An effective method to avoid ownership detection of deep learning models

Abstract

The present invention discloses a method for effectively avoiding ownership detection of deep learning models, which is characterized in that the ownership detection method uses a suitable data pool to fine-tune the decision boundary of the opponent model so that the confidence of data set reasoning is reduced without reducing the accuracy of the model, and specifically includes the steps of training the victim model, considering the attack method and model architecture, training the opponent model and data set reasoning, model inversion, calculating the EWC loss, fine-tuning and reasoning the opponent model and drawing conclusions. Compared with the prior art, the present invention has the detection of avoiding data set reasoning, and uses the elastic weight consolidation method, so that the model test accuracy can be controlled not to drop significantly while modifying the decision boundary. The method is simple, the effect is significant, and it has a wide application prospect, which can be further developed to a more realistic occasion: black box setting and high-resolution image.

Description

Technical Field

[0001] The present invention relates to the field of deep learning and security technology, and in particular to a method for effectively avoiding ownership detection of a deep learning model. Background Art

[0002] With the development and popularization of artificial intelligence, machine learning has shown great advantages in the fields of image and speech recognition, autonomous driving, natural language processing, and network security detection. Training a well-performing deep learning model requires a lot of computing resources and time. Sometimes model owners upload their models to cloud servers that provide services to the public. In most cases, the model parameters and structure are invisible to users, and users can only get the output (label or probability) corresponding to their input. At this time, some malicious users will steal the intellectual property (IP) of the victim model through the exposed interface. This threat is called a model stealing attack. Since the adversary can obtain a similar functional copy of the victim model, it is very urgent to protect the victim model. To prevent model stealing attacks, there are roughly two different defense strategies. On the one hand, adding perturbations to the victim model can increase the cost of model stealing attacks or prevent them completely. On the other hand, watermarks are widely used to protect model intellectual property.

[0003] Recently, Maini et al. proposed a method called Dataset Inference (DI) to protect the intellectual property rights of models, which uses the unique characteristics of private training data to verify model ownership. Experiments show that dataset inference can verify the theft of models with 95% confidence by exposing only 10 private training samples of the victim model.

[0004] The success of the existing DI method is mainly attributed to the model similarity (such as decision boundary) brought by the training set knowledge. Once the opponent uses some processed data to fine-tune his own model, the detection confidence of DI will drop significantly, and the accuracy of the model will also drop. Therefore, how to find suitable samples that can change the decision boundary of the opponent's model to make DI invalid without reducing the accuracy of the model is an important issue. Summary of the invention

[0005] The purpose of the present invention is to provide a method for effectively avoiding ownership detection of deep learning models in view of the deficiencies of the prior art. The elastic weight consolidation method is used to find a suitable data pool to fine-tune the decision boundary of the opponent model, so that the confidence of the data set reasoning decreases without reducing the accuracy of the model, so that the model test accuracy can be controlled not to decrease significantly while modifying the decision boundary. The method can avoid the detection of data set reasoning by modifying the decision boundary of the model, and uses the elastic weight consolidation method to alleviate catastrophic forgetting to ensure that the model accuracy will not decrease significantly. The experimental results on CIFAR10, CIFAR100 and Imagenet12 data sets prove that the method is effective, and further developed to a more realistic occasion, black box setting and high-resolution image, the method is simple, the effect is significant, and it has broad application prospects.

[0006] The specific technical solution to achieve the purpose of the present invention is: an effective method for avoiding the ownership detection of deep learning models, which is characterized in that the ownership detection method uses a suitable data pool to fine-tune the decision boundary of the opponent model to reduce the confidence of the data set reasoning without reducing the accuracy of the model, and specifically includes the following steps:

[0007] Step 1: Train the Victim Model

[0008] A residual network WRN-28-10 with a total of 28 convolutional layers and a widening factor of 10 was selected. The datasets selected were CIFAR10, CIFAR100, and Imagenet12. CIFAR10 consists of 10 categories of 32×32 color images, with 50,000 training images and 10,000 test images for each category. CIFAR100 has the same distribution as CIFAR10, with 100 classes, each class containing 500 training images and 100 test images, for a total of 60,000 images. Imagenet12 is a subset of ImageNet. It contains 12 categories of color images, with 1,040 training images and 260 validation images for each class.

