A fingerprint robustness evaluation method for deep neural network models

Abstract

The present invention discloses a method for evaluating the robustness of a deep neural network model fingerprint, comprising: simulating an attacker to obtain a target model F v and an alternative dataset D for fine-tuning sub ; Based on the min-max double-layer optimization algorithm, the target model F is reversed v The first l layers and logistic layers of the model are respectively perturbed by adding behavioral patterns to obtain the output z1 of the first l layers after inversion and the output z2 of the logistic layer, and the model is optimized based on the output z1 of the first l layers after inversion and the output z2 of the logistic layer to obtain the replacement model F s ; According to the target model and the alternative model, the cost of deep neural network fingerprint removal is quantitatively and qualitatively evaluated, and a deep neural network fingerprint robustness score is output.

Description

Technical Field

[0001] The present invention belongs to the field of neural network security technology, and in particular to a method for evaluating the robustness of fingerprints of a deep neural network model. Background Art

[0002] As a widely used artificial intelligence technology, deep neural networks have achieved remarkable results in fields such as image recognition and natural language processing. Since deep neural networks usually rely on a large amount of data and computing resources for training, and involve protected sensitive data sets (such as medical images, biological data, and facial images), copyright protection of deep learning models is particularly important. However, with the increasing development of copyright attack technology, the copyright protection issues of deep neural networks have gradually become prominent, and it has become crucial to evaluate the robustness of copyright protection algorithms of deep neural networks. To evaluate the robustness of copyright protection algorithms of deep neural networks, it is necessary to pay attention to their ability to maintain normal performance and recognition accuracy when subjected to malicious attacks and disturbances. To meet this challenge, researchers need to seek effective methods and technologies to improve the robustness of deep neural networks in the field of copyright protection and ensure their stable operation in various complex environments.

[0003] In recent years, a large number of patents (such as CN115222990A, CN113987425A, CN115759247A, CN114880642A) have proposed various deep neural network model fingerprint verification technologies, aiming to protect the intellectual property rights of deep neural network models. Under the premise of specifying the target model and the suspect model, the main goal of the model fingerprint verification technology is to determine whether the suspect model is derived from the target model. Model fingerprint verification is a passive copyright verification technology that does not require modification of the target model itself. It extracts a series of probe samples (also known as fingerprint samples) from the target model to identify the inherent characteristics of the model. In the verification stage, the verifier uses the extracted probe samples to track the behavior pattern of the model. However, the existing model fingerprint verification technology has deficiencies in robustness, which makes the design and implementation of algorithms for evaluating the robustness of model fingerprint verification technology an important research topic. At present, there is still a gap in research on this field, which requires further exploration and research. In order to evaluate the robustness of the model fingerprint verification technology, the evaluation algorithm needs to simulate the fingerprint removal attack process and analyze the cost of removing the model fingerprint. In the process of implementing the present invention, the inventors found that there are the following challenges in evaluating the robustness of deep neural network model fingerprint verification technology:

[0004] (1) Model fingerprints are inherent features of deep neural networks and are deeply embedded in neurons. However, complex neural networks contain billions of interacting neurons, making it difficult to evaluate and assess the cost of removing fingerprints.

[0005] (2) In order to calculate the cost of clearing model fingerprints, it is necessary to clear model fingerprints while ensuring model accuracy. However, clearing model fingerprints will inevitably lead to a decrease in model accuracy. There are technical challenges in simulating model fingerprint clearing attacks and retaining model accuracy. Summary of the invention

[0006] In view of the problems existing in the prior art, the purpose of the embodiments of the present application is to provide a method for evaluating the robustness of deep neural network model fingerprints. The method aims to retain the general semantic information of the model while evaluating the cost of clearing the model fingerprint information and bypassing the copyright protection technology of the deep neural network model. By simulating the process of an attacker clearing fingerprints, we can effectively evaluate the robustness of the deep neural network model fingerprint verification technology.

