Method for verifying integrity of data set, method for training model and computing equipment

Abstract

A data set integrity verification method, a model training method and a computing device relate to a to-be-tested model obtained through training according to a real data set, the real data set comprises a training sample, and the training sample comprises a target sample. The sample number of the target sample in the real data set is generated by using a preset pseudo-random number generation algorithm and taking a first identifier as a random number seed, and the first identifier is determined by using a preset Hash algorithm according to the training sample in the real data set; the prediction result distribution of the to-be-tested model for the target sample and the real data set is different; acquiring a nominal data set; selecting training samples in the nominal data set according to a Hash algorithm and a pseudo-random number generation algorithm to obtain a probe set; determining the prediction accuracy of the to-be-tested model for the probe set; whether the nominal data set is the real data set is determined according to the prediction accuracy corresponding to the probe set, and tiny tampering of the real data set used in the training process can be recognized with low calculation cost.

Description

Technical Field

[0001] The embodiments in this specification belong to the field of machine learning technology, and in particular relate to methods for verifying the integrity of datasets, methods for training models, and computing devices. Background Technology

[0002] With the widespread application of deep learning across various industries, scenarios where model owners and users have independent identities are no longer uncommon. On the one hand, model users may choose to entrust the model owner to train the model using their own data; on the other hand, model owners may also share or sell the model after completing its training, allowing model users to use the ready-made model to meet their needs without having to participate in the training process.

[0003] During model training, if the training dataset contains falsified, missing, or backdoor-containing issues, the model user will directly bear the consequences, including drastic performance drops, security vulnerabilities, and soaring iteration costs. Typically, model owners publicly disclose the training dataset used during training to provide proof of their model's validity. However, to eliminate the aforementioned problems, before using the model, the user still needs to verify whether the publicly disclosed training dataset is genuinely and completely used in the training process—that is, to perform Trusted Dataset Proof (TDP).

[0004] Currently, existing TDP methods mainly fall into three categories. One is the Dataset Watermarking scheme. In this scheme, the data holder implants specific "backdoors" (e.g., uniformly modifying the labels of selected training samples to specific parameter values) or "triggers" (e.g., making specific modifications to the selected training samples) into the training dataset. The model trainer uses the training dataset provided by the data holder, enabling the model to learn the corresponding "backdoors" or "triggers." Therefore, during the validation phase, the model is validated using the selected training samples. If the model's prediction results for the selected training samples conform to the preset "backdoor" or "trigger" settings, it indicates that the training dataset has been used correctly. However, this scheme, due to the implantation of backdoors into the training dataset, can affect the model's prediction accuracy and security to some extent.

[0005] The second approach is the dataset inference scheme. This scheme involves constructing a test dataset with the same distribution as the training dataset and using the test dataset to validate the model. If the model exhibits significantly higher "familiarity" (e.g., higher confidence or lower loss) with respect to the test dataset compared to other datasets (unrelated to the training dataset), it is inferred that the training dataset was indeed used for training. This scheme relies on the similarity of the overall distribution between datasets and lacks sensitivity to minor data manipulations (e.g., poisoning of 0.01% of the sample size), making it prone to false negatives.

[0006] The third approach is the cryptographically based Proof of Training Data (PoTD) scheme. In this scheme, the forward and backward propagation processes of each round during model training are publicly exposed on the blockchain, providing a verifiable training process. This method incurs extremely high computational and storage overhead, and due to the complete public exposure of the training process, it also carries the risk of privacy breaches.

[0007] In view of the shortcomings of the above-mentioned solutions, this specification provides a technical solution for verifying the integrity of a dataset, so as to at least partially solve the above problems. Summary of the Invention

[0008] This specification provides embodiments intended to offer methods for verifying dataset integrity, methods for training models, and computing devices, including:

[0009] This specification provides a method for verifying the integrity of a dataset. The method relates to a model under test, which is trained on a real dataset. The real dataset includes several training samples, each containing several target samples. The sample numbers of the target samples in the real dataset are generated using a preset pseudo-random number generation algorithm. The pseudo-random number generation algorithm uses a first identifier as a random number seed, which is determined using a preset hash algorithm based on all training samples in the real dataset. The distribution of the prediction results of the model under test for the target samples differs from that of the real dataset. The method includes:

[0010] Obtain the nominal dataset;

[0011] Based on the hash algorithm and the pseudo-random number generation algorithm, a number of training samples are selected from the nominal dataset to obtain a probe set;

[0012] Determine the prediction accuracy of the model under test for the probe set;

[0013] Based on the prediction accuracy corresponding to the probe set, determine whether the nominal dataset is the real dataset.

[0014] A second aspect of this specification provides a method for training a model, the method comprising:

[0015] Determine the base model to be trained and the real dataset, wherein the real dataset includes several training samples;

[0016] Using a preset hash algorithm, determine the first identifier corresponding to all training samples in the real dataset;

[0017] Using a preset pseudo-random number generation algorithm, the first identifier is used as a random number seed to generate several sample numbers, and the training samples corresponding to the several sample numbers in the real dataset are used as target samples.

[0018] The training parameters for target samples and non-target samples in the real dataset are set differently, where the non-target samples are training samples other than the target samples in the real dataset.

[0019] The base model is trained using the prepared real dataset to obtain the model to be tested.

[0020] A third aspect of this specification provides a computer-readable storage medium having a computer program stored thereon that, when executed in a computer, causes the computer to perform the methods described in the first or second aspect.

[0021] A fourth aspect of this specification provides a computing device including a memory and a processor, wherein the memory stores executable code, and the processor, when executing the executable code, implements the method as described in the first or second aspect.

