Data protection method, device, medium based on non-learnable noise generator

Abstract

The present application relates to a data protection method, device and medium based on a non-learnable noise generator, the method comprising the following steps: obtaining a target data set and a random generator seed, using a preset auxiliary classification model to optimize the generator seed, obtaining an optimal generator seed, and initializing a noise generator; generating non-learnable noise based on label classification according to the optimal generator seed, adding the non-learnable noise to each sample in the target data set, and obtaining a non-learnable data set. Compared with the prior art, the present application uses an auxiliary classification model to train before adding noise, and makes the noise of images with the same label have similar features during the noise adding process using the generator, thereby solving or partially solving the problem that the existing label-based noise easily leads to original data leakage.

Description

Technical Field

[0001] This invention relates to the fields of big data and artificial intelligence, and in particular to a data protection method, device, and medium based on a non-learnable noise generator. Background Technology

[0002] Data intellectual property rights and privacy protection are important issues in the field of deep learning. In recent years, deep learning has made groundbreaking progress in areas such as computer vision and natural language processing, which is partly attributed to the exponential growth of data in cyberspace and the continuous enhancement of computer data processing capabilities. With the use of large-scale datasets such as ImageNet and JFT-300M, the accuracy of neural network models on some tasks has even surpassed that of humans.

[0003] However, most deep learning datasets are scraped from the internet by researchers, which raises concerns about personal data privacy. Furthermore, the collection and annotation of many large-scale datasets involve significant human and material resources, making the intellectual property rights of these datasets a crucial issue. Both unauthorized data collection and model training can lead to disputes regarding personal privacy and intellectual property. For commercial datasets, dishonest users may scrape publicly available preview images for use as training sets for deep neural network models, causing losses to the data owners. For privately used images, the privacy of the owners may be violated. Moreover, these images could be used to train neural network models for unethical or even illegal purposes.

[0004] In recent years, researchers have proposed several methods to address these key issues of data intellectual property rights and privacy protection in deep learning scenarios. These methods can be broadly categorized into three types: privacy protection techniques during training, infringement inference techniques after training, and data perturbation techniques before training begins, i.e., non-learnable samples.

[0005] Privacy protection techniques during training refer to modifying training data or gradient data during multi-party collaborative training of the model, so that other participants cannot deduce the training data from the gradient update information; infringement inference techniques after training are based on the different performance of the trained model on training data and non-training data to infer whether the model training set contains a certain dataset; and unlearnable noise is achieved by adding noise that is imperceptible to the naked eye to the dataset, making it impossible to train an effective model.

[0006] Privacy protection techniques during training have made significant progress in protecting data privacy, but they assume that the data owner has authorized the training of the neural network model. Infringement inference techniques have achieved some success in both white-box and black-box scenarios. However, the above methods all require the dataset owner to track the trained neural network model, and the dataset owner still needs to spend time and effort to protect their rights. Non-learnable noise, on the other hand, solves the problem of preventing infringement of data property rights in unauthorized scenarios.

[0007] Currently, traditional unlearnable noise is divided into two forms: label-based and sample-based. Label-based noise has a one-to-one correspondence with the labels on the image, while sample-based noise has a one-to-one correspondence with the image itself. Traditional unlearnable noise suffers from the following bottlenecks:

[0008] (1) Label-based noise can easily lead to the leakage of original images: if one original image is leaked, then the attacker can infer the noise of all images in that category. In addition, noise can also be easily detected using some statistical methods.

[0009] (2) Sample-based noise is relatively difficult to detect, but if the data owner wants to save both the original image samples and the unlearnable samples at the same time, this method requires twice the storage space.

[0010] (3) The noise performance based on samples is not as good as that based on labels. Summary of the Invention

[0011] The purpose of this invention is to overcome the shortcomings of the existing technology by providing a data protection method, device, and medium based on a non-learnable noise generator. By training an auxiliary classification model before adding noise, and making the noise of images with the same label have similar characteristics during the noise addition process, the invention solves or partially solves the problem that existing label-based noise can easily lead to the leakage of original data.

[0012] The objective of this invention can be achieved through the following technical solutions:

[0013] One aspect of the present invention provides a data protection method based on a non-learnable noise generator, comprising the following steps:

[0014] Obtain the target dataset and a random generator seed. Optimize the generator seed using a preset auxiliary classification model to obtain an optimal generator seed. Construct a noise generator based on the optimal generator seed.

[0015] According to the noise generator, non-learnable noise based on label classification is generated. For each sample in the target dataset, the non-learnable noise is added to obtain a non-learnable dataset.

[0016] As a preferred technical solution, the generator seed is optimized using a preset auxiliary classification model to obtain the preferred generator seed, specifically as follows:

[0017] Step S1: Based on the randomly generated generator seed, obtain the perturbation data generated by the generator for the target dataset;

[0018] Step S2: Based on the target dataset and the perturbation data, optimize the generator seed multiple times using a preset optimization method to obtain alternative generator seeds, and use the alternative generator seeds to obtain new perturbation data.

[0019] Step S3: Based on the target dataset and the new perturbation data, optimize the auxiliary classification model multiple times using a preset optimization method.

