Similarity comparison method for multi-dataset and multi-attribute models
Through the multi-attribute model similarity comparison method of multi-datasets, the predicted label consistency rate is calculated using the training data set and the data set with weak semantic correlation of classification labels, which solves the problem of similarity judgment when the model structure information cannot be obtained, and effectively compares the model similarity and intellectual property protection are achieved.
Patent Information
- Application Number
- CN202310350704.0
- Authority / Receiving Office
- CN · China
- Patent Type
- Patents(China)
- Current Assignee / Owner
- Filing Date
- 2023-04-04
- Publication Date
- 2025-08-19
- Estimated Expiration
- 2043-04-04
AI Technical Summary
In the case where the model structure and parameter information cannot be obtained, it is difficult to compare and judge the similarity between the two deep learning models, making it difficult to detect unauthorized use behaviors and to damage the intellectual property rights of the model owners.
By obtaining multiple data sets, including the model's training data set and the data set with weak semantic correlation of classification labels, the predicted label consistency rate is calculated, and a multi-attribute solid-power decision-making method is used to form a comprehensive similarity, so as to achieve similarity comparison of the model.
When only accessing the model interface can be accessed, the similarity between the two deep learning models can be effectively compared, the intellectual property rights of the model can be protected, and the detection ability of unauthorized use behavior can be improved.
Smart Images
Figure CN116451115B_ABST
Abstract
Description
Technical Field
[0001] The present invention belongs to the field of artificial intelligence and relates to a method for comparing similarity of multi-dataset and multi-attribute models. Background Art
[0002] When deep learning models are offered as open services and accessible through interfaces, malicious actors often exploit them without authorization, compromising intellectual property rights. Many internet companies today train models using vast amounts of data and expensive hardware, and profit from selling them as services. However, these open services inherently conflict with the confidentiality of the models and the data used to train them. Malicious actors can exploit models without authorization in various ways, such as model extraction attacks and transfer learning. However, the current poor interpretability of deep learning makes it difficult to detect these unauthorized exploits. This difficulty in detecting unauthorized exploitation makes it difficult to determine the damage inflicted on model owners. When only access to the model interface is lacking further information, determining the degree of similarity between two models is challenging. Summary of the Invention
[0003] In light of this, the present invention aims to provide a method for comparing the similarity of multiple datasets and multi-attribute models. This method can compare the similarity of two models, solving the problem of comparing the similarity of two given models when only accessing the model interface. This method can also, to a certain extent, protect the intellectual property rights of deep learning models.
[0004] In order to achieve the above object, the present invention provides the following technical solutions:
[0005] Multi-dataset multi-attribute model similarity measurement method, for two given models f A and f B , need to judge the model f A and f B The functions are similar, which includes the following steps:
[0006] The first step is to obtain the corresponding training set. Model f A The owner of Party A provides the training dataset D for its model A , model f B The owner of Party B provides the training dataset D for its model B .
[0007] The second step is to select a dataset D that has a weaker semantic correlation with the classification labels of all models of both parties A and B. U Datasets with weak semantic relevance to the classification labels of the model to be compared D U Screening is based on the following two principles: are independent of each other, and secondly The samples in should be evenly distributed in the decision space of the model, that is,
[0008] P(X)~U(DR f )
[0009] Where X represents The sample set of DR f The decision space of the test model. Specifically, through pre-test, screen D U The sample set that can meet the above formula is used as the test sample.
[0010] The third step is to obtain the corresponding output of the test sample; input the appropriate test samples obtained in the first two steps into all the models of Party A and Party B to obtain the corresponding output. Specifically, all the models of Party A are respectively in the dataset D A , dataset D B And the dataset D that has weak semantic relevance to its model classification labels U The predicted label corresponding to each sample is obtained. Similarly, all models of Party B obtain the predicted labels corresponding to the test samples.