[0022] The scheme for verifying the integrity of the dataset provided in this embodiment can identify minor tampering with the real dataset used in the training process at a low computational cost. Attached Figure Description

[0023] To more clearly illustrate the technical solutions of the embodiments in this specification, the drawings used in the description of the embodiments will be briefly introduced below. Obviously, the drawings described below are only some embodiments recorded in this specification. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0024] Figure 1 This is a system architecture diagram of a technical solution for verifying the integrity of a dataset in one embodiment of this specification;

[0025] Figure 2 This is a flowchart illustrating the training process in one embodiment of this specification;

[0026] Figure 3 This is a flowchart illustrating the model parameter adjustment process in any round during training, as described in one embodiment of this specification.

[0027] Figure 4 This is a flowchart illustrating a method for verifying the integrity of a dataset in one embodiment of this specification. Detailed Implementation

[0028] To enable those skilled in the art to better understand the technical solutions in this specification, the technical solutions in the embodiments of this specification will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of this specification, and not all embodiments. Based on the embodiments in this specification, all other embodiments obtained by those skilled in the art without creative effort should fall within the scope of protection of this specification.

[0029] First, it should be noted that the problem this embodiment aims to solve is the issue where the model owner claims the nominal dataset used after the model under test has been trained is inconsistent with the actual real dataset used during training. To address this problem, the technical solution for verifying dataset integrity proposed in this embodiment combines the training and verification processes. That is, in this embodiment, the model trainer must follow a specific procedure to ensure the effectiveness of the verification process.

[0030] The difference between the model owner and the model user has been explained above and will not be repeated here. To align with the training process of this embodiment, this specification further distinguishes between the model owner and the model trainer. Specifically, Figure 1 A system architecture diagram of a technical solution for verifying dataset integrity according to an embodiment of this specification is shown. Figure 1 As shown, the technical solution for verifying the integrity of the dataset involves the model owner, the model trainer, and the model validator.

[0031] The training process involves both the model owner and the model trainer. The model owner is responsible for providing the real dataset used for training and setting the base model to be trained, as well as the training-related hyperparameters. The model trainer is responsible for training the model to be tested using the base model based on the real dataset, base model, hyperparameters, and a pre-defined training procedure provided by the model owner, and then feeding the model to be tested back to the model owner. It should be noted that this embodiment distinguishes between the roles of the model owner and the model trainer primarily to ensure that the training process cannot be tampered with by the model owner (and vice versa). The model owner can only pre-set the real dataset, base model, hyperparameters, etc., before the training process begins, and the training process must be executed according to the pre-defined procedure. This ensures the validity of the subsequent verification process in this embodiment. Provided that the model owner cannot tamper with the training process, the model owner and the model trainer can be the same organization or different organizations; this specification does not impose any restrictions.

[0032] The model validator does not participate in the training process at all. It only verifies whether the nominal dataset is the real dataset actually used in the training process based on the model to be tested and the nominal dataset provided by the model owner (the model owner may not be honest and may not provide the real dataset used in the training process).

[0033] Specifically, Figure 2This document illustrates a flowchart of the training process in one embodiment. In this embodiment, the model owner can set the real dataset used for training and the base model to be trained before the training process begins, and accordingly set the hyperparameters (learning rate, optimizer type, loss function type, number of training epochs, data preprocessing method, etc.) during the training process. This document does not limit the type of the base model to be trained; the base model can be any common deep learning model, including but not limited to Convolutional Neural Networks (CNN), Transformers, and Multilayer Perceptrons (MLP). For example, ResNet-50 can be used as the base model in image classification scenarios; BERT-base can be used as the base model in text classification scenarios. Accordingly, this specification does not restrict the data type of training samples in the real dataset. The training samples may include input samples and corresponding labels. Depending on the model category of the base model, the input samples may be image data, text data, audio / video data, etc. The labels corresponding to the input samples can be determined according to the training needs of the model trainer (for example, for an image recognition task, the input samples may be image data, and the corresponding labels may be text data indicating the names of objects in the image input). Furthermore, this embodiment does not impose specific restrictions on the hyperparameters; the specific values ​​of each hyperparameter can be set by the implementer according to its own training needs.

[0034] After setting the base model, real dataset, and hyperparameters, the training process can be executed. In the preset scenario of this embodiment, this training process can be executed by the model owner or a trusted third-party training structure entrusted by the model owner. Here, the organization executing the training process is referred to as the model trainer, and the training process specifically includes:

[0035] Step S201: Using a preset hash algorithm, determine the first identifier corresponding to all training samples in the real dataset.

[0036] As mentioned above, the problem this embodiment aims to solve is the inconsistency between the real dataset and the nominal dataset claimed to be used after training. More specifically, this problem is considered inconsistent even if the real dataset and the nominal dataset contain the same amount (90%) of data. The purpose of this embodiment is to ensure that any inconsistency between the real dataset and the nominal dataset can be identified through a verification process.

[0037] Considering that the verification process needs to be sensitive to even minor differences, this embodiment uses a hash algorithm to calculate the first identifier corresponding to all training samples in the real dataset. Utilizing the "avalanche effect" of hash algorithms (a small change in the algorithm input will lead to a drastic change in the algorithm output), even if any dataset has most of the same training samples as the real dataset and is processed using the same hash algorithm, as long as there are differences between the two datasets, the resulting identifiers will be significantly different. Therefore, this first identifier uniquely corresponds to the complete real dataset.

[0038] This specification does not limit the specific type of hash algorithm used in step S201. For example, it can be MD5, SHA-1, RIPEMD-128, RIPEMD-160, SHA-224, SHA-256, etc.

[0039] In some implementations, the model owner may set a real key for performing the hash algorithm before step S201, and then in step S201, the model trainer uses the hash algorithm and the real key to determine the first identifier corresponding to all training samples in the real dataset.

