WO2023029447A1 - 模型保护方法、装置、设备、系统以及存储介质 - Google Patents

模型保护方法、装置、设备、系统以及存储介质 Download PDF

Info

Publication number
WO2023029447A1
WO2023029447A1 PCT/CN2022/082285 CN2022082285W WO2023029447A1 WO 2023029447 A1 WO2023029447 A1 WO 2023029447A1 CN 2022082285 W CN2022082285 W CN 2022082285W WO 2023029447 A1 WO2023029447 A1 WO 2023029447A1
Authority
WO
WIPO (PCT)
Prior art keywords
model
file
wasm
encrypted
verification
Prior art date
Application number
PCT/CN2022/082285
Other languages
English (en)
French (fr)
Inventor
岳双燕
樊中恺
Original Assignee
北京百度网讯科技有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 北京百度网讯科技有限公司 filed Critical 北京百度网讯科技有限公司
Priority to JP2022559937A priority Critical patent/JP2023542574A/ja
Priority to US17/915,705 priority patent/US20240211609A1/en
Priority to KR1020227033945A priority patent/KR20220140638A/ko
Publication of WO2023029447A1 publication Critical patent/WO2023029447A1/zh

Links

Images

Classifications

    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/10—Protecting distributed programs or content, e.g. vending or licensing of copyrighted material ; Digital rights management [DRM]
    • G06F21/12—Protecting executable software
    • G06F21/121—Restricting unauthorised execution of programs
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/60—Protecting data
    • G06F21/64—Protecting data integrity, e.g. using checksums, certificates or signatures

