WO2022261878A1 - Method for using artificial intelligence model and related apparatus - Google Patents

Abstract

A method and apparatus for using an artificial intelligence (AI) model, which can be applied to the field of AI. In the use method, a master chip sends an encrypted AI model to an AI chip. The encrypted AI model is a model obtained by the AI chip encrypting a first AI model by using a trusted root. The AI chip decrypts the encrypted AI model by using the trusted root so as to obtain the first AI model. Then, the AI chip performs inference by using the first AI model so as to obtain an inference result. Finally, the master chip receives the inference result obtained through inference by the AI chip using the first AI model. According to the method, by encrypting and decrypting the first AI model by means of the trusted root, the security of a use environment of AI models is ensured, while preventing the problem of excessively high software and hardware costs during the encryption and decryption of AI models in existing technology.

Description

Method for using artificial intelligence model and related device technical field

The present application relates to the technical field of artificial intelligence, in particular to a method for using an artificial intelligence model and related devices.

Background technique

Artificial intelligence (AI) is a theory, method, technology and application system that uses digital computers or machines controlled by digital computers to simulate, extend and expand human intelligence, perceive the environment, acquire knowledge and use knowledge to obtain the best results. In other words, artificial intelligence is the branch of computer science that attempts to understand the nature of intelligence and produce a new class of intelligent machines that respond in ways similar to human intelligence. Artificial intelligence is to study the design principles and implementation methods of various intelligent machines, so that various intelligent machines have the functions of perception, reasoning and decision-making.

Usually, the design principles and implementation methods of the above-mentioned intelligent machines all rely on the AI model obtained after training and processing of big data, and the AI model is stored in the operating environment of the AI application in the form of a file. However, AI models, as the core assets of AI applications, need to be strictly protected in the actual operating environment to prevent them from being stolen.

At present, a commonly used AI model protection method is mainly realized by software, that is, the trained AI model is encrypted and decrypted inside the AI application, and then the decrypted AI model is sent to the AI chip, and the AI chip performs Reasoning; another commonly used method is realized through a hardware dongle. After the hardware dongle receives the encrypted AI model sent by the AI chip, it decrypts it, and then sends the decrypted AI model to the AI chip. Then reasoning; however, in the process of use, it is found that the security of these two commonly used methods is not high.

Contents of the invention

The present application provides a method and device for using an AI model, which can improve the security of the AI model without increasing hardware costs.

In the first aspect, the present application provides a method for using an AI model, the method is applied to an AI chip, and the method includes: receiving an encrypted AI model from the main chip; decrypting the encrypted AI model to obtain the first AI model; use the first AI model to perform inference to obtain an inference result; send the inference result to the main chip.

In this method, compared with decryption by other chips or dongles other than the AI chip, since the decryption of the AI model is performed on the AI chip, the decrypted AI model is directly used by the AI chip, so it avoids The problem that the decrypted AI model is intercepted or stolen during the transmission process, that is to say, greatly reduces the risk of leakage of the AI model and improves security.

With reference to the first aspect, in a first possible implementation manner, the decrypting the encrypted AI model includes: using a trusted root stored in a secure storage area of the AI chip to decrypt the encrypted AI model decrypt.

In this implementation, since the root of trust is stored in the secure storage area of the AI chip, it can only be read and used by the AI chip itself, and cannot be obtained from the outside. That is to say, the re-encrypted AI model can only be used in the The AI chip is decrypted and run, so the security of the AI model can be further improved.

With reference to the first possible implementation manner, in a second possible implementation manner, before the AI chip receives the encrypted AI model, the method further includes: receiving the first AI model from the main chip; using The root of trust encrypts the first AI model to obtain the encrypted AI model; and sends the encrypted AI model to the main chip.

In this implementation, the AI chip can automatically realize the encryption protection of the AI model, without deploying a special hardware dongle, etc., which can reduce the complexity of the user's implementation of the AI model hardware-level protection scheme.

In a second aspect, the present application provides a method for using an artificial intelligence AI model, the method is applied to the main chip, and the method includes: sending an encrypted AI model to the AI chip, and the encrypted AI model is the AI chip pair A model obtained by encrypting the first AI model; receiving an inference result from the AI chip, where the inference result is an inference result obtained by the AI chip using the first AI model for inference.

With reference to the second aspect, in a first possible implementation manner, before sending the encrypted AI model to the AI chip, the method further includes: sending the first AI model to the AI chip; receiving the AI chip The encrypted AI model obtained by encrypting the first AI model using a root of trust; storing the encrypted AI model.

With reference to the first possible implementation manner, in a second possible implementation manner, the root of trust is a root of trust stored in a secure storage area of the AI chip.

In a third aspect, the present application provides a device for using an artificial intelligence AI model, the device is applied to the AI chip side, and the device includes: a receiving module for receiving the encrypted AI model from the main chip; a decryption module for The encrypted AI model is decrypted to obtain a first AI model; the reasoning module is used to use the first AI model to perform reasoning to obtain a reasoning result; the sending module is used to send the reasoning result to the main chip.