[0009] Step 2: Consider attack methods and model architecture

[0010] According to the different permission levels of the target model, six attack methods are considered and the adversary model architecture is determined respectively:

[0011] 1) Data-Accessible Attack )

[0012] The adversary has access to the target model’s dataset. The adversary can use knowledge distillation to train a student model or train a new model from scratch, choosing a simple model architecture: ResNet;

[0013] 2) Model-Accessible Attack )

[0014] The adversary has access to the entire model, including the internal structure, hyperparameters, and gradients of the target model; the adversary can train the copy through zero-knowledge distillation, or use a local independent dataset to fine-tune the target model; for the zero-knowledge distillation attacker, WRN-16-1 on CIFAR10 and WRN-16-2 on CIFAR100 are selected; for the fine-tuning attacker, because the victim model is directly fine-tuned, the model architecture is WRN-28-10.

[0015] 3) Query-Only Attack )

[0016] The adversary obtains knowledge of the target model by querying the API. According to the form returned by the API, there are two types of attacks: Label-Only attack and Logit-Only attack. WRN-16-1 on CIFAR10 and WRN-16-2 on CIFAR100 are selected.

[0017] Step 3: Train the Adversary Model

[0018] Different training methods are used depending on the type of attack:

[0019] 1) For data access attacks

[0020] Train both models directly on the original training dataset for 100 iterations;

[0021] 2) For zero-knowledge distillation attacks

[0022] A data-free adversarial distillation method was used, and the model was trained for 500 iterations; 3) For fine-tuning attacks

[0023] Using unlabeled Tinyimages, it approaches CIFAR after 5 training epochs;

[0024] 4) For the query-only attack, unlabeled Tinyimages are used, but the training epochs are 20.

[0025] Step 4: Perform inference on the adversary model on the dataset

[0026] The specific steps of Dataset Inference (DI) are as follows:

[0027] 1) First consider a task with N classes. For each sample (x, y) in the training dataset, DI first generates its distance to each class. Based on the victim’s access to the internal gradient of the target model, DI performs two generation methods: MinGD and Blind Walk, representing white box and black box respectively. In MinGD, DI generates the distance between the target model and the target class by minGD. δ d(x,x+δ)stf(x+δ)=m to obtain the minimum distance δ to the target class m m ; In Blind Walk, DI first selects an initial direction δ and walks k steps along this direction until f(x+kδ)=m,δ m = kδ represents the distance from y to m. In general, the metric (δ1, δ2, …, δ N ) are features embedded into the target model.

[0028] 2) The victim then randomly selects the same number of samples from its private training dataset and the public dataset, and calculates the embedding vector of its own model, marked as -1 or 1 (indicated as 1 in the private training dataset, otherwise -1), which is used to train a binary classifier. In the verification phase, the victim selects the same number of samples from the private and public datasets, calculates the feature vector of its adversary model, and inputs it into the binary classifier to calculate the confidence score μ V and μ. The victim makes the null hypothesis H0:μ<μ V , and get the p-value. If the p-value is lower than the significance level α, then H0 is rejected and the opponent model is marked as stolen;

[0029] Step 5: Perform model inversion on the adversary model to generate synthetic images similar to the original training samples

[0030] By inputting an initial random noise of the same size as the training data and target label y, from the adversary model f A The restored image is optimized to synthesize. λ1, λ2 and λ3 are the classification losses respectively. Batch Normalization Regularization and adversarial loss The penalty coefficient.