Definitions

  • the present disclosure relates to the field of computers, in particular to the field of artificial intelligence, and can be used in application scenarios such as AI model protection.
  • AI models may involve substantial financial and/or engineering resource commitments. Furthermore, the development of AI models is usually a unique domain-specific knowledge acquisition process that is time and resource intensive. Therefore, it is necessary to provide an effective protection mechanism to protect the AI model.
  • the present disclosure provides a model protection method, device, equipment, system, storage medium and computer program product.
  • a model protection method for the server including: generating a WASM file, wherein the WASM file is used to provide an operating environment for the target model, and the WASM file contains the corresponding model reasoning algorithm and a security verification algorithm, wherein the security verification algorithm implements at least one of the following security verification operations to protect the target model: verify the host environment; verify the integrity of the WASM file Verification; verify the integrity of the model file, wherein the model file is generated corresponding to the original model file of the target model; during the model reasoning process, perform timeout verification on the specified reasoning process; during the model reasoning process , for timeout verification of the entire reasoning process.
  • a model protection method for a client including: loading a model file generated corresponding to a target model; loading a WASM file, wherein the WASM file is used to provide the target model with Operating environment; during the instantiation and running of the WASM file, the model file is passed into the operating environment to perform at least one of the following security verification operations, thereby starting a model protection mechanism for the target model: for the host Verify the environment; verify the integrity of the WASM file; verify the integrity of the model file; during the model reasoning process, verify the specified reasoning process overtime; during the model reasoning process, verify the entire reasoning process Validate with timeout.
  • a model protection device for a server including: a generation module for generating a WASM file, wherein the WASM file is used to provide an operating environment for the target model, and the WASM file contains the corresponding model reasoning algorithm and security verification algorithm, wherein the security verification algorithm implements at least one of the following security verification operations to protect the target model: verify the host environment; verify the Verify the integrity of the WASM file; verify the integrity of the model file, wherein the model file is generated from the original model file corresponding to the target model; during the model reasoning process, perform timeout verification on the specified reasoning process ;
  • timeout validation for the entire inference process.
  • a model protection device for a client including: a first loading module, used to load a model file generated corresponding to a target model; a second loading module, used to load a WASM file, Wherein, the WASM file is used to provide an operating environment for the target model; the security verification module is used to pass the model file into the operating environment during the instantiation operation of the WASM file to perform the following security verification At least one of the operations, thereby starting the model protection mechanism for the target model: verifying the host environment; verifying the integrity of the WASM file; verifying the integrity of the model file; during the model reasoning process In, the timeout verification is performed on the specified inference process; in the model inference process, the timeout verification is performed on the entire inference process.
  • an electronic device including: at least one processor; and a memory communicatively connected to the at least one processor; wherein, the memory stores Instructions to be executed, the instructions are executed by the at least one processor, so that the at least one processor can execute the method described in the embodiments of the present disclosure.
  • a non-transitory computer-readable storage medium storing computer instructions, wherein the computer instructions are used to cause the computer to execute the method according to the embodiments of the present disclosure.
  • a computer program product including a computer program, the computer program implements the method according to the embodiments of the present disclosure when executed by a processor.
  • a model protection system including: a client and a server, wherein the client requests model information from the server; the server responds to the client's request , return the corresponding model information; the client performs the following operations based on the model information returned by the server: load the model file generated corresponding to the target model; load the WASM file, wherein the WASM file is used for the
  • the target model provides an operating environment; the WASM file is instantiated for operation, and the model file is passed into the operating environment; wherein, the WASM file performs at least one of the following security verification operations during the instantiation operation , to start the model protection mechanism for the target model: verify the host environment; verify the integrity of the WASM file; verify the integrity of the model file; during the model reasoning process, specify the reasoning process Perform timeout verification; during model inference, perform timeout verification on the entire reasoning process.
  • FIG. 1 exemplarily shows a system architecture suitable for an embodiment of the present disclosure
  • FIG. 2A schematically shows a block diagram of a model protection system suitable for embodiments of the present disclosure
  • Fig. 2B exemplarily shows a schematic diagram of model offline encryption and online reasoning suitable for embodiments of the present disclosure
  • Fig. 3A exemplarily shows a flow chart of a model protection method for a server according to an embodiment of the present disclosure
  • Fig. 3B exemplarily shows a schematic diagram of offline generation of model files and WASM files according to an embodiment of the present disclosure
  • FIG. 4A exemplarily shows a flowchart of a model protection method for a client according to an embodiment of the present disclosure
  • FIG. 4B exemplarily shows a sequence diagram of model online reasoning according to an embodiment of the present disclosure
  • FIG. 5 exemplarily shows a schematic diagram of a model protection mechanism according to an embodiment of the present disclosure
  • Fig. 6 exemplarily shows a block diagram of a model protection device for a server according to an embodiment of the present disclosure
  • Fig. 7 exemplarily shows a block diagram of a model protection device for a client according to an embodiment of the present disclosure
  • Fig. 8 exemplarily shows a block diagram of an electronic device used to implement the model protection method of the embodiment of the present disclosure.
  • AI computing on the web platform can use the AI computing capabilities provided by the web environment such as browsers and applets to complete the model reasoning process in the host environment and obtain corresponding calculation results.
  • the model information needs to be transmitted through the network, so it is easy to leak; the topology of the model needs to be generated and optimized during the JS (Java script) running process of the client, so the model is easy to be leaked. Debug or be tampered with; the model needs to complete the reasoning operation during the JS running process, so the topology and weight data of the model can be easily obtained or derived.
  • AI computing on the web platform can protect model information through the following two solutions.
  • Solution 1 deploy and reason the AI model on the server side.
  • the client can carry model input data and send a model reasoning request to the server.
  • the server performs the corresponding model inference operation, and returns the inference result through the network after the model inference is completed.
  • Solution 2 relying on the model reasoning capabilities provided by the host where the web environment such as browsers and applets reside to complete AI calculations.
  • the client invokes the AI computing capability provided by the host through JS Bridge and other methods when JS (Java script) is running.
  • JS Java script
  • the model input data also needs to be passed, and after the host completes the model inference, it needs to trigger the callback provided by the client to return the inference result.
  • the embodiments of the present disclosure provide a model protection solution suitable for application scenarios with extremely high latency requirements, and can be used in scenarios such as real-time video stream processing. Moreover, model security can be more effectively guaranteed.
  • FIG. 1 exemplarily shows a system architecture suitable for an embodiment of the present disclosure. It should be noted that, what is shown in FIG. 1 is only an example of the system architecture to which the embodiments of the present disclosure can be applied, so as to help those skilled in the art understand the technical content of the present disclosure, but it does not mean that the embodiments of the present disclosure cannot be used in other environment or scene.
  • the system architecture 100 in the embodiment of the present disclosure may include: a server 110 and a client 120 .
  • the server 110 can be used for offline encryption, that is, to complete the encryption of the model file and the encryption of the WASM file.
  • the encryption of the model weight data, the encryption of the model configuration information, and the encryption of the decryption key can also be completed.
  • the client 120 may request model information from the server 110 to load model files, WASM files, model weight data, model configuration information, and the like.
  • WASM file is a file in WASM format, which is a binary bytecode file obtained by compiling source code through Web Assembly technology.
  • the WASM file can be used to encapsulate the Web environment for model reasoning.
  • a decryption algorithm can also be added to the WASM file for model decryption.
  • a security verification algorithm can also be added to the WASM file to perform security verification-related operations.
  • model files WASM files, model weight data, and model configuration information are encrypted to prevent user data from being leaked during transmission.
  • WASM files are poorly readable since they are binary bytecode files. Therefore, encapsulating the web environment for model reasoning in WASM files can make it difficult to easily derive model topology (including operators, dependencies between operators, and attributes of operators) and model reasoning logic out, so as to protect the model.
  • the encrypted model-related information (such as the encrypted model file, model weight data, and model configuration information, etc.) Leading to the disclosure of model-related information.
  • the security of the host environment can be verified to ensure the security of the model.
  • FIG. 1 the numbers of clients and servers in FIG. 1 are only illustrative. According to implementation needs, there can be any number of clients and servers.
  • model protection solution provided by the embodiments of the present disclosure can be used in any type of data model protection scenario, for example, it can be used in the AI model protection scenario.
  • the present disclosure provides a model protection system.
  • FIG. 2A exemplarily shows a block diagram of a model protection system suitable for an embodiment of the present disclosure.
  • the model protection system 200 may include: a client 210 and a server 220 .
  • the client 210 requests model information from the server 220 .
  • the server 220 returns corresponding model information.
  • the client 210 Based on the model information returned by the server 220, the client 210 performs the following operations: load the model file generated corresponding to the target model; load the WASM file, wherein the WASM file is used to provide an operating environment for the target model; instantiate and run the WASM file, And pass the model file into the running environment.
  • At least one of the following security verification operations is performed to start the model protection mechanism for the target model: verify the host environment; verify the integrity of the WASM file; verify the integrity of the model file
  • the timeout verification is performed on the specified reasoning process; in the model reasoning process, the timeout verification is performed on the entire reasoning process.
  • model information returned by the server 220 may include, but not limited to, the address of the encrypted model file, the address of the encrypted WASM file, and the corresponding encrypted model configuration information (mainly including the input/output configuration of the model ), the encrypted weight data of the corresponding model, etc.
  • the model file generated corresponding to the target model may be the original model file of the target model or a product obtained by encrypting the original model file.
  • the model file generated corresponding to the target model may be an intermediate product obtained by processing the original model file of the target model or a product obtained by encrypting the intermediate product.
  • the topology of the target model can be determined based on the original model file of the target model, and then the intermediate product of the original model file can be obtained by obfuscating the attributes of operators in the topology and the dependencies between operators.
  • the WASM file can be generated corresponding to the topology structure of the target model, so that the WASM file can provide an operating environment (such as a Web environment) for the target model during instantiation and running, thereby implementing corresponding model reasoning.
  • an operating environment such as a Web environment
  • a decryption algorithm can also be added to the WASM file for model decryption (for example, to decrypt encrypted model files, model weight data, and model configuration information, etc.).
  • encrypted WASM files can be decrypted in the client's hosting environment.
  • a security verification algorithm can also be added to the WASM file to perform security verification-related operations.
  • the hosting environment is verified, such as verifying whether the domain name and/or username of the hosting environment are in the corresponding white list. If the verification result indicates that it is in the corresponding white list, the verification is passed. In response to passing this verification, the decryption algorithm and model inference algorithm can be executed during the instantiation and running of the WASM file to ensure the security of the model during the running process. In response to failing the current verification, the current model reasoning may be terminated.
  • verifying the integrity of the WASM file can avoid model security problems caused by tampering of the WASM file.
  • verifying the integrity of the model file can avoid model security problems caused by tampering of the model file.
  • timeout verification is performed on the specified reasoning process.
  • an anti-debugging mechanism can be set, such as burying key paths in advance, and then verify whether the inference process between the buried key paths (such as the inference process from A to B) times out during operation. It should be understood that if the verification result indicates that the specified reasoning process times out, it indicates that the model may be debugged during the reasoning process. In this case, the model inference can be terminated to ensure the safety of the model. If the verification result indicates that the specified reasoning process has not timed out, it indicates that the reasoning process is normal, and subsequent model reasoning operations can be continued.
  • timeout verification is performed on the whole reasoning process. It should be understood that if the verification result indicates that the reasoning process is timed out, it indicates that the model may be debugged during the reasoning process. In this case, the model inference can be terminated to ensure the safety of the model. If the verification result indicates that the entire reasoning process has not timed out, it indicates that the reasoning process is normal.
  • the server end by encrypting and compressing the model file before sending it to the client end, data leakage during transmission can be avoided, and network traffic can be saved for the user.
  • the running environment of the model is encapsulated through the WASM file, and a limited call interface is exposed to the external web hosting environment, which can prevent the model content (such as the topology of the model, including the operators and attributes contained in the model and The dependencies between operators, etc.) are easily deduced and obtained.
  • the file integrity verification mechanism is adopted to ensure the security of the model, and it can be found in time if the model is tampered with.
  • the model anti-debugging mechanism can be used to ensure the safety of the model, such as preventing the model from being debugged during the running process in time. Therefore, adopting the instant security verification mechanism can more comprehensively guarantee the security of the model.
  • the client may first send an authentication request to the server.
  • the server performs authentication operations and returns corresponding authentication results.
  • the client requests the model information from the server.
  • the client cannot request model information from the server.
  • the model information can be obtained through authentication during the client JS running process.
  • the model information may include the address of the encrypted model file, the address of the encrypted WASM file, encrypted related model configuration information (mainly including the input/output configuration of the model) and the encrypted weight data of the model.
  • the authentication service may follow the OAuth2.0 authorization standard.
  • the AI model provider can hand over the AK (Access Key Id, used to identify the user) for authentication verification to the model user.
  • the model user initiates an authentication request to the server such as the authentication server through the client to obtain the authentication token (token, before some data is transmitted, the token is checked first, and different tokens are authorized for different data operations before. ), and then the client sends a model information acquisition request carrying a token to the server, and the server returns the corresponding model information to the client based on the token carried in the request.
  • model information is acquired in an authorized access manner, which can ensure model information security.
  • Fig. 2B exemplarily shows a schematic diagram of model offline encryption and online reasoning suitable for the embodiments of the present disclosure.
  • the model file and the corresponding WASM file used for decryption, inference and security verification can be encrypted separately through offline encryption, and the encrypted secure file hosting for your files.
  • the client can obtain model information through user authentication (that is, authenticate the model user), and perform decryption, decoding, inference, and security verification (such as host environment verification and timeout verification) during the instantiation and running of the WASM file. ) and other operations.
  • the present disclosure provides a model protection method for a server.
  • Fig. 3A exemplarily shows a flowchart of a model protection method for a server according to an embodiment of the present disclosure.
  • the model protection method 300 may include: operation S310.
  • a WASM file is generated, wherein the WASM file is used to provide an operating environment for the target model, and the WASM file includes a corresponding model reasoning algorithm and a security verification algorithm.
  • the security verification algorithm implements at least one of the following security verification operations to protect the target model: verify the host environment; verify the integrity of the WASM file; verify the integrity of the model file, where , the model file is generated corresponding to the original model file of the target model; during the model inference process, the timeout verification is performed on the specified inference process; during the model inference process, the timeout verification is performed on the entire inference process.
  • the topology structure of the target model can be determined according to the original model file of the target model, and the model reasoning logic in the WASM file is generated based on the topology structure of the target model.
  • the generated WASM file can provide the corresponding operating environment for the target model.
  • a decryption algorithm can also be added to the WASM file for model decryption (for example, to decrypt encrypted model files, model weight data, and model configuration information, etc.).
  • encrypted WASM files can be decrypted in the client's hosting environment.
  • a security verification algorithm can also be added to the WASM file to perform security verification-related operations.
  • the hosting environment is verified, such as verifying whether the domain name and/or username of the hosting environment are in the corresponding white list. If the verification result indicates that it is in the corresponding white list, the verification is passed. In response to passing the verification, the decryption algorithm and model inference algorithm can be executed during the instantiation and running of the WASM file to ensure the security of the model during the running process. In response to failing the current verification, the current model reasoning may be terminated.
  • verifying the integrity of the WASM file can avoid model security problems caused by tampering of the WASM file.
  • verifying the integrity of the model file can avoid model security problems caused by tampering of the model file.
  • timeout verification is performed on the specified reasoning process.
  • an anti-debugging mechanism can be set, such as burying key paths in advance, and then verify whether the inference process between the buried key paths (such as the inference process from A to B) times out during operation. It should be understood that if the verification result indicates that the specified reasoning process times out, it indicates that the model may be debugged during the reasoning process. In this case, the model reasoning can be terminated to ensure the safety of the model. If the verification result indicates that the specified reasoning process has not timed out, it indicates that the reasoning process is normal, and subsequent model reasoning operations can be continued.
  • timeout verification is performed on the whole reasoning process. It should be understood that if the verification result indicates that the reasoning process is timed out, it indicates that the model may be debugged during the reasoning process. In this case, the model reasoning can be terminated to ensure the safety of the model. If the verification result indicates that the entire reasoning process has not timed out, it indicates that the reasoning process is normal.
