A data recovery method and related device for machine learning models
The training set data is recorded and restored by linear combination of model weights, which solves the problems of limited recording capabilities and large errors in correlation value encoding attacks, and improves the accuracy and model performance of data recovery.
Patent Information
- Application Number
- CN202210157952.9
- Authority / Receiving Office
- CN · China
- Patent Type
- Patents(China)
- Current Assignee / Owner
- Filing Date
- 2022-02-21
- Publication Date
- 2025-01-14
- Estimated Expiration
- 2042-02-21
AI Technical Summary
When existing correlation value encoding attacks are used in machine learning models to record training set data, the recording capability is limited and the recovered data error is large, and may reduce the accuracy of the test set of the model.
The training set data is recorded and restored by linear combination of model weights. By obtaining the image training set and model weight sequence, the data record length is calculated, private data is extracted, and the model weights are trained and updated by using record vectors and malicious terms until the training is completed. , to recover private data.
It improves the accuracy of data recovery, reduces the impact on model accuracy, and expands the recording space, avoiding the problem of increasing errors.
Smart Images
Figure CN114549931B_ABST
Abstract
Description
Technical Field
[0001] The present invention relates to the field of machine learning, and in particular to a data recovery method, device, electronic device and storage medium for a machine learning model. Background Art
[0002] In the field of machine learning, a trained machine learning model is usually unable to directly restore the training set. However, if the training method of the machine learning model is modified and the model is guided to actively record the training set data using model parameters during the training process, the training set can be restored using the trained model parameters. Correlation value coding attack is a training method that can guide the machine learning model to record the training set. It uses the Pearson correlation coefficient to maximize the correlation between the model parameters and the data to be recorded to complete the data recording. However, there are some problems with correlation value coding attack, such as limited recording capabilities, large errors in the restored data compared to the original data, and it will also reduce the accuracy of the model's test set. Summary of the invention
[0003] The purpose of the present invention is to provide a data recovery method, device, electronic device and storage medium for machine learning models, which can record and recover training set data by using a linear combination of model weights, thereby improving the accuracy of recovered data and reducing the impact on model accuracy.
[0004] In order to solve the above technical problems, the present invention provides a data recovery method for a machine learning model, comprising:
[0005] Obtain an image training set and a model weight sequence, and calculate the data record length using a preset value and the length of the model weight sequence; the model weight sequence includes all model weights used by the machine learning model, and the preset value is the number of model weights required to record a single pixel data value;
[0006] Extracting private data having a length equal to the data record length from the image training set;
[0007] The model weight sequence is completely divided into a plurality of record vectors according to the data record length, and malicious items are generated using the record vectors, the private data and the data record length;
[0008] In each round of training, the model weight sequence is trained and updated using the image training set, the malicious item and the preset loss function, and the malicious item is numerically updated using the updated model weight sequence until the training is completed;
[0009] The private data is restored using the data record length and the trained model weight sequence.
[0010] Optionally, the training and updating the model weight sequence using the image training set, the malicious item and a preset loss function includes:
[0011] Adding the malicious item to the normal loss value calculated using the preset loss function to obtain a total loss value;
[0012] The total loss value is derived to obtain the gradient of the total loss value with respect to the model weight sequence, and the model weight sequence is updated using the gradient.
[0013] Optionally, the generating a malicious item by using the record vector, the private data and the data record length includes:
[0014] The malicious item is generated by using the record vector, the private data and the data record length in the following manner:
[0015]
[0016] Where W(θ,s) represents the malicious item, θ represents the model weight sequence, and θ i (i∈[1, K]) represents the record vector, K represents the preset value, λ represents the preset impact factor, s represents the private data, r represents the preset scaling factor, l represents the data record length, and the absolute value subscript 1 represents the L1 norm.
[0017] Optionally, the restoring the private data using the data record length and the trained model weight sequence comprises:
[0018] The trained model weight sequence is completely divided into a plurality of recovery vectors according to the data record length;
[0019] The restored vectors are superimposed to obtain initial private data, and the absolute value of the initial private data is multiplied by the scaling factor to obtain the private data.
