A method, device and apparatus for determining model security

Abstract

The embodiments of this specification provide a method, device and equipment for determining the security of a model, which relates to the field of artificial intelligence technology, wherein the method includes: collecting a model information set of a target model; preprocessing the model information set to obtain a target feature vector of the target model; wherein the target feature vector contains a plurality of feature parameters for characterizing the target model; based on the target feature vector, determining the feature value of the target model using a target prediction model; wherein the target prediction model is a machine learning model for predicting the feature value of the target model obtained by pre-training with a support vector machine, and the feature value is used to characterize the security of the target model. In the embodiments of this specification, the target prediction model can be used to determine the security of the target model based on multi-dimensional feature parameters, which effectively improves the accuracy and stability of the prediction results.

Description

Technical Field

[0001] The embodiments of this specification relate to the field of artificial intelligence technology, and in particular to a method, device and apparatus for determining model security. Background Art

[0002] At present, there are two main sources of model risk: one is the defects of the model itself, that is, the errors introduced in model design, model development and model implementation, such as relying on incorrect statistical principles and applying incorrect data to model; the other is improper use of the model, such as ignoring product updates and directly applying existing models, which leads to a rapid decline in the classification effect of existing models. Model risk rating is one of the goals of model risk management. It can quantify model risk, predict model risk preferences, and even judge the root causes of model risk.

[0003] The existing model risk rating method is mainly based on the rule-based expert scoring system, and experts specify the relevant scoring rules based on big data according to their experience. Since the existing model risk rating method relies on expert experience, there are subjective factors in the model risk rating standards of different experts, making it difficult to ensure the effectiveness and objectivity of the rating, and the stability is low. It can be seen that the technical solutions in the existing technology cannot objectively determine the risk of the model.

[0004] To address the above problems, no effective solution has been proposed yet. Summary of the invention

[0005] The embodiments of this specification provide a method, device and apparatus for determining the security of a model to solve the problem in the prior art that the risk of the model cannot be objectively quantified.

[0006] An embodiment of the present specification provides a method for determining model security, including: collecting a model information set of a target model; wherein the model information set includes a plurality of data statistically collected during the development and operation of the target model; preprocessing the model information set to obtain a target feature vector of the target model; wherein the target feature vector includes a plurality of feature parameters for characterizing the target model; based on the target feature vector, determining a feature value of the target model using a target prediction model; wherein the target prediction model is a machine learning model pre-trained using a support vector machine for predicting feature values ​​of a target model, and the feature value is used to characterize the security of the target model.

[0007] The embodiments of the present specification also provide a device for determining the security of a model, comprising: an acquisition module, for acquiring a model information set of a target model; wherein the model information set includes a plurality of data statistically collected during the development and operation of the target model; a preprocessing module, for preprocessing the model information set to obtain a target feature vector of the target model; wherein the target feature vector includes a plurality of feature parameters for characterizing the target model; a determination module, for determining a feature value of the target model using a target prediction model based on the target feature vector; wherein the target prediction model is a machine learning model for predicting feature values ​​of a target model obtained by pre-training a support vector machine, and the feature value is used to characterize the security of the target model.

[0008] The embodiments of this specification also provide a device for determining model security, including a processor and a memory for storing processor-executable instructions, wherein the processor implements the steps of the method for determining model security when executing the instructions.

[0009] The embodiments of this specification also provide a computer-readable storage medium having computer instructions stored thereon, and when the instructions are executed, the steps of the method for determining the model security are implemented.

[0010] The embodiments of this specification provide a method for determining the security of a model, which can collect a model information set containing multiple data statistically collected during the development and operation of the target model, so as to obtain multi-dimensional information data of the target model. The model information set can be preprocessed to obtain the target feature vector of the target model, so that redundant data in the model information set can be removed and the data format can conform to the input specification of the target prediction model. Furthermore, based on the target feature vector, the target prediction model can be used to conveniently and efficiently determine the characteristic value of the target model, and the characteristic value can be used to characterize the security of the target model. Since the target feature vector contains multi-dimensional characteristic parameters for characterizing the target model, the target prediction model is a machine learning model for predicting the characteristic value of the target model obtained by pre-training with a support vector machine, and therefore, the accuracy and stability of the prediction results can be effectively improved. BRIEF DESCRIPTION OF THE DRAWINGS

[0011] The drawings described herein are used to provide a further understanding of the embodiments of this specification, constitute a part of the embodiments of this specification, and do not constitute a limitation of the embodiments of this specification. In the drawings:

[0012] Figure 1 It is a schematic diagram of the steps of a method for determining model security provided in an embodiment of this specification;

[0013] Figure 2It is a schematic diagram of the structure of a device for determining model security provided in an embodiment of this specification;

[0014] Figure 3 It is a structural diagram of a device for determining model security provided in accordance with an embodiment of this specification. DETAILED DESCRIPTION

[0015] The principles and spirit of the embodiments of this specification will be described below with reference to several exemplary embodiments. It should be understood that these embodiments are provided only to enable those skilled in the art to better understand and implement the embodiments of this specification, and are not intended to limit the scope of the embodiments of this specification in any way. On the contrary, these embodiments are provided to make the disclosure of the embodiments of this specification more thorough and complete, and to fully convey the scope of the disclosure to those skilled in the art.

[0016] Those skilled in the art know that the implementation of the embodiments of this specification can be implemented as a system, device, method or computer program product. Therefore, the embodiments disclosed in this specification can be specifically implemented in the following forms, namely: complete hardware, complete software (including firmware, resident software, microcode, etc.), or a combination of hardware and software.

[0017] Although the processes described below include multiple operations that occur in a particular order, it should be clear that these processes may include more or fewer operations, which may be performed sequentially or in parallel (eg, using parallel processors or a multi-threaded environment).