  • model protection method provided in this embodiment is applied to the server.
  • the Plain JS backend calculation scheme of the model front-end reasoning engine can be selected to construct the topology of the model, and then the intermediate product is encrypted to generate an encrypted model file.
  • the encryption algorithm may use the AES symmetric encryption algorithm.
  • the information required by the WASM backend calculation scheme can be extracted based on the topology of the target model, and the WASM file can be generated based on the extracted information.
  • the server end by encrypting and compressing the model file before sending it to the client end, data leakage during transmission can be avoided, and network traffic can be saved for the user.
  • the running environment of the model is encapsulated through the WASM file, and a limited call interface is exposed to the external web hosting environment, which can prevent the topology of the model from being easily derived and obtained.
  • the file integrity verification mechanism is adopted to ensure the security of the model, and it can be found in time if the model is tampered with.
  • the model anti-debugging mechanism can be used to ensure the safety of the model, such as preventing the model from being debugged during the running process in time. Therefore, adopting the instant security verification mechanism can more comprehensively guarantee the security of the model.
  • the model can be deployed and reasoned completely in the web environment, without the need to transmit user data to the server side through the network, which protects the privacy of users and provides users with It saves traffic and reduces network delay.
  • the method may further include at least one of the following.
  • the model configuration information of the target model is encrypted to obtain the encrypted model configuration information.
  • the weight data of the target model is encrypted to obtain encrypted weight data.
  • the WASM file also includes a corresponding decryption algorithm, which is used to decrypt at least one of the following: encrypted model files, encrypted model configuration information, and encrypted weight data.
  • the encryption algorithm may adopt the AES symmetric encryption algorithm.
  • model files can not only effectively prevent user data from being leaked during hosting, but also effectively prevent user data from being leaked during transmission.
  • adding the corresponding decryption algorithm to the WASM file, and decrypting the encrypted model file, encrypted model configuration information, and encrypted weight data during the instantiation of the WASM file can prevent the above content from being easily decrypted.
  • the privacy of the model can be further protected.
  • the method may further include: encrypting the decryption key to obtain an encrypted key.
  • secondary encryption can be achieved by encrypting the key used for decryption.
  • the safe transmission of information can be guaranteed by hiding the key used for decryption.
  • the decryption key may be encrypted using an RSA asymmetric encryption algorithm to generate an encrypted key for decryption.
  • the encryption key may also be encrypted using the RSA asymmetric encryption algorithm to generate an encrypted key for encryption.
  • the privacy of the model can be further protected by performing secondary encryption on the decryption key.
  • the method may further include: for the target model, configuring an access key identifier for each of the at least one user.
  • the at least one user refers to the user of the target model.
  • a unique access key identifier AK
  • the AK provided by the user (that is, the model user) can be used to identify whether the user is the model user of the trusted domain. If the authentication result indicates that the user requesting authentication is a model user of the trusted domain, then confirm that the authentication has passed, otherwise, confirm that the authentication has failed. Wherein, the user is allowed to obtain the model information only when the authentication is passed, otherwise the user is not allowed to obtain the model information.
  • model users are authorized to access, which can prevent model information from being obtained illegally, thereby protecting the model.
  • Fig. 3B exemplarily shows a schematic diagram of offline generation of model files and WASM files according to an embodiment of the present disclosure.
  • the topology of the model can be generated in the Plain JS CPU computing solution.
  • the model file of the model can be generated, and then the generated model file can be compressed and deployed.
  • a WASM file containing algorithms such as analysis, decryption, decoding, reasoning, and security verification can be generated in the Plain JS WASM computing solution.
  • the WASM file After the WASM file is generated, the file can also be encrypted, compressed, and deployed.
  • the encryption key may be dynamically generated or specified.
  • the present disclosure provides a model protection method for a client.
  • Fig. 4A exemplarily shows a flowchart of a model protection method for a client according to an embodiment of the present disclosure.
  • the model protection method 400 may include: operation S410-operation S430.
  • the WASM file is loaded, wherein the WASM file is used to provide an execution environment for the target model.
  • the WASM file is instantiated and run, and the model file is passed into the running environment provided by the WASM file, so that at least one of the following security verification operations is performed during the instantiation of the WASM file to start the model for the target model Protection mechanism: verify the host environment; verify the integrity of the WASM file; verify the integrity of the model file; during the model reasoning process, perform timeout verification on the specified reasoning process; during the model reasoning process, verify the entire reasoning process The process performs timeout verification.
  • the model file and/or WASM file is an encrypted file. It should be understood that the encryption method of the type file and the WASM file in this embodiment is the same as or similar to the description in the previous embodiment, and will not be repeated here.
  • the method may further include: performing the following operations during the instantiation and running of the WASM file.
  • the encrypted model file is decrypted to obtain the decrypted model file. Perform model inference based on the decrypted model file.
  • the preset security verification may include at least one of the following: host environment verification, model file integrity verification, and WASM file integrity verification.
  • model content such as model topology
  • data leakage can be prevented due to inappropriate decryption timing.
  • decrypting the encrypted model file may include the following operations: obtaining an encrypted key for decryption.
  • the encrypted key is decrypted to obtain the decrypted key.
  • the decryption key can be dynamically read during decryption.
  • the privacy of the model can be further protected by performing secondary encryption on the decryption key.
  • FIG. 4B exemplarily shows a sequence diagram of model online reasoning according to an embodiment of the present disclosure.
  • the timing of the online reasoning of the model is as follows: the client sends an authentication request to the server during the running of the JS; the server executes the authentication operation in response to the request, and returns the authentication token; the client JS carries the authentication token to send model information requests, such as model configuration information requests, model weight data requests, encrypted model file address requests, and encrypted WASM file address requests, to the server in parallel; The server returns the corresponding model information in response to these requests; the client JS loads the encrypted WASM file and the encrypted model file; the client JS instantiates the WASM file while the model weight data, model Write the input data, model structure content, etc.
  • model information requests such as model configuration information requests, model weight data requests, encrypted model file address requests, and encrypted WASM file address requests
  • the WASM module (obtained from the instantiation of the model file) performs host environment verification during operation (such as confirming the user's identity through the signature handshake mechanism with the server) , decryption, decoding, initialization, inference, and time limit verification (that is, verify whether the entire inference process has timed out, such as whether it exceeds 1h, and exit if it times out); the WASM module writes the inference result into the memory of the WASM module; the client JS running process You can call the calling interface exposed by the WASM module, such as calling the relevant interface to read the corresponding inference result.
  • Fig. 5 exemplarily shows a schematic diagram of a model protection mechanism according to an embodiment of the present disclosure.
  • the model protection mechanism can guarantee the security of the model from two aspects of confidentiality and controllability.
  • confidentiality of the model the security of the model itself can be ensured through offline model encryption; by encapsulating the decryption and reasoning process into an unreadable WASM file (that is, encapsulating the operating environment) to prevent the leakage of the model structure and model at runtime Data; the key used for decryption has been encrypted twice asymmetrically and obtained through authorized access, thus ensuring the security of the key.
  • the encryption of the model and the key adopts offline privatization deployment to ensure the security of the encryption environment; the key for decryption is obtained through a separate authorized access service (that is, the number of credit authorizations is managed) to ensure the security of the key ;
  • the host environment verification, code integrity verification, and anti-debugging verification can be carried out during the model operation (such as the timeout verification of the specified inference process and the timeout verification of the entire inference process, and the latter is also the verification of the effective time limit of the operation), so that it can be guaranteed during operation.
  • the model is safe and prevents the model from being stolen.
  • the present disclosure also provides a model protection device for a server.
  • Fig. 6 exemplarily shows a block diagram of a model protection device for a server according to an embodiment of the present disclosure.
  • the model protection device 600 may include: a generating module 610 .
  • the generating module 610 is configured to generate a WASM file, wherein the WASM file is used to provide an operating environment for the target model, and the WASM file includes a corresponding model reasoning algorithm and a security verification algorithm.
  • the security verification algorithm implements at least one of the following security verification operations to protect the target model: verify the host environment; verify the integrity of the WASM file; verify the integrity of the model file Verification, wherein, the model file is generated corresponding to the original model file of the target model; during the model reasoning process, a timeout verification is performed on the specified reasoning process; during the model reasoning process, the timeout verification is performed on the entire reasoning process.
  • the device also includes at least one of the following modules: a first encryption module, configured to encrypt the model file to obtain an encrypted model file; a second encryption module, used to encrypt The WASM file is encrypted to obtain an encrypted WASM file; the third encryption module is used to encrypt the model configuration information of the target model to obtain encrypted model configuration information; the fourth encryption module is used to the target model
  • the weight data is encrypted to obtain the encrypted weight data; wherein, the WASM file also contains a corresponding decryption algorithm, and the decryption algorithm is used to decrypt at least one of the following: the encrypted model file, the encrypted model configuration information, the encrypted weight data.
  • the device further includes: a fifth encryption module, configured to encrypt the decryption key to obtain an encrypted key.
  • the device further includes: a configuration module configured to configure an access key identifier for each user in the at least one user with respect to the target model.
  • the present disclosure also provides a model protection device for a client.
  • Fig. 7 exemplarily shows a block diagram of a model protection device for a client according to an embodiment of the present disclosure.
  • the model protection device 700 may include: a first loading module 710 , a second loading module 720 and a security verification module 730 .
  • the first loading module 710 is configured to load the generated model file corresponding to the target model.
  • the second loading module 720 is configured to load a WASM file, wherein the WASM file is used to provide an operating environment for the target model.
  • the security verification module 730 is configured to pass the model file into the running environment during the instantiation and running of the WASM file and perform at least one of the following security verification operations to start the model protection mechanism for the target model: host environment Verify; verify the integrity of the WASM file; verify the integrity of the model file; during model reasoning, perform timeout verification of the specified reasoning process; during model reasoning, perform timeout verification of the entire reasoning process .
  • the first loading module acquires and loads the model file
  • the second loading module acquires and loads the WASM file.
  • model file and/or the WASM file are encrypted files.
  • the device further includes: a decryption module, configured to decrypt the encrypted model file in response to the passing of the preset security verification during the instantiation and operation of the WASM file, to obtain the decrypted model file; and a model reasoning module, configured to perform model reasoning based on the decrypted model file.
  • a decryption module configured to decrypt the encrypted model file in response to the passing of the preset security verification during the instantiation and operation of the WASM file, to obtain the decrypted model file
  • a model reasoning module configured to perform model reasoning based on the decrypted model file.
  • the preset security verification includes at least one of the following: host environment verification, model file integrity verification, and WASM file integrity verification.
  • the decryption module includes: an acquisition unit, configured to obtain an encrypted key for decryption; a first decryption unit, configured to decrypt the encrypted key, to obtain the decrypted a key; and a second decryption unit, configured to use the decrypted key to decrypt the encrypted model file.
  • the present disclosure also provides an electronic device, a readable storage medium, and a computer program product.
  • FIG. 8 shows a schematic block diagram of an example electronic device 800 that may be used to implement embodiments of the present disclosure.
  • Electronic device is intended to represent various forms of digital computers, such as laptops, desktops, workstations, personal digital assistants, servers, blade servers, mainframes, and other suitable computers.
  • Electronic devices may also represent various forms of mobile devices, such as personal digital processing, cellular telephones, smart phones, wearable devices, and other similar computing devices.
  • the components shown herein, their connections and relationships, and their functions, are by way of example only, and are not intended to limit implementations of the disclosure described and/or claimed herein.
  • an electronic device 800 includes a computing unit 801, which can perform calculations according to a computer program stored in a read-only memory (ROM) 802 or a computer program loaded from a storage unit 808 into a random access memory (RAM) 803. Various appropriate actions and processes are performed. In the RAM 803, various programs and data necessary for the operation of the electronic device 800 can also be stored.
  • the computing unit 801, ROM 802, and RAM 803 are connected to each other through a bus 804.
  • An input/output (I/O) interface 805 is also connected to the bus 804 .
  • the I/O interface 805 includes: an input unit 806, such as a keyboard, a mouse, etc.; an output unit 807, such as various types of displays, speakers, etc.; a storage unit 808, such as a magnetic disk, an optical disk etc.; and a communication unit 809, such as a network card, a modem, a wireless communication transceiver, and the like.
  • the communication unit 809 allows the device 800 to exchange information/data with other devices over a computer network such as the Internet and/or various telecommunication networks.
  • the computing unit 801 may be various general-purpose and/or special-purpose processing components having processing and computing capabilities. Some examples of computing units 801 include, but are not limited to, central processing units (CPUs), graphics processing units (GPUs), various dedicated artificial intelligence (AI) computing chips, various computing units that run machine learning model algorithms, digital signal processing processor (DSP), and any suitable processor, controller, microcontroller, etc.
  • the calculation unit 801 executes various methods and processes described above, such as a model protection method.
  • the model protection method may be implemented as a computer software program tangibly embodied on a machine-readable medium, such as storage unit 808 .
  • part or all of the computer program may be loaded and/or installed on the device 800 via the ROM 802 and/or the communication unit 809.
  • the computer program When the computer program is loaded into RAM 803 and executed by computing unit 801, one or more steps of the model protection method described above may be performed.
  • the computing unit 801 may be configured to execute the model protection method in any other suitable manner (for example, by means of firmware).
  • Various implementations of the systems and techniques described above herein can be implemented in digital electronic circuit systems, integrated circuit systems, field programmable gate arrays (FPGAs), application specific integrated circuits (ASICs), application specific standard products (ASSPs), systems on chips Implemented in a system of systems (SOC), load programmable logic device (CPLD), computer hardware, firmware, software, and/or combinations thereof.
  • FPGAs field programmable gate arrays
  • ASICs application specific integrated circuits
  • ASSPs application specific standard products
  • SOC system of systems
  • CPLD load programmable logic device
  • computer hardware firmware, software, and/or combinations thereof.
  • programmable processor can be special-purpose or general-purpose programmable processor, can receive data and instruction from storage system, at least one input device, and at least one output device, and transmit data and instruction to this storage system, this at least one input device, and this at least one output device an output device.
  • Program codes for implementing the methods of the present disclosure may be written in any combination of one or more programming languages. These program codes may be provided to a processor or controller of a general-purpose computer, a special purpose computer, or other programmable data processing devices, so that the program codes, when executed by the processor or controller, make the functions/functions specified in the flow diagrams and/or block diagrams Action is implemented.
  • the program code may execute entirely on the machine, partly on the machine, as a stand-alone software package partly on the machine and partly on a remote machine or entirely on the remote machine or server.
  • a machine-readable medium may be a tangible medium that may contain or store a program for use by or in conjunction with an instruction execution system, apparatus, or device.
  • a machine-readable medium may be a machine-readable signal medium or a machine-readable storage medium.
  • a machine-readable medium may include, but is not limited to, electronic, magnetic, optical, electromagnetic, infrared, or semiconductor systems, apparatus, or devices, or any suitable combination of the foregoing.
  • machine-readable storage media would include one or more wire-based electrical connections, portable computer discs, hard drives, random access memory (RAM), read only memory (ROM), erasable programmable read only memory (EPROM or flash memory), optical fiber, compact disk read only memory (CD-ROM), optical storage, magnetic storage, or any suitable combination of the foregoing.
  • RAM random access memory
  • ROM read only memory
  • EPROM or flash memory erasable programmable read only memory
  • CD-ROM compact disk read only memory
  • magnetic storage or any suitable combination of the foregoing.
  • the systems and techniques described herein can be implemented on a computer having a display device (e.g., a CRT (cathode ray tube) or LCD (liquid crystal display) monitor) for displaying information to the user. ); and a keyboard and pointing device (eg, a mouse or a trackball) through which a user can provide input to the computer.
  • a display device e.g., a CRT (cathode ray tube) or LCD (liquid crystal display) monitor
  • a keyboard and pointing device eg, a mouse or a trackball
  • Other kinds of devices can also be used to provide interaction with the user; for example, the feedback provided to the user can be any form of sensory feedback (e.g., visual feedback, auditory feedback, or tactile feedback); and can be in any form (including Acoustic input, speech input or, tactile input) to receive input from the user.
  • the systems and techniques described herein can be implemented in a computing system that includes back-end components (e.g., as a data server), or a computing system that includes middleware components (e.g., an application server), or a computing system that includes front-end components (e.g., as a a user computer having a graphical user interface or web browser through which a user can interact with embodiments of the systems and techniques described herein), or including such backend components, middleware components, Or any combination of front-end components in a computing system.
  • the components of the system can be interconnected by any form or medium of digital data communication, eg, a communication network. Examples of communication networks include: Local Area Network (LAN), Wide Area Network (WAN) and the Internet.
  • a computer system may include clients and servers.
  • Clients and servers are generally remote from each other and typically interact through a communication network.
  • the relationship of client and server arises by computer programs running on the respective computers and having a client-server relationship to each other.
  • the server can be a cloud server, also known as cloud computing server or cloud host, which is a host product in the cloud computing service system to solve the problem of traditional physical host and VPS service ("Virtual Private Server", or "VPS”) Among them, there are defects such as difficult management and weak business scalability.
  • the server can also be a server of a distributed system, or a server combined with a blockchain.