[0031] There is still a gap between the synthetic image and the private training sample. The present invention selects the most similar synthetic image. In order to judge the similarity, a metric Q is proposed to quantitatively analyze the difference between the synthetic image and the original training sample. The metric Q is calculated by the following formula (a):

[0032]

[0033] Among them, the numerator represents the cross entropy loss and the denominator represents the maximum confidence value of the synthesized image in the prediction vector.

[0034] The similarity matrix is ​​proportional to the gap between the synthetic image and the real sample. The lower the Q value, the smaller the difference between the synthetic image and the real sample.

[0035] From the above formula (a), we can see that the two synthetic images with low loss values ​​and high prediction probabilities for the target class have lower similarity metrics. The synthetic images are sorted in non-descending order by the metric, and the first K samples are selected as the most similar samples, which are represented as the core set D C , and the other part is represented by D O Given a pre-trained adversarial model, we invert it to get 50,000 synthetic images, and select the first 10,000 images to the core set D according to the sorted similarity matrix. C .

[0036] Step 6: Calculate EWC loss

[0037] In order to minimize the drop in test accuracy, elastic weight consolidation is used, a method to ease the learning speed of specific model parameters, which requires part of the original training data to calculate the Fisher information matrix F, a data pool similar to the private training data obtained by inverting the adversary model. Therefore, the sample with the highest probability can be selected to approximate the Fisher information matrix.

[0038] Calculate the Fisher information matrix F of the previous task = [F ij ] n×n , its F ij Calculated by the following formula (b):

[0039]

[0040] Where f(x|θ) is the output of the model with input x and parameter θ; D is the entire training data set; is the expected value of the gradient change of the i-th layer parameter.

[0041] To measure the contribution of each parameter, EWC selects the diagonal F of the Fisher information matrix F of the previous task calculated by the following formula (c): i :

[0042]

[0043] Where f(x|θ) is the output of the model with input x and parameter θ; D is the entire training data set; is the expected value of the gradient change of the i-th layer parameter; θ * are the model parameters of the previous task.

[0044] When the pre-trained model faces a new task, in order to maintain the memory of the previous task, the model parameters θ

[0045] Should be close to the previous parameter θ * Therefore, a penalty term is set, which is related to the model parameters θ and (with F i Related)θ * A regularization term is added to the loss function to train a new task. The loss function Calculated by the following formula (d):

[0046]

[0047] in, To optimize the cross entropy loss of the new task; λ is a parameter that controls the importance of the previous task; F i represents the parameter θ * The importance on the previous task, that is, the diagonal of the Fisher information matrix of the previous task, i represents each parameter.

[0048] Step 7: Apply EWC method and D O Dataset to fine-tune the adversary model

[0049] In step 5, D was obtained C and D O Two datasets, which are similar to the private training dataset, are O In comparison, D C More similar to the victim training set. Due to the lack of original training sets for previous tasks, D is selected C To approximate the Fisher information matrix F, in the fine-tuning stage, the weights of all layers are updated.

[0050] Step 8: Perform dataset inference on the fine-tuned adversary model and draw conclusions

[0051] The dataset reasoning process is given in step 4. If the result of the dataset reasoning for the fine-tuned adversary model is that it is not stolen, then the method is effective. Otherwise, the method is invalid and cannot avoid the detection of dataset reasoning.

[0052] Compared with the prior art, the present invention has the advantages of avoiding the detection of data set reasoning by modifying the decision boundary of the model, and using the elastic weight consolidation method to alleviate catastrophic forgetting to ensure that the model accuracy will not drop significantly. Since the success of data set reasoning is attributed to the model similarity (such as decision boundary) brought by the training set knowledge, fine-tuning the opponent model can reduce the confidence of data set reasoning. The present invention also uses the elastic weight consolidation method, so that the model test accuracy can be controlled not to drop significantly while modifying the decision boundary. The experimental results on CIFAR10, CIFAR100 and Imagenet12 data sets prove that the method is effective, and further developed to a more realistic occasion: black box setting and high-resolution images. The method is simple, the effect is significant, and it has broad application prospects. BRIEF DESCRIPTION OF THE DRAWINGS

[0053] Figure 1 It is a flow chart of the present invention;

[0054] Figure 2 Schematic diagram of the comparison of p-values ​​obtained by exposing 40 samples to the data set inference before and after fine-tuning. DETAILED DESCRIPTION

[0055] The present invention is described in detail below in conjunction with the accompanying drawings. It should be understood that the specific embodiments described herein are only used to illustrate and explain the present invention, and are not used to limit the present invention.

