A member inference attack defense method, device, equipment and storage medium

Abstract

The application provides a member inference attack defense method, device, equipment and storage medium, including: training a teacher model according to a privacy data set, adjusting a target model by using a dynamic adjustment loss target algorithm; the dynamic adjustment loss target algorithm includes: combining the feedback result of test data in each round of the target model with the RelaxLoss technology, to ensure that the method is widely applicable; using the knowledge distillation technology to ensure that the model can be normally fitted; dynamically optimizing the learning path problem of the student model through the performance of the training data, to improve the attack resistance of the model; implementing member inference defense according to the continuous iteration optimization of the loss target; the determination result includes: unable to judge whether the data belongs to the training data set or the test data set, thereby solving the technical problems that the traditional regularization method focuses on the utility ability of the model, cannot effectively solve the privacy security problem of the model, and the regularization method for the member inference attack cannot be popularized and promoted due to the limitation of the loss target.

Description

Technical Field

[0001] This application relates to the field of machine learning technology, and in particular to a method, apparatus, device, and storage medium for defending against member reasoning attacks. Background Technology

[0002] The rapid development of machine learning has enabled its deployment in key applications such as autonomous driving and image generation. However, the high cost of basic machine learning equipment and personnel has hindered its widespread adoption. Machine Learning as a Service (MLAS) addresses this pain point. In MLAS, users don't need expensive equipment or highly skilled personnel; they simply upload data to the cloud, which then helps them solve a series of problems, including data preprocessing, model training, and model evaluation. This significantly lowers the barrier to entry for machine learning and makes personalized model customization possible. It not only helps users without data science experience quickly train and deploy models but also allows trained models to be rented out on the platform for external users to access online for a fee per access. Recent research has shown that models have memory, posing a serious privacy threat to models available to external users.

[0003] Membership-based attacks are a type of attack targeting data privacy, aiming to determine whether a specific sample participated in model training. In the earliest machine learning-as-a-service (MWAS) membership-based attacks, attackers successfully launched attacks in a black-box environment by distinguishing the posterior probabilities of the model's output. Compared to black-box attacks, white-box attacks can be seen as an extension of the black-box scenario. In the white-box scenario, adversaries can not only obtain the posterior probabilities of the model's output but also utilize intermediate computational results to improve attack performance. Furthermore, research on membership-based attacks continues to emerge and is gradually expanding to other machine learning scenarios such as image generation, recommender systems, and federated learning. Although no serious privacy breaches have yet been related to membership-based attacks, we still need to be aware of their potential privacy hazards. Therefore, exploring effective mitigation strategies to address the threat of membership-based attacks is crucial.

[0004] Numerous defenses against member inference attacks have been proposed, but existing methods struggle to maintain model privacy while preserving the utility of the machine learning model. Current mitigation measures primarily involve restricting prediction vectors to the top k classes or employing regularization methods. The increased distance between models deployed through knowledge distillation and private datasets is also gaining traction. Furthermore, differential privacy is considered an effective defense, but unfortunately, it requires significant utility sacrifice to reduce the likelihood of information leakage.

[0005] Among numerous mitigation strategies, a defense strategy called RelaxLoss was proposed at the top AI conference ICLR in 2022. This strategy is a regularization defense against member inference attacks. It achieves a balance between model utility and privacy for the first time by relaxing the loss requirement. The implementation steps are as follows: First, a loss target is manually set based on the features of the dataset and model structure in the training task. Second, the model is trained normally, and the cross-entropy loss value is calculated in each round. Third, the model's loss value is compared with the set loss target; when the loss value is greater than the loss target, the model's gradient descent proceeds normally. Fourth, when the loss value is less than the loss target, the model alternates between gradient ascent and gradient descent. During gradient descent, the values ​​of the correct classes in the model's output are retained, while the values ​​of the other incorrect classes are averaged to ensure normal model training. Although this method achieves the goal of protecting data privacy by relaxing the loss target, the differences between the datasets and model structures in real-world training tasks make choosing a suitable loss target for different tasks a crucial issue. Summary of the Invention

[0006] This application provides a method, apparatus, device, and storage medium for defending against member reasoning attacks. It solves the technical problem that traditional regularization methods focus on the utility of the model and cannot effectively solve the privacy and security issues of the model, as well as the problem that regularization methods for member reasoning attacks cannot be popularized and promoted due to the limitation of loss targets.