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Security & Cryptography (AREA)
  • Software Systems (AREA)
  • Theoretical Computer Science (AREA)
  • Physics & Mathematics (AREA)
  • Computer Hardware Design (AREA)
  • General Engineering & Computer Science (AREA)
  • General Physics & Mathematics (AREA)
  • Technology Law (AREA)
  • Multimedia (AREA)
  • Health & Medical Sciences (AREA)
  • Bioethics (AREA)
  • General Health & Medical Sciences (AREA)
  • Storage Device Security (AREA)

Abstract

本公开公开了一种模型保护方法，涉及计算机领域，尤其涉及人工智能领域，可以用于AI模型保护等应用场景。具体实现方案为：生成WASM文件，其中，WASM文件用于为目标模型提供运行环境，WASM文件中包含对应的模型推理算法以及安全验证算法，其中，安全验证算法通过执行以下安全验证操作中的至少之一，以实现对目标模型的保护：对宿主环境进行验证；对WASM文件的完整性进行验证；对模型文件的完整性进行验证，其中，模型文件是对应于目标模型的原模型文件生成的；在模型推理过程中，对指定推理过程进行超时验证；在模型推理过程中，对整个推理过程进行超时验证。

Description

模型保护方法、装置、设备、系统以及存储介质
本申请要求于2021年8月30日提交的、申请号为202111007976.8的中国专利申请的优先权，其全部内容通过引用结合在本申请中。
技术领域
本公开涉及计算机领域，尤其涉及人工智能领域，可以用于AI模型保护等应用场景。
背景技术
人工智能模型(即AI模型)的开发可能涉及大量的财政投入和/或工程资源投入。此外，AI模型的开发通常是时间和资源密集的独特的具体领域的知识获取过程。因而，需要提供一种有效的保护机制来保护AI模型。
发明内容
本公开提供了一种模型保护方法、装置、设备、系统、存储介质以及计算机程序产品。
根据本公开的一方面，提供了一种用于服务端的模型保护方法，包括：生成WASM文件，其中，所述WASM文件用于为目标模型提供运行环境，所述WASM文件中包含对应的模型推理算法以及安全验证算法，其中，所述安全验证算法通过执行以下安全验证操作中的至少之一，以实现对所述目标模型的保护：对宿主环境进行验证；对所述WASM文件的完整性进行验证；对模型文件的完整性进行验证，其中，所述模型文件是对应于所述目标模型的原模型文件生成的；在模型推理过程中，对指定推理过程进行超时验证；在模型推理过程中，对整个推理过程进行超时验证。
根据本公开的另一方面，提供了一种用于客户端的模型保护方法，包括：加载对应于目标模型生成的模型文件；加载WASM文件，其中，所述WASM文件用于为所述目标模型提供运行环境；在所述WASM文件实例化运行中，将所述模型文件传入所述运行环境，以执行以下安全验证操作中的至少之一，从而对所述目标模型启动模型保护机制：对宿主环境进行验证；对所述WASM文件的完整性进行验证；对所述模型文件的 完整性进行验证；在模型推理过程中，对指定推理过程进行超时验证；在模型推理过程中，对整个推理过程进行超时验证。
根据本公开的另一方面，提供了一种用于服务端的模型保护装置，包括：生成模块，用于生成WASM文件，其中，所述WASM文件用于为目标模型提供运行环境，所述WASM文件中包含对应的模型推理算法以及安全验证算法，其中，所述安全验证算法通过执行以下安全验证操作中的至少之一，以实现对所述目标模型的保护：对宿主环境进行验证；对所述WASM文件的完整性进行验证；对模型文件的完整性进行验证，其中，所述模型文件是对应于所述目标模型的原模型文件生成的；在模型推理过程中，对指定推理过程进行超时验证；在模型推理过程中，对整个推理过程进行超时验证。
根据本公开的另一方面，提供了一种用于客户端的模型保护装置，包括：第一加载模块，用于加载对应于目标模型生成的模型文件；第二加载模块，用于加载WASM文件，其中，所述WASM文件用于为所述目标模型提供运行环境；安全验证模块，用于在所述WASM文件实例化运行中，将所述模型文件传入所述运行环境，以执行以下安全验证操作中的至少之一，从而对所述目标模型启动模型保护机制：对宿主环境进行验证；对所述WASM文件的完整性进行验证；对所述模型文件的完整性进行验证；在模型推理过程中，对指定推理过程进行超时验证；在模型推理过程中，对整个推理过程进行超时验证。
根据本公开的另一方面，提供了一种电子设备，包括：至少一个处理器；以及与所述至少一个处理器通信连接的存储器；其中，所述存储器存储有可被所述至少一个处理器执行的指令，所述指令被所述至少一个处理器执行，以使所述至少一个处理器能够执行本公开实施例所述的方法。
根据本公开的另一方面，提供了一种存储有计算机指令的非瞬时计算机可读存储介质，其中，所述计算机指令用于使所述计算机执行根据本公开实施例所述的方法。
根据本公开的另一方面，提供了一种计算机程序产品，包括计算机程序，所述计算机程序在被处理器执行时实现根据本公开实施例所述的方法。
根据本公开的另一方面，提供了一种模型保护系统，包括：客户端和服务端，其中，所述客户端向所述服务端请求模型信息；所述服务端响应于所述客户端的请求，返回对应的模型信息；所述客户端基于所述服务端返回的模型信息，执行以下操作：加载对应于目标模型生成的模型文件；加载WASM文件，其中，所述WASM文件用于为所述目标模型提供运行环境；使所述WASM文件实例化运行，并将所述模型文件传入所述运 行环境；其中，所述WASM文件在实例化运行中，执行以下安全验证操作中的至少之一，以对所述目标模型启动模型保护机制：对宿主环境进行验证；对所述WASM文件的完整性进行验证；对所述模型文件的完整性进行验证；在模型推理过程中，对指定推理过程进行超时验证；在模型推理过程中，对整个推理过程进行超时验证。
应当理解，本部分所描述的内容并非旨在标识本公开的实施例的关键或重要特征，也不用于限制本公开的范围。本公开的其它特征将通过以下的说明书而变得容易理解。
附图说明
附图用于更好地理解本方案，不构成对本公开的限定。其中：
图1示例性示出了适于本公开实施例的系统架构；
图2A示例性示出了适于本公开实施例的模型保护系统的框图；
图2B示例性示出了适于本公开实施例的模型离线加密和在线推理的示意图；
图3A示例性示出了根据本公开实施例的用于服务端的模型保护方法的流程图；
图3B示例性示出了根据本公开实施例的离线生成模型文件和WASM文件的示意图；
图4A示例性示出了根据本公开实施例的用于客户端的模型保护方法的流程图；
图4B示例性示出了根据本公开实施例的模型在线推理的时序图；
图5示例性示出了根据本公开实施例的模型保护机制的原理图；
图6示例性示出了根据本公开实施例的用于服务端的模型保护装置的框图；
图7示例性示出了根据本公开实施例的用于客户端的模型保护装置的框图；
图8示例性示出了用来实现本公开实施例的模型保护方法的电子设备的框图。
具体实施方式
以下结合附图对本公开的示范性实施例做出说明，其中包括本公开实施例的各种细节以助于理解，应当将它们认为仅仅是示范性的。因此，本领域普通技术人员应当认识到，可以对这里描述的实施例做出各种改变和修改，而不会背离本公开的范围和精神。同样，为了清楚和简明，以下的描述中省略了对公知功能和结构的描述。
应该理解，Web平台的AI计算，可以利用Web环境如浏览器、小程序提供的AI计算能力，在宿主环境完成模型推理过程，并得到对应的计算结果。而模型在Web环境中部署和推理，会存在如下问题：模型信息需要通过网络传输，因而容易泄露；模型 的拓扑结构需要在客户端的JS(Java script)运行过程中生成和优化，因而模型容易被调试或被篡改；模型需要在JS运行过程中完成推理运算，因而模型的拓扑结构和权重数据容易被轻易获取或推导出来。
因此，对于保密性要求高的应用场景，无法在Web环境中直接进行模型的部署和推理。
因此，Web平台的AI计算，可以通过以下两种解决方案来实现模型信息的保护。
方案1，在服务端进行AI模型的部署和推理。
示例性的，客户端可以携带模型输入数据，向服务端发送模型推理请求。服务端响应于来自客户端的模型推理请求，执行相应的模型推理操作，并在完成模型推理后通过网络返回推理结果。
方案2，依赖Web环境如浏览器、小程序等所在的宿主提供的模型推理能力完成AI计算。
示例性的，客户端在JS(Java script)运行时通过JS Bridge等方式，调用宿主提供的AI计算能力。本方案中，同样需要传递模型输入数据，并且宿主完成模型推理后需要触发客户端提供的回调以返回推理结果。
应该理解，方案1中，由于客户端需要通过网络将模型输入数据传输给服务端，因而存在用户数据泄露、耗费网络流量、数据传输延迟等弊端，且无法适于实时视频流处理等对时延要求极高的应用场景。
还应该理解，方案2中，由于客户端与宿主间的通信需要对传递的数据进行解析，因而也无法适于实时视频流处理等对时延要求极高的应用场景。此外，方案2中，由于Web开发需要适配诸如安卓、IOS等不同类型的宿主环境，因而需要跨端开发且需要不断发版，迭代速度慢且调试繁琐，丧失了Web开发原有的便捷性和易迭代等优势。
对此，本公开实施例提供了一种适于对时延要求极高的应用场景的模型保护方案，可以用于实时视频流处理等场景。并且，可以更有效地保障模型安全。
以下将结合附图和具体实施例详细阐述本公开。
适于本公开实施例的模型保护方法和装置的系统架构介绍如下。
图1示例性示出了适于本公开实施例的系统架构。需要注意的是，图1所示仅为可以应用本公开实施例的系统架构的示例，以帮助本领域技术人员理解本公开的技术内容，但并不意味着本公开实施例不可以用于其他环境或场景。
如图1所示，本公开实施例中系统架构100可以包括：服务端110和客户端120。
服务端110可以用于离线加密，即，完成模型文件的加密和WASM文件的加密。此外，还可以完成模型权重数据的加密、模型配置信息的加密、以及解密用的密钥的加密。
客户端120可以向服务端110请求模型信息，以加载模型文件、WASM文件、模型的权重数据和模型配置信息等。
应该理解，WASM文件就是WASM格式的文件，是通过Web Assembly技术对源代码进行编译得到的二进制字节码文件。
在本公开实施例中，WASM文件可以用于封装供模型推理的Web环境。此外，还可以在WASM文件中增加解密算法，用于模型解密。此外，还可以在WASM文件中增加安全验证算法，用于执行安全验证相关操作。
应该理解，模型文件、WASM文件、模型的权重数据和模型配置信息等通过加密处理，可以防止用户数据在传输过程中被泄露。
此外，由于WASM文件是二进制字节码文件，因而可读性很差。因此将供模型推理的Web环境封装在WASM文件中，可以使模型的拓扑结构(包括各算子以及各算子之间的依赖，以及各算子的属性)和模型推理逻辑很难被轻易推导出，从而可以起到保护模型的作用。
此外，通过在WASM文件中增加解密算法，可以对经加密的模型相关信息(如经加密的模型文件、模型的权重数据和模型配置信息等)进行解密，由此可以避免在宿主环境中解密而导致模型相关信息被泄露。
此外，通过在WASM文件中增加安全验证算法，比如可以通过验证宿主环境的安全性来确保模型安全。
应该理解，图1中的客户端和服务端的数目仅仅是示意性的。根据实现需要，可以具有任意数目的客户端和服务端。
适于本公开实施例的模型保护方法和装置的应用场景介绍如下。
应该理解，本公开实施例提供的模型保护方案，可以用于对任何类型的数据模型保护场景，比如可以用于AI模型保护场景。
根据本公开的实施例，本公开提供了一种模型保护系统。
图2A示例性示出了适于本公开实施例的模型保护系统的框图。
如图2A所示，模型保护系统200可以包括：客户端210和服务端220。
其中，客户端210向服务端220请求模型信息。服务端220响应于客户端210的请 求，返回对应的模型信息。
客户端210基于服务端220返回的模型信息，执行以下操作：加载对应于目标模型生成的模型文件；加载WASM文件，其中，WASM文件用于为目标模型提供运行环境；使WASM文件实例化运行，并将模型文件传入运行环境。
其中，WASM文件在实例化运行中，执行以下安全验证操作中的至少之一，以对目标模型启动模型保护机制：对宿主环境进行验证；对WASM文件的完整性进行验证；对模型文件的完整性进行验证；在模型推理过程中，对指定推理过程进行超时验证；在模型推理过程中，对整个推理过程进行超时验证。
需要说明的是，服务端220返回的模型信息可以包括但不限于经加密的模型文件的地址、经加密的WASM文件的地址、对应的经加密的模型配置信息(主要包括模型的输入/输出配置)、经加密的对应模型的权重数据等。
此外，在一个实施例中，对应于目标模型生成的模型文件可以是目标模型的原始模型文件或者是对该原始模型文件进行加密得到的产物。
或者，在一个实施例中，对应于目标模型生成的模型文件可以是目标模型的原始模型文件经处理得到的中间产物或者是对该中间产物进行加密得到的产物。