[0011] The fourth step is to compare the models and compare the predicted label consistency between the two models based on the output of the previous step. A , dataset D B And the dataset D that has weak semantic relevance to its model classification labels U The output of is used to calculate the predicted label consistency rate. The predicted label consistency rate is expressed as:
[0012]
[0013]
[0014] where f A (x i ) represents the model f A For the sample x i The predicted label of f B (x i ) represents the model f B For the sample x i The predicted label. Based on the test of part of the training set, the sampling prediction label consistency rate can be obtained. When the sample size is large enough, according to the central limit theorem, the distribution of the sampling prediction label consistency rate is a normal distribution. Then the sampling prediction label consistency rate obeys the following distribution, that is,
[0015]
[0016] Where lc is the predicted label consistency rate based on the test of part of the training set, so that the model f can be estimated A and f B In the dataset D A The corresponding overall prediction label consistency rate is recorded as At a confidence level of 1-α,
[0017]
[0018] Similarly, model f A and f B In the dataset D B The corresponding predicted label consistency rate is obtained, which is recorded as
[0019] Model f A and f B In D U The m datasets are tested to obtain the m predicted label consistency rates {lc1, lc2, ..., lc m}, where lc j Represents the model f A and f B The predicted label consistency rate on the jth dataset. In order to avoid the abnormal values generated by the above situation during the test, the model f is calculated A and f B The mean of the predicted label consistency rates on m data sets is
[0020]
[0021] Finally, the model to be compared f is obtained A and f B The consistency rate of predicted labels on m datasets with weak correlation with the semantic features of the original model classification labels
[0022] The fifth step is to form the comprehensive similarity of the model and calculate the corresponding predicted label consistency rate value obtained in the previous step. and And the predicted label consistency rate calculated by testing on m data sets The multi-attribute fixed weight decision method is used to calculate the comprehensive similarity Φ, that is,
[0023]
[0024] The beneficial effect of the present invention is that: for given two deep learning models f A and f B , using multiple datasets from different sources, including model f A All or part of the training set DA , model f B All or part of the training set D B The algorithm also uses m datasets whose classification labels have semantic features that are weakly correlated with those of the two models being compared. These datasets ensure the diversity and independence of the test samples. The algorithm further calculates the predicted label consistency across multiple datasets and combines the test samples from multiple sources to form a comprehensive similarity score. This solves the problem of comparing the similarity between two given deep learning models when only the model interface is accessible and no model structure information is known.
[0025] Other advantages, objects, and features of the present invention will be described in part in the following description and, in part, will be apparent to those skilled in the art upon examination of the following description or may be learned from practice of the present invention. The objects and other advantages of the present invention may be realized and obtained through the following description. BRIEF DESCRIPTION OF THE DRAWINGS
[0026] In order to make the purpose, technical solutions and advantages of the present invention more clear, the present invention will be described in detail below with reference to the accompanying drawings, in which:
[0027] Figure 1 It is a flow chart of the present invention. DETAILED DESCRIPTION
[0028] The following describes the embodiments of the present invention by means of specific examples, and those skilled in the art can easily understand other advantages and effects of the present invention from the contents disclosed in this specification. The present invention can also be implemented or applied through other different specific embodiments, and the details in this specification can also be modified or changed in various ways based on different viewpoints and applications without departing from the spirit of the present invention. It should be noted that the illustrations provided in the following embodiments are only schematic illustrations of the basic concept of the present invention, and the following embodiments and features in the embodiments can be combined with each other without conflict.
[0029] Among them, the accompanying drawings are only for illustrative purposes and represent only schematic diagrams rather than actual pictures, and should not be understood as limiting the present invention. In order to better illustrate the embodiments of the present invention, some parts of the accompanying drawings may be omitted, enlarged or reduced, and do not represent the dimensions of actual products. For those skilled in the art, it is understandable that some well-known structures and their descriptions may be omitted in the accompanying drawings.
[0030] The same or similar numbers in the drawings of the embodiments of the present invention correspond to the same or similar parts; in the description of the present invention, it should be understood that if there are terms such as "upper", "lower", "left", "right", "front", "back", etc. indicating directions or positional relationships, they are based on the directions or positional relationships shown in the drawings. They are only for the convenience of describing the present invention and simplifying the description, and do not indicate or imply that the device or element referred to must have a specific direction, be constructed and operate in a specific direction. Therefore, the terms describing the positional relationship in the drawings are only used for illustrative purposes and cannot be understood as limiting the present invention. For ordinary technicians in this field, the specific meanings of the above terms can be understood according to specific circumstances.
[0031] See also Figure 1 , for two given models f A and f B , need to judge the model f A and f B The functions are similar, which includes the following steps:
[0032] The first step is to obtain the corresponding training set. Model f A The owner of Party A provides the training dataset D for its model A , model f B The owner of Party B provides the training dataset D for its model B .
[0033] The second step is to select a dataset D that has a weaker semantic correlation with the classification labels of all models of both parties A and B. U Datasets with weak semantic relevance to the classification labels of the model to be compared D U Screening is based on the following two principles: are independent of each other, and secondly The samples in should be evenly distributed in the decision space of the model, that is,
[0034] P(X)~U(DR f )
[0035] Where X represents The sample set of DR f The decision space of the test model. Specifically, through pre-test, screen D U The sample set that can meet the above formula is used as the test sample.
[0036] The third step is to obtain the corresponding output of the test sample; input the appropriate test samples obtained in the first two steps into all the models of Party A and Party B to obtain the corresponding output. Specifically, all the models of Party A are respectively in the dataset D A , dataset D B And the dataset D that has weak semantic relevance to its model classification labelsU The predicted label corresponding to each sample is obtained. Similarly, all models of Party B obtain the predicted labels corresponding to the test samples.