[0007] According to a first aspect of an embodiment of the present application, a method for evaluating the robustness of a deep neural network model fingerprint is provided, comprising:

[0008] (1) Simulate an attacker to obtain the target model F v and an alternative dataset D for fine-tuning sub ;

[0009] (2) Based on the min-max two-level optimization algorithm, the target model F is reversed v The first l layers and logistic layers of the model are respectively perturbed by adding behavioral patterns to obtain the output z1 of the first l layers after inversion and the output z2 of the logistic layer, and the model is optimized based on the output z1 of the first l layers after inversion and the output z2 of the logistic layer to obtain the replacement model F s ;

[0010] (3) Based on the target model and the alternative model, the cost of deep neural network fingerprint removal is quantitatively and qualitatively evaluated, and a deep neural network fingerprint robustness score is output.

[0011] Furthermore, in step (2), the stochastic gradient descent algorithm is used to update the output z1 of the first l layers after the reverse process multiple times, so that the output z1 of the first l layers after the reverse process is The update of z1 is as follows:

[0012]

[0013] In the formula, represents the loss function and η represents the learning rate.

[0014] Furthermore, the loss function Indicates F v The predicted label of Indicates F vThe layer output of the previous layer l, Indicates the output of the next layer l, represents the cross entropy loss function.

[0015] Furthermore, in step (2), the stochastic gradient descent algorithm is used to update the output z1 of the first l layers after the reverse process multiple times, so that the output z1 of the first l layers after the reverse process is

[0016] Furthermore, in step (2), the model is tuned based on the output z1 of the first l layers after the reverse operation and the output z2 of the logistic layer to obtain the replacement model F s , the optimization objective function is:

[0017]

[0018]

[0019] In the formula, z * The updated {z1,z2}, w represents the parameters of the alternative model, Represents the output of the next lth layer of the target model, Represents the output of the last lth layer of the substitution model.

[0020] Furthermore, in step (3), the l2 distance is used to evaluate the model parameter difference between the target model and the alternative model, thereby achieving quantitative evaluation. The l2 distance is expressed as:

[0021] s1=||w1-w2||

[0022] Among them, w1 is the target model parameter and w2 is the alternative model parameter.

[0023] Furthermore, in step (3), the qualitative evaluation is specifically as follows:

[0024] Simulate several deep neural network fingerprint detection systems, input the target model, alternative model and fingerprint data set into each system for detection, and obtain the corresponding prediction results; use the majority voting algorithm to evaluate the robustness of deep neural network fingerprints:

[0025]

[0026] Among them, F i represents the i-th system, N represents the total number of systems, w1 represents the target model parameter, w2 represents the alternative model parameter, and D fp The fingerprint dataset.

[0027] According to a second aspect of an embodiment of the present application, a deep neural network model fingerprint robustness evaluation device is provided, comprising:

[0028] Acquisition module, used to simulate the attacker to obtain the target model F v and an alternative dataset D for fine-tuning sub ;

[0029] The two-layer optimization module is used for the two-layer optimization algorithm based on min-max to reverse the target model F v The first l layers and logistic layers of the model are respectively perturbed by adding behavioral patterns to obtain the output z1 of the first l layers after inversion and the output z2 of the logistic layer, and the model is optimized based on the output z1 of the first l layers after inversion and the output z2 of the logistic layer to obtain the replacement model F s ;

[0030] An evaluation module is used to quantitatively and qualitatively evaluate the cost of deep neural network fingerprint removal based on the target model and the alternative model, and output a deep neural network fingerprint robustness score.

[0031] According to a third aspect of an embodiment of the present application, there is provided an electronic device, including:

[0032] one or more processors;

[0033] A memory for storing one or more programs;

[0034] When the one or more programs are executed by the one or more processors, the one or more processors implement the method as described in the first aspect.

[0035] According to a fourth aspect of an embodiment of the present application, a computer-readable storage medium is provided, on which computer instructions are stored, and when the instructions are executed by a processor, the steps of the method described in the first aspect are implemented.

[0036] The technical solution provided by the embodiments of the present application may have the following beneficial effects:

[0037] It can be seen from the above embodiments that the main purpose of this application is to evaluate the robustness of the deep neural network model copyright verification system. This application realizes the research on the deep neural network model fingerprint clearing attack method by simulating the model fingerprint clearing attack and evaluating the cost of the attack. Specifically, this application proposes a deep neural network model fingerprint clearing attack method based on double-layer optimization. This method simulates the behavior of the model copyright attacker and can efficiently clear the fingerprint of the target model without compromising its accuracy. A large number of experimental results show that the existing deep neural network model fingerprint verification method has deficiencies in robustness, and the robustness of the algorithm needs to be improved urgently.

