A membership inference attack method and system based on image similarity distribution

Abstract

The application provides a member inference attack method and system based on image similarity distribution. It includes: 1) selecting appropriate pedestrian re-identification dataset D and model structure f, training an effective pedestrian re-identification model as the target model f' of the member inference attack; 2) obtaining the feature vectors of the training and test datasets output by the target model after training, and marking them as member dataset and non-member dataset respectively as attack dataset M; 3) sampling feature vectors from the entire attack dataset as the reference set r of the attack method t , and calculating the Euclidean distance of each feature vector in the attack dataset relative to all elements in the reference set, then forming a metric vector v t according to the sampling order of the reference set; 4) updating the metric vector with the corresponding feature vector to form a new attack dataset M'; 5) constructing a deep neural network as an attack model A and training it using the attack dataset M'; 6) using the trained attack model A' to attack the data record x t .

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of privacy computing and deep learning, in particular to a member inference attack method and system based on image similarity distribution. BACKGROUND

[0002] Pedestrian re-identification aims to solve the association and matching of target pedestrians across cameras and scenes, as a key part of intelligent video surveillance systems, it plays a significant role in maintaining social public order. In recent years, thanks to the rapid development of deep learning and the continuous release of large-scale pedestrian re-identification datasets, pedestrian re-identification technology has made great breakthroughs and achieved high accuracy on multiple standard pedestrian datasets. However, the current pedestrian data is usually collected from high-definition cameras in the video surveillance network, often containing personal sensitive information, if these data are misused or leaked due to vulnerabilities, it will lead to serious privacy security problems.

[0003] Currently, the research on pedestrian re-identification is greatly hindered due to possible security trust issues and privacy vulnerabilities. First, many previous pedestrian re-identification methods are vulnerable to external attacks due to the lack of anti-attack prevention, resulting in the leakage of underlying model architecture and parameters, i.e., the pedestrian re-identification system may not be trustworthy due to security issues. On the other hand, some large pedestrian re-identification datasets, such as DukeMTMC, have been forced to stop network sharing due to serious privacy security problems, which is very detrimental to the further development of pedestrian re-identification research. In summary, the current research on trustworthy pedestrian re-identification and privacy protection is in urgent need of systematic and in-depth development.

[0004] Member inference attack mainly studies the membership attribution of the current attack data records, i.e., whether the attack record is used to train the target machine learning model. It can be classified by a simple binary classifier. It also calculates the metric value of the input data, such as confidence score, label information, loss function value or any other pre-set unified metric value, and then compares the metric value with a pre-set threshold to determine the membership attribution of the data.

[0005] From the perspective of the output features of the target model, most of the methods proposed by existing researches are related to the output information of the outermost layer of the network, such as prediction vector, confidence score, loss value or entropy, and there are relatively few studies on pedestrian re-identification models that can only obtain the similarity output between pictures. Therefore, how to conduct member inference attack for the output characteristics of pedestrian re-identification models to quantify security risks is an important problem to be solved. SUMMARY

[0006] Therefore, the present application aims to provide a member inference attack method and system based on image similarity distribution.

[0007] To achieve the above object, the present application provides a member inference attack method based on image similarity distribution, comprising:

[0008] 1) Select a pedestrian re-identification dataset D and a model structure f, train a pedestrian re-identification model as a target model f' of member inference attack;

[0009] 2) Obtain the feature vectors of the training and test datasets output by the target model after training, and label them as member dataset and non-member dataset respectively as attack dataset M;

[0010] 3) Sample feature vectors from the entire attack dataset as reference set r t , and calculate the Euclidean distance of each feature vector in the attack dataset relative to all elements in the reference set, then form a metric vector v t according to the sampling order of the reference set;

[0011] 4) Form a new attack dataset M' with the metric vector and the corresponding feature vector;

[0012] 5) Construct a deep neural network as an attack model A and train it using the attack dataset M';

[0013] 6) Use the trained attack model A' to attack the data record x t , and obtain the final member attribution inference.

[0014] Further, the step 1) specifically comprises the following steps:

[0015] 11) The pedestrian re-identification model is trained using the cross-entropy loss as shown below as the objective function:

[0016]

[0017] Where n represents the number of datasets, x i represents the input pedestrian image, y i represents the corresponding pedestrian category of x i , p(y i |x i ) represents the probability of obtaining the label y i after sampling x i , and a model structure f with a deep residual network as the backbone is selected for training;

[0018] ​12) The model dataset D is Market1501, a classic dataset in the field of pedestrian re-identification.

