WO2024149202A1 - 模型部署的方法、装置及电子设备 - Google Patents

模型部署的方法、装置及电子设备 Download PDF

Info

Publication number
WO2024149202A1
WO2024149202A1 PCT/CN2024/071178 CN2024071178W WO2024149202A1 WO 2024149202 A1 WO2024149202 A1 WO 2024149202A1 CN 2024071178 W CN2024071178 W CN 2024071178W WO 2024149202 A1 WO2024149202 A1 WO 2024149202A1
Authority
WO
WIPO (PCT)
Prior art keywords
model
random
noise
noise model
mask
Prior art date
Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
Ceased
Application number
PCT/CN2024/071178
Other languages
English (en)
French (fr)
Inventor
洪文博
苏涛
胡志远
Current Assignee (The listed assignees may be inaccurate. Google has not performed a legal analysis and makes no representation or warranty as to the accuracy of the list.)
Vivo Mobile Communication Co Ltd
Original Assignee
Vivo Mobile Communication Co Ltd
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by Vivo Mobile Communication Co Ltd filed Critical Vivo Mobile Communication Co Ltd
Publication of WO2024149202A1 publication Critical patent/WO2024149202A1/zh
Anticipated expiration legal-status Critical
Ceased legal-status Critical Current

Links

Classifications

    • G—PHYSICS
    • G06—COMPUTING OR CALCULATING; COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/10—Protecting distributed programs or content, e.g. vending or licensing of copyrighted material ; Digital rights management [DRM]
    • G06F21/12—Protecting executable software
    • G06F21/14—Protecting executable software against software analysis or reverse engineering, e.g. by obfuscation
    • G—PHYSICS
    • G06—COMPUTING OR CALCULATING; COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F8/00—Arrangements for software engineering
    • G06F8/60—Software deployment
    • Y—GENERAL TAGGING OF NEW TECHNOLOGICAL DEVELOPMENTS; GENERAL TAGGING OF CROSS-SECTIONAL TECHNOLOGIES SPANNING OVER SEVERAL SECTIONS OF THE IPC; TECHNICAL SUBJECTS COVERED BY FORMER USPC CROSS-REFERENCE ART COLLECTIONS [XRACs] AND DIGESTS
    • Y02—TECHNOLOGIES OR APPLICATIONS FOR MITIGATION OR ADAPTATION AGAINST CLIMATE CHANGE
    • Y02D—CLIMATE CHANGE MITIGATION TECHNOLOGIES IN INFORMATION AND COMMUNICATION TECHNOLOGIES [ICT], I.E. INFORMATION AND COMMUNICATION TECHNOLOGIES AIMING AT THE REDUCTION OF THEIR OWN ENERGY USE
    • Y02D10/00—Energy efficient computing, e.g. low power processors, power management or thermal management