[0020] The present invention also provides a data recovery device for a machine learning model, comprising:
[0021] An acquisition module is used to acquire an image training set and a model weight sequence, and calculate the data record length using a preset value and the length of the model weight sequence; the model weight sequence includes all model weights used by the machine learning model, and the preset value is the number of model weights required to record a single pixel data value;
[0022] An extraction module, used for extracting private data having a length equal to the data record length from the image training set;
[0023] A malicious item generation module, used to completely divide the model weight sequence into a plurality of record vectors according to the data record length, and generate malicious items using the record vectors, the private data and the data record length;
[0024] A training module, used to use the image training set, the malicious items and a preset loss function to train and update the model weight sequence in each round of training, and use the updated model weight sequence to numerically update the malicious items until the training is completed;
[0025] A recovery module is used to recover the private data using the data record length and the trained model weight sequence.
[0026] Optionally, the training module includes:
[0027] A total loss value calculation submodule, used for adding the malicious item to the normal loss value calculated using the preset loss function of the model to obtain a total loss value;
[0028] An updating submodule is used to derive the total loss value to obtain the gradient of the total loss value with respect to the model weight sequence, and to update the model weight sequence using the gradient.
[0029] Optionally, the malicious item generating module is specifically configured to generate the malicious item by using the record vector, the private data and the data record length in the following manner:
[0030]
[0031] Where W(θ,s) represents the malicious item, θ represents the model weight sequence, and θ i (i∈[1, K]) represents the record vector, K represents the preset value, λ represents the preset impact factor, s represents the private data, r represents the preset scaling factor, l represents the data record length, and the absolute value subscript 1 represents the L1 norm.
[0032] Optionally, the recovery module includes:
[0033] A division submodule, used for completely dividing the trained model weight sequence into a plurality of recovery vectors according to the data record length;
[0034] The restoration submodule is used to superimpose the restoration vectors to obtain initial private data, and multiply the absolute value of the initial private data by the scaling factor to obtain the private data.
[0035] The present invention also provides an electronic device, comprising:
[0036] Memory for storing computer programs;
[0037] A processor is used to implement the steps of the data recovery method for machine learning models as described above when executing the computer program.
[0038] The present invention also provides a storage medium, on which a computer program is stored. When the computer program is executed by a processor, the steps of the data recovery method for the machine learning model as described above are implemented.
[0039] The present invention provides a data recovery method for a machine learning model, comprising: obtaining an image training set and a model weight sequence, and calculating a data record length using a preset value and the length of the model weight sequence; the model weight sequence includes all model weights used by the machine learning model, and the preset value is the number of model weights required to record a single pixel data value; extracting private data with a length of the data record length from the image training set; completely dividing the model weight sequence into a plurality of record vectors according to the data record length, and generating malicious items using the record vectors, the private data and the data record length; in each round of training, training and updating the model weight sequence using the image training set, the malicious items and a preset loss function, and numerically updating the malicious items using the updated model weight sequence until the training is completed; and restoring the private data using the data record length and the trained model weight sequence.
[0040] It can be seen that the present invention first extracts the image training set and the model weight sequence, and calculates the data record length using the preset value and the length of the model weight sequence, wherein the sequence contains all the model weights required for the machine learning model, and the preset value is the number of model weights required to record a single pixel data value; further, the present invention extracts the private data to be recorded from the image training set according to the data record length, and completely divides the model weight sequence into multiple record vectors, and generates malicious items using the record vectors, the private data and the data record length, wherein the malicious items are used to affect the training direction of the machine learning model to record private data in the model weights; finally, the present invention uses the image training set, the normal preset loss function and the malicious items to iteratively train the model weights of the machine learning model to achieve the effect of affecting the gradient descent of the model parameters and forcing all model parameters to record private data. In other words, the present invention can record the training set data in the form of a linear combination of model weights. Since all model weights are used for recording, the accuracy is higher than that of the existing correlation coding attack, and it is not easy to reduce the performance of the model; in addition, the linear combination of model weights can also obtain a larger recording space. The present invention also provides a data recovery device, an electronic device and a storage medium, which have the above-mentioned beneficial effects. BRIEF DESCRIPTION OF THE DRAWINGS
[0041] In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are only embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on the provided drawings without paying creative work.
[0042] Figure 1 A flowchart of a data recovery method for a machine learning model provided by an embodiment of the present invention;
[0043] Figure 2 A structural block diagram of a data recovery device for a machine learning model provided in an embodiment of the present invention. DETAILED DESCRIPTION
[0044] In order to make the purpose, technical solution and advantages of the embodiments of the present invention clearer, the technical solution in the embodiments of the present invention will be clearly and completely described below in conjunction with the drawings in the embodiments of the present invention. Obviously, the described embodiments are part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.
