Smart power grid deep learning model copyright protection method, device and system based on model confidence domain

Abstract

The invention relates to a smart power grid deep learning model copyright protection method, device and system based on a model confidence domain, a computer readable storage medium and a computer program product. The method comprises the steps of obtaining a smart grid depth model set; aiming at each model in the intelligent power grid depth model set, searching a characteristic data sample of which the model prediction value is close to the model discrimination boundary in the special data set to obtain a confidence domain characteristic point set; carrying out dimensionality reduction on a gradient vector of the confidence domain feature point set on a model discrimination boundary according to a linear discriminant analysis method to obtain a disturbance vector of the confidence domain feature point set; generating a model feature identification set corresponding to the intelligent power grid deep model set according to the prediction label change before and after the confidence domain feature point set and the disturbance vector are combined by each model; and training a to-be-trained copyright detection model according to the model feature identification set to obtain a pre-trained copyright detection model. By adopting the method, the detection accuracy of the model copyright infringement attack can be improved.

Description

Technical Field

[0001] The present application relates to the field of artificial intelligence technology, and in particular to a method, device, system, computer-readable storage medium, and computer program product for copyright protection of a smart grid deep learning model based on a model trust region. Background Art

[0002] With the rapid development of smart grid technology, machine learning models are increasingly being used in power systems. In particular, advances in deep learning technology have promoted the development of a variety of advanced analysis algorithms, including grid flow prediction, user electricity behavior analysis, and equipment anomaly detection. However, these machine learning-based systems rely on high-quality data sets, which makes them potential targets for intellectual property theft.

[0003] For example, machine learning models in smart grids usually need to access and analyze a large amount of user data, such as household electricity habits and electricity consumption. Once this data is obtained by attackers through model extraction attacks, it will not only violate the privacy of users, but may also be used for malicious purposes, such as fraud or stealing user identity information. At the same time, smart grids also contain a large amount of grid operation data, such as power load, equipment status, etc. This data is crucial for the safe operation of the grid. If attackers obtain this data through model extraction attacks, it may cause the leakage of grid operation data, thereby endangering the safety and stable operation of the grid. Attackers can use this data to manipulate the electricity market or conduct cyber attacks against the grid. Therefore, how to protect the copyright of neural networks in this case has become an urgent problem to be solved.

[0004] In related technologies, some research has been devoted to defending against model extraction attacks and protecting model privacy. However, these methods still have some limitations in practical applications, which makes the detection accuracy of model copyright infringement attacks low. Summary of the invention

[0005] Based on this, it is necessary to provide a smart grid deep learning model copyright protection method, device, system, computer-readable storage medium and computer program product based on model trust domain, which can improve the detection accuracy of model copyright infringement attacks in response to the above technical problems.

[0006] In a first aspect, the present application provides a smart grid deep learning model copyright protection method based on a model trust region, comprising:

[0007] Acquire a smart grid deep model set; the smart grid deep model set includes a target copyright protection model, and a target risk model and a target homomorphic model corresponding to the target copyright protection model; the target risk model is a model that has a smart grid data set infringement problem with the target copyright protection model; the target homomorphic model is a model obtained by simulating the target copyright protection model under the same problem domain;

[0008] For each model in the smart grid deep model set, a feature data sample whose distance between the corresponding model prediction value and the corresponding model discrimination limit meets a preset condition is searched in the smart grid proprietary data set to obtain a trust region feature point set; the model discrimination limit represents an area that can be predicted as other types within a preset displacement in the gradient direction of the model inference of the feature data sample;

[0009] Determine the gradient vector of the trust region feature point set on the model discrimination boundary, and reduce the dimension of the obtained gradient vector according to the linear discriminant analysis method, and use the gradient vector after dimension reduction as the perturbation vector of the trust region feature point set;

[0010] Generate a model feature identification set corresponding to the smart grid deep model set according to changes in predicted labels of each model before and after combining the trust region feature point set with the disturbance vector;

[0011] The copyright detection model to be trained is trained according to the model feature identification set to obtain a pre-trained copyright detection model; the pre-trained copyright detection model is used to detect whether the model to be detected infringes the copyright of the target copyright protection model.

[0012] In one embodiment, determining the gradient vector of the trust region feature point set on the model discrimination boundary and performing dimensionality reduction on the obtained gradient vector according to a linear discriminant analysis method includes:

[0013] Grouping the gradient vectors according to category labels, and determining a mean vector for each category and an overall mean vector;

[0014] Determine a within-class scatter matrix and an between-class scatter matrix according to the mean vector of each of the categories and the overall mean vector;

[0015] By solving the eigenvalues ​​and eigenvectors of the product of the inverse matrix of the intra-class scatter matrix and the inter-class scatter matrix, eigenvectors whose cumulative contribution rates meet preset conditions are selected for dimensionality reduction processing to obtain the gradient vector after dimensionality reduction.

[0016] In one embodiment, the step of training the copyright detection model to be trained according to the model feature identification set includes:

[0017] Expanding the model feature identification set by searching homologous data subsets to obtain an expanded model feature identification set;

[0018] The copyright detection model to be trained is trained using the expanded model feature identification set.

[0019] In one embodiment, the model feature identification set is expanded by searching homologous data subsets to obtain an expanded model feature identification set, including:

[0020] Dividing the model feature identifier set into k subsets, taking each model feature identifier in the model feature identifier set as a data point; each subset includes a core point; the core point is represented by being randomly selected from the model feature identifier set;

[0021] Determine the distance from each of the data points to each of the core points, and assign each of the data points to the subset to which the nearest core point belongs;

[0022] The core point of each subset is updated to the mean of all the data points in the subset, and the step of determining the distance from each data point to each core point is returned until the core point no longer changes or the maximum number of iterations is reached, and data enhancement processing is performed on the data points in each subset to obtain the expanded model feature identification set.