Definitions

  • the present application belongs to the field of artificial intelligence technology, and specifically relates to a method, device and electronic device for model deployment.
  • model file is encrypted using an encryption algorithm, and the model file is in an encrypted state before it is actually used. Therefore, even if the encrypted model file is stolen, the other party cannot use it directly.
  • the purpose of the embodiments of the present application is to provide a method, device and electronic device for model deployment, which can solve the problems of high delay and overhead caused by using encryption and decryption methods for model protection in related technologies.
  • an embodiment of the present application provides a model deployment method, which is applied to a first electronic device, and the method includes:
  • the confusion layers are model layers in a preset model library, the number of layers of each of the confusion layers in the second noise model is equal to an element in a first set, and the first set includes a first number of random numbers generated based on a second random number seed;
  • the target parameters include the first random number seed and the second random number seed.
  • an embodiment of the present application provides a model deployment method, which is applied to a second electronic device, and the method includes:
  • the target parameter includes a first random number seed and a second random number seed
  • the second noise model is a model obtained by splicing multiple model layers of the first noise model with a first number of confusion layers
  • the first noise model is a model obtained by masking a model to be deployed using a random mask, and the random mask is a mask generated based on the first random number seed
  • the confusion layer is a model layer in a preset model library, and the number of layers of each of the confusion layers in the second noise model is equal to an element in a first set, and the first set includes a first number of random numbers generated based on the second random number seed
  • the random mask in the first noise model is removed based on the target parameter to obtain the model to be deployed.
  • an embodiment of the present application provides a model deployment device, which is applied to a first electronic device, and the device includes:
  • a random number seed module used to generate a random mask based on a first random number seed
  • a masking module used for performing masking processing on the model to be deployed by using the random mask to obtain a first noise model
  • a concatenation module configured to concatenate a plurality of model layers of the first noise model with a first number of confusion layers to obtain a second noise model, wherein the confusion layers are model layers in a preset model library, the number of layers of each of the confusion layers in the second noise model is equal to an element in a first set, and the first set includes a first number of random numbers generated based on a second random number seed;
  • a sending module configured to send the target parameter and the second noise model to a second electronic device, wherein the second electronic device removes the first number of confusion layers in the second noise model based on the target parameter to obtain the first noise model, and removes the random mask in the first noise model to obtain the model to be deployed;
  • the target parameters include the first random number seed and the second random number seed.
  • an embodiment of the present application provides a model deployment device, which is applied to a second electronic device, and the device includes:
  • a receiving module configured to receive a target parameter and a second noise model sent by a first electronic device, wherein the target parameter includes a first random number seed and a second random number seed;
  • the second noise model is a model obtained by concatenating multiple model layers of the first noise model with a first number of confusion layers;
  • the first noise model is a model obtained by masking a model to be deployed using a random mask, and the random mask is a mask generated based on the first random number seed;
  • the confusion layer is a model layer in a preset model library, and the number of layers of each of the confusion layers in the second noise model is equal to an element in a first set, and the first set includes a first number of random numbers generated based on the second random number seed;
  • a first denoising module configured to remove the first number of confusion layers in the second noise model based on the target parameter to obtain the first noise model
  • a second denoising module is used to remove the random mask in the first noise model based on the target parameter to obtain the model to be deployed.
  • an embodiment of the present application provides an electronic device, which includes a processor and a memory, wherein the memory stores programs or instructions that can be run on the processor, and when the program or instructions are executed by the processor, the steps of the method described in the first aspect or the second aspect are implemented.
  • an embodiment of the present application provides a readable storage medium, on which a program or instruction is stored.
  • the program or instruction is executed by a processor, the steps of the method described in the first aspect or the second aspect are implemented.
  • an embodiment of the present application provides a chip, comprising a processor and a communication interface, wherein the communication interface is coupled to the processor, and the processor is used to run a program or instruction to implement the method described in the first aspect or the second aspect.
  • an embodiment of the present application provides a computer program product, which is stored in a storage medium and is executed by at least one processor to implement the method described in the first aspect or the second aspect.
  • an embodiment of the present application provides an electronic device, which is configured to execute the method described in the first aspect or the second aspect.
  • the method of model deployment is applied to a first electronic device that serves as a model provider.
  • the first electronic device Before providing the model, the first electronic device generates a random mask using a first random number seed, and then uses the random mask to mask the model to be deployed, thereby adding noise to the model to destroy the model, thereby achieving a first layer of protection for the model.
  • multiple model layers of the first noise model are spliced with a first number of obfuscation layers, and the model structure is destroyed by redundant obfuscation layers to achieve a second layer of protection for the model.
  • the embodiment of the present application not only improves the security of the model through two layers of protection, but also solves the problems of high delay and overhead caused by model encryption and decryption.
  • FIG1 is a flowchart of one of the steps of the method for model deployment provided in an embodiment of the present application
  • FIG2 is a second flow chart of the steps of the method for model deployment provided in an embodiment of the present application.
  • FIG3 is a diagram of an actual application architecture of the method for model deployment provided in an embodiment of the present application.
  • FIG4 is one of the structural block diagrams of the device for model deployment provided in an embodiment of the present application.
  • FIG5 is a second structural block diagram of the device for model deployment provided in an embodiment of the present application.
  • FIG6 is a schematic diagram of a hardware structure of an electronic device provided in an embodiment of the present application.
  • FIG. 7 is a second schematic diagram of the hardware structure of the electronic device provided in an embodiment of the present application.
  • first, second, etc. in the specification and claims of this application are used to distinguish similar objects, and are not used to describe a specific order or sequence. It should be understood that the data used in this way can be interchangeable under appropriate circumstances, so that the embodiments of the present application can be implemented in an order other than those illustrated or described here, and the objects distinguished by "first”, “second”, etc. are generally of one type, and the number of objects is not limited.
  • the first object can be one or more.
  • “and/or” in the specification and claims represents at least one of the connected objects, and the character “/" generally indicates that the objects associated with each other are in an "or” relationship.
  • the model deployment method provided in an embodiment of the present application is applied to a first electronic device, wherein the first electronic device acts as a provider of the model and stores the model to be deployed.
  • the model deployment method may include:
  • Step 101 Generate a random mask based on a first random number seed.
  • the first random number seed is a pre-set random number seed, and multiple random numbers can be generated by using the random number seed according to a preset pseudo-random generation function.
  • the random mask is a mask composed of the multiple random numbers, which can be a tensor or a bit stream. It can be understood that when the random number seed and the pseudo-random generation function are fixed, the generated random numbers and the masks composed of random numbers will also be fixed. Therefore, the random numbers generated above can also be called pseudo-random numbers, and the generated masks are called random masks.
  • Step 102 Use a random mask to perform mask processing on the model to be deployed to obtain a first noise model.
  • masking is a common operation in deep learning. In simple terms, it is equivalent to covering the original data with a mask to shield or select some specific elements, but it is not limited to this. It can also add noise to the original data, that is, masking is masking and noise addition.
  • the masking process can be performed on the entire model.
  • the model itself is first converted into a binary bit stream, and then the binary bit stream is masked.
  • masking can also be performed on part of the data of the model.
  • the model weights are parsed from the model, and then the model weights are masked. It can be understood that in the case of masking the model weights, the original model weights are masked and denoised using a random mask to generate new model weights. This process is a reversible process, that is, the new model weights and random masks can be used to perform demasking or mask denoising to obtain the original model weights.
  • the original model weights are the model weights of the model to be deployed.
  • the new model weights are the model weights of the first noise model.
  • the random mask can be a noise parameter
  • the original model weights are masked and denoised using a random mask to generate new model parameters, that is, a fixed algorithm is used to perform forward calculations on the original model parameters and noise parameters to obtain forward calculation results, and the forward calculation results are the new model parameters.
  • the new model weights and random masks can be used for demasking or mask denoising to generate the original model weights, that is, a fixed algorithm is used to reversely calculate the calculation results and noise parameters to obtain reverse calculation results, which are the original model parameters.
  • the model weights of the model to be deployed will contain the noise generated by the random mask, and other model parameters will not change.
  • the model to be deployed after masking is called the first noise model.
  • the first noise model differs from the model to be deployed only in the model weights.
  • the model weights of the first noise model are the result of masking the model weights of the model to be deployed.
  • a random mask can be used to mask all or part of the model weights of the model to be deployed to obtain the first noise model.
  • Step 103 concatenate multiple model layers of the first noise model with the first number of confusion layers to obtain a second noise model.
  • the confusion layer in the second noise model is used to destroy the model structure of the first noise model or the model to be deployed, causing confusion to the stealing party. Therefore, the confusion layer does not belong to the first noise model or the model to be deployed.
  • the confusion layer is a model layer in a preset model library, and the preset model library is a pre-set database storing multiple models or model layers.
  • the model layer in the preset model library may include the model layer of the model to be deployed and/or a plurality of pre-generated reasonable model layers, and the reasonable model layer is a model layer that can be spliced with the model layer of the first noise model.
  • the model weight of the confusion layer can be a randomly generated weight, but is not limited to this.
  • the model to be deployed includes multiple model layers.
  • the confusion layers can be spliced into the model to be deployed in any manner so that the confusion layers serve as the model layers of the spliced model.
  • a confusion layer can be spliced behind each model layer of the model to be deployed, but is not limited thereto.
  • the positions of each confusion layer in the spliced model can also be predetermined, and then each confusion layer is spliced into the model to be deployed based on the determined positions.
  • the number of layers of each confusion layer in the second noise model is equal to an element in the first set, and the first set includes a first number of random numbers generated based on a second random number seed.
  • the first number of confusion layers can be one or at least two.
  • the first number is described as two.
  • the two random numbers generated based on the second random number seed are 3 and 6, respectively, the first set includes element 3 and element 6.
  • the third model layer and the sixth model layer in the second noise model are both confusion layers.
  • a first number of model layers are randomly selected from the preset model library as confusion layers. Then, according to the number of layers indicated by the first number of random numbers, the confusion layers are spliced into the first noise model to generate the second noise model. It can be understood that the value range of the random numbers generated by the second random number seed is [1, m], where m is equal to the sum of the number of layers of the model to be deployed and the first number.
  • Step 104 Send the target parameters and the second noise model to the second electronic device, wherein the second electronic device removes a first number of confusion layers in the second noise model based on the target parameters to obtain the first noise model, and removes the random mask in the first noise model to obtain the model to be deployed.
  • the target parameters include a first random number seed and a second random number seed. Since the random mask and random number generated by the random number seed are fixed data content, the second electronic device as the model user can generate the random mask in step 101 based on the first random number seed; and can determine the position of the confusion layer in the second noise model based on the second random number seed. Then, the second electronic device can remove the first number of confusion layers in the second noise model to obtain the first noise model, and perform a demasking or de-noising operation on the model weights of the first noise model based on the generated random mask to obtain the model to be deployed.
  • the method of model deployment is applied to a first electronic device that serves as a model provider.
  • the first electronic device Before providing the model, the first electronic device generates a random mask using a first random number seed, and then uses the random mask to mask the model to be deployed, thereby adding noise to the model to destroy the model, thereby achieving a first layer of protection for the model.
  • multiple model layers of the first noise model are spliced with a first number of obfuscation layers, and the model structure is destroyed by redundant obfuscation layers to achieve a second layer of protection for the model.
  • the embodiment of the present application not only improves the security of the model through two layers of protection, but also solves the problems of high delay and overhead caused by model encryption and decryption.
  • a random mask is used to perform mask processing on the model to be deployed to obtain a first noise model, including:
  • All model weights of the to-be-deployed model are masked using a random mask to obtain a first noise model.
  • each layer of the neural network model usually includes multiple neurons. And each neuron has a model weight, so the neural network model usually has more model weights, the number may be dozens or hundreds, but not limited to this.
  • the model weights after masking can be regarded as model weights containing noise.
  • the noise in the noisy model weights needs to be removed.
  • the more the number of model parameters in this part the more complex the operation will be and the more difficult it will be to crack the model.
  • the security of the model will be higher. Therefore, in order to improve the security of the model as much as possible, all the model weights of the model to be deployed will be masked.
  • the difficulty of cracking the model can be increased, thereby improving the security of the model.
  • the target parameter further includes: a filtering mask constructed by the first character and the second character, wherein each character of the filtering mask corresponds to a model weight of the model to be deployed.
  • the model to be deployed is masked by using a random mask to obtain a first noise model, including:
  • the target model weight is the model weight corresponding to the first character in the model to be deployed.
  • the first character is used to indicate that masking is required, that is, the model weight corresponding to the first character needs to be masked.
  • the second character is used to indicate that masking is not required, that is, the model weight corresponding to the second character does not need to be masked.
  • the screening mask is a mask composed of multiple 0s and 1s, the total number of 0s and 1s is equal to the total number of model weights, and each 0 or 1 corresponds to a model weight of the model to be deployed.
  • the first character may be 1, and the second character may be 0, and the screening mask 01 is used to indicate that the model weight corresponding to 1 needs to be masked, while the model weight corresponding to 0 does not need to be masked.
  • the screening mask is a mask that the user pre-stores in the first electronic device based on preference or experience.
  • the user can freely select the model weights that need to be masked, thereby increasing the uncertainty of the model parameters containing noise.
  • the L1 norm L1-Norm
  • the screening mask is constructed based on the important model parameters. Specifically, the character corresponding to the important model parameter in the screening mask is set to the first character, and the remaining bits are set to the second character.
  • some model parameters in the model to be deployed are selected for masking, which increases the uncertainty of the model parameters containing noise, thereby increasing the difficulty of cracking the model and improving the security of the model.
  • the target parameter further includes: a third random number seed, and a random mask is used to perform masking processing on the model to be deployed to obtain a first noise model, including:
  • the model weights of the second number of target model layers are masked using a random mask to obtain a first noise model.
  • the number of layers of each target model layer in the model to be deployed is equal to an element in the second set, and the second set includes a second number of random numbers generated based on a third random number seed.
  • the model layer is used as the dimension, and the model parameters of a part of the model layers are selected for masking, and the model parameters of another part of the model layers are not masked.
  • the model layer indicated by the second number of random numbers is determined as the target model layer, and then the model weights of the target model layer are masked using a random mask to obtain a first noise model.
  • the value range of the random numbers generated by the third random number seed is [1, n], where n is equal to the number of layers of the model to be deployed.
  • the second number is less than the number of layers of the model to be deployed.
  • the second number is also greater than or equal to half the number of layers of the model to be deployed.
  • some model parameters in the model to be deployed are selected for masking, which increases the uncertainty of the model parameters containing noise, thereby increasing the difficulty of cracking the model and improving the security of the model.
  • the target parameters also include: a digital signature of the second noise model.
  • a digital signature is a string of numbers that can only be generated by the sender of the information and cannot be forged by others. This string of numbers is also an effective proof of the authenticity of the information sent by the sender of the information.
  • the second electronic device can verify the digital signature to determine whether the second noise model received by itself has been tampered with. Regarding digital signatures and verification, we will not go into details here.
  • the second electronic device by adding the digital signature of the second noise model to the target parameter, the second electronic device can determine whether the second noise model has been tampered with during the transmission process.
  • sending the target parameter and the second noise model to a second electronic device includes:
  • the target request is a request for a target key sent locally by the second electronic device in a trusted execution environment, and the target key includes the target parameter.
  • the target parameter can be understood as the key of the model to be deployed
  • the second noise model can be understood as the model after adding noise to the model to be deployed using the key. Therefore, the key and the second noise model can be sent to the second electronic device together, so that the second electronic device can restore the model to be deployed based on the received data.
  • the two can also be sent in batches, and the second noise model is sent first.
  • the target parameter is sent based on the target request returned by the second electronic device.
  • the target parameter can be encrypted first and transmitted in ciphertext.
  • the target parameter is sent using a key exchange protocol, but is not limited to this.
  • the target parameters and the second noise model are sent in batches. After the second noise model is sent, the target parameters are sent to the second electronic device based on the target request of the second electronic device, so that the model deployment method is more flexible.
  • the model deployment method provided in an embodiment of the present application is applied to a second electronic device, wherein the second electronic device serves as a recipient of the model and is used to use the model to be deployed for model training or online use.
  • the model deployment method may include:
  • Step 201 receiving target parameters and a second noise model sent by a first electronic device.
  • the target parameters include a first random number seed and a second random number seed
  • the second noise model is a model obtained by splicing multiple model layers of the first noise model and a first number of confusion layers
  • the first noise model is a model obtained by masking the model to be deployed using a random mask, and the random mask is a mask generated based on the first random number seed
  • the confusion layer is a model layer in a preset model library, and the number of layers of each confusion layer in the second noise model is equal to an element in the first set, and the first set includes a first number of random numbers generated based on the second random number seed.
  • the process of the first electronic device generating and sending the target parameters and the second noise model, the target parameters, the first random number seed, the second random number seed, the confusion layer, the first noise model, and the random mask can be referred to the embodiment shown in Figure 1, and will not be repeated here.
  • Step 202 removing a first number of confusion layers in the second noise model based on the target parameter to obtain a first noise model.
  • the first number of confusion layers is a redundant structure in the second noise model.
  • the model layer of the first noise model is spliced with the first number of confusion layers to obtain the second noise model. Therefore, on the second electronic device side, the second noise model is restored to the first noise model in an inverse processing manner.
  • the random numbers generated based on the second random number seed are the same, that is, the first number of random numbers can be generated.
  • the two random numbers generated based on the second random number seed are 3 and 6 respectively.
  • two random numbers 3 and 6 will also be generated based on the second random number seed.
  • the first number of random numbers generated based on the second random number seed are then removed according to the first number of random numbers, and the first noise model is obtained.
  • the two random numbers generated based on the second random number seed are 3 and 6 respectively
  • the third model layer and the sixth model layer in the second noise model are both confusion layers.
  • two random numbers 3 and 6 are generated again based on the second random number seed.
  • the first noise model can be obtained by removing the third model layer and the sixth model layer of the second noise model.
  • Step 203 remove the random mask in the first noise model based on the target parameters to obtain the model to be deployed.
  • the model weights of the model to be deployed are masked using a random mask to obtain the first noise model. Therefore, on the second electronic device side, the first noise model is restored to the model to be deployed in an inverse processing manner.
  • the random mask generated based on the first random number seed is the same.
  • the model weights in the first noise model are demasked or masked by using a random mask to obtain the model to be deployed. Since the random masks are the same, the noise in the model weights in the first noise model can be removed by the reverse demasking process, thereby restoring the first noise model to the model to be deployed.
  • a first random number seed is used to generate a random mask, and then the random mask is used to mask the model to be deployed.
  • the random mask is used to mask the model to be deployed.
  • the first layer of protection for the model is achieved.
  • multiple model layers of the first noise model are spliced with the first number of confusion layers, and the model structure is destroyed by redundant confusion layers to achieve the second layer of protection for the model.
  • the second noise model is reversely processed using the target parameters to restore it to the model to be deployed for use.
  • the embodiment of the present application not only improves the security of the model through two layers of protection, but also solves the problems of high delay and overhead caused by model encryption and decryption.
  • the target parameter further includes: a filtering mask constructed by the first character and the second character, wherein each character of the filtering mask corresponds to a model weight of the model to be deployed.
  • the random mask in the first noise model is removed based on the target parameter to obtain a model to be deployed, including:
  • the first noise model weight in the first noise model is the same as the position of the target model weight in the model to be deployed, and the target model weight is the model weight of the corresponding first character in the model to be deployed.
  • a random mask is generated.
  • the first noise model weights in the first noise model are demasked based on the random mask to obtain a model to be deployed.
  • the process of masking the model to be deployed based on the random mask and the screening mask on the first electronic device side will not be repeated here.
  • the model weight containing noise that is, the first noise model weight
  • the first noise model weight is demasked and the first noise model is restored to the model to be deployed.
  • some model parameters in the model to be deployed can be selected for masking processing, and noise can be added to some model weights using a filtering mask.
  • the filtering mask can be used to determine the model weights containing noise, which can achieve model destruction and restoration and improve the security of the model.
  • the target parameters also include: a third random number seed.
  • the random mask in the first noise model is removed based on the target parameter to obtain a model to be deployed, including:
  • a second number of random numbers is generated.
  • a second number of noise model layers in the first noise model is determined; wherein the number of layers of each noise model layer in the first noise model is equal to a random number in the second number of random numbers.
  • a random mask is generated.
  • the second noise model weights are demasked based on the random mask to obtain a model to be deployed; wherein the second noise model weights are model weights of the second number of noise model layers.
  • the process of processing the model to be deployed based on the random mask and the obfuscation layer on the first electronic device side will not be repeated here.
  • a second number of random numbers will be generated based on the third random number seed, and then the model layer indicated by the second number of random numbers will be determined as a model layer containing noise or masked, that is, a noise model layer.
  • the model weights of the noise model layer are demasked, and the first noise model is restored to the model to be deployed.
  • the random numbers generated based on the third random number seed are the same, that is, the second number of random numbers can be generated.
  • the two random numbers generated based on the third random number seed are 3 and 6.
  • two random numbers 3 and 6 will also be generated based on the third random number seed.
