WO2024061052A1 - 模型的处理方法、基于模型的数据处理方法及相关装置 - Google Patents

模型的处理方法、基于模型的数据处理方法及相关装置 Download PDF

Info

Publication number
WO2024061052A1
WO2024061052A1 PCT/CN2023/118186 CN2023118186W WO2024061052A1 WO 2024061052 A1 WO2024061052 A1 WO 2024061052A1 CN 2023118186 W CN2023118186 W CN 2023118186W WO 2024061052 A1 WO2024061052 A1 WO 2024061052A1
Authority
WO
WIPO (PCT)
Prior art keywords
expression
calculation
branch
model
operator
Prior art date
Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
Ceased
Application number
PCT/CN2023/118186
Other languages
English (en)
French (fr)
Inventor
杨渊
金修浪
张澍坤
王泽�
Current Assignee (The listed assignees may be inaccurate. Google has not performed a legal analysis and makes no representation or warranty as to the accuracy of the list.)
Huawei Technologies Co Ltd
Original Assignee
Huawei Technologies Co Ltd
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by Huawei Technologies Co Ltd filed Critical Huawei Technologies Co Ltd
Priority to EP23867341.2A priority Critical patent/EP4582980A4/en
Publication of WO2024061052A1 publication Critical patent/WO2024061052A1/zh
Priority to US19/083,803 priority patent/US20250245302A1/en
Anticipated expiration legal-status Critical
Ceased legal-status Critical Current

Links

Classifications

    • G—PHYSICS
    • G06—COMPUTING OR CALCULATING; COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/10—Protecting distributed programs or content, e.g. vending or licensing of copyrighted material ; Digital rights management [DRM]
    • G06F21/12—Protecting executable software
    • G06F21/14—Protecting executable software against software analysis or reverse engineering, e.g. by obfuscation
    • G—PHYSICS
    • G06—COMPUTING OR CALCULATING; COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/70—Protecting specific internal or peripheral components, in which the protection of a component leads to protection of the entire computer
    • G06F21/71—Protecting specific internal or peripheral components, in which the protection of a component leads to protection of the entire computer to assure secure computing or processing of information
    • G06F21/72—Protecting specific internal or peripheral components, in which the protection of a component leads to protection of the entire computer to assure secure computing or processing of information in cryptographic circuits
    • G—PHYSICS
    • G06—COMPUTING OR CALCULATING; COUNTING
    • G06N—COMPUTING ARRANGEMENTS BASED ON SPECIFIC COMPUTATIONAL MODELS
    • G06N20/00—Machine learning
    • G—PHYSICS
    • G06—COMPUTING OR CALCULATING; COUNTING
    • G06N—COMPUTING ARRANGEMENTS BASED ON SPECIFIC COMPUTATIONAL MODELS
    • G06N3/00—Computing arrangements based on biological models
    • G06N3/02—Neural networks
    • G06N3/04—Architecture, e.g. interconnection topology
    • G—PHYSICS
    • G06—COMPUTING OR CALCULATING; COUNTING
    • G06N—COMPUTING ARRANGEMENTS BASED ON SPECIFIC COMPUTATIONAL MODELS
    • G06N3/00—Computing arrangements based on biological models
    • G06N3/02—Neural networks
    • G06N3/04—Architecture, e.g. interconnection topology
    • G06N3/045—Combinations of networks
    • G—PHYSICS
    • G06—COMPUTING OR CALCULATING; COUNTING
    • G06N—COMPUTING ARRANGEMENTS BASED ON SPECIFIC COMPUTATIONAL MODELS
    • G06N3/00—Computing arrangements based on biological models
    • G06N3/02—Neural networks
    • G06N3/06—Physical realisation, i.e. hardware implementation of neural networks, neurons or parts of neurons
    • G06N3/063—Physical realisation, i.e. hardware implementation of neural networks, neurons or parts of neurons using electronic means
    • G—PHYSICS
    • G06—COMPUTING OR CALCULATING; COUNTING
    • G06N—COMPUTING ARRANGEMENTS BASED ON SPECIFIC COMPUTATIONAL MODELS
    • G06N3/00—Computing arrangements based on biological models
    • G06N3/02—Neural networks
    • G06N3/08—Learning methods
    • G—PHYSICS
    • G06—COMPUTING OR CALCULATING; COUNTING
    • G06N—COMPUTING ARRANGEMENTS BASED ON SPECIFIC COMPUTATIONAL MODELS
    • G06N3/00—Computing arrangements based on biological models
    • G06N3/02—Neural networks
    • G06N3/08—Learning methods
    • G06N3/084—Backpropagation, e.g. using gradient descent
    • G—PHYSICS
    • G06—COMPUTING OR CALCULATING; COUNTING
    • G06N—COMPUTING ARRANGEMENTS BASED ON SPECIFIC COMPUTATIONAL MODELS
    • G06N3/00—Computing arrangements based on biological models
    • G06N3/02—Neural networks
    • G06N3/10—Interfaces, programming languages or software development kits, e.g. for simulating neural networks
    • G06N3/105—Shells for specifying net layout
    • G—PHYSICS
    • G06—COMPUTING OR CALCULATING; COUNTING
    • G06N—COMPUTING ARRANGEMENTS BASED ON SPECIFIC COMPUTATIONAL MODELS
    • G06N5/00—Computing arrangements using knowledge-based models
    • G06N5/01—Dynamic search techniques; Heuristics; Dynamic trees; Branch-and-bound