示例性的，可以基于目标模型的原始模型文件确定目标模型的拓扑结构，然后通过对该拓扑结构中各算子的属性以及算子间的依赖关系进行混淆来得到该原始模型文件的中间产物。
应该理解，通过上述的混淆处理，可以进一步确保模型的拓扑结构不被轻易推导出。
还应该理解，可以对应于目标模型的拓扑结构生成WASM文件，使得WASM文件在实例化运行过程中能够为该目标模型提供运行环境(如Web环境)，从而实现对应的模型推理。
此外，还可以在WASM文件中增加解密算法，用于模型解密(比如，对经加密的模型文件、模型的权重数据和模型配置信息等进行解密)。
另外，经加密的WASM文件可以在客户端的宿主环境中完成解密。
此外，还可以在WASM文件中增加安全验证算法，用于执行安全验证相关操作。
示例性的，对宿主环境进行验证，比如验证宿主环境的域名和/或用户名是否在对应的白名单中。如果验证结果表征其在对应的白名单中，则本次验证通过。响应于本次验证通过，可以在WASM文件实例化运行过程中执行解密算法和模型推理算法等，以确保运行过程中模型安全。响应于本次验证未通过，可以终止本次模型推理。
示例性的，对WASM文件的完整性进行验证，可以避免因WASM文件被篡改而导致的模型安全问题。
示例性的，对模型文件的完整性进行验证，可以避免因模型文件被篡改而导致的模型安全问题。
示例性的，在模型推理过程中，对指定推理过程进行超时验证。具体地，可以设置反调试机制，如预先对关键路径进行埋点，然后在运行过程中验证埋点的关键路径之间的推理过程(如从A到B的推理过程)是否超时。应该理解，如果验证结果表征指定推理过程超时，则表明该推理过程中存在模型被调试的可能。此种情况下，可以终止本次模型推理，以确保模型安全。如果验证结果表征指定推理过程未超时，则表明该推理过程正常，可以继续执行后续的模型推理操作。
示例性的，在模型推理过程中，对整个推理过程进行超时验证。应该理解，如果验证结果表征推理过程超时，则表明该推理过程中存在模型被调试的可能。此种情况下，可以终止本次模型推理，以确保模型安全。如果验证结果表征整个推理过程未超时，则表明该推理过程正常。
通过本公开实施例，在服务端，通过对模型文件加密、压缩之后再发送给客户端，可以避免传输过程中出现数据泄露，而且可以为用户节约网络流量。在客户端，通过WASM文件对模型的运行环境进行封装，并且对外部的Web宿主环境暴露有限的调用接口，可以防止模型内容(如模型的拓扑结构，包括模型中包含的各算子以及属性以及各算子之间的依赖关系等)被轻易推导出并被轻易的获取。并且，采用文件完整性校验机制，可以保证模型安全，如模型被篡改后可以及时发现。并且，采用模型反调试机制，可以保证模型安全，如及时阻止运行过程中模型被调试。因此，采用即时安全验证机制，可以更全面地保障模型安全。
作为一种可选的实施例，客户端在向服务端请求模型信息之前，可以先向服务端发送鉴权请求。服务端响应于来自客户端的鉴权请求，执行鉴权操作并返回对应的鉴权结果。客户端在鉴权结果表征鉴权通过的情况下，再向服务端请求模型信息。
其中，如果鉴权结果表征鉴权未通过，则客户端无法向服务端请求模型信息。
在本公开实施例中，在客户端JS运行过程中，通过鉴权可以获取到模型信息。该模型信息可以包括经加密的模型文件的地址、经加密的WASM文件的地址、经加密的相关模型配置信息(主要包括模型的输入/输出配置)以及模型的经加密的权重数据。
在本公开实施例中，鉴权服务可以遵循OAuth2.0授权标准。AI模型提供方可以将 用于鉴权校验的AK(Access Key Id，用于标示用户)交给模型使用方。模型使用方通过客户端向服务端如鉴权服务器发起鉴权请求，以获取鉴权token(令牌，在一些数据传递之前，先进行令牌核对，不同的令牌之前被授权不同的数据操作)，然后客户端发送携带有token的模型信息获取请求给服务端，服务端基于该请求携带的token向客户端返回对应的模型信息。
通过本公开实施例，采用授权访问的方式获取模型信息，可以保证模型信息安全。
图2B示例性示出了适于本公开实施例的模型离线加密和在线推理的示意图。如图2B所示，本方案中，对于任意需要保护的模型而言，可以通过离线加密方式，对模型文件和对应的用于解密、推理和安全验证的WASM文件分别进行加密，并对经加密的文件进行安全的文件托管处理。此外，在线推理时，客户端可以通过用户鉴权(即对模型使用方鉴权)来获取模型信息，并在WASM文件实例化运行中执行解密、解码、推理和安全验证(如宿主环境验证和超时验证)等操作。
根据本公开的实施例，本公开提供了一种用于服务端的模型保护方法。
图3A示例性示出了根据本公开实施例的用于服务端的模型保护方法的流程图。
如图3A所示，模型保护方法300可以包括：操作S310。
在操作S310，生成WASM文件，其中，WASM文件用于为目标模型提供运行环境，WASM文件中包含对应的模型推理算法以及安全验证算法。
其中，安全验证算法通过执行以下安全验证操作中的至少之一，以实现对目标模型的保护：对宿主环境进行验证；对WASM文件的完整性进行验证；对模型文件的完整性进行验证，其中，模型文件是对应于目标模型的原模型文件生成的；在模型推理过程中，对指定推理过程进行超时验证；在模型推理过程中，对整个推理过程进行超时验证。
示例性的，在一个实施例中，可以根据目标模型的原始模型文件来确定目标模型的拓扑结构，并基于目标模型的拓扑结构生成WASM文件中的模型推理逻辑。由此，生成的WASM文件可以为目标模型提供对应的运行环境。
此外，还可以在WASM文件中增加解密算法，用于模型解密(比如，对经加密的模型文件、模型的权重数据和模型配置信息等进行解密)。
另外，经加密的WASM文件可以在客户端的宿主环境中完成解密。
此外，还可以在WASM文件中增加安全验证算法，用于执行安全验证相关操作。
示例性的，对宿主环境进行验证，比如验证宿主环境的域名和/或用户名是否在对应的白名单中。如果验证结果表征其在对应的白名单中，则本次验证通过。响应于本次验 证通过，可以在WASM文件实例化运行过程中执行解密算法和模型推理算法等，以确保运行过程中模型安全。响应于本次验证未通过，可以终止本次模型推理。
示例性的，对WASM文件的完整性进行验证，可以避免因WASM文件被篡改而导致的模型安全问题。
示例性的，对模型文件的完整性进行验证，可以避免因模型文件被篡改而导致的模型安全问题。
示例性的，在模型推理过程中，对指定推理过程进行超时验证。具体地，可以设置反调试机制，如预先对关键路径进行埋点，然后在运行过程中验证埋点的关键路径之间的推理过程(如从A到B的推理过程)是否超时。应该理解，如果验证结果表征指定推理过程超时，则表明该推理过程中存在模型被调试的可能。此种情况下，可以终止本次模型推理，以保证模型安全。如果验证结果表征指定推理过程未超时，则表明该推理过程正常，可以继续执行后续的模型推理操作。
示例性的，在模型推理过程中，对整个推理过程进行超时验证。应该理解，如果验证结果表征推理过程超时，则表明该推理过程中存在模型被调试的可能。此种情况下，可以终止本次模型推理，以保证模型安全。如果验证结果表征整个推理过程未超时，则表明该推理过程正常。
应该理解，本实施例提供的模型保护方法应用于服务端，该方法的描述可以参考前述模型保护系统实施例中的相关描述，本公开实施例在此不再赘述。
示例性的，生成用于解密、推理和安全验证的WASM文件时，可以选择模型前端推理引擎的WASM backend计算方案，编译出在线推理所需的WASM文件，其中可以包括解密、安全验证及模型推理等算法。
此外，示例性的，生成经加密的模型文件时，可以选择模型前端推理引擎的Plain JS backend计算方案，构建出模型的拓扑结构，然后对这个中间产物加密，生成经加密的模型文件。应该理解，此方案中，不是对原始的模型结构和模型数据进行加密，而是对由原始的模型结构和模型数据处理得到的中间内容和数据进行加密，由此可以增加模型被破解的难度，从而能够更好地保护到模型。在本实施例中，加密算法可以采用AES对称加密算法。
此外，在本实施例中，在生成WASM文件时，可以基于该目标模型的拓扑结构提取出WASM backend计算方案需要的信息，并基于提取的信息生成WASM文件。
通过本公开实施例，在服务端，通过将模型文件加密、压缩之后再发送给客户端， 可以避免传输过程中出现数据泄露，而且可以为用户节约网络流量。在客户端，通过WASM文件对模型的运行环境进行封装，并且对外部的Web宿主环境暴露有限的调用接口，可以防止模型的拓扑结构被轻易推导出并被轻易地获取。并且，采用文件完整性校验机制，可以保证模型安全，如模型被篡改后可以及时发现。并且，采用模型反调试机制，可以保证模型安全，如及时阻止运行过程中模型被调试。因此，采用即时安全验证机制，可以更全面地保障模型安全。
应该理解，采用本公开实施例提供的针对Web平台的AI计算的模型保护方案，可以有效解决模型在Web环境的安全问题。并且在保证模型安全的前提下：
相较于在服务端进行AI模型的部署和推理，本方案中，模型可以完全在Web环境下完成部署和推理，无需将用户数据通过网络传输到服务端，保护了用户的隐私，且为用户节省了流量，降低了网络延时。
相较于依赖Web环境所在的宿主提供的模型推理对应的端能力，本方案中，无需依赖宿主开发相应的推理功能并发版，节省了跨端开发成本及前端适配成本，同样无需与宿主环境传递模型输入数据，降低了延时。
作为一种可选的实施例，该方法还可以包括以下至少之一。
对模型文件进行加密，得到经加密的模型文件。
对WASM文件进行加密，得到经加密的WASM文件。
对目标模型的模型配置信息进行加密，得到经加密的模型配置信息。
对目标模型的权重数据进行加密，得到经加密的权重数据。
其中，WASM文件中还包含对应的解密算法，该解密算法用于对以下至少之一进行解密：经加密的模型文件、经加密的模型配置信息、经加密的权重数据。
在本公开实施例中，加密算法可以采用AES对称加密算法。
应该理解，通过对模型文件、WASM文件、模型配置信息、模型的权重数据等进行加密，既可以有效防止用户数据在托管过程中泄露，又可以有效防止用户数据在传输过程中泄露。
此外，在WASM文件中增加对应的解密算法，并在WASM文件实例化运行中对经加密的模型文件、经加密的模型配置信息、经加密的权重数据进行解密，可以防止上述内容解密后被轻易获取。
在本公开实施例中，通过对上述内容进行加密，可以进一步保护模型隐私。
进一步，作为一种可选的实施例，该方法还可以包括：对解密用的密钥进行加密， 得到经加密的密钥。
应该理解，通过对解密用的密钥进行加密，可以实现二次加密。由此，在前后端通信中(即在客户端与服务器通信中)，可以通过对解密用的密钥的隐藏处理来保障信息的安全传递。
在本公开实施例中，对解密用的密钥可以采用RSA非对称加密算法进行加密，生成解密用的经加密的密钥。
此外，在本公开实施例中，对加密用的密钥也可以采用RSA非对称加密算法进行加密，生成加密用的经加密的密钥。
在本公开实施例中，通过对解密用的密钥进行二次加密，可以进一步保护模型隐私。
作为一种可选的实施例，该方法还可以包括：针对目标模型，为至少一个用户中的每个用户配置一个访问密钥标识。
在本公开实施例中，该至少一个用户是指目标模型的使用方。通过为每个目标模型的使用方配置一个唯一的访问密钥标识(AK)，可以用于标志用户。因而，在鉴权服务中，可以通过用户(即模型使用方)提供的AK来鉴别用户是否是授信域的模型使用方。如果鉴权结果表征请求鉴权的用户是授信域的模型使用方，则确认本次鉴权通过，否则确认本次鉴权失败。其中，在鉴权通过的情况下，才允许用户获取模型信息，否则不允许用户获取模型信息。
通过本公开实施例，对模型使用方采用授权访问的方式，可以避免模型信息被非法获取，进而起到保护模型的作用。
图3B示例性示出了根据本公开实施例的离线生成模型文件和WASM文件的示意图。如图3B所示，可以在Plain JS CPU计算方案中生成模型的拓扑结构，对拓扑结构进行混淆、加密处理后，可以生成该模型的模型文件，之后可以对生成的模型文件进行压缩和部署。如图3B所示，可以在Plain JS WASM计算方案中生成包含分析、解密、解码、推理、安全验证等算法的WASM文件，生成WASM文件后还可以对该文件进行加密、压缩和部署。应该理解，本实施例中，加密密钥可以动态生成或指定。
根据本公开的实施例，本公开提供了一种用于客户端的模型保护方法。
图4A示例性示出了根据本公开实施例的用于客户端的模型保护方法的流程图。
如图4A所示，模型保护方法400可以包括：操作S410～操作S430。
在操作S410，加载对应于目标模型生成的模型文件。
在操作S420，加载WASM文件，其中，WASM文件用于为目标模型提供运行环境。
在操作S430，使WASM文件实例化运行，并将模型文件传入WASM文件提供的运行环境，从而使得在WASM文件实例化运行中执行以下安全验证操作中的至少之一，以对目标模型启动模型保护机制：对宿主环境进行验证；对WASM文件的完整性进行验证；对模型文件的完整性进行验证；在模型推理过程中，对指定推理过程进行超时验证；在模型推理过程中，对整个推理过程进行超时验证。
应该理解，本实施例中的模型文件和WASM文件的生成、加密、加载、解密等方法与前述实施例中的描述相同或类似，在此不再赘述。
应该理解，本实施例中的安全验证方法与前述实施例中的描述相同或类似，在此不再赘述。
作为一种可选的实施例，响应于对用户鉴权通过，获取并加载模型文件和WASM文件。应该理解，本实施例中的用户鉴权方法与前述实施例中的描述相同或类似，在此不再赘述。