[0007] In view of this, the first aspect of this application provides a method for defending against member reasoning attacks, the method comprising:

[0008] S1. Initialize parameters, where temperature T = 1, preset loss target value α = 1, β = 0.5;

[0009] S2, Based on Private Dataset Training teacher model f t (θ), where x represents the feature vector of the training sample, y represents the sample label, and θ represents the parameters of the target model;

[0010] S3. Train the student model f based on the aforementioned private dataset. s (θ), and based on the propagation of the preceding term y′=f s (θ,x) is used to calculate the cross-entropy loss of the model in each epoch during training. And training accuracy Where N represents the training data in one round, N t This indicates the number of correct predictions made by the model in one round of training;

[0011] S4. At the end of each round, the test dataset D will be... test Put into the student model f s The test is performed in (θ), and the test dataset D is calculated for each round. test The average loss value, Where, x t y represents the features of the test dataset. t This indicates the labels corresponding to the test dataset. It is a loss function;

[0012] S5. In the next round of model training, the model's cross-entropy loss value will be... Compare with the preset loss target α;

[0013] S6, when the cross-entropy loss value When the loss target value α is greater than the preset target value, the gradient descent of the model is applied.

[0014] S7, when the cross-entropy loss value When the value is less than the preset loss target value α, the accuracy and loss function of each training round are calculated based on knowledge distillation technology;

[0015] S8. Update the parameters based on the accuracy and the average loss value.

[0016] Optionally, step S7 specifically includes:

[0017] When the cross-entropy loss value When the temperature is less than the preset loss target value α, the current training epoch is subtracted from the temperature T to obtain the current temperature T. c ;

[0018] Compare the training sample x with the existing temperature T c As the teacher model f t The input (θ) yields the teacher model label y. t The output of the teacher model is calculated using the softmax function, specifically:

[0019]

[0020] in Using logits as input to softmax, q i The probability of output for each category corresponds to T, where T represents temperature;

[0021] Calculate the cross-entropy using the sample label y and the preceding propagation y'.

[0022] Using the sample label y and the teacher model label y t Calculate KL divergence

[0023] Calculate the loss function

[0024] Optionally, step S8 specifically includes:

[0025] The parameters are updated based on the accuracy and the average loss value, where temperature T = T + 1, and a preset loss target value. β = train acc .

[0026] A second aspect of this application provides a member reasoning attack defense device, the device comprising:

[0027] An initialization unit is used to initialize parameters, where temperature T = 1, preset loss target values ​​α = 1, and β = 0.5;

[0028] The first training unit is used based on a private dataset. Training teacher model f t (θ), where x represents the feature vector of the training sample, y represents the sample label, and θ represents the parameters of the target model;

[0029] The second training unit trains the student model f based on the aforementioned private dataset. s (θ), and based on the propagation of the preceding term y`=f s (θ,x) is used to calculate the cross-entropy loss of the model in each epoch during training. And training accuracy Where N represents the training data in one round, N t This indicates the number of correct predictions made by the model in one round of training;

[0030] The test unit is used to process the test dataset D at the end of each round. test Put into the student model f s The test is performed in (θ), and the test dataset D is calculated for each round. test The average loss value, Where, x t y represents the features of the test dataset. t This indicates the labels corresponding to the test dataset. It is a loss function;

[0031] The comparison unit is used to compare the model's cross-entropy loss value during the next round of model training. Compare with the preset loss target α;

[0032] The first processing unit is configured to, when the cross-entropy loss value When the loss target value α is greater than the preset target value, the gradient descent of the model is applied.

[0033] The second processing unit is used to process the cross-entropy loss value. When the value is less than the preset loss target value α, the accuracy and loss function of each training round are calculated based on knowledge distillation technology;

[0034] A parameter update unit is used to update the parameters based on the accuracy and the average loss value.

[0035] Optionally, the second processing unit is specifically used for:

[0036] When the cross-entropy loss value When the temperature is less than the preset loss target value α, the current training epoch is subtracted from the temperature T to obtain the current temperature T. c ;

[0037] Compare the training sample x with the existing temperature T c As the teacher model f t The input (θ) yields the teacher model label y. t The output of the teacher model is calculated using the softmax function, specifically:

[0038]

[0039] in Using logits as input to softmax, q i The probability of output for each category corresponds to T, where T represents temperature;

[0040] Calculate the cross-entropy using the sample label y and the preceding propagation y'.

