Deep learning data privacy protection method, system and device and medium

Abstract

The invention relates to a deep learning data privacy protection method, system and device, and a medium. The method comprises the following steps: loading an original training data set and a deep learning model; assigning privacy protection weight to privacy information in the original training data set, and constructing a privacy importance matrix; configuring global noise intensity and generator parameters in the training data to construct a noise generator; training the noise generator according to a loss function constructed by a privacy importance matrix; performing noise addition on all original training data in the original training data set through a noise generator to generate a noise-added data set; and training the deep learning model by using the noise-added data set to form a deep learning model with privacy protection characteristics. According to the method, the objective function and the parameter training method of the noise generator are constructed, the model performance difference is minimized while the noise intensity added to the training data is maximized, and the model feasibility and the privacy protection intensity are automatically balanced.

Description

technical field [0001] The present disclosure relates to the field of deep learning models, and in particular, to a deep learning data privacy protection method, system, device and medium. Background technique [0002] In recent years, due to the theoretical innovation of deep learning and in-depth research in various fields, many commercial applications based on deep learning technology involve all walks of life, creating immeasurable value. In order to speed up the research and application of deep learning, many enterprises or research institutions have made public deep learning models. The construction of deep learning models relies on a large amount of training data, and the training data may involve personal privacy and commercial secrets. Therefore, whether the disclosed deep learning model will leak training data has attracted attention. In recent years, related research work has confirmed that public deep learning models have the risk of leaking training data in so...

AI Technical Summary

Problems solved by technology

Regarding differential privacy machine learning, the mainstream approach is to limit the difference of model output by adding noise to parameters to prevent differential attacks, but these protection measures have a trade-off problem that is difficult to adjust in model inversion attacks and model update attacks , that is, the trade-off between model usability and data privacy protection strength. In order to protect data leakage as much as possible, the decline in model performance (such as accuracy rate) that may be caused is sometimes unacceptable, and it lacks certain understandability. This comprehensibility problem refers to the fact that after the introduction of differential privacy, it is difficult to show which training data information is protected in a visual way, such as the face or background in the picture has more privacy protection, because in the image data or In other data, the privacy considerations in different parts are different. If such intelligibility can be provided, it will help the data provider to control the direct risk of privacy leakage; regarding the noise addition of training data, such as the patent "a medical-based Image privacy protection method [P]. Guo Lihong, Sha Aijun, Song Hao, Dong Tengteng, Wang Jiacheng. Chinese patent: CN113889232A, 2022-01-04", which extracts information from the personal privacy area of ​​the original training image, and then With the help of the complex sequence generated iteratively by the Logistic chaotic system, the pixel value transformation is performed on the extracted area, and finally the transformation results of all text areas are embedded into the original image, and the image is scrambled after the overall encryption, which is protected by this encryption form. personal privacy area

The problem with this method is that the training data after the noise conversion will have an uncontrollable impact on the construction of the deep learning model, such as the decrease in model usability due to the shielding of too much effective information, etc.

Images