Secure machine learning model processing
A data processing method, apparatus and system are disclosed. The method includes: splitting a preset data processing module from a machine learning model, to generate a security application module configured for performing encryption calculation on data input into the machine learning model; taking, through a preset operator, an output value of an operation layer in the split machine learning model as an input value to be input into the security application module, and inputting the input value into the security application module; performing, through the security application module, subgraph calculation in an isolated operating environment according to the input value, to obtain a calculation result; returning the calculation result to the preset operator. The present application solves the technical problem of high computational pressure of TEE model due to that different reasoning frameworks need to be adapted to different customer requirements in the TEE model in related technologies.
1 . A data processing method, comprising:
splitting, by a preset tool, a preset data processing module from a machine learning model;
generating a security application module according to the preset data processing module, wherein the security application module is configured for performing an encryption calculation on data input into the machine learning model, and wherein the generating the security application module according to the preset data processing module further comprises:
optimizing and encrypting, by a heterogeneous accelerated compiler, the preset data processing module, to obtain the security application module;
taking, through a preset operator, an output value of an operation layer in the split machine learning model as an input value to be input into the security application module, and inputting the input value into the security application module;
performing, through the security application module, a subgraph encryption calculation in an isolated operating environment according to the input value, to obtain a calculation result; and
returning the calculation result to the preset operation.
2 . The method of claim 1 , wherein the optimizing and encrypting, by the heterogeneous accelerated compiler, the preset data processing module, to obtain the security application module, comprises:
configuring a network structure in the machine learning model to a specified position of the security application module; and
encrypting the specified position of the security application module, to obtain the encrypted security application module.
3 . The method of claim 1 , wherein the taking, through the preset operator, the output value of the operation layer in the split machine learning model as the input value to be input into the security application module, and inputting the input value into the security application module, comprises:
in a case where the operation layer comprises a first operation layer, acquiring, through the preset operator, an output value of the first operation layer in the split machine learning model;
taking the output value as the input value to be input into the security application module; and
inputting the input value into the security application module.
4 . The method of claim 3 , wherein the performing, through the security application module, the subgraph encryption calculation in the isolated operating environment according to the input value, to obtain the calculation result, comprises:
detecting, according to the input value, whether there is use authorization for the split machine learning model;
in a case where it is detected that there is the use authorization for the split machine learning model, or in a case where it is detected that no authorization is required for the split machine learning model, performing, through the security application module, the subgraph encryption calculation in the isolated operating environment according to the input value, to obtain the calculation result; and
in a case where it is detected that there is no use authorization for the split machine learning model, stopping the calculation.
5 . The method of claim 4 , wherein the performing, through the security application module, the subgraph encryption calculation in the isolated operating environment according to the input value, to obtain the calculation result, comprises:
allocating a corresponding application program interface according to the input value, and performing the subgraph encryption calculation in the isolated operating environment according to the input value, to obtain the calculation result.
6 . The method of claim 5 , wherein the returning the calculation result to the preset operator, comprises:
in a case where the operation layer further comprises a second operation layer, inputting, through the preset operator, the calculation result into the second operation layer in the split machine learning model, wherein the first operation layer is before the preset operator, and the second operation layer is after the preset operator.
7 . A non-transitory computer readable storage medium, comprising a stored program, wherein the program, when running, controls a device where the non-transitory computer readable storage medium is configured to perform the method of claim 1 .
8 . A processor, configured for running a program, wherein the program, when running, performs the method of claim 1 .
9 . A data processing method, applied to an artificial intelligence chip, comprising:
splitting, by the artificial intelligence chip and via a preset tool, a preset data processing module from a machine learning model;
generating a security application module according to the preset data processing module, wherein the generating the security application module according to the preset data processing module comprises:
optimizing and encrypting, by a heterogeneous accelerated compiler, the preset data processing module, to obtain the security application module;
acquiring, by the artificial intelligence chip, an output value of an operation layer in the split machine learning model through a preset operator, taking the acquired output value as an input value to be input into the security application module, and inputting the input value into the security application module; and
performing, by the artificial intelligence chip, an encryption calculation on the input value through the security application module, to obtain a calculation result, and returning the calculation result to the preset operator.
10 . A data processing system, comprising:
a memory storing computer executable instructions; and
a processor configured to execute the computer executable instructions stored in the memory to perform operations, the operations comprising:
splitting, by a preset tool, a preset data processing module from a machine learning model;
generating a security application module according to the preset data processing module, wherein the security application module is configured for performing an encryption calculation on data input into the machine learning model, and wherein generating the security application module further comprises:
optimizing and encrypting, by a heterogeneous accelerated compiler, the preset data processing module, to obtain the security application module;
taking, through a preset operator, an output value of an operation layer in the split machine learning model as an input value to be input into the security application module, and inputting the input value into the security application module;
performing, through the security application module, a subgraph encryption calculation in an isolated operating environment according to the input value, to obtain a calculation result; and
returning the calculation result to the preset operator.
11 . The system of claim 10 , wherein the processor is further configured to perform operations comprising:
configuring a network structure in the machine learning model to a specified position of the security application module; and
encrypting the specified position of the security application module, to obtain the encrypted security application module.
12 . The system of claim 10 , wherein the processor is further configured to perform operations comprising:
in a case where the operation layer in the split machine learning module comprises a first operation layer, acquiring, through the preset operator, an output value of the first operation layer in the split machine learning model;
taking the output value as the input value to be input into the security application module; and
inputting the input value into the security application module.
13 . The system of claim 12 , wherein the processor is further configured to perform operations comprising:
detecting, according to the input value, whether there is use authorization for the split machine learning model;
in a case where it is detected that there is the use authorization for the split machine learning model, or in a case where it is detected that no authorization is required for the split machine learning model, performing, through the security application module, the encryption calculation in the isolated operating environment according to the input value, to obtain the calculation result; and
in a case where it is detected that there is no use authorization for the split machine learning model, stopping the calculation.
14 . The system of claim 13 , wherein the processor is further configured to perform operations comprising:
allocating a corresponding application program interface according to the input value, and performing the encryption calculation in the isolated operating environment according to the input value, to obtain the calculation result.
15 . The system of claim 14 , wherein the processor is further configured to perform operations comprising:
in a case where the operation layer further comprises a second operation layer, inputting, through the preset operator, the calculation result into the second operation layer in the split machine learning model, wherein the first operation layer is before the preset operator, and the second operation layer is after the preset operator.