[0040] Therefore, an identifier identical to the first identifier can only be calculated if the key is the same as the real key used during training and the dataset is the same as the real dataset. Since the real key is provided by the model owner who actually initiates the training process, a non-real model owner cannot provide the real key for verification after training, leading to verification failure. The existence of the key ensures the authenticity of the model owner's identity in subsequent verification processes.

[0041] The specific implementation of the hash algorithm combined with the key can be, for example, by concatenating the key into the algorithm input, or by referring to the implementation of hash algorithms such as HMAC and Blake2-MAC. This specification does not impose any restrictions here.

[0042] Step S203: Using a preset pseudo-random number generation algorithm, the first identifier is used as a random number seed to generate several sample numbers, and the training samples corresponding to the several sample numbers in the real dataset are used as target samples.

[0043] After determining the first identifier, a preset pseudo-random number generation algorithm can be used to generate several sample numbers, using the first identifier as a random number seed. The training samples corresponding to these sample numbers in the real dataset are then used as target samples. It should be noted that for different implementations, as long as the same pseudo-random number generation algorithm is used and the same random number seed and algorithm parameters (such as the length and number of generated pseudo-random numbers) are set, the generated pseudo-random number sequences (i.e., the sample numbers in this embodiment) will all be identical. On the other hand, even if the same pseudo-random number generation algorithm is used, it is impossible to generate the same pseudo-random number sequence if the random number seed is different.

[0044] Therefore, the sample number generated in step S203 in this embodiment also uniquely corresponds to the first identifier, that is, the sample number generated in step S203 uniquely corresponds to the complete real dataset. Combining steps S201 and S203, if the real dataset is tampered with, even if the same process (steps S201-S203) is followed, the generated sample numbers will be very different.

[0045] The specific type of the preset pseudo-random number generation algorithm is not limited in this specification; for example, it can be MT19937, xoshiro256++, PCG32 / PCG64, etc. Furthermore, the number of generated sample IDs—that is, the number of target samples—is also the size of the probe set in the subsequent verification process of this embodiment. In some implementations, the size of the probe set (i.e., the number of sample IDs generated in step S203, which is also the number of target samples) can be set to [0.1%, 5%] of the total number of training samples in the real dataset. A larger probe set results in a lower probability of errors in the subsequent verification process, while a smaller probe set results in faster execution of the subsequent verification process.

[0046] Step S205: Differentiate the training parameters for target samples and non-target samples in the real dataset, wherein the non-target samples are training samples other than the target samples in the real dataset.

[0047] After determining each target sample, this embodiment sets different training parameters for the target samples and non-target samples so that the training of the base model to be trained "remembers" each target sample during the training process.

[0048] In some implementations, the sampling weights of each target sample and the sampling weights of non-target samples can be set differently.

[0049] Specifically, the aforementioned differentiated settings for sampling weights may include: amplifying the sampling weights corresponding to each target sample to several times that of non-target samples; or reducing the sampling weights corresponding to each target sample to that of non-target samples. (n>1), this specification does not impose any restrictions. In some implementations, the sampling weight of each target sample can be reduced to 0; in other implementations, the sampling weight of each target sample can be set to [5,20] times that of the non-target samples.

[0050] The sampling weight determines the probability that a training sample will be selected (from the real dataset) for model parameter tuning (one round of model parameter tuning is equivalent to one round of complete forward propagation + backpropagation) during the training process. In the complete training process (i.e., iteratively performing multiple rounds of model parameter tuning), training samples with larger sampling weights will be selected more frequently for model parameter calls. The higher the sampling weight of a training sample, the more rounds the base model learns from that training sample, and the more accurate the prediction results of the trained model for that training sample will be. Conversely, the lower the sampling weight of a training sample, the less accurate the prediction results of the trained model for that training sample will be.

[0051] In summary, by setting different sampling weights for target samples and non-target samples, the training model can produce different distributions of prediction results for target samples and non-target samples.

[0052] It should also be noted that, since this embodiment only sets the sampling weights, it does not introduce "backdoors" or "triggers" during the training process as is the case with existing dataset watermarking schemes. The adjustment of the sampling weights will not affect the overall prediction accuracy and security of the trained model.

[0053] In some other implementations, in step S205, the training labels for target samples and non-target samples can be differentiated.

[0054] Specifically, the aforementioned differentiated settings for sampling weights may include: setting the training labels corresponding to each target sample to a uniform category; or setting the training labels corresponding to each target sample to a random category.

[0055] Obviously, directly adjusting the training labels can also cause the prediction results of the trained model to differ between target samples and non-target samples.

[0056] However, this method of adjusting training labels is equivalent to introducing incorrect training samples into the real dataset, which may affect the prediction accuracy of the trained model to some extent. Therefore, the number of target samples needs to be controlled, for example, by setting the size of the probe set to 0.1% of the real dataset.

[0057] It should be noted that both adjusting the training labels and setting the sampling weights in step S205 are performed during the training process. As mentioned above, in the preset scenario of this embodiment, the model owner cannot tamper with the execution method of step S205. That is, during the training process of the model under test, it can be guaranteed that steps S201-S205 are executed according to the process settings (which may include: the type and parameters of the hash function, the type and parameters of the pseudo-random number generation algorithm, the size of the probe set, the adjustment of sampling weights, the adjustment of training labels, etc.). The aforementioned process settings can be pre-set by any of the participating parties in this embodiment (model owner, model trainer, model validator, etc.), and this specification does not impose any restrictions on this.

[0058] Step S207: Train the base model using the prepared real dataset to obtain the model to be tested.

[0059] After differentiating the training parameters for target and non-target samples in the real dataset, the base model can be trained using the differentiated real dataset. Specifically, training the base model may involve several rounds of model parameter tuning. Figure 3 This diagram illustrates the process of adjusting model parameters in any one of the rounds. For example... Figure 3 As shown, the model parameter adjustments in any round include:

[0060] Step S301: Based on the sampling weights, sample from the real dataset to determine several training samples from the real dataset as test samples.