[0056] See also Figure 1 The present invention adopts an elastic weight consolidation method to find a suitable data pool to fine-tune the decision boundary of the opponent model, so that the confidence of the data set reasoning decreases without reducing the accuracy of the model, so that the model test accuracy can be controlled while modifying the decision boundary. The method of finding a suitable data pool to fine-tune the decision boundary of the opponent model makes the confidence of the data set reasoning decrease without reducing the accuracy of the model, specifically including the following steps:

[0057] Step 1: Train the Victim Model

[0058] A residual network WRN-28-10 with a total of 28 convolutional layers and a widening factor of 10 was selected. The datasets selected were CIFAR10, CIFAR100, and Imagenet12. CIFAR10 consists of 10 categories of 32×32 color images, with 50,000 training images and 10,000 test images for each category. CIFAR100 has the same distribution as CIFAR10, with 100 classes, each class containing 500 training images and 100 test images, for a total of 60,000 images. Imagenet12 is a subset of ImageNet. It contains 12 categories of color images, with 1,040 training images and 260 validation images for each class.

[0059] Step 2: Consider attack methods and model architecture

[0060] According to the different permission levels of the target model, six attack methods are considered and the adversary model architecture is determined respectively: (1) Data-Accessible Attack ) — The adversary can obtain the dataset of the target model. The adversary can use knowledge distillation to train a student model or train a new model from scratch. We chose a simple model architecture: ResNet; (2) Model-Accessible Attack )——The adversary has access to the entire model, including the internal structure, hyperparameters, and gradients of the target model. The adversary can train the replica through zero-knowledge distillation, or use a local independent dataset to fine-tune the target model. For the zero-knowledge distillation attacker, WRN-16-1 on CIFAR10 and WRN-16-2 on CIFAR100 are selected; for the fine-tuning attacker, because the victim model is directly fine-tuned, the model architecture is WRN-28-10; (3) Query-Only Attack ) — The adversary obtains knowledge of the target model by querying the API. According to the form returned by the API, there are two types of attacks: Label-Only attack and Logit-Only attack. We choose WRN-16-1 on CIFAR10 and WRN-16-2 on CIFAR100.

[0061] Step 3: Train the Adversary Model

[0062] Different training methods are used according to the type of attack: (1) For data-accessible attacks, both models are trained directly on the original training dataset for 100 epochs; (2) For zero-knowledge distillation attacks, a data-free adversarial distillation method is used, and the model is trained for 500 epochs; for fine-tuning attacks, unlabeled Tinyimages is used, which approaches CIFAR after 5 training epochs; (3) For query-only attacks, unlabeled Tinyimages is also used, but the training epochs are 20.

[0063] Step 4: Dataset Inference for Adversary Model

[0064] The specific steps of Dataset Inference (DI) are as follows:

[0065] First consider a task with N classes. For each sample (x, y) in the training dataset, DI first generates its distance to each class. Based on the victim’s access to the internal gradient of the target model, DI performs two generation methods: MinGD and Blind Walk, representing white box and black box respectively. In MinGD, DI generates the distance from each class to the target model by minGD. δ d(x,x+δ)stf(x+δ)=m to obtain the minimum distance δ to the target class m m ; In Blind Walk, DI first selects an initial direction δ and walks k steps along this direction until f(x+kδ)=m,δ m = kδ represents the distance from y to m. In general, the metric (δ1, δ2, …, δ N ) are features embedded into the target model.