[0041] Using the sample label y and the teacher model label y t Calculate KL divergence

[0042] Calculate the loss function

[0043] Optionally, the parameter update unit is specifically used for:

[0044] The parameters are updated based on the accuracy and the average loss value, where temperature T = T + 1, and a preset loss target value. β = train acc .

[0045] A third aspect of this application provides a member inference attack defense device, the device comprising a processor and a memory:

[0046] The memory is used to store program code and transmit the program code to the processor;

[0047] The processor is configured to execute the steps of the member inference attack defense method described in the first aspect above, according to the instructions in the program code.

[0048] A fourth aspect of this application provides a computer-readable storage medium for storing program code for performing the steps of the member reasoning attack defense method described in the first aspect above.

[0049] As can be seen from the above technical solutions, the embodiments of this application have the following advantages:

[0050] This application provides a method, apparatus, device, and storage medium for defending against member inference attacks, including: training a teacher model based on a privacy dataset, and adjusting the target model using a dynamic loss target adjustment algorithm; the dynamic loss target adjustment algorithm includes: combining the feedback results of the test data in each round of the target model with the RelaxLoss technique to ensure the method has a wide range of applicability; using knowledge distillation technology to ensure the model can fit normally; dynamically optimizing the learning path of the student model through the performance of the training data to improve the model's resistance to attacks; and achieving member inference defense through continuous iterative optimization of the loss target; the judgment result includes: being unable to determine whether the data belongs to the training dataset or the test dataset, thereby solving the problem that traditional regularization methods focus on the utility of the model and cannot effectively solve the privacy and security problem of the model, as well as the technical problem that regularization methods for member inference attacks cannot be popularized and promoted due to the limitation of the loss target. Attached Figure Description

[0051] Figure 1 This is a flowchart illustrating a method for defending against member reasoning attacks in an embodiment of this application.

[0052] Figure 2 This is a schematic diagram of the structure of a member reasoning attack defense device according to an embodiment of this application;

[0053] Figure 3 This is a schematic diagram of the structure of a member reasoning attack defense device in an embodiment of this application. Detailed Implementation

[0054] To enable those skilled in the art to better understand the present application, the technical solutions in the embodiments of the present application will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present application, and not all embodiments. Based on the embodiments in the present application, all other embodiments obtained by those of ordinary skill in the art without creative effort are within the scope of protection of the present application.

[0055] This application designs a method, device, equipment, and storage medium for defending against member reasoning attacks. It solves the technical problems that traditional regularization methods focus on the utility of the model and cannot effectively solve the privacy and security issues of the model, as well as the problem that regularization methods for member reasoning attacks cannot be popularized and promoted due to the limitation of loss targets.

[0056] For easier understanding, please refer to Figure 1 , Figure 1 This is a flowchart of a method for defending against member reasoning attacks in an embodiment of this application, as shown below. Figure 1 As shown, specifically:

[0057] S1. Initialize parameters, where temperature T = 1, preset loss target value α = 1, β = 0.5;

[0058] S2, Based on Private Dataset Training teacher model f t (θ), where x represents the feature vector of the training sample, y represents the sample label, and θ represents the parameters of the target model;

[0059] S3. Training the student model f based on a private dataset s (θ), and based on the propagation of the preceding term y`=f s (θ,x) is used to calculate the cross-entropy loss of the model in each epoch during training. And training accuracy Where N represents the training data in one round, N t This indicates the number of correct predictions made by the model in one round of training;

[0060] S4. At the end of each round, the test dataset D will be... test Put into student model f s The test is performed in (θ), and the test dataset D is calculated for each round. test The average loss value, Where, x t y represents the features of the test dataset. t This indicates the labels corresponding to the test dataset. It is a loss function;

[0061] S5. In the next round of model training, the model's cross-entropy loss value will be... Compare with the preset loss target α;

[0062] S6, when the cross-entropy loss value When the loss target value α is greater than the preset target value, the model's gradient descent occurs;

[0063] S7, when the cross-entropy loss value When the error is less than the preset loss target value α, the accuracy and loss function of each training round are calculated based on knowledge distillation technology.

[0064] S8. Update parameters based on accuracy and average loss.