  • some model parameters in the model to be deployed can be selected for masking processing, and noise can be added to some model weights using a third random number seed.
  • the third random number seed can be used to determine the model weights containing noise, which can achieve model destruction and restoration and improve the security of the model.
  • the target parameters further include: a digital signature of the second noise model
  • Removing a first number of confusion layers in the second noise model based on the target parameter to obtain a first noise model includes:
  • a first number of confusion layers in the second noise model are removed based on the target parameter to obtain a first noise model.
  • a digital signature is a string of numbers that can only be generated by the sender of the information and cannot be forged by others. This string of numbers is also an effective proof of the authenticity of the information sent by the sender of the information.
  • the second electronic device can verify the digital signature to determine whether the second noise model received by itself has been tampered with. Regarding digital signatures and verification, we will not go into details here.
  • the second electronic device by adding the digital signature of the second noise model to the target parameter, the second electronic device can determine whether the second noise model has been tampered with during the transmission process.
  • receiving the target parameter and the second noise model sent by the first electronic device includes:
  • the threats in the network include: semi-honest threats and malicious threats.
  • the attacker cannot break into the device, and can only attack within the predetermined rules and limited permissions to achieve his own goals.
  • the attacker Under the malicious threat, the attacker can completely control the attacked device, and does not comply with the predetermined protocol, and controls the entire operation process. Therefore, the present application can set up two different scenarios based on the two threats to deal with them.
  • the semi-honest threat scenario since the attacker is a semi-honest party, he will not break into the system of the second electronic device to intervene.
  • a simple encrypted communication method can be used to load the target parameters into the private space of the second electronic device when the application or service is loaded for the first time.
  • the second electronic device has been broken into by a malicious attacker, and the attacker will gain control of the device and master the runtime. Information.
  • an enhanced solution is needed to distribute, manage and use the target parameters.
  • a key exchange protocol is used in a trusted execution environment to interact with the first electronic device to obtain the target parameters, that is, the target parameters are only visible in the trusted execution environment.
  • Trusted Execution Environment a completely trusted operating environment that cannot be hacked and monitored at runtime, including existing TEE (Trusted Execution Environment) technology and a runtime environment built on technologies such as confidential computing.
  • an embodiment of the present application also provides a model deployment method, which is applied to a network system consisting of a first device and a second device, wherein the first device is equivalent to the first electronic device in the embodiment shown in Figure 1, and the second device is equivalent to the second electronic device in the embodiment shown in Figure 2, which will not be repeated here.
  • the method may include:
  • Step 301 Generate a mask, a redundant structure, and a corresponding key in the first device.
  • a predetermined random number seed key1 is used to generate a random mask Mask1.
  • a predetermined random number seed key2 is used to generate k random numbers within a target range, where the target range is [1, k+n], where n is the number of layers of the model to be deployed. Randomly select k model layers in the preset model library as a redundant structure.
  • k is less than or equal to n, and k is greater than or equal to the target value, and the target value is the maximum value of n/4 and 1.
  • the key of the random mask Mask1 is the random number seed key1; the key of the redundant structure is the random number seed key2.
  • Step 302 The first device combines the protection model and sends it for deployment. Specifically, the model weights in the model to be deployed are masked using a random mask Mask1, and then the redundant structure is spliced to obtain a k+n layer protection model, which is equivalent to the second noise model in the above-mentioned application embodiment. The protection model and the digital signature of the protection model are then sent to the second device as a package file.
  • Step 303 The first device issues a key. Specifically, upon receiving a target request sent by the second device, the first device sends the random number seed key1 and the random number seed key2 as keys to the second device.
  • Step 304 After receiving the packaged file, the second device performs file deployment on the protection model.
  • Step 305 Request the first device to issue a key, and store the key in a trusted execution space.
  • the trusted execution space is a storage space in the second device that has a trusted execution environment.
  • Step 306 If the model needs to be used, the digital signature in the package file is used to verify the integrity of the protection model. If the signature verification fails, the first device is requested to re-send the package file. If the signature verification passes, step 307 is executed.
  • Step 307 Based on the key in the trusted execution space, remove the redundant structure in the protection model and perform demasking to obtain the model to be deployed. Then use the model to be deployed for model training or data inference. It is worth noting that in a malicious threat scenario, this step will be performed in the trusted execution environment of the second device.
  • the random mask Mask1 when using the random mask Mask1 to mask the model weights in the model to be deployed, it can cover the entire model or only part of the model, that is, all the model weights of the model to be deployed can be masked, or part of the model weights of the model to be deployed can be masked.
  • the following methods can be specifically adopted according to the needs of security and performance.
  • Method 1 Add a layer of mask noise to the entire model, that is, mask all the model weights of the deployed model.
  • Method 2 Determine the important model weights through the L1 paradigm, then construct a screening mask Mask2 composed of 0 and 1 for this part of the weights (which can be greater than 20% of the total weights), and finally use a random mask Mask1 to mask and add noise to the model weights corresponding to 1.
  • Method 3 Use the random number seed key3 to generate n1 random numbers in another range, where the range is [1, n], and n is equal to the number of layers of the model to be deployed. n1 is less than or equal to n, and n1 is greater than or equal to n/2.
  • the model weights in the model layers indicated by the n1 random numbers are masked and denoised using the random mask Mask1.
  • the key received by the second device usually includes: random number seed key1 and random number seed key2. If it also includes random number seed key3, it means that the first device uses method 3 for mask denoising. When performing mask denoising, first determine the model layer that needs to be denoised based on the random number seed key3, and then use the random mask Mask1 to perform mask denoising on this part of the model layer that needs to be denoised. If it also includes the screening mask Mask2, it means that the first device uses method 2 for mask denoising. When performing mask denoising, first determine the model weight that needs to be denoised based on the screening mask Mask2, and then use the random mask Mask1 to perform mask denoising on this part of the model weight that needs to be denoised.
  • random masking technology is used to destroy the integrity and availability of the model with lower overhead and delay; while protecting the model weights, a redundant model structure is used to perform model structure obfuscation protection, and it can confuse attackers to make them mistakenly judge that the obtained model is a usable real model.
  • the execution subject of the method for model deployment provided in the embodiment of the present application may be a device for model deployment, or a control module in the device for model deployment for executing the method for model deployment.
  • the method for model deployment executed by the device for model deployment is taken as an example to illustrate the device for model deployment provided in the embodiment of the present application.
  • an embodiment of the present application further provides a model deployment device, which is applied to a first electronic device, and includes:
  • the random number seed module 41 is used to generate a random mask based on a first random number seed.
  • the masking module 42 is used to perform masking processing on the model to be deployed by using a random mask to obtain a first noise model.
  • the splicing module 43 is used to splice multiple model layers of the first noise model with a first number of confusion layers to obtain a second noise model, wherein the confusion layers are model layers in a preset model library, the number of layers of each confusion layer in the second noise model is equal to an element in the first set, and the first set includes a first number of random numbers generated based on a second random number seed.
  • the sending module 44 is used to send the target parameters and the second noise model to the second electronic device, wherein the second electronic device removes a first number of confusion layers in the second noise model based on the target parameters to obtain the first noise model, and removes the random mask in the first noise model to obtain the model to be deployed.
  • the target parameters include a first random number seed and a second random number seed.
  • the mask module 42 is specifically configured to perform masking processing on all model weights of the to-be-deployed model using a random mask to obtain a first noise model.
  • the target parameter further includes: a filtering mask constructed by the first character and the second character, wherein each character of the filtering mask corresponds to a model weight of the model to be deployed.
  • the mask module 42 is specifically used to use a random mask to mask the target model weights of the to-be-deployed model to obtain a first noise model.
  • the target model weight is the model weight corresponding to the first character in the model to be deployed.
  • the target parameters also include: a third random number seed, a mask module 42, which is specifically used to use a random mask to mask the model weights of the second number of target model layers to obtain a first noise model.
  • a mask module 42 which is specifically used to use a random mask to mask the model weights of the second number of target model layers to obtain a first noise model.
  • the number of layers of each target model layer in the model to be deployed is equal to an element in the second set, and the second set includes a second number of random numbers generated based on a third random number seed.
  • the target parameters also include: a digital signature of the second noise model.
  • the sending module 44 includes:
  • the first sending unit is used to send the second noise model to the second electronic device.
  • the second sending unit is configured to send the target parameter to the second electronic device upon receiving the target request sent by the second electronic device.
  • the target request is a request for a target key sent locally by the second electronic device in a trusted execution environment, and the target key includes the target parameter.
  • the first electronic device before providing a model, the first electronic device generates a random mask using a first random number seed, and then uses the random mask to mask the model weights of the model to be deployed, and adds noise to the model weights to destroy the model weights, thereby achieving the first layer of protection for the model. Then, the model layer of the first noise model is spliced with the first number of obfuscation layers, and the redundant obfuscation layers are used to destroy the model structure to achieve the second layer of protection for the model.
  • the embodiment of the present application not only improves the security of the model through two layers of protection, but also solves the problems of high delay and overhead caused by model encryption and decryption.
  • the device for model deployment in the embodiment of the present application can be an electronic device or a component in the electronic device, such as an integrated circuit or a chip.
  • the electronic device can be a terminal or other devices other than a terminal.
  • the electronic device can be a mobile phone, a tablet computer, a laptop computer, a PDA, a vehicle-mounted electronic device, a mobile Internet device (Mobile Internet Device, MID), an augmented reality (augmented reality, AR)/virtual reality (virtual reality, VR) device, a robot, a wearable device, an ultra-mobile personal computer (ultra-mobile personal computer, UMPC), a netbook or a personal digital assistant (personal digital assistant, PDA), etc.
  • NAS Network Attached Storage
  • PC personal computer
  • TV television
  • teller machine a self-service machine
  • the device for model deployment in the embodiment of the present application may be a device having an operating system.
  • the operating system may be an Android operating system, an iOS operating system, or other possible operating systems, which are not specifically limited in the embodiment of the present application.
  • the model deployment device provided in the embodiment of the present application can implement each process implemented in the method embodiment of Figure 1 and achieve the same technical effect. To avoid repetition, it will not be repeated here.
  • an embodiment of the present application further provides a model deployment device, which is applied to a second electronic device, and includes:
  • the receiving module 51 is used to receive the target parameters and the second noise model sent by the first electronic device, wherein the target parameters include the first random number seed and the second random number seed; the second noise model is a model obtained by splicing multiple model layers of the first noise model with a first number of confusion layers; the first noise model is a model obtained by masking the model to be deployed using a random mask, and the random mask is a mask generated based on the first random number seed; the confusion layer is a model layer in a preset model library, and the number of layers of each confusion layer in the second noise model is equal to an element in the first set, and the first set includes a first number of random numbers generated based on the second random number seed.
  • the target parameters include the first random number seed and the second random number seed
  • the second noise model is a model obtained by splicing multiple model layers of the first noise model with a first number of confusion layers
  • the first noise model is a model obtained by masking the model to be deployed using a random mask, and the random mask is
  • the first denoising module 52 is configured to remove a first number of confusion layers in the second noise model based on the target parameter to obtain a first noise model.
  • the second denoising module 53 is used to remove the random mask in the first noise model based on the target parameter to obtain the model to be deployed.
  • the target parameter further includes: a filtering mask constructed by the first character and the second character, wherein each character of the filtering mask corresponds to a model weight of the model to be deployed.
  • the second denoising module 53 comprises:
  • a screening unit is used to determine a first noise model weight in a first noise model based on a screening mask, wherein a position of the first noise model weight in the first noise model is the same as a position of a target model weight in a model to be deployed, and the target model weight is a model weight corresponding to a first character in the model to be deployed.
  • the first random number seed unit is used to generate a random mask based on a first random number seed.
  • the first denoising unit is used to perform a de-masking process on the first noise model weights in the first noise model based on a random mask to obtain a model to be deployed.
  • the target parameters also include: a third random number seed.
  • the second denoising module 53 comprises:
  • the second random number seed unit is used to generate a second number of random numbers based on a third random number seed.
  • the determination unit is used to determine a second number of noise model layers in the first noise model based on the second number of random numbers; wherein the number of layers of each noise model layer in the first noise model is equal to a random number in the second number of random numbers.
  • the third random number seed unit is used to generate a random mask based on the first random number seed.
  • the second denoising unit is used to perform a demasking process on the second noise model weight based on a random mask to obtain a model to be deployed; wherein the second noise model weight is a model weight of a second number of noise model layers.
  • the target parameters also include: a digital signature of the second noise model.
  • the first denoising module 52 is specifically configured to remove a first number of confusion layers in the second noise model based on a target parameter to obtain a first noise model when the digital signature passes the verification.
  • the receiving module 51 is specifically configured to:
  • a first random number seed is used to generate a random mask, and then the random mask is used to mask the model to be deployed.
  • the random mask is used to mask the model to be deployed.
  • the first layer of protection for the model is achieved.
  • multiple model layers of the first noise model are spliced with the first number of confusion layers, and the model structure is destroyed by redundant confusion layers to achieve the second layer of protection for the model.
  • the second noise model is reversely processed using the target parameters to restore it to the model to be deployed for use.
  • the embodiment of the present application not only improves the security of the model through two layers of protection, but also solves the problems of high delay and overhead caused by model encryption and decryption.
  • the device for model deployment in the embodiment of the present application can be an electronic device or a component in the electronic device, such as an integrated circuit or a chip.
  • the electronic device can be a terminal or other devices other than a terminal.
  • the electronic device can be a mobile phone, a tablet computer, a laptop computer, a PDA, a vehicle-mounted electronic device, a mobile Internet device (Mobile Internet Device, MID), an augmented reality (augmented reality, AR)/virtual reality (virtual reality, VR) device, a robot, a wearable device, an ultra-mobile personal computer (ultra-mobile personal computer, UMPC), a netbook or a personal digital assistant (personal digital assistant, PDA), etc.
  • NAS Network Attached Storage
  • PC personal computer
  • TV television
  • teller machine a self-service machine
  • the device for model deployment in the embodiment of the present application may be a device having an operating system.
  • the operating system may be an Android operating system, an iOS operating system, or other possible operating systems, which are not specifically limited in the embodiment of the present application.
  • the model deployment device provided in the embodiment of the present application can implement each process implemented in the method embodiment of Figure 2 and achieve the same technical effect. To avoid repetition, it will not be repeated here.
  • an embodiment of the present application also provides an electronic device 600, including a processor 601 and a memory 602, and the memory 602 stores a program or instruction that can be executed on the processor 601.
  • the program or instruction is executed by the processor 601
  • the various steps of the above-mentioned model deployment method embodiment are implemented, and the same technical effect can be achieved. To avoid repetition, it will not be repeated here.
  • the electronic devices in the embodiments of the present application include the mobile electronic devices and non-mobile electronic devices mentioned above.
  • FIG. 7 is a schematic diagram of the hardware structure of an electronic device implementing an embodiment of the present application.
  • the electronic device 700 includes but is not limited to: a radio frequency unit 701, a network module 702, an audio output unit 703, an input unit 704, a sensor 705, a display unit 706, a user input unit 707, an interface unit 708, a memory 709, and a processor 710.
  • the electronic device 700 may also include a power source (such as a battery) for supplying power to each component, and the power source may be logically connected to the processor 710 through a power management system, so that the power management system can manage charging, discharging, and power consumption.
  • a power source such as a battery
  • the electronic device structure shown in FIG7 does not constitute a limitation on the electronic device, and the electronic device may include more or fewer components than shown, or combine certain components, or arrange components differently, which will not be described in detail here.
  • the processor 710 is configured to generate a random mask based on a first random number seed.
  • the processor 710 is further configured to perform mask processing on the model to be deployed using a random mask to obtain a first noise model.
  • Processor 710 is also used to splice multiple model layers of the first noise model with a first number of confusion layers to obtain a second noise model, wherein the confusion layers are model layers in a preset model library, and the number of layers of each confusion layer in the second noise model is equal to an element in the first set, and the first set includes a first number of random numbers generated based on a second random number seed.
  • the network module 702 is used to send the target parameters and the second noise model to the second electronic device, wherein the second electronic device removes a first number of confusion layers in the second noise model based on the target parameters to obtain the first noise model, and removes the random mask in the first noise model to obtain the model to be deployed.
  • the target parameters include a first random number seed and a second random number seed.
  • the first electronic device before providing a model, the first electronic device generates a random mask using a first random number seed, and then uses the random mask to mask the model to be deployed, and adds noise to the model to destroy the model, thereby achieving the first layer of protection for the model. Then, multiple model layers of the first noise model are spliced with the first number of obfuscation layers, and the model structure is destroyed by redundant obfuscation layers to achieve the second layer of protection for the model.
  • the embodiment of the present application not only improves the security of the model through two layers of protection, but also solves the problems of high delay and overhead caused by model encryption and decryption.
  • the network module 702 is used to receive target parameters and a second noise model sent by the first electronic device, wherein the target parameters include a first random number seed and a second random number seed;
  • the second noise model is a model obtained by concatenating multiple model layers of the first noise model and a first number of confusion layers;
  • the first noise model is a model obtained by masking a model to be deployed using a random mask, and the random mask is a mask generated based on a first random number seed;
  • the confusion layer is a model layer in a preset model library, and the number of layers of each confusion layer in the second noise model is equal to an element in the first set, and the first set includes a first number of random numbers generated based on the second random number seed.
  • the processor 710 is configured to remove a first number of confusion layers in the second noise model based on the target parameter to obtain a first noise model.
  • the processor 710 is further configured to remove the random mask in the first noise model based on the target parameter to obtain the model to be deployed.
  • a first random number seed is used to generate a random mask, and then the random mask is used to mask the model to be deployed.
  • the random mask is used to mask the model to be deployed.
  • the first layer of protection for the model is achieved.
  • multiple model layers of the first noise model are spliced with the first number of confusion layers, and the model structure is destroyed by redundant confusion layers to achieve the second layer of protection for the model.
  • the second noise model is reversely processed using the target parameters to restore it to the model to be deployed for use.
  • the embodiment of the present application not only improves the security of the model through two layers of protection, but also solves the problems of high delay and overhead caused by model encryption and decryption.
  • the input unit 704 may include a graphics processing unit (GPU) 7041 and a microphone 7042.
  • the graphics processor 7041 processes the image data of a static picture or video obtained by an image capture device (such as a camera) in a video capture mode or an image capture mode.
  • the display unit 706 may The display panel 7061 may be configured in the form of a liquid crystal display, an organic light emitting diode, etc.
  • the user input unit 707 includes a touch panel 7071 and at least one of other input devices 7072.
  • the touch panel 7071 is also called a touch screen.
  • the touch panel 7071 may include two parts: a touch detection device and a touch controller.
  • Other input devices 7072 may include, but are not limited to, a physical keyboard, function keys (such as a volume control button, a switch button, etc.), a trackball, a mouse, and a joystick, which will not be repeated here.
  • the memory 709 can be used to store software programs and various data.
  • the memory 709 may mainly include a first storage area for storing programs or instructions and a second storage area for storing data, wherein the first storage area may store an operating system, an application program or instructions required for at least one function (such as a sound playback function, an image playback function, etc.), etc.
  • the memory 709 may include a volatile memory or a non-volatile memory, or the memory x09 may include both volatile and non-volatile memories.
  • the non-volatile memory may be a read-only memory (ROM), a programmable read-only memory (PROM), an erasable programmable read-only memory (EPROM), an electrically erasable programmable read-only memory (EEPROM), or a flash memory.
  • the volatile memory may be a random access memory (RAM), a static random access memory (SRAM), a dynamic random access memory (DRAM), a synchronous dynamic random access memory (SDRAM), a double data rate synchronous dynamic random access memory (DDRSDRAM), an enhanced synchronous dynamic random access memory (ESDRAM), a synchronous link dynamic random access memory (SLDRAM) and a direct memory bus random access memory (DRRAM).
  • the memory 709 in the embodiment of the present application includes but is not limited to these and any other suitable types of memory.
  • the processor 710 may include one or more processing units; optionally, the processor 710 integrates an application processor and a modem processor, wherein the application processor mainly processes operations related to an operating system, a user interface, and application programs, and the modem processor mainly processes wireless communication signals, such as a baseband processor. It is understandable that the modem processor may not be integrated into the processor 710.
  • An embodiment of the present application also provides a readable storage medium, on which a program or instruction is stored.
  • a program or instruction is stored.
  • the program or instruction is executed by a processor, each process of the above-mentioned model deployment method embodiment is implemented, and the same technical effect can be achieved. To avoid repetition, it will not be repeated here.
  • the processor is a processor in the electronic device described in the above embodiment.
  • the readable storage medium includes a computer readable storage medium, such as a computer read-only memory (ROM), a random access memory (RAM), a magnetic disk or an optical disk, etc.
  • An embodiment of the present application further provides a chip, which includes a processor and a communication interface, wherein the communication interface is coupled to the processor, and the processor is used to run programs or instructions to implement the various processes of the above-mentioned model deployment method embodiment, and can achieve the same technical effect. To avoid repetition, it will not be repeated here.
  • the chip mentioned in the embodiments of the present application can also be called a system-level chip, a system chip, a chip system or a system-on-chip chip, etc.
  • An embodiment of the present application provides a computer program product, which is stored in a storage medium.
  • the program product is executed by at least one processor to implement the various processes of the method embodiment of the above-mentioned model deployment, and can achieve the same technical effect. To avoid repetition, it will not be repeated here.
  • the technical solution of the present application can be embodied in the form of a computer software product, which is stored in a storage medium (such as ROM/RAM, a magnetic disk, or an optical disk), and includes a number of instructions for a terminal (which can be a mobile phone, a computer, a server, or a network device, etc.) to execute the methods described in each embodiment of the present application.
  • a storage medium such as ROM/RAM, a magnetic disk, or an optical disk
  • a terminal which can be a mobile phone, a computer, a server, or a network device, etc.