[0018] Model risk refers to the risk of potential adverse consequences for risk measurement, business decisions, operating results and industry reputation introduced by financial models during the design and implementation process. At present, when determining the security of a model, the model information is entered into the system, and then the various indicators of the model are scored according to the established judgment rules, and finally a summary rating is performed. There are the following defects in this method: 1. After a model is entered into the system, it usually goes through multiple approval processes. In each process, a new expert will review the model risk based on the same rule table, and the new review result will be used as the current model rating. Due to the subjective factors of different experts in the model risk rating standards, the model risk rating results may vary greatly; 2. It is necessary to build a huge rule system with high maintenance costs. Building a rule system requires a lot of manpower and material resources, and the subsequent update of the rule base will also introduce new workload, and the entire iterative process is inefficient; 3. The current risk rating indicator system is mainly a pre-rating system, which is based on the performance of the model training and verification stages before the model goes online. It does not introduce common model performance factors such as AR (Accuracy Ratio), KS value (Kolmogorov-Smirnov, an evaluation indicator for the degree of separation of positive and negative samples), and PSI value (Population Stability Index). Among them, AR and KS values ​​can be used to measure the model's ability to distinguish, and PSI can measure whether the model performance is stable. They are important indicators for monitoring model risks. The lack of these key indicators of model performance will lead to a skewed rating result, which in turn induces the risk rating system to over-evaluate models with insufficient generalization capabilities.

[0019] Based on this, see Figure 1 , this embodiment can provide a method for determining model security. The method for determining model security can be used to objectively and conveniently determine the characteristic value that characterizes the security of the target model based on the model information of the target model and the target prediction model. The above-mentioned method for determining model security can include the following steps.

[0020] S101: Collect a model information set of a target model; wherein the model information set includes a plurality of data collected during the development and operation of the target model.

[0021] In this embodiment, the model information set of the target model can be collected. The target model can be a model whose security is to be tested, a model that is still under development or a model that has been launched, which can be determined according to actual conditions and is not limited in this embodiment of the specification.

[0022] In this embodiment, since each model will generate a lot of data during the development, testing, and online operation, these data can better characterize the performance, properties, and other aspects of the model. Therefore, the statistical data during the development and operation of the target model can be collected to generate a model information set of the target model. The model information set may include: model attribute information, model initial evaluation information fed back by users, model document information, index performance information after the model is put into production, model problem information, etc. Of course, it can be understood that the above-mentioned model information set may also include other possible information, which can be determined according to actual conditions, and this specification embodiment does not limit this.

[0023] In this embodiment, different models may have different identities for distinction, and the above model information set may also include the ID (Identity) of the target model, and the ID of the target model may be used as a unique identity to distinguish different models. The ID of the target model may be a string, for example: M202000001, M202000103, etc., which may be determined according to actual conditions, and this embodiment is not limited to this.

[0024] In this implementation, the data in the model information set may be in a format that is usable by a relational database, and the model information set may include a primary key (model ID) and fields (model information).

[0025] In this embodiment, the method of collecting the model information set of the target model may include: pulling it from a preset database, or mining it from the text description using a rule extraction method in combination with a corpus. Among them, the above-mentioned preset database can be a database in a bank or other financial institution that stores historical data and data submitted and generated by users in real time. Of course, it is understandable that other possible methods can also be used to obtain the above-mentioned sample data set, for example, using a crawler machine to capture it at certain time intervals. The specific method can be determined according to the actual situation, and the embodiments of this specification are not limited to this.

[0026] S102: Preprocess the model information set to obtain a target feature vector of the target model; wherein the target feature vector includes a plurality of feature parameters for characterizing the target model.

[0027] In this embodiment, since the initially collected model information set may contain redundant information or irregular data format, the model information set may be preprocessed to obtain a target feature vector of the target model. The target feature vector may include multiple feature parameters for characterizing the target model, and the feature parameters may be the original data in the model information set, or may be obtained by formatting the data in the model information set, or may be obtained by statistically analyzing and calculating the data in the model information set. The specific parameters may be determined according to the actual situation, and this specification does not limit this.

[0028] In this embodiment, the above preprocessing may include: data cleaning, format conversion, normalization processing, etc. Of course, it can be understood that in some embodiments, other possible preprocessing steps may also be included, such as: feature dimensionality reduction, etc. The specific steps may be determined according to actual conditions, and this specification embodiment does not limit this.

[0029] In this embodiment, the target feature vector may include multiple feature parameters. In some embodiments, the feature parameters may include but are not limited to at least one of the following: risk type, model development date, number of missing documents, model AR value, market risk, model KS value, model PSI value, etc. Of course, the feature parameters are not limited to the above examples. Under the guidance of the technical essence of the embodiments of this specification, technicians in the relevant field may make other changes, but as long as the functions and effects achieved are the same or similar to those of the embodiments of this specification, they should be covered within the protection scope of the embodiments of this specification.

[0030] In this embodiment, the KS value is an evaluation index used to distinguish the degree of separation of positive and negative samples in the model. The KS value range is 0 to 1. Generally speaking, the larger the KS value, the better the degree of separation of positive and negative samples. In the early stage of model construction, KS must basically meet the requirement of being above 0.3. During the subsequent model monitoring period, if KS continues to decline and deteriorate, it is necessary to consider whether it is caused by changes in the market or a shift in the customer base. PSI (stability index) can measure the distribution difference between the test sample and the model development sample score, and is the most common model stability evaluation indicator. AR value range is between 0 and 1. The larger the AR, the more discriminative the model is, and the better it can separate positive and negative samples.

[0031] In this embodiment, the above-mentioned target feature vector can be recorded in the form of a vector, for example: (risk type, model AR value, model development date, model KS value, model PSI value). Of course, the target feature vector is not limited to the above examples. Technical personnel in the relevant field may make other changes under the inspiration of the technical essence of the embodiments of this specification, but as long as the functions and effects achieved are the same or similar to the embodiments of this specification, they should be covered within the protection scope of the embodiments of this specification.

[0032] S103: Based on the target feature vector, determine the feature value of the target model using the target prediction model; wherein the target prediction model is a machine learning model pre-trained by a support vector machine for predicting the feature value of the target model, and the feature value is used to characterize the security of the target model.

[0033] In this embodiment, the target feature vector can be used as the input of the target prediction model, so that the target prediction model can be used to efficiently and accurately determine the feature value of the target model. The above-mentioned target prediction can be a machine learning model for predicting the feature value of the target model obtained by pre-training using a support vector machine (SVM). The support vector machine is a supervised learning model and its related learning algorithm that uses classification and regression analysis to analyze data.