[0045] Correlation value coding attack is a training method that can guide machine learning models to record training sets. It uses the Pearson correlation coefficient to maximize the correlation between model parameters and the data to be recorded to complete data recording. However, there are some problems with correlation value coding attack, such as limited recording capacity, large errors between the recovered data and the original data, and the reduction of the accuracy of the model's test set. In view of this, the present invention provides a data recovery method for machine learning models, which can use a linear combination of model weights to record and recover training set data, which can improve the accuracy of recovered data and reduce the impact on model accuracy. Please refer to Figure 1 , Figure 1 A flowchart of a data recovery method for a machine learning model provided by an embodiment of the present invention, the method may include:
[0046] S101. Obtain an image training set and a model weight sequence, and calculate the data record length using a preset value and the length of the model weight sequence; the model weight sequence includes all model weights used by the machine learning model, and the preset value is the number of model weights required to record a single pixel data value.
[0047] Different from the existing related value coding attack that only uses a single model weight to record a stolen data value, the present invention uses a linear combination of multiple model weights to record a stolen data value, which can effectively improve the accuracy of data recovery and reduce the impact on the accuracy of the machine learning model; in addition, because the present invention uses multiple model weights for recording, a larger recording space can be obtained, and the data in the training set can be recorded more accurately. It should be noted that the model weight sequence is a sequence containing all model weights used by the machine learning model. The embodiment of the present invention does not limit the specific number of model weights, and reference may be made to related techniques of machine learning.
[0048] Furthermore, the embodiment of the present invention also uses a special preset value, which is the number of model weights required to record a single pixel data value. For example, if the preset value is set to 3, 3 model weights are required to record a single pixel data value. In the embodiment of the present invention, the purpose of the preset value is to determine the data record length and to evenly divide the model weight sequence into multiple record vectors. For example, if a machine learning model has 6000 weight parameters and the preset value is 3, then the 6000 weight parameters can record 2000 pixels, and these weight parameters can be completely divided into 3 record vectors, and the number of model weights contained in each record vector is 2000. Obviously, a larger recording space can be obtained by simply adjusting the preset value. It should be noted that the embodiment of the present invention does not limit the specific numerical value of the preset value, and can be set according to actual application requirements.
[0049] Furthermore, it should be noted that the embodiments of the present invention are not limited to a specific machine learning model, which can be selected according to actual needs; the embodiments of the present invention are not limited to a specific image training set, which can include any number and type of images and can be set according to actual application needs.
[0050] S102: Extract private data with a length equal to the data record length from the image training set.
[0051] It should be noted that the embodiments of the present invention do not limit how to extract private data with a length equal to the data record length from the image training set. As long as the number of pixels contained in the private data is equal to the value of the data record length, it can be set according to actual application requirements.
[0052] S103. Completely divide the model weight sequence into multiple record vectors according to the data record length, and generate malicious items using the record vectors, private data and data record length.
[0053] It should be noted that the number of model weights contained in each record vector is the same and equal to the data record length. This is because all record vectors need to record private data together and need to maintain the same length as the private data. The embodiment of the present invention does not limit the specific division method, and can be set according to actual application requirements. For example, the model weight sequence can be divided into multiple segments, and the length of each segment is equal to the data record length, and each segment of the model weight sequence is used as a record vector. For example, the model weight sequence θ contains 6000 model weights and the data record length is 2000. Then the model weight sequence θ can be divided into θ1=θ[0:1999], θ2=θ[2000:3999] and θ3=θ[4000:5999], where θ1, θ2 and θ3 are three record vectors.
[0054] In one possible scenario, a malicious entry is generated using the record vector, private data, and data record length in the following manner:
[0055]
[0056] Where W(θ,s) represents the malicious item, θ represents the model weight sequence, and θ i (i∈[1, K]) represents a record vector, K represents a preset value, λ represents a preset impact factor, s represents private data, r represents a preset scaling factor, l represents a data record length, and the absolute value subscript 1 represents an L1 norm.