[0019] Furthermore, the feature vector in step 2) is the feature output of the intermediate layer of model f′ after data input;

[0020] Specifically, the feature vector output of the target model training set is labeled as the member dataset, and the feature vector output of the target model test set is labeled as the non-member dataset. The member dataset and the non-member dataset are used as the attack dataset M.

[0021] Furthermore, the characteristic is that, in step 3), the sampling method is random sampling from the entire attack dataset M, and the number of samples is 4% of the entire attack dataset; the final sampling reference set r t for:

[0022]

[0023] Where N is the number of samples in the reference set; then, the feature vector in the attack dataset M is compared with the entire reference set r. t The Euclidean distance yields a metric vector v with the same dimension as the number N of the reference set. t :

[0024]

[0025] in Represents the metric vector v t The i-th dimension in x corresponds to the i-th reference data in the reference set; t F represents the current target image. fe The output represents the model's feature vectors.

[0026] Furthermore, the characteristic is that, in step 4), the new attack dataset M′ is formed by taking each feature vector F from the old attack dataset M. fe (x t By using reference set r t The metric vector v is calculated. t Then, use the metric vector v t Replace feature vector F fe (x t ).

[0027] Further, in the step 5), the attack model A is a multilayer perceptron with four fully connected hidden layers; each hidden layer contains 512 neurons, and a tanh activation function is selected; a one-dimensional output layer is connected after the hidden layer, and a Sigmoid activation function is selected; the member data in the attack data set M' is marked as 1, and the non-member data is marked as 0, and the training is performed under the stochastic gradient descent method.

[0028] Further, in the step 6), the data record is a data record of unknown member attribution; the data record is input into the target model f' to obtain a corresponding feature vector , and is compared with the reference set r t to obtain a metric vector v . Then, the metric vector v is input into the attack model to obtain a final member attribution inference, and finally an attack success rate (ASR) is obtained as shown in the following formula:

[0029]

[0030] Based on the above purpose, the application further provides a member inference attack system based on image similarity distribution, comprising:

[0031] A first training module is configured to select a pedestrian re-identification data set D and a model structure f, train a pedestrian re-identification model as a target model f' of member inference attack;

[0032] An attack data module is configured to obtain feature vectors of training and testing data sets output by the target model after training, and mark them as a member data set and a non-member data set respectively as an attack data set M;

[0033] A metric vector module is configured to sample feature vectors from the entire attack data set as a reference set r t , and calculate the Euclidean distance of each feature vector in the attack data set relative to all elements in the reference set, and then form a metric vector v t according to the sampling order of the reference set.

[0034] An updating module is configured to form a new attack data set M' by combining the metric vector with the corresponding feature vector;

[0035] A second training module is configured to construct a deep neural network as an attack model A and train it using the attack data set M';

[0036] An attack inference module is configured to use the trained attack model A' to attack the data record x t , and obtain a final member attribution inference.

[0037] In general, the advantages of the present application and the experience brought to the user are:

[0038] I. The training set privacy risk problem in the pedestrian re-identification task is proposed, and the leakage degree of the privacy risk is quantified by the member inference attack method for pedestrian re-identification proposed in the present application;

[0039] II. The first member inference attack method for pedestrian re-identification model is proposed, which attacks by using the relative correlation between the target image and the reference image;

[0040] III. The member inference attack method can promote the development of privacy protection of the pedestrian re-identification system in the form of negative feedback regulation. BRIEF DESCRIPTION OF DRAWINGS

[0041] In the drawings, like reference numerals refer to same or similar components throughout the several views. These drawings are not necessarily to scale. It should be understood that these drawings are merely schematic and certain features can be exaggerated for the purposes of illustration.

[0042] Figure 1 The calculation flowchart of the method of the present application.

[0043] Figure 2 The calculation graph of the method of the present application in the network structure.

[0044] Figure 3 The constituent diagram of the member inference attack system based on image similarity distribution according to the embodiment of the present application is shown.

[0045] Figure 4 The structural schematic diagram of an electronic device provided by an embodiment of the present application is shown.

[0046] Figure 5 The schematic diagram of a storage medium provided by an embodiment of the present application is shown. DETAILED DESCRIPTION

[0047] The present application will be further described in detail below with reference to the drawings and embodiments. It can be understood that the specific embodiments described herein are only used to explain the related application, and not to limit the application. In addition, it should be noted that only the parts related to the application are shown in the drawings for ease of description.