[0023] In one embodiment, obtaining a smart grid deep model set includes:

[0024] Acquire a training data set used in the training process of the target copyright protection model, and train the target homomorphic model on the training data set; the target homomorphic model includes a complete homomorphic model, an architecture homomorphic model, and a problem domain homomorphic model;

[0025] The fully homomorphic model is obtained by multiple trainings under the premise that all experimental settings are the same as those of the target copyright protection model;

[0026] The architecture homomorphic model is obtained by fine-tuning the hyperparameters during training and performing multiple trainings on the premise that the architecture is the same as that of the target copyright protection model;

[0027] The problem domain homomorphic model is obtained by performing multiple trainings under a preset similar model structure and a randomly selected hyperparameter combination, under the premise of using the same source data set as the target copyright protection model.

[0028] The copyright detection model to be trained includes an autoencoder recognition network and a mapping network, and the step of training the copyright detection model to be trained according to the model feature identification set includes:

[0029] Using a self-supervised learning method to train the autoencoder recognition network and the mapping network, mapping the model feature identification set to a low-dimensional representation space;

[0030] If the model feature is , the positive pair of the model feature identifier is , the negative pair of the model feature identifier is , the loss function for self-supervised learning It can be expressed as:

[0031] ;

[0032] in, express The same attitude, express The same attitude.

[0033] In a second aspect, the present application also provides a smart grid deep learning model copyright protection device based on a model trust region, comprising:

[0034] An acquisition module is used to acquire a smart grid deep model set; the smart grid deep model set includes a target copyright protection model, and a target risk model and a target homomorphic model corresponding to the target copyright protection model; the target risk model is a model that has a smart grid data set infringement problem with the target copyright protection model; the target homomorphic model is a model obtained by simulating the target copyright protection model under the same problem domain;

[0035] A search module is used to search for feature data samples whose distance between the corresponding model prediction value and the corresponding model discrimination boundary meets a preset condition in the smart grid proprietary data set for each model in the smart grid deep model set, so as to obtain a trust region feature point set; the model discrimination boundary represents an area that can be predicted as other types within a preset displacement of the gradient direction of the model inference of the feature data sample;

[0036] A determination module, used to determine the gradient vector of the trust region feature point set on the model discrimination boundary, and perform dimensionality reduction on the obtained gradient vector according to a linear discriminant analysis method, and use the gradient vector after dimensionality reduction as the perturbation vector of the trust region feature point set;

[0037] A generation module, used to generate a model feature identification set corresponding to the smart grid deep model set according to the predicted label changes of each model before and after combining the trust region feature point set with the disturbance vector;

[0038] The training module is used to train the copyright detection model to be trained according to the model feature identification set to obtain a pre-trained copyright detection model; the pre-trained copyright detection model is used to detect whether the model to be detected infringes the copyright of the target copyright protection model.

[0039] In a third aspect, the present application also provides a smart grid deep learning model copyright protection system based on model trust region. The system includes a memory and a processor, the memory stores a computer program, and the computer program implements the steps of the above method when executed by the processor.

[0040] In a fourth aspect, the present application further provides a computer-readable storage medium having a computer program stored thereon, wherein the computer program implements the steps of the above method when executed by a processor.

[0041] In a fifth aspect, the present application further provides a computer program product, wherein the computer program product comprises a computer program, and when the computer program is executed by a processor, the steps of the above method are implemented.

[0042] The above-mentioned smart grid deep learning model copyright protection method, device, system, computer-readable storage medium and computer program product based on model trust region obtains a target copyright protection model, and a target risk model and a target homomorphic model corresponding to the target copyright protection model. The target risk model is a model that has a smart grid data set infringement problem with the target copyright protection model; the target homomorphic model is a model obtained by simulating the target copyright protection model under the same problem domain; and for each model in the smart grid deep model set, searches for feature data samples in the smart grid proprietary data set whose distance between the corresponding model prediction value and the corresponding model discrimination boundary meets preset conditions, and obtains a trust region feature point set, so that the obtained trust region feature point set can accurately describe the trust region information of the deep learning model, and then the gradient vector of the trust region feature point set on the model discrimination boundary is calculated according to the trust region feature point set. Dimensionality reduction is performed according to the method of linear discriminant analysis to obtain the perturbation vector of the trust domain feature point set, so that the model feature identification set corresponding to the smart grid deep model set can be accurately generated according to the changes in the predicted labels before and after the trust domain feature point set is combined with the perturbation vector. The copyright detection model to be trained is trained by the model feature identification set to obtain a pre-trained copyright detection model; the pre-trained copyright detection model can be used to detect whether the model to be detected infringes the copyright of the target copyright protection model, and thus can effectively prevent attackers from forging identities and replacing users to participate in model training in the iteration after the start of training; at the same time, by extracting the trust domain features of the model to generate feature identification, risk models and homomorphic models can be effectively distinguished, the accuracy and robustness of feature identification matching are improved, the copyright security of the data set deployed in the smart grid model is guaranteed, and data leakage and unauthorized use are prevented. BRIEF DESCRIPTION OF THE DRAWINGS

[0043] In order to more clearly illustrate the technical solutions in the embodiments of the present application or related technologies, the drawings required for use in the embodiments of the present application or related technical descriptions will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present application. For ordinary technicians in this field, other related drawings can be obtained based on these drawings without paying creative work.

[0044] Figure 1 A flowchart of a smart grid deep learning model copyright protection method based on a model trust region in an embodiment;

[0045] Figure 2 A flowchart of a smart grid deep learning model copyright protection method based on a model trust region in another embodiment;

[0046] Figure 3 A flowchart of another smart grid deep learning model copyright protection method based on model trust region in an embodiment;

[0047] Figure 4 It is a structural block diagram of a smart grid deep learning model copyright protection device based on model trust region in one embodiment;

[0048] FIG. 5 is a diagram showing the internal structure of a computer device in one embodiment. DETAILED DESCRIPTION

[0049] In order to make the purpose, technical solution and advantages of the present application more clearly understood, the present application is further described in detail below in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are only used to explain the present application and are not used to limit the present application.

