Depth model privacy protection method and device oriented to member reasoning attack and based on parameter sharing

Abstract

The invention discloses a depth model privacy protection method and device oriented to member reasoning attack and based on parameter sharing. The method comprises the following steps: constructing a target model, and optimizing the network parameters of the target model through an image sample; after optimization is finished, carrying out clustering processing on each layer of network parameters of the target model, and after the network parameters belonging to the same class are replaced by the network parameter average value of the class cluster to which the network parameters belong, the network parameters are optimized; constructing a shadow model having the same structure as the target model, and optimizing network parameters of the shadow model by using the training image sample; constructing a new image sample according to the shadow model; constructing an attack model, and optimizing model parameters of the attack model by using the new image sample; and obtaining a prediction confidence coefficient of the input test image by using the parameter-shared enhanced target model, inputting the prediction confidence coefficient into the parameter-optimized attack model, obtaining a prediction result of the attack model through calculation, and judging whether the test image is a member sample of the target model or not according to the prediction result.

Description

technical field [0001] The invention relates to the fields of computer information security and artificial intelligence security, and in particular relates to a parameter sharing-based deep model privacy protection method and device for member reasoning attacks. Background technique [0002] Deep Learning (DL) is a branch of machine learning inspired by the way the human brain works when it processes data. Specifically, DL forms a mathematical model based on sample data, that is, training data, and gradually extracts higher-level features from the sample data, on which the model can make decisions without human participation. Due to its good performance, DL is widely used in image classification, object recognition, image segmentation, disease prediction and other fields. [0003] While DL is penetrating into academia and industry, its explosive growth and huge potential have also attracted cybercriminals, which has brought serious security issues to the DL community. Gene...

AI Technical Summary

Problems solved by technology

However, this defense method has certain limitations. Adversarial training will cause high time complexity. In addition, adversarial training will reduce the predictive ability of the target model for normal samples, and because of the change of the loss function when training the model, the target The model will have difficulty converging during training

Images