[0057] It should be noted that the impact factor is used to adjust the impact of malicious items; the scaling factor is used to scale private data. The reason for adding the scaling factor is that the value of a single pixel is generally 0-255, and the model weight is generally small, about -0.1 to +0.1. If the s value is too large, the model weight cannot be used to represent the pixel value, so s needs to be appropriately reduced. The embodiment of the present invention does not limit the specific values of the impact factor and the scaling factor, which can be set according to actual application requirements.
[0058] S104. In each round of training, the model weight sequence is trained and updated using the image training set, malicious items, and a preset loss function, and the malicious items are numerically updated using the updated model weight sequence until the training is completed.
[0059] After obtaining the malicious item, the item can be added to the loss function of the machine learning model to affect the gradient descent of the model weights, forcing the model weights to gradient descent towards the purpose of the malicious item, and the purpose is to make the cumulative sum of multiple model parameters equal to the value of a certain pixel to be stolen. Specifically, the malicious item can be added to the normal loss value calculated using the preset loss function of the model to obtain the total loss value, and the total loss value can be derived to obtain the gradient of the total loss value to the model weight sequence, and finally the gradient is used to update the model weight sequence. The above gradient can be expressed as:
[0060]
[0061] Among them, θ i represents the model weight sequence of the i-th round of training, f(·) represents the machine learning model, L(·) represents the loss function, (x, y) represents the image training set, represents the gradient, and s represents the recorded private data.
[0062] It should be noted that the embodiments of the present invention do not limit the specific loss function, and reference may be made to relevant techniques of machine learning. The embodiments of the present invention do not limit how to use the loss value to update the model weight, and reference may also be made to relevant techniques of machine learning.
[0063] In one possible scenario, training and updating the model weight sequence using the image training set, malicious items, and a preset loss function may include:
[0064] Step 11: Add the malicious item to the normal loss value calculated using the preset loss function to obtain the total loss value;
[0065] Step 12: Derivative the total loss value to obtain the gradient of the total loss value to the model weight sequence, and use the gradient to update the model weight sequence.
[0066] Furthermore, it can be understood that since the weight values in the model weight sequence will change in each round of training, and the malicious items are generated based on the sequence and affect the gradient descent of the sequence, after each round of training, it is necessary to use the updated model weight sequence to update the malicious items numerically, that is, to recalculate the values of the malicious items using the updated model weight values.
[0067] S105. Restore private data using the data record length and the trained model weight sequence.
[0068] Since the purpose of adding malicious items is to make the cumulative sum of multiple model parameters equal to the value of a certain pixel to be stolen, it is only necessary to re-divide the trained model weight sequence according to the data record length, obtain the recovery vector corresponding to the record vector in the training process, and accumulate the recovery vector to recover the private data. Furthermore, since the scaling factor is used during training, after accumulating the recovery vector, the accumulated result needs to be multiplied by the scaling factor to restore the scaling operation in order to obtain the private data.
[0069] In one possible scenario, restoring private data using the data record length and the trained model weight sequence may include:
[0070] Step 21: Divide the trained model weight sequence into multiple recovery vectors according to the data record length;
[0071] Step 22: The restored vectors are superimposed to obtain initial private data, and the absolute value of the initial private data is multiplied by the scaling factor to obtain private data.
[0072] Based on the above embodiments, the present invention first extracts the image training set and the model weight sequence, and calculates the data record length using the preset value and the length of the model weight sequence, wherein the sequence contains all the model weights required for the machine learning model, and the preset value is the number of model weights required to record a single pixel data value; further, the present invention extracts the private data to be recorded from the image training set according to the data record length, and completely divides the model weight sequence into multiple record vectors, and generates malicious items using the record vectors, the private data and the data record length, wherein the malicious items are used to affect the training direction of the machine learning model to record private data in the model weights; finally, the present invention uses the image training set, the normal preset loss function and the malicious items to iteratively train the model weights of the machine learning model to achieve the effect of affecting the gradient descent of the model parameters and forcing all model parameters to record private data. In other words, the present invention can record the training set data in the form of a linear combination of model weights. Since all model weights are used for recording, the accuracy is higher than that of the existing correlation coding attack, and it is not easy to reduce the performance of the model; in addition, the linear combination of model weights can also obtain a larger recording space.
[0073] The following is an introduction to the data recovery device, electronic device and storage medium for machine learning models provided in an embodiment of the present invention. The data recovery device, electronic device and storage medium for machine learning models described below and the data recovery method for machine learning models described above can be referenced to each other.