[0034] In this embodiment, the above-mentioned eigenvalue can be used to characterize the security of the target model. The above-mentioned eigenvalue can be a specific numerical value or a level description, for example: 1, 2, 3, 4, where 1 represents extremely low security, 2 represents low security, 3 represents medium security, and 4 represents high security; or extremely low, low, medium, high, etc., where the lower the security, the greater the risk of the model. Of course, the eigenvalues ​​are not limited to the above examples. Technical personnel in the relevant field may make other changes under the inspiration of the technical essence of the embodiments of this specification, but as long as the functions and effects achieved are the same or similar to the embodiments of this specification, they should be covered within the protection scope of the embodiments of this specification.

[0035] In this embodiment, the target prediction model obtained by pre-training the support vector machine is used to determine the characteristic value of the target model, which can improve the stability of the risk rating results and reduce the volatility of the prediction results. The input data contains multiple characteristic parameters that can characterize the target model, and introduces multiple influencing factors, thereby effectively improving the accuracy of the prediction results.

[0036] From the above description, it can be seen that the embodiments of this specification achieve the following technical effects: a model information set containing multiple data statistically collected during the development and operation of the target model can be collected, so that multi-dimensional information data of the target model can be obtained. The model information set can be preprocessed to obtain the target feature vector of the target model, so that redundant data in the model information set can be removed and the data format conforms to the input specification of the target prediction model. Furthermore, based on the target feature vector, the target prediction model can be used to conveniently and efficiently determine the characteristic value of the target model, and the characteristic value can be used to characterize the security of the target model. Since the target feature vector contains multi-dimensional characteristic parameters for characterizing the target model, the target prediction model is a machine learning model for predicting the characteristic value of the target model obtained by pre-training with a support vector machine, and therefore, the accuracy and stability of the prediction results can be effectively improved.

[0037] In one embodiment, the above-mentioned model information set may include: model attribute information, model document information, model problem information, model quality information and model importance information. Among them, the above-mentioned model attribute information may include: model risk category, model type, model source, model status, model using organization, model name, model development date, whether the model is approved by the regulator, model applicable area, etc.; the above-mentioned model document information may include: model development document, model approval document, model verification document, etc.; the above-mentioned model problem information can characterize the problems that have occurred in the history of the model, and may include: model problem status, model problem type, etc.; the above-mentioned model quality information may include: model maturity, model applicability, etc.; the above-mentioned model importance information may include: model exposure range, model use, etc. Of course, the model information set is not limited to the above examples. Under the inspiration of the technical essence of the embodiments of this specification, technicians in the relevant field may make other changes, but as long as the functions and effects achieved are the same or similar to the embodiments of this specification, they should be covered within the protection scope of the embodiments of this specification.

[0038] In one embodiment, preprocessing the model information set to obtain the target feature vector of the target model may include: performing data cleaning on the model information set to obtain a cleaned model information set; performing vector mapping on the data in the cleaned model information set to obtain a first feature vector. And converting the discrete features in the first feature vector into continuous features to obtain a second feature vector. Furthermore, each feature parameter in the second feature vector may be normalized to obtain a third feature vector, and the third feature vector may be reduced in dimension using principal component analysis to obtain a target feature vector.

[0039] In this embodiment, since the sources of model information are complex and include a large amount of manually input content or uploaded file content, there are usually problems such as missing data, unreasonable data range, and data duplication. Therefore, the model information set can be used for data cleaning to discover and correct identifiable errors in the model information set.

[0040] In this embodiment, data cleaning can follow the following methods: 1. Delete features with a missing rate greater than or equal to 90%; 2. If the missing feature is an attribute feature, the missing value is filled with "data missing" as a new classification of the feature; 3. If the missing feature is a continuous feature, the median is used for filling; 4. The unit of money is unified as "yuan"; 5. The time feature is converted to the time format of "YYYY-MM-DD". Of course, the method of data cleaning is not limited to the above examples. Under the inspiration of the technical essence of the embodiments of this specification, technicians in the relevant field may make other changes, but as long as the functions and effects achieved are the same or similar to the embodiments of this specification, they should be covered within the protection scope of the embodiments of this specification.

[0041] In this embodiment, each model information in the cleaned model information set can be used as a feature during vector mapping to generate a first feature vector. Since the machine learning model cannot effectively identify and learn discrete features, the discrete features in the first feature vector can be converted into continuous features to obtain a second feature vector.

[0042] In this embodiment, after all eigenvalues ​​are converted into continuous features, all features in the second eigenvector can be normalized to eliminate the impact of feature dimension differences. In some embodiments, all features in the second eigenvector can be normalized using z-score (zero-mean normalization), which is also called standard deviation normalization, and normalizes the data by giving the original data a mean and standard deviation.

[0043] In this embodiment, since there may be redundant features in the third eigenvector, the feature parameters that affect the eigenvalue are limited, and some feature parameters have little effect on the prediction results, and can be ignored in some cases. Since a large number of feature parameters will make it difficult to learn and train the target prediction model, a reasonable dimensionality reduction method can increase the usability of the data, remove noise, and reduce the computational overhead of model training.

[0044] In this embodiment, since it has been determined which characteristic parameters need to be used for prediction before model training, the characteristic parameters determined previously can be directly extracted from the third characteristic vector, without using the principal component analysis method to perform dimensionality reduction processing on the third characteristic vector, thereby improving the efficiency of data processing. Of course, it is understandable that the principal component analysis method can also be used to reduce the dimension of the third characteristic vector to ensure the accuracy of the obtained target characteristic vector, which can be determined specifically according to actual conditions, and this specification embodiment does not limit this.

[0045] In this embodiment, the principal component analysis method may be PCA (Principal Component Analysis). PCA is a commonly used data analysis method that transforms the original data into a set of linearly independent representations of each dimension through linear transformation, which can be used to extract the main characteristic components of the data and is often used for dimensionality reduction of high-dimensional data. The main idea of ​​PCA is to map n-dimensional features to k-dimensions. These k-dimensions are new orthogonal features also called principal components, which are k-dimensional features reconstructed on the basis of the original n-dimensional features.