[0020] Step S4: Determine whether the classification error rate of the auxiliary classification model is less than a preset value. If yes, the candidate generator seed is the preferred generator seed. If no, proceed to step S2.

[0021] As a preferred technical solution, the optimization method is specifically as follows:

[0022] Training data is obtained from the target dataset, perturbation data is added, and forward propagation is performed in the auxiliary classification model to obtain the predicted probability of the label.

[0023] Based on the predicted probabilities, calculate the classification loss, obtain the gradient of the classification loss with respect to each component of the optimization objective, and then optimize using an optimization algorithm.

[0024] As a preferred technical solution, the optimization algorithm is the PGD optimization method.

[0025] As a preferred technical solution, the classification loss is calculated using the following formula:

[0026]

[0027] In the formula, Let k be the predicted probability, and k be the number of training data.

[0028] As a preferred technical solution, the generator seed is optimized multiple times using a preset optimization method, implemented using the following formula:

[0029]

[0030] For the aforementioned auxiliary classification model, multiple optimizations are performed using a preset optimization method, implemented as follows:

[0031]

[0032] In the formula, θ t These represent the generator seed and the components of the auxiliary classification model, respectively, for the t-th optimization. These are the generator seed and the components of the auxiliary classification model for the (t+1)th iteration, respectively. These are the gradients of the classification loss with respect to each component of the generator seed and the gradients of the classification loss with respect to each component of the model parameters, respectively.

[0033] As a preferred technical solution, the gradient of the classification loss with respect to each component of the generator seed is obtained using the following formula:

[0034]

[0035] In the formula, This is perturbation data.

[0036] As a preferred technical solution, the target dataset is an image dataset.

[0037] In another aspect, an electronic device is provided, comprising: one or more processors and a memory, wherein the memory stores one or more programs, the one or more programs including instructions for executing the data protection method based on the unlearnable noise generator described above.

[0038] In another aspect, the present invention provides a computer-readable storage medium including one or more programs executable by one or more processors of an electronic device, the one or more programs including instructions for performing the data protection method based on the unlearnable noise generator described above.

[0039] Compared with the prior art, the present invention has the following advantages:

[0040] (1) By training an auxiliary classification model before adding noise, the noise of images with the same label has similar features during the noise addition process using the generator. This avoids the problem that attackers can infer the noise of all samples when one or several original samples are leaked, thus preventing the dataset from being unprotected. This solves or partially solves the problem that existing label-based noise is prone to causing the leakage of original data.

[0041] (2) Compared to sample-based noise, which requires twice the storage space to store the original image samples and unlearnable samples, this invention combines the security advantages of sample-based noise with the storage-saving advantages of label-based noise.

[0042] (3) In the noise generator, a function mapping from the sample label and index to the noise is used to generate unlearnable noise. By carefully designing the mapping, the noise of samples with the same label has similar characteristics, thus having an effect similar to label-based noise. At the same time, the noise is differentiable with respect to the generator seed, so that the gradient descent algorithm can be used to initialize the seed.

[0043] (4) In the initialization of the noise generator, the algorithm uses a method similar to PGD (Project Gradient Descent) to minimize the model’s classification error on the training set and uses the gradient descent algorithm to iterate the seed of the noise generator multiple times, so that the initial model can converge quickly during training. Attached Figure Description

[0044] Figure 1 This is a schematic diagram of the data protection system based on a non-learnable noise generator in Example 1. Detailed Implementation

[0045] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some, not all, of the embodiments of the present invention. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort should fall within the scope of protection of the present invention.

[0046] Example 1

[0047] like Figure 1 This embodiment provides a data protection system based on a non-learnable noise generator, including an original dataset module, a noise generator module, an auxiliary classification model module, and a generator seed module.

[0048] In this embodiment, the noise generator is configured as follows:

[0049] Generator Seed Let be a tensor of (K, C, H, W) dimensions, where K, C, H, and W represent the number of classes, number of channels, pixel height, and pixel width of the training image, respectively. We can view it as an image of the same size as the training data. Represents training data x i The pixel located in channel c, row h, column w ( (Similarly defined), then the design of the noise generator is as follows:

[0050]

[0051] in It is a hash function.

[0052] The generation of unlearnable samples includes the following steps:

[0053] Step S1: Noise generation and noise generator initialization.

[0054] For a deep learning image dataset, the noise generator is first initialized using a non-learnable noise generator initialization algorithm based on gradient descent. During initialization, the deep learning image dataset is forward propagated through an auxiliary classification model to obtain the loss function. Gradient descent is then applied to both the generator seed and the auxiliary classification model parameters until the classification error rate is less than a given value.

[0055] Step S2, generation of unlearnable samples.

[0056] After the noise generator is initialized, adding the perturbation generated by the noise generator to the original image samples yields unlearnable samples. Because we limit the size of the perturbation, the unlearnable samples are difficult to distinguish from the original samples to the naked eye. During model training, unlearnable samples allow the model to quickly achieve a high accuracy rate on training data, but its accuracy on test data remains very low.