[0061] The batch size (number of training samples per round) can be pre-set by the model trainer. In this embodiment, each round randomly samples from the real dataset according to the sampling weight corresponding to each training sample. Therefore, the same training sample may be selected as the test sample multiple times in different rounds. Consequently, training samples with higher sampling weights will be learned more fully by the base model.

[0062] Step S303: Use the basic model to process each sample to be tested and obtain the prediction results.

[0063] This specification does not impose any restrictions on the form in which the prediction results are represented. For example, when the model under test is used to perform a multi-class classification task, the prediction results may be the predicted probability distributions for each predicted class output by the basic model; when the model under test is used to perform a regression task, the prediction results may also be scalar values.

[0064] Step S305: Based on the prediction result and corresponding label of each test sample, determine the loss value for the current round using a preset loss function.

[0065] The loss function can be any of the common loss functions used for supervised learning, such as cross-entropy loss function (usually used for multi-class classification tasks) or mean squared error (usually used for regression tasks). This specification does not impose any restrictions on it.

[0066] Step S307: Adjust the parameters of the basic model according to the loss value corresponding to the current round.

[0067] After determining the loss value corresponding to the current round, the gradients of each parameter in the basic model can be calculated, and the parameters of the basic model can be adjusted using a preset optimizer.

[0068] After iterating through multiple rounds of model parameter adjustments to achieve the preset training objectives (e.g., the number of rounds for adjusting model parameters or the minimum improvement of model parameter metrics), the model to be tested can be trained from the base model.

[0069] After training the model under test, the training provider will feed back the trained model (i.e., the model parameters) to the model owner (if the training provider and the model owner are the same organization, no feedback is needed). The model owner often chooses to make the interface of the model under test public or authorize its public release for users to call. To illustrate the performance and application scenarios of the model under test, the model owner often also discloses the training dataset used during training, along with the public interface. Honest model owners will directly disclose the actual dataset used, while dishonest model owners may (claim) to disclose a training dataset that is not the actual dataset used during training. Therefore, without verification, the training dataset disclosed by the model owner is referred to as the nominal dataset.

[0070] Figure 4 This specification illustrates a flowchart of a method for verifying dataset integrity according to one embodiment. Figure 4 The method shown is the verification process in this embodiment. This method can be performed by the model verification party against the nominal dataset disclosed by the model owner and the model to be tested. The party includes:

[0071] Step S401: Obtain the nominal dataset.

[0072] As mentioned above, this nominal dataset is the training dataset used by the model owner when training the model to be tested.

[0073] Step S403: Based on the hash algorithm and the pseudo-random number generation algorithm, select several training samples from the nominal dataset to obtain a probe set.

[0074] During the verification process, the model verification team uses the same method as steps S201-103 in the training process to select several training samples from the nominal dataset to form a probe set.

[0075] Specifically, in step S403, the hash algorithm used in step S201 can be used to determine the second identifier corresponding to all training samples in the nominal dataset; then, the pseudo-random number generation algorithm used in step S203 can be used to generate several sample numbers using the second identifier as a random number seed, and the training samples corresponding to the several sample numbers in the nominal dataset can be used as probe samples to form a probe set.

[0076] Based on the preceding introduction to hash algorithms and pseudo-random number generation algorithms, it is known that if the nominal dataset is the same as the real dataset used in the training process, then using the same hash algorithm, the second identifier should be equal to the first identifier. Furthermore, using the same pseudo-random number seed and pseudo-random number generation algorithm, the generated pseudo-random number sequences should be completely identical; that is, the training samples in the probe set should be completely identical to the target samples determined in step S203. However, if there are any differences between the nominal dataset and the real dataset, the training samples in the probe set will be almost entirely unrelated to the target samples. That is, as described above... Figure 4 The method shown is highly sensitive to minor alterations to the dataset. Even if there is a 0.01% difference between the nominal dataset and the real dataset, the probe dataset obtained in step S403 will be significantly different from the target sample.

[0077] It should be noted that if a real key is used in determining the first identifier during the training process (i.e., step S201), the model owner must provide the real key to the model verifier so that the model verifier can use the real key in step S403 to implement the same identifier determination process as the training process.

[0078] Step S405: Determine the prediction accuracy of the model under test for the probe set.

[0079] Therefore, after determining the probe set, the training samples in the probe set can be processed using the model under test. Based on the prediction results output by the model under test, the prediction accuracy of the model for the probe set can be determined. For any training sample, the prediction accuracy represents the difference between the prediction result output based on the input sample in that training sample and the label corresponding to that training sample. The prediction accuracy of the probe set can be determined based on the prediction accuracy corresponding to each training sample in the probe set (for example, the prediction accuracy corresponding to each training sample in the probe set can be weighted and summed to determine the prediction accuracy of the probe set).

[0080] In some implementations, if the model under test is used for a multi-class classification task, for any training sample in the probe set, the model under test is used to determine the predicted probability distribution corresponding to the training sample, which shows the predicted probability of the training sample belonging to each category; and a preset scoring algorithm is used to determine the accuracy score corresponding to the predicted probability distribution based on the label corresponding to the training sample.

[0081] The model to be tested is... The training samples are denoted as Let the predicted probability distribution corresponding to the training samples be denoted as The labels corresponding to the training samples are denoted as Accuracy ratings can include the following categories:

[0082] In some implementations, the pre-defined scoring algorithm can be designed based on confidence levels, and for any training sample, the accuracy score of that training sample can be determined. That is:

[0083] This means using the maximum value in the predicted probability distribution as the accuracy score for that training sample. Clearly, the higher the model's confidence in its predictions, the higher the accuracy score. The higher.