[0037] The fourth step is to compare the models and compare the predicted label consistency between the two models based on the output of the previous step. A , dataset D B And the dataset D that has weak semantic relevance to its model classification labels U The output of is used to calculate the predicted label consistency rate. The predicted label consistency rate is expressed as:
[0038]
[0039]
[0040] where f A (x i ) represents the model f A For the sample x i The predicted label of f B (x i ) represents the model f B For the sample x i The predicted label. Based on the test of part of the training set, the sampling prediction label consistency rate can be obtained. When the sample size is large enough, according to the central limit theorem, the distribution of the sampling prediction label consistency rate is a normal distribution. Then the sampling prediction label consistency rate obeys the following distribution, that is,
[0041]
[0042] Where lc is the predicted label consistency rate based on the test of part of the training set, so that the model f can be estimated A and f B In the dataset D A The corresponding overall prediction label consistency rate is recorded as At a confidence level of 1-α,
[0043]
[0044] Similarly, model f A and f B In the dataset D B The corresponding predicted label consistency rate is obtained, which is recorded as
[0045] Model f A and f B In D U Test on the m data sets in the m datasets to get the m predicted label consistency rates where lcj Represents the model f A and f B The predicted label consistency rate on the jth dataset. In order to avoid the abnormal values generated by the above situation during the test, the model f is calculated A and f B The mean of the predicted label consistency rates on m data sets is
[0046]
[0047] Finally, the model to be compared f is obtained A and f B The consistency rate of predicted labels on m datasets with weak correlation with the semantic features of the original model classification labels
[0048] The fifth step is to form the comprehensive similarity of the model and calculate the corresponding predicted label consistency rate value obtained in the previous step. and And the predicted label consistency rate calculated by testing on m data sets The multi-attribute fixed weight decision method is used to calculate the comprehensive similarity Φ, that is,
[0049]
[0050] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention and are not limiting. Although the present invention has been described in detail with reference to the preferred embodiments, those skilled in the art should understand that the technical solutions of the present invention can be modified or replaced by equivalents without departing from the purpose and scope of the technical solutions, which should all be included in the scope of the claims of the present invention.
Claims
1. A multi-dataset, multi-attribute model similarity comparison method, applied in the field of artificial intelligence, is used to compare the similarity of two deep learning models when only the model interface is accessible, in order to protect the model intellectual property rights. Its characteristics are: The method comprises the following steps: S1: Get the corresponding training set, model f A The owner of Party A provides the training dataset D for its model A , model f B The owner of Party B provides the training dataset D for its model B ; S2: Select a dataset D that has a weaker semantic correlation with the classification labels of all models of both parties A and B. U ; The dataset with weak semantic relevance to the classification labels of the model to be compared is D U Filter according to the following two principles: First, are independent of each other; Second, The samples in the model are uniformly distributed in the decision space, that is: P(X)~U(DR f ) Where X represents The sample set of DR f The decision space for the test model; By After pre-testing, randomly select samples and screen D U The sample set that can meet the above formula is used as the test sample; S3: Get the corresponding output of the test sample; input the appropriate test samples obtained in S1 and S2 into all models of Party A and Party B to obtain the corresponding output; all models of Party A are respectively in the dataset D A , dataset D B And the dataset D that has weak semantic relevance to its model classification labels U The predicted label corresponding to each sample is obtained; similarly, all models of Party B obtain the predicted labels corresponding to the test samples; S4: Comparison model, using the output obtained in S3 to compare the predicted label consistency between the two models; The specific models of Party A and Party B are respectively in the dataset D A , dataset D B And the dataset D that has weak semantic relevance to its model classification labels U The output of the predicted label consistency rate is calculated; the predicted label consistency rate is expressed as: where f A (x i ) represents the model f A For the sample x i The predicted label of f B (x i ) represents the model f B For the sample x i The predicted label; based on the test of part of the training set, the sampling prediction label consistency rate is obtained. When the sample size is large enough, according to the central limit theorem, the distribution of the sampling prediction label consistency rate is normally distributed; then the sampling prediction label consistency rate obeys the following distribution, that is, Where lc is the predicted label consistency rate based on the test of part of the training set, and the calculation model f A and f B In the dataset D A The corresponding overall prediction label consistency rate is recorded as At a confidence level of 1-α, Similarly, model f A and f B In the dataset D B The corresponding predicted label consistency rate is obtained, which is recorded as Model f A and f B In D U The m datasets are tested to obtain the m predicted label consistency rates {lc1, lc2, ..., lc m }, where lc j Represents the model f A and f B The predicted label consistency rate on the jth dataset; to avoid outliers generated during the test, calculate the model f A and f B The mean of the predicted label consistency rates on m data sets is Not related to the semantic features of the original model classification label; S5: Forming the comprehensive similarity of the model. Based on the predicted label consistency rate obtained under each data set, the comprehensive similarity of multiple data sets is formed; The comprehensive similarity of the model is formed, which has the following meanings: The corresponding predicted label consistency value calculated in the test S4 and And the predicted label consistency rate calculated by testing on m data sets The multi-attribute fixed weight decision method is used to calculate the comprehensive similarity Φ, that is,