[0048] It should be noted that the embodiments in the present application and the features in the embodiments can be combined with each other without conflict. The present application will be described in detail below with reference to the drawings and embodiments.

[0049] The specific implementation steps of the present application are:

[0050] Figure 1 is the flow chart of the method of the present application, and the specific implementation is as follows:

[0051] 1. Training a pedestrian re-identification model as a target model of member inference attack;

[0052] 2. Obtaining the feature vectors of the training and test data sets output by the pedestrian re-identification target model after training as the member and non-member data sets to construct an attack data set;

[0053] 3. Sampling a reference set from the entire attack data set; calculating the Euclidean distance between the feature vectors in the attack data set and the reference set to obtain the corresponding metric vector;

[0054] 4. Updating the metric vector and the corresponding feature vector to form a new attack data set;

[0055] 5. Constructing a deep neural network as an attack model and training using the attack data set;

[0056] 6. Using the trained attack model to attack the pedestrian re-identification data set to obtain the final member attribution inference. Quantify the privacy security risk of the pedestrian re-identification model by the attack success rate, and promote the development of the pedestrian re-identification privacy protection system in the form of negative feedback.

[0057] The specific implementation of the above steps is as follows:

[0058] Step 1: The pedestrian re-identification model uses the cross-entropy loss as shown below as the objective function for training:

[0059]

[0060] Where n represents the number of data sets, x i represents the input pedestrian image, y i represents the corresponding pedestrian class of x i , p(y i |x i ) represents the probability of obtaining the label y i after sampling x i , and a model structure f with a deep residual network as the backbone is selected in the pedestrian re-identification field. The classical data set Market1501 is trained to obtain the trained target model f′.

[0061] Step 2: Obtain the feature vectors of the training and test datasets from the feature output of the intermediate layer of model f′, specifically the output of the layer before the classification layer, after training the pedestrian re-identification target model. Label the feature vector output of the target model's training set as the member dataset and the feature vector output of the target model's test set as the non-member dataset. Use the member dataset and the non-member dataset as the attack dataset M.

[0062] Step 3: Randomly sample 4% of the feature vectors from the entire attack dataset as the reference set r for the attack method. t :

[0063]

[0064] Where N is the number of samples taken from the reference set. Then, the feature vector in the attack dataset M is compared with the entire reference set r. t The Euclidean distance yields a metric vector v with the same dimension as the number of reference sets N. t :

[0065]

[0066] in Represents the metric vector v t The i-th dimension in x corresponds to the i-th reference data in the reference set. t F represents the current target image. fe The output represents the model's feature vectors.

[0067] Step 4: The metric vector obtained in the previous step and the corresponding feature vector are used to update and form a new attack dataset M′. The update method is to update each feature vector F in the old attack dataset M. fe (x t The metric vector v is obtained by calculating with the reference set rt. t Then use the metric vector v t Replace feature vector F fe (x t ).

[0068] Step 5, as follows Figure 2 The diagram shows the computational graph of the proposed method in the network structure. A multilayer perceptron attack model A with four fully connected hidden layers is constructed. Each hidden layer contains 512 neurons, and the tanh activation function is used. A one-dimensional output layer with the sigmoid activation function is followed by each hidden layer. Member data in the attack dataset M′ is labeled as 1, and non-member data is labeled as 0. The model is then trained using stochastic gradient descent.

[0069] Step 6: Record the data of unknown member affiliation. Input the target model f' to obtain the corresponding feature vector and the reference set r t Calculate the metric vector Then Input the attack model A to obtain the final member attribution inference.

[0070] Finally, the attack success rate (ASR) is obtained as shown in the following formula:

[0071]

[0072] The ASR is used to quantify the privacy security risk of the pedestrian re-identification model, and in the form of negative feedback to promote the development of the pedestrian re-identification privacy protection system.

[0073] Table 1 is a performance comparison of the method of the present application and other conversion methods. As can be seen from Table 1, the accuracy of the method of the present application is the highest, higher than the performance of other conversion methods of the prior art.