[0038] It should be understood that the foregoing general description and the following detailed description are exemplary and explanatory only and are not restrictive of the present application. BRIEF DESCRIPTION OF THE DRAWINGS

[0039] The accompanying drawings, which are incorporated in and constitute a part of this specification, illustrate embodiments consistent with the present application and, together with the description, serve to explain the principles of the present application.

[0040] Figure 1 A flowchart of a method for clearing fingerprint attacks on a deep neural network model is shown according to an exemplary embodiment.

[0041] Figure 2 An explanatory diagram of fingerprint removal of a deep neural network model at an intermediate layer according to an exemplary embodiment.

[0042] Figure 3 The present invention is a block diagram of a deep neural network model fingerprint clearing attack device according to an exemplary embodiment.

[0043] Figure 4 is a schematic diagram of an electronic device according to an exemplary embodiment. DETAILED DESCRIPTION

[0044] Here, exemplary embodiments will be described in detail, and examples thereof are shown in the accompanying drawings. When the following description refers to the drawings, unless otherwise indicated, the same numbers in different drawings represent the same or similar elements. The implementations described in the following exemplary embodiments do not represent all implementations consistent with the present application.

[0045] The terms used in this application are for the purpose of describing specific embodiments only and are not intended to limit this application. The singular forms of "a", "said" and "the" used in this application and the appended claims are also intended to include plural forms unless the context clearly indicates other meanings. It should also be understood that the term "and / or" used herein refers to and includes any or all possible combinations of one or more associated listed items.

[0046] It should be understood that although the terms first, second, third, etc. may be used in the present application to describe various information, these information should not be limited to these terms. These terms are only used to distinguish the same type of information from each other. For example, without departing from the scope of the present application, the first information may also be referred to as the second information, and similarly, the second information may also be referred to as the first information. Depending on the context, the word "if" as used herein may be interpreted as "at the time of" or "when" or "in response to determining".

[0047] like Figure 1As shown, the present invention proposes a deep neural network model fingerprint robustness evaluation method, which divides the deep neural network into a feature extractor and a classifier, wherein:

[0048] The role of the feature extractor is to extract useful features from raw data and convert the raw data into feature vectors with semantic meaning so that machine learning algorithms (such as classifiers) can better understand and process the data. The role of the classifier is to map the extracted features to corresponding categories to complete the classification task.

[0049] like Figure 1 As shown, a deep neural network model fingerprint robustness evaluation method proposed in this application includes the following steps:

[0050] (1) Simulate an attacker to obtain the target model F v and an alternative dataset D for fine-tuning sub ;

[0051] Specifically, in the simulation system, it is assumed that the attacker uses the model stealing method (such as CN114547102A, CN115859102A) to obtain the target model F v ; Use a public public dataset as alternative data to fine-tune the model parameters. The dataset is required to contain multiple classification labels and have a similar distribution to the attacker's training set.

[0052] (2) Based on the min-max two-level optimization algorithm, the target model F is reversed v The first l layers and logistic layers of the model are respectively perturbed by adding behavioral patterns to obtain the output z1 of the first l layers after inversion and the output z2 of the logistic layer, and the model is optimized based on the output z1 of the first l layers after inversion and the output z2 of the logistic layer to obtain the replacement model F s , so as to evaluate the robustness of the target model fingerprint;

[0053] (2.1) Propose a latent layer inverse algorithm to reverse the target model F v Add the behavioral pattern perturbation δ1 to the first l layers (latent layers) of , and get the output z1 of the first l layers after inversion;

[0054] Specifically, the stochastic gradient descent algorithm is used to update the first l layers after the reverse process multiple times to obtain the output of the first l layers after the reverse process.

[0055] Among them, the loss function is:

[0056]

[0057] In the formula, Indicates F v The predicted label of Indicates F v The layer output of the previous layer l, represents the output of the next layer l (in this application, the decision boundary layer, i.e., the second to last layer, is mainly considered), Represents the cross entropy loss function. Through the stochastic gradient descent algorithm, the reverse layer output z1 is updated multiple times:

[0058]

[0059] In the formula, represents the loss function and η represents the learning rate.