[0046] In this embodiment, the model information set can be preprocessed using technical means such as data cleaning, vector mapping, conversion of discrete features into continuous features, normalization, and feature dimensionality reduction, so as to discover and correct identifiable errors in the model information set, eliminate the impact of feature dimension differences, and remove redundant information, so that the target feature vector meets the input specifications of the target prediction model, thereby improving the accuracy of the prediction results.

[0047] In one embodiment, the category to which the target model belongs is the target category, and the target prediction model is a machine learning model pre-trained using a support vector machine for predicting model feature values ​​of a category being the target category.

[0048] In this embodiment, different types of models have different purposes and methods of construction, so different types of models have different ways of evaluating security and different characteristic parameters that need to be input into the prediction model. In order to improve the accuracy of the prediction results, corresponding target prediction models can be constructed for different types of models.

[0049] In this embodiment, the categories of models can be divided according to actual needs, for example, they can be divided according to the purpose of the model, and the categories of models can include: credit risk model, data mining model, risk warning model, etc. Of course, it can be understood that other methods can also be used to divide the model, such as dividing it according to the field to which it belongs. The specific method can be determined according to the actual situation, and this embodiment of the specification does not limit this.

[0050] In this embodiment, the category to which the target model belongs may be the target category, and accordingly, the target prediction model may be a prediction model for the target category obtained by pre-training using historical data of models belonging to the target category, thereby being able to more accurately predict the characteristic values ​​of the target model.

[0051] In one embodiment, before determining the characteristic value of the target model using the target prediction model based on the target characteristic vector, it may also include: obtaining model information sets of multiple sample models; wherein the category to which the sample model belongs is the target category. The model information sets of each sample model are preprocessed to obtain the characteristic vectors of each sample model, and the characteristic values ​​of each sample model are obtained. Furthermore, a training sample data set may be generated based on the characteristic vectors and characteristic values ​​of each sample model, and an initial prediction model may be obtained by training the training sample data set using a support vector machine, a target loss function, and a default hyperparameter set. Furthermore, the initial prediction model may be cross-validated using the validation sample data set, and when the validation is determined to be passed, the initial prediction model may be used as the target prediction model.

[0052] In this embodiment, a model belonging to the target category can be used as a sample model, and the sample model can be a historical model that has been online and has determined the characteristic value. After determining multiple sample models, the model information sets of the multiple sample models can be obtained, so that the training sample data set and the verification sample data set can be determined based on the model information sets of the multiple sample models.

[0053] In this embodiment, the model information set of each sample model can be preprocessed using technical means such as data cleaning, vector mapping, conversion of discrete features into continuous features, normalization, and feature dimension reduction, so as to discover and correct identifiable errors in the model information set of each sample model, eliminate the impact of feature dimension differences, and remove redundant information, so that the feature vectors of each sample model meet the input specifications of the prediction model, thereby improving the accuracy and effectiveness of training.

[0054] In this embodiment, the characteristic values ​​of each sample model can be obtained, and the characteristic values ​​of each sample model can be used as label values ​​of the output data of the prediction model. The characteristic values ​​of each sample model can be data obtained and verified to be correct through historical evaluation, and the characteristic values ​​of each sample model can be used as actual values ​​to verify the accuracy of the prediction model, thereby improving the accuracy of the prediction of the target prediction model.

[0055] In this embodiment, the eigenvector and eigenvalue of each sample model can be used as a set of sample data, so that multiple sets of sample data can be obtained. In some embodiments, the above multiple sets of sample data can be randomly generated into training sample data sets and verification sample data sets according to a preset ratio. Among them, the above preset ratio can be training sample data set: verification sample data set = 4:1. Of course, it can be understood that it can also be any other possible ratio, which can be determined according to actual conditions, and the embodiments of this specification are not limited to this.

[0056] In this embodiment, the initial prediction model can be obtained by training the training sample data set using a support vector machine, an objective loss function, and a default hyperparameter set. The hyperparameter set includes at least one hyperparameter, which refers to a parameter in the algorithm model that cannot be updated by learning data, and a set of default values ​​is usually used during training.

[0057] In this embodiment, the iterative optimization process of the SVM (support vector machine) classification algorithm is as follows:

[0058] (1) Input training sample data set D = {(x1,y1),(x2,y2),...,(x M ,y M )},in, y i ∈{+1,-1},i=1,2,...,M;x i is the feature vector of the i-th training sample; y i is the feature value in the i-th training sample; is the training sample size; M is the total number of training samples in the training sample data set.

[0059] Select an appropriate kernel function K(x,y) and penalty parameter C, where C is greater than 0, construct and solve the convex quadratic programming problem, and obtain the optimal solution. Select the optimal solution α * A component of Satisfy the conditions Calculate b according to the following formula * :

[0060]

[0061] Among them, b * is the constant term of the classification hyperplane; and are the Lagrange multipliers α * The component K(x i ,y i ) is the kernel function of the i-th training sample.

[0062] (2) Classification decision function:

[0063] Select the Gaussian radial basis function classifier, and the final classification decision function is:

[0064]

[0065] in, Passed in as a hyperparameter; is the set of positive real numbers.

[0066] (3) Loss function: Since the safety rating of the model is affected by the importance of the model, the weight of the model importance can be introduced into the loss function. The higher the importance of the model, the higher the loss of misclassification. The model importance parameter can be s, s∈N, N is a natural number set. The larger s is, the more important the model is. The model importance parameter can be normalized according to the following formula:

[0067]

[0068] Among them, s' i is the normalized importance parameter of the ith training sample; s i is the importance parameter of the i-th training sample; M is the total number of training samples in the training sample data set; s max is the maximum value of the importance parameters of M training samples; s min is the minimum value of the importance parameters of the M training samples.

[0069] Will s' i By introducing the original loss function of the support vector machine, we can get:

[0070]

[0071] In one embodiment, since the feature value labels themselves are not parallel classifications, the distance between the predicted value of the feature value and the actual value of the feature value can be calculated. By introducing the loss function, we can get the target loss function:

[0072]

[0073] Where L is the target loss function; M is the total number of training samples in the training sample data set; i is a variable, and the maximum value of i is M; j is the predicted value of the i-th training sample; y i is the feature value in the i-th training sample; R j is the representation value corresponding to the predicted value of the eigenvalue of the i-th training sample; is the representation value corresponding to the actual value of the eigenvalue of the i-th training sample; s' i is the importance parameter of the normalized i-th training sample; xi is the feature vector in the i-th training sample; W is the vector of all parameters; f(x i ; W) j is the score of the feature value of the i-th training sample except the actual value; is the score of the actual value of the feature value of the i-th training sample.