[0066] The victim then randomly selects the same number of samples from its private training dataset and the public dataset, and calculates the embedding vector of its own model, marked as -1 or 1 (indicated as 1 in the private training dataset, otherwise -1), which is used to train a binary classifier. In the verification phase, the victim selects the same number of samples from the private and public datasets, calculates the feature vector of its adversary model, and inputs it into the binary classifier to calculate the confidence score μ V and μ. The victim makes the null hypothesis H0:μ<μ V , and get the p-value. If the p-value is lower than the significance level α, then H0 is rejected and the opponent model is marked as stolen;

[0067] Step 5: Perform model inversion on the adversary model to generate synthetic images similar to the original training samples

[0068] Then the adversary model is inverted to generate synthetic images similar to the original training samples: by inputting initial random noise of the same size as the training data and target label y, from the adversary model f A The restored image is optimized to synthesize. λ1, λ2 and λ3 are the classification losses respectively. Batch Normalization Regularization and adversarial loss There is still a gap between the synthetic image and the private training sample, and we select the most similar synthetic image.

[0069] In order to judge the similarity, a metric Q is proposed to quantitatively analyze the difference between the synthesized image and the original training sample. The metric Q is calculated by the following formula (a):

[0070]

[0071] Among them, the numerator represents the cross entropy loss; the denominator represents the maximum confidence value of the synthetic image in the prediction vector.

[0072] The similarity matrix is ​​proportional to the gap between the synthetic image and the real sample. The lower the Q value, the smaller the difference between the synthetic image and the real sample. From the above formula (a), it can be seen that the two synthetic images with low loss values ​​and high prediction probabilities for the target class have lower similarity metrics. The synthetic images are sorted in non-descending order by the metric, and the first K samples are selected as the most similar samples. They are represented as the core set D C , and the other part is represented by D O Given a pre-trained adversarial model, we invert it to obtain 50,000 synthetic images. Based on the sorted similarity matrix, we select the first 10,000 images to the core set.

[0073] Step 6: Calculate EWC loss

[0074] To calculate the EWC loss, first calculate the Fisher information matrix F of the previous task = [F ij ] n×n , the calculation method of F is expressed by the following formula (b):

[0075]

[0076] Where f(x|θ) is the output of the model with input x and parameter θ; D is the entire training data set. In order to measure the contribution of each parameter, EWC chooses the following formula (c) to represent the diagonal F of the Fisher information matrix of the previous task i :

[0077]

[0078] Among them, θ * is the model parameter of the previous task. When the pre-trained model faces a new task, in order to keep the memory of the previous task, the model parameter θ should be close to the previous parameter θ * Therefore, a penalty term is set, which is related to the model parameters θ and (with F i Related)θ * A regularization term is added to the loss function to train a new task. The loss function Calculated by the following formula (d):

[0079]

[0080] in, To optimize the cross entropy loss of the new task; λ is a parameter that controls the importance of the previous task; F i represents the parameter θ *The importance of the previous task, that is, the diagonal F of the Fisher information matrix of the previous task i , i represents each parameter. Due to the lack of original training sets for previous tasks, we choose D C To approximate the Fisher information matrix F, in the fine-tuning stage, the weights of all layers are updated.

[0081] Step 7: Apply EWC method and D O Dataset to fine-tune the adversary model

[0082] In step 5 above, we obtain two datasets, which are similar to the private training dataset and D O In comparison, D C More similar to the victim training set. Due to the lack of original training sets for previous tasks, D is selected C To approximate the Fisher information matrix, the weights of all layers are updated during the fine-tuning phase.