[0074] Please refer to Figure 2, Figure 2 A structural block diagram of a data recovery device for a machine learning model provided by an embodiment of the present invention, the device may include:
[0075] The acquisition module 201 is used to acquire the image training set and the model weight sequence, and calculate the data record length using the preset value and the length of the model weight sequence; the model weight sequence includes all the model weights used by the machine learning model, and the preset value is the number of model weights required to record a single pixel data value;
[0076] An extraction module 202, used to extract private data having a length equal to a data record length from an image training set;
[0077] Malicious item generation module 203, used to completely divide the model weight sequence into multiple record vectors according to the data record length, and generate malicious items using the record vectors, private data and data record length;
[0078] The training module 204 is used to train and update the model weight sequence using the image training set, the malicious items and the preset loss function in each round of training, and to numerically update the malicious items using the updated model weight sequence until the training is completed;
[0079] The recovery module 205 is used to recover the private data using the data record length and the trained model weight sequence.
[0080] Optionally, the training module 204 may include:
[0081] A total loss value calculation submodule, used to add the malicious item to the normal loss value calculated using a preset loss function to obtain a total loss value;
[0082] The update submodule is used to derive the total loss value to obtain the gradient of the total loss value to the model weight sequence, and use the gradient to update the model weight sequence.
[0083] Optionally, the malicious item generation module 203 is specifically used to generate the malicious item by using the record vector, private data and data record length in the following manner:
[0084]
[0085] Where W(θ,s) represents the malicious item, θ represents the model weight sequence, and θ i (i∈[1, K]) represents a record vector, K represents a preset value, λ represents a preset impact factor, s represents private data, r represents a preset scaling factor, l represents a data record length, and the absolute value subscript 1 represents an L1 norm.
[0086] Optionally, the recovery module 205 may include:
[0087] A partitioning submodule is used to completely partition the trained model weight sequence into multiple recovery vectors according to the data record length;
[0088] The recovery submodule is used to superimpose the recovery vectors to obtain initial private data, and multiply the absolute value of the initial private data by the scaling factor to obtain private data.
[0089] An embodiment of the present invention further provides an electronic device, including:
[0090] Memory for storing computer programs;
[0091] A processor is used to implement the steps of the data recovery method for machine learning models as described above when executing a computer program.
[0092] Since the embodiments of the electronic device part correspond to the embodiments of the data recovery method part for machine learning models, please refer to the description of the embodiments of the data recovery method part for machine learning models for the embodiments of the electronic device part, which will not be repeated here.
[0093] An embodiment of the present invention also provides a storage medium, on which a computer program is stored. When the computer program is executed by a processor, the steps of the data recovery method for a machine learning model in any of the above embodiments are implemented.
[0094] Since the embodiments of the storage medium part correspond to the embodiments of the data recovery method part for the machine learning model, please refer to the description of the embodiments of the data recovery method part for the machine learning model for the embodiments of the storage medium part, which will not be repeated here.
[0095] The various embodiments in the specification are described in a progressive manner, and each embodiment focuses on the differences from other embodiments. The same or similar parts between the various embodiments can be referred to each other. For the device disclosed in the embodiment, since it corresponds to the method disclosed in the embodiment, the description is relatively simple, and the relevant parts can be referred to the method part description.
[0096] Professionals may further appreciate that the units and algorithm steps of each example described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, computer software, or a combination of the two. In order to clearly illustrate the interchangeability of hardware and software, the composition and steps of each example have been generally described in the above description according to function. Whether these functions are performed in hardware or software depends on the specific application and design constraints of the technical solution. Professionals and technicians may use different methods to implement the described functions for each specific application, but such implementation should not be considered to be beyond the scope of the present invention.
[0097] The steps of the method or algorithm described in conjunction with the embodiments disclosed herein may be implemented directly using hardware, a software module executed by a processor, or a combination of the two. The software module may be placed in a random access memory (RAM), a memory, a read-only memory (ROM), an electrically programmable ROM, an electrically erasable programmable ROM, a register, a hard disk, a removable disk, a CD-ROM, or any other form of storage medium known in the art.
[0098] The above is a detailed introduction to a data recovery method, device, electronic device and storage medium for a machine learning model provided by the present invention. Specific examples are used herein to illustrate the principles and implementation methods of the present invention. The description of the above embodiments is only used to help understand the method of the present invention and its core idea. It should be pointed out that for ordinary technicians in this technical field, without departing from the principles of the present invention, several improvements and modifications can be made to the present invention, and these improvements and modifications also fall within the scope of protection of the claims of the present invention.