作为一种可选的实施例，模型文件和/或WASM文件为经加密的文件。应该理解，本实施例中的型文件和WASM文件的加密方法与前述实施例中的描述相同或类似，在此不再赘述。
作为一种可选的实施例，该方法还可以包括：在WASM文件实例化运行中，执行以下操作。响应于预设安全验证通过，对经加密的模型文件进行解密，得到解密后的模型文件。基于解密后的模型文件进行模型推理。
作为一种可选的实施例，预设安全验证可以包括以下中的至少之一：宿主环境验证、模型文件完整性验证、WASM文件完整性验证。通过本公开实施例，可以防止解密时机不当导致模型内容(如模型的拓扑结构)或数据泄露。
作为一种可选的实施例，对经加密的模型文件进行解密，可以包括如下操作：获取解密用的经加密的密钥。对经加密的密钥进行解密，得到解密后的密钥。利用解密后的密钥，对经加密的模型文件进行解密。在本公开实施例中，解密时可以动态地读取解密用的密钥。在本公开实施例中，通过对解密用的密钥进行二次加密，可以进一步保护模型隐私。
图4B示例性示出了根据本公开实施例的模型在线推理的时序图。如图4B所示，模型的在线推理的时序如下：客户端JS运行过程中向服务端发送鉴权请求；服务端响应于该请求执行鉴权操作，并在鉴权通过的情况下返回鉴权token；客户端JS运行过程中携带该鉴权token向服务端并行发送模型配置信息请求、模型权重数据请求、经加密 的模型文件的地址请求、经加密的WASM文件的地址请求等模型信息请求；服务端响应于这些请求返回对应的模型信息；客户端JS运行过程中加载经加密的WASM文件和经加密的模型文件；客户端JS运行过程中将WASM文件实例化，同时将模型权重数据、模型输入数据、模型结构内容等写入WASM模块的内存并生成对应的地址Map；WASM模块(模型文件实例化得到的)运行中进行宿主环境验证(如通过与服务端的签名握手机制，确认用户身份)、解密、解码、初始化、推理、时效限制验证(即验证整个推理过程是否超时，如是否超过1h，若超时，则退出)；WASM模块将推理结果写入WASM模块的内存；客户端JS运行过程中可以调用WASM模块暴露出来的调用接口，如调用相关接口读取对应的推理结果。
图5示例性示出了根据本公开实施例的模型保护机制的原理图。如图5所示，该模型保护机制可以从机密性与可控性两个方面来保障模型的安全。其中，对于模型的机密性：可以通过离线模型加密来保证模型本身的安全；通过将解密与推理过程封装到不可读的WASM文件中(即封装运行环境)，来防止运行时泄露模型结构和模型数据；解密用的密钥已被二次非对称加密，且通过授权访问的方式获取，由此可以保证密钥的安全。对于模型的可控性：模型以及密钥的加密采用离线私有化部署，以保证加密环境安全；解密用的密钥通过单独的授权访问服务获取(即进行授信次数管理)，以保证密钥安全；模型运行中可以进行宿主环境验证、代码完整性验证、反调试验证(如指定推理过程超时验证和整个推理过程超时验证，其中后者也是运行有效时间限制的验证)，由此可以保证运行中模型安全、防止模型被盗用。
根据本公开的实施例，本公开还提供了一种用于服务端的模型保护装置。
图6示例性示出了根据本公开实施例的用于服务端的模型保护装置的框图。
如图6所示，模型保护装置600可以包括：生成模块610。
生成模块610，用于生成WASM文件，其中，该WASM文件用于为目标模型提供运行环境，该WASM文件中包含对应的模型推理算法以及安全验证算法。
其中，该安全验证算法通过执行以下安全验证操作中的至少之一，以实现对该目标模型的保护：对宿主环境进行验证；对该WASM文件的完整性进行验证；对模型文件的完整性进行验证，其中，该模型文件是对应于该目标模型的原模型文件生成的；在模型推理过程中，对指定推理过程进行超时验证；在模型推理过程中，对整个推理过程进行超时验证。
作为一种可选的实施例，该装置还包括以下模块中的至少之一：第一加密模块，用 于对该模型文件进行加密，得到经加密的模型文件；第二加密模块，用于对该WASM文件进行加密，得到经加密的WASM文件；第三加密模块，用于对该目标模型的模型配置信息进行加密，得到经加密的模型配置信息；第四加密模块，用于对该目标模型的权重数据进行加密，得到经加密的权重数据；其中，WASM文件中还包含对应的解密算法，该解密算法用于对以下至少之一进行解密：该经加密的模型文件、该经加密的模型配置信息、该经加密的权重数据。
作为一种可选的实施例，该装置还包括：第五加密模块，用于对解密用的密钥进行加密，得到经加密的密钥。
作为一种可选的实施例，该装置还包括：配置模块，用于针对该目标模型，为至少一个用户中的每个用户配置一个访问密钥标识。
应该理解，本公开装置部分的实施例与本公开前述对应方法部分的实施例对应相同或类似，所解决的技术问题和所达到的技术效果也对应相同或类似，本公开在此不再赘述。
根据本公开的实施例，本公开还提供了一种用于客户端的模型保护装置。
图7示例性示出了根据本公开实施例的用于客户端的模型保护装置的框图。
如图7所示，模型保护装置700可以包括：第一加载模块710、第二加载模块720和安全验证模块730。
第一加载模块710，用于加载对应于目标模型生成的模型文件。
第二加载模块720，用于加载WASM文件，其中，该WASM文件用于为该目标模型提供运行环境。
安全验证模块730，用于在该WASM文件实例化运行中，将该模型文件传入该运行环境并执行以下安全验证操作中的至少之一，以对该目标模型启动模型保护机制：对宿主环境进行验证；对该WASM文件的完整性进行验证；对该模型文件的完整性进行验证；在模型推理过程中，对指定推理过程进行超时验证；在模型推理过程中，对整个推理过程进行超时验证。
作为一种可选的实施例，响应于对用户鉴权通过，由该第一加载模块获取并加载该模型文件，以及由该第二加载模块获取并加载该WASM文件。
作为一种可选的实施例，该模型文件和/或该WASM文件为经加密的文件。
作为一种可选的实施例，该装置还包括：解密模块，用于在该WASM文件实例化运行中，响应于预设安全验证通过，对经加密的模型文件进行解密，得到解密后的模型 文件；以及模型推理模块，用于基于该解密后的模型文件进行模型推理。
作为一种可选的实施例，该预设安全验证包括以下中的至少之一：宿主环境验证、模型文件完整性验证、WASM文件完整性验证。
作为一种可选的实施例，该解密模块包括：获取单元，用于获取解密用的经加密的密钥；第一解密单元，用于对该经加密的密钥进行解密，得到解密后的密钥；以及第二解密单元，用于利用该解密后的密钥，对该经加密的模型文件进行解密。
应该理解，本公开装置部分的实施例与本公开前述对应方法部分的实施例对应相同或类似，所解决的技术问题和所达到的技术效果也对应相同或类似，本公开在此不再赘述。
根据本公开的实施例，本公开还提供了一种电子设备、一种可读存储介质和一种计算机程序产品。
图8示出了可以用来实施本公开的实施例的示例电子设备800的示意性框图。电子设备旨在表示各种形式的数字计算机，诸如，膝上型计算机、台式计算机、工作台、个人数字助理、服务器、刀片式服务器、大型计算机和其它适合的计算机。电子设备还可以表示各种形式的移动装置，诸如，个人数字处理、蜂窝电话、智能电话、可穿戴设备和其它类似的计算装置。本文所示的部件、它们的连接和关系、以及它们的功能仅仅作为示例，并且不意在限制本文中描述的和/或者要求的本公开的实现。
如图8所示，电子设备800包括计算单元801，其可以根据存储在只读存储器(ROM)802中的计算机程序或者从存储单元808加载到随机访问存储器(RAM)803中的计算机程序，来执行各种适当的动作和处理。在RAM 803中，还可存储电子设备800操作所需的各种程序和数据。计算单元801、ROM 802以及RAM 803通过总线804彼此相连。输入/输出(I/O)接口805也连接至总线804。
电子设备800中的多个部件连接至I/O接口805，包括：输入单元806，例如键盘、鼠标等；输出单元807，例如各种类型的显示器、扬声器等；存储单元808，例如磁盘、光盘等；以及通信单元809，例如网卡、调制解调器、无线通信收发机等。通信单元809允许设备800通过诸如因特网的计算机网络和/或各种电信网络与其他设备交换信息/数据。
计算单元801可以是各种具有处理和计算能力的通用和/或专用处理组件。计算单元801的一些示例包括但不限于中央处理单元(CPU)、图形处理单元(GPU)、各种专用的人工智能(AI)计算芯片、各种运行机器学习模型算法的计算单元、数字信号处理器 (DSP)、以及任何适当的处理器、控制器、微控制器等。计算单元801执行上文所描述的各个方法和处理，例如模型保护方法。例如，在一些实施例中，模型保护方法可被实现为计算机软件程序，其被有形地包含于机器可读介质，例如存储单元808。在一些实施例中，计算机程序的部分或者全部可以经由ROM 802和/或通信单元809而被载入和/或安装到设备800上。当计算机程序加载到RAM 803并由计算单元801执行时，可以执行上文描述的模型保护方法的一个或多个步骤。备选地，在其他实施例中，计算单元801可以通过其他任何适当的方式(例如，借助于固件)而被配置为执行模型保护方法。
本文中以上描述的系统和技术的各种实施方式可以在数字电子电路系统、集成电路系统、场可编程门阵列(FPGA)、专用集成电路(ASIC)、专用标准产品(ASSP)、芯片上系统的系统(SOC)、负载可编程逻辑设备(CPLD)、计算机硬件、固件、软件、和/或它们的组合中实现。这些各种实施方式可以包括：实施在一个或者多个计算机程序中，该一个或者多个计算机程序可在包括至少一个可编程处理器的可编程系统上执行和/或解释，该可编程处理器可以是专用或者通用可编程处理器，可以从存储系统、至少一个输入装置、和至少一个输出装置接收数据和指令，并且将数据和指令传输至该存储系统、该至少一个输入装置、和该至少一个输出装置。
用于实施本公开的方法的程序代码可以采用一个或多个编程语言的任何组合来编写。这些程序代码可以提供给通用计算机、专用计算机或其他可编程数据处理装置的处理器或控制器，使得程序代码当由处理器或控制器执行时使流程图和/或框图中所规定的功能/操作被实施。程序代码可以完全在机器上执行、部分地在机器上执行，作为独立软件包部分地在机器上执行且部分地在远程机器上执行或完全在远程机器或服务器上执行。
在本公开的上下文中，机器可读介质可以是有形的介质，其可以包含或存储以供指令执行系统、装置或设备使用或与指令执行系统、装置或设备结合地使用的程序。机器可读介质可以是机器可读信号介质或机器可读储存介质。机器可读介质可以包括但不限于电子的、磁性的、光学的、电磁的、红外的、或半导体系统、装置或设备，或者上述内容的任何合适组合。机器可读存储介质的更具体示例会包括基于一个或多个线的电气连接、便携式计算机盘、硬盘、随机存取存储器(RAM)、只读存储器(ROM)、可擦除可编程只读存储器(EPROM或快闪存储器)、光纤、便捷式紧凑盘只读存储器(CD-ROM)、光学储存设备、磁储存设备、或上述内容的任何合适组合。
为了提供与用户的交互，可以在计算机上实施此处描述的系统和技术，该计算机具有：用于向用户显示信息的显示装置(例如，CRT(阴极射线管)或者LCD(液晶显示器)监视器)；以及键盘和指向装置(例如，鼠标或者轨迹球)，用户可以通过该键盘和该指向装置来将输入提供给计算机。其它种类的装置还可以用于提供与用户的交互；例如，提供给用户的反馈可以是任何形式的传感反馈(例如，视觉反馈、听觉反馈、或者触觉反馈)；并且可以用任何形式(包括声输入、语音输入或者、触觉输入)来接收来自用户的输入。
可以将此处描述的系统和技术实施在包括后台部件的计算系统(例如，作为数据服务器)、或者包括中间件部件的计算系统(例如，应用服务器)、或者包括前端部件的计算系统(例如，具有图形用户界面或者网络浏览器的用户计算机，用户可以通过该图形用户界面或者该网络浏览器来与此处描述的系统和技术的实施方式交互)、或者包括这种后台部件、中间件部件、或者前端部件的任何组合的计算系统中。可以通过任何形式或者介质的数字数据通信(例如，通信网络)来将系统的部件相互连接。通信网络的示例包括：局域网(LAN)、广域网(WAN)和互联网。
计算机系统可以包括客户端和服务器。客户端和服务器一般远离彼此并且通常通过通信网络进行交互。通过在相应的计算机上运行并且彼此具有客户端-服务器关系的计算机程序来产生客户端和服务器的关系。服务器可以是云服务器，又称为云计算服务器或云主机，是云计算服务体系中的一项主机产品，以解决了传统物理主机与VPS服务(″Virtual Private Server″，或简称″VPS″)中，存在的管理难度大，业务扩展性弱的缺陷。服务器也可以为分布式系统的服务器，或者是结合了区块链的服务器。
在本公开的技术方案中，所涉及的用户个人信息的收集、存储、使用、加工、传输、提供、公开和应用等处理，均符合相关法律法规的规定，采取了必要保密措施，且不违背公序良俗。
在本公开的技术方案中，在获取或采集用户个人信息之前，均获取了用户的授权或同意。应该理解，可以使用上面所示的各种形式的流程，重新排序、增加或删除步骤。例如，本发公开中记载的各步骤可以并行地执行也可以顺序地执行也可以不同的次序执行，只要能够实现本公开公开的技术方案所期望的结果，本文在此不进行限制。
上述具体实施方式，并不构成对本公开保护范围的限制。本领域技术人员应该明白的是，根据设计要求和其他因素，可以进行各种修改、组合、子组合和替代。任何在本公开的精神和原则之内所作的修改、等同替换和改进等，均应包含在本公开保护范围之 内。