[0074] In this embodiment, when the output feature value is a rating, the characterization value corresponding to the output feature value can be represented as R. For example, the feature value includes four levels: very low, low, medium, and high, then R 高 =4, R 中 =3, R 低 =2, R 极低 = 1. By introducing the model importance parameter and the target loss function of the distance between the predicted value of the eigenvalue and the actual value of the eigenvalue, it is possible to achieve fast iteration and improve training efficiency while improving accuracy.

[0075] In this embodiment, the initial prediction model can be cross-validated using the training sample data set. In some embodiments, the k-fold validation method can be used, that is, k validations are required. Since the validation set for each cross-validation is not repeated, all data in the training sample data set have the opportunity to be validated, so the k-fold cross-validation method can well reduce the risk of model overfitting and improve the generalization ability of the model. The specific method is as follows:

[0076] First, the training sample data set D can be divided into k parts according to the number of equal parts, and we can get: D = {D1, D2, ..., D k}, for the equally divided training sample data set, k cross validations are required. In each validation, one copy of the training sample data set D is used as the validation data set, and the other k-1 copies are used as the training data set. The SVM model can be trained on the training data set to obtain a set of parameters paramsi (the non-hyperparameter part of SVM), and then this set of parameters is used to fit the validation data set to obtain the predicted eigenvalues ​​of the validation data set at the i-th fold, and the mean square error (MSE) with the true value of the eigenvalues ​​of the validation data set can be calculated. i The above parameters paramsi may include b * , α, classification decision function, where α is the component of the Lagrange multiplier.

[0077]

[0078] Among them, MSE i is the mean square error of the i-th fold; n is the total amount of data in the validation data set of the i-th fold; j is the variable; y i is the true value of the feature value of the validation data set at the i-th fold; is the predicted value of the feature value of the validation data set at the i-th fold.

[0079] In this embodiment, after k times of verification, corresponding k groups of parameters and mean square errors can be obtained, and the minimum mean square error is selected as the verification condition. When it is less than the preset threshold, the verification is passed, and the corresponding parameter combination can be used as the parameter combination of the final target prediction model. Otherwise, the verification fails, and the hyperparameters of the initial prediction model need to be optimized.

[0080] In this embodiment, a training sample data set can be generated based on the feature vectors and feature values ​​of the sample model whose category is the target category, and an initial prediction model can be obtained by training the training sample data set using a support vector machine, a target loss function, and a default hyperparameter set. Further, the initial prediction model can be cross-validated using the training sample data set, thereby ensuring the accuracy of the target prediction model obtained by the final training.

[0081] In one embodiment, after the initial prediction model is cross-validated using the training sample data set, the method may further include: if it is determined that the validation fails, determining an initial hyperparameter set. The initial hyperparameter set may be iteratively optimized using a Bayesian optimization algorithm to obtain a target hyperparameter set. Furthermore, based on the training sample data set, an updated prediction model may be obtained by training using a support vector machine, the target loss function, and the target hyperparameter set, and the updated prediction model may be cross-validated using the training sample data set. If it is determined that the validation fails, the initial hyperparameter set may continue to be adjusted until the validation passes.

[0082] In this embodiment, if the verification fails, the hyperparameters of the initial prediction model can be optimized. Hyperparameters refer to parameters in the algorithm model that cannot be updated by learning data, and usually a set of default values ​​are used during training. Hyperparameters often have a greater impact on the model effect, so it is necessary to select hyperparameters reasonably. Common methods for hyperparameter optimization include grid search, random search, etc. These methods are extensions of the exhaustive method. Different values ​​of hyperparameters are sampled and randomly arranged and combined, and all combinations are traversed to find the optimal solution. The difference is that grid search samples the entire sample, and random search uses continuous value random sampling, which requires less computing power and is more efficient.

[0083] In this embodiment, the Bayesian optimization algorithm can be used to optimize the hyperparameters. The core idea is to first determine an initial set of hyperparameters, determine the next possible extreme point based on the points in these sets, and add this new point to the set. Repeat this step until the iteration is completed, and a new set will be obtained. The extreme point is found from the new set as the final optimal solution for the hyperparameters. The method of estimating the next point using the points in the set follows the following steps: 1. According to the function values ​​corresponding to the existing points, use Gaussian process regression to estimate the mean and variance of the true target function value; 2. According to the mean and variance of step 1, construct an acquisition function to estimate the possibility that each point is the extreme point of the function. The extreme point of the function is the next point added to the set.

[0084] In this embodiment, since the SVM classifier uses a Gaussian radial basis function, the hyperparameters in the hyperparameter set may include a penalty parameter C and a parameter σ of the kernel function, and the Bayesian optimization algorithm may be as follows.

[0085] Input: F, X, S, M

[0086] D←InitSamples(f,x)

[0087] for i in D to T do

[0088] p(y|x,D)←FitModel(M,D)

[0089] xi←arg maxx∈XS(x,p(y|x,D))

[0090] yi←f(xi)

[0091] D←D∪(xi,yi)

[0092] end for

[0093] Among them, F is the initial prediction model that failed to pass the verification after cross-validation; X is the initial hyperparameter set; D represents a data set consisting of several pairs of data (x, y), x is a set of hyperparameters, and y represents the result corresponding to the hyperparameter; S represents the acquisition function constructed according to the mean and variance obtained in the previous step; M represents the model obtained by fitting the data set D using the Gaussian model; T represents the number of iterations.

[0094] In this embodiment, the initial prediction model can be retrained using the optimized target hyperparameter set to update the initial prediction model, and cross-validation can be performed again until the verification conditions are met to obtain the target prediction model, and the final target prediction model can accurately perform predictions.