[0074] Table 1 Comparison of attack experiment performance on pedestrian re-identification model after conversion of the method of the present application and other member inference attack methods

[0075] Method Feature based Loss based User level The method Accuracy 80.1％ 82.6％ 82.9％ 87.0％

[0076] The application embodiment provides a member inference attack system based on image similarity distribution, which is used to execute the member inference attack method based on image similarity distribution described in the above embodiment, as shown in the following formula: Figure 3 The system comprises:

[0077] The first training module 301 is configured to select a pedestrian re-identification data set D and a model structure f, and train a pedestrian re-identification model as a target model f' of member inference attack;

[0078] The attack data module 302 is configured to obtain the feature vectors of the training and testing data sets output by the target model after training, and mark them as member data set and non-member data set respectively as attack data set M;

[0079] The metric vector module 303 is configured to sample the feature vectors from the entire attack data set as the reference set r t , and calculate the Euclidean distance of each feature vector in the attack data set relative to all elements in the reference set, and then form a metric vector v t according to the sampling order of the reference set;

[0080] The update module 304 is configured to form a new attack data set M' by combining the metric vector with the corresponding feature vector;

[0081] The second training module 305 is configured to construct a deep neural network as an attack model A and train the attack model A using an attack data set M';

[0082] The attack inference module 306 is configured to use the trained attack model A' to perform an attack on the data record x t to obtain a final member attribution inference.

[0083] The member inference attack system based on the image similarity distribution provided by the above-mentioned embodiments of the present application and the member inference attack method based on the image similarity distribution provided by the embodiments of the present application have the same beneficial effects as the methods adopted, run or implemented by the application programs stored therein.

[0084] The embodiments of the present application also provide an electronic device corresponding to the member inference attack method based on the image similarity distribution provided by the above-mentioned embodiments, to execute the member inference attack method based on the image similarity distribution. The embodiments of the present application are not limited.

[0085] Please refer to Figure 4 , which shows a schematic diagram of an electronic device provided by some embodiments of the present application. As Figure 4 shown, the electronic device 20 includes a processor 200, a memory 201, a bus 202 and a communication interface 203, the processor 200, the communication interface 203 and the memory 201 are connected through the bus 202; the memory 201 stores a computer program executable on the processor 200, and the processor 200 executes the computer program to perform the member inference attack method based on the image similarity distribution provided by any one of the preceding embodiments of the present application.

[0086] The memory 201 can include a high-speed random access memory (RAM: Random Access Memory) and can also include a non-volatile memory, such as at least one disk memory. The communication between the system network element and at least one other network element is realized through at least one communication interface 203 (which can be wired or wireless), and the Internet, wide area network, local area network, metropolitan area network, etc. can be used.

[0087] The bus 202 can be an ISA bus, a PCI bus or an EISA bus, etc. The bus can be divided into an address bus, a data bus, a control bus, etc. The memory 201 is used to store programs, and the processor 200 executes the programs after receiving execution instructions. The member inference attack method based on the image similarity distribution disclosed in any one of the preceding embodiments of the present application can be applied to the processor 200 or implemented by the processor 200.

[0088] The processor 200 can be an integrated circuit chip with signal processing capability. In implementation, each step of the above method can be completed by integrated logic circuits or instructions in the form of software in the processor 200. The processor 200 described above can be a general processor, including a central processing unit (CPU), a network processor (NP), etc.; or can be a digital signal processor (DSP), an application specific integrated circuit (ASIC), a ready programmable gate array (FPGA) or other programmable logic device, a discrete gate or transistor logic device, a discrete hardware component. Each method, step and logic block diagram disclosed in the embodiments of the present application can be implemented or executed. The general processor can be a microprocessor or the processor can be any conventional processor. The steps of the method disclosed in combination with the embodiments of the present application can be directly embodied as a hardware code processor for execution, or a combination of hardware and software modules in the code processor for execution. The software module can be located in a random access memory, a flash memory, a read only memory, a programmable read only memory or an electrically erasable programmable memory, a register, etc. The storage medium in the art. The storage medium is located in the memory 201, and the processor 200 reads the information in the memory 201, and combines the hardware to complete the steps of the above method.

[0089] The electronic device provided by the embodiments of the present application and the member inference attack method based on image similarity distribution provided by the embodiments of the present application have the same beneficial effects as the method adopted, run or implemented.

[0090] The present application also provides a computer readable storage medium corresponding to the member inference attack method based on image similarity distribution provided by the preceding embodiments. Please refer to Figure 5 The computer readable storage medium shown is an optical disc 30, and a computer program (i.e. program product) is stored on the optical disc 30. When the computer program is run by a processor, the member inference attack method based on image similarity distribution provided by any of the preceding embodiments is executed.

