Member reasoning attack-oriented deep model privacy protection method based on abnormal point detection

Abstract

The invention discloses a member reasoning attack-oriented deep model privacy protection method based on abnormal point detection, which comprises the following steps of: relieving the overfitting degree of a target model through a regularization method, finding out abnormal samples which are easily attacked by member reasoning on the model, and deleting the samples from a training set of the target model, so as to improve the privacy of the target model; and finally, re-training the target model to achieve a defense effect. In order to determine samples susceptible to member reasoning attacks, the method comprises the following steps: firstly, establishing a reference model training set, establishing a reference model, training the reference model by using the reference model training set, inputting a to-be-tested sample into the reference model, obtaining feature vectors of the to-be-tested sample, and determining the distance between the feature vectors of different to-be-tested samples; and calculating a local outlier factor of the to-be-detected sample, wherein the sample with the local outlier factor greater than 1 is an abnormal sample. By utilizing the method, the problems of unstable gradient, non-convergent training, low convergence speed and the like of a traditional defense method can be eliminated, and relatively good defense performance is achieved.

Description

technical field [0001] The invention belongs to the field of artificial intelligence security, and in particular relates to a deep model privacy protection method based on anomalous point detection oriented to member reasoning attacks. Background technique [0002] Machine learning technology is widely used in image classification, natural language processing, financial analysis and other fields. As an increasingly popular business model, many companies (e.g., Google, Microsoft, and Amazon) deploy machine learning as a service (MLaaS) to provide various functions such as data processing, model training, and data prediction to different customers. Users can upload data to these service providers to train their own models, or they can publish these models in a black box way. Others have access to these models, but do not know the specific information (internal parameters) inside these models. On the other hand, the data uploaded by users is their own unique private data, suc...

AI Technical Summary

Problems solved by technology

[0005] In order to solve the above-mentioned problems existing in the prior art, the present invention provides a deep model privacy protection method based on outlier detection for member reas

Images