Definitions

  • This application relates to the technical field of Artificial Intelligence (AI), and in particular to a model processing method and related devices.
  • AI Artificial Intelligence
  • AI technology has ushered in rapid development.
  • fields such as computer vision, natural language processing, and speech recognition
  • AI systems have been deployed on a large scale, and more and more manufacturers are providing AI services.
  • AI service providers complete model training and tuning locally, they deploy the AI model to third-party platforms (such as terminal devices, edge devices, and cloud servers) to provide inference services.
  • third-party platforms such as terminal devices, edge devices, and cloud servers
  • a model protection solution based on encryption and decryption algorithms uses encryption algorithms to encrypt the AI model during transmission and storage, and decrypts the AI model into memory before performing inference on the AI model.
  • this solution can protect the confidentiality of the AI model, the entire AI model needs to be decrypted before each inference of the AI model is performed.
  • the computational overhead is huge, which will greatly extend the inference delay of the AI model and severely limit it.
  • the application of AI models is very large, which will greatly extend the inference delay of the AI model and severely limit it.
  • This application provides a model processing method that can protect the normal execution process of the entire AI model and reduce the additional performance overhead caused by model protection, which is conducive to the promotion and application of AI models.
  • the first aspect of this application provides a model processing method, which is applied to physical devices or virtual devices such as servers or terminal devices.
  • the method includes: the server obtains a first calculation graph by parsing the model file of the AI model.
  • the first calculation graph is used to indicate the execution logic of the AI model, and the first calculation graph includes at least one calculation graph. son. That is, the first calculation graph may implement execution logic indicating the AI model by indicating a dependency relationship between at least one operator.
  • the execution logic of the AI model may refer to executing the at least one operator in an orderly manner.
  • the server Based on the first calculation graph, the server generates a second calculation graph.
  • the second calculation graph includes at least one calculation branch, at least one confusion branch and a first expression.
  • the output of the first expression is used to indicate execution of at least one calculation branch. of branches or at least a branch within an obfuscated branch.
  • at least one operator in the first calculation graph is included in at least one calculation branch in the second calculation graph, and at least one calculation branch and at least one confusion branch have different calculation logics.
  • the confusion branch is a branch with operators, which can calculate the input data of the confusion branch through the operators in the confusion branch to obtain the output data.
  • the calculation logic of the confusion branch is different from that of the calculation branch, that is, the operators in the confusion branch are different from the operators in the calculation branch, so for the same input data, the confusion branch and the calculation branch can obtain different output data.
  • the server generates execution code corresponding to the AI model based on the second calculation graph.
  • the target code in the execution code is configured for encryption protection, and the target code is the code related to the first expression. Since in the second calculation graph, the output of the first expression can affect the execution between the calculation branch and the obfuscation branch in the second calculation graph, by encrypting and protecting the target code of the first expression, it can be achieved Protect the calculation logic of the second calculation graph. To put it simply, even if the attacker steals the AI model by stealing the execution code corresponding to the AI model, since the target code corresponding to the first expression is protected by encryption, the attacker cannot obtain the calculation logic of the first expression. As a result, the correct output value cannot be obtained, and the correct execution logic of the AI model cannot be obtained.
  • a confusion branch is added in parallel with the calculation branch in the AI model, and the execution relationship between the calculation branch and the confusion branch is determined through expressions. Only when the output of the expression is correct Only then can the correct calculation branch be executed. In this way, the explicit operator execution order and dependencies in the original model can be blurred through the new confusion branch, and the model structure can be scrambled. Only the newly added expressions need to be encrypted and protected, and the entire expression can be encrypted. The protection of the normal execution process of AI models reduces the additional performance overhead caused by model protection, which is conducive to the promotion and application of AI models.
  • the second calculation graph includes only one calculation branch, and the output of the first expression is used to indicate execution of the calculation branch and one of the at least one confusion branch.
  • the calculation branch in the second calculation graph includes all operators in the first calculation graph and the dependencies between all operators. Therefore, by executing a calculation branch in the second calculation graph, the first calculation can be realized.
  • the first expression may be connected to one calculation branch and at least one confusion branch respectively, and is used to instruct execution of any one of the calculation branch and the at least one confusion branch. Only when the output of the first expression is the preset target value, the calculation branch in the second calculation graph will be executed; otherwise, when the output of the first expression is not the preset target value, the second calculation graph will be executed.
  • connecting the first expression to the calculation branch and at least one confusion branch may mean that a jump to the calculation branch and at least one confusion branch based on the output value of the first expression is defined in the code. Therefore, after execution of the first expression, a jump can be made to execution of a calculation branch or at least one obfuscation branch.
  • the second calculation graph includes multiple calculation branches, and the second calculation graph further includes a second expression.
  • the output of the first expression is used to indicate executing one of the multiple calculation branches and at least one confusion branch;
  • the second expression is connected with the multiple calculation branches and at least one confusion branch, and the second expression is used to indicate the third The number of loop executions of an expression where the input of the first expression is related to the last executed branch.
  • connection between the second expression and the calculation branch and at least one confusion branch may mean that after executing any one of the multiple calculation branches and at least one confusion branch in the code, it will jump to the execution of the second expression. . Therefore, after executing any one calculation branch or obfuscation branch, it is possible to jump to the second expression, so that the second expression indicates whether to continue the loop execution of the first expression.
  • the input of the second expression is related to the last executed branch, and the output of the second expression is used to indicate whether to execute the first expression in a loop.
  • the first expression is run based on the input value to obtain the output value of the first expression; then, the execution branch is determined based on the output value of the first expression.
  • execute the second expression to determine whether to continue looping execution of the first expression.
  • the first expression is continued to be executed to determine the next branch to be executed.
  • the initial input of the first expression includes a first value
  • the first value is configured for encryption protection.
  • the first value is configured to run in a trusted execution environment; or the first value is configured to be encrypted using an encryption algorithm.
  • the initial input of the first expression can be fixed. Only when the initial input of the first expression is the first value, the first expression can output the correct value, so that the calculation logic of the second calculation graph and The calculation logic of the first calculation graph is the same.
  • the first value as encryption protection, the output of the first expression can be protected. Even if the attacker obtains the entire second calculation graph, he will be unable to obtain the correct input value of the first expression. The correct calculation logic of the second calculation graph cannot be obtained, thereby protecting the confidentiality of the model.
  • the target code is configured to run in a trusted execution environment, and/or the target code is configured to perform code obfuscation.
  • the terminal device can load the target code into the trusted execution environment.
  • the target code is run in a trusted execution environment, thereby realizing encryption protection of the target code based on the trusted execution environment.
  • the target code when the target code is configured for code obfuscation, the target code will be converted into a code with the same function but difficult to read and understand, thereby realizing protection of the target code without affecting the normal execution of the target code.
  • the target code is configured to be encrypted and protected using an encryption algorithm.
  • the terminal device needs to first use a decryption algorithm to decrypt the target code before it can obtain the decrypted code, and thereby obtain the first expression based on the decrypted code.
  • the encryption algorithm may be the Advanced Encryption Standard (AES) algorithm, the Data Encryption Standard (DES) algorithm, the International Data Encryption Algorithm (IDEA), and the RSA algorithm.
  • the method further includes: the server obtains a third calculation graph, the third calculation graph is used to indicate the execution logic of the AI model, and the third calculation graph includes the first operator.
  • the third calculation graph and the above-mentioned first calculation graph can be two different calculation graphs in the AI model; the third calculation graph can also be a sub-calculation graph of the first calculation graph, that is, the third calculation graph includes The first operator belongs to one of a plurality of operators in the first calculation graph.
  • the server Based on the third calculation graph, the server generates a fourth calculation graph.
  • the fourth calculation graph includes a second operator and a third expression.
  • the second operator is obtained by modifying the weight parameter of the first operator.
  • the third expression The inputs to include the output of the second operator, and the output of the third expression is the same as the output of the first operator given the same inputs as the second operator.
  • the server generates execution code corresponding to the AI model based on the second computation graph and the fourth computation graph.
  • the explicit operators in the AI model can be effectively obfuscated, effectively preventing attackers from stealing the AI model by misappropriating the operators in the AI model, and protecting the confidentiality of the AI model.
  • the weight parameter of the second operator is obtained by modifying the weight parameter of the first operator based on the second value
  • the input of the third expression includes the second value
  • the second value is Configured for encryption protection.
  • the third expression when the input of the third expression is incorrect, the third expression cannot convert the output of the second operator into the output of the first operator. Therefore, by encrypting and protecting the first value, the calculation logic in the fourth calculation graph can be protected, thereby protecting the normal execution process of the entire AI model and reducing the additional performance overhead caused by model protection. .
  • the second aspect of this application provides a model-based data processing method, which is applied to devices deployed with AI models, such as physical devices or virtual devices such as servers or terminal devices.
  • the method includes: based on the execution code of the AI model, the terminal device obtains a second calculation graph, the second calculation graph includes at least one calculation branch, at least one confusion branch and a first expression.
  • the output of an expression is used to indicate the execution of a branch in at least one calculation branch or a branch in at least one confusion branch.
  • the at least one calculation branch includes an operator of at least one AI model.
  • the at least one calculation branch has a different value from the at least one confusion branch.
  • the target code in the execution code is configured for encryption protection, the target code is the code related to the first expression; the terminal device obtains the input data of the AI model; the terminal device performs the calculation based on the second calculation graph The input data is processed to obtain the output data of the AI model.
  • the second calculation graph includes only one calculation branch; the output of the first expression is used to indicate execution of the calculation branch and at least one branch of the confusion branch.
  • the second calculation graph includes multiple calculation branches, and the second calculation graph also includes a second expression; the output of the first expression is used to indicate execution of multiple calculation branches and at least one confusion branch.
  • a branch in; the second expression is connected with a plurality of calculation branches and at least one confusion branch, and the second expression is used to indicate the number of loop executions of the first expression.
  • the input of the second expression is related to the last executed branch, and the output of the second expression is used to indicate whether to execute the first expression in a loop.
  • the initial input of the first expression includes a first value
  • the first value is configured for encryption protection.
  • the target code is configured to run in a trusted execution environment, and/or the target code is configured to perform code obfuscation.
  • the target code is configured to be encrypted and protected using an encryption algorithm.
  • the terminal device can decrypt the target code in the execution code to obtain the decrypted code; and the terminal device executes the decrypted code to obtain the first expression.
  • the method also includes: based on the execution code of the AI model, obtaining a fourth calculation graph.
  • the fourth calculation graph includes a second operator and a third expression, and the second operator is a function of the AI model. obtained by modifying the weight parameter of the first operator in , the input of the third expression includes the output of the second operator, and the output of the third expression is the same as the first operator when using the same input as the second operator.
  • the output is the same; processing the input data based on the second calculation graph includes: processing the input data based on the second calculation graph and the fourth calculation graph.
  • the weight parameter of the second operator is obtained by modifying the weight parameter of the first operator based on the second value
  • the input of the third expression includes the second value
  • the second value is configured to be encrypted and protected.
  • a third aspect of the present application provides a model processing device, including: an acquisition module, configured to acquire a first calculation graph.
  • the first calculation graph is used to indicate the execution logic of the artificial intelligence AI model.
  • the first calculation graph includes at least one operator; a processing module configured to generate a second calculation graph based on the first calculation graph, the second calculation graph including at least one calculation branch, at least one confusion branch and a first expression, the first The output of the expression is used to indicate execution of a branch in the at least one calculation branch or a branch in the at least one confusion branch, the at least one operator is included in the at least one calculation branch, the at least one calculation branch Having different calculation logic from the at least one confusion branch; a processing module configured to generate execution code corresponding to the AI model according to the second calculation graph, and the target in the execution code related to the first expression
  • the code is configured for encryption protection.
  • the second computation graph includes only one computation branch; and the output of the first expression is used to indicate the execution of the computation branch and one of the at least one obfuscation branch.
  • the second calculation graph includes a plurality of calculation branches, and the second calculation graph further includes a second expression; the output of the first expression is used to indicate execution of the multiple calculation branches. one of the calculation branches and the at least one confusion branch; the second expression is connected to the plurality of calculation branches and the at least one confusion branch, and the second expression is used to indicate the first The number of loop executions of the expression, and the input of the first expression is related to the last executed branch.
  • the input of the second expression is related to the last executed branch, and the output of the second expression is used to indicate whether to execute the first expression in a loop.
  • the initial input of the first expression includes a first value
  • the first value is configured for encryption protection.
  • the target code is configured to run in a trusted execution environment, and/or the target code is configured to perform code obfuscation.
  • the target code is configured to be encrypted and protected using an encryption algorithm.
  • the acquisition module is also used to acquire a third calculation graph.
  • the third calculation graph is used to indicate the execution logic of the AI model.
  • the third calculation graph includes a first calculation graph. sub; the processing module is further configured to: generate a fourth calculation graph based on the third calculation graph, the fourth calculation graph includes a second operator and a third expression, the second operator is a pair The weight parameters of the first operator are modified, and the input of the third expression includes the output of the second operator, and the output of the third expression is the same as that of the first operator using The output of the same input as the second operator is the same; the execution code corresponding to the AI model is generated according to the second calculation graph and the fourth calculation graph.
  • the weight parameter of the second operator is obtained by modifying the weight parameter of the first operator based on the second value, and the input of the third expression includes the third Two values, and the second value is configured for encryption protection.
  • a fourth aspect of the present application provides a model-based data processing device, including: an acquisition module, configured to acquire a second calculation graph based on the execution code of the AI model, where the second calculation graph includes at least one calculation branch, at least one confusion a branch and a first expression, the output of which is used to indicate execution of a branch in the at least one computation branch or a branch in the at least one obfuscation branch, the at least one computation branch including at least one of the The operator of the AI model, the at least one calculation branch and the at least one confusion branch have different calculation logic, the target code related to the first expression in the execution code is configured for encryption protection; the acquisition The module is also used to obtain the input data of the AI model; the processing module is also used to process the input data based on the second calculation graph to obtain the output data of the AI model.
  • the second calculation graph includes only one calculation branch; the output of the first expression is used to indicate execution of the calculation branch and one of the at least one confusion branches.
  • the second calculation graph includes a plurality of calculation branches, and the second calculation graph further includes a second expression; the output of the first expression is used to indicate execution of the multiple calculation branches. one of the calculation branches and the at least one confusion branch; the second expression is connected to the plurality of calculation branches and the at least one confusion branch, and the second expression is used to indicate the first The number of loop executions of the expression, and the input of the first expression is related to the last executed branch.
  • the input of the second expression is related to the last executed branch, and the output of the second expression is used to indicate whether to execute the first expression in a loop.
  • the initial input of the first expression includes a first value
  • the first value is configured for encryption protection.
  • the target code is configured to run in a trusted execution environment, and/or the target code is configured to perform code obfuscation.
  • the target code is configured to be encrypted and protected by an encryption algorithm; the processing module is also used to decrypt the target code in the execution code to obtain a decrypted code; and execute the decrypted code to obtain the first expression.
  • the acquisition module is also used to acquire a fourth calculation graph based on the execution code of the AI model, where the fourth calculation graph includes a second operator and a third expression, so The second operator is obtained by modifying the weight parameter of the first operator in the AI model, the input of the third expression includes the output of the second operator, and the The output is the same as the output of the first operator when using the same input as the second operator; the processing module is also configured to calculate the second calculation graph based on the second calculation graph and the fourth calculation graph. Enter data for processing.
  • the weight parameter of the second operator is obtained by modifying the weight parameter of the first operator based on the second value, and the input of the third expression includes the third Two values, and the second value is configured for encryption protection.
  • a fifth aspect of the present application provides an electronic device.
  • the electronic device includes: a memory and a processor; the memory stores code, the processor is configured to execute the code, and when the code is executed, the The electronic device performs the method in any implementation manner in the first aspect.
  • a sixth aspect of the present application provides an electronic device.
  • the electronic device includes: a memory and a processor; the memory stores code, and the processor is configured to execute the code. When the code is executed, the The electronic device performs the method in any implementation manner in the second aspect.
  • a seventh aspect of this application provides an AI system, which includes: a model processing device as described in any implementation manner of the third aspect, and a model-based data processing device as described in any implementation manner of the fourth aspect.
  • An eighth aspect of the present application provides a computer-readable storage medium.
  • the computer-readable storage medium stores a computer program that, when run on a computer, causes the computer to execute any one of the first aspect or the second aspect. Ways to implement it.
  • a ninth aspect of the present application provides a computer program product that, when run on a computer, causes the computer to execute the method implemented in any one of the first aspect or the second aspect.
  • a tenth aspect of this application provides a chip including one or more processors. Part or all of the processor is used to read and execute the computer program stored in the memory to execute the method in any one of the above-mentioned implementations of the first aspect or the second aspect.
  • the chip should include a memory, and the memory and the processor are connected to the memory through circuits or wires.
  • the chip also includes a communication interface, and the processor is connected to the communication interface.
  • the communication interface is used to receive data and/or information that needs to be processed.
  • the processor obtains the data and/or information from the communication interface, processes the data and/or information, and outputs the processing results through the communication interface.
  • the communication interface may be an input-output interface.
  • Figure 1 is a schematic diagram of a clear text deployment of a model file provided by an embodiment of the present application
  • Figure 2 is a schematic diagram of a model file encryption deployment provided by an embodiment of the present application.
  • Figure 3 is a schematic diagram of an application scenario of a model processing method provided by an embodiment of the present application.
  • Figure 4 is a schematic flowchart of a model processing method provided by an embodiment of the present application.
  • Figure 5A is a schematic structural diagram of generating a second calculation graph based on a first calculation graph according to an embodiment of the present application
  • Figure 5B is another structural schematic diagram of generating a second calculation graph based on a first calculation graph according to an embodiment of the present application
  • Figure 6A is another structural schematic diagram of generating a second calculation graph based on a first calculation graph according to an embodiment of the present application
  • Figure 6B is a schematic diagram of the operation of a second calculation graph provided by the embodiment of the present application.
  • Figure 7A is another structural schematic diagram of generating a second calculation graph based on a first calculation graph according to an embodiment of the present application
  • FIG7B is a schematic diagram of executing a second computation graph provided in an embodiment of the present application.
  • Figure 8 is another structural schematic diagram of generating a second calculation graph based on a first calculation graph according to an embodiment of the present application
  • Figure 9 is a schematic diagram of obtaining a fourth calculation graph based on a third calculation graph provided by an embodiment of the present application.
  • Figure 10 is a schematic flow chart of a model-based data processing method provided by an embodiment of the present application.
  • Figure 11 is a schematic flow chart of a processing model provided by the embodiment of the present application and data processing based on the model;
  • Figure 12 is a schematic structural diagram of a model processing device provided by an embodiment of the present application.
  • FIG13 is a schematic diagram of the structure of a model-based data processing device provided in an embodiment of the present application.
  • FIG14 is a schematic diagram of a structure of an execution device provided in an embodiment of the present application.
  • Figure 15 is a schematic structural diagram of a chip provided by an embodiment of the present application.
  • Figure 16 is a schematic structural diagram of a computer-readable storage medium provided by an embodiment of the present application.
  • the naming or numbering of steps in this application does not mean that the steps in the method flow must be executed in the time/logical sequence indicated by the naming or numbering.
  • the process steps that have been named or numbered can be implemented according to the purpose to be achieved. The order of execution can be changed for technical purposes, as long as the same or similar technical effect can be achieved.
  • the division of units presented in this application is a logical division. In actual applications, there may be other divisions. For example, multiple units may be combined or integrated into another system, or some features may be ignored. , or not executed.
  • the coupling or direct coupling or communication connection between the units shown or discussed may be through some interfaces, and the indirect coupling or communication connection between units may be electrical or other similar forms. There are no restrictions in the application.
  • the units or subunits described as separate components may or may not be physically separated, may or may not be physical units, or may be distributed into multiple circuit units, and some or all of them may be selected according to actual needs. unit to achieve the purpose of this application plan.
  • AI is a theory, method, technology and application system that uses digital computers or machines controlled by digital computers to simulate, extend and expand human intelligence, perceive the environment, acquire knowledge and use knowledge to obtain the best results.
  • AI is a comprehensive technology of computer science that attempts to understand the essence of intelligence and produce a new intelligent machine that can respond in a manner similar to human intelligence.
  • AI is the study of the design principles and implementation methods of various intelligent machines, so that the machines have the functions of perception, reasoning and decision-making.
  • AI model is a technical means in AI technology used to handle specific tasks.
  • an AI model can be a neural network composed of neural units.
  • AI models are run on the model owner’s device or platform (e.g., server, virtual machine, VM) or container (container), the trained AI model will be stored in the form of a model file.
  • the model user's device such as terminal device, server or edge device, VM or container, etc.
  • the model user's device can actively load the model file of the AI model; it can also be owned by the model.
  • the user's device actively sends the model file of the AI model to the model user's device, so that the model user's device can load and execute the model file of the AI model.
  • the server is a physical machine.
  • VMs or containers can be virtualized devices that are divided into virtualized devices on the hardware resources of a physical machine.
  • Terminal equipment also called user equipment (UE)
  • UE user equipment
  • UE user equipment
  • the terminal device can be, for example, a smartphone (mobile phone), a tablet computer (pad), a computer with wireless transceiver functions, an Internet of Things device, a virtual reality (VR) terminal, an augmented reality (AR) ) terminal, wireless terminal in industrial control, wireless terminal in self-driving, wireless terminal in remote medical, wireless terminal in smart grid, transportation security Wireless terminals in transportation safety, wireless terminals in smart cities, wireless terminals in smart homes, etc.
  • a smartphone mobile phone
  • a tablet computer pad
  • a computer with wireless transceiver functions an Internet of Things device
  • VR virtual reality
  • AR augmented reality
  • wireless terminal in industrial control wireless terminal in self-driving
  • wireless terminal in remote medical wireless terminal in smart grid
  • transportation security Wireless terminals in transportation safety wireless terminals in smart cities, wireless terminals in smart homes, etc.
  • a computational graph is a way to represent mathematical functions using graph theory, that is, to graphically represent the computational process.
  • a computational graph is defined as a directed graph consisting of nodes and edges.
  • input values and computational functions appear in the form of nodes, and the relationship between the output items of the nodes is represented by directed lines (i.e., edges between nodes).
  • An expression is a combination of numbers, operators, number grouping symbols (parentheses), free variables and constraint variables, etc., in a meaningful arrangement that can yield numerical values.
  • an expression is a formula composed of operands and operators, and is a computer instruction with complete meaning. For example, the expression could be (x+6)*3*COS(1)/2*8+7.
  • An opaque predicate is an expression.
  • the value of an opaque predicate is known to the author of the opaque predicate at a certain point in the execution, but the compiler or static analyzer cannot infer this value and can only determine the value of the opaque predicate when the opaque predicate is run.
  • Trusted execution environment refers to building a secure area in the central processor through software and hardware methods to ensure that the confidentiality and integrity of the programs and data loaded inside are protected. Simply put, the trusted execution environment is a secure area within the central processor. The central processor is used to ensure that the confidentiality and integrity of the code and data in the trusted execution environment are protected, that is, the code and data running in the trusted execution environment are protected. Code and data are confidential and cannot be tampered with.
  • Code obfuscation also known as code obfuscation, is the act of converting computer program code into a form that is functionally equivalent but difficult to read and understand. Code obfuscation can be used for program source code or for intermediate code compiled by the program. Programs that perform code obfuscation are called code obfuscators.
  • code obfuscation can refer to rewriting the names of various elements in the code (such as variables, functions, classes) into meaningless names. For example, rewriting the elements in the code into a single letter, or a short meaningless letter combination, or even into a symbol such as "__" makes it impossible for readers to guess its purpose based on the name.
  • Code obfuscation can also involve rewriting part of the logic in the code into a form that is functionally equivalent but harder to understand. For example, rewrite the for loop into a while loop, rewrite the loop into recursion, streamline intermediate variables, etc. Code obfuscation can also disrupt the format of the code. For example, remove spaces, squeeze multiple lines of code into one line, or break one line of code into multiple lines, etc.
  • AI service providers generally complete the training and tuning of AI models in the local model training environment, obtain the model files corresponding to the AI models, and then deploy the AI models to the model deployment environment of the model users in the form of model files. (such as terminal equipment).
  • model files of the AI model are deployed in the model deployment environment in clear text, they are vulnerable to theft by criminals.
  • Figure 1 is a schematic diagram of a model file plain text deployment provided by an embodiment of the present application.
  • AI service providers The AI model is trained in the model training environment and the model file of the AI model is generated. Then, the AI service provider deploys the clear text model file to the model deployment environment, so that the AI computing framework in the model deployment environment can execute the AI model by importing the model file.
  • the model files are deployed in the model deployment environment in clear text, criminals can directly steal the model files from the model deployment environment by attacking the model deployment environment, and then obtain the stolen models.
  • Figure 2 is a schematic diagram of a model file encryption deployment provided by an embodiment of the present application.
  • the AI service provider trains the AI model in the model training environment and generates the model file of the AI model. Then, the AI service provider uses an encryption algorithm to encrypt the model file, and deploys the encrypted model file to the model deployment environment of the model user.
  • the application triggers the decryption of the model file and decrypts the model file into the memory, thereby executing the AI model in the memory.
  • the embodiment of the present application provides a model processing method.
  • a confusion branch is added in parallel with the calculation branch in the AI model, and the calculation branch and the sum of the calculation branches are determined through expressions. Confusing the execution relationship between branches, the correct calculation branch can only be executed when the output of the expression is correct. In this way, the explicit operator execution order and dependencies in the original model can be blurred through the new confusion branch, and the model structure can be scrambled. Only the newly added expressions need to be encrypted and protected, and the entire expression can be encrypted. The protection of the normal execution process of AI models reduces the additional performance overhead caused by model protection, which is conducive to the promotion and application of AI models.
  • Figure 3 is a schematic diagram of an application scenario of a model processing method provided by an embodiment of the present application.
  • the calculation graph corresponding to the original model file is obtained by parsing the original model file.
  • the obtained calculation graph is processed through the model processing method provided by the embodiment of the present application, and a confusion state model file is generated based on the processed calculation graph.
  • the obfuscated model file can be deployed in the model user environment.
  • the AI application can obtain the confused model file and inference data, and load the confused model.
  • inference can be performed based on the confusion model and inference results can be obtained.
  • the model processing method and the model-based data processing method provided by the embodiments of the present application can be applied to electronic devices or virtualization devices.
  • the electronic devices are, for example, the above-mentioned servers and terminal devices;
  • the virtualization device is, for example, The virtual machines and containers mentioned above.
  • the methods provided by the embodiments of the present application will be introduced in sequence from the model processing stage and the model usage stage. Moreover, for the convenience of description, the method provided by the embodiment of the present application will be introduced below by taking the example that the processing phase of the model is executed on the server and the usage phase of the model is executed on the terminal device. In actual applications, the processing phase of the model is not limited to execution on the server, and the use phase of the model is not limited to execution on the terminal device.
  • FIG. 4 is a schematic flowchart of a model processing method provided by an embodiment of the present application. As shown in Figure 4, the model processing method includes the following steps 401-403.
  • Step 401 Obtain a first calculation graph.
  • the first calculation graph is used to indicate the execution logic of the AI model.
  • the first calculation graph includes at least one operator.
  • the server may obtain the first calculation graph by parsing the model file of the AI model.
  • the first calculation graph may indicate part of the execution logic of the AI model, or the first calculation graph may indicate the entire execution logic of the entire AI model.
  • an AI model will include multiple computing units, such as convolution units, pooling units or addition units and other types of units used to perform corresponding calculations.
  • Each computing unit can be called an operator.
  • the execution logic of the AI model is the order in which each computing unit is executed and the dependencies between each computing unit. Therefore, when a calculation graph is used to represent the calculation units in the AI model and the input or output relationships between the calculation units, the above-mentioned first calculation graph can indicate the execution logic of the AI model.
  • the first calculation graph may include all operators or some operators in the AI model. Moreover, there may be one or more types of operators in the first calculation graph, and there may also be one or more operators of the same type.
  • the type of operator usually represents the computational properties of the operator. properties, such as: convolution type, pooling type, addition type, batch normalization type or linear correction type, etc.
  • the convolution type operator refers to the operator used to perform convolution operations
  • the pooling type operator refers to the operator used to perform pooling operations
  • the addition type operator refers to the operator used to perform pooling operations.
  • Operators that perform addition operations batch normalization type operators refer to operators used for batch normalization
  • linear correction type operators refer to operators used for linear correction.
  • each operator will have a unique identifier or unique name, such as: convolution operator 1, convolution operator 2, pooling operator 1 or addition operator 1, etc.
  • the user can specify the operators in the AI model that need to be obfuscated. For example, the user specifies that one or more operators in the AI model need to be obfuscated; or, the user specifies that one or more types of operators in the AI model need to be obfuscated.
  • the server parses the model file of the AI model, it can determine the first calculation graph based on the operators that require obfuscation protection specified by the user.
  • the first calculation graph includes the operators that require obfuscation protection.
  • Step 402 Generate a second calculation graph based on the first calculation graph.
  • the second calculation graph includes at least one calculation branch, at least one confusion branch and a first expression.
  • the output of the first expression is used to indicate execution of at least one calculation branch or A branch in at least one confusion branch, at least one operator included in at least one calculation branch, at least one calculation branch and at least one confusion branch have different calculation logic.
  • the first expression in the second calculation graph, may be connected to at least one calculation branch and at least one confusion branch. Moreover, in the process of executing the second calculation graph, the first expression is first executed, and at least one calculation branch or a branch in at least one confusion branch is selected to be executed according to the output of the first expression. Only when the output of the first expression is the preset target value, at least one of the above calculation branches is executed; when the output of the first expression is not the preset target value, then at least one of the above confusion branches is executed .
  • the preset target value may include one or more values.
  • At least one operator in the first calculation graph is included in at least one calculation branch of the second calculation graph. Therefore, when the output of the first expression is the preset target value, at least one calculation branch in the second calculation graph is executed, thereby ensuring that the actual calculation logic is the same as that of the original AI model; when the output of the first expression is not When the target value is preset, at least one confusion branch in the second calculation graph is executed, so that the actual calculation logic is different from the calculation logic of the original AI model, thereby realizing the protection of the AI model.
  • Step 403 Generate execution code corresponding to the AI model based on the second calculation graph.
  • the target code in the execution code is configured for encryption protection, and the target code is the code related to the first expression.
  • the server can generate execution code corresponding to the AI model according to the calculation logic of the second calculation graph, so as to facilitate the deployment of the AI model to other devices.
  • the target code related to the first expression is configured for encryption protection, while the codes in other parts of the execution code may not be configured for encryption protection.
  • the output of the first expression can affect the execution between the calculation branch and the obfuscation branch in the second calculation graph, by encrypting and protecting the target code of the first expression, it can be achieved Protect the calculation logic of the second calculation graph. To put it simply, even if the attacker steals the AI model by stealing the execution code corresponding to the AI model, since the target code corresponding to the first expression is protected by encryption, the attacker cannot obtain the calculation logic of the first expression. As a result, the correct output value cannot be obtained, and the correct execution logic of the AI model cannot be obtained.
  • a confusion branch is added in parallel with the calculation branch in the AI model, and the execution relationship between the calculation branch and the confusion branch is determined through expressions. Only when the expression Only when the output of the formula is correct can the correct calculation branch be executed. In this way, the explicit operator execution order and dependencies in the original model can be blurred through the new confusion branch, and the model structure can be scrambled. Only the newly added expressions need to be encrypted and protected, and the entire expression can be encrypted. The protection of the normal execution process of AI models reduces the additional performance overhead caused by model protection, which is conducive to the promotion and application of AI models.
  • the target code related to the first expression is configured to run in a trusted execution environment.
  • the terminal device loads the target code into a trusted execution environment and runs it, thereby achieving encryption protection of the target code based on the trusted execution environment.
  • the trusted execution environment is a safe area built in the central processor based on software and hardware methods, when the target code is configured to run in the trusted execution environment, a model user is required
  • the terminal device itself supports a trusted execution environment, that is, it has certain hardware requirements for the terminal device that needs to load the AI model.
  • the target code is configured to perform code obfuscation.
  • code obfuscation the target code will be converted into code with the same functionality but difficult to read and understand, thereby protecting the target code without affecting the normal execution of the target code.
  • the target code is configured to be encrypted and protected using an encryption algorithm.
  • the encryption algorithm may be, for example, the Advanced Encryption Standard (AES) algorithm, the Data Encryption Standard (DES) algorithm, the International Data Encryption Algorithm (IDEA), and the RSA algorithm.
  • AES Advanced Encryption Standard
  • DES Data Encryption Standard
  • IDEA International Data Encryption Algorithm
  • the server may also use the above-mentioned multiple implementation methods to simultaneously encrypt and protect the target code related to the first expression.
  • the target code is configured to run in a trusted execution environment, and the target code is also configured to be encrypted and protected using an encryption algorithm.
  • the terminal device can decrypt the target code in a trusted execution environment to obtain the decrypted code, and thereby obtain the first expression based on the decrypted code; or , the terminal device may decrypt the target code and run the decrypted code in a trusted execution environment, thereby obtaining the first expression.
  • the first expression itself may also be protected.