[0050] It should be noted that the terms "first", "second", etc. in the specification and claims of the present disclosure and the above-mentioned drawings are used to distinguish similar objects, and are not necessarily used to describe a specific order or sequence. It should be understood that the data used in this way can be interchanged where appropriate, so that the embodiments of the present disclosure described herein can be implemented in an order other than those illustrated or described herein. The embodiments described in the following exemplary embodiments do not represent all embodiments consistent with the present disclosure. Instead, they are merely examples of devices and methods consistent with some aspects of the present disclosure as detailed in the appended claims.

[0051] In one embodiment, Figure 1 As shown, a smart grid deep learning model copyright protection method based on model trust region is provided. This embodiment takes the method applied to a computer device as an example. It can be understood that the computer device can be a terminal, a server, or a system including a terminal and a server, and is implemented through the interaction between the terminal and the server. In this embodiment, the method includes the following steps:

[0052] Step S110, obtaining a smart grid deep model set.

[0053] Among them, the smart grid deep model set includes a target copyright protection model, as well as a target risk model and a target homomorphic model corresponding to the target copyright protection model.

[0054] Among them, the target risk model is a model that has smart grid data set infringement issues with the target copyright protection model.

[0055] The target homomorphic model is a model obtained by simulating the target copyright protection model under the same problem domain.

[0056] Among them, the target copyright protection model can be a machine learning model deployed in the smart grid and which requires smart grid data copyright protection.

[0057] In practical applications, the target copyright protection model can be named as smart grid copyright protection model.

[0058] In a specific implementation, a computer device can obtain a smart grid deep model set; the smart grid deep model set includes a target copyright protection model, and a target risk model and a target homomorphic model corresponding to the target copyright protection model.

[0059] Among them, the computer equipment can generate the target risk model through the model extraction algorithm, and use the defender's white box authority to generate the target homomorphic model.

[0060] Furthermore, the computer device can train the homomorphic model by fine-tuning the data set and parameters to simulate different models under the same problem domain. The homomorphic model can be implemented by training on the training data set used by the target copyright protection model in the training process, but using different hyperparameters or model structures. By simulating the attacker, generating the target risk model through the model extraction algorithm, querying the target copyright protection model's (Application Programming Interface) multiple times, and using the returned prediction results to simulate and train the target risk model with the smart grid data set infringement problem.

[0061] Specifically, the detailed steps of the model extraction algorithm are as follows, simulating an attacker repeatedly querying the target copyright protection model through the API In a problem domain where there may be leakage and copyright infringement of smart grid datasets, the dataset is defined as , Target Copyright Protection Model The training data set used in the training process is

[0062] , for The corresponding label. Simulate an attacker to obtain A part of the data set, randomly selected from the data set The extraction size is Model extraction dataset ,in The representative model extraction data set accounts for the size of the training data set. You can use 1.5 to achieve the effect of balancing the learning model features and simulating actual attack scenarios. Get the prediction results , the model extraction dataset can be expressed as The results are used to train the risk model, and the optimization objective is , so as to achieve the risk model to learn the characteristics of the target copyright protection model and obtain the target risk model .in, and Represent the neural network parameters of the target risk model and the target copyright protection model respectively. After multiple extractions and training, the risk model set is formed. .

[0063] In some embodiments, in the process of obtaining the smart grid deep model set, the computer device can obtain the training data set used by the target copyright protection model in the training process, and train a target homomorphic model on the training data set; the target homomorphic model includes a fully homomorphic model, an architectural homomorphic model, and a problem domain homomorphic model.

[0064] Among them, the fully homomorphic model is obtained by multiple training under the premise that all experimental settings are the same as those of the target copyright protection model.

[0065] Among them, the architectural homomorphic model is obtained by fine-tuning the hyperparameters during training and performing multiple trainings on the premise that the architecture is the same as that of the target copyright protection model.

[0066] The problem domain homomorphic model is obtained by multiple trainings under the premise of using the same source data set as the target copyright protection model with a preset similar model structure and a randomly selected hyperparameter combination.

[0067] Specifically, during the training of the homomorphic model, considering that the target copyright protection model and the homomorphic model need to be distinguished as much as possible in the subsequent recognition network training stage, the entire training data set is used. According to the closeness between the target homomorphic model and the target copyright protection model, the target homomorphic model set Divided into the following three subsets: Completely homomorphic model , architectural homomorphic model , homomorphic model of problem domain Among them, the fully homomorphic model Represents the result of multiple trainings under the same experimental settings as the target copyright protection model, and the architecture is the same model It represents the result of multiple trainings while fine-tuning the hyperparameters during training, such as learning rate, batch size, and optimizer selection, while maintaining the same architecture as the target copyright protection model. Represents the results of training with a preset similar model structure and randomly selected hyperparameter combinations using only the same source dataset. , and , can build a deep model set of smart grid .

[0068] Step S120, for each model in the smart grid deep model set, search the smart grid proprietary data set for feature data samples whose distance between the corresponding model prediction value and the corresponding model discrimination boundary meets the preset conditions to obtain a trust region feature point set.

[0069] Among them, the model discrimination boundary represents the area that can be predicted as other types within the preset displacement of the gradient direction of the model's inference of the feature data sample.