[0084] In other implementations, the pre-defined scoring algorithm can be designed based on a loss function, which scores the accuracy of any training sample. That is:

[0085] in, This represents the cross-entropy loss function. Since the loss value is usually set to a negative number, The larger the value, the smaller the absolute value of the loss, and the higher the prediction accuracy of the model.

[0086] In other implementations, the pre-defined scoring algorithm can be designed based on information entropy, which scores the accuracy of any training sample. That is:

[0087] in, This represents the predicted probability for the i-th category in the predicted probability distribution. This can represent the information entropy corresponding to the predicted probability distribution; the lower the entropy, the more deterministic the model. Therefore, the lower the entropy, The larger. That is The larger the value, the higher the model's confidence in its predictions.

[0088] In some other implementations, this embodiment also provides a method for constructing a scoring algorithm. Specifically, the accuracy score may include a first scoring item and a second scoring item. The first scoring item is determined based on the predicted probability corresponding to the true category, and the higher the predicted probability corresponding to the true category, the larger the first scoring item. The true category is indicated by the label. The second scoring item is determined based on the disorder of the predicted probability distribution corresponding to each incorrect category, and the higher the disorder of the distribution, the smaller the second scoring item.

[0089] Specifically, for any given training sample, the accuracy score of that training sample. That is:

[0090] in, As the first scoring item, This is the second scoring item.

[0091] This represents the predicted probability corresponding to the true category shown by the label. This represents the predicted probability for each error category. It can reflect the disorder of the predicted probability distribution corresponding to each error category. For numerically stable terms, they can typically take a minimum value, for example... , This is the balance coefficient between the first and second scoring items, and it can usually be taken as... .

[0092] Imagine that when the model's predicted probability distribution for training samples contains multiple categories with relatively high predicted probabilities, it indicates that the model's predictions are ambiguous, meaning the model has low confidence in the prediction results. In this embodiment, accuracy scoring is used... The second scoring item (the degree of disorder in the predicted probability distribution corresponding to each error category) represents the model's confidence in the predicted probability distribution. Combined with the first scoring item, it can comprehensively reflect the accuracy and confidence of the model's predictions. The larger the value, the higher the accuracy and confidence of the model's predictions.

[0093] Step S407: Determine whether the nominal dataset is the real dataset based on the prediction accuracy corresponding to the probe set.

[0094] Determining the accuracy score corresponding to each training sample in the probe set allows for further determination of the distribution characteristics of the accuracy scores in the probe set. Specifically, for a probe set, the distribution characteristics may include the capacity of the accuracy scores in the probe set (i.e., the number of training samples in the probe set), the mean of the accuracy scores in the probe set, and the variance of the accuracy scores in the probe set.

[0095] Furthermore, the idea of ​​hypothesis testing can be used to determine whether the nominal dataset is the real dataset based on the distribution characteristics of the accuracy scores in the probe set.

[0096] Specifically, a baseline set consisting of several training samples can be determined first. This baseline set can be obtained by random sampling from the nominal dataset or by random sampling from training samples in the nominal dataset that are not part of the probe set; this specification does not impose any restrictions on this. Similarly, this specification does not impose any restrictions on the number of training samples in the baseline set.

[0097] After determining the benchmark set, the accuracy score corresponding to each training sample in the benchmark set is determined using the same method (using the same scoring algorithm) as when processing the probe set in step S405, and the distribution characteristics of the accuracy scores in the benchmark set are determined. Similarly, for the benchmark set, the distribution characteristics may include the capacity of the accuracy scores in the benchmark set (i.e., the number of training samples in the probe set), the mean of the accuracy scores in the benchmark set, and the variance of the accuracy scores in the benchmark set.

[0098] Since the benchmark set is obtained by random sampling from the nominal dataset (without using the aforementioned pseudo-random number generation algorithm with the second identifier as the random number seed), it theoretically consists of training samples unrelated to the probe set. Therefore, the training samples in the benchmark set should not have undergone differential settings for training parameters or labels. However, if the nominal dataset is the real dataset, the training samples in the probe set should have undergone differential settings for training parameters or labels. Consequently, the distribution characteristics of accuracy scores in the benchmark set and the distribution characteristics of accuracy scores in the probe set should differ significantly.

[0099] For example, hypothesis testing methods can be used to determine whether there is a significant difference in accuracy scores between the baseline set and the probe set. In some implementations, the null hypothesis can be set as the distribution of accuracy scores in the baseline set being no different from that in the probe set. Further, based on the distribution characteristics of the baseline set and the probe set, the degree of deviation of the probe set relative to the baseline set can be determined. In some implementations, the effect size of the t-test can be used... As a measure of the deviation of the probe set from the reference set:

[0100] in, The capacity for accuracy scoring within the probe set. The mean of the accuracy scores in the probe set. The variance of the accuracy scores in the probe set. The capacity of the accuracy scores in the benchmark set. The mean of accuracy scores in the benchmark set. This represents the variance of the accuracy scores in the benchmark set.

[0101] After determining the degree of deviation, it can be determined whether the degree of deviation reaches a preset deviation threshold. If the degree of deviation reaches the preset deviation threshold, further determination can be made by referring to a table. The corresponding p-value is determined, and based on a preset significance level, it is determined whether the p-value is less than that significance level. Therefore, if the degree of deviation reaches a preset deviation threshold, and... If the corresponding p-value is less than the significance level, the null hypothesis can be rejected.

[0102] If the null hypothesis is rejected, it means that there is indeed a significant difference between the probe set and the benchmark set. Accordingly, the nominal dataset can be certified as the real dataset used in the training process.

[0103] The larger the absolute value of the deviation threshold, the more rigorous the validation between the nominal and real datasets. In some implementations, this deviation threshold can be set to 0.5.

[0104] The significance level can be set to common significance levels for p-values, such as 0.1, 0.05, etc., and this specification does not impose any restrictions on it.

