Method and system of protecting model, device, and storage medium
View Patent ↗A method of protecting a model, which relates to a field of computer, a field of artificial intelligence, and may be applied to an AI model protection scenarios. The method includes: generating a WASM file for providing a runtime environment for a target model, the WASM file containing a corresponding model inference algorithm and security verification algorithm, wherein the security verification algorithm is configured to perform at least one security verification operation to protect the target model, the at least one security verification operation is selected from: a verification of a host environment; a verification of an integrity of the WASM file; a verification of an integrity of the model file generated corresponding to an original model file of the target model; a timeout verification of a specified inference process during a model inference process; or a timeout verification of an entire inference process during the model inference process.
1. A method of protecting a model, the method comprising:
generating a WASM file, wherein the WASM file is configured to provide a runtime environment for a target model, and the WASM file contains a corresponding model inference algorithm and a corresponding security verification algorithm,
wherein the security verification algorithm is configured to perform at least one security verification operation to protect the target model, the at least one security verification operation is selected from:
a verification of a host environment;
a verification of an integrity of the WASM file;
a verification of an integrity of a model file, wherein the model file is an encrypted file generated corresponding to an original model file of the target model;
a timeout verification of a specified inference process during a model inference process; or
a timeout verification of an entire inference process during the model inference process,
wherein the model file is obtained by:
determining a topology of the target model based on the original model file;
obfuscating attributes of operators in the topology and dependencies between the operators to obtain an intermediate product of the original model file; and
encrypting the intermediate product to obtain the model file.
2. The method according to claim 1 , further comprising at least one selected from:
encrypting the WASM file to obtain an encrypted WASM file;
encrypting a model configuration information of the target model to obtain an encrypted model configuration information; or
encrypting weight data of the target model to obtain encrypted weight data,
wherein the WASM file further contains a corresponding decryption algorithm, and the decryption algorithm is configured to decrypt at least one selected from: the encrypted model file, the encrypted model configuration information, or the encrypted weight data.
3. The method according to claim 2 , further comprising encrypting a key for decryption to obtain an encrypted key.
4. The method according to claim 3 , further comprising, for the target model, configuring an access key identifier for each of at least one user.
5. The method according to claim 2 , further comprising, for the target model, configuring an access key identifier for each of at least one user.
6. The method according to claim 1 , further comprising, for the target model, configuring an access key identifier for each of at least one user.
7. An electronic device, comprising:
at least one processor; and
a memory communicatively connected to the at least one processor, wherein the memory stores instructions executable by the at least one processor, and the instructions, when executed by the at least one processor, cause the at least one processor to implement the method according to claim 1 .
8. The electronic device according to claim 7 , wherein the instructions are further configured to cause the at least one processor to at least:
encrypt the WASM file to obtain an encrypted WASM file; and/or
encrypt a model configuration information of the target model to obtain an encrypted model configuration information; and/or
encrypt weight data of the target model to obtain encrypted weight data,
wherein the WASM file further contains a corresponding decryption algorithm, and the decryption algorithm is configured to decrypt at least one selected from: the encrypted model file, the encrypted model configuration information, or the encrypted weight data.
9. A non-transitory computer-readable storage medium having computer instructions therein, wherein the computer instructions are configured to cause a computer system to implement the method according to claim 1 .
10. A method of protecting a model, the method comprising:
loading a model file generated corresponding to a target model;
loading a WASM file, wherein the WASM file is configured to provide a runtime environment for the target model;
transferring, during an instantiation running of the WASM file, the model file into the runtime environment to perform at least one security verification operation so as to activate a model protection mechanism for the target model, wherein the at least one security verification operation is selected from:
a verification of a host environment;
a verification of an integrity of the WASM file;
a verification of an integrity of the model file;
a timeout verification of a specified inference process during a model inference process; or
a timeout verification of an entire inference process during the model inference process,
wherein the model file is an encrypted file generated corresponding to an original model file of the target model, the model file is obtained by encrypting an intermediate product of the original model file, the intermediate product of the original model file is obtained by obfuscating attributes of operators in a topology of the target model and dependencies between the operators, and the topology of the target model is determined based on the original model file.
11. The method according to claim 10 , wherein the model file and the WASM file are acquired and loaded in response to a user authentication being successful.
12. The method according to claim 11 , wherein the WASM file is an encrypted file.
13. The method according to claim 10 , wherein the WASM file is an encrypted file.
14. The method according to claim 13 , further comprising: during the instantiation running of the WASM file,
decrypting an encrypted model file to obtain a decrypted model file, in response to a predetermined security verification being successful; and
performing a model inference based on the decrypted model file.
15. The method according to claim 14 , wherein the predetermined security verification comprises at least one selected from: a verification of a host environment, a verification of an integrity of the WASM file, or a verification of an integrity of the model file.
16. The method according to claim 14 , wherein the decrypting an encrypted model file comprises:
acquiring an encrypted key for decryption;
decrypting the encrypted key to obtain a decrypted key; and
decrypting the encrypted model file using the decrypted key.
17. An electronic device, comprising:
at least one processor; and
a memory communicatively connected to the at least one processor, wherein the memory stores instructions executable by the at least one processor, and the instructions, when executed by the at least one processor, cause the at least one processor to implement the method according to claim 10 .
18. A non-transitory computer-readable storage medium having computer instructions therein, wherein the computer instructions are configured to cause a computer system to implement the method according to claim 10 .
19. A system of protecting a model, comprising a client and a server,
wherein the client is configured to request a model information from the server; the server is configured to return a corresponding model information in response to the request of the client; and the client is configured to load a model file generated corresponding to a target model, load a WASM file configured to provide a runtime environment for the target model, and enable an instantiation running of the WASM file and transfer the model file into the runtime environment, based on the model information returned by the server, wherein the client and the server are computers, and
wherein the WASM file is configured to perform at least one security verification operation during the instantiation running to activate a model protection mechanism for the target model, the at least one security verification operation is selected from:
a verification of a host environment;
a verification of an integrity of the WASM file;
a verification of an integrity of the model file;
a timeout verification of a specified inference process during a model inference process; or
a timeout verification of an entire inference process during the model inference process,
wherein the model file is an encrypted file generated corresponding to an original model file of the target model, the model file is obtained by encryption of an intermediate product of the original model file, the intermediate product of the original model file is obtained by obfuscation of attributes of operators in a topology of the target model and dependencies between the operators, and the topology of the target model is determined based on the original model file.
20. The system according to claim 19 , wherein:
the client is configured to send an authentication request to the server before requesting the model information from the server;
the server is configured to perform an authentication operation and return an authentication result, in response to the authentication request from the client; and
the client is configured to request the model information from the server, in response to the authentication result indicating that an authentication is successful.