  • the first expression may be an opaque predicate, and the server uses the opaque predicate as the first expression. In this way, when the target code corresponding to the first expression is obtained, the value of the first expression cannot be inferred through the target code. Instead, the value of the first expression can only be obtained during the process of running the target code, thus Implement hidden protection of the first expression.
  • the server there are multiple ways for the server to generate the second calculation graph based on the first calculation graph.
  • the server generates a second calculation graph having one calculation branch, at least one confusion branch and the first expression.
  • the calculation branch in the second calculation graph includes at least one operator in the first calculation graph, and the output of the first expression is used to indicate execution of the calculation branch and one branch of the at least one confusion branch.
  • a calculation branch in the second calculation graph includes all operators in the first calculation graph and the dependencies between all operators.
  • the calculation logic in the first calculation graph can be realized.
  • the first expression may be connected to one calculation branch and at least one confusion branch respectively, and is used to instruct execution of any one of the calculation branch and the at least one confusion branch. Only when the output of the first expression is correct, the calculation branch in the second calculation graph will be executed; otherwise, when the output of the first expression is wrong, one of at least one confusion branch in the second calculation graph will be executed. branch.
  • FIG. 5A is a schematic structural diagram of generating a second calculation graph based on a first calculation graph according to an embodiment of the present application.
  • the first calculation graph includes three operators connected in sequence, namely a convolution operator, a batch normalization operator and a linear correction operator.
  • the input of the convolution operator is the input of the first calculation graph
  • the input of the batch normalization operator is the output of the convolution operator
  • the input of the linear correction operator is the output of the batch normalization operator
  • the linear correction operator The output of the operator is the output of the first calculation graph.
  • the convolution operator, batch normalization operator and linear correction operator connected in sequence become a calculation branch in the second calculation graph.
  • the second calculation graph also includes a confusion branch parallel to the calculation branch, and both the calculation branch and the confusion branch are connected to the first expression.
  • the executed branch is determined based on the value output by the first expression. Specifically, when the value output by the first expression is the preset target value, the calculation branch is executed to implement the calculation logic as shown in the first calculation graph, so that the output of the second calculation graph is consistent with the first calculation graph. The output of The output of the computational graph is different.
  • FIG. 5B is another structural schematic diagram of generating a second calculation graph based on a first calculation graph according to an embodiment of the present application.
  • the first calculation graph in Figure 5B is the same as the first calculation graph shown in Figure 5A; and, the calculation branch of the second calculation graph in Figure 5B is the same as the calculation branch of the first calculation graph in Figure 5A
  • the difference is that the second calculation graph in Figure 5B includes multiple confusion branches, namely confusion branch 1, confusion branch 2...confusion branch N.
  • Implementation 2 The server generates a second calculation graph having multiple calculation branches, at least one confusion branch and the first expression.
  • the first expression is connected with a plurality of calculation branches and at least one confusion branch, and is used to indicate orderly execution of a plurality of branches in the plurality of calculation branches and at least one confusion branch.
  • the first expression is used to indicate the orderly execution of multiple calculation branches; when the value output by the first expression is not the preset target value, the first expression Expressions are used to indicate the execution of multiple other branches in order or the execution of multiple calculation branches out of order.
  • the calculation logic of the second calculation graph is the same as that of the first calculation graph only when the output of the first expression is the preset target value; when the output of the first expression is not the preset target value value, the calculation logic of the second calculation graph is not the same as the calculation logic of the first calculation graph.
  • FIG. 6A is another schematic structural diagram of generating a second calculation graph based on a first calculation graph according to an embodiment of the present application.
  • the first calculation graph in FIG. 6A is the same as the first calculation graph shown in FIG. 5A.
  • the second calculation graph in FIG. 6A includes a plurality of parallel calculation branches and a plurality of confusion branches, and each calculation branch of the plurality of calculation branches includes an operator.
  • the first branch is the calculation branch including the convolution operator
  • the second branch is the confusion branch 1
  • the third branch The first branch is the calculation branch including the batch normalization operator
  • the fourth branch is the confusion branch 2
  • the fifth branch is the calculation branch including the linear correction operator
  • the sixth branch is the confusion branch 3.
  • the above six branches are also connected to a judgment expression, which is used to determine the number of executed branches; and the judgment expression is connected to the first expression, and is used to determine each time based on the output value of the first expression. The next branch to continue execution after executing one branch.
  • FIG. 6B is a schematic diagram of the operation of a second calculation graph provided by an embodiment of the present application.
  • the execution steps of the second calculation graph include a total of 7 steps.
  • Step 1 Run the first expression, and determine to execute a calculation branch including a convolution operator based on the output value of the first expression.
  • Step 2 Execute the convolution operator and determine whether the three branches have been executed based on the judgment expression.
  • Step 3 Based on the output value of the first expression, the judgment formula determines that the second branch to be executed is the calculation branch including the batch normalization operator.
  • Step 4 Execute the batch normalization operator and determine whether the three branches have been executed based on the judgment expression.
  • Step 5 Based on the output value of the first expression, the judgment expression determines that the third branch to be executed is the calculation branch including the linear correction operator.
  • Step 6 Execute the linear correction operator and determine whether the three branches have been executed based on the judgment expression.
  • Step 7 The judgment expression outputs the result obtained by executing the linear correction operator as the output value.
  • the calculation logic of the second calculation graph is not to execute the first branch, the third branch and the fifth branch in sequence, so that the second calculation The calculation logic of the graph is different from the calculation logic of the first calculation graph.
  • the calculation logic of the second calculation graph may be to execute the second branch, the fourth branch and the sixth branch in sequence.
  • the calculation logic of the second calculation graph may be to execute the second branch, the third branch and the fourth branch in sequence.
  • Implementation manner 3 the server generates a second calculation graph having multiple calculation branches, at least one confusion branch, a first expression and a second expression.
  • the output of the first expression is used to indicate executing one of the plurality of calculation branches and at least one confusion branch.
  • the second expression is connected with a plurality of calculation branches and at least one confusion branch, and the second expression is used to indicate the number of loop executions of the first expression.
  • the input of the first expression is related to the last executed branch.
  • the input of the second expression is related to the last executed branch, and the output of the second expression is used to indicate whether to loop the first expression.
  • the first expression is run based on the input value to obtain the output value of the first expression; then, the execution branch is determined based on the output value of the first expression.
  • the second expression is executed to determine whether to continue looping the first expression.
  • the first expression is continued to be executed to determine the next branch to be executed.
  • Figure 7A is another method for generating a second calculation graph based on a first calculation graph according to an embodiment of the present application. Schematic. As shown in FIG. 7A, the first calculation graph in FIG. 7A is the same as the first calculation graph shown in FIG. 5A. Moreover, the second calculation graph in FIG. 7A includes a plurality of parallel calculation branches and a plurality of confusion branches, and each calculation branch of the plurality of calculation branches includes an operator. In addition, for each of the multiple calculation branches and the multiple confusion branches, there are calculation expressions within the branch (ie, expressions such as P1, P2, P3, P4, P5, P6, etc.), and these calculation expressions are used to give Variable next is assigned a value.
  • branch ie, expressions such as P1, P2, P3, P4, P5, P6, etc.
  • the first expression includes two inputs, one input is used as the input of the subsequently executed branch, and the other input is the variable next.
  • the first expression is used to obtain the corresponding output based on the value of the variable next.
  • the second expression determines whether to continue the first expression based on the value assigned to the variable next in the previously executed branch.
  • FIG. 7B is a schematic diagram of executing a second calculation graph provided by an embodiment of the present application.
  • the first expression is a selection (switch) operator used to select the corresponding branch based on the value of the variable next.
  • the branch When the branch including the convolution operator is executed, the branch also assigns the value of the variable next to the output value of the expression P1.
  • the values of expression P1-expression P4 are all less than the value of expression P5, and the value of expression P6 is greater than the value of expression P5.
  • the second expression is executed to determine whether the value of next is greater than or equal to the output value of expression P5, and based on the current value of next being less than the output value of expression P5, the loop is selected to execute the second expression. an expression.
  • the branch When executing the branch including the batch normalization operator, the branch simultaneously assigns the value of the variable next to the output value of expression P3.
  • the second expression is executed to determine whether the value of next is greater than or equal to the output value of expression P5, and based on the current value of next being less than the output value of expression P5, select a loop Execute the first expression.
  • the second expression is executed to determine whether the value of next is greater than or equal to the output value of expression P5, and based on the current value of next being equal to the output value of expression P5, choose not to loop again
  • the first expression is executed, thereby outputting the output value of the linear correction operator.
  • the initial input of the first expression may include the first numerical value, and the first numerical value is configured for encryption protection. That is to say, the initial input of the first expression can be fixed. Only when the initial input of the first expression is the first value, the first expression can output the correct value, so that the calculation logic of the second calculation graph and The calculation logic of the first calculation graph is the same. In addition, by configuring the first value as encryption protection, the output of the first expression can be protected. Even if the attacker obtains the entire second calculation graph, he will be unable to obtain the correct input value of the first expression. The correct calculation logic of the second calculation graph cannot be obtained, thereby protecting the confidentiality of the model.
  • the initial input of the first expression may also include an output of a calculation expression, and the output of the calculation expression is obtained by processing the first numerical value.
  • the first expression can output the correct value only when the input to the calculation expression is the first numerical value.
  • FIG. 8 is another structural schematic diagram of generating a second calculation graph based on a first calculation graph according to an embodiment of the present application.
  • the first calculation graph in Figure 8 is the same as the first calculation graph shown in Figure 5A.
  • the second calculation graph in Figure 8 includes a calculation branch and a confusion branch, where the first expression includes two inputs, one input is used as the input of the subsequent calculation branch or confusion branch, and the other input is used as the first expression itself. enter.
  • the other input may be the first numerical value or the output value obtained by the calculation expression based on the first numerical value.
  • the input of the first expression is the first numerical value or the input of the calculation expression is the first numerical value
  • the output of the first expression is the preset target value, that is, Only the second calculation graph will be executed to the calculation branch; otherwise, when the input of the first expression is not the first value or the input of the calculation expression is not the first value, the output of the first expression is not the preset target value.
  • the second calculation graph will execute the confusion branch, so that the actual calculation logic of the second calculation graph is different from the calculation logic of the first calculation graph. Editing is different.
  • the server may scramble and obfuscate the weight parameters of the operators in the AI model to prevent attackers from misappropriating the AI model by misappropriating each operator in the AI model.
  • the server may obtain a third computation graph, which is used to indicate the execution logic of the AI model, and includes a first operator.
  • the third computation graph and the first computation graph may be two different computation graphs in the AI model; the third computation graph may also be a sub-computation graph of the first computation graph, that is, the first operator included in the third computation graph belongs to one of the multiple operators in the first computation graph.
  • a fourth calculation graph is generated.
  • the fourth calculation graph includes a second operator and a third expression.
  • the second operator is obtained by modifying the weight parameter of the first operator.
  • the input of the third expression includes the output of the second operator, and the output of the third expression is the same as the output of the first operator when the same input as the second operator is used.
  • the server modifies the weight parameter of the first operator in the third calculation graph and obtains the second operator in the fourth calculation graph.
  • the server also inserts the third expression after the second operator so that the output value after the second operator and the third expression are combined can be the same as the output value of the first operator, that is, the calculation result of the fourth calculation graph is maintained unchanged from the calculation result of the third calculation graph.
  • the output of the second operator is obtained by modifying the weight parameter of the first operator, based on the same input, the output of the second operator must be different from the output of the first operator. ; therefore, by introducing a third expression, the output of the second operator is converted to the same value as the output of the first operator.
  • the server may generate execution code corresponding to the AI model based on the second computation graph and the fourth computation graph.
  • the weight parameter of the second operator is obtained by modifying the weight parameter of the first operator based on the second value
  • the input of the third expression includes the second value
  • the second value is configured for encryption protection. That is, only when the input of the third expression is the second value, the third expression can convert the output of the second operator to be the same as the output of the first operator; otherwise, in the case of the third expression When the input is not the second value, the third expression cannot convert the output of the second operator into the same value as the output of the first operator.
  • the way in which the second value is configured for encryption protection may be the same as the way in which the first expression is configured for encryption protection introduced in the above embodiment, that is, the second value is configured to be encrypted using an encryption algorithm and/or Or run in a trusted execution environment. Please refer to the above embodiment for details, which will not be described again here.
  • FIG. 9 is a schematic diagram of obtaining a fourth calculation graph based on a third calculation graph according to an embodiment of the present application.
  • the third calculation diagram includes convolution operator 1.
  • the fourth calculation graph obtained based on the third calculation graph includes convolution operator 2 and a third expression. Among them, convolution operator 2 is obtained by modifying the weight parameter w in convolution operator 1.
  • the input of the third expression includes the output of the convolution operator 2 and the first value or the output of the first value after the calculation expression.
  • the above describes a method for processing a model provided by the embodiment of the present application.
  • the following will introduce a method for processing data based on the model after obtaining the model of the confused state.
  • Figure 10 is a schematic flow chart of a model-based data processing method provided by an embodiment of the present application. As shown in Figure 10, the model-based data processing method includes the following steps 1001-1003.
  • Step 1001 Based on the execution code of the AI model, obtain a second calculation graph.
  • the second calculation graph includes at least one calculation branch, at least A confusion branch and a first expression, the output of the first expression is used to indicate execution of at least one calculation branch or a branch in at least one confusion branch, at least one calculation branch includes at least one operator of the AI model, and at least one calculation branch is related to At least one obfuscated branch has different calculation logic, and the target code related to the first expression in the execution code is configured for encryption protection.
  • the execution code of the AI model is obtained based on the model processing method described in the embodiment corresponding to Figure 4. Therefore, the terminal device can obtain the second calculation graph by parsing the execution code of the AI model.
  • the second calculation graph described in this embodiment is similar to the second calculation graph described in the embodiment corresponding to Figure 4. For details, please refer to the embodiment corresponding to Figure 4, which will not be described again here.
  • Step 1002 Obtain the input data of the AI model.
  • the input data of the AI model is the data to be processed.
  • the AI model is an image processing model (such as an image classification model or an image segmentation model)
  • the input data of the AI model can be image data
  • the AI model is a speech processing model (such as a speech recognition model)
  • the input data of the AI model can be speech data.
  • the input data of the AI model can be determined according to the actual type of the AI model, and this embodiment does not limit the type of the input data of the AI model.
  • Step 1003 Process the input data based on the second calculation graph to obtain the output data of the AI model.
  • the terminal device may process the input data based on the second calculation graph, thereby obtaining the output data of the AI model.
  • the terminal device may also process the input data based on the second calculation graph and other calculation graphs to obtain the output data of the AI model.
  • the second computation graph includes only one computation branch; and the output of the first expression is used to indicate the execution of the computation branch and one of the at least one obfuscation branch.
  • the second calculation graph includes multiple calculation branches, and the second calculation graph also includes a second expression; the output of the first expression is used to indicate execution of multiple calculation branches and at least one confusion branch. a branch in; the second expression is connected to a plurality of calculation branches and at least one confusion branch, the second expression is used to indicate the number of loop executions of the first expression, and the input of the first expression is consistent with the last executed branch Related.
  • the input of the second expression is related to the branch executed last time, and the output of the second expression is used to indicate whether to execute the first expression in a loop.
  • the initial input of the first expression includes a first value
  • the first value is configured for encryption protection.
  • the target code is configured to run in a trusted execution environment; based on the execution code of the AI model, obtaining the second calculation graph includes: the terminal device runs the target code in the trusted execution environment to Get the first expression in the second calculation graph.
  • the target code is configured to be encrypted and protected using an encryption algorithm.
  • the terminal device can decrypt the target code in the execution code to obtain the decrypted code; and the terminal device executes the decrypted code to obtain the first expression.
  • the method also includes: based on the execution code of the AI model, obtaining a fourth calculation graph.
  • the fourth calculation graph includes a second operator and a third expression, and the second operator is a function of the AI model. obtained by modifying the weight parameter of the first operator in , the input of the third expression includes the output of the second operator, and the output of the third expression is the same as the first operator when using the same input as the second operator.
  • the output is the same; processing the input data based on the second calculation graph includes: processing the input data based on the second calculation graph and the fourth calculation graph.
  • the weight parameter of the second operator is obtained by modifying the weight parameter of the first operator based on the second value
  • the input of the third expression includes the second value
  • the second value is Configured for encryption protection.
  • model processing method and the model-based data processing method provided by the embodiments of the present application will be introduced below with reference to specific examples.
  • Figure 11 is a schematic flowchart of a processing model and data processing based on the model provided by an embodiment of the present application.
  • the calculation graph corresponding to the original model file is obtained by parsing the original model file. Then, the obtained calculation graph is subjected to control flow structure obfuscation, encrypted data structure obfuscation and/or model weight obfuscation based on encrypted data through the model processing method provided by the embodiment of the present application, to obtain a confused state model file.
  • control flow structure obfuscation refers to adding obfuscation branches to fuzzy the execution order and dependencies of explicit operators in the calculation graph to achieve the effect of hiding the true calculation logic of the model.
  • the method of adding confusion branches is as described in the corresponding embodiments of Figures 5A to 7B.
  • the server generates a false subgraph corresponding to the calculation subgraph to be protected, and combines it with a user-defined opaque predicate expression (i.e., the above-mentioned third an expression), establish a switch operator structure.
  • One branch of the switch operator structure is the calculation subgraph to be protected, and the other branch is a false subgraph or expression to blur the dependencies between operators.
  • a certain number of false subgraphs and calculation expressions for judging branch selection are generated for the calculation subgraph to be protected, and the switch operator is used to insert the calculation subgraph to be protected and the false subgraph into the branch of each switch.
  • the execution order of model operators is hidden by controlling the execution order of branches through calculation expressions and user-defined opaque predicates.
  • Encrypted data structure obfuscation refers to obfuscation of the model structure based on encrypted data, as specifically described in the corresponding embodiment of Figure 8.
  • the server generates corresponding false subgraphs and calculation expressions for the calculation subgraph to be protected.
  • the random numbers are passed into the calculation expression as input conditions to determine the execution branch of the control flow structure. Only by passing in correct random numbers during inference can the obfuscated model output correct results, thereby preventing the model from being misappropriated.
  • Model weight obfuscation based on encrypted data means that for each weight that needs to be protected, the weight is scrambled by referencing externally generated random noise, and different random noise can be used for each weight scrambling.
  • a new subgraph i.e., the third expression described in the above embodiment
  • the new subgraph can restore the unscrambled output of the protected operator, thereby satisfying the requirement that weight scrambling does not affect the accuracy of the model execution results.
  • the random numbers can also be encrypted to generate metadata files.
  • the obfuscated model file and the corresponding encrypted metadata file are deployed to the terminal device.
  • the terminal device loads and parses the confused state model file to obtain the calculation graph of the AI model. Then, the terminal device decrypts the metadata file to obtain the random number set, and the decryption process can be executed in a trusted execution environment. After decrypting the set of random numbers, the terminal device traverses each computing unit in the execution task sequence based on the inference data input by the AI application and the decrypted random numbers, directly performs confusion state model inference, and obtains the inference results.
  • FIG. 12 is a schematic structural diagram of a model processing device provided by an embodiment of the present application.
  • the processing device of the model includes: an acquisition module 1201, which is used to acquire a first calculation graph.
  • the first calculation graph is used to indicate the execution logic of the AI model.
  • the first calculation graph includes at least one calculation graph.
  • processing module 1202 configured to generate a second calculation graph based on the first calculation graph, the second calculation graph including at least one calculation branch, at least one confusion branch and a first expression, the first expression
  • the output of is used to indicate execution of a branch in the at least one calculation branch or a branch in the at least one confusion branch, the at least one operator is included in the at least one calculation branch, the at least one calculation branch is consistent with the The at least one confusion branch has different calculation logic; the processing module 1202 is used to generate the execution code corresponding to the AI model according to the second calculation graph, and the target code related to the first expression in the execution code Configured for encryption protection.
  • the second calculation graph includes only one calculation branch; the output of the first expression is used to indicate execution of the calculation branch and one of the at least one confusion branches.
  • the second calculation graph includes a plurality of calculation branches, and the second calculation graph further includes a second expression; the output of the first expression is used to indicate execution of the multiple calculation branches. one of the calculation branches and the at least one confusion branch; the second expression is connected to the plurality of calculation branches and the at least one confusion branch, and the second expression is used to indicate the first The number of loop executions of the expression, and the input of the first expression is related to the last executed branch.
  • the input of the second expression is related to the last executed branch, and the output of the second expression is used to indicate whether to execute the first expression in a loop.
  • the initial input of the first expression includes a first value
  • the first value is configured for encryption protection.
  • the target code is configured to run in a trusted execution environment.
  • the target code is configured to be encrypted and protected using an encryption algorithm.
  • the acquisition module 1201 is also used to acquire a third calculation graph.
  • the third calculation graph is used to indicate the execution logic of the AI model.
  • the third calculation graph includes a first operator; the processing module 1202 is also used to: based on the third Calculation graph, generate a fourth calculation graph, the fourth calculation graph includes a second operator and a third expression, the second operator is obtained by modifying the weight parameter of the first operator, the The input of the third expression includes the output of the second operator, and the output of the third expression is the same as the output of the first operator using the same input as the second operator; according to The second calculation graph and the fourth calculation graph generate execution code corresponding to the AI model.
  • the weight parameter of the second operator is obtained by modifying the weight parameter of the first operator based on the second value, and the input of the third expression includes the third Two values, and the second value is configured for encryption protection.
  • FIG. 13 is a schematic structural diagram of a model-based data processing device provided by an embodiment of the present application.
  • the model-based data processing device includes: an acquisition module 1301, which is used to acquire a second calculation graph based on the execution code of the AI model.
  • the second calculation graph includes at least one calculation branch and at least one confusion branch.
  • the output of which is used to indicate execution of a branch in the at least one calculation branch or a branch in the at least one obfuscation branch, the at least one calculation branch including at least one of the AI
  • the operator of the model, the at least one calculation branch and the at least one confusion branch have different calculation logic, the target code related to the first expression in the execution code is configured for encryption protection; the acquisition module 1301 is also used to obtain the input data of the AI model; the processing module 1302 is also used to process the input data based on the second calculation graph to obtain the output data of the AI model.
  • the second calculation graph includes only one calculation branch; the output of the first expression is used to indicate execution of the calculation branch and one of the at least one confusion branches.
  • the second calculation graph includes a plurality of calculation branches, and the second calculation graph further includes a second expression; the output of the first expression is used to indicate execution of the multiple calculation branches. one of the calculation branches and the at least one confusion branch; the second expression is connected to the plurality of calculation branches and the at least one confusion branch, and the second expression is used to indicate the first The number of loop executions of the expression, and the input of the first expression is related to the last executed branch.
  • the input of the second expression is related to the last executed branch, and the output of the second expression is used to indicate whether to execute the first expression in a loop.
  • the initial input of the first expression includes a first value
  • the first value is configured for encryption protection.
  • the target code is configured to run in a trusted execution environment, and/or the target code is configured to perform code obfuscation.
  • the target code is configured to be encrypted and protected using an encryption algorithm; the processing module 1302 is also used to decrypt the target code in the execution code to obtain the decrypted code ; Execute the decrypted code to obtain the first expression.
  • the acquisition module 1301 is also used to acquire a fourth calculation graph based on the execution code of the AI model, where the fourth calculation graph includes a second operator and a third expression,
  • the second operator is obtained by modifying the weight parameter of the first operator in the AI model
  • the input of the third expression includes the output of the second operator
  • the third expression The output of is the same as the output of the first operator when using the same input as the second operator
  • the processing module 1302 is also configured to pair The input data is processed.
  • the weight parameter of the second operator is obtained by modifying the weight parameter of the first operator based on the second value, and the input of the third expression includes the third Two values, and the second value is configured for encryption protection.
  • FIG 14 is a schematic structural diagram of an execution device provided by an embodiment of the present application.
  • the execution device 1400 can be embodied as a mobile phone, a tablet, a notebook computer, Smart wearable devices, servers, etc. are not limited here.
  • the execution device 1400 includes: a receiver 1401, a transmitter 1402, a processor 1403 and a memory 1404 (the number of processors 1403 in the execution device 1400 can be one or more, one processor is taken as an example in Figure 14) , wherein the processor 1403 may include an application processor 14031 and a communication processor 14032.
  • the receiver 1401, the transmitter 1402, the processor 1403, and the memory 1404 may be connected by a bus or other means.
  • Memory 1404 may include read-only memory and random access memory and provides instructions and data to processor 1403 .
  • Memory 1404 Part of the system may also include non-volatile random access memory (NVRAM).
  • NVRAM non-volatile random access memory
  • the memory 1404 stores processor and operating instructions, executable modules or data structures, or a subset thereof, or an extended set thereof, where the operating instructions may include various operating instructions for implementing various operations.
  • the processor 1403 controls the execution of operations of the device.
  • various components of the execution device are coupled together through a bus system.
  • the bus system may also include a power bus, a control bus, a status signal bus, etc.
  • various buses are called bus systems in the figure.
  • the methods disclosed in the above embodiments of the present application can be applied to the processor 1403 or implemented by the processor 1403.
  • the processor 1403 may be an integrated circuit chip with signal processing capabilities. During the implementation process, each step of the above method can be completed by instructions in the form of hardware integrated logic circuits or software in the processor 1403 .
  • the above-mentioned processor 1403 can be a general-purpose processor, a digital signal processor (DSP), a microprocessor or a microcontroller, and can further include an application specific integrated circuit (ASIC), a field programmable Gate array (field-programmable gate array, FPGA) or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components.
  • DSP digital signal processor
  • ASIC application specific integrated circuit
  • FPGA field-programmable gate array
  • the processor 1403 can implement or execute each method, step and logical block diagram disclosed in the embodiment of this application.
  • a general-purpose processor may be a microprocessor or the processor may be any conventional processor, etc.
  • the steps of the method disclosed in conjunction with the embodiments of the present application can be directly implemented by a hardware decoding processor, or executed by a combination of hardware and software modules in the decoding processor.
  • the software module can be located in random access memory, flash memory, read-only memory, programmable read-only memory or electrically erasable programmable memory, registers and other mature storage media in this field.
  • the storage medium is located in the memory 1404.
  • the processor 1403 reads the information in the memory 1404 and completes the steps of the above method in combination with its hardware.
  • the receiver 1401 may be configured to receive input numeric or character information and generate signal inputs related to performing relevant settings and functional controls of the device.
  • the transmitter 1402 can be used to output numeric or character information through the first interface; the transmitter 1402 can also be used to send instructions to the disk group through the first interface to modify the data in the disk group; the transmitter 1402 can also include a display device such as a display screen .
  • the processor 1403 is used to execute the method in the corresponding embodiment of Figure 4 or Figure 10.
  • the electronic device provided in the embodiment of the present application may specifically be a chip, and the chip includes: a processing unit and a communication unit, wherein the processing unit may be, for example, a processor, and the communication unit may be, for example, an input/output interface, a pin or a circuit, etc.
  • the processing unit may execute the computer execution instructions stored in the storage unit, so that the chip in the execution device executes the method for selecting the model hyperparameters described in the above embodiment, or so that the chip in the training device executes the method for selecting the model hyperparameters described in the above embodiment.
  • the storage unit is a storage unit in the chip, such as a register, a cache, etc.
  • the storage unit may also be a storage unit located outside the chip in the wireless access device, such as a read-only memory (ROM) or other types of static storage devices that can store static information and instructions, a random access memory (RAM), etc.
  • ROM read-only memory
  • RAM random access memory
  • Figure 15 is a schematic structural diagram of a chip provided by an embodiment of the present application.
  • the chip can be represented as a neural network processor NPU 1500.
  • the NPU 1500 serves as a co-processor and is mounted to the main CPU (Host). CPU), tasks are allocated by the Host CPU.
  • the core part of the NPU is the arithmetic circuit 1503.
  • the arithmetic circuit 1503 is controlled by the controller 1504 to extract the matrix data in the memory and perform multiplication operations.
  • the computing circuit 1503 internally includes multiple processing units (Process Engine, PE).
  • arithmetic circuit 1503 is a two-dimensional systolic array.
  • the arithmetic circuit 1503 may also be a one-dimensional systolic array or other electronic circuit capable of performing mathematical operations such as multiplication and addition.
  • arithmetic circuit 1503 is a general-purpose matrix processor.
  • the arithmetic circuit obtains the corresponding data of matrix B from the weight memory 1502 and caches it on each PE in the arithmetic circuit.
  • the operation circuit takes matrix A data and matrix B from the input memory 1501 to perform matrix operations, and the partial result or final result of the obtained matrix is stored in an accumulator (accumulator) 1508 .
  • the unified memory 1506 is used to store input data and output data.
  • the weight data directly passes through the storage unit access controller (Direct Memory Access Controller, DMAC) 1505, and the DMAC is transferred to the weight memory 1502.
  • Input data is also transferred to unified memory 1506 via DMAC.
  • DMAC Direct Memory Access Controller
  • BIU is the Bus Interface Unit, that is, the bus interface unit 1515, which is used for the interaction between the AXI bus and the DMAC and the Instruction Fetch Buffer (IFB) 1509.
  • IFB Instruction Fetch Buffer
  • Bus Interface Unit 1515 (Bus Interface Unit, BIU for short), used to fetch memory 1509 to obtain instructions from external memory, It is also used for the storage unit access controller 1505 to obtain the original data of the input matrix A or the weight matrix B from the external memory.
  • DMAC is mainly used to transfer the input data in the external memory DDR to the unified memory 1506 or the weight data to the weight memory 1502 or the input data to the input memory 1501 .
  • the vector calculation unit 1507 includes multiple arithmetic processing units, and if necessary, further processes the output of the arithmetic circuit 1503, such as vector multiplication, vector addition, exponential operation, logarithmic operation, size comparison, etc.
  • vector calculation unit 1507 can store the processed output vectors to unified memory 1506 .
  • the vector calculation unit 1507 can apply a linear function; or a nonlinear function to the output of the operation circuit 1503, such as linear interpolation on the feature plane extracted by the convolution layer, or a vector of accumulated values, to generate an activation value.
  • vector calculation unit 1507 generates normalized values, pixel-wise summed values, or both.
  • the processed output vector can be used as an activation input to the arithmetic circuit 1503, such as for use in a subsequent layer in a neural network.
  • the instruction fetch buffer 1509 connected to the controller 1504 is used to store instructions used by the controller 1504;
  • the unified memory 1506, the input memory 1501, the weight memory 1502 and the fetch memory 1509 are all On-Chip memories. External memory is private to the NPU hardware architecture.
  • the processor mentioned in any of the above places can be a general central processing unit, a microprocessor, an ASIC, or one or more integrated circuits used to control the execution of the above programs.
  • FIG. 16 is a schematic structural diagram of a computer-readable storage medium provided by an embodiment of the present application.
  • the present application also provides a computer-readable storage medium.
  • the method disclosed in Figure 4 or Figure 10 can be implemented as being encoded on a computer-readable storage medium in a machine-readable format or encoded in Computer program instructions on other non-transitory media or articles.
  • 16 schematically illustrates a conceptual partial view of an example computer-readable storage medium including a computer program for executing a computer process on a computing device, arranged in accordance with at least some embodiments presented herein.
  • computer-readable storage media 1600 is provided using signal bearing media 1601.
  • Signal bearing medium 1601 may include one or more program instructions 1602 that, when executed by one or more processors, may provide the functionality or portions of the functionality described above with respect to FIG. 4 or FIG. 10 . Additionally, program instructions 1602 in Figure 16 also describe example instructions.
  • signal bearing media 1601 may include computer readable media 1603 such as, but not limited to, a hard drive, compact disk (CD), digital video disc (DVD), digital tape, memory, ROM or RAM, and the like.
  • computer readable media 1603 such as, but not limited to, a hard drive, compact disk (CD), digital video disc (DVD), digital tape, memory, ROM or RAM, and the like.
  • signal bearing media 1601 may include computer recordable media 1604 such as, but not limited to, memory, read/write (R/W) CDs, R/W DVDs, and the like.
  • signal bearing medium 1601 may include communication media 1605, such as, but not limited to, digital and/or analog communication media (eg, fiber optic cables, waveguides, wired communication links, wireless communication links, etc.).
  • signal bearing medium 1601 may be conveyed by a wireless form of communication medium 1605 (e.g., a wireless communication medium that complies with the IEEE 802.16 standard or other transmission protocol).
  • One or more program instructions 1602 may be, for example, computer-executable instructions or logic-implemented instructions.
  • the computing device of the computing device may be configured to respond to program instructions 1602 communicated to the computing device via one or more of computer-readable media 1603 , computer-recordable media 1604 , and/or communication media 1605 , providing various operations, functions, or actions.
  • the device embodiments described above are only illustrative.
  • the units described as separate components may or may not be physically separated, and the components shown as units may or may not be physically separate.
  • the physical unit can be located in one place, or it can be distributed across multiple network units. Some or all of the modules can be selected according to actual needs to achieve the purpose of the solution of this embodiment.
  • the connection relationship between modules indicates that there are communication connections between them, which can be specifically implemented as one or more communication buses or signal lines.
  • the computer software products are stored in readable storage media, such as computer floppy disks, U disks, mobile hard disks, ROM, RAM, magnetic disks, etc. disk or optical disk, etc., including a number of instructions to cause a computer device (which can be a personal computer, a training device, or a network device, etc.) to execute the methods described in various embodiments of the present application.
  • readable storage media such as computer floppy disks, U disks, mobile hard disks, ROM, RAM, magnetic disks, etc. disk or optical disk, etc.
  • the computer program product includes one or more computer instructions.
  • the computer may be a general-purpose computer, a special-purpose computer, a computer network, or other programmable device.
  • the computer instructions may be stored in or transmitted from one computer-readable storage medium to another, for example, the computer instructions may be transferred from a website, computer, training device, or data
  • the center transmits to another website site, computer, training equipment or data center through wired (such as coaxial cable, optical fiber, digital subscriber line (DSL)) or wireless (such as infrared, wireless, microwave, etc.) means.
  • wired such as coaxial cable, optical fiber, digital subscriber line (DSL)
  • wireless such as infrared, wireless, microwave, etc.
  • the computer-readable storage medium may be any available medium that a computer can store, or a data storage device such as a training device or a data center integrated with one or more available media.
  • the available media may be magnetic media (eg, floppy disk, hard disk, magnetic tape), optical media (eg, DVD), or semiconductor media (eg, solid state disk (Solid State Disk, SSD)), etc.

