Selective Weight Encryption for Deep Learning Circuit Security
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing methods for encrypting deep learning circuits face challenges in balancing security with circuit area and power consumption, as encrypting all logics increases area and cost, while partial encryption may not significantly degrade accuracy, especially in deep learning applications where weight errors are tolerated.
Innovation Solution
An information processing apparatus and method that selectively identifies and encrypts weights influencing accuracy degradation, using a unit to evaluate inference accuracy until a target accuracy is reached, thereby encrypting only critical weights to maintain security without increasing circuit area.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If all logics are encrypted to prevent information leakage, then security is improved, but circuit area increases and power consumption increases
Solution Approach 1:
The patent divides the encryption task into segments by identifying and encrypting only critical weights (those with large absolute values) rather than all weights. This segmentation approach encrypts specific portions of the circuit that are most important for security, preventing information leakage while avoiding the need to encrypt the entire circuit, thus reducing circuit area overhead.
Solution Approach 2:
The patent applies different encryption treatments to different parts of the circuit based on their importance. Critical weights with large absolute values are encrypted, while less important weights remain unencrypted. This local quality approach ensures that security is strengthened where it matters most without unnecessarily increasing circuit area across the entire system.
2Reliability
If all logics are encrypted to prevent information leakage, then security is improved, but power consumption increases
Solution Approach 1:
The patent segments the encryption workload by selecting only critical weights for encryption based on their absolute values. By encrypting only a subset of weights rather than all weights, the power consumption associated with encryption operations is significantly reduced while still maintaining security against information leakage.
Solution Approach 2:
The patent applies encryption selectively to specific weights that have large absolute values and are therefore more critical for model accuracy. This local quality approach ensures that power is consumed only for encrypting the most important parameters, rather than wasting power encrypting all weights uniformly.
3Area of stationary object
If only some logics are encrypted to suppress circuit area increase, then circuit area is reduced, but accuracy degradation may be insufficient when incorrect decryption key is given
Solution Approach 1:
The patent identifies weights with large absolute values as critical and encrypts only those weights. These critical weights have a disproportionate impact on model accuracy, so encrypting them ensures that when an incorrect decryption key is provided, significant accuracy degradation occurs. This local quality approach focuses encryption resources on the most impactful weights.
Solution Approach 2:
The patent uses the absolute values of weights as a parameter to determine which weights to encrypt. By changing the selection criterion from random or uniform selection to selection based on absolute value magnitude, the patent ensures that encrypted weights are those that will cause the most significant accuracy degradation when incorrectly decrypted.
4Loss of time
If weights are embedded in ASIC circuit to shorten design period, then design time is reduced, but information leakage risk increases
Solution Approach 1:
The patent performs preliminary identification of critical weights by evaluating their absolute values before the ASIC manufacturing process. This preliminary action allows the system to determine which weights need encryption in advance, so that when weights are embedded in the ASIC circuit, only the critical ones are encrypted, providing security protection while maintaining the shortened design period benefit of ASIC implementation.
Solution Approach 2:
The patent applies encryption selectively to critical weights embedded in the ASIC circuit rather than encrypting all weights. This local quality approach ensures that information security is protected for the most important parameters while maintaining the efficiency and speed benefits of ASIC implementation with shortened design period.
Data Source
AI summary
Provided is an information processing apparatus configured for determining an encryption target from a plurality of weights of a model trained by deep learning, the information processing apparatus includes an encryption target weight selection means for selecting, from among the plurality of weights, a weight of an encryption target, an encryption target weight changing means for changing the selected weight in the trained model, an inference accuracy evaluation means for evaluating an inference accuracy of the trained model with the changed weight, and a control means for repeating selection of the weight by the encryption target weight selection unit until the inference accuracy reaches a target accuracy or less.