[0065] Furthermore, step S7 specifically includes:

[0066] When the cross-entropy loss value When the temperature is less than the preset loss target value α, the current training epoch is subtracted from the temperature T to obtain the current temperature T. c ;

[0067] Compare the training sample x with the existing temperature T c As a teacher model f t The input (θ) yields the teacher model label y. t The output of the teacher model is calculated using the softmax function, specifically:

[0068]

[0069] in Using logits as input to softmax, q i The probability of output for each category corresponds to T, where T represents temperature;

[0070] Calculate the cross-entropy using the sample label y and the previous propagation y'.

[0071] Using sample label y and teacher model label y t Calculate KL divergence

[0072] Calculate the loss function

[0073] Furthermore, step S8 specifically includes:

[0074] The parameters are updated based on accuracy and average loss value, where temperature T = T + 1, and the preset loss target value is... β = train acc .

[0075] The beneficial effects of the member reasoning attack defense method provided in this application can be further illustrated by the following simulation experiments:

[0076] 1. Simulation experimental conditions:

[0077] The simulations used two datasets: CIFAR-10 and CIFAR-100. Each dataset was trained on two models, ResNet20 and VGG11, respectively.

[0078] 2. Simulation content and result analysis:

[0079] Simulation content: Under the above simulation experimental conditions, the RelaxLoss method, which has good performance among existing member inference attack defense methods, was used to compare the attack accuracy of the two methods before and after adding the defense method in four cases. The results are shown in Table 1:

[0080]

[0081]

[0082] Our evaluation metric is the AUC value of the attack model; therefore, the ideal defense scenario is AUC = 0.5. In other words, if the attack accuracy approaches 50% after adding the defense method, it indicates that the scheme successfully resists member inference attacks and successfully protects the privacy of the training data.

[0083] As shown in Table 1, the proposed method reduces the average loss by 7.975% and 6.275% compared to the traditional RelaxLoss strategy when facing NN attacks and LOSS attacks, respectively. Although the proposed method is 3.9 and 3.3 lower than RelaxLoss in the CIFAR100 (ResNet20) case, considering that our strategy does not require setting a loss target and effectively protects the privacy of the model training data in most cases, this application is an effective member inference defense scheme.

[0084] Please see Figure 2 , Figure 2 This is a schematic diagram of the structure of a member reasoning attack defense device according to an embodiment of this application, such as... Figure 2 As shown, specifically:

[0085] Initialization unit 201 is used to initialize parameters, where temperature T = 1, preset loss target value α = 1, β = 0.5;

[0086] The first training unit 202 is used for training based on a private dataset. Training teacher model f t(θ), where x represents the feature vector of the training sample, y represents the sample label, and θ represents the parameters of the target model;

[0087] The second training unit 203 trains the student model f based on a private dataset. s (θ), and based on the propagation of the preceding term y`=f s (θ,x) is used to calculate the cross-entropy loss of the model in each epoch during training. And training accuracy Where N represents the training data in one round, N t This indicates the number of correct predictions made by the model in one round of training;

[0088] Test unit 204 is used to transfer the test dataset D at the end of each round. test Put into student model f s The test is performed in (θ), and the test dataset D is calculated for each round. test The average loss value, Where, x t y represents the features of the test dataset. t This indicates the labels corresponding to the test dataset. It is a loss function;

[0089] Comparison unit 205 is used to compare the model's cross-entropy loss value during the next round of model training. Compare with the preset loss target α;

[0090] The first processing unit 206 is used to process the cross-entropy loss value. When the loss target value α is greater than the preset target value, the model's gradient descent occurs;

[0091] The second processing unit 207 is used to process the cross-entropy loss value. When the error is less than the preset loss target value α, the accuracy and loss function of each training round are calculated based on knowledge distillation technology.

[0092] The parameter update unit 208 is used to update the parameters based on the accuracy and the average loss value.

[0093] Furthermore, the second processing unit 207 is specifically used for:

[0094] When the cross-entropy loss value When the temperature is less than the preset loss target value α, the current training epoch is subtracted from the temperature T to obtain the current temperature T. c ;

[0095] Compare the training sample x with the existing temperature T c As a teacher model f t The input (θ) yields the teacher model label y.t The output of the teacher model is calculated using the softmax function, specifically:

[0096]

[0097] in Using logits as input to softmax, q i The probability of output for each category corresponds to T, where T represents temperature;

[0098] Calculate the cross-entropy using the sample label y and the previous propagation y'.