Landscapes

  • Engineering & Computer Science (AREA)
  • Theoretical Computer Science (AREA)
  • Physics & Mathematics (AREA)
  • Software Systems (AREA)
  • General Engineering & Computer Science (AREA)
  • General Physics & Mathematics (AREA)
  • Mathematical Physics (AREA)
  • Computing Systems (AREA)
  • Artificial Intelligence (AREA)
  • Data Mining & Analysis (AREA)
  • Evolutionary Computation (AREA)
  • Health & Medical Sciences (AREA)
  • Computational Linguistics (AREA)
  • Life Sciences & Earth Sciences (AREA)
  • Biomedical Technology (AREA)
  • Biophysics (AREA)
  • General Health & Medical Sciences (AREA)
  • Molecular Biology (AREA)
  • Computer Hardware Design (AREA)
  • Computer Security & Cryptography (AREA)
  • Multimedia (AREA)
  • Technology Law (AREA)
  • Medical Informatics (AREA)
  • Computer Vision & Pattern Recognition (AREA)
  • Neurology (AREA)
  • Information Retrieval, Db Structures And Fs Structures Therefor (AREA)
  • Storage Device Security (AREA)

Abstract

一种模型的处理方法，应用于人工智能(Artificial Intelligence，AI)技术领域。在该方法中，在AI模型原有的计算逻辑的基础上，增加新的混淆计算节点，并且通过表达式来确定原有计算节点和混淆节点之间的执行关系，只有在表达式的输出正确时才能够执行到正确的计算节点。这样一来，通过新增的混淆节点能够模糊原模型中算子的执行顺序和依赖关系，实现模型结构加扰，并且只需要对新增的表达式进行加密保护，则能够实现对整个AI模型正常执行流程的保护，降低了模型保护所带来的额外性能开销，有利于AI模型的推广应用。