Claims (25)

  1. 一种模型保护方法，包括：
    生成WASM文件，其中，所述WASM文件用于为目标模型提供运行环境，所述WASM文件中包含对应的模型推理算法以及安全验证算法，
    其中，所述安全验证算法通过执行以下安全验证操作中的至少之一，以实现对所述目标模型的保护：
    对宿主环境进行验证；
    对所述WASM文件的完整性进行验证；
    对模型文件的完整性进行验证，其中，所述模型文件是对应于所述目标模型的原模型文件生成的；
    在模型推理过程中，对指定推理过程进行超时验证；
    在模型推理过程中，对整个推理过程进行超时验证。
  2. 根据权利要求1所述的方法，还包括以下至少之一：
    对所述模型文件进行加密，得到经加密的模型文件；
    对所述WASM文件进行加密，得到经加密的WASM文件；
    对所述目标模型的模型配置信息进行加密，得到经加密的模型配置信息；
    对所述目标模型的权重数据进行加密，得到经加密的权重数据；
    其中，所述WASM文件中还包含对应的解密算法，所述解密算法用于对以下至少之一进行解密：所述经加密的模型文件、所述经加密的模型配置信息、所述经加密的权重数据。
  3. 根据权利要求2所述的方法，还包括：
    对解密用的密钥进行加密，得到经加密的密钥。
  4. 根据权利要求1至3中任一项所述的方法，还包括：
    针对所述目标模型，为至少一个用户中的每个用户配置一个访问密钥标识。
  5. 一种模型保护方法，包括：
    加载对应于目标模型生成的模型文件；
    加载WASM文件，其中，所述WASM文件用于为所述目标模型提供运行环境；
    在所述WASM文件实例化运行中，将所述模型文件传入所述运行环境， 以执行以下安全验证操作中的至少之一，从而对所述目标模型启动模型保护机制：
    对宿主环境进行验证；
    对所述WASM文件的完整性进行验证；
    对所述模型文件的完整性进行验证；
    在模型推理过程中，对指定推理过程进行超时验证；
    在模型推理过程中，对整个推理过程进行超时验证。
  6. 根据权利要求5所述的方法，其中：
    响应于对用户鉴权通过，获取并加载所述模型文件和所述WASM文件。
  7. 根据权利要求5或6所述的方法，其中：
    所述模型文件和/或所述WASM文件为经加密的文件。
  8. 根据权利要求7所述的方法，还包括：在所述WASM文件实例化运行中，
    响应于预设安全验证通过，对经加密的模型文件进行解密，得到解密后的模型文件；以及
    基于所述解密后的模型文件进行模型推理。
  9. 根据权利要求8所述的方法，其中，所述预设安全验证包括以下中的至少之一：宿主环境验证、模型文件完整性验证、WASM文件完整性验证。
  10. 根据权利要求8所述的方法，其中，所述对经加密的模型文件进行解密，包括：
    获取解密用的经加密的密钥；
    对所述经加密的密钥进行解密，得到解密后的密钥；以及
    利用所述解密后的密钥，对所述经加密的模型文件进行解密。
  11. 一种模型保护装置，包括：
    生成模块，用于生成WASM文件，其中，所述WASM文件用于为目标模型提供运行环境，所述WASM文件中包含对应的模型推理算法以及安全验证算法，
    其中，所述安全验证算法通过执行以下安全验证操作中的至少之一，以实现对所述目标模型的保护：
    对宿主环境进行验证；
    对所述WASM文件的完整性进行验证；
    对模型文件的完整性进行验证，其中，所述模型文件是对应于所述目标模型的原模型文件生成的；
    在模型推理过程中，对指定推理过程进行超时验证；
    在模型推理过程中，对整个推理过程进行超时验证。
  12. 根据权利要求11所述的装置，还包括以下模块中的至少之一：
    第一加密模块，用于对所述模型文件进行加密，得到经加密的模型文件；
    第二加密模块，用于对所述WASM文件进行加密，得到经加密的WASM文件；
    第三加密模块，用于对所述目标模型的模型配置信息进行加密，得到经加密的模型配置信息；
    第四加密模块，用于对所述目标模型的权重数据进行加密，得到经加密的权重数据；
    其中，所述WASM文件中还包含对应的解密算法，所述解密算法用于对以下至少之一进行解密：所述经加密的模型文件、所述经加密的模型配置信息、所述经加密的权重数据。
  13. 根据权利要求12所述的装置，还包括：
    第五加密模块，用于对解密用的密钥进行加密，得到经加密的密钥。
  14. 根据权利要求11至13中任一项所述的装置，还包括：
    配置模块，用于针对所述目标模型，为至少一个用户中的每个用户配置一个访问密钥标识。
  15. 一种模型保护装置，包括：
    第一加载模块，用于加载对应于目标模型生成的模型文件；
    第二加载模块，用于加载WASM文件，其中，所述WASM文件用于为所述目标模型提供运行环境；
    安全验证模块，用于在所述WASM文件实例化运行中，将所述模型文件传入所述运行环境，以执行以下安全验证操作中的至少之一，从而对所述目标模型启动模型保护机制：
    对宿主环境进行验证；
    对所述WASM文件的完整性进行验证；
    对所述模型文件的完整性进行验证；
    在模型推理过程中，对指定推理过程进行超时验证；
    在模型推理过程中，对整个推理过程进行超时验证。
  16. 根据权利要求15所述的装置，其中：
    响应于对用户鉴权通过，由所述第一加载模块获取并加载所述模型文件，
    以及由所述第二加载模块获取并加载所述WASM文件。
  17. 根据权利要求15或16所述的装置，其中：
    所述模型文件和/或所述WASM文件为经加密的文件。
  18. 根据权利要求17所述的装置，还包括：
    解密模块，用于在所述WASM文件实例化运行中，响应于预设安全验证通过，对经加密的模型文件进行解密，得到解密后的模型文件；以及
    模型推理模块，用于基于所述解密后的模型文件进行模型推理。
  19. 根据权利要求18所述的装置，其中，所述预设安全验证包括以下中的至少之一：宿主环境验证、模型文件完整性验证、WASM文件完整性验证。
  20. 根据权利要求18所述的装置，其中，所述解密模块包括：
    获取单元，用于获取解密用的经加密的密钥；
    第一解密单元，用于对所述经加密的密钥进行解密，得到解密后的密钥；以及
    第二解密单元，用于利用所述解密后的密钥，对所述经加密的模型文件进行解密。
  21. 一种电子设备，包括：
    至少一个处理器；以及
    与所述至少一个处理器通信连接的存储器；其中，
    所述存储器存储有可被所述至少一个处理器执行的指令，所述指令被所述至少一个处理器执行，以使所述至少一个处理器能够执行权利要求1-10中任一项所述的方法。
  22. 一种存储有计算机指令的非瞬时计算机可读存储介质，其中，所述计算机指令用于使所述计算机执行根据权利要求1-10中任一项所述的方法。
  23. 一种计算机程序产品，包括计算机程序，所述计算机程序在被处理器执行时实现根据权利要求1-10中任一项所述的方法。
  24. 一种模型保护系统，包括：客户端和服务端，其中，
    所述客户端向所述服务端请求模型信息；
    所述服务端响应于所述客户端的请求，返回对应的模型信息；
    所述客户端基于所述服务端返回的模型信息，执行以下操作：
    加载对应于目标模型生成的模型文件；
    加载WASM文件，其中，所述WASM文件用于为所述目标模型提供运行环境；
    使所述WASM文件实例化运行，并将所述模型文件传入所述运行环境；
    其中，所述WASM文件在实例化运行中，执行以下安全验证操作中的至少之一，以对所述目标模型启动模型保护机制：
    对宿主环境进行验证；
    对所述WASM文件的完整性进行验证；
    对所述模型文件的完整性进行验证；
    在模型推理过程中，对指定推理过程进行超时验证；
    在模型推理过程中，对整个推理过程进行超时验证。
  25. 根据权利要求24所述的系统，其中：
    所述客户端在向所述服务端请求模型信息之前，先向所述服务端发送鉴权请求；
    所述服务端响应于来自所述客户端的鉴权请求，执行鉴权操作并返回鉴权结果；以及
    所述客户端在所述鉴权结果表征鉴权通过的情况下，再向所述服务端请求模型信息。
PCT/CN2022/082285 2021-08-30 2022-03-22 模型保护方法、装置、设备、系统以及存储介质 WO2023029447A1 (zh)