[0091] It should be noted that examples of the computer readable storage medium can also include, but are not limited to, phase change memory (PRAM), static random access memory (SRAM), dynamic random access memory (DRAM), other types of random access memory (RAM), read only memory (ROM), electrically erasable programmable read only memory (EEPROM), flash memory or other optical, magnetic storage medium, which will not be described one by one here.

[0092] The computer readable storage medium provided by the above embodiments of the present application has the same inventive concept as the member inference attack method based on image similarity distribution provided by the embodiments of the present application, and has the same beneficial effects as the method adopted, run or implemented by the application stored therein.

[0093] It should be noted that:

[0094] The methods and displays provided herein are not inherently related to any particular computer, virtual system, or other apparatus. Various general purpose systems can be used with these methods based on the teachings herein. In terms of an apparatus created to perform the methods of the present application, the required structure would be apparent to those skilled in the art from the description above. Additionally, the present application is not described with reference to any particular programming language. It will be appreciated that a variety of programming languages can be used to implement the teachings of the present application as described herein, and any oblique descriptions of a particular language are used only for the purpose of disclosure.

[0095] In the description provided herein, numerous specific details are set forth. However, it is understood that embodiments of the application can be practiced without these specific details. In some instances, well-known methods, structures and techniques have not been described in detail in order not to obscure the understanding of this description.

[0096] Similarly, it is to be understood that the above description is not of limitation on the scope of the application, but is intended to provide an overview of certain example embodiments of the application as a prelude to a detailed description and is not intended to present an exhaustive description of all possible embodiments. The exemplary embodiments provided in the specification are illustrative of the application and should not be construed as requiring individual features of the application. Rather, the individual features of the application should be construed as being each independently and separately patentable and combinable in any number of sub-combinations.

[0097] Those skilled in the art will appreciate that the modules in the apparatuses in the embodiments can be adapted and placed in one or more apparatuses other than the embodiments. The modules or units or components in the embodiments can be combined into one module or unit or component, and furthermore can be split into multiple sub-modules or sub-units or sub-components. Any combination of all the features disclosed in the specification (including the accompanying claims, abstract and drawings), and any method or process or device of any combination of the features disclosed in the specification (including the accompanying claims, abstract and drawings) can be taken, except that at least some of such features and / or processes or units are mutually exclusive, unless explicitly stated otherwise. Each feature disclosed in the specification (including the accompanying claims, abstract and drawings) can be replaced by alternative features providing the same, equivalent, or similar functions unless stated explicitly otherwise.

[0098] Furthermore, those skilled in the art will appreciate that different embodiments of the application have different features and that the features of one embodiment can not be included in another embodiment. For example, in the following claims, any of the claims can be used to enable a single claim, multiple claims or single and multiple claims in combination. The following claims are therefore merely exemplary and are not intended to limit the application or scope of the application in any way.

[0099] The various component embodiments of the present application can be implemented in hardware, or as software modules running in one or more processors, or in combinations thereof. Those skilled in the art will appreciate that a microprocessor or a digital signal processor (DSP) can be used in practice to implement some or all of the functions of some or all of the components in the system for creating a virtual machine according to the embodiments of the present application. The present application can also be implemented as a program of apparatus or system (for example, a computer program and a computer program product) for performing part or all of the methods described herein. Such a program implementing the present application can be stored on a computer readable medium, or can be in the form of one or more signals. Such signals can be downloaded from an Internet website, or provided on a carrier signal, or in any other form.

[0100] It should be noted that the above embodiments are illustrative of this application and not restrictive, and that those skilled in the art can devise alternative embodiments without departing from the scope of the appended claims. In the claims, any reference signs placed between parentheses should not be construed as limiting the claims. The word "comprising" does not exclude the presence of elements or steps not listed in the claims. The word "a" or "an" preceding an element does not exclude the presence of a plurality of such elements. This application can be implemented by means of hardware comprising several different elements and by means of a suitably programmed computer. In the unit claims enumerating several systems, several of these systems may be embodied by the same item of hardware. The use of the words first, second, and third, etc., does not indicate any order. These words can be interpreted as names.

[0101] The above description is merely a specific embodiment of this application, but the scope of protection of this application is not limited thereto. Any person skilled in the art can easily conceive of various variations or substitutions within the technical scope disclosed in this application, and these should all be included within the scope of protection of this application. Therefore, the scope of protection of this application should be determined by the scope of the claims.

