Model running methods and apparatuses
This specification discloses model running methods, apparatuses, computer-readable storage media and systems. In an example method, an original model is split to obtain a basic model and a trusted execution environment (TEE) model; and data of the basic model and data of the TEE model are delivered to a terminal device, so that a rich execution environment (REE) in the terminal device runs the data of the basic model, and a TEE in the terminal device runs the data of the TEE model.
1. A computer-implemented method, comprising:
splitting an original model to obtain a basic model and a trusted execution environment (TEE) model; and
delivering data of the basic model and data of the TEE model to a terminal device to enable a rich execution environment (REE) in the terminal device runs the data of the basic model, and a TEE in the terminal device runs the data of the TEE model;
wherein:
after obtaining the TEE model and before delivering the data of the TEE model to the terminal device, the computer-implemented method further comprises: encrypting the TEE model based on a pre-obtained encryption key to obtain an encrypted model; and
the data of the TEE model comprises the encrypted model;
wherein the delivering data of the basic model and data of the TEE model to a terminal device comprises:
encapsulating the encrypted model into a TEE operator;
generating a reconstructed model based on the basic model and the TEE operator; and
delivering the reconstructed model to the REE in the terminal device.
2. The computer-implemented method according to claim 1 , wherein the splitting an original model comprises at least one of:
splitting the original model based on a predetermined split ratio;
splitting a neural network used by the original model, and using the first M layers as the basic model and the last N layers as the TEE model, wherein a total quantity of layers of the neural network is M+N; or
splitting the original model based on a size of a running space of the TEE in the terminal device.
3. The computer-implemented method according to claim 1 , wherein the delivering data of the basic model and data of the TEE model to a terminal device comprises:
delivering the data of the basic model to the REE in the terminal device; and
delivering the data of the TEE model to the TEE in the terminal device by using a TEE dedicated channel.
4. A computer-implemented method, comprising:
receiving data of a basic model and data of a trusted execution environment (TEE) model, wherein the data of the basic model and the data of the TEE model are obtained after an original model is split into the basic model and the TEE model;
running the basic model by using a rich execution environment (REE); and
running the TEE model by using a TEE;
wherein:
the receiving data of a basic model and data of a TEE model comprises: receiving, by the REE, a reconstructed model, wherein the reconstructed model is generated based on the basic model and a TEE operator obtained by encapsulating an encrypted model;
the running the basic model by using an REE comprises: running, by the REE, the basic model in the reconstructed model; and
the running the TEE model by using a TEE comprises:
receiving, by the TEE, the TEE operator to from the REE;
decapsulating, by the TEE, the TEE operator to obtain the encrypted model;
decrypting, by the TEE, the encrypted model by using a pre-obtained decryption key to obtain the TEE model; and
running, by the TEE, the TEE model.
5. The computer-implemented method according to claim 4 , wherein the receiving data of a basic model and data of a TEE model comprises:
receiving, by the REE, the data of the basic model; and
receiving, by the TEE, the data of the TEE model by using a TEE dedicated channel.
6. The computer-implemented method according to claim 4 , wherein the data of the TEE model comprises the encrypted model generated after the TEE model is encrypted.
7. The computer-implemented method according to claim 4 , wherein the TEE operator is received from the REE in response to that the REE is not able to recognize the TEE operator when the REE runs to the TEE operator in the reconstructed model.
8. The computer-implemented method according to claim 4 , wherein after the running the TEE model by using a TEE, the computer-implemented method further comprises:
outputting, by the TEE to the outside of the TEE, a feature vector obtained after running the TEE model.
9. The computer-implemented method according to claim 4 , wherein after the running the TEE model by using a TEE, the computer-implemented method further comprises: obtaining, by the TEE, an identification result based on a feature vector obtained after running the TEE model, and outputting the identification result to the outside of the TEE.
10. A computer-implemented system comprising a terminal device that comprises:
one or more processors; and
one or more memory devices interoperably coupled with the one or more processors and having tangible, non-transitory, computer-readable storage media storing one or more instructions that, when executed by the one or more processors, perform operations comprising:
receiving data of a basic model and data of a trusted execution environment (TEE) model, wherein the data of the basic model and the data of the TEE model are obtained after an original model is split into the basic model and the TEE model;
running the basic model by using a rich execution environment (REE); and
running the TEE model by using a TEE;
wherein:
the receiving data of a basic model and data of a TEE model comprises: receiving, by the REE, a reconstructed model, wherein the reconstructed model is generated based on the basic model and a TEE operator obtained by encapsulating an encrypted model;
the running the basic model by using an REE comprises: running, by the REE, the basic model in the reconstructed model; and
the running the TEE model by using a TEE comprises:
receiving, by the TEE, the TEE operator to from the REE;
decapsulating, by the TEE, the TEE operator to obtain the encrypted model;
decrypting, by the TEE, the encrypted model by using a pre-obtained decryption key to obtain the TEE model; and
running, by the TEE, the TEE model.
11. The computer-implemented system according to claim 10 , wherein the receiving data of a basic model and data of a TEE model comprises:
receiving, by the REE, the data of the basic model; and
receiving, by the TEE, the data of the TEE model by using a TEE dedicated channel.
12. The computer-implemented system according to claim 10 , wherein the data of the TEE model comprises the encrypted model generated after the TEE model is encrypted.
13. The computer-implemented system according to claim 10 , further comprising a server that comprises:
one or more second processors; and
one or more second memory devices interoperably coupled with the one or more second processors and having second tangible, non-transitory, computer-readable storage media storing one or more second instructions that, when executed by the one or more second processors, perform second operations comprising:
splitting the original model to obtain the basic model and the TEE model; and
delivering data of the basic model and data of the TEE model to the terminal device to enable the REE in the terminal device runs the data of the basic model, and the TEE in the terminal device runs the data of the TEE model.
14. The computer-implemented system according to claim 13 , wherein the splitting an original model comprises at least one of:
splitting the original model based on a predetermined split ratio;
splitting a neural network used by the original model, and using the first M layers as the basic model and the last N layers as the TEE model, wherein a total quantity of layers of the neural network is M+N; or
splitting the original model based on a size of a running space of the TEE in the terminal device.
15. The computer-implemented system according to claim 13 , wherein the delivering data of the basic model and data of the TEE model to a terminal device comprises:
delivering the data of the basic model to the REE in the terminal device; and
delivering the data of the TEE model to the TEE in the terminal device by using a TEE dedicated channel.
16. The computer-implemented system according to claim 13 , wherein:
after obtaining the TEE model and before delivering the data of the TEE model to the terminal device, the second operations further comprise encrypting the TEE model based on a pre-obtained encryption key to obtain the encrypted model,
the data of the TEE model comprises the encrypted model; and
the delivering data of the basic model and data of the TEE model to a terminal device comprises:
encapsulating the encrypted model into the TEE operator;
generating the reconstructed model based on the basic model and the TEE operator; and
delivering the reconstructed model to the REE in the terminal device.