Claims
1. A data recovery method for a machine learning model, characterized in that: include: Obtaining an image training set and a model weight sequence, and calculating a data record length using a preset value and the length of the model weight sequence; The model weight sequence includes all model weights used by the machine learning model, and the preset value is the number of model weights required to record a single pixel data value; Extracting private data having a length equal to the data record length from the image training set; The model weight sequence is completely divided into a plurality of record vectors according to the data record length, and malicious items are generated using the record vectors, the private data and the data record length; In each round of training, the model weight sequence is trained and updated using the image training set, the malicious item and the preset loss function, and the malicious item is numerically updated using the updated model weight sequence until the training is completed; The private data is restored using the data record length and the trained model weight sequence.
2. The data recovery method according to claim 1, characterized in that: The training and updating of the model weight sequence by using the image training set, the malicious item and the preset loss function includes: Adding the malicious item to the normal loss value calculated using the preset loss function to obtain a total loss value; The total loss value is derived to obtain the gradient of the total loss value with respect to the model weight sequence, and the model weight sequence is updated using the gradient.
3. The data recovery method according to claim 1 or 2, characterized in that: The generating a malicious item by using the record vector, the private data and the data record length comprises: The malicious item is generated by using the record vector, the private data and the data record length in the following manner: Where W(θ,s) represents the malicious item, θ represents the model weight sequence, and θ i (i∈[1, K]) represents the record vector, K represents the preset value, λ represents the preset influence factor, s represents the private data, r represents the preset scaling factor, l represents the data record length, and the absolute value subscript 1 represents the L1 norm.
4. The data recovery method according to claim 3, characterized in that: The method of restoring the private data by using the data record length and the trained model weight sequence includes: The trained model weight sequence is completely divided into a plurality of recovery vectors according to the data record length; The restored vectors are superimposed to obtain initial private data, and the absolute value of the initial private data is multiplied by the scaling factor to obtain the private data.
5. A data recovery device for a machine learning model, characterized in that: include: An acquisition module, used to acquire an image training set and a model weight sequence, and calculate a data record length using a preset value and the length of the model weight sequence; The model weight sequence includes all model weights used by the machine learning model, and the preset value is the number of model weights required to record a single pixel data value; An extraction module, used for extracting private data having a length equal to the data record length from the image training set; A malicious item generation module, used to completely divide the model weight sequence into a plurality of record vectors according to the data record length, and generate malicious items using the record vectors, the private data and the data record length; A training module, used to use the image training set, the malicious items and a preset loss function to train and update the model weight sequence in each round of training, and use the updated model weight sequence to numerically update the malicious items until the training is completed; A recovery module is used to recover the private data using the data record length and the trained model weight sequence.
6. The data recovery device according to claim 5, characterized in that: The training module comprises: The total loss value calculation submodule is used to add the malicious item to the normal loss value calculated using the preset loss function to obtain a total loss value update submodule, which is used to derive the total loss value to obtain the gradient of the total loss value with respect to the model weight sequence, and use the gradient to update the model weight sequence.
7. The data recovery device according to claim 5 or 6, characterized in that: The malicious item generation module is specifically used to generate the malicious item in the following manner using the record vector, the private data and the data record length: Where W(θ,s) represents the malicious item, θ represents the model weight sequence, and θ i (i∈[1, K]) represents the record vector, K represents the preset value, λ represents the preset impact factor, s represents the private data, r represents the preset scaling factor, l represents the data record length, and the absolute value subscript 1 represents the L1 norm.
8. The data recovery device according to claim 7, characterized in that: The recovery module comprises: A division submodule, used for completely dividing the trained model weight sequence into a plurality of recovery vectors according to the data record length; The restoration submodule is used to superimpose the restoration vectors to obtain initial private data, and multiply the absolute value of the initial private data by the scaling factor to obtain the private data.
9. An electronic device, characterized in that: include: Memory for storing computer programs; A processor, configured to implement the steps of the data recovery method for a machine learning model as described in any one of claims 1 to 4 when executing the computer program.
10. A storage medium, characterized in that: The storage medium stores a computer program, which, when executed by a processor, implements the steps of the data recovery method for a machine learning model as described in any one of claims 1 to 4.