Priority Applications (3)

Application Number Priority Date Filing Date Title
JP2022559937A JP2023542574A (ja) 2021-08-30 2022-03-22 モデル保護方法、装置、機器、システム、記憶媒体及びプログラム
US17/915,705 US20240211609A1 (en) 2021-08-30 2022-03-22 Method and system of protecting model, device, and storage medium
KR1020227033945A KR20220140638A (ko) 2021-08-30 2022-03-22 모델 보호 방법과 장치, 전자 기기, 모델 보호 시스템, 저장 매체 및 컴퓨터 프로그램

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN202111007976.8A CN113722683B (zh) 2021-08-30 2021-08-30 模型保护方法、装置、设备、系统以及存储介质
CN202111007976.8 2021-08-30

Publications (1)

Publication Number Publication Date
WO2023029447A1 true WO2023029447A1 (zh) 2023-03-09

Family

ID=78679505

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2022/082285 WO2023029447A1 (zh) 2021-08-30 2022-03-22 模型保护方法、装置、设备、系统以及存储介质

Country Status (2)

Country Link
CN (1) CN113722683B (zh)
WO (1) WO2023029447A1 (zh)

Cited By (1)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN116319763A (zh) * 2023-05-19 2023-06-23 北京长亭科技有限公司 一种基于wasm技术的文件上传方法以及装置

Families Citing this family (3)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN113722683B (zh) * 2021-08-30 2023-10-13 北京百度网讯科技有限公司 模型保护方法、装置、设备、系统以及存储介质
CN115146237B (zh) * 2022-09-05 2022-11-15 南湖实验室 一种基于机密计算的深度学习模型保护方法
CN115495714B (zh) * 2022-09-14 2023-07-07 湖南大学 基于区块链的金融人工智能算法集成方法及系统

Citations (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20200184037A1 (en) * 2018-12-10 2020-06-11 XNOR.ai, Inc. Integrating Binary Inference Engines and Model Data for Efficiency of Inference Tasks
US20200250312A1 (en) * 2019-02-04 2020-08-06 Pathtronic Inc. Systems and methods of security for trusted artificial intelligence hardware processing
CN112015470A (zh) * 2020-09-09 2020-12-01 平安科技（深圳）有限公司 模型部署方法、装置、设备及存储介质
CN113268737A (zh) * 2020-02-15 2021-08-17 阿里巴巴集团控股有限公司 环境安全验证方法、系统和客户端
CN113722683A (zh) * 2021-08-30 2021-11-30 北京百度网讯科技有限公司 模型保护方法、装置、设备、系统以及存储介质

Family Cites Families (9)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CA2492328A1 (en) * 2002-08-09 2004-02-19 Universite De Sherbrooke Image model based on n-pixels and defined in algebraic topology, and applications thereof
US10594564B2 (en) * 2016-10-31 2020-03-17 International Business Machines Corporation Network topology-preserving internet protocol address anonymization
EP3555785A1 (en) * 2016-12-15 2019-10-23 Irdeto B.V. Software integrity verification
CN108632251B (zh) * 2018-03-28 2020-09-01 杭州电子科技大学 基于云计算数据服务的可信认证方法及其加密算法
CN108965258B (zh) * 2018-06-21 2021-07-16 河南科技大学 一种基于全同态加密的云环境数据完整性验证方法
CN110138596A (zh) * 2019-04-13 2019-08-16 山东公链信息科技有限公司 一种基于切换网络拓扑方式的区块链共识方法
CN110852011B (zh) * 2019-11-08 2022-09-20 大连理工大学 一种基于序列Kriging代理模型的结构非梯度拓扑优化方法
CN111949972B (zh) * 2020-02-19 2023-10-03 华控清交信息科技(北京)有限公司 人工智能模型的验证方法、系统、设备及存储介质
CN111859379B (zh) * 2020-07-31 2023-08-25 中国工商银行股份有限公司 保护数据模型的处理方法和装置

Patent Citations (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20200184037A1 (en) * 2018-12-10 2020-06-11 XNOR.ai, Inc. Integrating Binary Inference Engines and Model Data for Efficiency of Inference Tasks
US20200250312A1 (en) * 2019-02-04 2020-08-06 Pathtronic Inc. Systems and methods of security for trusted artificial intelligence hardware processing
CN113268737A (zh) * 2020-02-15 2021-08-17 阿里巴巴集团控股有限公司 环境安全验证方法、系统和客户端
CN112015470A (zh) * 2020-09-09 2020-12-01 平安科技（深圳）有限公司 模型部署方法、装置、设备及存储介质
CN113722683A (zh) * 2021-08-30 2021-11-30 北京百度网讯科技有限公司 模型保护方法、装置、设备、系统以及存储介质

Non-Patent Citations (1)

* Cited by examiner, † Cited by third party
Title
YUN SHUI MU SHI: "Why does TensorFlow.js introduce the WASM backend", TENCENT CLOUD, pages 1 - 4, XP009544142, Retrieved from the Internet <URL:https://cloud.tencent.com/developer/article/1646410> [retrieved on 20220518] *

Cited By (2)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN116319763A (zh) * 2023-05-19 2023-06-23 北京长亭科技有限公司 一种基于wasm技术的文件上传方法以及装置
CN116319763B (zh) * 2023-05-19 2023-08-11 北京长亭科技有限公司 一种基于wasm技术的文件上传方法以及装置

Also Published As

Publication number Publication date
CN113722683B (zh) 2023-10-13
CN113722683A (zh) 2021-11-30

Similar Documents

Publication Publication Date Title
WO2023029447A1 (zh) 模型保护方法、装置、设备、系统以及存储介质
US20240126930A1 (en) Secure Collaboration Between Processors And Processing Accelerators In Enclaves
KR101091465B1 (ko) 프로세서의 가상 머신 내 기밀 콘텐츠의 보안 처리를 위한 방법 및 장치
CN110008745B (zh) 一种加密方法、计算机设备和计算机存储介质
CN111262889B (zh) 一种云服务的权限认证方法、装置、设备及介质
US10797868B2 (en) Shared secret establishment
US9208319B2 (en) Code base partitioning system
CN109992987B (zh) 基于Nginx的脚本文件保护方法、装置及终端设备
CN113438086A (zh) 一种数据安全防护方法和系统
CN113014444A (zh) 一种物联网设备生产测试系统及安全保护方法
CN115580413B (zh) 一种零信任的多方数据融合计算方法和装置
Ozkan et al. Security analysis of mobile authenticator applications
CN112308236A (zh) 用于处理用户请求的方法、装置、电子设备及存储介质
Vella et al. RV-TEE: secure cryptographic protocol execution based on runtime verification
Lee et al. Classification and analysis of security techniques for the user terminal area in the internet banking service
Pop et al. Towards securely migrating webassembly enclaves
CN112115430A (zh) 一种apk的加固方法、电子设备及存储介质
CN111475844A (zh) 一种数据共享方法、装置、设备及计算机可读存储介质
CN114676392B (zh) 应用的可信授权方法、装置及电子设备
CN115883078A (zh) 文件加密方法、文件解密方法、装置、设备及存储介质
US20240211609A1 (en) Method and system of protecting model, device, and storage medium
CN113434887A (zh) App业务数据处理方法及装置
DONG et al. Sesoa: Security enhancement system with online authentication for android apk
Zhang et al. Design and implementation of trustzone-based blockchain chip wallet
CN111460464A (zh) 数据加解密方法、装置、电子设备及计算机存储介质

Legal Events

Date Code Title Description
ENP Entry into the national phase

Ref document number: 20227033945

Country of ref document: KR

Kind code of ref document: A

WWE Wipo information: entry into national phase

Ref document number: 17915705

Country of ref document: US

ENP Entry into the national phase

Ref document number: 2022559937

Country of ref document: JP

Kind code of ref document: A

121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 22862594

Country of ref document: EP

Kind code of ref document: A1

NENP Non-entry into the national phase

Ref country code: DE

122 Ep: pct application non-entry in european phase

Ref document number: 22862594

Country of ref document: EP

Kind code of ref document: A1