[0070] Furthermore, before obtaining the trust region feature point set, the smart grid proprietary data set is subjected to data enhancement processing to generate an enhanced smart grid proprietary data set. The data enhancement methods for the image data set in the smart grid proprietary data set include rotation, flipping, scaling, slicing, etc. to increase the diversity of the data; the data enhancement methods for the digital data set in the smart grid proprietary data set include superimposing noise, slicing data, etc. to enhance the robustness of the model.

[0071] In this way, for each model in the smart grid deep model set, the trust domain features of the model set can be extracted based on the enhanced smart grid proprietary data set. Specifically, the computer device can use the white box permission of the smart grid proprietary data set to search for feature data samples (data points) whose distance between the corresponding model prediction value and the corresponding model discrimination boundary meets the preset condition (such as less than the preset distance threshold) from the enhanced smart grid proprietary data set in an iterative manner, and fuse the feature data samples belonging to different labels in combination with the problem domain. In order to ensure that the obtained trust domain feature point set can accurately describe the trust domain information of the deep learning model, the same attitude matching method is used to find the feature data samples with the highest same attitude from different label classes. At the same time, the heuristic iterative algorithm is used to obtain the feature data samples whose similarity with the decision sample meets the preset threshold, and the iterative algorithm is set to stop within the model discrimination boundary (discrimination boundary area) or the number of iterations ends. Among them, the model discrimination boundary represents the area that can be predicted as other types within the displacement ϵ in the gradient direction of the model's reasoning on the feature data sample. Specifically, specifically, let the model ( ) for the input feature data sample The gradient of , then the judgment boundary area can be expressed as .

[0072] Step S130, determining the gradient vector of the trust region feature point set on the model discrimination boundary, and reducing the dimension of the obtained gradient vector according to the linear discriminant analysis method, and using the reduced gradient vector as the perturbation vector of the trust region feature point set.

[0073] In a specific implementation, after obtaining the trust domain feature point set, the computer device can determine the gradient vector of the trust domain feature point set on the model discrimination boundary, and reduce the dimension of the obtained gradient vector according to the linear discriminant analysis method, and use the reduced gradient vector as the perturbation vector of the trust domain feature point set.

[0074] Specifically, the computer device can group the gradient vectors according to the category labels and determine the mean vector of each category. and the population mean vector Then, according to the mean vector of each category and the population mean vector , determine the intra-class scatter matrix and the between-class scatter matrix Then, by solving the product of the inverse matrix of the within-class scatter matrix and the between-class scatter matrix The eigenvalues ​​and eigenvectors of the feature vectors are selected, and the eigenvectors whose cumulative contribution rate meets the preset conditions (for example, the first 95% cumulative contribution rate) are selected. These eigenvectors are used to project the original gradient vector into the low-dimensional space, complete the dimensionality reduction process, and obtain the gradient vector after dimensionality reduction. The gradient vector after dimensionality reduction is used as the perturbation vector for the trust region feature point set.

[0075] Step S140, generating a model feature identification set corresponding to the smart grid deep model set according to the changes in the predicted labels of each model before and after combining the trust region feature point set with the disturbance vector.

[0076] In a specific implementation, the computer device can record the change in the predicted label of each model before and after combining the trust region feature point set with the disturbance vector. The generating function of can be expressed as: .in, is the trust region feature point set, is the linear dimension-reduced gradient vector (i.e., the gradient vector after dimension reduction).

[0077] Step S150, training the copyright detection model to be trained according to the model feature identification set to obtain a pre-trained copyright detection model.

[0078] Among them, the pre-trained copyright detection model is used to detect whether the model to be detected infringes the copyright of the target copyright protection model.

[0079] In a specific implementation, a computer device can train a copyright detection model to be trained according to a model feature identification set to obtain a pre-trained copyright detection model. The pre-trained copyright detection model is used to detect whether the model to be detected infringes the copyright of a target copyright protection model.

[0080] Furthermore, the computer device can expand the model feature identification set by searching homologous data subsets to increase the diversity of training data, obtain an expanded model feature identification set, and train the copyright detection model to be trained based on the expanded model feature identification set.

[0081] The specific method of searching for subsets of homologous data is as follows: the computer device can divide the model feature identification set into k subsets, and each model feature identification in the model feature identification set is used as a data point; each subset includes a core point; the core point is represented as a randomly selected one in the model feature identification set; the distance from each data point to each core point is determined, and each data point is assigned to the subset to which the nearest core point belongs; the core point of each subset is updated to the mean of all data points in the subset, and the step of determining the distance from each data point to each core point is returned until the core point no longer changes or the maximum number of iterations is reached, and data enhancement processing is performed on the data points in each subset to obtain an expanded model feature identification set. .

[0082] In some embodiments, the copyright detection model to be trained includes an autoencoder recognition network and a mapping network. The computer device can train the recognition network and the mapping network using a self-supervised learning method to set the expanded model feature identification set. The model feature identifiers in are mapped to a low-dimensional representation space. The goal of self-supervised learning is to make the distance between data points of the same type as close as possible in the representation space, and the distance between data points of different types as far as possible. Specifically, the expanded model feature identifier set The training set and the test set are divided into two sets. The recognition network is trained using the self-supervised learning method to make the distance between the data points of the same type as close as possible in the representation space and the distance between the data points of different types as far as possible. The performance of the recognition network is verified to ensure that it can accurately distinguish the feature identifiers of different models. First, the feature identifier data is prepared. The expanded model feature identifier set Divide into training set and test set The training set is used to train the recognition network and the mapping network, and the test set is used to verify the performance of the network. Suppose the expanded model feature identification set Include samples, each sample consists of a feature point Tags Label after superimposing the reduced dimension feature vector Composition, that is ,in .

[0083] Furthermore, the recognition network adopts an autoencoder structure, which includes two parts: encoder and decoder. The encoder inputs high-dimensional feature identification data Mapping to a low-dimensional representation vector , the decoder transforms the low-dimensional representation vector Restore to high-dimensional data .