With reference to the third aspect, in a first possible implementation manner, the decryption module is configured to decrypt the encrypted AI model, including: the decryption module is configured to use the data stored in the secure storage area of the AI chip The root of trust decrypts the encrypted AI model.

With reference to the first possible implementation, in the second possible implementation, before the AI chip receives the encrypted AI model, the device further includes: an encryption module; the receiving module is also configured to receive the encrypted AI model from the The first AI model of the main chip; the encryption module is used to encrypt the first AI model by using the root of trust to obtain the encrypted AI model; the sending module is also used to send to the The main chip sends the encrypted AI model.

In a fourth aspect, the present application provides a device for using an artificial intelligence AI model, the device is applied to the main chip side, and the device includes: a sending module for sending an encrypted AI model to the AI chip, and the encrypted AI model is the A model obtained by encrypting the first AI model by the AI chip; the receiving module is used to receive an inference result from the AI chip, and the inference result is an inference result obtained by the AI chip using the first AI model for inference .

With reference to the fourth aspect, in a first possible implementation manner, before the sending module is configured to send the encrypted AI model to the AI chip, the device further includes: a storage module; the sending module is also configured to send the encrypted AI model to the AI chip. The chip sends the first AI model; the receiving module is also used to receive the encrypted AI model obtained by encrypting the first AI model by the AI chip using a root of trust; the storage module is used to store the Encrypted AI model described above.

With reference to the first possible implementation manner, in a second possible implementation manner, the root of trust is a root of trust stored in a secure storage area of the AI chip.

In a fifth aspect, the present application provides an AI chip, the AI chip includes a processor coupled to a memory, and the processor is used to execute the program code in the memory, so as to realize the first aspect or any one of the possible method in the implementation.

In a sixth aspect, the present application provides a chip, the chip includes a processor coupled to a memory, and the processor is configured to execute program codes in the memory to implement the second aspect or any one of the possible implementations method in .

In a seventh aspect, the present application provides a computer-readable storage medium, in which computer programs or instructions are stored, and when the computer programs or instructions are executed by a processor, the first aspect or the second aspect or A method in any of the possible implementations.

In an eighth aspect, the present application provides a computer program product, the computer program product includes computer program code, and when the computer program code is run on a computer, the computer implements the first aspect or the second aspect or A method in any of the possible implementations.

Description of drawings

Figure 1 is a schematic diagram of a convolutional neural network architecture;

FIG. 2 is an architecture diagram of an application scenario of an embodiment of the present application;

Fig. 3 is a schematic diagram of deployment of a dedicated hardware dongle in the prior art;

FIG. 4 is a schematic flowchart of a method for using an AI model according to an embodiment of the present application;

FIG. 5 is a schematic flowchart of a method for using an AI model according to another embodiment of the present application;

FIG. 6 is a schematic flowchart of a method for using an AI model according to another embodiment of the present application;

FIG. 7 is a schematic diagram of a device for using an AI model according to an embodiment of the present application;

FIG. 8 is a schematic diagram of an AI model using device according to another embodiment of the present application;

Fig. 9 is a schematic block diagram of a device provided by an embodiment of the present application.

detailed description

The implementation of the embodiment of the present application will be described in detail below with reference to the accompanying drawings.

For ease of understanding, the "AI model" involved in the embodiment of the present application is introduced first with reference to FIG. 1 .

As mentioned earlier, the AI model can be regarded as the core of an intelligent machine. Based on different types of AI models, intelligent machines can be applied in various fields, such as natural language processing, computer vision, decision-making and reasoning, human-computer interaction, recommendation and search etc. At present, the more popular AI models include convolutional neural network (CNN), linear regression model, etc.

The AI model is introduced below by taking the convolutional neural network as an example. It should be noted that the method in the embodiment of the present application can also be applied to other AI models. Figure 1 is a schematic diagram of a convolutional neural network architecture. The CNN 100 shown in FIG. 1 includes an input layer 110 , a convolutional/pooling layer 120 , where the pooling layer is optional, and a neural network layer 130 .

As shown in Figure 1, the convolutional layer/pooling layer 120 may include layers 121 to 126 as examples. In one implementation, the 121st layer is a convolutional layer, the 122nd layer is a pooling layer, the 123rd layer is a convolutional layer, and the 124th layer is a convolutional layer. Layer is a pooling layer, 125 is a convolutional layer, and 126 is a pooling layer; in another implementation, 121 and 122 are convolutional layers, 123 is a pooling layer, 124 and 125 are convolutional layers, and 126 is pooling layer. That is, the output of the convolutional layer can be used as the input of the subsequent pooling layer, or as the input of another convolutional layer to continue the convolution operation.