[0057] In step S1, the initialization algorithm for the non-learnable noise generator based on gradient descent specifically includes the following steps:

[0058] Step S101: Initialize an auxiliary classification model f θt And randomly generate a generator seed.

[0059] Step S102, Generator For training data (x) i ,y i The generated disturbance

[0060] Step S103: Extract k training data in batches from the training set. After adding the perturbation δ, at f θ The model performs forward propagation to obtain the predicted probability of the model for the true label of the sample.

[0061] Step S104: Calculate the model classification loss.

[0062] Step S105: Calculate the gradient of the classification loss with respect to each component of the generator seed.

[0063] Step S106: Optimize the seed using PGD, that is:

[0064] Step S107, repeat steps S102-106 t times.

[0065] Step S108, Generator For training data (x) i ,y i The generated disturbance

[0066] Step S109: Extract k training data in batches from the training set. After adding the perturbation δ, at f θt The model performs forward propagation to obtain the predicted probability of the model for the true label of the sample.

[0067] Step S110: Calculate the model classification loss.

[0068] Step S111: Calculate the gradient of the classification loss with respect to each component of the model parameters.

[0069] Step S112, optimize the model parameters using gradient descent, that is:

[0070] Step S113, repeat steps S108-102 T times.

[0071] Step S114: Repeat steps 102-113 until the model classification error rate is less than the given value ∈.

[0072] Example 2

[0073] This embodiment provides an electronic device, including: one or more processors and a memory, wherein the memory stores one or more programs, the one or more programs including instructions for executing the data protection method based on a non-learnable noise generator as described in Embodiment 1.

[0074] Example 3

[0075] This embodiment provides a computer-readable storage medium including one or more programs executable by one or more processors of an electronic device, the one or more programs including instructions for performing the data protection method based on a non-learnable noise generator as described in Embodiment 1.

[0076] The above description is merely a specific embodiment of the present invention, but the scope of protection of the present invention is not limited thereto. Any person skilled in the art can easily conceive of various equivalent modifications or substitutions within the technical scope disclosed in the present invention, and these modifications or substitutions should all be covered within the scope of protection of the present invention. Therefore, the scope of protection of the present invention should be determined by the scope of the claims.

Claims

1. A data protection method based on a non-learnable noise generator, characterized in that, Includes the following steps: Obtain the target dataset and a random generator seed. Optimize the generator seed using a preset auxiliary classification model to obtain an optimal generator seed. Construct a noise generator based on the optimal generator seed. Based on the noise generator, non-learnable noise based on label classification is generated. For each sample in the target dataset, the non-learnable noise is added to obtain a non-learnable dataset. The noise generator is modeled as follows: in, Representing training data In the passage , No. Okay, number The noise generator corresponding to the pixels in the column. Generator seed, generator seed It is Tensors of dimension These represent the number of categories, number of channels, pixel height, and pixel width of the training image, respectively. For hash functions, For the generator seed, a preset auxiliary classification model is used for optimization to obtain an optimal generator seed. Specifically: Step S1: Based on the randomly generated generator seed, obtain the perturbation data generated by the generator for the target dataset; Step S2: Based on the target dataset and the perturbation data, optimize the generator seed multiple times using a preset optimization method to obtain alternative generator seeds, and use the alternative generator seeds to obtain new perturbation data. Step S3: Based on the target dataset and the new perturbation data, optimize the auxiliary classification model multiple times using a preset optimization method. Step S4: Determine whether the classification error rate of the auxiliary classification model is less than a preset value. If yes, the candidate generator seed is the preferred generator seed; otherwise, proceed to step S2. The optimization method is as follows: Training data is obtained from the target dataset, perturbation data is added, and forward propagation is performed in the auxiliary classification model to obtain the predicted probability of the label. Based on the predicted probabilities, calculate the classification loss, obtain the gradient of the classification loss with respect to each component of the optimization objective, and then optimize using an optimization algorithm. The optimization algorithm described is the PGD optimization method. The classification loss is calculated using the following formula: In the formula, The predicted probability, The number of training data, For the generator seed, multiple optimizations are performed using a preset optimization method, implemented as follows: For the aforementioned auxiliary classification model, multiple optimizations are performed using a preset optimization method, implemented as follows: In the formula, , The first The suboptimal generator seed and components of the auxiliary classification model. , The first The components of the secondary generator seed and the auxiliary classification model. , Classification loss The gradients of the generator seed with respect to each component, and the gradients of the classification loss with respect to each component of the model parameters. The gradient of the classification loss with respect to each component of the generator seed is obtained using the following formula: 。 2. The data protection method based on a non-learnable noise generator according to claim 1, characterized in that, The target dataset is an image dataset.

3. An electronic device, characterized in that, include: One or more processors and a memory, wherein the memory stores one or more programs, the one or more programs including instructions for performing the data protection method based on a non-learnable noise generator as described in any one of claims 1-2.

4. A computer-readable storage medium, characterized in that, It includes one or more programs that are executed by one or more processors of an electronic device, the one or more programs including instructions for performing the data protection method based on a non-learnable noise generator as described in any one of claims 1-2.

Images