Landscapes

  • Engineering & Computer Science (AREA)
  • Software Systems (AREA)
  • Theoretical Computer Science (AREA)
  • General Engineering & Computer Science (AREA)
  • Physics & Mathematics (AREA)
  • General Physics & Mathematics (AREA)
  • Multimedia (AREA)
  • Technology Law (AREA)
  • Computer Hardware Design (AREA)
  • Computer Security & Cryptography (AREA)
  • Measurement Of Mechanical Vibrations Or Ultrasonic Waves (AREA)
  • Image Processing (AREA)
  • Soundproofing, Sound Blocking, And Sound Damping (AREA)
  • Storage Device Security (AREA)

Abstract

一种模型部署的方法、装置及电子设备，属于人工智能技术领域。方法应用于第一电子设备，包括：基于第一随机数种子，生成随机掩码（101）；采用随机掩码对待部署模型进行掩码处理，得到第一噪声模型（102）；将第一噪声模型的多个模型层与第一数量的混淆层进行拼接，得到第二噪声模型（103），每一混淆层在第二噪声模型中的层数与第一集合中的一个元素相等，第一集合包括基于第二随机数种子生成的第一数量的随机数；将目标参数和第二噪声模型发送至第二电子设备（104），其中，第二电子设备基于目标参数去除第二噪声模型中的第一数量的混淆层，从而得到第一噪声模型（202），并去除第一噪声模型中的随机掩码，得到待部署模型（203）。