The convolutional layer in the convolutional layer/pooling layer 120 may include many convolutional operators, and the convolutional operator is also called a kernel, and its role in image processing is equivalent to a method for extracting specific information from the input image matrix. Filters, convolution operators can essentially be a weight matrix, this weight matrix is usually pre-defined, in the process of convolution operation on the image, the weight matrix is usually pixel by pixel along the horizontal direction on the input image (or two pixels followed by two pixels...it depends on the value of the stride) to complete the work of extracting specific features from the image. The size of the weight matrix should be related to the size of the image. It should be noted that the depth dimension of the weight matrix is the same as the depth dimension of the input image. During the convolution operation, the weight matrix will be extended to The entire depth of the input image. Thus, convolving with a single weight matrix produces a convolutional output with a single depth dimension, but in most cases instead of using a single weight matrix, multiple weight matrices of the same dimension are applied. The output of each weight matrix is stacked to form the depth dimension of the convolved image. Different weight matrices can be used to extract different features in the image. For example, one weight matrix is used to extract image edge information, another weight matrix is used to extract specific colors of the image, and another weight matrix is used to filter unwanted noise in the image. Perform fuzzification...the dimensions of the multiple weight matrices are the same, and the dimension of the feature maps extracted by the weight matrices with the same dimensions are also the same, and then the extracted feature maps with the same dimensions are combined to form the output of the convolution operation .

The weight values in these weight matrices need to be obtained through a lot of training in practical applications, and each weight matrix formed by the weight values obtained through training can extract information from the input image, thereby helping the convolutional neural network 100 to make correct predictions.

When the convolutional neural network 100 has multiple convolutional layers, the initial convolutional layer often extracts more general features, which can also be referred to as low-level features; with the depth of the convolutional neural network 100 Deepen, the features extracted by the later convolutional layers (such as 126) become more and more complex, such as high-level semantic features, and the higher semantic features are more suitable for the problem to be solved. For example, when the layers indicated by 121 and 126 are convolutional layers, the initial convolutional layer may be 121 , and the subsequent convolutional layer may be 126 .

The pooling layer in the convolutional layer/pooling layer 120 often needs to reduce the number of training parameters, so it is often necessary to periodically introduce the pooling layer after the convolutional layer, that is, the 121 to 126 exemplified by 120 in FIG. 1 Layer, which can be a convolutional layer followed by a pooling layer, or a multi-layer convolutional layer followed by one or more pooling layers. In image processing, the sole purpose of pooling layers is to reduce the spatial size of the image. The pooling layer may include an average pooling operator and/or a maximum pooling operator for sampling an input image to obtain an image of a smaller size. The average pooling operator can calculate the average value of the pixel values in the image within a specific range. The maximum pooling operator can take the pixel with the largest value within a specific range as the result of maximum pooling. Also, just like the size of the weight matrix used in the convolutional layer should be related to the size of the image, the operators in the pooling layer should also be related to the size of the image. The size of the image output after being processed by the pooling layer may be smaller than the size of the image input to the pooling layer, and each pixel in the image output by the pooling layer represents the average or maximum value of the corresponding sub-region of the image input to the pooling layer.

The neural network layer 130, after being processed by the convolutional layer/pooling layer 120, the convolutional neural network 100 is not enough to output the required output information. Because as mentioned earlier, the convolutional/pooling layer 120 only extracts features and reduces the dimensionality of the input data. However, in order to generate the final output data (required class information or other relevant information), the convolutional neural network 100 needs to use the neural network layer 130 to generate one or a set of outputs of the required class number. Therefore, the neural network layer 130 may include multiple hidden layers (131, 132 to 13n as shown in FIG. 1 ) and an output layer 140, and the model parameters contained in the multi-layer hidden layers may be determined according to specific tasks. Types of related training data are pre-trained, for example, the task type can include image recognition, image classification, image super-resolution reconstruction, and so on.

After the multi-layer hidden layer in the neural network layer 130, that is, the last layer of the entire convolutional neural network 100 is the output layer 140, which has a loss function similar to the classification cross entropy, and is specifically used to calculate the prediction error, Once the forward propagation of the entire convolutional neural network 100 (as shown in Figure 1, the propagation from 110 to 140 is forward propagation), the backpropagation (as shown in Figure 1, the propagation from 140 to 110 is backward propagation) will start to update The aforementioned weight values and deviations of each layer are used to reduce the loss of the convolutional neural network 100 and the error between the result output by the convolutional neural network 100 through the output layer and the ideal result.

It should be noted that the convolutional neural network 100 shown in FIG. 1 is only an example of a convolutional neural network. In specific applications, the convolutional neural network can also exist in the form of other network models. For example, multiple Each convolutional layer/pooling layer is parallelized, and the features extracted respectively are input to the full neural network layer 130 for processing. The method in the embodiment of the present application can also be applied to CNNs with other structures.

It should be further noted that the "AI model" mentioned below only refers to the data processing process in the AI model, and does not include the model parameters used in the data processing process. For example, the AI model only refers to the convolution operations and pooling operations that need to be performed by each layer in the CNN shown in Figure 1, and does not include the weights involved in the convolution operations and pooling operations.

With the development of artificial intelligence and deep learning, more and more enterprises have deployed AI chips on electronic devices and used AI technology, that is, to achieve specific functions through AI models (such as CNN shown in Figure 1), for example, Fingerprint unlocking, image recognition, voice recognition, etc. Usually, in order to improve the competitiveness of the AI model, enterprises will invest a lot of material resources and manpower to collect and purchase data to increase the training scale of the AI model and optimize the training parameters of the AI model in order to enhance and optimize the AI model. From this, it can be seen that the AI model has become an asset of the enterprise.