[0099] Using sample label y and teacher model label y t Calculate KL divergence

[0100] Calculate the loss function

[0101] Furthermore, the parameter update unit 208 is specifically used for:

[0102] The parameters are updated based on accuracy and average loss value, where temperature T = T + 1, and the preset loss target value is... β = train acc .

[0103] This application also provides another member inference attack defense device, such as... Figure 3 As shown, for ease of explanation, only the parts related to the embodiments of this application are shown. For specific technical details not disclosed, please refer to the method section of the embodiments of this application. The terminal can be any terminal device including mobile phones, tablets, personal digital assistants (PDAs), point-of-sale (POS) terminals, in-vehicle computers, etc. Taking a mobile phone as an example:

[0104] Figure 3 This is a block diagram illustrating a portion of the structure of a mobile phone related to the terminal provided in the embodiments of this application. (Reference) Figure 3 The mobile phone includes: a radio frequency (RF) circuit 1010, a memory 1020, an input unit 1030, a display unit 1040, a sensor 1050, an audio circuit 1060, a wireless fidelity (WiFi) module 1070, a processor 1080, and a power supply 1090, etc. Those skilled in the art will understand that... Figure 3The mobile phone structure shown does not constitute a limitation on the mobile phone and may include more or fewer components than shown, or combine certain components, or have different component arrangements.

[0105] The following is combined Figure 3 A detailed introduction to each component of a mobile phone:

[0106] The RF circuit 1010 can be used for receiving and transmitting signals during information transmission or calls. Specifically, it receives downlink information from the base station and processes it with the processor 1080; additionally, it transmits uplink data to the base station. Typically, the RF circuit 1010 includes, but is not limited to, an antenna, at least one amplifier, a transceiver, a coupler, a low-noise amplifier (LNA), a duplexer, etc. Furthermore, the RF circuit 1010 can also communicate wirelessly with networks and other devices. The aforementioned wireless communications may use any communication standard or protocol, including but not limited to Global System for Mobile Communications (GSM), General Packet Radio Service (GPRS), Code Division Multiple Access (CDMA), Wideband Code Division Multiple Access (WCDMA), Long Term Evolution (LTE), email, and Short Messaging Service (SMS).

[0107] The memory 1020 can be used to store software programs and modules. The processor 1080 executes various mobile phone functions and data processing by running the software programs and modules stored in the memory 1020. The memory 1020 may mainly include a program storage area and a data storage area. The program storage area may store the operating system, applications required for at least one function (such as sound playback function, image playback function, etc.), etc.; the data storage area may store data created according to the use of the mobile phone (such as audio data, phonebook, etc.). In addition, the memory 1020 may include high-speed random access memory, and may also include non-volatile memory, such as at least one disk storage device, flash memory device, or other volatile solid-state storage device.

[0108] The input unit 1030 can be used to receive input numerical or character information, and to generate key signal inputs related to user settings and function control of the mobile phone. Specifically, the input unit 1030 may include a touch panel 1031 and other input devices 1032. The touch panel 1031, also known as a touch screen, can collect touch operations performed by the user on or near it (such as operations performed by the user using a finger, stylus, or any suitable object or accessory on or near the touch panel 1031), and drive the corresponding connection devices according to a pre-set program. Optionally, the touch panel 1031 may include two parts: a touch detection device and a touch controller. The touch detection device detects the user's touch position and the signal generated by the touch operation, and transmits the signal to the touch controller; the touch controller receives touch information from the touch detection device, converts it into touch point coordinates, and sends it to the processor 1080, and can also receive and execute commands sent by the processor 1080. In addition, the touch panel 1031 can be implemented using various types such as resistive, capacitive, infrared, and surface acoustic wave. In addition to the touch panel 1031, the input unit 1030 may also include other input devices 1032. Specifically, other input devices 1032 may include, but are not limited to, one or more of the following: physical keyboard, function keys (such as volume control buttons, power buttons, etc.), trackball, mouse, joystick, etc.

[0109] The display unit 1040 can be used to display information input by the user or information provided to the user, as well as various menus of the mobile phone. The display unit 1040 may include a display panel 1041, which may optionally be configured as a Liquid Crystal Display (LCD), Organic Light-Emitting Diode (OLED), or similar display panel 1041. Further, a touch panel 1031 may cover the display panel 1041. When the touch panel 1031 detects a touch operation on or near it, it transmits the information to the processor 1080 to determine the type of touch event. Subsequently, the processor 1080 provides corresponding visual output on the display panel 1041 according to the type of touch event. Although in Figure 3 In this embodiment, the touch panel 1031 and the display panel 1041 are two separate components to realize the input and output functions of the mobile phone. However, in some embodiments, the touch panel 1031 and the display panel 1041 can be integrated to realize the input and output functions of the mobile phone.