[0060] The basic principle of the above-mentioned latent inverse algorithm is as follows: first, by using the cross entropy loss function to constrain the latent semantic information after inversion (the first term of the loss function), and secondly, by using the l2 distance to increase the latent distance after inversion (the second term of the loss function). In this way, while constraining the similarity of the semantic information of the latent output after inversion, the difference in its behavior pattern is enhanced, thereby obtaining the perturbed latent output, that is, the layer output after removing the model fingerprint. Specifically, the latent inverse algorithm is used to inverse the output z1 of the first l layers that are differentiated from the behavior pattern of the target model. The output z1 of this layer has a large behavioral pattern distance from the output of the first l layers of the target model, but the logical meaning expressed is similar. The so-called "similarity" here refers to the same classification category of the output, and the "behavioral pattern distance" refers to the l2 distance between vectors. Such as Figure 2 As shown, the latent layer reverse algorithm aims to use the stochastic gradient descent algorithm to guide the deep neural network to activate another optimal path, resulting in a differentiated enhancement of its behavior pattern.

[0061] (2.2) Propose an iterative decision boundary differentiation algorithm to reverse the target model F v The logistic layer (the second to last layer) adds the behavior pattern perturbation δ2 to obtain the output z2 of the reversed logistic layer;

[0062] Specifically, the stochastic gradient descent algorithm is used to iterate the reverse logistic layer multiple times to obtain the output of the logistic layer

[0063] The optimization function is:

[0064]

[0065]

[0066] In the formula, Indicates Fv The predicted label, F v (x) represents F v The logistic layer output.

[0067] The basic principle of the above iterative decision boundary differentiation algorithm is as follows: first, the cross entropy loss function is used to constrain the semantic information of the decision boundary layer (i.e., the logistic layer) after the inversion, which can be achieved through the loss function constraint term; second, the distance between the decision boundary layers after the inversion is increased by using the l2 distance, which can be achieved through the loss function. The purpose of these two optimization strategies is to enhance the behavioral pattern difference of the output of the decision boundary layer and increase its semantic similarity. Specifically, the iterative decision boundary differentiation algorithm is used to reverse the logistic layer output z2 that is differentiated from the decision boundary of the target model. The logistic layer output z2 represents the decision boundary of the model. This method reverses the behavior-differentiated and semantically similar logitsts layer output z2 through an iterative optimization algorithm.

[0068] (2.3) Based on the output z1 of the first l layers after the reverse operation and the output z2 of the logistic layer, the model is optimized to obtain the replacement model F s ;

[0069] Use the reversed perturbation layer output z1 obtained in step (2.1) to tune the alternative model F s , so that it can learn the perturbed layer output z1, and its optimization goal is:

[0070]

[0071] In the formula, represents the mean square error loss function, w represents the alternative model F s Parameters.

[0072] Use the reversed perturbation layer output z2 obtained in step (2.2) to fine-tune the alternative model so that it learns the perturbation layer output, and its optimization goal is:

[0073]

[0074] In the formula, represents the cross entropy loss function, and w represents the optimized alternative model F s Parameters.

[0075] The above steps (2.1) and (2.2) reverse the first l layers and logistic layers of different behavior patterns, and let the surrogate model learn these new behavior patterns (i.e., z1 and z2) in the upper layer optimization; in step (2.3), the surrogate model F is fine-tuned by the reverse layer outputs z1 and z2 s, so that the alternative model outputs the same prediction label, but exhibits latent layers and decision boundary layers that are different from the target model.

[0076] In summary, the above steps are based on the min-max two-layer optimization algorithm, in which the lower optimizer removes the fingerprint information of the deep neural network model by learning the model output with different behavior patterns and similar expression semantics from the target model, and the upper optimizer fine-tunes the model parameters to maintain the general semantic information of the deep neural network model. Specifically, the latent layer and logistic layer of step (2.1) and step (3.1) can be expressed as:

[0077]

[0078] In the formula, Respectively represent the output of the first l layers and the last l layers of the target model, z1 and z2 represent the output of the first l layers and the last l layers of the adversarial model, and δ1 and δ2 represent the behavioral pattern perturbations of these two layers. In the implementation process, the lower layer optimization target is first calculated to obtain {z1, z2}, and then the upper layer optimization target is calculated to obtain the fine-tuned alternative model. Furthermore, the two-layer optimization objective function based on min-max is:

[0079]

[0080]

[0081] In the formula, z * represents the output of the model latent layer and decision boundary layer, that is, the optimized {z1,z2}, and w represents the parameters of the alternative model. * , its behavior pattern perturbations δ1 and δ2 will not affect the semantic output results of the model.