[0084] The encoder part consists of layers, each followed by a ReLU activation function. Assume that the encoder contains Layer, then The output of the layer is represented as: ,in, and Respectively The weight matrix and bias vector of the layer, is the input data. The decoder part is symmetrical with the encoder and is also composed of The decoder is composed of layers of fully connected layers, each of which is followed by a ReLU activation function. The output of the decoder is the restored high-dimensional data.

[0085] The mapping network consists of three identical sub-networks that share weights and structures. Each sub-network receives a low-dimensional representation vector as input and outputs a new low-dimensional representation vector. The three sub-networks process anchor points, positive samples, and negative samples respectively. Each sub-network consists of several fully connected layers, each followed by a ReLU activation function. Self-supervised learning is used to transform the low-dimensional representation vector output by the recognition network into a Mapped to the final representation vector. The goal of self-supervised learning is to make the distance between data points of the same type as close as possible in the representation space, and the distance between data points of different types as far as possible. Let the model feature identifier be , its direct pair is , negative pair is , the loss function for self-supervised learning It can be expressed as:

[0086] ;

[0087] in, express The same attitude, express The same attitude can be expressed using cosine attitude: , .

[0088] In the above-mentioned smart grid deep learning model copyright protection method based on model trust region, a target copyright protection model, a target risk model and a target homomorphic model corresponding to the target copyright protection model are obtained, wherein the target risk model is a model that has a smart grid data set infringement problem with the target copyright protection model; the target homomorphic model is a model obtained by simulating the target copyright protection model under the same problem domain; and for each model in the smart grid deep model set, a feature data sample whose distance between the corresponding model prediction value and the corresponding model discrimination boundary meets the preset conditions is searched in the smart grid proprietary data set to obtain a trust region feature point set, so that the obtained trust region feature point set can accurately describe the trust region information of the deep learning model, and then the gradient vector of the trust region feature point set on the model discrimination boundary is analyzed according to the linear discriminant analysis method. The perturbation vector of the trust domain feature point set is obtained by performing dimensionality reduction, so that the model feature identification set corresponding to the smart grid deep model set can be accurately generated according to the changes in the predicted labels before and after the trust domain feature point set is combined with the perturbation vector. The copyright detection model to be trained is trained by the model feature identification set to obtain a pre-trained copyright detection model; the pre-trained copyright detection model can be used to detect whether the model to be detected infringes the copyright of the target copyright protection model, and thus can effectively prevent attackers from forging identities and replacing users to participate in model training in the iteration after the start of training; at the same time, by extracting the trust domain features of the model to generate feature identification, risk models and homomorphic models can be effectively distinguished, the accuracy and robustness of feature identification matching are improved, the copyright security of the data set deployed in the smart grid model is guaranteed, and data leakage and unauthorized use are prevented.

[0089] In some embodiments, a computer device can use a pre-trained copyright detection model to detect whether the model to be detected infringes the copyright of the target copyright protection model. First, obtain the model feature identifiers corresponding to all models in the smart grid deep model set. For the model to be detected, according to the above-mentioned method for extracting model feature identifiers, generate the model feature identifier to be detected corresponding to the model to be detected. Match the generated model feature identifier to be detected with the target copyright protection model feature identifier, and calculate the similarity between the model feature identifiers. The same attitude can be expressed as the cosine similarity between the model feature identifier to be detected and the model feature identifier in the representation space. According to the cosine similarity between the model feature identifier to be detected and the model feature identifier of the target copyright protection model, it is judged whether the model to be detected infringes the data copyright of the target copyright protection model. If the similarity exceeds the threshold, it is judged that the model to be detected infringes the copyright of the target copyright protection model, so as to ensure the copyright security of the data set deployed by the model in the smart grid and prevent data leakage and unauthorized use.

[0090] Furthermore, it is also possible to judge whether the model to be detected belongs to a risk model or a homomorphic model based on the model feature identifier of the target risk model and the model feature identifier of the target homomorphic model, respectively, and the similarity between the feature identifiers of the model to be detected, thereby effectively distinguishing between risk models and homomorphic models and improving the accuracy and robustness of feature identifier matching.

[0091] In another embodiment, Figure 2 As shown, a smart grid deep learning model copyright protection method based on model trust region is provided, and the method is applied to a computer device as an example for illustration, including the following steps:

[0092] Step S202, obtaining a smart grid deep model set, and for each model in the smart grid deep model set, searching the smart grid proprietary data set for feature data samples whose distance between the corresponding model prediction value and the corresponding model discrimination boundary meets preset conditions, to obtain a trust domain feature point set.

[0093] Step S204, determining the gradient vector of the trust region feature point set on the model discrimination boundary, grouping the gradient vectors according to the category labels, and determining the mean vector of each category and the overall mean vector.

[0094] Step S206, determining the intra-class scatter matrix and the inter-class scatter matrix according to the mean vector of each class and the overall mean vector.

[0095] Step S208, by solving the eigenvalues ​​and eigenvectors of the product of the inverse matrix of the intra-class scatter matrix and the inter-class scatter matrix, select the eigenvectors whose cumulative contribution rate meets the preset conditions for dimensionality reduction processing, obtain the gradient vector after dimensionality reduction, and use the gradient vector after dimensionality reduction as the perturbation vector of the trust region feature point set.

[0096] Step S210, generating a model feature identification set corresponding to the smart grid deep model set according to the changes in the predicted labels of each model before and after combining the trust region feature point set with the disturbance vector.

[0097] Step S212, expanding the model feature identification set by searching homologous data subsets to obtain an expanded model feature identification set.

[0098] Step S214: training the copyright detection model to be trained using the expanded model feature identification set.

[0099] It should be noted that the specific limitations of the above steps can be found in the specific limitations of a smart grid deep learning model copyright protection method based on model trust region mentioned above.