[0110] The mobile phone may also include at least one sensor 1050, such as a light sensor, a motion sensor, and other sensors. Specifically, the light sensor may include an ambient light sensor and a proximity sensor. The ambient light sensor can adjust the brightness of the display panel 1041 according to the ambient light level, and the proximity sensor can turn off the display panel 1041 and / or the backlight when the phone is moved to the ear. As a type of motion sensor, an accelerometer sensor can detect the magnitude of acceleration in various directions (generally three axes). When stationary, it can detect the magnitude and direction of gravity and can be used for applications that recognize the phone's posture (such as landscape / portrait switching, related games, magnetometer posture calibration), vibration recognition-related functions (such as pedometer, taps), etc. Other sensors that may be configured in the mobile phone, such as gyroscopes, barometers, hygrometers, thermometers, and infrared sensors, will not be described in detail here.

[0111] The audio circuit 1060, speaker 1061, and microphone 1062 provide an audio interface between the user and the mobile phone. The audio circuit 1060 converts the received audio data into electrical signals and transmits them to the speaker 1061, where the speaker 1061 converts them into sound signals for output. On the other hand, the microphone 1062 converts the collected sound signals into electrical signals, which are then received by the audio circuit 1060, converted into audio data, and then processed by the processor 1080 before being transmitted via the RF circuit 1010 to, for example, another mobile phone, or the audio data can be output to the memory 1020 for further processing.

[0112] WiFi is a short-range wireless transmission technology. Through the WiFi module 1070, mobile phones can help users send and receive emails, browse web pages, and access streaming media, providing users with wireless broadband internet access. Although Figure 3 The WiFi module 1070 is shown, but it is understood that it is not an essential component of a mobile phone and can be omitted as needed without changing the essence of the invention.

[0113] The processor 1080 is the control center of the mobile phone, connecting various parts of the phone through various interfaces and lines. It executes software programs and / or modules stored in the memory 1020 and calls data stored in the memory 1020 to perform various functions and process data, thereby providing overall monitoring of the phone. Optionally, the processor 1080 may include one or more processing units; preferably, the processor 1080 may integrate an application processor and a modem processor, wherein the application processor mainly handles the operating system, user interface, and applications, and the modem processor mainly handles wireless communication. It is understood that the modem processor may not be integrated into the processor 1080.

[0114] The mobile phone also includes a power supply 1090 (such as a battery) that supplies power to various components. Preferably, the power supply can be logically connected to the processor 1080 through a power management system, thereby enabling functions such as charging, discharging, and power consumption management through the power management system.

[0115] Although not shown, mobile phones may also include a camera, Bluetooth module, etc., which will not be described in detail here.

[0116] In this embodiment of the application, the processor 1080 included in the terminal also has the following functions:

[0117] S1. Initialize parameters, where temperature T = 1, preset loss target value α = 1, β = 0.5;

[0118] S2, Based on Private Dataset Training teacher model f t (θ), where x represents the feature vector of the training sample, y represents the sample label, and θ represents the parameters of the target model;

[0119] S3. Training the student model f based on a private dataset s (θ), and based on the propagation of the preceding term y`=f s (θ,x) is used to calculate the cross-entropy loss of the model in each epoch during training.

[0120] S4. At the end of each round, the test dataset D will be... test Put into student model f s The test is performed in (θ), and the test dataset D is calculated for each round. test Average loss value

[0121] S5. In the next round of model training, the model's cross-entropy loss value will be... Compare with the preset loss target α;

[0122] S6, when the cross-entropy loss value When the loss target value α is greater than the preset target value, the model's gradient descent occurs;

[0123] S7, when the cross-entropy loss value When the error is less than the preset loss target value α, the accuracy and loss function of each training round are calculated based on knowledge distillation technology.

[0124] S8. Update parameters based on accuracy and average loss.

[0125] This application also provides a computer-readable storage medium for storing program code that executes any one of the aforementioned member reasoning attack defense methods.