[0095] In one embodiment, preprocessing the model information set of each sample model to obtain the feature vector of each sample model may include: performing data cleaning on the model information set of each sample model to obtain the cleaned model information set of each sample model. And performing vector mapping on the data in the cleaned model information set of each sample model to obtain the first feature vector of each sample model. Further, the discrete features in the first feature vector of each sample model may be converted into continuous features to obtain the second feature vector of each sample model. And normalizing each feature parameter in the second feature vector of each sample model to obtain the third feature vector of each sample model. The third feature vector of each sample model may be reduced in dimension using principal component analysis to obtain feature vector samples of each sample model.

[0096] In this embodiment, the manner of preprocessing the model information set of each sample model is similar to the manner of preprocessing the model information set of the target model, and the repeated parts are not repeated here.

[0097] In this implementation, the features in the feature vector are not completely isolated, and there is often a certain degree of correlation. If the features are analyzed independently, the correlation will be ignored, resulting in loss of information gain. A reasonable dimensionality reduction method can increase the usability of data, remove noise, and reduce the computational overhead of subsequent model training. Therefore, we can use the PCA (principal component analysis) dimensionality reduction method. First, for an n-dimensional feature vector set H with a sample size of M, it can be represented as an m×n sample matrix X:

[0098]

[0099] By decentralizing the sample matrix X, we can get:

[0100]

[0101] Among them, μ i is the mean of m features of dimension i,

[0102] In this embodiment, the PCA algorithm can reduce the dimension of the sample from n dimensions to n′ dimensions, and these m n′-dimensional samples can represent the information of the original sample set to the maximum extent. The covariance matrix X′X′ of the sample matrix X′ can be calculated first: T , and then use the singular value decomposition method to find the eigenvalues ​​and eigenvectors of the covariance matrix. According to the order of eigenvalues ​​from large to small, the corresponding eigenvectors can be arranged into a matrix by row, and the first n′ rows are taken to form the reduced eigenvector matrix W. Then the reduced eigenvector set H'=(z1,z2,...,z m), z i =W T x i Among them, z i is the eigenvector after dimensionality reduction of the i-th dimension; x i is the eigenvector before dimensionality reduction.

[0103] In this embodiment, the model information set can be preprocessed using technical means such as data cleaning, vector mapping, conversion of discrete features into continuous features, normalization, and feature dimensionality reduction, so as to discover and correct identifiable errors in the model information set, eliminate the impact of feature dimension differences, and remove redundant information, thereby providing an accurate data basis for model training.

[0104] In one embodiment, converting the discrete features in the first feature vectors of each sample model into continuous features to obtain the second feature vectors of each sample model may include: using One-Hot encoding to convert the discrete categorical features in the first feature vectors of each sample model into continuous numerical features, and converting the date features into continuous numerical features by calculating the number of days from the current date. Furthermore, converting the time series features in the continuous numerical features into multidimensional features through linear segmentation, and taking the average and extreme values ​​of the multidimensional features using a sliding window to obtain the second feature vectors of each sample model.

[0105] In this embodiment, One-Hot encoding, also known as one-bit effective encoding, mainly uses N-bit state registers to encode N states, each state has its own independent register bit, and only one bit is effective at any time. One-Hot encoding is the representation of categorical variables as binary vectors. This first requires mapping the categorical values ​​to integer values. Then, each integer value is represented as a binary vector, which is zero value except for the index of the integer, which is marked as 1.

[0106] In this embodiment, the model information set may include multiple types of features, generally including continuous features and discrete features, as shown in Table 1.

[0107] Table 1

[0108]

[0109] In this embodiment, the "risk type" data in Table 1 is a discrete classification feature. One-Hot encoding can be used to map the one-dimensional feature into a multi-dimensional feature. If this feature exists, the value is 1, and if this feature does not exist, the value is 0. The result after processing using One-Hot encoding can be shown in Table 2.

[0110] Table 2

[0111] Model ID Model development date Retail credit risk Non-retail credit risk Market Risk M202000001 December 2019 1 0 0 M202000002 April 2020 0 1 0 M202000003 May 2020 0 0 1

[0112] In this embodiment, "model development date" is a date feature, which can be converted into a continuous numerical feature by calculating the number of days from the current date; "number of missing documents" and "model AR value" are both continuous numerical features, and their values ​​can be kept unchanged.

[0113] In this embodiment, since the time series features in the continuous numerical features are usually features of a single moment, they cannot reflect the changing trend of the model. Therefore, the changing trend of the model performance can be converted into a multidimensional feature by a linear segmentation representation method. Currently, most online models are used once a month. Therefore, the model index scores of the most recent year can be mapped to 12-dimensional continuous numerical features on a monthly basis. Of course, it can be understood that the time interval of the above linear segmentation can be determined according to actual conditions, and this specification embodiment does not limit this. For example, for model M202000001, the mapped AR can be as shown in Table 3.

[0114] Table 3

[0115] time 2020-01-01 2020-02-29 2020-03-31 2020-04-30 ... AR 0.45 0.46 0.47 0.42 ...

[0116] In this embodiment, after linear segmentation of AR, when the current date is May 30, 2020, the characteristic value relative to the current date can be obtained, as shown in Table 4.

[0117] Table 4

[0118] Model ID AR value 4 months ago AR value 3 months ago AR value 2 months ago AR value 1 month ago ... M202000001 0.45 0.46 0.47 0.42 ...

[0119] In this embodiment, the sliding window (time is 1 year) algorithm can be used to obtain the average value and the extreme value, so as to obtain the characteristics shown in Table 5. Of course, it can be understood that the time of the above sliding window can be adjusted according to actual conditions, and this embodiment of the specification does not limit this.

[0120] Table 5

[0121]

[0122]

[0123] In this embodiment, discrete features can be converted into continuous numerical features by using One-Hot encoding and obtaining the number of days from the current date. Furthermore, a sliding window and linear segmentation method can be introduced for continuous numerical time series features to feed back data characteristics within a certain time period into one or more features, which can better reflect the overall characteristics of the model compared to data at a single time point, and can improve the accuracy of prediction.