Description

模型的处理方法、基于模型的数据处理方法及相关装置
本申请要求于2022年9月20日提交中国专利局、申请号为202211145581.9、发明名称为“模型的处理方法、基于模型的数据处理方法及相关装置”的中国专利申请的优先权，其全部内容通过引用结合在本申请中。
技术领域
本申请涉及人工智能(Artificial Intelligence，AI)技术领域，尤其涉及一种模型的处理方法及相关装置。
背景技术
随着AI理论和硬件算力的不断突破，AI技术迎来了飞速发展。在计算机视觉、自然语言处理、语音识别等领域，AI系统已经实现大规模部署，越来越多的厂商提供AI服务。一般来说，AI服务提供商在本地完成模型训练和调优后，将AI模型部署到第三方平台(如终端设备、边缘设备和云服务器)上来提供推理服务。由于AI模型的设计和训练需要投入大量时间、数据和算力，因此如何防止AI模型在传输、存储以及运行等环节被窃取，已经成为AI服务提供商最为关心的问题。
为解决AI模型容易被窃取的问题，目前业界提出了一些模型机密性保护方案。例如，基于加解密算法的模型保护方案是采用加密算法对传输和存储过程中的AI模型进行加密，并且在执行AI模型的推理前将AI模型解密到内存中。这种方案虽然可以保护AI模型的机密性，但是每次执行AI模型的推理前都需要对整个AI模型进行解密，计算开销巨大，会导致AI模型的推理时延被大大地延长，严重地限制了AI模型的应用。
因此，如何实现高效的模型机密性保护成为亟待解决的问题。
发明内容
本申请提供了一种模型的处理方法，能够实现对整个AI模型正常执行流程的保护，且降低模型保护所带来的额外性能开销，有利于AI模型的推广应用。
本申请第一方面提供一种模型的处理方法，应用于服务器或终端设备等物理设备或虚拟设备上。以该方法应用于服务器为例，该方法包括：服务器通过解析AI模型的模型文件获取第一计算图，该第一计算图用于指示AI模型的执行逻辑，且第一计算图包括至少一个算子。即，第一计算图可以通过指示至少一个算子之间的依赖关系的方式来实现指示AI模型的执行逻辑。AI模型的执行逻辑可以是指有序地执行该至少一个算子。
然后，基于第一计算图，服务器生成第二计算图，第二计算图包括至少一个计算分支、至少一个混淆分支和第一表达式，第一表达式的输出用于指示执行至少一个计算分支中的分支或至少一个混淆分支中的分支。并且，第一计算图中的至少一个算子包含于第二计算图中的至少一个计算分支中，且至少一个计算分支与至少一个混淆分支具有不同的计算逻辑。在第一表达式的输出正确时，执行第二计算图中的至少一个计算分支，从而保证实际计算逻辑与原AI模型的计算逻辑相同；在第一表达式的输出错误时，执行第二计算图中的至少一个混淆分支，使得实际计算逻辑与原AI模型的计算逻辑不同，进而实现AI模型的保护。其中，混淆分支是一个具有算子的分支，能够将输入混淆分支的数据通过混淆分支中的算子进行计算得到输出数据。并且，由于混淆分支的计算逻辑与计算分支的计算逻辑不同，即混淆分支中的算子与计算分支中的算子不同，因此对于相同的输入数据，混淆分支和计算分支能够得到不同的输出数据。
其次，服务器根据第二计算图生成AI模型对应的执行代码，该执行代码中的目标代码被配置为加密保护，目标代码是与第一表达式相关的代码。由于在第二计算图中，第一表达式的输出能够影响第二计算图中的计算分支与混淆分支之间的执行情况，因此通过对第一表达式的目标代码进行加密保护，则能够实现对第二计算图的计算逻辑进行保护。简单来说，即便攻击者通过窃取AI模型对应的执行代码实现了AI模型的盗取，由于第一表达式对应的目标代码受到加密保护，因此攻击者无法获取到第一表达式的计算逻辑，从而无法得到正确的输出值，进而无法获取到AI模型正确的执行逻辑。
在AI模型原有的计算逻辑的基础上，增加与AI模型中的计算分支并列的混淆分支，并且通过表达式来确定计算分支和混淆分支之间的执行关系，只有在表达式的输出正确时才能够执行到正确的计算分支。这样一来，通过新增的混淆分支能够模糊原模型中显式的算子执行顺序和依赖关系，实现模型结构加扰，并且只需要对新增的表达式进行加密保护，则能够实现对整个AI模型正常执行流程的保护，降低了模型保护所带来的额外性能开销，有利于AI模型的推广应用。
在一种可能的实现方式中，第二计算图仅包括一个计算分支，且第一表达式的输出用于指示执行计算分支以及至少一个混淆分支中的一个分支。其中，第二计算图中的计算分支包括了第一计算图中的所有算子以及所有算子之间的依赖关系，因此通过执行第二计算图中的一个计算分支，则能够实现第一计算图中的计算逻辑。并且，第一表达式可以是分别与一个计算分支以及至少一个混淆分支连接，用于指示执行计算分支以及至少一个混淆分支中的任意一个分支。只有在第一表达式的输出为预设目标值时，才会执行第二计算图中的计算分支；否则，在第一表达式的输出不为预设目标值时，会执行第二计算图中的至少一个混淆分支中的一个分支。
其中，第一表达式与计算分支以及至少一个混淆分支连接可以是指在代码中定义了基于第一表达式的输出值来跳转到计算分支以及至少一个混淆分支。因此，在执行第一表达式后，能够跳转至执行计算分支或至少一个混淆分支。
本方案中，通过在第二计算图中设置一个或多个与计算分支并列的混淆分支，能够有效地模糊原模型中显式的算子执行顺序和依赖关系，实现对模型结构进行加扰，提高模型的机密性保护。
在一种可能的实现方式中，第二计算图包括多个计算分支，且第二计算图还包括第二表达式。其中，第一表达式的输出用于指示执行多个计算分支和至少一个混淆分支中的一个分支；第二表达式与多个计算分支和至少一个混淆分支连接，第二表达式用于指示第一表达式的循环执行次数，且第一表达式的输入与上一次执行的分支相关。
其中，第二表达式与计算分支以及至少一个混淆分支连接可以是指在代码中定义了执行多个计算分支以及至少一个混淆分支中的任意一个分支之后，均会跳转至执行第二表达式。因此，在执行任意一个计算分支或混淆分支之后，能够跳转至第二表达式，从而第二表达式指示是否继续循环执行第一表达式。
也就是说，第二计算图中的多个计算分支和至少一个混淆分支并列，且第一表达式用于控制需要执行的分支，第二表达式用于控制第一表达式的循环执行次数。因此，通过第二表达式和第一表达式的配合，能够实现依次执行相应的计算分支；且，通过并列的至少一个混淆分支，能够有效地模糊原模型中显式的算子执行顺序和依赖关系，实现对模型结构进行加扰，提高模型的机密性保护。
在一种可能的实现方式中，第二表达式的输入与上一次执行的分支相关，第二表达式的输出用于指示是否循环执行第一表达式。
在执行第二计算图的过程中，基于输入值，运行第一表达式，得到第一表达式的输出值；然后，基于第一表达式的输出值确定执行的分支。在执行一个分支后，执行第二表达式，以确定是否继续循环执行第一表达式。在确定继续循环第一表达式的情况下，基于执行分支所得到的输出值，继续执行第一表达式，以确定下一个需要执行的分支。通过循环执行上述的步骤，直至基于第二表达式的输出值确定终止循环第一表达式，从而实现依次执行多个计算分支，使得第二计算图的计算逻辑与第一计算图的计算逻辑相同。
在一种可能的实现方式中，第一表达式的初始输入包括第一数值，第一数值被配置为加密保护。例如，第一数值被配置为运行于可信执行环境中；或者，第一数值被配置为采用加密算法进行加密。
也就是说，第一表达式的初始输入可以是固定的，只有第一表达式的初始输入为第一数值时，第一表达式才能够输出正确值，从而使得第二计算图的计算逻辑与第一计算图的计算逻辑相同。此外，通过将第一数值配置为加密保护，可以实现对第一表达式的输出进行保护，攻击者即便获取到了整个第二计算图，也会因为无法获取到第一表达式正确的输入值而无法获取到第二计算图正确的计算逻辑，从而实现模型的机密性保护。
在一种可能的实现方式中，目标代码被配置为运行于可信执行环境中，和/或所述目标代码被配置为进行代码混淆。当模型使用者的终端设备需要运行AI模型时，终端设备则可以将目标代码加载至可信 执行环境中运行，从而基于可信执行环境来实现对目标代码的加密保护。另外，在目标代码为被配置为进行代码混淆的情况下，目标代码会被转换为功能相同但难以阅读和理解的代码，从而实现对目标代码的保护，且不影响目标代码的正常执行。
在一种可能的实现方式中，目标代码被配置为采用加密算法加密保护。当模型使用者的终端设备需要运行AI模型时，终端设备需要先采用解密算法对目标代码进行解密，才能够得到解密后的代码，从而基于解密后的代码获取第一表达式。示例性地，加密算法例如可以为高级加密标准(Advanced Encryption Standard，AES)算法、数据加密标准(Data Encryption Standard，DES)算法、国际数据加密算法(International Data Encryption Algorithm，IDEA)以及RSA算法。
在一种可能的实现方式中，该方法还包括：服务器获取第三计算图，第三计算图用于指示AI模型的执行逻辑，第三计算图包括第一算子。其中，第三计算图与上述的第一计算图可以是AI模型中不同的两个计算图；第三计算图也可以是第一计算图的一个子计算图，即第三计算图所包括的第一算子属于第一计算图中的多个算子中的一个。
基于第三计算图，服务器生成第四计算图，第四计算图包括第二算子和第三表达式，第二算子是对第一算子的权重参数修改后得到的，第三表达式的输入包括第二算子的输出，且第三表达式的输出与第一算子在采用与第二算子相同的输入时的输出相同。简单来说，在第二算子的权重参数是对第一算子的权重参数进行修改得到的情况下，基于相同的输入，第二算子的输出与第一算子的输出必然是不相同的；因此，通过引入一个第三表达式，来将第二算子的输出转换为与第一算子的输出相同的值。
最后，服务器根据第二计算图和第四计算图生成AI模型对应的执行代码。
本方案中，通过对AI模型中算子的权重参数进行加扰，能够有效地混淆AI模型中显式的各个算子，有效地避免攻击者通过盗用AI模型中算子的方式来实现对AI模型的盗用，保护了AI模型的机密性。
在一种可能的实现方式中，第二算子的权重参数是基于第二数值对第一算子的权重参数修改后得到的，第三表达式的输入包括第二数值，且第二数值被配置为加密保护。
其中，在第三表达式的输入不正确的情况下，第三表达式无法将第二算子的输出转换为第一算子的输出。因此，通过对第一数值进行加密保护，则能够实现对第四计算图中的计算逻辑进行保护，从而实现对整个AI模型正常执行流程的保护，并降低了模型保护所带来的额外性能开销。
本申请第二方面提供一种基于模型的数据处理方法，应用于部署有AI模型的设备，例如服务器或终端设备等物理设备或虚拟设备。以该方法应用于终端设备为例，该方法包括：基于AI模型的执行代码，终端设备获取第二计算图，第二计算图包括至少一个计算分支、至少一个混淆分支和第一表达式，第一表达式的输出用于指示执行至少一个计算分支中的分支或至少一个混淆分支中的分支，至少一个计算分支包括至少一个AI模型的算子，至少一个计算分支与至少一个混淆分支具有不同的计算逻辑，所述执行代码中的目标代码被配置为加密保护，所述目标代码是与所述第一表达式相关的代码；终端设备获取AI模型的输入数据；终端设备基于第二计算图对输入数据进行处理，得到AI模型的输出数据。
在一种可能的实现方式中，第二计算图仅包括一个计算分支；第一表达式的输出用于指示执行计算分支以及至少一个混淆分支中的一个分支。
在一种可能的实现方式中，第二计算图包括多个计算分支，且第二计算图还包括第二表达式；第一表达式的输出用于指示执行多个计算分支和至少一个混淆分支中的一个分支；第二表达式与多个计算分支和至少一个混淆分支连接，第二表达式用于指示第一表达式的循环执行次数。
在一种可能的实现方式中，第二表达式的输入与上一次执行的分支相关，第二表达式的输出用于指示是否循环执行第一表达式。
在一种可能的实现方式中，第一表达式的初始输入包括第一数值，第一数值被配置为加密保护。
在一种可能的实现方式中，目标代码被配置为运行于可信执行环境中，和/或所述目标代码被配置为进行代码混淆。
在一种可能的实现方式中，目标代码被配置为采用加密算法加密保护。终端设备可以对执行代码中的目标代码进行解密，得到解密后的代码；并且，终端设备执行解密后的代码，得到第一表达式。
在一种可能的实现方式中，该方法还包括：基于AI模型的执行代码，获取第四计算图，第四计算图包括第二算子和第三表达式，第二算子是对AI模型中第一算子的权重参数修改后得到的，第三表达式的输入包括第二算子的输出，且第三表达式的输出与第一算子在采用与第二算子相同的输入时的输出相同；基于第二计算图对输入数据进行处理，包括：基于第二计算图和第四计算图对输入数据进行处理。
在一种可能的实现方式中，第二算子的权重参数是基于第二数值对第一算子的权重参数修改后得到的，第三表达式的输入包括第二数值，且第二数值被配置为加密保护。
本申请第三方面提供一种模型的处理装置，包括：获取模块，用于获取第一计算图，所述第一计算图用于指示人工智能AI模型的执行逻辑，所述第一计算图包括至少一个算子；处理模块，用于基于所述第一计算图，生成第二计算图，所述第二计算图包括至少一个计算分支、至少一个混淆分支和第一表达式，所述第一表达式的输出用于指示执行所述至少一个计算分支中的分支或所述至少一个混淆分支中的分支，所述至少一个算子包含于所述至少一个计算分支中，所述至少一个计算分支与所述至少一个混淆分支具有不同的计算逻辑；处理模块，用于根据所述第二计算图生成所述AI模型对应的执行代码，所述执行代码中与所述第一表达式相关的目标代码被配置为加密保护。
在一种可能的实现方式中，所述第二计算图仅包括一个计算分支；所述第一表达式的输出用于指示执行所述计算分支以及所述至少一个混淆分支中的一个分支。
在一种可能的实现方式中，所述第二计算图包括多个计算分支，且所述第二计算图还包括第二表达式；所述第一表达式的输出用于指示执行所述多个计算分支和所述至少一个混淆分支中的一个分支；所述第二表达式与所述多个计算分支和所述至少一个混淆分支连接，所述第二表达式用于指示所述第一表达式的循环执行次数，且所述第一表达式的输入与上一次执行的分支相关。
在一种可能的实现方式中，所述第二表达式的输入与上一次执行的分支相关，所述第二表达式的输出用于指示是否循环执行所述第一表达式。
在一种可能的实现方式中，所述第一表达式的初始输入包括第一数值，所述第一数值被配置为加密保护。
在一种可能的实现方式中，所述目标代码被配置为运行于可信执行环境中，和/或所述目标代码被配置为进行代码混淆。
在一种可能的实现方式中，所述目标代码被配置为采用加密算法加密保护。
在一种可能的实现方式中，所述获取模块，还用于获取第三计算图，所述第三计算图用于指示所述AI模型的执行逻辑，所述第三计算图包括第一算子；所述处理模块，还用于：基于所述第三计算图，生成第四计算图，所述第四计算图包括第二算子和第三表达式，所述第二算子是对所述第一算子的权重参数修改后得到的，所述第三表达式的输入包括所述第二算子的输出，且所述第三表达式的输出与所述第一算子在采用与所述第二算子相同的输入时的输出相同；根据所述第二计算图和所述第四计算图生成所述AI模型对应的执行代码。
在一种可能的实现方式中，所述第二算子的权重参数是基于第二数值对所述第一算子的权重参数修改后得到的，所述第三表达式的输入包括所述第二数值，且所述第二数值被配置为加密保护。
本申请第四方面提供一种基于模型的数据处理装置，包括：获取模块，用于基于AI模型的执行代码，获取第二计算图，所述第二计算图包括至少一个计算分支、至少一个混淆分支和第一表达式，所述第一表达式的输出用于指示执行所述至少一个计算分支中的分支或所述至少一个混淆分支中的分支，所述至少一个计算分支包括至少一个所述AI模型的算子，所述至少一个计算分支与所述至少一个混淆分支具有不同的计算逻辑，所述执行代码中与所述第一表达式相关的目标代码被配置为加密保护；所述获取模块，还用于获取所述AI模型的输入数据；所述处理模块，还用于基于所述第二计算图对所述输入数据进行处理，得到所述AI模型的输出数据。
在一种可能的实现方式中，所述第二计算图仅包括一个计算分支；所述第一表达式的输出用于指示执行所述计算分支以及所述至少一个混淆分支中的一个分支。
在一种可能的实现方式中，所述第二计算图包括多个计算分支，且所述第二计算图还包括第二表达式；所述第一表达式的输出用于指示执行所述多个计算分支和所述至少一个混淆分支中的一个分支；所述第二表达式与所述多个计算分支和所述至少一个混淆分支连接，所述第二表达式用于指示所述第一表达式的循环执行次数，且所述第一表达式的输入与上一次执行的分支相关。
在一种可能的实现方式中，所述第二表达式的输入与上一次执行的分支相关，所述第二表达式的输出用于指示是否循环执行所述第一表达式。
在一种可能的实现方式中，所述第一表达式的初始输入包括第一数值，所述第一数值被配置为加密保护。
在一种可能的实现方式中，所述目标代码被配置为运行于可信执行环境中，和/或所述目标代码被配置为进行代码混淆。
在一种可能的实现方式中，所述目标代码被配置为采用加密算法加密保护；所述处理模块，还用于对所述执行代码中的所述目标代码进行解密，得到解密后的代码；执行所述解密后的代码，得到所述第一表达式。
在一种可能的实现方式中，所述获取模块，还用于基于所述AI模型的执行代码，获取第四计算图，所述第四计算图包括第二算子和第三表达式，所述第二算子是对所述AI模型中第一算子的权重参数修改后得到的，所述第三表达式的输入包括所述第二算子的输出，且所述第三表达式的输出与所述第一算子在采用与所述第二算子相同的输入时的输出相同；所述处理模块，还用于基于所述第二计算图和所述第四计算图对所述输入数据进行处理。
在一种可能的实现方式中，所述第二算子的权重参数是基于第二数值对所述第一算子的权重参数修改后得到的，所述第三表达式的输入包括所述第二数值，且所述第二数值被配置为加密保护。
本申请第五方面提供一种电子设备，该电子设备包括：存储器和处理器；所述存储器存储有代码，所述处理器被配置为执行所述代码，当所述代码被执行时，所述电子设备执行如第一方面中的任意一种实现方式的方法。
本申请第六方面提供一种电子设备，该电子设备包括：存储器和处理器；所述存储器存储有代码，所述处理器被配置为执行所述代码，当所述代码被执行时，所述电子设备执行如第二方面中的任意一种实现方式的方法。
本申请第七方面提供一种AI系统，该AI系统包括：如第三方面任一实现方式所述的模型的处理装置以及如第四方面任一实现方式所述的基于模型的数据处理装置。
本申请第八方面提供一种计算机可读存储介质，该计算机可读存储介质中存储有计算机程序，当其在计算机上运行时，使得计算机执行如第一方面或第二方面中的任意一种实现方式的方法。
本申请第九方面提供一种计算机程序产品，当其在计算机上运行时，使得计算机执行如第一方面或第二方面中的任意一种实现方式的方法。
本申请第十方面提供一种芯片，包括一个或多个处理器。处理器中的部分或全部用于读取并执行存储器中存储的计算机程序，以执行上述第一方面或第二方面中的任意一种实现方式中的方法。
可选地，该芯片该包括存储器，该存储器与该处理器通过电路或电线与存储器连接。可选地，该芯片还包括通信接口，处理器与该通信接口连接。通信接口用于接收需要处理的数据和/或信息，处理器从该通信接口获取该数据和/或信息，并对该数据和/或信息进行处理，并通过该通信接口输出处理结果。该通信接口可以是输入输出接口。本申请提供的方法可以由一个芯片实现，也可以由多个芯片协同实现。
其中，第二方面至第十方面中任一种设计方式所带来的技术效果可参见上述第一方面中不同实现方式所带来的技术效果，在此不再赘述。
附图说明
图1为本申请实施例提供的一种模型文件明文部署的示意图；
图2为本申请实施例提供的一种模型文件加密部署的示意图；
图3为本申请实施例提供的一种模型的处理方法的应用场景示意图；
图4为本申请实施例提供的一种模型的处理方法的流程示意图；
图5A为本申请实施例提供的一种基于第一计算图生成第二计算图的结构示意图；
图5B为本申请实施例提供的一种基于第一计算图生成第二计算图的另一结构示意图；
图6A为本申请实施例提供的一种基于第一计算图生成第二计算图的另一结构示意图；
图6B为本申请实施例提供的一种第二计算图的运行示意图；
图7A为本申请实施例提供的一种基于第一计算图生成第二计算图的另一结构示意图；
图7B为本申请实施例提供的一种执行第二计算图的示意图；
图8为本申请实施例提供的一种基于第一计算图生成第二计算图的另一结构示意图；
图9为本申请实施例提供的一种基于第三计算图得到第四计算图的示意图；
图10为本申请实施例提供的一种基于模型的数据处理方法的流程示意图；
图11为本申请实施例提供的一种处理模型以及基于模型处理数据的流程示意图；
图12为本申请实施例提供的一种模型的处理装置的结构示意图；
图13为本申请实施例提供的一种基于模型的数据处理装置的结构示意图；
图14为本申请实施例提供的执行设备的一种结构示意图；
图15为本申请实施例提供的芯片的一种结构示意图；
图16为本申请实施例提供的一种计算机可读存储介质的结构示意图。
具体实施方式
为了使本申请的目的、技术方案及优点更加清楚明白，下面结合附图，对本申请的实施例进行描述。显然，所描述的实施例仅仅是本申请一部分的实施例，而不是全部的实施例。本领域普通技术人员可知，随着新应用场景的出现，本申请实施例提供的技术方案对于类似的技术问题，同样适用。
本申请的说明书和权利要求书及上述附图中的术语“第一”、“第二”等是用于区别类似的对象，而不必用于描述特定的顺序或先后次序。应该理解这样使用的描述在适当情况下可以互换，以便使实施例能够以除了在本申请图示或描述的内容以外的顺序实施。此外，术语“包括”和“具有”以及他们的任何变形，意图在于覆盖不排他的包含，例如，包含了一系列步骤或模块的过程、方法、系统、产品或设备不必限于清楚地列出的那些步骤或模块，而是可包括没有清楚地列出的或对于这些过程、方法、产品或设备固有的其它步骤或模块。在本申请中出现的对步骤进行的命名或者编号，并不意味着必须按照命名或者编号所指示的时间/逻辑先后顺序执行方法流程中的步骤，已经命名或者编号的流程步骤可以根据要实现的技术目的变更执行顺序，只要能达到相同或者相类似的技术效果即可。本申请中所出现的单元的划分，是一种逻辑上的划分，实际应用中实现时可以有另外的划分方式，例如多个单元可以结合成或集成在另一个系统中，或一些特征可以忽略，或不执行，另外，所显示的或讨论的相互之间的耦合或直接耦合或通信连接可以是通过一些接口，单元之间的间接耦合或通信连接可以是电性或其他类似的形式，本申请中均不作限定。并且，作为分离部件说明的单元或子单元可以是也可以不是物理上的分离，可以是也可以不是物理单元，或者可以分布到多个电路单元中，可以根据实际的需要选择其中的部分或全部单元来实现本申请方案的目的。
为了便于理解，以下先介绍本申请实施例所涉及的技术术语。
(1)AI
AI是利用数字计算机或者数字计算机控制的机器模拟、延伸和扩展人的智能，感知环境、获取知识并使用知识获得最佳结果的理论、方法、技术及应用系统。换句话说，AI是计算机科学的一个综合技术，它企图了解智能的实质，并生产出一种新的能以人类智能相似的方式做出反应的智能机器。AI也就是研究各种智能机器的设计原理与实现方法，使机器具有感知、推理与决策的功能。
(2)AI模型
AI模型是AI技术中的一种用于处理特定任务的技术手段。一般来说，AI模型可以为由神经单元组成的神经网络。通常，AI模型是在模型所有者的设备或平台(如：服务器、虚拟机(virtual machine， VM)或容器(container)中进行训练得到的，训练好的AI模型会以模型文件的形式存储。在模型使用者的设备(如：终端设备、服务器或边缘设备、VM或容器等)需要使用该AI模型时，可以是模型使用者的设备主动加载该AI模型的模型文件；也可以是模型所有者的设备主动向模型使用者的设备发送AI模型的模型文件，以使得模型使用者的设备能够加载并执行该AI模型的模型文件。
其中，服务器是一种物理机。VM或容器都可以是在物理机的硬件资源上采用虚拟化的方式划分出来的虚拟化的设备。
终端设备(也可以称为用户设备(user equipment，UE))是一种具有无线收发功能的设备，可以部署在陆地上，包括室内或室外、手持或车载；也可以部署在水面上(如轮船等)；还可以部署在空中(例如飞机、气球和卫星上等)。示例性地，终端设备例如可以是智能手机(mobile phone)、平板电脑(pad)、带无线收发功能的电脑、物联网设备、虚拟现实(virtual reality，VR)终端、增强现实(augmented reality，AR)终端、工业控制(industrial control)中的无线终端、无人驾驶(self driving)中的无线终端、远程医疗(remote medical)中的无线终端、智能电网(smart grid)中的无线终端、运输安全(transportation safety)中的无线终端、智慧城市(smart city)中的无线终端、智慧家庭(smart home)中的无线终端等。
(3)计算图