The current artificial intelligence AI application based on deep neural network is mainly divided into two stages: training and reasoning. Specifically, the training is to train the initial neural network model into the target neural network model (AI model) through the training process of a large amount of data, so that it can be applied to the actual scene; and the reasoning is to apply the trained AI model to the actual The process of the scene.

Usually, the AI model is obtained after a huge investment in training, and is the core asset of the AI application, but it needs to be strictly protected in the actual running environment of the reasoning stage to prevent it from being stolen. Among them, the AI model is stored in the running environment of the AI application in the form of a file. The protection of the AI model file is mainly realized through encryption and decryption, that is, the AI model file is encrypted and stored, and when the AI reasoning application is running, the file is decrypted and used.

FIG. 2 is an architecture diagram of an application scenario according to an embodiment of the present application. As shown in FIG. 2 , the application scenario architecture diagram includes: a hardware device 200 , and the hardware device 200 includes: a main chip 201 and an AI chip 202 , where an AI application program is deployed on the main chip 201 .

As an example, the hardware device 200 may be an automatic driving box device of the vehicle; the main chip 201 may be the main controller of the vehicle, and the main chip 201 may contain an AI application program, such as an automatic driving program; the AI chip 202 may be an AI computing chips. It should be understood that the above descriptions are examples only.

Wherein, the AI model is deployed in the AI application program on the main chip 201 in the form of a file.

As an optional implementation, when the protection of the AI model is implemented through encryption and decryption, the implementation process of encryption and decryption can be implemented in the main chip 201, or in the AI chip 202, or can use other hardware devices.

There are mainly two encryption and decryption schemes for AI models in the prior art: a pure software scheme and a dedicated hardware dongle scheme.

Among them, the pure software solution is mainly to store the trained AI model in the storage (such as disk) of the operating environment in the form of ciphertext files after being encrypted by software. When the AI application is running, it reads the ciphertext and directly uses the key to decrypt it before using it. Keys are managed by the AI application itself and can be hardcoded or stored in configuration files.

For example, the AI application deployed on the main chip 201 carries a trained AI model, and the AI application uses related programs to encrypt the AI model, and then stores the encrypted AI model in the form of a ciphertext file in the operating environment. In storage, the key is hard-coded or stored in a file. When the AI application is running, the AI application itself directly uses the key to decrypt the encrypted AI model before using it.

Since the encryption and decryption process of this encryption and decryption scheme is implemented by pure software, that is to say, it needs to be implemented by the AI application itself, so this increases the implementation cost of the AI application; at the same time, the decryption key is hard-coded or stored in a file, which is easy to implement. It is reverse cracked; when the decrypted AI model is transmitted to the AI chip 202, there are also security issues, so the overall security of this solution is low.

In the special hardware dongle solution, the dongle is also called dongle. The dongle is an encryption product combined with software and hardware inserted into the parallel port of the computer. It is a popular security tool for identity authentication. Plug and unplug directly on the universal serial bus (USB) interface of the computer; for dongles, each dog has an independent product identification code and an independent latest encryption algorithm. When the user logs in to the platform, only the specific encryption is detected Normal login is only allowed after dog and accurate physical verification.

Fig. 3 is a schematic diagram of deployment of a dedicated hardware dongle in the prior art. As shown in Figure 3, the AI application is deployed on the host device. The host device can be understood as the main chip 201. At the same time, a dedicated hardware dongle module is deployed on the host device. When the AI model is running, the hardware dongle module decrypts the ciphertext of the AI model to obtain the plaintext of the AI model, and then sends the plaintext of the AI model back to the AI application, and the AI application will receive the AI model The plaintext is sent to the AI computing device for processing, where the AI computing device can be understood as the AI chip 202 .

It is understandable that during the use of the dedicated hardware dongle solution, since one or more dongles (models from different model manufacturers) need to be deployed on the AI application device, the cost is high and the deployment is complicated; and usually the dongle capability is weak , the encryption algorithm is less difficult than the public encryption algorithm, and the security is not very high; when the AI model decrypted by the hardware dongle is transmitted to the AI computing device, there are also security problems.

As an example, in an edge computing deployment scenario, for example, cameras, dongles, and AI models are all deployed on the cameras, and the cameras are generally outdoors, posing a risk of being stolen.

In view of this, this application provides a method for using the AI model, which realizes the purpose of strictly protecting the AI model, and avoids the need to increase the implementation cost of the AI application when protecting the AI model in the prior art, and the security is low. Using at least one dongle on a device deployed with an AI application results in increased hardware cost and deployment complexity as well as insecure issues in the process of transmitting the decrypted AI model to the AI chip.

Taking the schematic diagram of the application scenario shown in FIG. 2 as an example, the technical solution of the present application will be described in detail through the accompanying drawings and specific embodiments. It should be noted that the following specific embodiments may be combined with each other, and the same or similar concepts or processes may not be repeated in some embodiments.

FIG. 4 is a schematic flowchart of a method for using an artificial intelligence AI model provided by an embodiment of the present application. As shown in Fig. 4, the method may include S410 to S440. An example of the main chip in this method is the main chip 201 , and an example of the AI chip in this method is the AI chip 202 .