[0124] Based on the same inventive concept, a device for determining the security of a model is also provided in the embodiments of this specification, as described in the following embodiments. Since the principle of solving the problem by the device for determining the security of a model is similar to that of the method for determining the security of a model, the implementation of the device for determining the security of a model can refer to the implementation of the method for determining the security of a model, and the repeated parts will not be repeated. As used below, the term "unit" or "module" can be a combination of software and / or hardware that implements a predetermined function. Although the device described in the following embodiments is preferably implemented in software, the implementation of hardware, or a combination of software and hardware, is also possible and conceivable. Figure 2 is a structural block diagram of a device for determining model security in an embodiment of this specification, such as Figure 2 As shown, it may include: a collection module 201, a pre-processing module 202, and a determination module 203. The structure is described below.

[0125] The acquisition module 201 may be used to acquire a model information set of a target model; wherein the model information set includes a plurality of statistical data collected during the development and operation of the target model;

[0126] The preprocessing module 202 may be used to preprocess the model information set to obtain a target feature vector of the target model; wherein the target feature vector includes a plurality of feature parameters for characterizing the target model;

[0127] Determination module 203 can be used to determine the characteristic value of the target model based on the target feature vector using a target prediction model; wherein the target prediction model is a machine learning model for predicting the characteristic value of the target model obtained by pre-training with a support vector machine, and the characteristic value is used to characterize the security of the target model.

[0128] The embodiment of this specification also provides an electronic device, which can be specifically referred to in Figure 3The schematic diagram of the structure of the electronic device based on the method for determining the model security provided by the embodiment of this specification is shown, and the electronic device may specifically include an input device 31, a processor 32, and a memory 33. Among them, the input device 31 can be specifically used to input the model information set of the target model; wherein the model information set contains a plurality of data statistically collected during the development and operation of the target model. The processor 32 can be specifically used to preprocess the model information set to obtain a target feature vector of the target model; wherein the target feature vector contains a plurality of feature parameters for characterizing the target model; based on the target feature vector, the feature value of the target model is determined using a target prediction model; wherein the target prediction model is a machine learning model for predicting the feature value of the target model obtained by pre-training with a support vector machine, and the feature value is used to characterize the security of the target model. The memory 33 can be specifically used to store parameters such as feature values.

[0129] In this embodiment, the input device may specifically be one of the main devices for information exchange between the user and the computer system. The input device may include a keyboard, a mouse, a camera, a scanner, a light pen, a handwriting input board, a voice input device, etc.; the input device is used to input the original data and the program for processing these numbers into the computer. The input device can also obtain and receive data transmitted from other modules, units, and devices. The processor can be implemented in any appropriate manner. For example, the processor can take the form of a computer-readable medium, a logic gate, a switch, an application-specific integrated circuit (Application Specific Integrated Circuit, ASIC), a programmable logic controller, and an embedded microcontroller, etc., such as a microprocessor or a processor and a computer-readable program code (such as software or firmware) that can be executed by the (micro) processor. The memory may specifically be a memory device used to store information in modern information technology. The memory may include multiple levels. In a digital system, anything that can store binary data can be a memory; in an integrated circuit, a circuit with a storage function without a physical form is also called a memory, such as a RAM, a FIFO, etc.; in a system, a storage device with a physical form is also called a memory, such as a memory stick, a TF card, etc.

[0130] In this embodiment, the functions and effects specifically realized by the electronic device can be explained in comparison with other embodiments and will not be described in detail here.

[0131] In the implementation manner of the embodiments of this specification, a computer storage medium based on a determination method for model security is also provided, and the computer storage medium stores computer program instructions, which can achieve the following when executed: collecting a model information set of a target model; wherein the model information set includes a plurality of data statistically collected during the development and operation of the target model; preprocessing the model information set to obtain a target feature vector of the target model; wherein the target feature vector includes a plurality of feature parameters for characterizing the target model; based on the target feature vector, determining a feature value of the target model using a target prediction model; wherein the target prediction model is a machine learning model for predicting feature values ​​of a target model obtained by pre-training using a support vector machine, and the feature value is used to characterize the security of the target model.

[0132] In this embodiment, the storage medium includes, but is not limited to, a random access memory (RAM), a read-only memory (ROM), a cache, a hard disk (HDD), or a memory card. The memory may be used to store computer program instructions. The network communication unit may be an interface for network connection communication set in accordance with the standard specified by the communication protocol.

[0133] In this embodiment, the functions and effects specifically implemented by the program instructions stored in the computer storage medium can be explained in comparison with other embodiments and will not be repeated here.

[0134] Obviously, those skilled in the art should understand that the modules or steps of the above-mentioned embodiments of this specification can be implemented by a general computing device, they can be concentrated on a single computing device, or distributed on a network composed of multiple computing devices, and optionally, they can be implemented by a program code executable by a computing device, so that they can be stored in a storage device and executed by the computing device, and in some cases, the steps shown or described can be executed in a different order from that here, or they can be made into individual integrated circuit modules, or multiple modules or steps therein can be made into a single integrated circuit module for implementation. In this way, the embodiments of this specification are not limited to any specific combination of hardware and software.

[0135] Although the embodiments of this specification provide method operation steps as described in the above embodiments or flowcharts, more or fewer operation steps may be included in the method based on routine or no creative labor. In the steps where there is no necessary causal relationship logically, the execution order of these steps is not limited to the execution order provided by the embodiments of this specification. When the device or terminal product of the method described in practice is executed, it can be executed in sequence or in parallel according to the method shown in the embodiments or drawings (for example, a parallel processor or a multi-threaded processing environment).

[0136] It should be understood that the above description is for illustration and not for limitation. By reading the above description, many embodiments and many applications beyond the examples provided will be apparent to those skilled in the art. Therefore, the scope of the embodiments of this specification should not be determined with reference to the above description, but should be determined with reference to the full scope of the aforementioned claims and the equivalents possessed by these claims.

[0137] The above is only a preferred embodiment of the embodiment of this specification, and is not intended to limit the embodiment of this specification. For those skilled in the art, the embodiment of this specification may have various changes and variations. Any modification, equivalent replacement, improvement, etc. made within the spirit and principle of the embodiment of this specification shall be included in the protection scope of the embodiment of this specification.