计算图是用图论语言表示数学函数的一种方式，即将计算过程图形化表示出来。一般来说，计算图被定义为一个有向图，由节点和边所构成。在计算图中，输入值和计算函数都以节点的形式出现，而节点的输出项之间的关系则以有向线段(即节点间的边)表示。
(4)表达式
表达式，是由数字、算符、数字分组符号(括号)、自由变量和约束变量等以能求得数值的有意义排列方法所得的组合。简单来说，表达式是由操作数和运算符组成的式子，是一个具有完整意义的计算机指令。例如，表达式可以为(x+6)*3*COS(1)/2*8+7。
(5)不透明谓词
不透明谓词是一个表达式。不透明谓词的值在执行到某处时，对于不透明谓词的编写者而言必然是已知的，但是编译器或者静态分析器则无法推断出这个值，只能在运行不透明谓词时才能确定不透明谓词的值。
(6)可信执行环境(Trusted Execution Environment，TEE)
可信执行环境是指通过软硬件方法在中央处理器中构建一个安全区域，保证其内部加载的程序和数据在机密性和完整性上得到保护。简单来说，可信执行环境是中央处理器内的一个安全区域，中央处理器用于确保可信执行环境中代码和数据的机密性和完整性都得到保护，即运行在可信执行环境中的代码和数据，是保密且不可篡改的。
(7)代码混淆(obfuscated code)
代码混淆亦称花指令，是将计算机程序的代码，转换成一种功能上等价，但是难于阅读和理解的形式的行为。代码混淆可以用于程序源代码，也可以用于程序编译而成的中间代码。执行代码混淆的程序被称作代码混淆器。
简单来说，代码混淆可以是指将代码中的各种元素(例如变量，函数，类)的名字改写成无意义的名字。比如，将代码中的元素改写成单个字母，或是简短的无意义字母组合，甚至改写成“__”这样的符号，使得阅读的人无法根据名字猜测其用途。代码混淆还可以是重写代码中的部分逻辑，将其变成功能上等价，但是更难理解的形式。比如，将for循环改写成while循环，将循环改写成递归，精简中间变量等等。代码混淆还可以是打乱代码的格式。比如删除空格，将多行代码挤到一行中，或者将一行代码断成多行等等。
目前，AI服务提供商一般是在本地的模型训练环境中完成AI模型的训练和调优，得到AI模型对应的模型文件，然后通过模型文件的形式将AI模型部署至模型使用者的模型部署环境中(例如终端设备)。当AI模型的模型文件以明文形式部署于模型部署环境中时，容易受到不法分子的窃取。示例性地，请参阅图1，图1为本申请实施例提供的一种模型文件明文部署的示意图。如图1所示，AI服务提供商 在模型训练环境中训练得到AI模型，并生成AI模型的模型文件。然后，AI服务提供商将明文的模型文件部署至模型部署环境中，以使得模型部署环境中的AI计算框架能够通过导入模型文件来实现执行AI模型。然而，由于模型文件是以明文形式部署在模型部署环境中，因此不法分子能够通过攻击模型部署环境从而直接从模型部署环境中窃取得到模型文件，进而得到窃取的模型。
为解决AI模型容易被窃取的问题，目前业界提出了一些模型机密性保护方案。示例性地，请参阅图2，图2为本申请实施例提供的一种模型文件加密部署的示意图。如图2所示，AI服务提供商在模型训练环境中训练得到AI模型，并生成AI模型的模型文件。然后，AI服务提供商采用加密算法对模型文件进行加密，并将加密后的模型文件部署至模型使用者的模型部署环境中。当模型使用者需要使用AI模型时，通过应用程序触发模型文件的解密，并将模型文件解密至内存中，从而在内存中执行AI模型。
图2所示例的这种方案虽然可以保护AI模型的机密性，但是每次执行AI模型的推理前都需要对整个AI模型进行解密，计算开销巨大，会导致AI模型的推理时延被大大地延长，严重地限制了AI模型的应用。
基于此，本申请实施例提供了一种模型的处理方法，在AI模型原有的计算逻辑的基础上，增加与AI模型中的计算分支并列的混淆分支，并且通过表达式来确定计算分支和混淆分支之间的执行关系，只有在表达式的输出正确时才能够执行到正确的计算分支。这样一来，通过新增的混淆分支能够模糊原模型中显式的算子执行顺序和依赖关系，实现模型结构加扰，并且只需要对新增的表达式进行加密保护，则能够实现对整个AI模型正常执行流程的保护，降低了模型保护所带来的额外性能开销，有利于AI模型的推广应用。
请参阅图3，图3为本申请实施例提供的一种模型的处理方法的应用场景示意图。如图3所示，在模型的混淆阶段，通过对原模型文件进行解析，获取到原模型文件对应的计算图。然后，通过本申请实施例所提供的模型的处理方法对获取得到的计算图进行处理，并且基于处理后的计算图生成混淆态模型文件。其中，混淆态模型文件可以部署于模型使用者环境中。这样，在模型的推理阶段，AI应用程序能够获取到混淆态模型文件以及推理数据，并实现混淆模型的加载。通过执行本申请实施例提供的基于模型的数据处理方法，能够实现基于混淆模型执行推理，得到推理结果。
具体地，本申请实施例提供的模型的处理方法以及基于模型的数据处理方法均可以应用于电子设备或虚拟化设备上，该电子设备例如为上述的服务器以及终端设备；该虚拟化设备例如为上述的虚拟机和容器。
为了便于理解，以下将依次从模型的处理阶段和模型的使用阶段来介绍本申请实施例所提供的方法。并且，为了便于叙述，以下将以模型的处理阶段在服务器上执行，且模型的使用阶段在终端设备上执行为例，对本申请实施例提供的方法进行介绍。在实际应用中，模型的处理阶段并不限定于在服务器上执行，模型的使用阶段也不限定于在终端设备上执行。
请参阅图4，图4为本申请实施例提供的一种模型的处理方法的流程示意图。如图4所示，该模型的处理方法包括以下的步骤401-403。
步骤401，获取第一计算图，第一计算图用于指示AI模型的执行逻辑，第一计算图包括至少一个算子。
本实施例中，服务器可以通过解析AI模型的模型文件来获取第一计算图。其中，第一计算图可以是指示AI模型的部分执行逻辑，第一计算图也可以是指示整个AI模型的全部执行逻辑。
一般来说，AI模型中会包括多个计算单元，如：卷积单元、池化单元或加法单元等各种类型用于执行相应计算的单元，每个计算单元可以称为一个算子。AI模型的执行逻辑也就是每个计算单元执行的先后顺序以及各个计算单元之间的依赖关系。因此，在采用计算图来表示AI模型中的计算单元以及计算单元之间的输入或输出关系的情况下，上述的第一计算图能够指示AI模型的执行逻辑。
可选的，第一计算图中可以是包括AI模型中的所有算子或部分算子。并且，第一计算图中的算子的类型可以有一种或多种，同一种类型的算子也可以有一个或多个。算子的类型通常表征算子的计算属 性，如：卷积类型、池化类型、加法类型、批标准化类型或线性修正类型等。其中，卷积类型的算子指的是用于做卷积运算的算子，池化类型的算子指的是用于做池化运算的算子，加法类型的算子指的是用于做加法运算的算子，批标准化类型的算子指的是用于做批标准化的算子，线性修正类型的算子指的是用于做线性修正的算子。此外，在第一计算图中，每个算子都会有一个唯一的标识或唯一的名称，如：卷积算子1、卷积算子2、池化算子1或加法算子1等。
可选的，在服务器执行本申请实施例提供的方法之前，用户可以是对AI模型中需要进行混淆保护的算子进行指定。例如，用户指定AI模型中的某一个算子或多个算子需要进行混淆保护；或者，用户指定AI模型中的某一类或多类算子是需要进行混淆保护的。这样，服务器在解析AI模型的模型文件时，能够根据用户所指定的需要进行混淆保护的算子，确定第一计算图，该第一计算图中包括需要进行混淆保护的算子。
步骤402，基于第一计算图，生成第二计算图，第二计算图包括至少一个计算分支、至少一个混淆分支和第一表达式，第一表达式的输出用于指示执行至少一个计算分支或至少一个混淆分支中的分支，至少一个算子包含于至少一个计算分支中，至少一个计算分支与至少一个混淆分支具有不同的计算逻辑。
本实施例中，在第二计算图中，第一表达式可以是与至少一个计算分支以及至少一个混淆分支连接。并且，在执行第二计算图的过程中，先执行第一表达式，并根据第一表达式的输出选择执行至少一个计算分支或至少一个混淆分支中的分支。只有在第一表达式的输出是预设目标值的情况下，才执行上述的至少一个计算分支；在第一表达式的输出不是预设目标值的情况下，则执行上述的至少一个混淆分支。其中，预设目标值可以是包括一个或多个值。
具体地，第一计算图中的至少一个算子包含于第二计算图的至少一个计算分支中。因此，在第一表达式的输出为预设目标值时，执行第二计算图中的至少一个计算分支，从而保证实际计算逻辑与原AI模型的计算逻辑相同；在第一表达式的输出不为预设目标值时，执行第二计算图中的至少一个混淆分支，使得实际计算逻辑与原AI模型的计算逻辑不同，进而实现AI模型的保护。
步骤403，根据第二计算图生成AI模型对应的执行代码，执行代码中的目标代码被配置为加密保护，目标代码是与第一表达式相关的代码。
在得到第二计算图后，服务器可以根据第二计算图的计算逻辑生成AI模型对应的执行代码，以便于将AI模型部署至其他的设备上。其中，在服务器所生成的执行代码中，与第一表达式相关的目标代码被配置为加密保护，而执行代码中其他部分的代码则可以是不被配置为加密保护。
由于在第二计算图中，第一表达式的输出能够影响第二计算图中的计算分支与混淆分支之间的执行情况，因此通过对第一表达式的目标代码进行加密保护，则能够实现对第二计算图的计算逻辑进行保护。简单来说，即便攻击者通过窃取AI模型对应的执行代码实现了AI模型的盗取，由于第一表达式对应的目标代码受到加密保护，因此攻击者无法获取到第一表达式的计算逻辑，从而无法得到正确的输出值，进而无法获取到AI模型正确的执行逻辑。
本实施例中，在AI模型原有的计算逻辑的基础上，增加与AI模型中的计算分支并列的混淆分支，并且通过表达式来确定计算分支和混淆分支之间的执行关系，只有在表达式的输出正确时才能够执行到正确的计算分支。这样一来，通过新增的混淆分支能够模糊原模型中显式的算子执行顺序和依赖关系，实现模型结构加扰，并且只需要对新增的表达式进行加密保护，则能够实现对整个AI模型正常执行流程的保护，降低了模型保护所带来的额外性能开销，有利于AI模型的推广应用。
可选的，将与第一表达式相关的目标代码配置为加密保护的方式有多种。
在一种可能的实现方式中，与第一表达式相关的目标代码被配置为运行于可信执行环境中。当模型使用者的终端设备需要运行AI模型时，终端设备则将目标代码加载至可信执行环境中运行，从而基于可信执行环境来实现对目标代码的加密保护。
可以理解的是，由于可信执行环境是一种基于软硬件方法在中央处理器中所构建的一个安全区域，因此在目标代码被配置为运行于可信执行环境的情况下，需要模型使用者的终端设备本身支持可信执行环境，即对需要加载AI模型的终端设备具有一定的硬件要求。
在另一种可能的实现方式中，目标代码被配置为进行代码混淆。这样，在目标代码为被配置为进行 代码混淆的情况下，目标代码会被转换为功能相同但难以阅读和理解的代码，从而实现对目标代码的保护，且不影响目标代码的正常执行。
在另一种可能的实现方式中，目标代码被配置为采用加密算法加密保护。其中，加密算法例如可以为高级加密标准(Advanced Encryption Standard，AES)算法、数据加密标准(Data Encryption Standard，DES)算法、国际数据加密算法(International Data Encryption Algorithm，IDEA)以及RSA算法，本实施例并不对加密算法的类型做具体限定。当模型使用者的终端设备需要运行AI模型时，终端设备需要先采用解密算法对目标代码进行解密，才能够得到解密后的代码，从而基于解密后的代码获取第一表达式。
在一些示例中，服务器也可以是采用上述的多种实现方式同时对与第一表达式相关的目标代码进行加密保护。简单来说，目标代码被配置为运行于可信执行环境中，且目标代码同时被配置为采用加密算法加密保护。这样，在模型使用者的终端设备需要运行AI模型时，终端设备可以是在可信执行环境中对目标代码进行解密，得到解密后的代码，从而基于解密后的代码获取第一表达式；或者，终端设备可以是对目标代码进行解密，并将解密得到的代码在可信执行环境中运行，从而获取到第一表达式。
此外，除了对与第一表达式相关的目标代码进行加密保护之外，还可以对第一表达式本身进行保护。示例性地，第一表达式可以为不透明谓词，服务器采用不透明谓词来作为第一表达式。这样，在获取到第一表达式对应的目标代码时，无法通过目标代码推断出第一表达式的值，而是只有在运行目标代码的过程中才能够获取到第一表达式的值，从而实现第一表达式的隐藏保护。
以上介绍了通过生成新的计算图来对AI模型进行加密保护的过程，为便于理解，以下将详细介绍基于AI模型原有的计算图生成新的计算图的具体过程。
本实施例中，服务器基于第一计算图生成第二计算图的方式有多种。
实现方式1，服务器生成具有一个计算分支、至少一个混淆分支和第一表达式的第二计算图。
其中，第二计算图中的计算分支包括了第一计算图中的至少一个算子，第一表达式的输出用于指示执行计算分支以及至少一个混淆分支中的一个分支。
简单来说，在实现方式1中，第二计算图中的一个计算分支包括了第一计算图中的所有算子以及所有算子之间的依赖关系，通过执行第二计算图中的一个计算分支，则能够实现第一计算图中的计算逻辑。并且，第一表达式可以是分别与一个计算分支以及至少一个混淆分支连接，用于指示执行计算分支以及至少一个混淆分支中的任意一个分支。只有在第一表达式的输出正确时，才会执行第二计算图中的计算分支；否则，在第一表达式的输出错误时，会执行第二计算图中的至少一个混淆分支中的一个分支。
示例性地，可以参阅图5A，图5A为本申请实施例提供的一种基于第一计算图生成第二计算图的结构示意图。如图5A所示，第一计算图中包括依次连接的三个算子，分别为卷积算子、批归一化算子和线性修正算子。其中，卷积算子的输入为第一计算图的输入，批归一化算子的输入为卷积算子的输出，线性修正算子的输入为批归一化算子的输出，线性修正算子的输出为第一计算图的输出。在基于第一计算图所生成的第二计算图中，依次连接的卷积算子、批归一化算子和线性修正算子成为第二计算图中的一个计算分支。第二计算图中还包括一个与计算分支并列的混淆分支，且计算分支和混淆分支均与第一表达式连接。在第二计算图中，根据第一表达式输出的值，来确定所执行的分支。具体地，在第一表达式输出的值为预设目标值的情况下，则执行计算分支，从而实现如第一计算图所示的计算逻辑，使得第二计算图的输出与第一计算图的输出相同；在第一表达式输出的值不为预设目标值的情况下，则执行混淆分支，从而实现与第一计算图中不同的计算逻辑，使得第二计算图的输出与第一计算图的输出不同。
示例性地，可以参阅图5B，图5B为本申请实施例提供的一种基于第一计算图生成第二计算图的另一结构示意图。如图5B所示，图5B中的第一计算图与图5A中所示的第一计算图相同；并且，图5B中第二计算图的计算分支与图5A中第一计算图的计算分支相同，区别在于图5B中的第二计算图包括多个混淆分支，即混淆分支1、混淆分支2…混淆分支N。在图5B所示的第二计算图中，当第一表达式的输出为正确值时，执行计算分支；当第一表达式的输出为错误值1时，则执行混淆分支1；当第一表达式的输出为错误值2时，则执行混淆分支2；当第一表达式的输出为错误值N时，则执行混淆分支N。
本方案中，通过在第二计算图中设置一个或多个与计算分支并列的混淆分支，能够有效地模糊原模型中显式的算子执行顺序和依赖关系，实现对模型结构进行加扰，提高模型的机密性保护。
实现方式2，服务器生成具有多个计算分支、至少一个混淆分支和第一表达式的第二计算图。
其中，第一表达式与多个计算分支以及至少一个混淆分支连接，用于指示有序地执行有序地执行多个计算分支以及至少一个混淆分支中的多个分支。当第一表达式输出的值为预设目标值时，第一表达式则用于指示有序地执行多个计算分支；当第一表达式输出的值不为预设目标值时，第一表达式则用于指示有序地执行其他多个分支或者是乱序地执行多个计算分支。总的来说，只有在第一表达式的输出为预设目标值时，第二计算图的计算逻辑才与第一计算图的计算逻辑相同；在第一表达式的输出不为预设目标值时，第二计算图的计算逻辑则不与第一计算图的计算逻辑相同。
示例性地，请参阅图6A，图6A为本申请实施例提供的一种基于第一计算图生成第二计算图的另一结构示意图。如图6A所示，图6A中的第一计算图与图5A中所示的第一计算图相同。并且，图6A中的第二计算图包括并列的多个计算分支和多个混淆分支，该多个计算分支中的每个计算分支包括一个算子。具体地，在图6A的第二计算图中，从左往右依次排列有六个分支，其中第一个分支为包括卷积算子的计算分支，第二个分支为混淆分支1，第三个分支为包括批归一化算子的计算分支，第四个分支为混淆分支2，第五个分支为包括线性修正算子的计算分支，第六个分支为混淆分支3。此外，上述的六个分支还连接有一个判断式，该判断式用于判定已执行的分支数量；且该判断式与第一表达式连接，用于根据第一表达式的输出值确定每次执行完一个分支后下一个继续执行的分支。
请参阅图6B，图6B为本申请实施例提供的一种第二计算图的运行示意图。如图6B所述，第二计算图的执行步骤共包括7个。步骤1，运行第一表达式，并基于第一表达式的输出值确定执行包括卷积算子的计算分支。步骤2，执行卷积算子，并基于判断式判断是否已执行三个分支。步骤3，判断式基于第一表达式的输出值，确定需执行的第二个分支为包括批归一化算子的计算分支。步骤4，执行批归一化算子，并基于判断式判断是否已执行三个分支。步骤5，判断式基于第一表达式的输出值，确定需执行的第三个分支为包括线性修正算子的计算分支。步骤6，执行线性修正算子，并基于判断式判断是否已执行三个分支。步骤7，判断式将执行线性修正算子所得到的结果作为输出值输出。
由图6B可知，基于图6A中所示的第二计算图能够实现有序地执行第一计算图中所示的多个算子，从而使得第二计算图的计算逻辑与第一计算图的计算逻辑相同。
此外，在图6A的第一表达式的输出值为错误值时，第二计算图的计算逻辑则不为依次执行第一个分支、第三个分支以及第五个分支，从而使得第二计算图的计算逻辑与第一计算图的计算逻辑不同。例如，在第一表达式的输出值为错误值1时，第二计算图的计算逻辑可以为依次执行第二个分支、第四个分支以及第六个分支。又例如，在第一表达式的输出值为错误值2时，第二计算图的计算逻辑可以为依次执行第二个分支、第三个分支以及第四个分支。
实现方式3，服务器生成具有多个计算分支、至少一个混淆分支、第一表达式和第二表达式的第二计算图。
其中，第一表达式的输出用于指示执行多个计算分支和至少一个混淆分支中的一个分支。第二表达式与多个计算分支和至少一个混淆分支连接，且第二表达式用于指示第一表达式的循环执行次数。并且，第一表达式的输入与上一次执行的分支相关。
具体地，第二表达式的输入与上一次执行的分支相关，第二表达式的输出用于指示是否循环执行第一表达式。
在执行第二计算图的过程中，基于输入值，运行第一表达式，得到第一表达式的输出值；然后，基于第一表达式的输出值确定执行的分支。在执行分支后，执行第二表达式，以确定是否继续循环执行第一表达式。在确定继续循环第一表达式的情况下，基于执行分支所得到的输出值，继续执行第一表达式，以确定下一个需要执行的分支。通过循环执行上述的步骤，直至基于第二表达式的输出值确定终止循环第一表达式，从而实现依次执行多个计算分支，使得第二计算图的计算逻辑与第一计算图的计算逻辑相同。
示例性地，请参阅图7A，图7A为本申请实施例提供的一种基于第一计算图生成第二计算图的另一 结构示意图。如图7A所示，图7A中的第一计算图与图5A中所示的第一计算图相同。并且，图7A中的第二计算图包括并列的多个计算分支和多个混淆分支，该多个计算分支中的每个计算分支包括一个算子。此外，对于多个计算分支和多个混淆分支中的每一个分支，分支内还具有计算表达式(即P1、P2、P3、P4、P5、P6等表达式)，这些计算表达式用于给变量next赋值。此外，第一表达式包括两个输入，一个输入是作为后续所执行的分支的输入，另一个输入则为变量next，第一表达式用于基于变量next的值得到相应的输出。第二表达式则基于前一个所执行的分支内给变量next所赋予的值，确定是否继续第一表达式。
示例性地，请参阅图7B，图7B为本申请实施例提供的一种执行第二计算图的示意图。如图7B所示，第一表达式为一个选择(switch)算子，用于基于变量next的值选择相应的分支。其中，第一表达式的初始输入为next＝P0，基于该初始输入，第一表达式选择执行包括卷积算子的分支。
在执行包括卷积算子的分支时，该分支同时将变量next的值赋为表达式P1的输出值。其中表达式P1-表达式P4值均小于表达式P5的值，表达式P6的值大于表达式P5的值。
在执行完毕包括卷积算子的分支后，执行第二表达式，判断next的值是否大于等于表达式P5的输出值，并基于当前next的值小于表达式P5的输出值，选择循环执行第一表达式。
在第二次执行第一表达式时，第一表达式的输入包括执行卷积算子后的输出，以及next＝P1；基于next＝P1，第一表达式选择执行包括批归一化算子的分支，并将执行执行卷积算子后的输出作为批归一化算子的输入。
在执行包括批归一化算子的分支时，该分支同时将变量next的值赋为表达式P3的输出值。
在执行完毕包括批归一化算子的分支后，执行第二表达式，判断next的值是否大于等于表达式P5的输出值，并基于当前next的值小于表达式P5的输出值，选择循环执行第一表达式。
在第三次执行第一表达式时，第一表达式的输入包括执行批归一化算子后的输出，以及next＝P3；基于next＝P3，第一表达式选择执行包括线性修正算子的分支，并将执行执行批归一化算子后的输出作为线性修正算子的输入。
在执行完毕包括线性修正算子的分支后，执行第二表达式，判断next的值是否大于等于表达式P5的输出值，并基于当前next的值等于表达式P5的输出值，选择不再循环执行第一表达式，从而输出线性修正算子的输出值。
总的来说，在图7B所示的第二计算图中，通过变量next、第一表达式和第二表达式的配合，能够实现有序地执行多个计算分支，使得第二计算图的计算逻辑与第一计算图的计算逻辑相同。
在上述的实现方式1和实现方式2中，第一表达式的初始输入可以包括第一数值，且第一数值被配置为加密保护。也就是说，第一表达式的初始输入可以是固定的，只有第一表达式的初始输入为第一数值时，第一表达式才能够输出正确值，从而使得第二计算图的计算逻辑与第一计算图的计算逻辑相同。此外，通过将第一数值配置为加密保护，可以实现对第一表达式的输出进行保护，攻击者即便获取到了整个第二计算图，也会因为无法获取到第一表达式正确的输入值而无法获取到第二计算图正确的计算逻辑，从而实现模型的机密性保护。
此外，第一表达式的初始输入也可以是包括计算表达式的输出，该计算表达式的输出是对第一数值进行处理得到的。同样地，只有在计算表达式的输入为第一数值时，第一表达式才能够输出正确值。
示例性地，以实现方式1为例，以下将结合附图介绍第一表达式的输入还包括第一数值时的第二计算图。请参阅图8，图8为本申请实施例提供的一种基于第一计算图生成第二计算图的另一结构示意图。如图8所示，图8中的第一计算图与图5A中所示的第一计算图相同。图8中的第二计算图包括计算分支和混淆分支，其中第一表达式包括两个输入，一个输入用于作为后续计算分支或混淆分支的输入，另一个输入则作为第一表达式本身的输入。其中，另一个输入可以为第一数值或者计算表达式基于第一数值所得到的输出值。只有在第一表达式本身的输入正确的情况下，第一表达式的输入为第一数值或计算表达式的输入为第一数值时，第一表达式的输出才为预设目标值，即第二计算图才会执行到计算分支；否则，在第一表达式的输入不为第一数值或计算表达式的输入不为第一数值时，第一表达式的输出不为预设目标值，第二计算图会执行混淆分支，从而使得第二计算图的实际计算逻辑与第一计算图的计算逻 辑不同。
以上介绍了通过生成第二计算图的方式对AI模型结构进行加扰，从而实现对AI模型的机密性保护。以下将介绍从另外一个角度对AI模型的机密性进行保护的方式。
本实施例中，服务器可以是对AI模型中算子的权重参数进行加扰混淆，避免攻击者通过盗用AI模型中各个算子来实现对AI模型的盗用。
示例性地，服务器可以获取第三计算图，第三计算图用于指示AI模型的执行逻辑，且第三计算图包括第一算子。其中，第三计算图与上述的第一计算图可以是AI模型中不同的两个计算图；第三计算图也可以是第一计算图的一个子计算图，即第三计算图所包括的第一算子属于第一计算图中的多个算子中的一个。
基于第三计算图，生成第四计算图，第四计算图包括第二算子和第三表达式，第二算子是对第一算子的权重参数修改后得到的，第三表达式的输入包括第二算子的输出，且第三表达式的输出与第一算子在采用与第二算子相同的输入时的输出相同。也就是说，服务器对第三计算图中的第一算子的权重参数进行了修改，得到了第四计算图中的第二算子。并且，服务器还在第二算子后插入了第三表达式，以使得第二算子和第三表达式结合后的输出值能够与第一算子的输出值相同，即维持第四计算图的计算结果与第三计算图的计算结果不变。
简单来说，在第二算子的权重参数是对第一算子的权重参数进行修改得到的情况下，基于相同的输入，第二算子的输出与第一算子的输出必然是不相同的；因此，通过引入一个第三表达式，来将第二算子的输出转换为与第一算子的输出相同的值。