[0100] In another embodiment, to facilitate understanding by those skilled in the art, Figure 3A flowchart of another smart grid deep learning model copyright protection method based on model trust region is provided. Figure 3 As shown, the copyright protection method of the smart grid deep learning model based on the model trust region of this embodiment can be divided into four parts: S1, the preparation stage of the smart grid deep learning model set, generating the target risk model through the model extraction algorithm, and generating the target homomorphic model by fine-tuning the data set and parameters, so as to build the smart grid deep learning model set; S2, the trust region feature identification set generation stage, performing data enhancement on the smart grid proprietary data set, extracting the model discrimination boundary to determine the trust region feature point set, and obtaining the gradient vector after dimensionality reduction by the linear discriminant analysis method; S3, the model feature identification set expansion and recognition network training stage, expanding the model feature identification set by searching the same source data subset, training the autoencoder recognition network, and comparing the learning mapping network; S4, the smart grid deep learning model copyright detection stage, generating the model feature identification corresponding to all models in the smart grid deep model set, and calculating the spatial similarity of the model feature identification through the recognition network, and making a privacy violation threshold judgment.

[0101] It should be noted that the specific limitations of the above steps can be found in the specific limitations of a smart grid deep learning model copyright protection method based on model trust region mentioned above.

[0102] It should be understood that, although the various steps in the flowcharts involved in the above-mentioned embodiments are displayed in sequence according to the indication of the arrows, these steps are not necessarily executed in sequence according to the order indicated by the arrows. Unless there is a clear explanation in this article, the execution of these steps does not have a strict order restriction, and these steps can be executed in other orders. Moreover, at least a part of the steps in the flowcharts involved in the above-mentioned embodiments can include multiple steps or multiple stages, and these steps or stages are not necessarily executed at the same time, but can be executed at different times, and the execution order of these steps or stages is not necessarily to be carried out in sequence, but can be executed in turn or alternately with other steps or at least a part of the steps or stages in other steps.

[0103] Based on the same inventive concept, the embodiment of the present application also provides a device for protecting copyright of a smart grid deep learning model based on a model trust region for implementing the above-mentioned method for protecting copyright of a smart grid deep learning model based on a model trust region. The implementation scheme for solving the problem provided by the device is similar to the implementation scheme recorded in the above-mentioned method, so the specific limitations in the embodiments of one or more devices for protecting copyright of a smart grid deep learning model based on a model trust region provided below can be found in the above-mentioned limitations on the method for protecting copyright of a smart grid deep learning model based on a model trust region, and will not be repeated here.

[0104] In an exemplary embodiment, Figure 4 As shown, a smart grid deep learning model copyright protection device based on a model trust region is provided, comprising: an acquisition module 410, a search module 420, a determination module 430, a generation module 440 and a training module 450, wherein:

[0105] Acquisition module 410 is used to acquire a smart grid deep model set; the smart grid deep model set includes a target copyright protection model, and a target risk model and a target homomorphic model corresponding to the target copyright protection model; the target risk model is a model that has a smart grid data set infringement problem with the target copyright protection model; the target homomorphic model is a model obtained by simulating the target copyright protection model under the same problem domain.

[0106] The search module 420 is used to search for feature data samples in the smart grid proprietary data set for each model in the smart grid deep model set, wherein the distance between the corresponding model prediction value and the corresponding model judgment boundary meets preset conditions, and obtain a trust domain feature point set; the model judgment boundary represents an area that can be predicted as other types within a preset displacement in the gradient direction of the model inference of the feature data sample.

[0107] The determination module 430 is used to determine the gradient vector of the trust region feature point set on the model discrimination boundary, and reduce the dimension of the obtained gradient vector according to the linear discriminant analysis method, and use the reduced gradient vector as the perturbation vector of the trust region feature point set.

[0108] The generation module 440 is used to generate a model feature identification set corresponding to the smart grid deep model set according to the predicted label changes of each model before and after combining the trust region feature point set with the disturbance vector.

[0109] The training module 450 is used to train the copyright detection model to be trained according to the model feature identification set to obtain a pre-trained copyright detection model; the pre-trained copyright detection model is used to detect whether the model to be detected infringes the copyright of the target copyright protection model.

[0110] In one embodiment, the determination module 430 is specifically used to group the gradient vectors according to category labels, determine the mean vector of each category and the overall mean vector; determine the intra-class scatter matrix and the inter-class scatter matrix according to the mean vector of each category and the overall mean vector; by solving the eigenvalues ​​and eigenvectors of the product of the inverse matrix of the intra-class scatter matrix and the inter-class scatter matrix, select the eigenvectors whose cumulative contribution rate meets the preset conditions for dimensionality reduction processing, and obtain the gradient vector after dimensionality reduction.

[0111] In one of the embodiments, the training module 450 is specifically used to expand the model feature identification set by searching homologous data subsets to obtain an expanded model feature identification set; and train the copyright detection model to be trained by using the expanded model feature identification set.

[0112] In one embodiment, the training module 450 is specifically used to divide the model feature identification set into k subsets, and each model feature identification in the model feature identification set is regarded as a data point; each subset includes a core point; the core point is represented as randomly selected from the model feature identification set; the distance from each data point to each core point is determined, and each data point is assigned to the subset to which the nearest core point belongs; the core point of each subset is updated to the mean of all the data points in the subset, and the step of determining the distance from each data point to each core point is returned until the core point no longer changes or the maximum number of iterations is reached, and data enhancement processing is performed on the data points in each subset to obtain the expanded model feature identification set.