Description

模型部署的方法、装置及电子设备
相关申请的交叉引用
本申请要求在2023年1月13日提交中国专利局、申请号为202310077523.5、名称为“模型部署的方法、装置及电子设备”的中国专利申请的优先权，其全部内容通过引用结合在本申请中。
技术领域
本申请属于人工智能技术领域，具体涉及一种模型部署的方法、装置及电子设备。
背景技术
随着人工智能技术以及模型压缩等技术的快速发展和普及，越来越多的人工智能算法模型集成在了应用中，以进行端侧的算法推断或者训练，这就使得人工智能算法模型具有很大的被窃取风险。
目前，为降低模型文件被窃取的风险，大多采用加密手段。即采用加密算法对模型文件进行加密，模型文件在真正被使用之前处于加密状态。所以，加密状态的模型文件即使被窃取，对方也无法直接使用。
然而，上述方式安全性一般，同时模型文件的应用过程中需要进行加密和解密，造成的延时和开销较大。
发明内容
本申请实施例的目的是提供一种模型部署的方法、装置及电子设备，能够解决相关技术中采用加解密方式进行模型保护造成的延时和开销较大的问题。
第一方面，本申请实施例提供了一种模型部署的方法，应用于第一电子设备，该方法包括：
基于第一随机数种子，生成随机掩码；
采用所述随机掩码对待部署模型进行掩码处理，得到第一噪声模型；
将所述第一噪声模型的多个模型层与第一数量的混淆层进行拼接，得到第二噪声模型，其中，所述混淆层为预设模型库中的模型层，每一所述混淆层在所述第二噪声模型中的层数与第一集合中的一个元素相等，所述第一集合包括基于第二随机数种子生成的第一数量的随机数；
将目标参数和所述第二噪声模型发送至第二电子设备，其中，所述第二电子设备基于所述目标参数去除所述第二噪声模型中的所述第一数量的混淆层，从而得到所述第一噪声模型，并去除所述第一噪声模型中的所述随机掩码，得到所述待部署模型；
其中，所述目标参数包括所述第一随机数种子和所述第二随机数种子。
第二方面，本申请实施例提供了一种模型部署的方法，应用于第二电子设备，该方法包括：
接收第一电子设备发送的目标参数和第二噪声模型，其中，所述目标参数包括第一随机数种子和第二随机数种子；所述第二噪声模型为第一噪声模型的多个模型层与第一数量的混淆层进行拼接得到的模型；所述第一噪声模型为采用随机掩码对待部署模型进行掩码处理得到的模型，所述随机掩码为基于所述第一随机数种子生成的掩码；所述混淆层为预设模型库中的模型层，每一所述混淆层在所述第二噪声模型中的层数与第一集合中的一个元素相等，所述第一集合包括基于所述第二随机数种子生成的第一数量的随机数；
基于所述目标参数去除所述第二噪声模型中的所述第一数量的混淆层，得到所述第一噪声模型；
基于所述目标参数去除所述第一噪声模型中的所述随机掩码，得到所述待部署模型。
第三方面，本申请实施例提供了一种模型部署的装置，应用于第一电子设备，该装置包括：
随机数种子模块，用于基于第一随机数种子，生成随机掩码；
掩码模块，用于采用所述随机掩码对待部署模型进行掩码处理，得到第一噪声模型；
拼接模块，用于将所述第一噪声模型的多个模型层与第一数量的混淆层进行拼接，得到第二噪声模型，其中，所述混淆层为预设模型库中的模型层，每一所述混淆层在所述第二噪声模型中的层数与第一集合中的一个元素相等，所述第一集合包括基于第二随机数种子生成的第一数量的随机数；
发送模块，用于将目标参数和所述第二噪声模型发送至第二电子设备，其中，所述第二电子设备基于所述目标参数去除所述第二噪声模型中的所述第一数量的混淆层，从而得到所述第一噪声模型，并去除所述第一噪声模型中的所述随机掩码，得到所述待部署模型；
其中，所述目标参数包括所述第一随机数种子和所述第二随机数种子。
第四方面，本申请实施例提供了一种模型部署的装置，应用于第二电子设备，该装置包括：
接收模块，用于接收第一电子设备发送的目标参数和第二噪声模型，其中，所述目标参数包括第一随机数种子和第二随机数种子；所述第二噪声模型为第一噪声模型的多个模型层与第一数量的混淆层进行拼接得到的模型；所述第一噪声模型为采用随机掩码对待部署模型进行掩码处理得到的模型，所述随机掩码为基于所述第一随机数种子生成的掩码；所述混淆层为预设模型库中的模型层，每一所述混淆层在所述第二噪声模型中的层数与第一集合中的一个元素相等，所述第一集合包括基于所述第二随机数种子生成的第一数量的随机数；
第一去噪模块，用于基于所述目标参数去除所述第二噪声模型中的所述第一数量的混淆层，得到所述第一噪声模型；
第二去噪模块，用于基于所述目标参数去除所述第一噪声模型中的所述随机掩码，得到所述待部署模型。
第五方面，本申请实施例提供了一种电子设备，该电子设备包括处理器和存储器，所述存储器存储可在所述处理器上运行的程序或指令，所述程序或指令被所述处理器执行时实现如第一方面或第二方面所述的方法的步骤。
第六方面，本申请实施例提供了一种可读存储介质，所述可读存储介质上存储程序或指令，所述程序或指令被处理器执行时实现如第一方面或第二方面所述的方法的步骤。
第七方面，本申请实施例提供了一种芯片，所述芯片包括处理器和通信接口，所述通信接口和所述处理器耦合，所述处理器用于运行程序或指令，实现如第一方面或第二方面所述的方法。
第八方面，本申请实施例提供一种计算机程序产品，该程序产品被存储在存储介质中，该程序产品被至少一个处理器执行以实现如第一方面或第二方面所述的方法。
第九方面，本申请实施例提供一种电子设备，所述电子设备被配置成用于执行如第一方面或第二方面所述的方法。
本申请实施例中，模型部署的方法应用于作为模型提供方的第一电子设备。第一电子设备在提供模型之前，利用第一随机数种子生成随机掩码，进而采用随机掩码对待部署模型进行掩码处理，通过往模型中添加噪声以破坏模型，实现对模型的第一层保护。然后将第一噪声模型的多个模型层与第一数量的混淆层进行拼接，通过冗余的混淆层以破坏模型结构，实现对模型的第二层保护。本申请实施例不仅通过两层保护提升了模型的安全性，同时解决了模型加解密造成的延时和开销较大的问题。
附图说明
图1是本申请实施例提供的模型部署的方法的步骤流程图之一；
图2是本申请实施例提供的模型部署的方法的步骤流程图之二；
图3是本申请实施例提供的模型部署的方法的实际应用架构图；
图4是本申请实施例提供的模型部署的装置的结构框图之一；
图5是本申请实施例提供的模型部署的装置的结构框图之二；
图6是本申请实施例提供的电子设备的硬件结构示意图之一；
图7是本申请实施例提供的电子设备的硬件结构示意图之二。
具体实施例
下面将结合本申请实施例中的附图，对本申请实施例中的技术方案进行清楚地描述，显然，所描述的实施例是本申请一部分实施例，而不是全部的实施例。基于本申请中的实施例，本领域普通技术人员获得的所有其他实施例，都属于本申请保护的范围。
本申请的说明书和权利要求书中的术语“第一”、“第二”等是用于区别类似的对象，而不用于描述特定的顺序或先后次序。应该理解这样使用的数据在适当情况下可以互换，以便本申请的实施例能够以除了在这里图示或描述的那些以外的顺序实施，且“第一”、“第二”等所区分的对象通常为一类，并不限定对象的个数，例如第一对象可以是一个，也可以是多个。此外，说明书以及权利要求中“和/或”表示所连接对象的至少其中之一，字符“/”，一般表示前后关联对象是一种“或”的关系。
下面结合附图，通过具体的实施例及其应用场景对本申请实施例提供的模型部署的方法进行详细地说明。
如图1所示，为本申请实施例提供的模型部署的方法，应用于第一电子设备，其中，第一电子设备作为模型的提供方，存储有待部署模型。
该模型部署的方法，可以包括：
步骤101：基于第一随机数种子，生成随机掩码。
本步骤中，第一随机数种子为预先设置的一随机数种子，利用该随机数种子按照一预设的伪随机生成函数可以生成多个随机数，随机掩码为该多个随机数组合而成的掩码，其可以为张量或者比特流。可以理解的是，在随机数种子和伪随机生成函数固定的情况下，生成的随机数以及随机数组成的掩码也将是固定的。因此，上述生成的随机数也可以称之为伪随机数，生成的掩码称之为随机掩码。
步骤102：采用随机掩码对待部署模型进行掩码处理，得到第一噪声模型。
应当说明的是，掩码是深度学习中的常见操作。简单而言，其相当于在原始数据上盖上一层掩膜，从而屏蔽或选择一些特定元素，但不限于此。还可以是对原始数据添加噪声，也就是说，掩码处理即为掩码加噪。
在对待部署模型进行掩码处理时，可以针对模型整体进行掩码处理。例如先将模型本身转换为二进制比特流，然后对二进制比特流就行掩码处理。当然，也可以针对模型的部分数据进行掩码处理。例如从模型中解析出模型权重，进而对模型权重进行掩码处理。可以理解的是，在对模型权重进行掩码处理的情况下，原始模型权重采用随机掩码进行掩码加噪之后将生成新的模型权重，该过程为一可逆的过程，即利用新的模型权重和随机掩码可以进行去掩码处理或掩码去噪，从而得到原始模型权重。其中，原始模型权重为待部署模型的模型权重。新的模型权重为第一噪声模型的模型权重。例如，随机掩码可以为一噪声参数，原始模型权重采用随机掩码进行掩码加噪生成新的模型参数，即为采用一固定算法对原始模型参数和噪声参数进行正向计算，得到正向计算结果，该正向计算结果就是新的模型参数。利用新的模型权重和随机掩码可以进行去掩码处理或掩码去噪生成原始模型权重，即为采用一该固定算法对计算结果和噪声参数进行反向计算，得到反向计算结果，该反向计算结果就是原始模型参数。
值得注意的是，在对待部署模型的模型权重进行掩码处理之后，该待部署模型的模型权重中将包含有随机掩码产生的噪声，且其它模型参数不会发生变化。为便于区分，这里 将掩码处理后的待部署模型称之为第一噪声模型。该第一噪声模型与待部署模型的区别仅在于模型权重不同，第一噪声模型的模型权重为待部署模型的模型权重进行掩码处理后的结果。较佳地，可以采用随机掩码对待部署模型全部或部分的模型权重进行掩码处理，得到第一噪声模型。
步骤103：将第一噪声模型的多个模型层与第一数量的混淆层进行拼接，得到第二噪声模型。
应当说明的是，第二噪声模型中的混淆层用于破坏第一噪声模型或待部署模型的模型结构，对盗取方产生混淆。因此，混淆层并不属于第一噪声模型或待部署模型。这里，混淆层为预设模型库中的模型层，预设模型库为预先设置的存储有多个模型或模型层的数据库。其中，预设模型库中的模型层可以包括待部署模型的模型层和/或预先生成的多个合理的模型层，该合理的模型层为可以与第一噪声模型的模型层实现拼接的模型层。较佳地，混淆层的模型权重可以为随机生成的权重，但不限于此。
可以理解的是，待部署模型包括多个模型层，在拼接混淆层时，可以采用任意方式将混淆层拼接到待部署模型中，使得混淆层作为拼接后模型的模型层。例如可以在待部署模型的每一模型层后面拼接一个混淆层，但不限于此。也可以预先确定各混淆层在拼接后模型中的位置，然后基于确定的位置将各混淆层拼接到待部署模型中。这种情况下，每一混淆层在第二噪声模型中的层数与第一集合中的一个元素相等，第一集合包括基于第二随机数种子生成的第一数量的随机数。混淆层的第一数量可以为一个或者至少两个。这里以第一数量为两个进行说明。例如，基于第二随机数种子生成的两个随机数分别为3和6，则第一集合包括元素3和元素6。相应的，第二噪声模型中的第三层模型层和第六层模型层均为混淆层。
具体的，基于第二随机数种子生成的第一数量的随机数，在预设模型库中随机选择第一数量的模型层作为混淆层。然后按照第一数量的随机数所指示的层数，将混淆层拼接至第一噪声模型中，生成第二噪声模型。可以理解的是，第二随机数种子生成的随机数的取值范围为[1，m]，其中，m等于待部署模型的层数与第一数量的和。
步骤104：将目标参数和第二噪声模型发送至第二电子设备，其中，第二电子设备基于目标参数去除第二噪声模型中的第一数量的混淆层，从而得到第一噪声模型，并去除第一噪声模型中的随机掩码，得到待部署模型。
应当说明的是，目标参数包括第一随机数种子和第二随机数种子。由于通过随机数种子生成的随机掩码和随机数为固定的数据内容，因此，作为模型使用方的第二电子设备可以基于第一随机数种子，生成步骤101中的随机掩码；可以基于第二随机数种子，确定混淆层在第二噪声模型中的位置。进而第二电子设备可以去除第二噪声模型中的第一数量的混淆层得到第一噪声模型，并基于生成的随机掩码对第一噪声模型的模型权重进行去掩码或去噪声操作，得到待部署模型
本申请实施例中，模型部署的方法应用于作为模型提供方的第一电子设备。第一电子设备在提供模型之前，利用第一随机数种子生成随机掩码，进而采用随机掩码对待部署模型进行掩码处理，通过往模型中添加噪声以破坏模型，实现对模型的第一层保护。然后将第一噪声模型的多个模型层与第一数量的混淆层进行拼接，通过冗余的混淆层以破坏模型结构，实现对模型的第二层保护。本申请实施例不仅通过两层保护提升了模型的安全性，同时解决了模型加解密造成的延时和开销较大的问题。
可选地，采用随机掩码对待部署模型进行掩码处理，得到第一噪声模型，包括：
采用随机掩码对待部署模型的全部模型权重进行掩码处理，得到第一噪声模型。
应当说明的是，通常情况下神经网络模型的层数较多，且每层可能包括多个神经元。而每个神经元具有一个模型权重，因此神经网络模型通常具有较多的模型权重，其数量可能是几十上百个，但不限于此。可以理解的是，进行掩码处理后的模型权重，可以视为含有噪声的模型权重。在需要使用待部署模型时，需要去除含有噪声的模型权重中的噪声，这部分模型参数的数量越多，则需要的操作将越复杂、模型的破解难度越大。相应的，模型的安全性也将越高。因此，为尽可能高的提升模型的安全性，将对待部署模型全部的模型权重进行掩码处理。
本申请实施例中，通过对待部署模型的全部模型权重进行掩码处理，可以增加模型的破解难度，进而提升模型的安全性。
可选地，目标参数还包括：由第一字符和第二字符构建的筛选掩码，其中，筛选掩码的每一字符对应待部署模型的一个模型权重。
采用随机掩码对待部署模型进行掩码处理，得到第一噪声模型，包括：
采用随机掩码对待部署模型的目标模型权重进行掩码处理，得到第一噪声模型；
其中，目标模型权重为待部署模型中的对应第一字符的模型权重。
应当说明的是，在采用随机掩码对待部署模型的部分模型权重进行掩码处理的情况下，会仅对一部分模型参数进行掩码处理，而另一部分模型参数不会被进行掩码处理。
这里，第一字符用于表征需要掩码处理，即需要对第一字符对应的模型权重进行掩码处理。第二字符用于表征无需掩码处理，即无需对第二字符对应的模型权重进行掩码处理。示例性地，筛选掩码为多个0和1构成的掩码，0和1的总数量等于模型权重的总数量，每一个0或1均对应待部署模型的一个模型权重。
例如，第一字符可以为1，第二字符可以为0，则筛选掩码01用于表示需要对1对应的模型权重进行掩码处理，而无需对0对应的模型权重进行掩码处理。
可以理解的，筛选掩码为用户基于喜好或经验预先存储至第一电子设备的掩码。也就是说，用户可以自由选择需要进行掩码处理的模型权重，从而增加含有噪声的模型参数的不确定性。当然，还可以采用L1范数(L1-Norm)筛选一些重要的模型参数，基于重要的模型参数构造筛选掩码。具体地，将筛选掩码中对应重要的模型参数的字符设置为第一字符，剩余位设置为第二字符。
本申请实施例中，选择待部署模型中的部分模型参数进行掩码处理，增加了含有噪声的模型参数的不确定性，进而增加了模型的破解难度，提升了模型的安全性。
可选地，目标参数还包括：第三随机数种子，采用随机掩码对待部署模型进行掩码处理，得到第一噪声模型，包括：
采用随机掩码对第二数量的目标模型层的模型权重进行掩码处理，得到第一噪声模型。
其中，每一目标模型层在待部署模型中的层数与第二集合中的一个元素相等，第二集合包括基于第三随机数种子生成的第二数量的随机数组成。