在得到第四计算图后，服务器可以是根据第二计算图和第四计算图生成AI模型对应的执行代码。
可选的，第二算子的权重参数是基于第二数值对第一算子的权重参数修改后得到的，第三表达式的输入包括第二数值，且第二数值被配置为加密保护。即，只有在第三表达式的输入为第二数值的情况下，第三表达式才能够将第二算子的输出转换为与第一算子的输出相同；否则，在第三表达式的输入不为第二数值的情况下，第三表达式无法将第二算子的输出转换为与第一算子的输出相同的值。
其中，第二数值被配置为加密保护的方式可以是与上述实施例中所介绍的第一表达式被配置加密保护的方式相同，即第二数值被配置为被配置为采用加密算法加密和/或运行于可信执行环境，具体请参考上述的实施例，在此不再赘述。
示例性地，请参阅图9，图9为本申请实施例提供的一种基于第三计算图得到第四计算图的示意图。如图9所示，第三计算图中包括卷积算子1，该卷积算子1的计算公式为y＝x*w+b；其中，y为输出值，x为输入值，w和b为权重参数。基于第三计算图所得到的第四计算图中，包括卷积算子2和第三表达式。其中，卷积算子2是对卷积算子1中的权重参数w进行修改后得到的，卷积算子2的计算公式为y＝x*w’+b；其中，w’＝w+r，或者w’＝w+S(r)，r为第一数值，S(r)为经过计算表达式对r进行处理后的值。此外，第三表达式的输入包括卷积算子2的输出以及第一数值或第一数值经过计算表达式后的输出。当卷积算子1与卷积算子2的输入相同的情况下，第三表达式的输出与卷积算子1的输出相同。也就是说，假设第三表达式为D，对于任意输入x，均满足以下的等式：D(r，x*w’+b)＝x*w+b。
由上述的示例可以看出，在输入第三表达式的第一数值不正确的情况下，第三表达式无法将第二算子的输出转换为第一算子的输出，因此通过对第一数值进行加密保护，则能够实现对第四计算图中的计算逻辑进行保护，从而实现对整个AI模型正常执行流程的保护，并降低了模型保护所带来的额外性能开销。
以上介绍了本申请实施例提供的一种模型的处理方法，以下将介绍在得到混淆态的模型之后，基于模型对数据进行处理的方法。
请参阅图10，图10为本申请实施例提供的一种基于模型的数据处理方法的流程示意图。如图10所示，该基于模型的数据处理方法包括以下的步骤1001-1003。
步骤1001，基于AI模型的执行代码，获取第二计算图，第二计算图包括至少一个计算分支、至少 一个混淆分支和第一表达式，第一表达式的输出用于指示执行至少一个计算分支或至少一个混淆分支中的分支，至少一个计算分支包括至少一个AI模型的算子，至少一个计算分支与至少一个混淆分支具有不同的计算逻辑，执行代码中与第一表达式相关的目标代码被配置为加密保护。
本实施例中，AI模型的执行代码是基于上述图4对应的实施例中所述的模型的处理方法得到的。因此，终端设备通过解析AI模型的执行代码，能够得到第二计算图。其中，本实施例中所述的第二计算图与图4对应的实施例中所述的第二计算图类似，具体请参考上述图4对应的实施例，在此不再赘述。
步骤1002，获取AI模型的输入数据。
其中，AI模型的输入数据即为待处理的数据。例如，假设AI模型为图像处理模型(例如图像分类模型或图像分割模型)时，AI模型的输入数据可以为图像数据；假设AI模型为语音处理模型(例如语音识别模型)时，AI模型的输入数据可以为语音数据。总之，AI模型的输入数据可以是根据AI模型的实际类型来确定，本实施例并不限定AI模型的输入数据的类型。
步骤1003，基于第二计算图对输入数据进行处理，得到AI模型的输出数据。
在得到第二计算图的情况下，终端设备可以是基于第二计算图对输入数据进行处理，从而得到AI模型的输出数据。在第二计算图为AI模型中的部分计算图的情况下，终端设备还可以是基于第二计算图以及其他的计算图来对输入数据进行处理，得到AI模型的输出数据。
在一种可能的实现方式中，第二计算图仅包括一个计算分支；第一表达式的输出用于指示执行计算分支以及至少一个混淆分支中的一个分支。
在一种可能的实现方式中，第二计算图包括多个计算分支，且第二计算图还包括第二表达式；第一表达式的输出用于指示执行多个计算分支和至少一个混淆分支中的一个分支；第二表达式与多个计算分支和至少一个混淆分支连接，第二表达式用于指示第一表达式的循环执行次数，且第一表达式的输入与上一次执行的分支相关。
在一种可能的实现方式中，第二表达式的输入与上一次执行的分支相关，第二表达式的输出用于指示是否循环执行第一表达式。
在一种可能的实现方式中，第一表达式的初始输入包括第一数值，第一数值被配置为加密保护。
在一种可能的实现方式中，目标代码被配置为运行于可信执行环境中；基于AI模型的执行代码，获取第二计算图，包括：终端设备在可信执行环境中运行目标代码，以获取第二计算图中的第一表达式。
在一种可能的实现方式中，目标代码被配置为采用加密算法加密保护。终端设备可以对执行代码中的目标代码进行解密，得到解密后的代码；并且，终端设备执行解密后的代码，得到第一表达式。
在一种可能的实现方式中，该方法还包括：基于AI模型的执行代码，获取第四计算图，第四计算图包括第二算子和第三表达式，第二算子是对AI模型中第一算子的权重参数修改后得到的，第三表达式的输入包括第二算子的输出，且第三表达式的输出与第一算子在采用与第二算子相同的输入时的输出相同；基于第二计算图对输入数据进行处理，包括：基于第二计算图和第四计算图对输入数据进行处理。
在一种可能的实现方式中，第二算子的权重参数是基于第二数值对第一算子的权重参数修改后得到的，第三表达式的输入包括第二数值，且第二数值被配置为加密保护。
为了便于理解，以下将结合具体例子对本申请实施例提供的模型的处理方法以及基于模型的数据处理方法进行介绍。
请参阅图11，图11为本申请实施例提供的一种处理模型以及基于模型处理数据的流程示意图。
在模型的混淆阶段，通过对原模型文件进行解析，获取到原模型文件对应的计算图。然后，通过本申请实施例所提供的模型的处理方法对获取得到的计算图进行控制流结构混淆、加密数据结构混淆和/或基于加密数据的模型权重混淆，得到混淆态模型文件。
其中，控制流结构混淆是指通过添加混淆分支的方式，模糊计算图中显式算子执行顺序和依赖关系，达到隐藏模型真实计算逻辑的效果。其中，添加混淆分支的方式如上述图5A至图7B对应实施例所述，服务器生成一个与待保护计算子图对应的虚假子图，并结合用户自定义的不透明谓词表达式(即上述的第一表达式)，建立一个switch算子结构，switch算子结构的一个分支是待保护计算子图，另一个分支 是虚假子图或表达式，以此模糊算子之间的依赖关系。又或者，对待保护计算子图生成一定数量的虚假子图和用于判断分支选择的计算表达式，使用switch算子，在每个switch的分支中分别插入待保护计算子图和虚假子图，通过计算表达式和用户自定义的不透明谓词控制分支的执行顺序，从而隐藏模型算子的执行顺序。
加密数据结构混淆是指基于加密的数据对模型结构进行混淆，具体如图8对应的实施例所述。具体地，服务器对待保护计算子图生成对应的虚假子图和计算表达式。通过引入外部生成的随机数，将随机数当作输入条件传入计算表达式中，从而判断控制流结构的执行分支。在推理时只有传入正确的随机数，混淆后的模型才能输出正确的结果，从而防止模型被盗用。
基于加密数据的模型权重混淆是指对于每个需要保护的权重，引用外部生成的随机噪声对权重进行加扰，且每个权重加扰时可以使用不同的随机噪声。为保证权重加扰不会影响模型执行结果的正确性，需在权重加扰过的算子后加入新建子图(即上述实施例所述的第三表达式)，将随机噪声时和权重加扰过的算子的结果传入该新建子图。新建子图可以复原被保护算子未加扰的输出，从而满足权重加扰不影响模型执行的结果准确性。
在模型的混淆阶段，由于在模型混淆的过程中使用到了随机数，因此还可以对随机数进行加密，生成元数据文件。
模型混淆完毕后，将混淆态模型文件以及相应的加密后的元数据文件部署到终端设备上。
在模型推理阶段，终端设备加载并解析混淆态模型文件，以获取AI模型的计算图。然后，终端设备对元数据文件进行解密来获取随机数集合，解密过程可以在可信执行环境中执行。在解密得到随机数集合后，终端设备根据AI应用程序输入的推理数据以及解密后的随机数，遍历执行任务序列中的每个计算单元，直接进行混淆态模型推理，得到推理结果。
以上介绍了本申请实施例提供的方法，为便于理解，以下将介绍用于执行上述实施例所述的方法的装置。
请参阅图12，图12为本申请实施例提供的一种模型的处理装置的结构示意图。如图12所示，该模型的处理装置包括：获取模块1201，用于获取第一计算图，所述第一计算图用于指示AI模型的执行逻辑，所述第一计算图包括至少一个算子；处理模块1202，用于基于所述第一计算图，生成第二计算图，所述第二计算图包括至少一个计算分支、至少一个混淆分支和第一表达式，所述第一表达式的输出用于指示执行所述至少一个计算分支中的分支或所述至少一个混淆分支中的分支，所述至少一个算子包含于所述至少一个计算分支中，所述至少一个计算分支与所述至少一个混淆分支具有不同的计算逻辑；处理模块1202，用于根据所述第二计算图生成所述AI模型对应的执行代码，所述执行代码中与所述第一表达式相关的目标代码被配置为加密保护。
在一种可能的实现方式中，所述第二计算图仅包括一个计算分支；所述第一表达式的输出用于指示执行所述计算分支以及所述至少一个混淆分支中的一个分支。
在一种可能的实现方式中，所述第二计算图包括多个计算分支，且所述第二计算图还包括第二表达式；所述第一表达式的输出用于指示执行所述多个计算分支和所述至少一个混淆分支中的一个分支；所述第二表达式与所述多个计算分支和所述至少一个混淆分支连接，所述第二表达式用于指示所述第一表达式的循环执行次数，且所述第一表达式的输入与上一次执行的分支相关。
在一种可能的实现方式中，所述第二表达式的输入与上一次执行的分支相关，所述第二表达式的输出用于指示是否循环执行所述第一表达式。
在一种可能的实现方式中，所述第一表达式的初始输入包括第一数值，所述第一数值被配置为加密保护。
在一种可能的实现方式中，所述目标代码被配置为运行于可信执行环境中。
在一种可能的实现方式中，所述目标代码被配置为采用加密算法加密保护。
在一种可能的实现方式中，所述获取模块1201，还用于获取第三计算图，所述第三计算图用于指示所述AI模型的执行逻辑，所述第三计算图包括第一算子；所述处理模块1202，还用于：基于所述第三 计算图，生成第四计算图，所述第四计算图包括第二算子和第三表达式，所述第二算子是对所述第一算子的权重参数修改后得到的，所述第三表达式的输入包括所述第二算子的输出，且所述第三表达式的输出与所述第一算子在采用与所述第二算子相同的输入时的输出相同；根据所述第二计算图和所述第四计算图生成所述AI模型对应的执行代码。
在一种可能的实现方式中，所述第二算子的权重参数是基于第二数值对所述第一算子的权重参数修改后得到的，所述第三表达式的输入包括所述第二数值，且所述第二数值被配置为加密保护。
请参阅图13，图13为本申请实施例提供的一种基于模型的数据处理装置的结构示意图。如图13所示，该基于模型的数据处理装置包括：获取模块1301，用于基于AI模型的执行代码，获取第二计算图，所述第二计算图包括至少一个计算分支、至少一个混淆分支和第一表达式，所述第一表达式的输出用于指示执行所述至少一个计算分支中的分支或所述至少一个混淆分支中的分支，所述至少一个计算分支包括至少一个所述AI模型的算子，所述至少一个计算分支与所述至少一个混淆分支具有不同的计算逻辑，所述执行代码中与所述第一表达式相关的目标代码被配置为加密保护；所述获取模块1301，还用于获取所述AI模型的输入数据；所述处理模块1302，还用于基于所述第二计算图对所述输入数据进行处理，得到所述AI模型的输出数据。
在一种可能的实现方式中，所述第二计算图仅包括一个计算分支；所述第一表达式的输出用于指示执行所述计算分支以及所述至少一个混淆分支中的一个分支。
在一种可能的实现方式中，所述第二计算图包括多个计算分支，且所述第二计算图还包括第二表达式；所述第一表达式的输出用于指示执行所述多个计算分支和所述至少一个混淆分支中的一个分支；所述第二表达式与所述多个计算分支和所述至少一个混淆分支连接，所述第二表达式用于指示所述第一表达式的循环执行次数，且所述第一表达式的输入与上一次执行的分支相关。
在一种可能的实现方式中，所述第二表达式的输入与上一次执行的分支相关，所述第二表达式的输出用于指示是否循环执行所述第一表达式。
在一种可能的实现方式中，所述第一表达式的初始输入包括第一数值，所述第一数值被配置为加密保护。
在一种可能的实现方式中，所述目标代码被配置为运行于可信执行环境中，和/或所述目标代码被配置为进行代码混淆。
在一种可能的实现方式中，所述目标代码被配置为采用加密算法加密保护；所述处理模块1302，还用于对所述执行代码中的所述目标代码进行解密，得到解密后的代码；执行所述解密后的代码，得到所述第一表达式。
在一种可能的实现方式中，所述获取模块1301，还用于基于所述AI模型的执行代码，获取第四计算图，所述第四计算图包括第二算子和第三表达式，所述第二算子是对所述AI模型中第一算子的权重参数修改后得到的，所述第三表达式的输入包括所述第二算子的输出，且所述第三表达式的输出与所述第一算子在采用与所述第二算子相同的输入时的输出相同；所述处理模块1302，还用于基于所述第二计算图和所述第四计算图对所述输入数据进行处理。
在一种可能的实现方式中，所述第二算子的权重参数是基于第二数值对所述第一算子的权重参数修改后得到的，所述第三表达式的输入包括所述第二数值，且所述第二数值被配置为加密保护。
接下来介绍本申请实施例提供的一种执行设备，请参阅图14，图14为本申请实施例提供的执行设备的一种结构示意图，执行设备1400具体可以表现为手机、平板、笔记本电脑、智能穿戴设备、服务器等，此处不做限定。具体的，执行设备1400包括：接收器1401、发射器1402、处理器1403和存储器1404(其中执行设备1400中的处理器1403的数量可以一个或多个，图14中以一个处理器为例)，其中，处理器1403可以包括应用处理器14031和通信处理器14032。在本申请的一些实施例中，接收器1401、发射器1402、处理器1403和存储器1404可通过总线或其它方式连接。
存储器1404可以包括只读存储器和随机存取存储器，并向处理器1403提供指令和数据。存储器1404 的一部分还可以包括非易失性随机存取存储器(non-volatile random access memory，NVRAM)。存储器1404存储有处理器和操作指令、可执行模块或者数据结构，或者它们的子集，或者它们的扩展集，其中，操作指令可包括各种操作指令，用于实现各种操作。
处理器1403控制执行设备的操作。具体的应用中，执行设备的各个组件通过总线系统耦合在一起，其中总线系统除包括数据总线之外，还可以包括电源总线、控制总线和状态信号总线等。但是为了清楚说明起见，在图中将各种总线都称为总线系统。
上述本申请实施例揭示的方法可以应用于处理器1403中，或者由处理器1403实现。处理器1403可以是一种集成电路芯片，具有信号的处理能力。在实现过程中，上述方法的各步骤可以通过处理器1403中的硬件的集成逻辑电路或者软件形式的指令完成。上述的处理器1403可以是通用处理器、数字信号处理器(digital signal processing，DSP)、微处理器或微控制器，还可进一步包括专用集成电路(application specific integrated circuit，ASIC)、现场可编程门阵列(field-programmable gate array，FPGA)或者其他可编程逻辑器件、分立门或者晶体管逻辑器件、分立硬件组件。该处理器1403可以实现或者执行本申请实施例中的公开的各方法、步骤及逻辑框图。通用处理器可以是微处理器或者该处理器也可以是任何常规的处理器等。结合本申请实施例所公开的方法的步骤可以直接体现为硬件译码处理器执行完成，或者用译码处理器中的硬件及软件模块组合执行完成。软件模块可以位于随机存储器，闪存、只读存储器，可编程只读存储器或者电可擦写可编程存储器、寄存器等本领域成熟的存储介质中。该存储介质位于存储器1404，处理器1403读取存储器1404中的信息，结合其硬件完成上述方法的步骤。
接收器1401可用于接收输入的数字或字符信息，以及产生与执行设备的相关设置以及功能控制有关的信号输入。发射器1402可用于通过第一接口输出数字或字符信息；发射器1402还可用于通过第一接口向磁盘组发送指令，以修改磁盘组中的数据；发射器1402还可以包括显示屏等显示设备。
本申请实施例中，在一种情况下，处理器1403，用于执行图4或图10对应实施例中的方法。
本申请实施例提供的电子设备具体可以为芯片，芯片包括：处理单元和通信单元，所述处理单元例如可以是处理器，所述通信单元例如可以是输入/输出接口、管脚或电路等。该处理单元可执行存储单元存储的计算机执行指令，以使执行设备内的芯片执行上述实施例描述的模型超参数的选择方法，或者，以使训练设备内的芯片执行上述实施例描述的模型超参数的选择方法。可选地，所述存储单元为所述芯片内的存储单元，如寄存器、缓存等，所述存储单元还可以是所述无线接入设备端内的位于所述芯片外部的存储单元，如只读存储器(read-only memory，ROM)或可存储静态信息和指令的其他类型的静态存储设备，随机存取存储器(random access memory，RAM)等。
具体的，请参阅图15，图15为本申请实施例提供的芯片的一种结构示意图，所述芯片可以表现为神经网络处理器NPU 1500，NPU 1500作为协处理器挂载到主CPU(Host CPU)上，由Host CPU分配任务。NPU的核心部分为运算电路1503，通过控制器1504控制运算电路1503提取存储器中的矩阵数据并进行乘法运算。
在一些实现中，运算电路1503内部包括多个处理单元(Process Engine,PE)。在一些实现中，运算电路1503是二维脉动阵列。运算电路1503还可以是一维脉动阵列或者能够执行例如乘法和加法这样的数学运算的其它电子线路。在一些实现中，运算电路1503是通用的矩阵处理器。
举例来说，假设有输入矩阵A，权重矩阵B，输出矩阵C。运算电路从权重存储器1502中取矩阵B相应的数据，并缓存在运算电路中每一个PE上。运算电路从输入存储器1501中取矩阵A数据与矩阵B进行矩阵运算，得到的矩阵的部分结果或最终结果，保存在累加器(accumulator)1508中。
统一存储器1506用于存放输入数据以及输出数据。权重数据直接通过存储单元访问控制器(Direct Memory Access Controller，DMAC)1505，DMAC被搬运到权重存储器1502中。输入数据也通过DMAC被搬运到统一存储器1506中。
BIU为Bus Interface Unit即，总线接口单元1515，用于AXI总线与DMAC和取指存储器(Instruction Fetch Buffer，IFB)1509的交互。
总线接口单元1515(Bus Interface Unit，简称BIU)，用于取指存储器1509从外部存储器获取指令， 还用于存储单元访问控制器1505从外部存储器获取输入矩阵A或者权重矩阵B的原数据。
DMAC主要用于将外部存储器DDR中的输入数据搬运到统一存储器1506或将权重数据搬运到权重存储器1502中或将输入数据数据搬运到输入存储器1501中。
向量计算单元1507包括多个运算处理单元，在需要的情况下，对运算电路1503的输出做进一步处理，如向量乘，向量加，指数运算，对数运算，大小比较等等。主要用于神经网络中非卷积/全连接层网络计算，如Batch Normalization(批归一化)，像素级求和，对特征平面进行上采样等。
在一些实现中，向量计算单元1507能将经处理的输出的向量存储到统一存储器1506。例如，向量计算单元1507可以将线性函数；或，非线性函数应用到运算电路1503的输出，例如对卷积层提取的特征平面进行线性插值，再例如累加值的向量，用以生成激活值。在一些实现中，向量计算单元1507生成归一化的值、像素级求和的值，或二者均有。在一些实现中，处理过的输出的向量能够用作到运算电路1503的激活输入，例如用于在神经网络中的后续层中的使用。
控制器1504连接的取指存储器(instruction fetch buffer)1509，用于存储控制器1504使用的指令；
统一存储器1506，输入存储器1501，权重存储器1502以及取指存储器1509均为On-Chip存储器。外部存储器私有于该NPU硬件架构。
其中，上述任一处提到的处理器，可以是一个通用中央处理器，微处理器，ASIC，或一个或多个用于控制上述程序执行的集成电路。
可以参阅图16，图16为本申请实施例提供的一种计算机可读存储介质的结构示意图。本申请还提供了一种计算机可读存储介质，在一些实施例中，上述图4或图10所公开的方法可以实施为以机器可读格式被编码在计算机可读存储介质上或者被编码在其它非瞬时性介质或者制品上的计算机程序指令。
图16示意性地示出根据这里展示的至少一些实施例而布置的示例计算机可读存储介质的概念性局部视图，示例计算机可读存储介质包括用于在计算设备上执行计算机进程的计算机程序。
在一个实施例中，计算机可读存储介质1600是使用信号承载介质1601来提供的。信号承载介质1601可以包括一个或多个程序指令1602，其当被一个或多个处理器运行时可以提供以上针对图4或图10描述的功能或者部分功能。此外，图16中的程序指令1602也描述示例指令。
在一些示例中，信号承载介质1601可以包含计算机可读介质1603,诸如但不限于，硬盘驱动器、紧密盘(CD)、数字视频光盘(DVD)、数字磁带、存储器、ROM或RAM等等。
在一些实施方式中，信号承载介质1601可以包含计算机可记录介质1604，诸如但不限于，存储器、读/写(R/W)CD、R/W DVD、等等。在一些实施方式中，信号承载介质1601可以包含通信介质1605,诸如但不限于，数字和/或模拟通信介质(例如，光纤电缆、波导、有线通信链路、无线通信链路、等等)。因此，例如，信号承载介质1601可以由无线形式的通信介质1605(例如，遵守IEEE 802.16标准或者其它传输协议的无线通信介质)来传达。
一个或多个程序指令1602可以是，例如，计算机可执行指令或者逻辑实施指令。在一些示例中，计算设备的计算设备可以被配置为，响应于通过计算机可读介质1603、计算机可记录介质1604、和/或通信介质1605中的一个或多个传达到计算设备的程序指令1602，提供各种操作、功能、或者动作。
另外需说明的是，以上所描述的装置实施例仅仅是示意性的，其中所述作为分离部件说明的单元可以是或者也可以不是物理上分开的，作为单元显示的部件可以是或者也可以不是物理单元，即可以位于一个地方，或者也可以分布到多个网络单元上。可以根据实际的需要选择其中的部分或者全部模块来实现本实施例方案的目的。另外，本申请提供的装置实施例附图中，模块之间的连接关系表示它们之间具有通信连接，具体可以实现为一条或多条通信总线或信号线。
通过以上的实施方式的描述，所属领域的技术人员可以清楚地了解到本申请可借助软件加必需的通用硬件的方式来实现，当然也可以通过专用硬件包括专用集成电路、专用CPU、专用存储器、专用元器件等来实现。一般情况下，凡由计算机程序完成的功能都可以很容易地用相应的硬件来实现，而且，用来实现同一功能的具体硬件结构也可以是多种多样的，例如模拟电路、数字电路或专用电路等。但是，对本申请而言更多情况下软件程序实现是更佳的实施方式。基于这样的理解，本申请的技术方案本质上 或者说对现有技术做出贡献的部分可以以软件产品的形式体现出来，该计算机软件产品存储在可读取的存储介质中，如计算机的软盘、U盘、移动硬盘、ROM、RAM、磁碟或者光盘等，包括若干指令用以使得一台计算机设备(可以是个人计算机，训练设备，或者网络设备等)执行本申请各个实施例所述的方法。
在上述实施例中，可以全部或部分地通过软件、硬件、固件或者其任意组合来实现。当使用软件实现时，可以全部或部分地以计算机程序产品的形式实现。
所述计算机程序产品包括一个或多个计算机指令。在计算机上加载和执行所述计算机程序指令时，全部或部分地产生按照本申请实施例所述的流程或功能。所述计算机可以是通用计算机、专用计算机、计算机网络、或者其他可编程装置。所述计算机指令可以存储在计算机可读存储介质中，或者从一个计算机可读存储介质向另一计算机可读存储介质传输，例如，所述计算机指令可以从一个网站站点、计算机、训练设备或数据中心通过有线(例如同轴电缆、光纤、数字用户线(DSL))或无线(例如红外、无线、微波等)方式向另一个网站站点、计算机、训练设备或数据中心进行传输。所述计算机可读存储介质可以是计算机能够存储的任何可用介质或者是包含一个或多个可用介质集成的训练设备、数据中心等数据存储设备。所述可用介质可以是磁性介质，(例如，软盘、硬盘、磁带)、光介质(例如，DVD)、或者半导体介质(例如固态硬盘(Solid State Disk，SSD))等。