[0082] Specifically, the basic principle of the above-mentioned two-layer optimization algorithm is as follows: the core idea of ​​model fingerprint verification is to analyze the differences in the layer behavior patterns of the target model and the suspect model, where the layers include the latent layer and the decision boundary layer. Therefore, the model fingerprint verification system can be interfered with by reversing the outputs of the latent layer and the decision boundary layer and adding layer output disturbances thereto. At the same time, in order to ensure the accuracy of the model, the layer output disturbance needs to ensure that the semantic information of the model is not destroyed. Based on the above discussion, the model fingerprint removal algorithm based on the two-layer optimization algorithm proposed in the present invention increases the difference in behavior patterns in the lower layer optimization and increases the similarity of semantic information in the upper layer optimization. In this way, we can effectively interfere with the model fingerprint verification system while ensuring the accuracy of the model, and evaluate the robustness of the model fingerprint verification system based on the cost of interference.

[0083] (3) quantitatively and qualitatively evaluating the cost of deep neural network fingerprint removal based on the target model and the alternative model, and outputting a deep neural network fingerprint robustness score;

[0084] Specifically, quantitative refers to the numerical value of the modification of the deep neural network model parameters. This application proposes to use the l2 distance to evaluate the model parameter difference between the target model and the alternative model. The l2 distance is expressed as:

[0085] s1=||w1-w2||,

[0086] Among them, w1 is the target model parameter, and w2 is the alternative model parameter (i.e., w in the above step 2).

[0087] Specifically, qualitative refers to whether the model after the fingerprint is clear can deceive the existing deep neural network model fingerprint detection system (such as CN115222990A, CN113987425A, CN115759247A, CN114880642A). The present invention simulates multiple deep neural network fingerprint detection systems, and inputs the target model, the alternative model and the fingerprint data set (i.e., the test set segmented from the data set of the training target model) into the simulation system for detection, and obtains the prediction result of its detection (i.e., 0 / 1 judgment result, 0 means the fingerprint is irrelevant, 1 means the fingerprint is relevant). Finally, the application proposes to use the majority voting algorithm to evaluate the robustness of deep neural network fingerprints, which is defined as:

[0088]

[0089] Among them, F i represents the i-th simulation system, and N represents the total number of simulation systems.

[0090] The final step (3) outputs the quantitative index s1 and the qualitative index s2 to evaluate the robustness of the deep neural network fingerprint. The larger the value, the stronger the robustness.

[0091] Specifically, the basic principles of the above steps are two-fold: First, the more model parameter modifications of the alternative model, the more computational cost, time and optimization complexity of simulating the attacker's attack. In summary, the larger s1 is, the better the robustness of the deep neural network fingerprint. Secondly, by simulating model fingerprint clearing attacks to evaluate whether the attack algorithm can deceive the existing deep neural network model fingerprint detection system, the robustness of the deep neural network model fingerprint clearing method is measured. In other words, the larger s2 is, the better the robustness of the deep neural network fingerprint.

[0092] Corresponding to the aforementioned embodiment of the deep neural network model fingerprint clearing attack method, the present application also provides an embodiment of the deep neural network model fingerprint clearing attack device.

[0093] Figure 3 1 is a block diagram of a deep neural network model fingerprint removal attack device according to an exemplary embodiment. Figure 3 , the device may include:

[0094] Acquisition module 21, used to simulate an attacker to acquire the target model F v and an alternative dataset D for fine-tuning sub ;

[0095] The double-layer optimization module 22 is used for the double-layer optimization algorithm based on min-max to reverse the target model F v The first l layers and logistic layers of the model are respectively perturbed by adding behavioral patterns to obtain the output z1 of the first l layers after inversion and the output z2 of the logistic layer, and the model is optimized based on the output z1 of the first l layers after inversion and the output z2 of the logistic layer to obtain the replacement model F s ;

[0096] The evaluation module 23 is used to quantitatively and qualitatively evaluate the cost of deep neural network fingerprint removal based on the target model and the alternative model, and output a deep neural network fingerprint robustness score.

[0097] Regarding the device in the above embodiment, the specific manner in which each module performs operations has been described in detail in the embodiment of the method, and will not be elaborated here.