[0105] In the preceding introduction, the null hypothesis was that the distribution of accuracy scores in the baseline set and the probe set were identical, meaning the directionality of the accuracy score distribution difference was not considered. The conclusion that the nominal dataset was the real dataset was only required if there was a significant difference between the two distributions. However, the directional nature of the impact of differentiation settings on accuracy scores still needs to be considered. For example, if the differentiation is set to "amplify the sampling weights corresponding to each target sample to several times that of non-target samples" or "set the training labels corresponding to each target sample to a unified category," then the accuracy score of the probe set should be significantly higher than that of the baseline set; conversely, if the differentiation is set to "reduce the sampling weights corresponding to each target sample to several times that of non-target samples," then the accuracy score of the probe set should be significantly higher than that of the baseline set. If "(n>1)" or "set the training labels corresponding to each target sample to random categories", then the accuracy score of the probe set should be significantly lower than that of the benchmark set.

[0106] Therefore, under the condition that the differentiation is set to "amplify the sampling weights corresponding to each target sample to several times that of the non-target samples" or "set the training labels corresponding to each target sample to a unified category", the null hypothesis can be set to the accuracy score in the benchmark set being no lower than the accuracy score in the probe set. The null hypothesis is rejected only when the accuracy score in the probe set is significantly higher than that in the benchmark set, thus confirming that there is a significant difference between the probe set and the benchmark set, and finally arriving at the conclusion that the nominal dataset is the real dataset.

[0107] The differentiation setting is "reduce the sampling weights corresponding to each target sample to non-target samples". Under the conditions of "(n>1)" or "set the training labels corresponding to each target sample to random categories", the null hypothesis can be set as the accuracy score in the benchmark set is no higher than the accuracy score in the probe set. The null hypothesis is rejected only when the accuracy score in the probe set is significantly lower than that in the benchmark set, thus verifying that there is a significant difference between the probe set and the benchmark set, and finally concluding that the nominal dataset is the real dataset.

[0108] By observing the training and verification processes in this embodiment, it can be found that the main additional time compared to simple model training lies in processing the real and nominal datasets using hash functions. Experiments on the ImageNet dataset (1.28 million images) show that determining the corresponding identifier for ImageNet using MD5 hashing takes approximately 7 minutes (the hash function calculation uses streaming batch processing (batch size = 1024), with a space complexity of O(1)), and a peak memory usage of 467.46 MB. These time and memory consumption figures demonstrate that this embodiment can be applied to industrial-grade datasets with relatively low computational cost.

[0109] like Figure 4The method shown is for verifying the integrity of a dataset, which can identify minor tampering with the real dataset used in the training process at a low computational cost.

[0110] In addition, in some implementations, such as Figure 2 The method shown can be performed by a trusted computing institution, that is, the model trainer can be a trusted computing institution other than the model owner, and the real dataset (which, in some implementations, also includes the real key) is transferred from the model owner to the trusted computing institution.

[0111] Therefore, this trusted computing institution can guarantee the uninterrupted execution of the training process, thereby ensuring the normal execution of the subsequent verification process. Furthermore, the real key can also be issued and determined by this trusted computing institution for the real dataset, further guaranteeing the security of the real key and ensuring the security of the entire training process.

[0112] In the 1990s, improvements to a technology could be clearly distinguished as either hardware improvements (e.g., improvements to the circuit structure of diodes, transistors, switches, etc.) or software improvements (improvements to the methodology). However, with technological advancements, many methodological improvements today can be considered direct improvements to the hardware circuit structure. Designers almost always obtain the corresponding hardware circuit structure by programming the improved methodology into the hardware circuit. Therefore, it cannot be said that a methodological improvement cannot be implemented using hardware physical modules. For example, a Programmable Logic Device (PLD) (such as a Field Programmable Gate Array (FPGA)) is such an integrated circuit whose logic function is determined by the user programming the device. Designers can program and "integrate" a digital system onto a PLD themselves, without needing chip manufacturers to design and manufacture dedicated integrated circuit chips. Furthermore, nowadays, instead of manually manufacturing integrated circuit chips, this programming is mostly implemented using "logic compiler" software. Similar to the software compiler used in program development, the original code before compilation must also be written in a specific programming language, called a Hardware Description Language (HDL). There are many HDLs, such as ABEL (Advanced Boolean Expression Language), AHDL (Altera Hardware Description Language), Confluence, CUPL (Cornell University Programming Language), HDCal, JHDL (Java Hardware Description Language), Lava, Lola, MyHDL, PALASM, and RHDL (Ruby Hardware Description Language). Currently, the most commonly used are VHDL (Very-High-Speed ​​Integrated Circuit Hardware Description Language) and Verilog. Those skilled in the art should also understand that by simply performing some logic programming on the method flow using one of these hardware description languages ​​and programming it into an integrated circuit, the hardware circuit implementing the logical method flow can be easily obtained.

[0113] The controller can be implemented in any suitable manner. For example, it can take the form of a microprocessor or processor and a computer-readable medium storing computer-readable program code (e.g., software or firmware) executable by the (micro)processor, logic gates, switches, application-specific integrated circuits (ASICs), programmable logic controllers, and embedded microcontrollers. Examples of controllers include, but are not limited to, the following microcontrollers: ARC 625D, Atmel AT91SAM, Microchip PIC18F26K20, and Silicon Labs C8051F320. A memory controller can also be implemented as part of the control logic of the memory. Those skilled in the art will also recognize that, in addition to implementing the controller in purely computer-readable program code form, the same functionality can be achieved by logically programming the method steps to make the controller take the form of logic gates, switches, application-specific integrated circuits, programmable logic controllers, and embedded microcontrollers. Therefore, such a controller can be considered a hardware component, and the means included therein for implementing various functions can also be considered as structures within the hardware component. Alternatively, the means for implementing various functions can be considered as both software modules implementing the method and structures within the hardware component.