Claims (23)

  1. 一种模型的处理方法，其特征在于，包括：
    获取第一计算图，所述第一计算图用于指示人工智能AI模型的执行逻辑，所述第一计算图包括至少一个算子；
    基于所述第一计算图，生成第二计算图，所述第二计算图包括至少一个计算分支、至少一个混淆分支和第一表达式，所述第一表达式的输出用于指示执行所述至少一个计算分支中的分支或所述至少一个混淆分支中的分支，所述至少一个算子包含于所述至少一个计算分支中，所述至少一个计算分支与所述至少一个混淆分支具有不同的计算逻辑；
    根据所述第二计算图生成所述AI模型对应的执行代码，所述执行代码中的目标代码被配置为加密保护，所述目标代码是与所述第一表达式相关的代码。
  2. 根据权利要求1所述的方法，其特征在于，所述第二计算图仅包括一个计算分支；
    所述第一表达式的输出用于指示执行所述计算分支以及所述至少一个混淆分支中的一个分支。
  3. 根据权利要求1所述的方法，其特征在于，所述第二计算图包括多个计算分支，且所述第二计算图还包括第二表达式；
    所述第一表达式的输出用于指示执行所述多个计算分支和所述至少一个混淆分支中的一个分支；
    所述第二表达式与所述多个计算分支和所述至少一个混淆分支连接，所述第二表达式用于指示所述第一表达式的循环执行次数。
  4. 根据权利要求3所述的方法，其特征在于，所述第二表达式的输入与上一次执行的分支相关，所述第二表达式的输出用于确定是否循环执行所述第一表达式。
  5. 根据权利要求1-4任意一项所述的方法，其特征在于，所述第一表达式的初始输入包括第一数值，所述第一数值被配置为加密保护。
  6. 根据权利要求1-5任意一项所述的方法，其特征在于，所述目标代码被配置为运行于可信执行环境中，和/或所述目标代码被配置为进行代码混淆。
  7. 根据权利要求1-6任意一项所述的方法，其特征在于，所述目标代码被配置为采用加密算法加密保护。
  8. 根据权利要求1-7任意一项所述的方法，其特征在于，所述方法还包括：
    获取第三计算图，所述第三计算图用于指示所述AI模型的执行逻辑，所述第三计算图包括第一算子；
    基于所述第三计算图，生成第四计算图，所述第四计算图包括第二算子和第三表达式，所述第二算子是对所述第一算子的权重参数修改后得到的，所述第三表达式的输入包括所述第二算子的输出，且所述第三表达式的输出与所述第一算子在采用与所述第二算子相同的输入时的输出相同；
    所述根据所述第二计算图生成所述AI模型对应的执行代码，包括：
    根据所述第二计算图和所述第四计算图生成所述AI模型对应的执行代码。
  9. 根据权利要求8所述的方法，其特征在于，所述第二算子的权重参数是基于第二数值对所述第一算子的权重参数修改后得到的，所述第三表达式的输入包括所述第二数值，且所述第二数值被配置为加密保护。
  10. 一种基于模型的数据处理方法，其特征在于，包括：
    基于AI模型的执行代码，获取第二计算图，所述第二计算图包括至少一个计算分支、至少一个混淆分支和第一表达式，所述第一表达式的输出用于指示执行所述至少一个计算分支中的分支或所述至少一个混淆分支中的分支，所述至少一个计算分支包括至少一个所述AI模型的算子，所述至少一个计算分支与所述至少一个混淆分支具有不同的计算逻辑，所述执行代码中的目标代码被配置为加密保护，所述目标代码是与所述第一表达式相关的代码；
    获取所述AI模型的输入数据；
    基于所述第二计算图对所述输入数据进行处理，得到所述AI模型的输出数据。
  11. 根据权利要求10所述的方法，其特征在于，所述第二计算图仅包括一个计算分支；
    所述第一表达式的输出用于指示执行所述计算分支以及所述至少一个混淆分支中的一个分支。
  12. 根据权利要求10所述的方法，其特征在于，所述第二计算图包括多个计算分支，且所述第二计算图还包括第二表达式；
    所述第一表达式的输出用于指示执行所述多个计算分支和所述至少一个混淆分支中的一个分支；
    所述第二表达式与所述多个计算分支和所述至少一个混淆分支连接，所述第二表达式用于指示所述第一表达式的循环执行次数。
  13. 根据权利要求12所述的方法，其特征在于，所述第二表达式的输入与上一次执行的分支相关，所述第二表达式的输出用于确定是否循环执行所述第一表达式。
  14. 根据权利要求10-13任意一项所述的方法，其特征在于，所述第一表达式的初始输入包括第一数值，所述第一数值被配置为加密保护。
  15. 根据权利要求10-14任意一项所述的方法，其特征在于，所述目标代码被配置为运行于可信执行环境中，和/或所述目标代码被配置为进行代码混淆。
  16. 根据权利要求10-15任意一项所述的方法，其特征在于，所述目标代码被配置为采用加密算法加密保护；
    所述方法还包括：
    对所述执行代码中的所述目标代码进行解密，得到解密后的代码；
    执行所述解密后的代码，得到所述第一表达式。
  17. 根据权利要求10-16任意一项所述的方法，其特征在于，所述方法还包括：
    基于所述AI模型的执行代码，获取第四计算图，所述第四计算图包括第二算子和第三表达式，所述第二算子是对所述AI模型中第一算子的权重参数修改后得到的，所述第三表达式的输入包括所述第二算子的输出，且所述第三表达式的输出与所述第一算子在采用与所述第二算子相同的输入时的输出相同；
    所述基于所述第二计算图对所述输入数据进行处理，包括：
    基于所述第二计算图和所述第四计算图对所述输入数据进行处理。
  18. 根据权利要求17所述的方法，其特征在于，所述第二算子的权重参数是基于第二数值对所述第一算子的权重参数修改后得到的，所述第三表达式的输入包括所述第二数值，且所述第二数值被配置为加密保护。
  19. 一种模型的处理装置，其特征在于，包括存储器和处理器；所述存储器存储有代码，所述处理器被配置为执行所述代码，当所述代码被执行时，所述装置执行如权利要求1至9任一项所述的方法。
  20. 一种基于模型的数据处理装置，其特征在于，包括存储器和处理器；所述存储器存储有代码，所述处理器被配置为执行所述代码，当所述代码被执行时，所述装置执行如权利要求10至18任一项所述的方法。
  21. 一种AI系统，其特征在于，包括：如权利要求19所述的模型的处理装置以及如权利要求20所述的基于模型的数据处理装置。
  22. 一种计算机存储介质，其特征在于，所述计算机存储介质存储有指令，所述指令在由计算机执行时使得所述计算机实施权利要求1至18任意一项所述的方法。
  23. 一种计算机程序产品，其特征在于，所述计算机程序产品存储有指令，所述指令在由计算机执行时使得所述计算机实施权利要求1至18任意一项所述的方法。
PCT/CN2023/118186 2022-09-20 2023-09-12 模型的处理方法、基于模型的数据处理方法及相关装置 Ceased WO2024061052A1 (zh)

Priority Applications (2)

Application Number Priority Date Filing Date Title
EP23867341.2A EP4582980A4 (en) 2022-09-20 2023-09-12 METHOD AND DEVICE FOR MODEL PROCESSING, AND METHOD AND DEVICE FOR MODEL-BASED DATA PROCESSING
US19/083,803 US20250245302A1 (en) 2022-09-20 2025-03-19 Model processing method, model-based data processing method, and related apparatus

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN202211145581.9 2022-09-20
CN202211145581.9A CN115659169A (zh) 2022-09-20 2022-09-20 模型的处理方法、基于模型的数据处理方法及相关装置

Related Child Applications (1)

Application Number Title Priority Date Filing Date
US19/083,803 Continuation US20250245302A1 (en) 2022-09-20 2025-03-19 Model processing method, model-based data processing method, and related apparatus

Publications (1)

Publication Number Publication Date
WO2024061052A1 true WO2024061052A1 (zh) 2024-03-28

Family

ID=84984501

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2023/118186 Ceased WO2024061052A1 (zh) 2022-09-20 2023-09-12 模型的处理方法、基于模型的数据处理方法及相关装置

Country Status (4)

Country Link
US (1) US20250245302A1 (zh)
EP (1) EP4582980A4 (zh)
CN (1) CN115659169A (zh)
WO (1) WO2024061052A1 (zh)

Families Citing this family (3)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN115659169A (zh) * 2022-09-20 2023-01-31 华为技术有限公司 模型的处理方法、基于模型的数据处理方法及相关装置
US20250004727A1 (en) * 2023-06-27 2025-01-02 Mcafee, Llc System and method for source code transformation
CN119720233A (zh) * 2024-11-18 2025-03-28 中移互联网有限公司 基于控制流的机器学习模型加密方法和解密方法

Citations (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20130036473A1 (en) * 2011-08-01 2013-02-07 Apple Inc. System and method for branch function based obfuscation
CN111177663A (zh) * 2019-12-20 2020-05-19 青岛海尔科技有限公司 编译器的代码混淆改进方法及装置、存储介质、电子装置
CN114266336A (zh) * 2020-09-15 2022-04-01 华为技术有限公司 一种处理人工智能模型的方法、数据处理的方法及装置
CN114282181A (zh) * 2021-12-01 2022-04-05 北京达佳互联信息技术有限公司 代码执行方法、装置、服务器及存储介质
CN115659169A (zh) * 2022-09-20 2023-01-31 华为技术有限公司 模型的处理方法、基于模型的数据处理方法及相关装置

Family Cites Families (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN110135129B (zh) * 2019-04-12 2023-04-07 平安科技（深圳）有限公司 代码段保护方法、装置、计算机设备和存储介质
CN114830597B (zh) * 2019-12-17 2025-09-19 微芯片技术股份有限公司 混淆用于椭圆曲线密码学的密码参数及相关系统和设备
US12056219B2 (en) * 2020-12-21 2024-08-06 Cryptography Research, Inc. Protection of neural networks by obfuscation of neural network architecture
CN113282892A (zh) * 2021-04-16 2021-08-20 南方电网数字电网研究院有限公司 代码混淆方法、装置、计算机设备和存储介质

Patent Citations (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20130036473A1 (en) * 2011-08-01 2013-02-07 Apple Inc. System and method for branch function based obfuscation
CN111177663A (zh) * 2019-12-20 2020-05-19 青岛海尔科技有限公司 编译器的代码混淆改进方法及装置、存储介质、电子装置
CN114266336A (zh) * 2020-09-15 2022-04-01 华为技术有限公司 一种处理人工智能模型的方法、数据处理的方法及装置
CN114282181A (zh) * 2021-12-01 2022-04-05 北京达佳互联信息技术有限公司 代码执行方法、装置、服务器及存储介质
CN115659169A (zh) * 2022-09-20 2023-01-31 华为技术有限公司 模型的处理方法、基于模型的数据处理方法及相关装置

Non-Patent Citations (1)

* Cited by examiner, † Cited by third party
Title
See also references of EP4582980A4

Also Published As

Publication number Publication date
CN115659169A (zh) 2023-01-31
EP4582980A1 (en) 2025-07-09
EP4582980A4 (en) 2025-11-19
US20250245302A1 (en) 2025-07-31

Similar Documents

Publication Publication Date Title
US12353608B2 (en) Secure collaboration between processors and processing accelerators in enclaves
WO2024061052A1 (zh) 模型的处理方法、基于模型的数据处理方法及相关装置
EP2962193B1 (en) Compiler based obfuscation
CN107346401B (zh) 用于安全地执行程序的信息保障系统
US7587616B2 (en) System and method of iterative code obfuscation
EP3757857B1 (en) Device id for memory protection
CN107408072B (zh) 用于随机化指令的方法、介质和装置
JP5345726B2 (ja) ストリーム・ペイロードを保護しながら復号メディア・ストリームにおいてナビゲーション・データへのソフトウェア・アクセスを可能にする方法及び装置
US20240154802A1 (en) Model protection method and apparatus
JP2023542574A (ja) モデル保護方法、装置、機器、システム、記憶媒体及びプログラム
CN111538962A (zh) 程序控制流混淆方法、系统、存储介质、云服务器及应用
CN114266336B (zh) 一种处理人工智能模型的方法、数据处理的方法及装置
CN107679409B (zh) 一种数据加密的加速方法和系统
CN118643521A (zh) 数据处理方法、装置、设备及存储介质
CN114936365A (zh) 一种机密数据的保护系统、方法以及装置
WO2022133165A1 (en) Privacy-enhanced computation via sequestered encryption
US7970133B2 (en) System and method for secure and flexible key schedule generation
CN114756833B (zh) 代码混淆方法、装置、设备、介质以及程序产品
CN108182358B (zh) 文件保护方法、装置、计算设备及计算机存储介质
CN120675883A (zh) 模型推理方法、模型加密方法、电子设备和存储介质
CN119004436A (zh) 一种大模型训练系统、大模型训练方法及相关服务器
CN115242373B (zh) 全同态算法的本地化服务方法、装置、计算机设备及介质
US12547682B2 (en) Secure machine learning model processing
CN108369613A (zh) 计算设备和方法
CN119378023A (zh) 一种数据处理方法、装置及设备

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 23867341

Country of ref document: EP

Kind code of ref document: A1

WWE Wipo information: entry into national phase

Ref document number: 2023867341

Country of ref document: EP

ENP Entry into the national phase

Ref document number: 2023867341

Country of ref document: EP

Effective date: 20250403

NENP Non-entry into the national phase

Ref country code: DE

WWP Wipo information: published in national office

Ref document number: 2023867341

Country of ref document: EP