[0098] For the device embodiment, since it basically corresponds to the method embodiment, the relevant parts can refer to the partial description of the method embodiment. The device embodiment described above is only schematic, wherein the units described as separate components may or may not be physically separated, and the components displayed as units may or may not be physical units, that is, they may be located in one place, or they may be distributed on multiple network units. Some or all of the modules may be selected according to actual needs to achieve the purpose of the present application scheme. A person of ordinary skill in the art can understand and implement it without paying any creative work.

[0099] Accordingly, the present application also provides an electronic device, comprising: one or more processors; a memory for storing one or more programs; when the one or more programs are executed by the one or more processors, the one or more processors implement the above-mentioned deep neural network model fingerprint removal attack method. Figure 4As shown, a hardware structure diagram of any device with data processing capability in which a deep neural network model fingerprint removal attack method provided by an embodiment of the present invention is located, except Figure 4 In addition to the processor, memory and network interface shown, any device with data processing capability in which the apparatus in the embodiment is located may also include other hardware, generally based on the actual functions of the device with data processing capability, which will not be described in detail.

[0100] Accordingly, the present application also provides a computer-readable storage medium on which computer instructions are stored, and when the instructions are executed by the processor, the deep neural network model fingerprint removal attack method as described above is implemented. The computer-readable storage medium can be an internal storage unit of any device with data processing capabilities described in any of the aforementioned embodiments, such as a hard disk or a memory. The computer-readable storage medium can also be an external storage device, such as a plug-in hard disk, a smart memory card (Smart Media Card, SMC), an SD card, a flash card (Flash Card), etc. equipped on the device. Furthermore, the computer-readable storage medium can also include both an internal storage unit of any device with data processing capabilities and an external storage device. The computer-readable storage medium is used to store the computer program and other programs and data required by any device with data processing capabilities, and can also be used to temporarily store data that has been output or is to be output.

[0101] Those skilled in the art will readily appreciate other embodiments of the present application after considering the specification and practicing the contents disclosed herein. The present application is intended to cover any variations, uses or adaptations of the present application, which follow the general principles of the present application and include common knowledge or customary technical means in the art that are not disclosed in the present application.

[0102] It should be understood that the present application is not limited to the exact construction that has been described above and shown in the drawings, and that various modifications and changes may be made without departing from the scope thereof.

Claims

1. A method for evaluating the robustness of fingerprints of a deep neural network model, characterized in that: include: (1) Simulate an attacker to obtain the target model F v and an alternative dataset D for fine-tuning sub ; (2) Based on the min-max two-level optimization algorithm, the target model F is reversed v The first l layers and logistic layers of the model are respectively perturbed by adding behavioral patterns to obtain the output z1 of the first l layers after inversion and the output z2 of the logistic layer, and the model is optimized based on the output z1 of the first l layers after inversion and the output z2 of the logistic layer to obtain the replacement model F s ; (3) quantitatively and qualitatively evaluating the cost of deep neural network fingerprint removal based on the target model and the alternative model, and outputting a deep neural network fingerprint robustness score; Wherein step (2) comprises: (2.1) Propose a latent layer inverse algorithm to reverse the target model F v The first l layers of the model are perturbed by the behavior pattern δ1, and the output z1 of the first l layers after the reverse operation is obtained; among them, the loss function Indicates F v The predicted label of Indicates F v The layer output of the previous layer l, Indicates the output of the next layer l, represents the cross entropy loss function; (2.2) Propose an iterative decision boundary differentiation algorithm to reverse the target model F v The logistic layer of , adds the behavior pattern perturbation δ2, and obtains the output z2 of the reversed logistic layer; where the optimization function is: In the formula, Indicates F v The predicted label, F v (x) represents F v The logistic layer output; (2.3) Based on the output z1 of the first l layers after the reverse operation and the output z2 of the logistic layer, the model is optimized to obtain the replacement model F s ; The latent layer and logistic layer are represented as The min-max based two-level optimization objective function is: In the formula, z * represents the output of the model latent layer and decision boundary layer, that is, the optimized {z1,z2}, and w represents the parameters of the alternative model; In step (3), the l2 distance is used to evaluate the model parameter difference between the target model and the alternative model, thereby achieving quantitative evaluation. The l2 distance is expressed as: s1=||w1-w2|| Among them, w1 is the target model parameter, w2 is the alternative model parameter; In step (3), the qualitative assessment is as follows: Simulate several deep neural network fingerprint detection systems, input the target model, alternative model and fingerprint data set into each system for detection, and obtain the corresponding prediction results; use the majority voting algorithm to evaluate the robustness of deep neural network fingerprints: Among them, F i represents the i-th system, N represents the total number of systems, w1 represents the target model parameter, w2 represents the alternative model parameter, and D fp The fingerprint dataset.