[0083] Step 8: Perform dataset inference on the fine-tuned adversary model and draw conclusions

[0084] See also Figure 2 , the experiment found that DI detected the model as stolen before fine-tuning, and the adversary successfully evaded detection after the fine-tuning process. However, it is noted that the white-box method MinGD has some limitations, and it is difficult for the adversary model to fully expose itself to the victim for ownership detection. Therefore, it is further developed to a more realistic occasion: black-box setting and high-resolution images. The present invention adopts Imagenet12 and a more realistic black-box method: Blind Walk. Considering the low efficiency of model extraction on large-scale benchmark datasets, it is assumed that the adversary has full access to the victim's training data to train the model. Four models with different architectures are trained: Resnet34, Resnet18, Densenet121 and VGG16. Resnet34 is considered to be the victim model, and the others are adversary models. The present invention also extracts the knowledge of the victim model and transfers them to the student model. Compared with CIFAR10 and CIFAR100, when only 5 samples are exposed, DI can verify that the model is stolen with a confidence level greater than 95%. After fine-tuning, the minimum p-value of 40 samples is even higher than 0.1, and the present invention can be extended to realistic tasks. DI captures the similarity of model decision boundaries and verifies it by the distance from the sample to the boundary. However, even the decision boundaries of models with different structures trained on the same dataset vary, not to mention the results after fine-tuning on different datasets. In some cases, the former achieved good performance in the previous dataset, but made relatively large modifications to the decision boundary to circumvent DI.

[0085] The effectiveness of the invention depends on the quality and diversity of the synthesized images. The high similarity of images between the core set and the private training set helps to suppress catastrophic forgetting, resulting in relatively small accuracy drops. However, it is difficult to generate suitable images with a proper image gap between the output set and the private training set so that the decision boundary moves sufficiently, which will be an interesting future work.

[0086] The above experimental results are detailed in the following Tables 1 and 2, which show the comparison of test accuracy before and after fine-tuning the adversary model and the p-value obtained after data set inference (the smaller the p-value, the higher the confidence of the hypothesis test that the model has been stolen):

[0087] Table 1 Test accuracy of the victim model and six adversary models before and after fine-tuning

[0088]

[0089] Table 2. The p-values ​​of the victim model and the adversary model (only two are given) after exposing 40 samples to the dataset inference before and after fine-tuning.

[0090]

[0091] Tables 1 and 2 above show that when only 40 samples are exposed on CIFAR10, the probability that the data set inference claims that the model is stolen exceeds 99%. After fine-tuning the opponent's model, the p-value will increase significantly. At this time, DI cannot claim that the probability of the model being stolen exceeds 90%, which means that there is a significant difference between the two models. In order to achieve the same verification effect, the victim needs to expose more samples, or even cannot make a judgment at all, which proves that this method is effective. At the same time, the method of elastic weight consolidation also makes the test accuracy of the model as little as possible or slightly decrease.

[0092] The above is only a further explanation of the present invention and is not intended to limit this patent. Any equivalent implementation of the present invention should be included in the scope of the claims of this patent.