S410. The main chip sends the encrypted AI model to the AI chip. Correspondingly, the AI chip receives the encrypted AI model sent by the main chip, wherein the encrypted AI model is a model obtained by encrypting the first AI model by the AI chip.

For example, when the main chip needs the AI chip to use the first AI model to perform inference, the main chip may send the encrypted AI model obtained by encrypting the first AI model to the AI chip.

Taking the main chip and AI chip as the chips in the automatic driving box device, the main chip is deployed with an automatic driving program, and the automatic driving program is realized through the first AI model as an example. When the main chip runs the automatic driving program, the main chip An encrypted model of the first AI model may be sent to the AI chip.

As an example, the first AI model is the convolutional neural network model shown in FIG. 1 .

S420. The AI chip decrypts the encrypted AI model to obtain the first AI model.

After receiving the encrypted AI model sent by the main chip, the AI chip performs a decryption operation on the encrypted AI model, and obtains the first AI model after decryption.

S430. The AI chip uses the first AI model to perform inference to obtain an inference result.

It can be understood that the reasoning process is the process of applying the trained AI model to the actual scene. For example, the process of using a trained model to infer various conclusions using new data, that is, using the existing neural network model to perform calculations and using new input data to obtain correct conclusions at one time, can also be called prediction or inference.

As an example, in the actual scene, it is necessary to obtain real operating data from the operating equipment, also called field data, and then decode it through the built-in decoder of the CPU to obtain the input data required by the AI chip, and then pass it through the high-speed serial computer. The expansion bus standard (peripheral component interconnect express, PCIE) transmits the input data to the AI chip, and uses the first AI model for reasoning.

As another example, the first AI model is an algorithm that uses big data in advance to determine the optimal configuration parameters. The process of AI chip reasoning using the first AI model is to input the input data into the first AI model. The corresponding algorithm is used to obtain the inference result. For example, the acquired vehicle operation data is obtained through the above method to obtain input data, and then the input data is input into the first AI model to obtain the vehicle condition information required by the user.

S440. The AI chip sends an inference result to the main chip. Correspondingly, the main chip receives the inference results from the AI chip.

In the method of this embodiment, compared with the decryption by other chips or dongles other than the AI chip, since the decryption of the encrypted AI model is performed on the AI chip, for the decrypted AI model, the AI chip directly reasoning uses , so the problem of the decrypted AI model being intercepted or stolen during the transmission process is avoided, that is to say, the risk of leaking the AI model is greatly reduced and the security is improved.

As an example, an implementation manner in which the AI chip decrypts the encrypted AI model to obtain the first AI model includes: using a root of trust stored in a secure storage area of the AI chip to decrypt the encrypted AI model.

For example, the AI chip uses the root of trust of the chip to generate a decryption key, and then uses the decryption key to decrypt the encrypted AI model to obtain the first AI model.

The chip root of trust can be understood as the unconditionally trusted information in the chip, which is stored in the secure storage area of the AI chip, and the storage content in this secure storage area can only be read by the AI chip, and cannot be read by external devices. In other words, the re-encrypted AI model can only be decrypted and run on the AI chip, so the security of the AI model can be further improved.

In this embodiment, the encrypted AI model in the main chip can be obtained in various ways, and a method for obtaining the encrypted AI model will be introduced below with reference to FIG. 5 .

As shown in FIG. 5 , before S410, an achievable way of acquiring the encrypted AI model in the usage method of the embodiment of the present application may include the following steps:

S401. The main chip sends the first AI model to the AI chip. Correspondingly, the AI chip receives the first AI model sent by the main chip.

For example, when the main chip needs the AI chip to use the first AI model for encryption, the main chip may send the first AI model to the AI chip.

As an optional manner, what is stored on the main chip is an AI model obtained by encrypting the first AI model by software. In this case, the main chip may first decrypt the software-encrypted AI model, and after obtaining the first AI model, send the first AI model to the AI chip.

As another optional manner, the first AI model is stored on the main chip. In this case, the main chip can directly send the first AI model to the AI chip.

S402. The AI chip sends to the main chip an encrypted AI model obtained by encrypting the first AI model using the root of trust. Correspondingly, the main chip receives the encrypted AI model.

For example, after the AI chip receives the first AI model from the main chip, it uses the root of trust stored in the secure storage area of the AI chip to generate a key, and then uses the key to encrypt the received first AI model to obtain Encrypt the AI model and return the encrypted AI model to the main chip.

It can be understood that the root of trust in the AI chip refers to the unconditionally trusted information in the chip, which can be stored in the secure storage area of the AI chip, and only the AI chip can store the content in this secure storage area. read, the external device cannot read. In this way, the security of the key can be improved, so that the security of the first AI model can be further improved.

S403. The main chip stores the encrypted AI model.

As an implementation, after receiving the encrypted AI model corresponding to the first AI model, the main chip saves the encrypted AI model, and records the mapping relationship between the encrypted AI model and the first AI model, so that the first AI model can be used , the encrypted AI model can be obtained based on the mapping relationship.

Optionally, when the main chip stores the encrypted AI model, the previously stored first AI model may be deleted, so as to avoid waste of storage space corresponding to the main chip.