应当说明的是，在采用随机掩码对待部署模型部分的模型权重进行掩码处理的情况下，将选择一部分模型参数进行掩码处理，另一部分不进行掩码处理。这里以模型层为维度，选择一部分模型层的模型参数进行掩码处理，另一部分模型层的模型参数不进行掩码处理。具体的，基于第三随机数种子生成的第二数量的随机数，将第二数量的随机数所指示的模型层确定为目标模型层，进而采用随机掩码对目标模型层的模型权重进行掩码处理，得到第一噪声模型。可以理解的是，第三随机数种子生成的随机数的取值范围为[1，n]，其中，n等于待部署模型的层数。第二数量小于待部署模型的层数。较佳地，第二数量还大于等于待部署模型的层数的一半。
本申请实施例中，选择待部署模型中的部分模型参数进行掩码处理，增加了含有噪声的模型参数的不确定性，进而增加了模型的破解难度，提升了模型的安全性。
可选的，目标参数还包括：第二噪声模型的数字签名。
应当说明的是，数字签名是只有信息的发送者才能产生的别人无法伪造的一段数字串，这段数字串同时也是对信息的发送者发送信息真实性的一个有效证明。第二电子设备可以对数字签名进行验签，以确定自身接收到的第二噪声模型是否被篡改。关于数字签名和验签，这里不再详述。
本申请实施例中，通过在目标参数中添加第二噪声模型的数字签名，方便第二电子设备确定第二噪声模型在传输过程中是否被篡改。
可选地，将目标参数和第二噪声模型发送至第二电子设备，包括：
将第二噪声模型发送至第二电子设备；
在接收到第二电子设备发送的目标请求的情况下，将目标参数发送至第二电子设备；
其中，目标请求为第二电子设备在本地处于可信执行环境下发送的用于请求目标密钥的请求，目标密钥包括所述目标参数。
应当说明的是，目标参数可以理解为待部署模型的密钥，第二噪声模型可以理解为对待部署模型使用密钥添加噪声后的模型。因此，可以将密钥与第二噪声模型一同发送至第二电子设备，以使第二电子设备可以基于接收到数据还原出待部署模型。当然为提升安全性，还可以将两者分批发送，且优先发送第二噪声模型。然后基于第二电子设备返回的目标请求发送目标参数。较佳地，在发送目标参数时，可以先对目标参数进行加密处理，以密文的方式传输目标参数。例如采用密钥交换协议发送目标参数，但不限于此。
本申请实施例中，将目标参数和第二噪声模型分批发送，在发送第二噪声模型之后，基于第二电子设备的目标请求，向第二电子设备发送目标参数，使得模型部署的方式更加灵活。
如图2所示，为本申请实施例提供的模型部署的方法，应用于第二电子设备，其中，第二电子设备作为模型的接收方，用于使用待部署模型进行模型训练或线上使用。
该模型部署的方法，可以包括：
步骤201：接收第一电子设备发送的目标参数和第二噪声模型。
应当说明的是，目标参数包括第一随机数种子和第二随机数种子；第二噪声模型为第一噪声模型的多个模型层与第一数量的混淆层进行拼接得到的模型；第一噪声模型为采用随机掩码对待部署模型进行掩码处理得到的模型，随机掩码为基于第一随机数种子生成的掩码；混淆层为预设模型库中的模型层，每一混淆层在第二噪声模型中的层数与第一集合中的一个元素相等，第一集合包括基于第二随机数种子生成的第一数量的随机数。可以理解的是，第一电子设备生成并发送目标参数和第二噪声模型的过程、目标参数、第一随机数种子、第二随机数种子、混淆层、第一噪声模型以及随机掩码的相关内容，可以参见图1所示实施例，在此不再赘述。
步骤202：基于目标参数去除第二噪声模型中的第一数量的混淆层，得到第一噪声模型。
应当说明的是，第一数量的混淆层为第二噪声模型中的冗余结构。在第一电子设备侧，将第一噪声模型的模型层与第一数量的混淆层进行拼接，得到第二噪声模型。因此，在第二电子设备侧，将以逆向的处理方式将第二噪声模型还原为第一噪声模型。
值得注意的是，无论在第一电子设备侧还是在第二电子设备侧，基于第二随机数种子生成的随机数相同，即均可以生成第一数量的随机数。例如，在第一电子设备侧，基于第二随机数种子生成的两个随机数分别为3和6。在第二电子设备侧，基于第二随机数种子将同样生成3和6两个随机数。
本步骤中，将基于第二随机数种子生成的第一数量的随机数，然后按照第一数量的随机数去除第二噪声模型相应的模型层，得到第一噪声模型。假设在第一电子设备侧，基于第二随机数种子生成的两个随机数分别为3和6，则第二噪声模型中的第三层模型层和第六层模型层均为混淆层。在本步骤中，在第二电子设备侧，再次基于第二随机数种子将生成两个随机数3和6。去除第二噪声模型的第三层模型层和第六层模型层，可以得到第一噪声模型。
步骤203：基于目标参数去除第一噪声模型中的随机掩码，得到待部署模型。
应当说明的是，在第一电子设备侧，采用随机掩码对待部署模型的模型权重进行掩码处理，得到第一噪声模型。因此，在第二电子设备侧，将以逆向的处理方式将第一噪声模型还原为待部署模型。
值得注意的是，无论在第一电子设备侧还是在第二电子设备侧，基于第一随机数种子生成的随机掩码相同。本步骤中，将基于第一随机数种子生成的随机掩码，然后基于生成 的随机掩码对第一噪声模型中的模型权重去掩码处理或掩码去噪，得到待部署模型。由于随机掩码相同，因此，通过逆向的去掩码处理可以去除第一噪声模型中的模型权重中的噪声，进而将第一噪声模型还原为待部署模型。
本申请实施例中，利用第一随机数种子生成随机掩码，进而采用随机掩码对待部署模型进行掩码处理，通过往模型中添加噪声以破坏模型，实现对模型的第一层保护。然后将第一噪声模型的多个模型层与第一数量的混淆层进行拼接，通过冗余的混淆层以破坏模型结构，实现对模型的第二层保护。最后利用目标参数对第二噪声模型进行逆向处理，将其恢复为待部署模型以供使用。本申请实施例不仅通过两层保护提升了模型的安全性，同时解决了模型加解密造成的延时和开销较大的问题。
可选地，目标参数还包括：由第一字符和第二字符构建的筛选掩码，其中，筛选掩码的每一字符对应待部署模型的一个模型权重。
基于目标参数去除第一噪声模型中的随机掩码，得到待部署模型，包括：
基于筛选掩码，确定第一噪声模型中的第一噪声模型权重，其中，第一噪声模型权重在第一噪声模型中的位置与目标模型权重在待部署模型中的位置相同，目标模型权重为待部署模型中的对应第一字符的模型权重。
基于第一随机数种子，生成随机掩码。
基于随机掩码对第一噪声模型中的第一噪声模型权重进行去掩码处理，得到待部署模型。
应当说明的是，在第一电子设备侧基于随机掩码和筛选掩码对待部署模型进行掩码的过程，这里不再赘述。本步骤中，若检测到目标参数中存在筛选掩码，将基于筛选掩码，确定含有噪声的模型权重，即第一噪声模型权重。进而基于目标参数中的第一随机数种子生成的随机掩码，对第一噪声模型权重进行去掩码处理，将第一噪声模型还原为待部署模型。
本申请实施例中，可以选择待部署模型中的部分模型参数进行掩码处理，利用筛选掩码对部分模型权重添加噪声，同时利用筛选掩码确定含有噪声的模型权重，可以实现模型的破坏与还原，提升了模型的安全性。
可选地，目标参数还包括：第三随机数种子。
基于目标参数去除第一噪声模型中的随机掩码，得到待部署模型，包括：
基于第三随机数种子，生成第二数量的随机数。
基于第二数量的随机数，确定第一噪声模型中第二数量的噪声模型层；其中，每一噪声模型层在第一噪声模型中的层数与第二数量的随机数中的一个随机数相等。
基于第一随机数种子，生成随机掩码。
基于随机掩码对第二噪声模型权重进行去掩码处理，得到待部署模型；其中，第二噪声模型权重为第二数量的噪声模型层的模型权重。
应当说明的是，在第一电子设备侧基于随机掩码和混淆层对待部署模型进行处理的过程，这里不再赘述。本步骤中，若检测到目标参数中含有第三随机数种子，将基于第三随机数种子生成第二数量的随机数，然后将第二数量的随机数指示的模型层确定为含有噪声或进行过掩码处理的模型层，即噪声模型层。进而基于目标参数中的第一随机数种子生成的随机掩码，对噪声模型层的模型权重进行去掩码处理，将第一噪声模型还原为待部署模型。
值得注意的是，无论在第一电子设备侧还是在第二电子设备侧，基于第三随机数种子生成的随机数相同，即均可以生成第二数量的随机数。例如，在第一电子设备侧，基于第三随机数种子生成的两个随机数分别为3和6。在第二电子设备侧，基于第三随机数种子将同样生成3和6两个随机数。
本申请实施例中，可以选择待部署模型中的部分模型参数进行掩码处理，利用第三随机数种子对部分模型权重添加噪声，同时利用第三随机数种子确定含有噪声的模型权重，可以实现模型的破坏与还原，提升了模型的安全性。
可选地，目标参数还包括：第二噪声模型的数字签名；
基于目标参数去除第二噪声模型中的第一数量的混淆层，得到第一噪声模型，包括：
在数字签名通过验签的情况下，基于目标参数去除第二噪声模型中的第一数量的混淆层，得到第一噪声模型。
应当说明的是，数字签名是只有信息的发送者才能产生的别人无法伪造的一段数字串，这段数字串同时也是对信息的发送者发送信息真实性的一个有效证明。第二电子设备可以对数字签名进行验签，以确定自身接收到的第二噪声模型是否被篡改。关于数字签名和验签，这里不再详述。
本申请实施例中，通过在目标参数中添加第二噪声模型的数字签名，方便第二电子设备确定第二噪声模型在传输过程中是否被篡改。
可选地，接收第一电子设备发送的目标参数和第二噪声模型，包括：
接收第一电子设备发送的第二噪声模型；
在第二电子设备本地处于可信执行环境下，发送用于请求目标密钥的第一请求，其中，目标密钥包括目标参数；
接收第一电子设备基于第一请求返回的目标密钥。
应当说明的是，网络中的威胁包括：半诚实威胁和恶意威胁。其中，在半诚实威胁下，攻击者无法攻破设备，只能在预定的规则和有限权限内进行攻击实现自己的目的。在恶意威胁下，攻击者能够完全掌握被攻击的设备，并且不遵守预定的协议，控制整个运行流程。因此，本申请可以基于两种威胁设置两种不同的场景进行应对。在半诚实威胁场景下，由于攻击者是半诚实方，即不会攻破第二电子设备的系统进行干预。可以在应用或服务首次加载时采用简单的加密通信方式将目标参数加载至第二电子设备的私有空间。在恶意威胁场景中，第二电子设备已经被恶意攻击者攻破，攻击者将会获得设备控制权，掌握运行时 信息。此时，需要采用加强方案对目标参数进行分发、管理和使用。具体来说，在应用或服务首次加载时，于可信执行环境中使用密钥交换协议与第一电子设备交互获取目标参数，即目标参数只在可信执行环境中可见。其中，可信执行环境：完全可信的运行环境，无法被攻破和运行时监测，包括现有的TEE(可信执行环境，Trusted Execution Environment)技术以及机密计算等技术之上搭建的运行时环境。
如图3所示，本申请实施例还提供了一种模型部署的方法，应用于第一设备和第二设备组成的网络系统，其中，第一设备相当于图1所示实施例中的第一电子设备，第二设备相当于图2所示实施例中的第二电子设备，在此不再赘述。
该方法可以包括：
步骤301：在第一设备中生成掩码、冗余结构以及相应密钥。具体的，使用一个预定的随机数种子key1生成随机掩码Mask1。使用预定的随机数种子key2，生成k个目标范围内的随机数，其中目标范围为[1，k+n]，其中，n为待部署模型的层数。在预设模型库中随机选择k个模型层作为冗余结构。较佳地，k小于等于n，且k大于等于目标值，目标值为n/4和1中的最大值。这里，随机掩码Mask1的密钥为随机数种子key1；冗余结构的密钥为随机数种子key2。
步骤302：第一设备组合保护模型后下发部署。具体的，使用随机掩码Mask1对待部署模型中的模型权重进行掩码处理，然后拼接冗余结构，得到k+n层的保护模型，保护模型相当于上述申请实施例中的第二噪声模型。然后将保护模型和保护模型的数字签名作为打包文件下发至第二设备。
步骤303：第一设备进行密钥下发。具体的，在接收到第二设备发送的目标请求的情况下，将随机数种子key1和随机数种子key2作为密钥发送至第二设备。
步骤304：第二设备在接收到打包文件后，对保护模型进行文件部署。
步骤305：请求第一设备下下发密钥，将密钥存储至可信执行空间中。该可信执行空间为第二设备中具有可信执行环境的存储空间。
步骤306：在需要使用模型的情况下，利用打包文件中的数字签名对保护模型进行验签以验证保护模型的完整性。若验签不通过，则请求第一设备重新下发打包文件。若验签通过，则执行步骤307。
步骤307：基于可信执行空间中的密钥，去除保护模型中的冗余结构，并进行去掩码处理，得到待部署模型。然后使用待部署模型进行模型训练或数据推断。值得注意的是，在恶意威胁场景中，本步骤将在第二设备的可信执行环境中进行。
应当说明的是，使用随机掩码Mask1对待部署模型中的模型权重进行掩码处理时，可以是覆盖整个模型也可以仅覆盖部分模型，即可以对待部署模型全部的模型权重进行掩码处理，也可以对待部署模型的部分模型权重进行掩码处理，根据安全性和性能的需要可以具体采用以下方式。
方式1：对整个模型加上一层掩码噪声，即对待部署模型全部的模型权重进行掩码处理。
方式2：通过L1范式确定重要的模型权重，随后针对这部分权重(可以大于总权重数的20％)构造由0和1组成的筛选掩码Mask2，最后对1对应的模型权重使用随机掩码Mask1进行掩码加噪。
方式3：使用随机数种子key3生成又一数值范围内的n1个随机数，其中，该数值范围为[1，n]，n等于待部署模型的层数。n1小于等于n，且n1大于等于n/2。对n1个随机数指示的模型层中的模型权重使用随机掩码Mask1进行掩码加噪。
因此，第二设备接收到的密钥中通常包含有：随机数种子key1和随机数种子key2。若其还包含有随机数种子key3，说明第一设备采用了方式3进行掩码加噪。在进行掩码去噪时，先基于随机数种子key3，确定需要去噪的模型层，进而对这部分需要去噪的模型层利用随机掩码Mask1进行掩码去噪。若其还包含有筛选掩码Mask2，说明第一设备采用了方式2进行掩码加噪。在进行掩码去噪时，先基于筛选掩码Mask2，确定需要去噪的模型权重，进而对这部分需要去噪的模型权重利用随机掩码Mask1进行掩码去噪。
本申请实施例中，使用随机掩码技术以较低开销和时延破坏模型完整性和可用性；在进行模型权重保护的同时，使用冗余模型结构进行模型结构混淆保护，且能够迷惑攻击者使其错误判断所获模型为可用的真实模型。
需要说明的是，本申请实施例提供的模型部署的方法，执行主体可以为模型部署的装置，或者该模型部署的装置中的用于执行模型部署的方法的控制模块。本申请实施例中以模型部署的装置执行模型部署的方法为例，说明本申请实施例提供的模型部署的装置。
如图4所示，本申请实施例还提供了一种模型部署的装置，应用于第一电子设备，该装置包括：
随机数种子模块41，用于基于第一随机数种子，生成随机掩码。
掩码模块42，用于采用随机掩码对待部署模型进行掩码处理，得到第一噪声模型。
拼接模块43，用于将第一噪声模型的多个模型层与第一数量的混淆层进行拼接，得到第二噪声模型，其中，混淆层为预设模型库中的模型层，每一混淆层在第二噪声模型中的层数与第一集合中的一个元素相等，第一集合包括基于第二随机数种子生成的第一数量的随机数。
发送模块44，用于将目标参数和第二噪声模型发送至第二电子设备，其中，第二电子设备基于目标参数去除第二噪声模型中的第一数量的混淆层，从而得到第一噪声模型，并去除第一噪声模型中的随机掩码，得到待部署模型。
其中，目标参数包括第一随机数种子和第二随机数种子。
可选地，掩码模块42，具体用于采用随机掩码对待部署模型的全部模型权重进行掩码处理，得到第一噪声模型。
可选地，目标参数还包括：由第一字符和第二字符构建的筛选掩码，其中，筛选掩码的每一字符对应待部署模型的一个模型权重。
掩码模块42，具体用于采用随机掩码对待部署模型的目标模型权重进行掩码处理，得到第一噪声模型。
其中，目标模型权重为待部署模型中的对应第一字符的模型权重。
可选地，目标参数还包括：第三随机数种子，掩码模块42，具体用于采用随机掩码对第二数量的目标模型层的模型权重进行掩码处理，得到第一噪声模型。
