Method for protecting deep learning model based on confidential computing

A method for protecting a deep learning model based on confidential computing, wherein a preprocessing module having a data preprocessing model and an inference module having an inference model are comprised, the data preprocessing model is encrypted and deployed into a confidential computing environment;

• and
• the method comprises:
• S1:
• starting the preprocessing module in the confidential computing environment, and sending attestation information of the confidential computing environment to a model copyright owner server;
• S2:
• receiving a attestation result returned by the model copyright owner server, and obtaining a decryption key for decrypting the data preprocessing model if the attestation result is correct, or exiting running if the attestation result is incorrect;
• S3:
• decrypting the data preprocessing model by using the obtained decryption key, wherein the preprocessing module loads the decrypted data preprocessing model;
• S4:
• preprocessing, by the data preprocessing model, to-be-inferred data submitted by an authorized user, and sending the preprocessed data to the inference model;
• and
• S5:
• performing, by the inference model, inference on the preprocessed data, and then sending an inference result to the authorized user;
• wherein the preprocessing module and the inference module are distributed to the authorized user in advance and are deployed on an authorized user end, and the preprocessing module and the inference module are distributed to the authorized user in the following manners:
• encrypting a trained data preprocessing model by using an encryption algorithm;
• packaging the encrypted data preprocessing model and preprocessing code as the preprocessing module;
• packaging a trained inference model and inference code as the inference module;
• distributing the preprocessing module and the inference module to the authorized user;
• and
• deploying, by the authorized user, the preprocessing module to the confidential computing environment and deploying the inference module to a common computing environment;
• and
• wherein a training method of the data preprocessing model comprises:
• running the data preprocessing model and a pretraining model, randomizing parameter information in the models, and combining loss functions of the data preprocessing model and the pretraining model;
• processing a data set by using the data preprocessing model, and sending preprocessed data to the pretraining model;
• sending unprocessed original data to the pre-training model;
• and
• training the pretraining model by using the original data and the preprocessed data, and selecting a combination of the data preprocessing model and the pretraining model with highest prediction accuracy.