Claims

1. A method for determining model security, characterized in that: include: Collecting a model information set of a target model; wherein the model information set includes a plurality of statistical data collected during the development and operation of the target model; Preprocessing the model information set to obtain a target feature vector of the target model; wherein the target feature vector includes a plurality of feature parameters for characterizing the target model; Based on the target feature vector, a target prediction model is used to determine a feature value of the target model; wherein the target prediction model is a machine learning model for predicting a target model feature value obtained by pre-training with a support vector machine, and the feature value is used to characterize the security of the target model; Wherein, before determining the characteristic value of the target model by using the target prediction model based on the target characteristic vector, the method further includes: Generate a training sample data set based on the eigenvectors and eigenvalues ​​of each sample model; According to the training sample data set, an initial prediction model is obtained by training using a support vector machine, a target loss function and a default hyperparameter set; Using the training sample data set to cross-validate the initial prediction model; When it is determined that the verification is passed, the initial prediction model is used as the target prediction model; Among them, the objective loss function is as follows: Where L is the target loss function; M is the total number of training samples in the training sample data set; i is a variable, and the maximum value of i is M; j is the predicted value of the i-th training sample; y i is the feature value in the i-th training sample; R j is the representation value corresponding to the predicted value of the eigenvalue of the i-th training sample; is the representation value corresponding to the actual value of the eigenvalue of the i-th training sample; s i ' is the importance parameter of the normalized i-th training sample; x i is the feature vector in the i-th training sample; W is the vector of all parameters; f(x i ; W) j is the score of the feature value of the i-th training sample except the actual value; is the score of the actual value of the feature value of the i-th training sample.

2. The method according to claim 1, characterized in that The model information set includes: model attribute information, model document information, model problem information, model quality information and model importance information.

3. The method according to claim 1, characterized in that Preprocessing the model information set to obtain a target feature vector of the target model includes: Performing data cleaning on the model information set to obtain a cleaned model information set; Performing vector mapping on the cleaned data in the model information set to obtain a first eigenvector; Converting the discrete features in the first feature vector into continuous features to obtain a second feature vector; Normalizing each characteristic parameter in the second characteristic vector to obtain a third characteristic vector; The third eigenvector is reduced in dimension using principal component analysis to obtain a target eigenvector.

4. The method according to claim 1, characterized in that: The category to which the target model belongs is the target category, and the target prediction model is a machine learning model pre-trained using a support vector machine for predicting model feature values ​​of a category being the target category.

5. The method according to claim 4, characterized in that Before generating a training sample data set based on the eigenvectors and eigenvalues ​​of each sample model, the following is also included: Acquire a model information set of multiple sample models; wherein the category to which the sample models belong is a target category; Preprocess the model information set of each sample model to obtain the feature vector of each sample model; Get the characteristic values ​​of each sample model.

6. The method according to claim 5, characterized in that After cross-validating the initial prediction model using the training sample data set, the method further includes: If the validation fails, determine the initial hyperparameter set; Iteratively optimizing the initial hyperparameter set using a Bayesian optimization algorithm to obtain a target hyperparameter set; According to the training sample data set, using the support vector machine, the target loss function and the target hyperparameter set to train to obtain an updated prediction model; Using the training sample data set to cross-validate the updated prediction model; If it is determined that the verification fails, the initial hyperparameter set is adjusted until the verification passes.

7. The method according to claim 5, characterized in that The model information set of each sample model is preprocessed to obtain the feature vector of each sample model, including: Performing data cleaning on the model information sets of the respective sample models to obtain cleaned model information sets of the respective sample models; Performing vector mapping on the data in the model information set of each sample model after the cleaning to obtain a first feature vector of each sample model; Converting discrete features in the first feature vectors of each sample model into continuous features to obtain second feature vectors of each sample model; Normalizing each characteristic parameter in the second characteristic vector of each sample model to obtain a third characteristic vector of each sample model; The third eigenvector of each sample model is reduced in dimension by using the principal component analysis method to obtain a eigenvector sample of each sample model.

8. The method according to claim 7, characterized in that Converting the discrete features in the first feature vectors of each sample model into continuous features to obtain the second feature vectors of each sample model includes: One-Hot encoding is used to convert the discrete categorical features in the first feature vector of each sample model into continuous numerical features; Convert date features into continuous numerical features by calculating the number of days from the current date; The time series features in the continuous numerical features are converted into multidimensional features through linear segmentation, and the multidimensional features are averaged and extreme values ​​are taken using a sliding window to obtain the second feature vector of each sample model.

9. A device for determining model security, characterized in that: include: A collection module, used for collecting a model information set of a target model; wherein the model information set includes a plurality of statistical data collected during the development and operation of the target model; A preprocessing module, used for preprocessing the model information set to obtain a target feature vector of the target model; wherein the target feature vector includes a plurality of feature parameters for characterizing the target model; A determination module, configured to determine the characteristic value of the target model using a target prediction model based on the target characteristic vector; wherein the target prediction model is a machine learning model for predicting the characteristic value of the target model obtained by pre-training using a support vector machine, and the characteristic value is used to characterize the security of the target model; Wherein, before determining the characteristic value of the target model by using the target prediction model based on the target characteristic vector, the method further includes: Generate a training sample data set based on the eigenvectors and eigenvalues ​​of each sample model; According to the training sample data set, an initial prediction model is obtained by training using a support vector machine, a target loss function and a default hyperparameter set; Using the training sample data set to cross-validate the initial prediction model; When it is determined that the verification is passed, the initial prediction model is used as the target prediction model; Among them, the objective loss function is as follows: Where L is the target loss function; M is the total number of training samples in the training sample data set; i is a variable, and the maximum value of i is M; j is the predicted value of the i-th training sample; y i is the feature value in the i-th training sample; R j is the representation value corresponding to the predicted value of the eigenvalue of the i-th training sample; is the representation value corresponding to the actual value of the eigenvalue of the i-th training sample; s i ' is the importance parameter of the normalized i-th training sample; x i is the feature vector in the i-th training sample; W is the vector of all parameters; f(x i ; W) j is the score of the feature value of the i-th training sample except the actual value; is the score of the actual value of the feature value of the i-th training sample.

10. A device for determining model security, characterized in that: The method comprises a processor and a memory for storing processor-executable instructions, wherein the processor implements the steps of the method according to any one of claims 1 to 8 when executing the instructions.

11. A computer-readable storage medium, characterized in that: Computer instructions are stored thereon, and when the instructions are executed, the steps of the method according to any one of claims 1 to 8 are implemented.

Images