As an example, when the AI application to which the first AI model belongs is installed and executed on the main chip for the first time, the main chip may execute S401, S402 and S403.

When the AI application program is run again, the main chip directly loads the locally stored encrypted AI model to the AI chip; then the AI chip decrypts the encrypted AI model, and uses the decrypted first AI model to perform inference to obtain an inference result, and return the inference result to the main chip.

In this embodiment, the AI chip can automatically realize the encryption protection of the AI model, without deploying a dedicated hardware dongle, etc., which can reduce the complexity of the user's implementation of the AI model hardware-level protection scheme.

The following takes the main chip and the AI chip as the chips in the autopilot box as an example, and in combination with Figure 6, an example of how to use the AI model is introduced.

S601. Install and start an automatic driving program for the first time.

The maintenance and testing personnel install the autopilot program into the autopilot box device of the vehicle, then start the autopilot program for the first time, and perform debugging. Among them, the autopilot box device includes a main chip and an AI computing chip, and the autopilot program is deployed on the main chip, and the autopilot program can include an AI model encrypted by software.

S602. The automatic driving program decrypts the AI model to obtain plaintext of the AI model.

S603. The main chip deployed with the autopilot program sends the AI model plaintext to the AI computing chip.

It can be understood that if the AI model deployed in the autopilot program is not encrypted, after S601, S602 can be skipped and S603 can be executed directly.

For example, the autopilot program calls the interface of the AI computing chip, and loads the plain text of the AI model onto the AI computing chip for subsequent calculations.

S604. The AI computing chip generates a unique key, and re-encrypts the AI model.

The AI computing chip automatically generates the key of the AI computing chip according to the root of trust of its own chip, and encrypts the plaintext of the AI model according to the key to obtain the encrypted AI model.

In this step, the root of trust is stored in the secure storage area of the AI computing chip and cannot be obtained externally.

S605. The AI computing chip sends the re-encrypted AI model to the main chip.

S606. The main chip deployed with the autopilot program deletes the original stored AI model and key, and saves the re-encrypted AI model.

It is understandable that the main chip does not need to delete the original stored AI model and key.

S607. The main chip deployed with the autopilot program sends the re-encrypted AI model to the AI computing chip.

As an optional method, when subsequent maintenance personnel debug again or the car owner starts automatic driving, the main chip deployed with the automatic driving program can directly load the re-encrypted AI model to the AI computing chip.

S608. Decrypt the encrypted AI model.

After obtaining the encrypted AI model, the AI computing chip uses the decryption key generated by its own root of trust to decrypt the encrypted AI model to obtain the plaintext of the AI model, and then perform corresponding operations.

In this embodiment, the AI computing chip is used to automatically generate a key based on its own root of trust, and the plaintext of the AI model is encrypted and decrypted. That is to say, the protection of the AI model is converted from software-level key encryption protection to chip hardware Level key encryption protection, and the trusted root of the generated key is stored in the secure storage of the chip and cannot be obtained from the outside, so when decrypting, it can only be decrypted and run on the AI computing chip, which greatly reduces the risk of AI model leakage ; AI chips can automatically implement hardware-level key encryption protection for AI models, which greatly reduces the complexity of AI users implementing hardware-level protection solutions for AI models, and also does not need to deploy special hardware dongles, thereby reducing development and product costs .

FIG. 7 is a schematic diagram of an apparatus for using an artificial intelligence AI model provided by an embodiment of the present application. It should be understood that the device 700 shown in FIG. 7 is only an example, and the device 700 in this embodiment of the present application may further include other modules or units. The device 700 may be used to implement the method shown in FIG. 4 .

For example, the apparatus 700 may include an encryption module 701 , a receiving module 702 , a decryption module 703 , an inference module 704 and a sending module 705 . Wherein, the encryption module 701 and the receiving module 702 are used to perform S410, the decryption module 703 is used to perform S420, the reasoning module 704 is used to perform S430, and the sending module 705 is used to perform S440.

Fig. 8 is a schematic diagram of an apparatus for using an artificial intelligence AI model provided by another embodiment of the present application. It should be understood that the device 800 shown in FIG. 8 is only an example, and the device 800 in this embodiment of the present application may further include other modules or units. The device 800 may be used to implement the method shown in FIG. 5 .

For example, the apparatus 800 may include a sending module 801 , a receiving module 802 and a storage module 803 . Wherein, the sending module 801 is used to perform S401, the receiving module 803 is used to perform S402, and the storage module 804 is used to perform S403.

It should be understood that the term "module" here may be implemented in the form of software and/or hardware, which is not specifically limited. For example, a "module" may be a software program, a hardware circuit or a combination of both to realize the above functions. The hardware circuitry may include application specific integrated circuits (ASICs), electronic circuits, processors (such as shared processors, dedicated processors, or group processors) for executing one or more software or firmware programs. etc.) and memory, incorporating logic, and/or other suitable components to support the described functionality.

Fig. 9 is a schematic block diagram of a device provided by an embodiment of the present application. The device 900 shown in FIG. 9 includes a memory 901 , a processor 902 , a communication interface 903 and a bus 904 . Wherein, the memory 901 , the processor 902 , and the communication interface 903 are connected to each other through a bus 904 .