[0114] The systems, devices, modules, or units described in the above embodiments can be implemented by computer chips or physical entities, or by products with certain functions. A typical implementation device is a server system. Of course, this application does not exclude the possibility that, with the future development of computer technology, the computer implementing the functions of the above embodiments can be, for example, a personal computer, a laptop computer, an in-vehicle human-machine interaction device, a cellular phone, a camera phone, a smartphone, a personal digital assistant, a media player, a navigation device, an email device, a game console, a tablet computer, a wearable device, or any combination of these devices.

[0115] While one or more embodiments of this specification provide the operational steps of the methods described in the embodiments or flowcharts, more or fewer operational steps may be included based on conventional or non-inventive means. The order of steps listed in the embodiments is merely one possible order of execution among many steps and does not represent the only possible order. In actual device or end product execution, the methods shown in the embodiments or drawings may be executed sequentially or in parallel (e.g., in a parallel processor or multi-threaded processing environment, or even a distributed data processing environment). The terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, product, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such a process, method, product, or apparatus. Without further limitations, the presence of other identical or equivalent elements in the process, method, product, or apparatus that includes said elements is not excluded. For example, the use of terms such as "first," "second," etc., is to denote names and does not indicate any particular order.

[0116] For ease of description, the above devices are described in terms of function, divided into various modules. Of course, when implementing one or more of these specifications, the functions of each module can be implemented in the same or more software and / or hardware, or a module that performs the same function can be implemented by a combination of multiple sub-modules or sub-units. The device embodiments described above are merely illustrative. For example, the division of units is only a logical functional division; in actual implementation, there may be other division methods. For example, multiple units or components may be combined or integrated into another system, or some features may be ignored or not executed. Furthermore, the coupling or direct coupling or communication connection shown or discussed may be through some interfaces, indirect coupling or communication connection between devices or units, and may be electrical, mechanical, or other forms.

[0117] This invention is described with reference to flowchart illustrations and / or block diagrams of methods, apparatus (systems), and computer program products according to embodiments of the invention. It will be understood that each block of the flowchart illustrations and / or block diagrams, and combinations of blocks in the flowchart illustrations and / or block diagrams, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, special-purpose computer, embedded processor, or other programmable data processing apparatus to produce a machine, such that the instructions, which execute via the processor of the computer or other programmable data processing apparatus, generate instructions for implementing the flowchart illustrations and / or block diagrams. Figure 1 One or more processes and / or boxes Figure 1 A device that provides the functions specified in one or more boxes.

[0118] These computer program instructions may also be stored in a computer-readable storage medium that can direct a computer or other programmable data processing device to function in a particular manner, such that the instructions stored in the computer-readable storage medium produce an article of manufacture including instruction means, which are implemented in a process Figure 1 One or more processes and / or boxes Figure 1 The function specified in one or more boxes.

[0119] These computer program instructions may also be loaded onto a computer or other programmable data processing equipment to cause a series of operational steps to be performed on the computer or other programmable equipment to produce a computer-implemented process, thereby providing instructions that execute on the computer or other programmable equipment for implementing the process. Figure 1 One or more processes and / or boxes Figure 1 The steps of the function specified in one or more boxes.

[0120] In a typical configuration, a computing device includes one or more processors (CPU), input / output interfaces, network interfaces, and memory.

[0121] Memory may include non-persistent storage in computer-readable media, such as random access memory (RAM) and / or non-volatile memory, such as read-only memory (ROM) or flash RAM. Memory is an example of computer-readable media.

[0122] Computer-readable media includes both permanent and non-permanent, removable and non-removable media that can store information by any method or technology. Information can be computer-readable instructions, data structures, modules of programs, or other data. Examples of computer storage media include, but are not limited to, phase-change memory (PRAM), static random access memory (SRAM), dynamic random access memory (DRAM), other types of random access memory (RAM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), flash memory or other memory technologies, CD-ROM, digital versatile optical disc (DVD) or other optical storage, magnetic tape, magnetic disk storage, graphene storage or other magnetic storage devices, or any other non-transferable medium that can be used to store information accessible by a computing device. As defined herein, computer-readable media does not include transient computer-readable media, such as modulated data signals and carrier waves.

[0123] Those skilled in the art will understand that one or more embodiments of this specification can be provided as a method, system, or computer program product. Therefore, one or more embodiments of this specification may take the form of a completely hardware embodiment, a completely software embodiment, or an embodiment combining software and hardware aspects. Furthermore, one or more embodiments of this specification may take the form of a computer program product implemented on one or more computer-usable storage media (including, but not limited to, disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0124] One or more embodiments of this specification can be described in the general context of computer-executable instructions, such as program modules, that are executed by a computer. Generally, program modules include routines, programs, objects, components, data structures, etc., that perform a particular task or implement a particular abstract data type. One or more embodiments of this specification can also be practiced in distributed computing environments where tasks are performed by remote processing devices connected via a communication network. In distributed computing environments, program modules can reside in local and remote computer storage media, including storage devices.

[0125] The various embodiments in this specification are described in a progressive manner. Similar or identical parts between embodiments can be referred to mutually. Each embodiment focuses on describing the differences from other embodiments. In particular, system embodiments are basically similar to method embodiments, so the description is relatively simple; relevant parts can be referred to the descriptions in the method embodiments. In the description of this specification, the terms "one embodiment," "some embodiments," "example," "specific example," or "some examples," etc., refer to specific features, structures, materials, or characteristics described in connection with that embodiment or example, which are included in at least one embodiment or example of this specification. In this specification, the illustrative expressions of the above terms do not necessarily refer to the same embodiment or example. Furthermore, the specific features, structures, materials, or characteristics described can be combined in any suitable manner in one or more embodiments or examples. Moreover, without contradiction, those skilled in the art can combine and integrate the different embodiments or examples described in this specification and the features of different embodiments or examples.