2. The method according to claim 1, characterized in that In step (2), the stochastic gradient descent algorithm is used to repeatedly update the output z1 of the first l layers after the reverse process, so that the output z1 of the first l layers after the reverse process is The update of z1 is as follows: In the formula, represents the loss function, η represents the learning rate, Indicates F v The output of the previous layer l, δ1 represents the target model F v The behavioral pattern perturbation added by the first l layers.

3. The method according to claim 1, characterized in that In step (2), the stochastic gradient descent algorithm is used to repeatedly update the output z1 of the first l layers after the reverse process, so that the output z1 of the first l layers after the reverse process is δ2 represents the target model F v The logistic layer adds behavioral pattern perturbations.

4. A deep neural network model fingerprint robustness evaluation device, characterized in that: include: Acquisition module, used to simulate the attacker to obtain the target model F v and an alternative dataset D for fine-tuning sub ; The two-layer optimization module is used for the two-layer optimization algorithm based on min-max to reverse the target model F v The first l layers and logistic layers of the model are respectively perturbed by adding behavioral patterns to obtain the output z1 of the first l layers after inversion and the output z2 of the logistic layer, and the model is optimized based on the output z1 of the first l layers after inversion and the output z2 of the logistic layer to obtain the replacement model F s ; An evaluation module, for quantitatively and qualitatively evaluating the cost of deep neural network fingerprint cleaning according to the target model and the alternative model, and outputting a deep neural network fingerprint robustness score; Among them, based on the min-max double-layer optimization algorithm, the target model F is reversed v The first l layers and logistic layers of , add behavioral pattern perturbations respectively, and obtain the output z1 of the first l layers and the output z2 of the logistic layer after reverse, including: (2.1) Propose a latent layer inverse algorithm to reverse the target model F v The first l layers of the model are perturbed by the behavior pattern δ1, and the output z1 of the first l layers after the reverse operation is obtained; among them, the loss function Indicates F v The predicted label of Indicates F v The layer output of the previous layer l, Indicates the output of the next layer l, represents the cross entropy loss function; (2.2) Propose an iterative decision boundary differentiation algorithm to reverse the target model F v The logistic layer of , adds the behavior pattern perturbation δ2, and obtains the output z2 of the reversed logistic layer; where the optimization function is: In the formula, Indicates F v The predicted label, F v (x) represents F v The logistic layer output; (2.3) Based on the output z1 of the first l layers after the reverse operation and the output z2 of the logistic layer, the model is optimized to obtain the replacement model F s ; The latent layer and logistic layer are represented as The min-max based two-level optimization objective function is: In the formula, z * represents the output of the model latent layer and decision boundary layer, that is, the optimized {z1,z2}, and w represents the parameters of the alternative model; In step (3), the l2 distance is used to evaluate the model parameter difference between the target model and the alternative model, thereby achieving quantitative evaluation. The l2 distance is expressed as: s1=||w1-w2|| Among them, w1 is the target model parameter, w2 is the alternative model parameter; In step (3), the qualitative assessment is as follows: Simulate several deep neural network fingerprint detection systems, input the target model, alternative model and fingerprint data set into each system for detection, and obtain the corresponding prediction results; use the majority voting algorithm to evaluate the robustness of deep neural network fingerprints: Among them, F i represents the i-th system, N represents the total number of systems, w1 represents the target model parameter, w2 represents the alternative model parameter, and D fp The fingerprint dataset.

5. An electronic device, characterized in that: include: one or more processors; A memory for storing one or more programs; When the one or more programs are executed by the one or more processors, the one or more processors implement the method according to any one of claims 1 to 3.

6. A computer-readable storage medium having computer instructions stored thereon, characterized in that: When the instruction is executed by a processor, the steps of the method according to any one of claims 1 to 3 are implemented.

Images