[0113] In one embodiment, the acquisition module 410 is specifically used to acquire the training data set used in the training process of the target copyright protection model, and train the target homomorphic model on the training data set; the target homomorphic model includes a completely homomorphic model, an architectural homomorphic model and a problem domain homomorphic model; the completely homomorphic model is obtained by performing multiple trainings under the premise that all experimental settings are the same as those of the target copyright protection model; the architectural homomorphic model is obtained by performing multiple trainings under the premise that the architecture is the same as that of the target copyright protection model, by fine-tuning the hyperparameters during training; the problem domain homomorphic model is obtained by performing multiple trainings under the premise that the same source data set as that of the target copyright protection model is used, with a preset similar model structure and a randomly selected hyperparameter combination.

[0114] In one embodiment, the copyright detection model to be trained includes an autoencoder recognition network and a mapping network, and the training module 450 is specifically used to train the autoencoder recognition network and the mapping network using a self-supervised learning method to map the model feature identification set to a low-dimensional representation space;

[0115] If the model feature is , the positive pair of the model feature identifier is , the negative pair of the model feature identifier is , the loss function for self-supervised learning It can be expressed as:

[0116] ;

[0117] in, express The same attitude, express The same attitude.

[0118] Each module in the above-mentioned smart grid deep learning model copyright protection device based on model trust region can be implemented in whole or in part by software, hardware and their combination. Each of the above modules can be embedded in or independent of the processor in the computer device in the form of hardware, or can be stored in the memory of the computer device in the form of software, so that the processor can call and execute the operations corresponding to each of the above modules.

[0119] In an exemplary embodiment, a computer device is provided, which may be a smart grid deep learning model copyright protection system based on a model trust region, and its internal structure diagram may be shown in FIG5. The computer device includes a processor, a memory, an input / output interface (Input / Output, referred to as I / O) and a communication interface. Among them, the processor, the memory and the input / output interface are connected through a system bus, and the communication interface is connected to the system bus through the input / output interface. Among them, the processor of the computer device is used to provide computing and control capabilities. The memory of the computer device includes a non-volatile storage medium and an internal memory. The non-volatile storage medium stores an operating system, a computer program and a database. The internal memory provides an environment for the operation of the operating system and the computer program in the non-volatile storage medium. The database of the computer device is used to store model feature identification set data. The input / output interface of the computer device is used to exchange information between the processor and an external device. The communication interface of the computer device is used to communicate with an external terminal through a network connection. When the computer program is executed by the processor, a smart grid deep learning model copyright protection method based on a model trust region is implemented.

[0120] Those skilled in the art will understand that the structure shown in FIG. 5 is merely a block diagram of a partial structure related to the solution of the present application, and does not constitute a limitation on the computer device to which the solution of the present application is applied. The specific computer device may include more or fewer components than shown in the figure, or combine certain components, or have a different arrangement of components.

[0121] In one embodiment, a smart grid deep learning model copyright protection system based on model trust region is also provided, including a memory and a processor, wherein a computer program is stored in the memory, and the processor implements the steps in the above-mentioned method embodiments when executing the computer program.

[0122] In one embodiment, a computer-readable storage medium is provided, on which a computer program is stored. When the computer program is executed by a processor, the steps in the above-mentioned method embodiments are implemented.

[0123] In one embodiment, a computer program product is provided, including a computer program, which implements the steps in the above method embodiments when executed by a processor.

[0124] It should be noted that the user information (including but not limited to user device information, user personal information, etc.) and data (including but not limited to data used for analysis, stored data, displayed data, etc.) involved in this application are all information and data authorized by the user or fully authorized by all parties, and the collection, use and processing of relevant data must comply with relevant regulations.

[0125] A person of ordinary skill in the art can understand that all or part of the processes in the above-mentioned embodiment method can be completed by instructing the relevant hardware through a computer program, and the computer program can be stored in a non-volatile computer-readable storage medium. When the computer program is executed, it can include the processes of the embodiments of the above-mentioned methods. Among them, any reference to the memory, database or other medium used in the embodiments provided in the present application can include at least one of non-volatile memory and volatile memory. Non-volatile memory can include read-only memory (ROM), magnetic tape, floppy disk, flash memory, optical memory, high-density embedded non-volatile memory, resistive random access memory (ReRAM), magnetic random access memory (MRAM), ferroelectric random access memory (FRAM), phase change memory (PCM), graphene memory, etc. Volatile memory can include random access memory (RAM) or external cache memory, etc. As an illustration and not limitation, RAM can be in various forms, such as static random access memory (SRAM) or dynamic random access memory (DRAM). The database involved in each embodiment provided in this application may include at least one of a relational database and a non-relational database. Non-relational databases may include distributed databases based on blockchains, etc., but are not limited to this. The processor involved in each embodiment provided in this application may be a general-purpose processor, a central processing unit, a graphics processor, a digital signal processor, a programmable logic device, a data processing logic device based on quantum computing, an artificial intelligence (AI) processor, etc., but are not limited to this.

[0126] The technical features of the above embodiments may be combined arbitrarily. To make the description concise, not all possible combinations of the technical features in the above embodiments are described. However, as long as there is no contradiction in the combination of these technical features, they should be considered to be within the scope of this application.

[0127] The above-described embodiments only express several implementation methods of the present application, and the descriptions thereof are relatively specific and detailed, but they cannot be understood as limiting the scope of the present application. It should be pointed out that, for a person of ordinary skill in the art, several variations and improvements can be made without departing from the concept of the present application, and these all belong to the protection scope of the present application. Therefore, the protection scope of the present application shall be subject to the attached claims.