The memory 901 may be a read only memory (read only memory, ROM), a static storage device, a dynamic storage device or a random access memory (random access memory, RAM). The memory 901 may store a program, and when the program stored in the memory 901 is executed by the processor 902, the processor 902 is configured to execute each step of the method shown in FIG. 4 and FIG. 5 .

The processor 902 may adopt a general-purpose central processing unit (central processing unit, CPU), a microprocessor, an application-specific integrated circuit (application specific integrated circuit, ASIC), or one or more integrated circuits for executing related programs to Implement the method in the method embodiment of the present application.

The processor 902 may also be an integrated circuit chip, which has a signal processing capability. In the implementation process, each step of the method in the embodiment of the present application may be completed by an integrated logic circuit of hardware in the processor 902 or instructions in the form of software.

The above-mentioned processor 902 can also be a general-purpose processor, a digital signal processor (digital signal processing, DSP), an application-specific integrated circuit (ASIC), a ready-made programmable gate array (field programmable gate array, FPGA) or other programmable logic devices, Discrete gate or transistor logic devices, discrete hardware components. Various methods, steps, and logic block diagrams disclosed in the embodiments of the present application may be implemented or executed. A general-purpose processor may be a microprocessor, or the processor may be any conventional processor, or the like.

The steps of the method disclosed in connection with the embodiments of the present application may be directly implemented by a hardware decoding processor, or implemented by a combination of hardware and software modules in the decoding processor. The software module can be located in a mature storage medium in the field such as random access memory, flash memory, read-only memory, programmable read-only memory or electrically erasable programmable memory, register. The storage medium is located in the memory 901, and the processor 902 reads the information in the memory 901, and combines its hardware to complete the functions required by the units included in the temperature measuring device of the present application. For example, the embodiments shown in FIGS. 4 and 5 can be executed. individual steps/functions.

The communication interface 903 may use, but is not limited to, a transceiver device such as a transceiver to implement communication between the device 900 and other devices or communication networks.

The bus 904 may include a pathway for transferring information between various components of the device 900 (eg, memory 901 , processor 902 , communication interface 903 ).

It should be understood that the apparatus 900 shown in the embodiment of the present application may be an electronic device, or may also be a chip configured in the electronic device.

It should be understood that the processor in the embodiment of the present application may be a central processing unit (central processing unit, CPU), and the processor may also be other general processors, digital signal processors (digital signal processor, DSP), application specific integrated circuits (application specific integrated circuit, ASIC), off-the-shelf programmable gate array (field programmable gate array, FPGA) or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, etc. A general-purpose processor may be a microprocessor, or the processor may be any conventional processor, or the like.

It should also be understood that the memory in the embodiments of the present application may be a volatile memory or a nonvolatile memory, or may include both volatile and nonvolatile memories. Among them, the non-volatile memory can be read-only memory (read-only memory, ROM), programmable read-only memory (programmable ROM, PROM), erasable programmable read-only memory (erasable PROM, EPROM), electrically programmable Erases programmable read-only memory (electrically EPROM, EEPROM) or flash memory. Volatile memory can be random access memory (RAM), which acts as external cache memory. By way of illustration and not limitation, many forms of random access memory (RAM) are available, such as static random access memory (static RAM, SRAM), dynamic random access memory (DRAM), synchronous dynamic random access memory Access memory (synchronous DRAM, SDRAM), double data rate synchronous dynamic random access memory (double data rate SDRAM, DDR SDRAM), enhanced synchronous dynamic random access memory (enhanced SDRAM, ESDRAM), synchronous connection dynamic random access memory Access memory (synchlink DRAM, SLDRAM) and direct memory bus random access memory (direct rambus RAM, DR RAM).

The above-mentioned embodiments may be implemented in whole or in part by software, hardware, firmware or other arbitrary combinations. When implemented using software, the above-described embodiments may be implemented in whole or in part in the form of computer program products. The computer program product comprises one or more computer instructions or computer programs. When the computer instruction or computer program is loaded or executed on the computer, the processes or functions according to the embodiments of the present application will be generated in whole or in part. The computer may be a general purpose computer, a special purpose computer, a computer network, or other programmable devices. The computer instructions may be stored in or transmitted from one computer-readable storage medium to another computer-readable storage medium, for example, the computer instructions may be transmitted from a website, computer, server or data center Transmission to another website site, computer, server or data center by wired (such as infrared, wireless, microwave, etc.). The computer-readable storage medium may be any available medium that can be accessed by a computer, or a data storage device such as a server or a data center that includes one or more sets of available media. The available media may be magnetic media (eg, floppy disk, hard disk, magnetic tape), optical media (eg, DVD), or semiconductor media. The semiconductor medium may be a solid state drive.

It should be understood that the term "and/or" in this article is only an association relationship describing associated objects, which means that there may be three relationships, for example, A and/or B may mean: A exists alone, and A and B exist at the same time , there are three cases of B alone, where A and B can be singular or plural. In addition, the character "/" in this article generally indicates that the related objects are an "or" relationship, but it may also indicate an "and/or" relationship, which can be understood by referring to the context.