其中，每一目标模型层在待部署模型中的层数与第二集合中的一个元素相等，第二集合包括基于第三随机数种子生成的第二数量的随机数。
可选地，目标参数还包括：第二噪声模型的数字签名。
可选地，发送模块44，包括：
第一发送单元，用于将第二噪声模型发送至第二电子设备。
第二发送单元，用于在接收到第二电子设备发送的目标请求的情况下，将目标参数发送至第二电子设备。
其中，目标请求为第二电子设备在本地处于可信执行环境下发送的用于请求目标密钥的请求，目标密钥包括所述目标参数。
本申请实施例中，第一电子设备在提供模型之前，利用第一随机数种子生成随机掩码，进而采用随机掩码对待部署模型的模型权重进行掩码处理，通过往模型权重中添加噪声以破坏模型权重，实现对模型的第一层保护。然后将第一噪声模型的模型层与第一数量的混淆层进行拼接，通过冗余的混淆层以破坏模型结构，实现对模型的第二层保护。本申请实施例不仅通过两层保护提升了模型的安全性，同时解决了模型加解密造成的延时和开销较大的问题。
本申请实施例中的模型部署的装置可以是电子设备，也可以是电子设备中的部件，例如集成电路或芯片。该电子设备可以是终端，也可以为除终端之外的其他设备。示例性的，电子设备可以为手机、平板电脑、笔记本电脑、掌上电脑、车载电子设备、移动上网装置(Mobile Internet Device，MID)、增强现实(augmented reality，AR)/虚拟现实(virtual reality，VR)设备、机器人、可穿戴设备、超级移动个人计算机(ultra-mobile personal computer，UMPC)、上网本或者个人数字助理(personal digital assistant，PDA)等，还可以为服务器、网络附属存储器(Network Attached Storage，NAS)、个人计算机(personal computer，PC)、电视机(television，TV)、柜员机或者自助机等，本申请实施例不作具体限定。
本申请实施例中的模型部署的装置可以为具有操作系统的装置。该操作系统可以为安卓(Android)操作系统，可以为iOS操作系统，还可以为其他可能的操作系统，本申请实施例不作具体限定。
本申请实施例提供的模型部署的装置能够实现图1的方法实施例实现的各个过程，实现相同的技术效果，为避免重复，这里不再赘述。
如图5所示，本申请实施例还提供了一种模型部署的装置，应用于第二电子设备，该装置包括：
接收模块51，用于接收第一电子设备发送的目标参数和第二噪声模型，其中，目标参数包括第一随机数种子和第二随机数种子；第二噪声模型为第一噪声模型的多个模型层与第一数量的混淆层进行拼接得到的模型；第一噪声模型为采用随机掩码对待部署模型进行掩码处理得到的模型，随机掩码为基于第一随机数种子生成的掩码；混淆层为预设模型库中的模型层，每一混淆层在第二噪声模型中的层数与第一集合中的一个元素相等，第一集合包括基于第二随机数种子生成的第一数量的随机数。
第一去噪模块52，用于基于目标参数去除第二噪声模型中的第一数量的混淆层，得到第一噪声模型。
第二去噪模块53，用于基于目标参数去除第一噪声模型中的随机掩码，得到待部署模型。
可选地，目标参数还包括：由第一字符和第二字符构建的筛选掩码，其中，筛选掩码的每一字符对应待部署模型的一个模型权重。
第二去噪模块53，包括：
筛选单元，用于基于筛选掩码，确定第一噪声模型中的第一噪声模型权重，其中，第一噪声模型权重在第一噪声模型中的位置与目标模型权重在待部署模型中的位置相同，目标模型权重为待部署模型中的对应第一字符的模型权重。
第一随机数种子单元，用于基于第一随机数种子，生成随机掩码。
第一去噪单元，用于基于随机掩码对第一噪声模型中的第一噪声模型权重进行去掩码处理，得到待部署模型。
可选地，目标参数还包括：第三随机数种子。
第二去噪模块53，包括：
第二随机数种子单元，用于基于第三随机数种子，生成第二数量的随机数。
确定单元，用于基于第二数量的随机数，确定第一噪声模型中第二数量的噪声模型层；其中，每一噪声模型层在第一噪声模型中的层数与第二数量的随机数中的一个随机数相等。
第三随机数种子单元，用于基于第一随机数种子，生成随机掩码。
第二去噪单元，用于基于随机掩码对第二噪声模型权重进行去掩码处理，得到待部署模型；其中，第二噪声模型权重为第二数量的噪声模型层的模型权重。
可选地，目标参数还包括：第二噪声模型的数字签名。
第一去噪模块52，具体用于在数字签名通过验签的情况下，基于目标参数去除第二噪声模型中的第一数量的混淆层，得到第一噪声模型。
可选地，接收模块51，具体用于：
接收第一电子设备发送的所述第二噪声模型；
在所述第二电子设备本地处于可信执行环境下，发送用于请求目标密钥的第一请求，其中，所述目标密钥包括所述目标参数；
接收所述第一电子设备基于所述第一请求返回的所述目标密钥。
本申请实施例中，利用第一随机数种子生成随机掩码，进而采用随机掩码对待部署模型进行掩码处理，通过往模型中添加噪声以破坏模型，实现对模型的第一层保护。然后将第一噪声模型的多个模型层与第一数量的混淆层进行拼接，通过冗余的混淆层以破坏模型结构，实现对模型的第二层保护。最后利用目标参数对第二噪声模型进行逆向处理，将其恢复为待部署模型以供使用。本申请实施例不仅通过两层保护提升了模型的安全性，同时解决了模型加解密造成的延时和开销较大的问题。
本申请实施例中的模型部署的装置可以是电子设备，也可以是电子设备中的部件，例如集成电路或芯片。该电子设备可以是终端，也可以为除终端之外的其他设备。示例性的，电子设备可以为手机、平板电脑、笔记本电脑、掌上电脑、车载电子设备、移动上网装置(Mobile Internet Device，MID)、增强现实(augmented reality，AR)/虚拟现实(virtual reality，VR)设备、机器人、可穿戴设备、超级移动个人计算机(ultra-mobile personal computer，UMPC)、上网本或者个人数字助理(personal digital assistant，PDA)等，还可以为服务器、网络附属存储器(Network Attached Storage，NAS)、个人计算机(personal computer，PC)、电视机(television，TV)、柜员机或者自助机等，本申请实施例不作具体限定。
本申请实施例中的模型部署的装置可以为具有操作系统的装置。该操作系统可以为安卓(Android)操作系统，可以为iOS操作系统，还可以为其他可能的操作系统，本申请实施例不作具体限定。
本申请实施例提供的模型部署的装置能够实现图2的方法实施例实现的各个过程，实现相同的技术效果，为避免重复，这里不再赘述。
可选地，如图6所示，本申请实施例还提供一种电子设备600，包括处理器601和存储器602，存储器602上存储有可在所述处理器601上运行的程序或指令，该程序或指令被处理器601执行时实现上述模型部署的方法实施例的各个步骤，且能达到相同的技术效果，为避免重复，这里不再赘述。
需要说明的是，本申请实施例中的电子设备包括上述所述的移动电子设备和非移动电子设备。
图7为实现本申请实施例的一种电子设备的硬件结构示意图。
该电子设备700包括但不限于：射频单元701、网络模块702、音频输出单元703、输入单元704、传感器705、显示单元706、用户输入单元707、接口单元708、存储器709、以及处理器710等部件。
本领域技术人员可以理解，电子设备700还可以包括给各个部件供电的电源(比如电池)，电源可以通过电源管理系统与处理器710逻辑相连，从而通过电源管理系统实现管理充电、放电、以及功耗管理等功能。图7中示出的电子设备结构并不构成对电子设备的限定，电子设备可以包括比图示更多或更少的部件，或者组合某些部件，或者不同的部件布置，在此不再赘述。
其中，在电子设备为第一电子设备的情况下，处理器710，用于基于第一随机数种子，生成随机掩码。
处理器710，还用于采用随机掩码对待部署模型进行掩码处理，得到第一噪声模型。
处理器710，还用于将第一噪声模型的多个模型层与第一数量的混淆层进行拼接，得到第二噪声模型，其中，混淆层为预设模型库中的模型层，每一混淆层在第二噪声模型中的层数与第一集合中的一个元素相等，第一集合包括基于第二随机数种子生成的第一数量的随机数。
网络模块702，用于将目标参数和第二噪声模型发送至第二电子设备，其中，第二电子设备基于目标参数去除第二噪声模型中的第一数量的混淆层，从而得到第一噪声模型，并去除第一噪声模型中的随机掩码，得到待部署模型。
其中，目标参数包括第一随机数种子和第二随机数种子。
本申请实施例中，第一电子设备在提供模型之前，利用第一随机数种子生成随机掩码，进而采用随机掩码对待部署模型进行掩码处理，通过往模型中添加噪声以破坏模型，实现对模型的第一层保护。然后将第一噪声模型的多个模型层与第一数量的混淆层进行拼接，通过冗余的混淆层以破坏模型结构，实现对模型的第二层保护。本申请实施例不仅通过两层保护提升了模型的安全性，同时解决了模型加解密造成的延时和开销较大的问题。
在电子设备为第二电子设备的情况下，网络模块702，用于接收第一电子设备发送的目标参数和第二噪声模型，其中，目标参数包括第一随机数种子和第二随机数种子；第二噪声模型为第一噪声模型的多个模型层与第一数量的混淆层进行拼接得到的模型；第一噪声模型为采用随机掩码对待部署模型进行掩码处理得到的模型，随机掩码为基于第一随机数种子生成的掩码；混淆层为预设模型库中的模型层，每一混淆层在第二噪声模型中的层数与第一集合中的一个元素相等，第一集合包括基于第二随机数种子生成的第一数量的随机数。
处理器710，用于基于目标参数去除第二噪声模型中的第一数量的混淆层，得到第一噪声模型。
处理器710，还用于基于目标参数去除第一噪声模型中的随机掩码，得到待部署模型。
本申请实施例中，利用第一随机数种子生成随机掩码，进而采用随机掩码对待部署模型进行掩码处理，通过往模型中添加噪声以破坏模型，实现对模型的第一层保护。然后将第一噪声模型的多个模型层与第一数量的混淆层进行拼接，通过冗余的混淆层以破坏模型结构，实现对模型的第二层保护。最后利用目标参数对第二噪声模型进行逆向处理，将其恢复为待部署模型以供使用。本申请实施例不仅通过两层保护提升了模型的安全性，同时解决了模型加解密造成的延时和开销较大的问题。
应理解的是，本申请实施例中，输入单元704可以包括图形处理器(Graphics Processing Unit，GPU)7041和麦克风7042，图形处理器7041对在视频捕获模式或图像捕获模式中由图像捕获装置(如摄像头)获得的静态图片或视频的图像数据进行处理。显示单元706可 包括显示面板7061，可以采用液晶显示器、有机发光二极管等形式来配置显示面板7061。用户输入单元707包括触控面板7071以及其他输入设备7072中的至少一种。触控面板7071，也称为触摸屏。触控面板7071可包括触摸检测装置和触摸控制器两个部分。其他输入设备7072可以包括但不限于物理键盘、功能键(比如音量控制按键、开关按键等)、轨迹球、鼠标、操作杆，在此不再赘述。
存储器709可用于存储软件程序以及各种数据。存储器709可主要包括存储程序或指令的第一存储区和存储数据的第二存储区，其中，第一存储区可存储操作系统、至少一个功能所需的应用程序或指令(比如声音播放功能、图像播放功能等)等。此外，存储器709可以包括易失性存储器或非易失性存储器，或者，存储器x09可以包括易失性和非易失性存储器两者。其中，非易失性存储器可以是只读存储器(Read-Only Memory，ROM)、可编程只读存储器(Programmable ROM，PROM)、可擦除可编程只读存储器(Erasable PROM，EPROM)、电可擦除可编程只读存储器(Electrically EPROM，EEPROM)或闪存。易失性存储器可以是随机存取存储器(Random Access Memory，RAM)，静态随机存取存储器(Static RAM，SRAM)、动态随机存取存储器(Dynamic RAM，DRAM)、同步动态随机存取存储器(Synchronous DRAM，SDRAM)、双倍数据速率同步动态随机存取存储器(Double Data Rate SDRAM，DDRSDRAM)、增强型同步动态随机存取存储器(Enhanced SDRAM，ESDRAM)、同步连接动态随机存取存储器(Synch link DRAM，SLDRAM)和直接内存总线随机存取存储器(Direct Rambus RAM，DRRAM)。本申请实施例中的存储器709包括但不限于这些和任意其它适合类型的存储器。
处理器710可包括一个或多个处理单元；可选地，处理器710集成应用处理器和调制解调处理器，其中，应用处理器主要处理涉及操作系统、用户界面和应用程序等的操作，调制解调处理器主要处理无线通信信号，如基带处理器。可以理解的是，上述调制解调处理器也可以不集成到处理器710中。
本申请实施例还提供一种可读存储介质，所述可读存储介质上存储有程序或指令，该程序或指令被处理器执行时实现上述模型部署的方法实施例的各个过程，且能达到相同的技术效果，为避免重复，这里不再赘述。
其中，所述处理器为上述实施例中所述的电子设备中的处理器。所述可读存储介质，包括计算机可读存储介质，如计算机只读存储器(Read-Only Memory，ROM)、随机存取存储器(Random Access Memory，RAM)、磁碟或者光盘等。
本申请实施例另提供了一种芯片，所述芯片包括处理器和通信接口，所述通信接口和所述处理器耦合，所述处理器用于运行程序或指令，实现上述模型部署的方法实施例的各个过程，且能达到相同的技术效果，为避免重复，这里不再赘述。
应理解，本申请实施例提到的芯片还可以称为系统级芯片、系统芯片、芯片系统或片上系统芯片等。
本申请实施例提供一种计算机程序产品，该程序产品被存储在存储介质中，该程序产品被至少一个处理器执行以实现如上述模型部署的方法实施例的各个过程，且能达到相同的技术效果，为避免重复，这里不再赘述。
需要说明的是，在本文中，术语“包括”、“包含”或者其任何其他变体意在涵盖非排他性的包含，从而使得包括一系列要素的过程、方法、物品或者装置不仅包括那些要素，而且还包括没有明确列出的其他要素，或者是还包括为这种过程、方法、物品或者装置所固有的要素。在没有更多限制的情况下，由语句“包括一个……”限定的要素，并不排除在包括该要素的过程、方法、物品或者装置中还存在另外的相同要素。此外，需要指出的是，本申请实施方式中的方法和装置的范围不限按示出或讨论的顺序来执行功能，还可包括根据所涉及的功能按基本同时的方式或按相反的顺序来执行功能，例如，可以按不同于所描述的次序来执行所描述的方法，并且还可以添加、省去、或组合各种步骤。另外，参照某些示例所描述的特征可在其他示例中被组合。
通过以上的实施方式的描述，本领域的技术人员可以清楚地了解到上述实施例方法可借助软件加必需的通用硬件平台的方式来实现，当然也可以通过硬件，但很多情况下前者是更佳的实施方式。基于这样的理解，本申请的技术方案本质上或者说对现有技术做出贡献的部分可以以计算机软件产品的形式体现出来，该计算机软件产品存储在一个存储介质(如ROM/RAM、磁碟、光盘)中，包括若干指令用以使得一台终端(可以是手机，计算机，服务器，或者网络设备等)执行本申请各个实施例所述的方法。
上面结合附图对本申请的实施例进行了描述，但是本申请并不局限于上述的具体实施方式，上述的具体实施方式仅仅是示意性的，而不是限制性的，本领域的普通技术人员在本申请的启示下，在不脱离本申请宗旨和权利要求所保护的范围情况下，还可做出很多形式，均属于本申请的保护之内。