Claims

1. A method for effectively avoiding ownership detection of deep learning models, characterized in that: Using the elastic weight consolidation method, a suitable data pool is found to fine-tune the decision boundary of the opponent model, so that the confidence of the data set reasoning decreases without reducing the accuracy of the model, so that the model test accuracy can be controlled while modifying the decision boundary. The method specifically includes the following steps: Step 1: Train the Victim Model We select a residual network WRN-28-10 with a total number of 28 convolutional layers and a widening factor of 10. The datasets we select are CIFAR10, CIFAR100, and Imagenet12. Step 2: Consider attack methods and model architecture According to the different permission levels and attack methods of the target model, the following adversary model architecture is determined: 1) Data accessibility attack The adversary uses knowledge distillation to train a student model or trains a new model from scratch, choosing ResNet as the model architecture; 2) Model Accessibility Attack The adversary can train the replica through zero-knowledge distillation, or use a local independent dataset to fine-tune the target model. For the zero-knowledge distillation attacker, the model architecture is WRN-16-1 on CIFAR10 and WRN-16-2 on CIFAR100; for the fine-tuning attacker, the model architecture is WRN-28-10; 3) Query-only attack According to the form returned by the API, there are two types: label-only attack and log-only attack. The model architectures are WRN-16-1 on CIFAR10 and WRN-16-2 on CIFAR100. Step 3: Train the Adversary Model Depending on the type of attack, different training methods are used as follows: 1) For data accessibility attacks, two models are trained directly on the original training dataset for 100 iterations; 2) For zero-knowledge distillation attack, a data-free adversarial distillation method is used and the model is trained for 500 iterations; For the fine-tuning attack, unlabeled Tinyimages are used, which is close to CIFAR after 5 training cycles; 3) For query-only attack, unlabeled Tinyimages are used and the training period is 20; Step 4: Dataset Inference for Adversarial Model 1) Consider a task with N classes. For each sample (x, y) in the training dataset, Dataset Inference first generates its distance to each class. Based on the victim’s access to the internal gradient of the target model, DI performs two generation methods: MinGD and Blind Walk, representing white box and black box respectively. In MinGD, DI generates the distance between the target model and the target class by min. δ d(x,x+δ)stf(x+δ)=m to obtain the minimum distance δ to the target class m m ; In Blind Walk, DI selects an initial direction δ and walks k steps along this direction until f(x+kδ)=m,δ m = kδ represents the distance from y to m, where the metric (δ1, δ2, …, δ N ) is the feature embedded in the target model; 2) The victim randomly selects the same number of samples from its private training dataset and the public dataset, calculates the embedding vector of its own model, and marks them as -1 or 1 for training a binary classifier; 3) In the verification phase, the victim selects the same number of samples from the private and public datasets, calculates the feature vector of its adversary model, and inputs it into the binary classifier to calculate the confidence score μ V and μ; the victim makes the null hypothesis H0:μ<μ V , get the p-value. If the p-value is lower than the significance level α, reject H0 and mark the opponent model as stolen. Step 5: Perform model inversion on the adversary model to generate synthetic images similar to the original training samples 1) By inputting an initial random noise of the same size as the training data and target label y, from the adversary model f A The restored image is optimized to synthesize, where λ1, λ2 and λ3 are the classification losses Batch Normalization Regularization and adversarial loss The penalty coefficient of 2) Use the metric Q to quantitatively analyze the difference between the synthesized image and the original training sample, and the metric Q is calculated by the following formula (a): In the formula, is the cross entropy loss; is the maximum confidence value of the synthetic image in the prediction vector; 3) Sort the synthetic images in non-descending order according to the metric Q, select the first K samples as the most similar samples, and represent them as the core set D C , the rest are sample set D O ; Step 6: Calculate EWC loss 1) Select the sample with the highest probability to approximate the Fisher information matrix F of the previous task, where F = [F ij ] n×n , its F ij Calculated by the following formula (b): Where f(x|θ) is the output of the model with input x and parameter θ; D is the entire training data set; is the first-order partial derivative, which represents the expected value of the gradient change of the i-th layer parameter; 2) Select the diagonal of the Fisher information matrix F as the contribution of each parameter, the diagonal of the Fisher information matrix F i Calculated by the following formula (c): In the formula, θ * is the model parameter of the previous task; θ is the model parameter; F ii is the value of the ith row and ith column of the Fisher information matrix; F x～D is the mathematical expectation under the data distribution; 3) In the loss function Add a regularization term to train a new task, the loss function Calculated by the following formula (d): in, To optimize the cross entropy loss for new tasks; λ is a parameter that controls the importance of the previous task; F i The diagonal of the Fisher information matrix for the previous task represents the parameters θ * The importance on the previous task, i represents each parameter; Step 7: Apply EWC method and D O Dataset to fine-tune the adversary model Select D C To approximate the Fisher information matrix F, use the EWC method and D O The dataset fine-tunes the adversary model, updates the weights of all layers, and obtains the fine-tuned adversary model; Step 8: Perform dataset inference on the fine-tuned adversary model and draw conclusions For the fine-tuned adversary model, the dataset inference in step 4 is used. If the inference result is that it is not stolen, the model is valid. Otherwise, the model is invalid and cannot avoid the detection of dataset inference.

Images