A neural network model stealing defense method in aiot scenarios

Abstract

The invention discloses a neural network model stealing defense method in an AIoT scenario, which is applied in the field of network security. In the AIoT scenario, data leakage may occur when an edge device transmits data to a cloud server, resulting in model theft. Encrypted inference data images and labels realize the defense against model theft. The encrypted image part is based on neural network-like activation mapping technology, and the encrypted label part is based on incomplete autoencoder technology; the present invention mainly includes training phase and deployment phase, and the training phase is performed on the server The deployment stage is carried out after the training stage is completed, and the data in the training stage is deployed to edge devices and cloud servers. The solution of the present invention can effectively prevent the theft of neural network models in AIoT scenarios.

Description

technical field [0001] The invention belongs to the field of network defense, in particular to a neural network model stealing defense technology. Background technique [0002] Model stealing is a serious threat to neural network (NN) based artificial intelligence (AI) applications. Such as figure 1 As shown, the principle of model stealing is to send a large number of inferred requests to public machine learning APIs such as Amazon AWS, Microsoft Azure, Google Cloud, and BigML. And the output and input of the API can constitute the training data set of the stolen model, and then use various common machine learning models for training and find the best results. The purpose of stealing a model is to bypass the original model and use an alternative model to obtain future predictions for commercial gain. and / or steal model knowledge and generate transferable adversarial samples that can be used to perturb the original model to make wrong predictions. Model stealing technolo...

AI Technical Summary

Problems solved by technology

[0007] In terms of model stealing detection, M.Juuti et al. proposed a model stealing detection method based on the difference between the attacker's query distribution and the normal customer query distribution; in terms of model stealing detection defense, N.Papernot et al. Private student-teacher network architecture, and through this network architecture, the direct connection between the training set and the final deployment model is isolated, so that attackers cannot directly obtain the private information in the original training set through public APIs

[0008] However, in the AIoT scenario, data leakage may occur when the edge device transmits data to the cloud server, resulting in model theft.

Images