In this application, "at least one" means one or more, and "multiple" means two or more. "At least one of the following" or similar expressions refer to any combination of these items, including any combination of single or plural items. For example, at least one item (piece) of a, b, or c can represent: a, b, c, a-b, a-c, b-c, or a-b-c, where a, b, c can be single or multiple .

It should be understood that, in various embodiments of the present application, the sequence numbers of the above-mentioned processes do not mean the order of execution, and the execution order of the processes should be determined by their functions and internal logic, and should not be used in the embodiments of the present application. The implementation process constitutes any limitation.

Those skilled in the art can appreciate that the units and algorithm steps of the examples described in conjunction with the embodiments disclosed herein can be implemented by electronic hardware, or a combination of computer software and electronic hardware. Whether these functions are executed by hardware or software depends on the specific application and design constraints of the technical solution. Skilled artisans may use different methods to implement the described functions for each specific application, but such implementation should not be regarded as exceeding the scope of the present application.

Those skilled in the art can clearly understand that for the convenience and brevity of the description, the specific working process of the above-described system, device and unit can refer to the corresponding process in the foregoing method embodiment, which will not be repeated here.

In the several embodiments provided in this application, it should be understood that the disclosed systems, devices and methods may be implemented in other ways. For example, the device embodiments described above are only illustrative. For example, the division of the units is only a logical function division. In actual implementation, there may be other division methods. For example, multiple units or components can be combined or May be integrated into another system, or some features may be ignored, or not implemented. In another point, the mutual coupling or direct coupling or communication connection shown or discussed may be through some interfaces, and the indirect coupling or communication connection of devices or units may be in electrical, mechanical or other forms.

The units described as separate components may or may not be physically separated, and the components shown as units may or may not be physical units, that is, they may be located in one place, or may be distributed to multiple network units. Part or all of the units can be selected according to actual needs to achieve the purpose of the solution of this embodiment.

In addition, each functional unit in each embodiment of the present application may be integrated into one processing unit, each unit may exist separately physically, or two or more units may be integrated into one unit.

If the functions described above are realized in the form of software function units and sold or used as independent products, they can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present application is essentially or the part that contributes to the prior art or the part of the technical solution can be embodied in the form of a software product, and the computer software product is stored in a storage medium, including Several instructions are used to make a computer device (which may be a personal computer, a server, or a network device, etc.) execute all or part of the steps of the methods described in the various embodiments of the present application. The aforementioned storage medium includes: various media capable of storing program codes such as U disk, mobile hard disk, read-only memory, random access memory, magnetic disk or optical disk.

The above is only a specific implementation of the application, but the scope of protection of the application is not limited thereto. Anyone familiar with the technical field can easily think of changes or substitutions within the technical scope disclosed in the application. Should be covered within the protection scope of this application. Therefore, the protection scope of the present application should be determined by the protection scope of the claims.

Claims (11)

A method for using an artificial intelligence AI model, wherein the method is applied to an AI chip, and the method includes: Receive the encrypted AI model from the main chip; Decrypting the encrypted AI model to obtain a first AI model; Using the first AI model to perform reasoning to obtain a reasoning result; sending the reasoning result to the main chip. The method according to claim 1, wherein the decrypting the encrypted AI model comprises: The encrypted AI model is decrypted using the root of trust stored in the secure storage area of the AI chip. The method according to claim 2, wherein before the AI chip receives the encrypted AI model, the method further comprises: receiving the first AI model from the main chip; Encrypting the first AI model using the root of trust to obtain the encrypted AI model; sending the encrypted AI model to the main chip. A method for using an artificial intelligence AI model, characterized in that the method is applied to a main chip, and the method includes: Sending an encrypted AI model to the AI chip, where the encrypted AI model is a model obtained by encrypting the first AI model by the AI chip; An inference result from the AI chip is received, where the inference result is an inference result obtained by the AI chip using the first AI model for inference. The method according to claim 4, wherein before sending the encrypted AI model to the AI chip, the method further comprises: sending the first AI model to the AI chip; receiving the encrypted AI model obtained by encrypting the first AI model by the AI chip using a root of trust; The encrypted AI model is stored. The method according to claim 5, wherein the root of trust is a root of trust stored in a secure storage area of the AI chip. A device for using an artificial intelligence AI model, characterized in that the device includes a module for implementing the method according to any one of claims 1 to 6. An artificial intelligence AI chip, characterized in that the AI chip includes a processor coupled to a memory, and the processor is used to execute the program code in the memory, so as to realize the process described in any one of claims 1 to 3. described method. A chip, characterized in that the chip includes a processor coupled to a memory, and the processor is configured to execute program codes in the memory to implement the method as claimed in any one of claims 4 to 6. A computer-readable storage medium, characterized in that the storage medium stores computer programs or instructions, and when the computer programs or instructions are executed by a processor, the implementation of any one of claims 1 to 6 Methods. A computer program product, the computer program product comprising computer program code, characterized in that, when the computer program code is run on a computer, the computer is made to implement the computer program described in any one of claims 1 to 6 Methods.

Images