Claims

1. A copyright protection method for a smart grid deep learning model based on a model trust region, characterized in that: The method comprises: Acquire a smart grid deep model set; the smart grid deep model set includes a target copyright protection model, and a target risk model and a target homomorphic model corresponding to the target copyright protection model; the target risk model is a model that has a smart grid data set infringement problem with the target copyright protection model; the target homomorphic model is a model obtained by simulating the target copyright protection model under the same problem domain; For each model in the smart grid deep model set, a feature data sample whose distance between the corresponding model prediction value and the corresponding model discrimination limit meets a preset condition is searched in the smart grid proprietary data set to obtain a trust region feature point set; the model discrimination limit represents an area that can be predicted as other types within a preset displacement in the gradient direction of the model inference of the feature data sample; Determine the gradient vector of the trust region feature point set on the model discrimination boundary, and reduce the dimension of the obtained gradient vector according to the linear discriminant analysis method, and use the gradient vector after dimension reduction as the perturbation vector of the trust region feature point set; Generate a model feature identification set corresponding to the smart grid deep model set according to changes in predicted labels of each model before and after combining the trust region feature point set with the disturbance vector; The copyright detection model to be trained is trained according to the model feature identification set to obtain a pre-trained copyright detection model; the pre-trained copyright detection model is used to detect whether the model to be detected infringes the copyright of the target copyright protection model.

2. The method according to claim 1, characterized in that The step of determining the gradient vector of the trust region feature point set on the model discrimination boundary and performing dimensionality reduction on the obtained gradient vector according to a linear discriminant analysis method includes: Grouping the gradient vectors according to category labels, and determining a mean vector for each category and an overall mean vector; Determine a within-class scatter matrix and an between-class scatter matrix according to the mean vector of each of the categories and the overall mean vector; By solving the eigenvalues ​​and eigenvectors of the product of the inverse matrix of the intra-class scatter matrix and the inter-class scatter matrix, eigenvectors whose cumulative contribution rates meet preset conditions are selected for dimensionality reduction processing to obtain the gradient vector after dimensionality reduction.

3. The method according to claim 1, characterized in that The step of training the copyright detection model to be trained according to the model feature identification set includes: Expanding the model feature identification set by searching homologous data subsets to obtain an expanded model feature identification set; The copyright detection model to be trained is trained using the expanded model feature identification set.

4. The method according to claim 3, characterized in that The method of expanding the model feature identification set by searching homologous data subsets to obtain an expanded model feature identification set includes: Dividing the model feature identifier set into k subsets, and taking each model feature identifier in the model feature identifier set as a data point; each subset includes a core point; and the core point is represented by being randomly selected from the model feature identifier set; Determine the distance from each of the data points to each of the core points, and assign each of the data points to the subset to which the nearest core point belongs; The core point of each subset is updated to the mean of all the data points in the subset, and the step of determining the distance from each data point to each core point is returned until the core point no longer changes or the maximum number of iterations is reached, and data enhancement processing is performed on the data points in each subset to obtain the expanded model feature identification set.

5. The method according to claim 1, characterized in that The step of obtaining a smart grid deep model set includes: Acquire a training data set used in the training process of the target copyright protection model, and train the target homomorphic model on the training data set; the target homomorphic model includes a complete homomorphic model, an architecture homomorphic model, and a problem domain homomorphic model; The fully homomorphic model is obtained by multiple trainings under the premise that all experimental settings are the same as those of the target copyright protection model; The architecture homomorphic model is obtained by fine-tuning the hyperparameters during training and performing multiple trainings on the premise that the architecture is the same as that of the target copyright protection model; The problem domain homomorphic model is obtained by performing multiple trainings under a preset similar model structure and a randomly selected hyperparameter combination, under the premise of using the same source data set as the target copyright protection model.

6. The method according to claim 1, characterized in that The copyright detection model to be trained includes an autoencoder recognition network and a mapping network, and the step of training the copyright detection model to be trained according to the model feature identification set includes: Using a self-supervised learning method to train the autoencoder recognition network and the mapping network, mapping the model feature identification set to a low-dimensional representation space; If the model feature is , the positive pair of the model feature identifier is , the negative pair of the model feature identifier is , the loss function for self-supervised learning It can be expressed as: ； in, express The same attitude, express The same attitude.

7. A smart grid deep learning model copyright protection device based on model trust region, characterized in that: The device comprises: An acquisition module is used to acquire a smart grid deep model set; the smart grid deep model set includes a target copyright protection model, and a target risk model and a target homomorphic model corresponding to the target copyright protection model; the target risk model is a model that has a smart grid data set infringement problem with the target copyright protection model; the target homomorphic model is a model obtained by simulating the target copyright protection model under the same problem domain; A search module is used to search for feature data samples whose distance between the corresponding model prediction value and the corresponding model discrimination boundary meets a preset condition in the smart grid proprietary data set for each model in the smart grid deep model set, so as to obtain a trust region feature point set; the model discrimination boundary represents an area that can be predicted as other types within a preset displacement of the gradient direction of the model inference of the feature data sample; A determination module, used to determine the gradient vector of the trust region feature point set on the model discrimination boundary, and perform dimensionality reduction on the obtained gradient vector according to a linear discriminant analysis method, and use the gradient vector after dimensionality reduction as the perturbation vector of the trust region feature point set; A generation module, used to generate a model feature identification set corresponding to the smart grid deep model set according to the predicted label changes of each model before and after combining the trust region feature point set with the disturbance vector; The training module is used to train the copyright detection model to be trained according to the model feature identification set to obtain a pre-trained copyright detection model; the pre-trained copyright detection model is used to detect whether the model to be detected infringes the copyright of the target copyright protection model.

8. A smart grid deep learning model copyright protection system based on model trust region, comprising a memory and a processor, wherein the memory stores a computer program, characterized in that: When the processor executes the computer program, the steps of the method according to any one of claims 1 to 6 are implemented.

9. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the steps of the method according to any one of claims 1 to 6 are implemented.

10. A computer program product, comprising a computer program, characterized in that When the computer program is executed by a processor, the steps of the method according to any one of claims 1 to 6 are implemented.

Images