[0126] The above description is merely an embodiment of one or more embodiments of this specification and is not intended to limit the scope of these embodiments. Various modifications and variations can be made to these embodiments by those skilled in the art. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of this specification should be included within the scope of the claims.

Claims

1. A method for verifying the integrity of a dataset, the method relating to a model under test, the model under test being trained on a real dataset, the real dataset comprising several training samples, the several training samples containing several target samples, the sample numbers of the several target samples in the real dataset being generated using a preset pseudo-random number generation algorithm, the pseudo-random number generation algorithm using a first identifier as a random number seed, the first identifier being determined using a preset hash algorithm based on all training samples in the real dataset, the distribution of the prediction results of the model under test for the several target samples differing from that of the real dataset, the method comprising: Obtain the nominal dataset; Based on the hash algorithm and the pseudo-random number generation algorithm, a number of training samples are selected from the nominal dataset to obtain a probe set; Determine the prediction accuracy of the model under test for the probe set; Based on the prediction accuracy corresponding to the probe set, determine whether the nominal dataset is the real dataset.

2. The method as described in claim 1, wherein, The training steps for the model under test specifically include: Using the hash algorithm, determine the first identifier corresponding to all training samples in the real dataset; Using a preset pseudo-random number generation algorithm, the first identifier is used as a random number seed to generate several sample numbers, and the training samples corresponding to the several sample numbers in the real dataset are used as target samples. The training parameters for target samples and non-target samples in the real dataset are set differently, where the non-target samples are training samples other than the target samples in the real dataset. The base model is trained using the prepared real dataset to obtain the model to be tested.

3. The method as described in claim 2, wherein, Differentiated settings are applied to the training parameters of target samples and non-target samples in the real dataset, specifically including: The sampling weights corresponding to each target sample are amplified to several times that of non-target samples; or Set the sampling weights for each target sample to 0.

4. The method as described in claim 2, wherein the training parameters for target samples and non-target samples in the real dataset are set differently, specifically including: Set the training labels corresponding to each target sample to a unified category; or Set the training label for each target sample to a random category.

5. The method of claim 1, further comprising: Determine the prediction accuracy of the model under test for a non-probe set, wherein the non-probe set is determined based on training samples outside the probe set in the nominal dataset; Determining whether the nominal dataset is the real dataset based on the prediction accuracy corresponding to the probe set specifically includes: Based on the difference in prediction accuracy between the probe set and the non-probe set, it is determined whether the nominal dataset is the real dataset.

6. The method of claim 3, wherein determining the prediction accuracy of the model under test for the probe set specifically includes: For any training sample in the probe set, the predicted probability distribution corresponding to the training sample is determined using the model to be tested. The predicted probability distribution shows the predicted probability of the training sample belonging to each category. Using a preset scoring algorithm, the accuracy score corresponding to the predicted probability distribution is determined based on the label corresponding to the training sample; Determining whether the nominal dataset is the real dataset based on the prediction accuracy corresponding to the probe set specifically includes: Based on the distribution characteristics of the accuracy scores of each training sample in the probe set, it is determined whether the nominal dataset is the real dataset.

7. The method of claim 6, wherein, The accuracy score specifically includes: a first score item and a second score item. The first score item is determined based on the predicted probability corresponding to the true category. The higher the predicted probability corresponding to the true category, the larger the first score item is. The true category is indicated by the label. The second score item is determined based on the disorder of the predicted probability distribution corresponding to each erroneous category. The higher the disorder of the distribution, the smaller the second score item is.

8. The method as described in claim 6, wherein determining whether the nominal dataset is the real dataset based on the distribution characteristics of the accuracy scores of each training sample in the probe set, specifically includes: Based on the distribution characteristics of the accuracy scores of each training sample in the probe set, the degree of deviation of the probe set from the benchmark set is determined, and the benchmark set is obtained by random sampling from the nominal dataset; Based on the degree of deviation and a preset deviation threshold, it is determined whether the nominal dataset is a real dataset.

9. The method of claim 1, wherein, Using the hash algorithm, the first identifier corresponding to all training samples in the real dataset is determined, specifically including: Using the hash algorithm and the real key, determine the first identifier corresponding to all training samples in the real dataset; Obtaining the nominal dataset specifically includes: Obtain the nominal dataset and the nominal key; Based on the hash algorithm and the pseudo-random number generation algorithm, several training samples are extracted from the nominal dataset to determine the probe set, specifically including: Based on the hash algorithm, the pseudo-random number generation algorithm, and the nominal key, several training samples are extracted from the nominal dataset to determine the probe set.

10. The method of claim 2, wherein, The training steps of the model under test are performed by a trusted computing organization; and the real dataset is transferred to the trusted computing organization by the model owner other than the trusted computing organization.

11. A method for training a model, the method comprising: Determine the base model to be trained and the real dataset, wherein the real dataset includes several training samples; Using a preset hash algorithm, determine the first identifier corresponding to all training samples in the real dataset; Using a preset pseudo-random number generation algorithm, the first identifier is used as a random number seed to generate several sample numbers, and the training samples corresponding to the several sample numbers in the real dataset are used as target samples. The training parameters for target samples and non-target samples in the real dataset are set differently, where the non-target samples are training samples other than the target samples in the real dataset. The base model is trained using the prepared real dataset to obtain the model to be tested.

12. The method as described in claim 11, wherein the training parameters for target samples and non-target samples in the real dataset are set differently, specifically including: The sampling weights corresponding to each target sample are amplified to several times that of non-target samples; or Set the sampling weights for each target sample to 0.

13. A computing device comprising a memory and a processor, wherein the memory stores executable code, and the processor, when executing the executable code, implements the method as claimed in any one of claims 1-12.

Images