Claims (24)

  1. 一种模型部署的方法，应用于第一电子设备，所述方法包括：
    基于第一随机数种子，生成随机掩码；
    采用所述随机掩码对待部署模型进行掩码处理，得到第一噪声模型；
    将所述第一噪声模型的多个模型层与第一数量的混淆层进行拼接，得到第二噪声模型，其中，所述混淆层为预设模型库中的模型层，每一所述混淆层在所述第二噪声模型中的层数与第一集合中的一个元素相等，所述第一集合包括基于第二随机数种子生成的第一数量的随机数；
    将目标参数和所述第二噪声模型发送至第二电子设备，其中，所述第二电子设备基于所述目标参数去除所述第二噪声模型中所述第一数量的混淆层，从而得到所述第一噪声模型，并去除所述第一噪声模型中的所述随机掩码，得到所述待部署模型；
    其中，所述目标参数包括所述第一随机数种子和所述第二随机数种子。
  2. 根据权利要求1所述的方法，其中，所述采用所述随机掩码对待部署模型进行掩码处理，得到第一噪声模型，包括：
    采用所述随机掩码对待部署模型的全部模型权重进行掩码处理，得到第一噪声模型。
  3. 根据权利要求1所述的方法，其中，所述目标参数还包括：由第一字符和第二字符构建的筛选掩码，其中，所述筛选掩码的每一字符对应所述待部署模型的一个模型权重；
    所述采用所述随机掩码对待部署模型进行掩码处理，得到第一噪声模型，包括：
    采用所述随机掩码对所述待部署模型的目标模型权重进行掩码处理，得到第一噪声模型；
    其中，所述目标模型权重为所述待部署模型中的对应所述第一字符的模型权重。
  4. 根据权利要求1所述的方法，其中，所述目标参数还包括：第三随机数种子，所述采用所述随机掩码对待部署模型进行掩码处理，得到第一噪声模型，包括：
    采用所述随机掩码对第二数量的目标模型层的模型权重进行掩码处理，得到第一噪声模型；
    其中，每一所述目标模型层在所述待部署模型中的层数与第二集合中的一个元素相等，所述第二集合包括基于所述第三随机数种子生成的第二数量的随机数。
  5. 根据权利要求1所述的方法，其中，所述目标参数还包括：所述第二噪声模型的数字签名。
  6. 根据权利要求1所述的方法，其中，所述将所述目标参数和所述第二噪声模型发送至第二电子设备，包括：
    将所述第二噪声模型发送至所述第二电子设备；
    在接收到所述第二电子设备发送的目标请求的情况下，将所述目标参数发送至所述第二电子设备；
    其中，所述目标请求为所述第二电子设备在本地处于可信执行环境下发送的用于请求目标密钥的请求，所述目标密钥包括所述目标参数。
  7. 一种模型部署的方法，应用于第二电子设备，所述方法包括：
    接收第一电子设备发送的目标参数和第二噪声模型，其中，所述目标参数包括第一随机数种子和第二随机数种子；所述第二噪声模型为第一噪声模型的多个模型层与第一数量的混淆层进行拼接得到的模型；所述第一噪声模型为采用随机掩码对待部署模型进行掩码处理得到的模型，所述随机掩码为基于所述第一随机数种子生成的掩码；所述混淆层为预设模型库中的模型层，每一所述混淆层在所述第二噪声模型中的层数与第一集合中的一个元素相等，所述第一集合包括基于所述第二随机数种子生成的第一数量的随机数；
    基于所述目标参数去除所述第二噪声模型中的所述第一数量的混淆层，得到所述第一噪声模型；
    基于所述目标参数去除所述第一噪声模型中的所述随机掩码，得到所述待部署模型。
  8. 根据权利要求7所述的方法，其中，所述目标参数还包括：由第一字符和第二字符构建的筛选掩码，其中，所述筛选掩码的每一字符对应所述待部署模型的一个模型权重；
    所述基于所述目标参数去除所述第一噪声模型中的所述随机掩码，得到所述待部署模型，包括：
    基于所述筛选掩码，确定所述第一噪声模型中的第一噪声模型权重，其中，所述第一噪声模型权重在所述第一噪声模型中的位置与目标模型权重在所述待部署模型中的位置相同，所述目标模型权重为所述待部署模型中的对应所述第一字符的模型权重；
    基于所述第一随机数种子，生成所述随机掩码；
    基于所述随机掩码对所述第一噪声模型中的所述第一噪声模型权重进行去掩码处理，得到所述待部署模型。
  9. 根据权利要求7所述的方法，其中，所述目标参数还包括：第三随机数种子；
    所述基于所述目标参数去除所述第一噪声模型中的所述随机掩码，得到所述待部署模型，包括：
    基于所述第三随机数种子，生成第二数量的随机数；
    基于所述第二数量的随机数，确定所述第一噪声模型中第二数量的噪声模型层；其中，每一所述噪声模型层在所述第一噪声模型中的层数与所述第二数量的随机数中的一个随机数相等；
    基于所述第一随机数种子，生成所述随机掩码；
    基于所述随机掩码对第二噪声模型权重进行去掩码处理，得到所述待部署模型；其中，所述第二噪声模型权重为所述第二数量的噪声模型层的模型权重。
  10. 根据权利要求7所述的方法，其中，所述目标参数还包括：所述第二噪声模型的数字签名；
    所述基于所述目标参数去除所述第二噪声模型中的所述第一数量的混淆层，得到所述第一噪声模型，包括：
    在所述数字签名通过验签的情况下，基于所述目标参数去除所述第二噪声模型中的所述第一数量的混淆层，得到所述第一噪声模型。
  11. 根据权利要求7所述的方法，其中，接收第一电子设备发送的目标参数和第二噪声模型，包括：
    接收第一电子设备发送的所述第二噪声模型；
    在所述第二电子设备本地处于可信执行环境下，发送用于请求目标密钥的第一请求，其中，所述目标密钥包括所述目标参数；
    接收所述第一电子设备基于所述第一请求返回的所述目标密钥。
  12. 一种模型部署的装置，应用于第一电子设备，所述装置包括：
    随机数种子模块，用于基于第一随机数种子，生成随机掩码；
    掩码模块，用于采用所述随机掩码对待部署模型进行掩码处理，得到第一噪声模型；
    拼接模块，用于将所述第一噪声模型的多个模型层与第一数量的混淆层进行拼接，得到第二噪声模型，其中，所述混淆层为预设模型库中的模型层，每一所述混淆层在所述第二噪声模型中的层数与第一集合中的一个元素相等，所述第一集合包括基于第二随机数种子生成的第一数量的随机数；
    发送模块，用于将目标参数和所述第二噪声模型发送至第二电子设备，其中，所述第二电子设备基于所述目标参数去除所述第二噪声模型中的所述第一数量的混淆层，从而得到所述第一噪声模型，并去除所述第一噪声模型中的所述随机掩码，得到所述待部署模型；
    其中，所述目标参数包括所述第一随机数种子和所述第二随机数种子。
  13. 根据权利要求12所述的装置，其中，所述掩码模块，具体用于采用所述随机掩码对待部署模型的全部模型权重进行掩码处理，得到第一噪声模型。
  14. 根据权利要求12所述的装置，其中，所述目标参数还包括：由第一字符和第二字符构建的筛选掩码，其中，所述筛选掩码的每一字符对应所述待部署模型的一个模型权重；
    所述掩码模块，具体用于采用所述随机掩码对所述待部署模型的目标模型权重进行掩码处理，得到第一噪声模型；
    其中，所述目标模型权重为所述待部署模型中的对应所述第一字符的模型权重。
  15. 根据权利要求12所述的装置，其中，所述目标参数还包括：第三随机数种子，所述掩码模块，具体用于采用所述随机掩码对第二数量的目标模型层的模型权重进行掩码处理，得到第一噪声模型；
    其中，每一所述目标模型层在所述待部署模型中的层数与第二集合中的一个元素相等，所述第二集合包括基于所述第三随机数种子生成的第二数量的随机数。
  16. 根据权利要求12所述的装置，其中，所述目标参数还包括：所述第二噪声模型的数字签名。
  17. 根据权利要求12所述的装置，其中，所述发送模块，包括：
    第一发送单元，用于将所述第二噪声模型发送至所述第二电子设备；
    第二发送单元，用于在接收到所述第二电子设备发送的目标请求的情况下，将所述目标参数发送至所述第二电子设备；
    其中，所述目标请求为所述第二电子设备在本地处于可信执行环境下发送的用于请求目标密钥的请求，所述目标密钥包括所述目标参数。
  18. 一种模型部署的装置，应用于第二电子设备，所述装置包括：
    接收模块，用于接收第一电子设备发送的目标参数和第二噪声模型，其中，所述目标参数包括第一随机数种子和第二随机数种子；所述第二噪声模型为第一噪声模型的多个模型层与第一数量的混淆层进行拼接得到的模型；所述第一噪声模型为采用随机掩码对待部署模型进行掩码处理得到的模型，所述随机掩码为基于所述第一随机数种子生成的掩码；所述混淆层为预设模型库中的模型层，每一所述混淆层在所述第二噪声模型中的层数与第一集合中的一个元素相等，所述第一集合包括基于所述第二随机数种子生成的第一数量的随机数；
    第一去噪模块，用于基于所述目标参数去除所述第二噪声模型中的所述第一数量的混淆层，得到所述第一噪声模型；
    第二去噪模块，用于基于所述目标参数去除所述第一噪声模型中的所述随机掩码，得到所述待部署模型。
  19. 根据权利要求18所述的装置，其中，所述目标参数还包括：由第一字符和第二字符构建的筛选掩码，其中，所述筛选掩码的每一字符对应所述待部署模型的一个模型权重；
    所述第二去噪模块，包括：
    筛选单元，用于基于所述筛选掩码，确定所述第一噪声模型中的第一噪声模型权重，其中，所述第一噪声模型权重在所述第一噪声模型中的位置与目标模型权重在所述待部署模型中的位置相同，所述目标模型权重为所述待部署模型中的对应所述第一字符的模型权重；
    第一随机数种子单元，用于基于所述第一随机数种子，生成所述随机掩码；
    第一去噪单元，用于基于所述随机掩码对所述第一噪声模型中的所述第一噪声模型权重进行去掩码处理，得到所述待部署模型。
  20. 根据权利要求18所述的装置，其中，所述目标参数还包括：第三随机数种子；
    所述第二去噪模块，包括：
    第二随机数种子单元，用于基于所述第三随机数种子，生成第二数量的随机数；
    确定单元，用于基于所述第二数量的随机数，确定所述第一噪声模型中第二数量的噪声模型层；其中，每一所述噪声模型层在所述第一噪声模型中的层数与所述第二数量的随机数中的一个随机数相等；
    第三随机数种子单元，用于基于所述第一随机数种子，生成所述随机掩码；
    第二去噪单元，用于基于所述随机掩码对第二噪声模型权重进行去掩码处理，得到所述待部署模型；其中，所述第二噪声模型权重为所述第二数量的噪声模型层的模型权重。
  21. 根据权利要求18所述的装置，其中，所述目标参数还包括：所述第二噪声模型的数字签名；
    所述第一去噪模块，具体用于在所述数字签名通过验签的情况下，基于所述目标参数去除所述第二噪声模型中的所述第一数量的混淆层，得到所述第一噪声模型。
  22. 根据权利要求18所述的装置，其中，所述接收模块，具体用于：
    接收第一电子设备发送的所述第二噪声模型；
    在所述第二电子设备本地处于可信执行环境下，发送用于请求目标密钥的第一请求，其中，所述目标密钥包括所述目标参数；
    接收所述第一电子设备基于所述第一请求返回的所述目标密钥。
  23. 一种电子设备，包括处理器和存储器，所述存储器存储可在所述处理器上运行的程序或指令，所述程序或指令被所述处理器执行时实现如权利要求1-6任一项所述的模型部署的方法或如权利要求7-11任一项所述的模型部署的方法的步骤。
  24. 一种可读存储介质，所述可读存储介质上存储程序或指令，所述程序或指令被处理器执行时实现如权利要求1-6任一项所述的模型部署的方法或如权利要求7-11任一项所述的模型部署的方法的步骤。
PCT/CN2024/071178 2023-01-13 2024-01-08 模型部署的方法、装置及电子设备 Ceased WO2024149202A1 (zh)

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN202310077523.5 2023-01-13
CN202310077523.5A CN116010911A (zh) 2023-01-13 2023-01-13 模型部署的方法、装置及电子设备

Publications (1)

Publication Number Publication Date
WO2024149202A1 true WO2024149202A1 (zh) 2024-07-18

Family

ID=86030180

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2024/071178 Ceased WO2024149202A1 (zh) 2023-01-13 2024-01-08 模型部署的方法、装置及电子设备

Country Status (2)

Country Link
CN (1) CN116010911A (zh)
WO (1) WO2024149202A1 (zh)

Cited By (1)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN119182525A (zh) * 2024-09-19 2024-12-24 国网山东省电力公司电力科学研究院 基于扩散模型的密钥生成方法、装置、电子设备及介质

Families Citing this family (1)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN116010911A (zh) * 2023-01-13 2023-04-25 维沃移动通信有限公司 模型部署的方法、装置及电子设备

Citations (6)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN112749392A (zh) * 2021-01-07 2021-05-04 西安电子科技大学 一种联邦学习中异常节点的检测方法及系统
US20210256309A1 (en) * 2020-02-18 2021-08-19 Xain Ag Apparatuses, computer program products, and computer-implemented methods for privacy-preserving federated learning
US20210406589A1 (en) * 2020-06-26 2021-12-30 Amazon Technologies, Inc. Task-based image masking
CN115168841A (zh) * 2021-04-02 2022-10-11 华为技术有限公司 一种威胁检测方法、装置及系统
CN115238827A (zh) * 2022-09-16 2022-10-25 支付宝(杭州)信息技术有限公司 保护隐私的样本检测系统训练方法及装置
CN116010911A (zh) * 2023-01-13 2023-04-25 维沃移动通信有限公司 模型部署的方法、装置及电子设备

Patent Citations (6)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20210256309A1 (en) * 2020-02-18 2021-08-19 Xain Ag Apparatuses, computer program products, and computer-implemented methods for privacy-preserving federated learning
US20210406589A1 (en) * 2020-06-26 2021-12-30 Amazon Technologies, Inc. Task-based image masking
CN112749392A (zh) * 2021-01-07 2021-05-04 西安电子科技大学 一种联邦学习中异常节点的检测方法及系统
CN115168841A (zh) * 2021-04-02 2022-10-11 华为技术有限公司 一种威胁检测方法、装置及系统
CN115238827A (zh) * 2022-09-16 2022-10-25 支付宝(杭州)信息技术有限公司 保护隐私的样本检测系统训练方法及装置
CN116010911A (zh) * 2023-01-13 2023-04-25 维沃移动通信有限公司 模型部署的方法、装置及电子设备

Cited By (1)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN119182525A (zh) * 2024-09-19 2024-12-24 国网山东省电力公司电力科学研究院 基于扩散模型的密钥生成方法、装置、电子设备及介质

Also Published As

Publication number Publication date
CN116010911A (zh) 2023-04-25

Similar Documents

Publication Publication Date Title
CN111241580B (zh) 一种基于可信执行环境的联邦学习方法
CN110492990B (zh) 区块链场景下的私钥管理方法、装置及系统
JP6771565B2 (ja) ウェブページ、ウェブアプリ、およびアプリケーションをセキュリティ保護すること
US20170116410A1 (en) Software protection
WO2024149202A1 (zh) 模型部署的方法、装置及电子设备
CN113722683B (zh) 模型保护方法、装置、设备、系统以及存储介质
CN114598541A (zh) 一种安全评估方法及装置、电子设备和可读存储介质
CN112308236A (zh) 用于处理用户请求的方法、装置、电子设备及存储介质
CA2983166A1 (en) Generating cryptographic function parameters based on an observed astronomical event
JP2023542574A (ja) モデル保護方法、装置、機器、システム、記憶媒体及びプログラム
CN110765470A (zh) 安全键盘实现方法、装置、计算机设备及存储介质
KR20070057968A (ko) 랜덤 함수를 이용한 비밀 공유
CN119515546A (zh) 一种基于Web3框架的数字资产管控平台、设备及介质
CN115549906A (zh) 基于区块链的隐私计算方法、系统、设备和介质
CN115730319B (zh) 数据处理方法、装置、计算机设备和存储介质
CN120675883A (zh) 模型推理方法、模型加密方法、电子设备和存储介质
EP3278259B1 (en) Data protection
WO2021140574A1 (ja) 情報処理装置、情報処理方法及び情報処理プログラム
Rahaman et al. Keylogger threat to the android mobile banking applications
AlShawi Applying data mining techniques to improve information security in the cloud: a single cache system approach
CN112866226B (zh) 网络安全防护方法和装置
CN115834791B (zh) 利用矩阵密钥的图像加解密传输方法和电子设备
CN121923875A (zh) 一种异常用户识别方法及装置
Guo et al. Backdoor-Based Protection Framework for Model Functional Services
Holmes Cryptographic Authentication for Private RAG-Enabled LLMs

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 24741201

Country of ref document: EP

Kind code of ref document: A1

NENP Non-entry into the national phase

Ref country code: DE

122 Ep: pct application non-entry in european phase

Ref document number: 24741201

Country of ref document: EP

Kind code of ref document: A1