Split Inference Model Deployment to Limit Input Reconstruction
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Unauthorized entities can potentially reconstruct input features from inferences generated by inference models, compromising sensitive data due to vulnerabilities in hardware resources, network security, and differing data privacy regulations.
Innovation Solution
Deploy a multipath inference model with a shared body portion at a trusted location and a prediction head portion at an untrusted location, trained using a modified split training process with weight freezing to reduce reconstructability of input features.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Productivity
If inference models are deployed at untrusted locations to provide computer-implemented services, then service availability and accessibility are improved, but the risk of unauthorized reconstruction of input features increases
Solution Approach 1:
The inference model is divided into two distinct portions: a shared body portion deployed at a trusted location and a prediction head portion deployed at an untrusted location. This segmentation allows the system to leverage the computational capabilities of untrusted locations for service delivery while protecting sensitive input data by keeping the vulnerable shared body portion isolated in a trusted environment. The prediction head portion receives processed features from the shared body and generates predictions without direct access to the original input data, thereby reducing reconstruction risk.
Solution Approach 2:
A trusted location acts as an intermediary between the untrusted location and the input data source. The trusted location hosts the shared body portion that processes input data and generates intermediate features, which are then transmitted to the prediction head portion at the untrusted location. This intermediary architecture enables service availability at untrusted locations while preventing direct access to sensitive input data, as the intermediary transforms and protects the data during transmission.
2Object-affected harmful factors
If the shared body portion is frozen during training to reduce reconstructability, then input feature protection is improved, but the training time and iterations required increase
Solution Approach 1:
The shared body portion is frozen after an initial training phase before the final training stage. This preliminary action of freezing weights prevents the shared body from being updated during the final training iterations, which reduces the reconstructability of input features by limiting the model's ability to adapt to specific input patterns. The freezing is performed at a predetermined stage in the training process, allowing the system to balance protection requirements with training efficiency.
Solution Approach 2:
Instead of continuously updating all model parameters during training, the system applies partial updates by freezing the shared body portion weights while allowing the prediction head portion weights to continue training. This partial action approach provides sufficient protection against input reconstruction while maintaining the functional capabilities of the model, avoiding the excessive action of completely preventing all weight updates which would render the model ineffective.
Data Source
AI summary
Methods, systems, and devices for providing computer-implemented services are disclosed. To provide the computer-implemented services, inference models may be deployed to locations to generate inferences. Prior to deploying an inference model to a location, it may be determined whether the location is trustworthy. If the location is determined to not be trustworthy, an input data attack resistant inference model may be selected and deployed. The input data attack resistant inference model may be based, at least in part, on a training process that includes a weight freezing process based on levels of reconstructability of input features based on inferences generated by the input data attack resistant inference model. The training process may decrease a likelihood of the inferences generated by the input data attack resistant inference model being usable to reconstruct input data used to generate the inferences. By doing so, sensitive input data may be protected during inference generation.