[0126] This application provides a method, apparatus, device, and storage medium for defending against member inference attacks, including: training a teacher model based on a privacy dataset, and adjusting the target model using a dynamic loss target adjustment algorithm; the dynamic loss target adjustment algorithm includes: combining the feedback results of the test data in each round of the target model with the RelaxLoss technique to ensure the method has a wide range of applicability; using knowledge distillation technology to ensure the model can fit normally; dynamically optimizing the learning path of the student model through the performance of the training data to improve the model's resistance to attacks; and achieving member inference defense through continuous iterative optimization of the loss target; the determination result includes: being unable to determine whether the data belongs to the training dataset or the test dataset, thereby solving the technical problem that traditional regularization methods focus on the utility of the model and cannot effectively solve the privacy and security problem of the model, as well as the technical problem that regularization methods for member inference attacks cannot be popularized and promoted due to the limitation of the loss target.

[0127] Those skilled in the art will clearly understand that, for the sake of convenience and brevity, the specific working processes of the systems, devices, and units described above can be referred to the corresponding processes in the foregoing method embodiments, and will not be repeated here.

[0128] The terms “first,” “second,” “third,” “fourth,” etc. (if present) in the specification and accompanying drawings of this application are used to distinguish similar objects and are not necessarily used to describe a specific order or sequence. It should be understood that such data can be interchanged where appropriate so that the embodiments of this application described herein can be implemented, for example, in orders other than those illustrated or described herein. Furthermore, the terms “comprising” and “having,” and any variations thereof, are intended to cover a non-exclusive inclusion; for example, a process, method, system, product, or apparatus that comprises a series of steps or units is not necessarily limited to those steps or units explicitly listed, but may include other steps or units not explicitly listed or inherent to such processes, methods, products, or apparatus.

[0129] It should be understood that in this application, "at least one (item)" means one or more, and "more than" means two or more. "And / or" is used to describe the relationship between related objects, indicating that three relationships can exist. For example, "A and / or B" can represent three cases: only A exists, only B exists, and both A and B exist simultaneously, where A and B can be singular or plural. The character " / " generally indicates that the preceding and following related objects are in an "or" relationship. "At least one (item) of the following" or similar expressions refer to any combination of these items, including any combination of single or plural items. For example, at least one (item) of a, b, or c can represent: a, b, c, "a and b", "a and c", "b and c", or "a and b and c", where a, b, and c can be single or multiple.

[0130] In the several embodiments provided in this application, it should be understood that the disclosed systems, apparatuses, and methods can be implemented in other ways. For example, the apparatus embodiments described above are merely illustrative; for instance, the division of units is only a logical functional division, and in actual implementation, there may be other division methods. For example, multiple units or components may be combined or integrated into another system, or some features may be ignored or not executed. Furthermore, the coupling or direct coupling or communication connection shown or discussed may be an indirect coupling or communication connection between apparatuses or units through some interfaces, and may be electrical, mechanical, or other forms.

[0131] The units described as separate components may or may not be physically separate. The components shown as units may or may not be physical units; that is, they may be located in one place or distributed across multiple network units. Some or all of the units can be selected to achieve the purpose of this embodiment according to actual needs.

[0132] Furthermore, the functional units in the various embodiments of this application can be integrated into one processing unit, or each unit can exist physically separately, or two or more units can be integrated into one unit. The integrated unit can be implemented in hardware or as a software functional unit.

[0133] If the integrated unit is implemented as a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of this application, in essence, or the part that contributes to the prior art, or all or part of the technical solution, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute all or part of the steps of the methods described in the various embodiments of this application. The aforementioned storage medium includes: USB flash drives, portable hard drives, read-only memory (ROM), random access memory (RAM), magnetic disks, optical disks, and other media capable of storing program code.

[0134] The above-described embodiments are only used to illustrate the technical solutions of this application, and are not intended to limit them. Although this application has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that modifications can still be made to the technical solutions described in the foregoing embodiments, or equivalent substitutions can be made to some of the technical features. Such modifications or substitutions do not cause the essence of the corresponding technical solutions to deviate from the spirit and scope of the technical solutions of the embodiments of this application.