Claims

1. A member inference attack method based on image similarity distribution, characterized in that, Includes the following steps: 1) Select a pedestrian re-identification dataset D and a model structure f, and train a pedestrian re-identification model as the target model f′ for member inference attacks; 2) Obtain the feature vectors of the training and test datasets output by the target model after training, and label them as member datasets and non-member datasets respectively as attack dataset M; 3) Sample feature vectors from the entire attack dataset as the reference set r t It calculates the Euclidean distance of each feature vector in the attack dataset relative to all elements in the reference set, and then constructs a metric vector v according to the sampling order of the reference set. t ; 4) Combine the metric vector with the corresponding feature vector to form a new attack dataset M′; 5) Construct a deep neural network as the attack model A and train it using the attack dataset M′; 6) Use the trained attack model A′ to record the data. The attack is carried out to obtain the final inference of member affiliation; Step 1) specifically includes the following steps: 11) The pedestrian re-identification model uses the cross-entropy loss shown below. Used as the objective function for training: Where n represents the number of datasets, x i The input pedestrian image, y i Represents x i The corresponding pedestrian category, p(y) i |x i ) represents sample x i The label y was obtained later. i The probability is determined, and a model structure f with a deep residual network as the backbone is selected for training. 12) The model dataset D is Market1501, a classic dataset in the field of pedestrian re-identification; In step 3), the sampling method involves random sampling from the entire attack dataset M, with the sample size being 4% of the entire attack dataset; the final sampled reference set r t for: Where N is the number of samples in the reference set; then, the feature vector in the attack dataset M is compared with the entire reference set r. t The Euclidean distance yields a metric vector v with the same dimension as the number N of the reference set. t : in Represents the metric vector v t The i-th dimension in x corresponds to the i-th reference data in the reference set; t F represents the current target image. fe The output represents the model's feature vectors; In step 4), the new attack dataset M′ is the result of taking each feature vector F from the old attack dataset M. fe (x t By using reference set r t The metric vector v is calculated. t Then, use the metric vector v t Replace feature vector F fe (x t ).

2. The member inference attack method based on image similarity distribution according to claim 1, characterized in that, In step 2), the feature vector is the feature output of the intermediate layer of model f′ after data input; Specifically, the feature vector output of the target model training set is labeled as the member dataset, and the feature vector output of the target model test set is labeled as the non-member dataset. The member dataset and the non-member dataset are used as the attack dataset M.

3. The member inference attack method based on image similarity distribution according to claim 1, characterized in that, In step 5), the attack model A is a multilayer perceptron with four fully connected hidden layers; each hidden layer contains 512 neurons and uses the tanh activation function; a one-dimensional output layer is followed by the hidden layer and uses the sigmoid activation function; the member data in the attack dataset M′ is marked as 1 and the non-member data is marked as 0, and the model is trained using the stochastic gradient descent method.

4. The member inference attack method based on image similarity distribution according to claim 1, characterized in that, In step 6), data recording Data records for members whose affiliation is unknown; record this data record Input the target model f′ to obtain the corresponding feature vector and reference set r t Calculate the metric vector Then The final member attribution inference is obtained by inputting the attack model, and the final attack success rate (ASR) is shown in the following formula:

5. A member inference attack system based on image similarity distribution, using the method described in any one of claims 1-4, characterized in that, include: The first training module is used to select the pedestrian re-identification dataset D and the model structure f, and train a pedestrian re-identification model as the target model f′ for member inference attacks. The attack data module is used to obtain the feature vectors of the training and test datasets output by the target model after training, and label them as member datasets and non-member datasets respectively as attack dataset M; The metric vector module is used to sample feature vectors from the entire attack dataset as a reference set r. t It calculates the Euclidean distance of each feature vector in the attack dataset relative to all elements in the reference set, and then constructs a metric vector v according to the sampling order of the reference set. t ; The update module is used to combine the metric vector with the corresponding feature vector to form a new attack dataset M′; The second training module is used to construct a deep neural network as an attack model A and train it using the attack dataset M′. The attack inference module is used to analyze data record x using a trained attack model A′. t The attack is carried out to obtain the final inference of member affiliation.

6. An electronic device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, characterized in that, The processor executes the computer program to implement the method as described in any one of claims 1-4.

7. A computer-readable storage medium having a computer program stored thereon, characterized in that, The program is executed by a processor to implement the method as described in any one of claims 1-4.

Images