Claims

1. A method for defending against member reasoning attacks, characterized in that, include: S1. Initialize parameters, where temperature T = 1, preset loss target value α = 1, β = 0.5; S2, Based on Private Dataset Training teacher model f t (θ), where x represents the feature vector of the training sample, y represents the sample label, and θ represents the parameters of the target model; S3. Train the student model f based on the aforementioned private dataset. s (θ), and based on the propagation of the preceding term y`=f s (θ,x) calculates the model's cross-entropy loss L and training accuracy in each epoch during training. Where N represents the training data in one round, N t This indicates the number of correct predictions made by the model in one round of training; S4. At the end of each round, the test dataset D will be... test Put into the student model f s The test is performed in (θ), and the test dataset D is calculated for each round. test The average loss value, Where, x t y represents the features of the test dataset. t This indicates the labels corresponding to the test dataset. It is a loss function; S5. In the next round of model training, the model's cross-entropy loss value will be... Compare with the preset loss target α; S6, when the cross-entropy loss value When the loss target value α is greater than the preset target value, the gradient descent of the model is applied. S7, when the cross-entropy loss value When the value is less than the preset loss target value α, the accuracy and loss function of each training round are calculated based on knowledge distillation technology; S8. Update the parameters based on the accuracy and the average loss value.

2. The method for defending against member reasoning attacks according to claim 1, characterized in that, Step S7 specifically includes: When the cross-entropy loss value When the temperature is less than the preset loss target value α, the current training epoch is subtracted from the temperature T to obtain the current temperature T. c ; Compare the training sample x with the existing temperature T c As the teacher model f t The input (θ) yields the teacher model label y. t The output of the teacher model is calculated using the softmax function, specifically: in Using logits as input to softmax, q i The probability of output for each category corresponds to T, where T represents temperature; Calculate the cross-entropy using the sample label y and the preceding propagation y'. Using the sample label y and the teacher model label y t Calculate KL divergence Calculate the loss function 3. The method for defending against member reasoning attacks according to claim 2, characterized in that, Step S8 specifically includes: The parameters are updated based on the accuracy and the average loss value, where temperature T = T + 1, and a preset loss target value. βtrain acc .

4. A member reasoning attack defense device, characterized in that, include: An initialization unit is used to initialize parameters, where temperature T = 1, preset loss target values ​​α = 1, and β = 0.5; The first training unit is used based on a private dataset. Training teacher model f t (θ), where x represents the feature vector of the training sample, y represents the sample label, and θ represents the parameters of the target model; The second training unit trains the student model f based on the aforementioned private dataset. s (θ), and based on the propagation of the preceding term y`=f s (θ,x) is used to calculate the cross-entropy loss of the model in each epoch during training. And training accuracy Where N represents the training data in one round, N t This indicates the number of correct predictions made by the model in one round of training; The test unit is used to process the test dataset D at the end of each round. test Put into the student model f s The test is performed in (θ), and the test dataset D is calculated for each round. test The average loss value, Where, x t y represents the features of the test dataset. t This indicates the labels corresponding to the test dataset. It is a loss function; The comparison unit is used to compare the model's cross-entropy loss value during the next round of model training. Compare with the preset loss target α; The first processing unit is configured to, when the cross-entropy loss value When the loss target value α is greater than the preset target value, the gradient descent of the model is applied. The second processing unit is used to process the cross-entropy loss value. When the value is less than the preset loss target value α, the accuracy and loss function of each training round are calculated based on knowledge distillation technology; A parameter update unit is used to update the parameters based on the accuracy and the average loss value.

5. The member reasoning attack defense device according to claim 4, characterized in that, The second processing unit is specifically used for: When the cross-entropy loss value When the temperature is less than the preset loss target value α, the current training epoch is subtracted from the temperature T to obtain the current temperature T. c ; Compare the training sample x with the existing temperature T c As the teacher model f t The input (θ) yields the teacher model label y. t The output of the teacher model is calculated using the softmax function, specifically: in Using logits as input to softmax, q i The probability of output for each category corresponds to T, where T represents temperature; Calculate the cross-entropy using the sample label y and the preceding propagation y'. Using the sample label y and the teacher model label y t Calculate KL divergence Calculate the loss function 6. The member reasoning attack defense device according to claim 5, characterized in that, The parameter update unit is specifically used for: The parameters are updated based on the accuracy and the average loss value, where temperature T = T + 1, and a preset loss target value. β = train acc .

7. A member reasoning attack defense device, characterized in that, The device includes a processor and a memory: The memory is used to store program code and transmit the program code to the processor; The processor is used to execute the member reasoning attack defense method according to any one of claims 1-3 according to the instructions in the program code.

8. A computer-readable storage medium, characterized in that, The computer-readable storage medium is used to store program code for executing the member reasoning attack defense method according to any one of claims 1-3.

Images