A data extraction method for uniform sample generation based on CGAN

Abstract

The present invention discloses a data extraction method based on uniform sample generation using CGAN. The method uses uniform sampling to generate a class label l, then samples a vector z from a Gaussian distribution, combines l and z and inputs them into CGAN. CGAN is used to generate an image x, which is then input into a target model to obtain the output of the target model. Subsequently, a label pair (x, V(x)) is used to train a surrogate model to obtain the output C of the surrogate model. Finally, the difference (V(x), C(x)) and the difference (l, V(x)) between the target model and the surrogate model are compared using a cross-entropy loss function, and the generator CGAN is updated by backpropagation of gradients. After a certain number of CGAN cyclic training rounds, that is, when the loss of (l, V(x)) hardly changes, the surrogate model is trained separately using images generated by CGAN until the optimal surrogate model is achieved. The present invention utilizes a balanced sample generator based on a conditional generative adversarial network (CGAN) to generate a class-balanced forged dataset, thereby reducing class imbalance and improving the efficiency of model extraction.

Description

Technical Field

[0001] The present invention relates to the field of data extraction technology, and in particular to a data extraction method based on CGAN (Clustered Annotated Artificial Intelligence) uniform sample generation. Background Art

[0002] With the rapid development and widespread application of artificial intelligence, Machine Learning as a Service (MLaaS) has become a common model. Even the most complex machine learning models can be provided to customers through a pay-per-query model. This model enables users to avoid the time-consuming process of data collection, hyperparameter tuning, and model training. However, by allowing customers to access their models for prediction, MLaaS providers also face intellectual property risks, such as sensitive training data, optimized hyperparameters, or learned model parameters. Furthermore, the service interfaces provided by MLaaS providers also pose potential risks, such as model theft attacks.

[0003] Currently, the more common data extraction method is the model stealing attack, which requires the use of an alternative dataset for querying. However, for some datasets with small amounts of data and a single type, alternative datasets are not available, so the data extraction method of model stealing attacks has gradually evolved into data-free model extraction. Data-free model extraction does not require an alternative dataset and can generate fake datasets through generative adversarial networks (GANs), thereby greatly reducing the difficulty of data extraction. However, the existing data-free model extraction method generates data randomly, which is prone to class imbalance and cannot ensure the accuracy and efficiency of data extraction. Summary of the Invention

[0004] This paper proposes a data extraction method based on uniform sample generation of CGAN, which uses a balanced sample generator based on conditional generative adversarial network (CGAN) to generate a class-balanced fake dataset to reduce class imbalance and improve the efficiency of model extraction.

[0005] In order to solve the above technical problems, the technical solution of the present invention is:

[0006] A data extraction method for uniform sample generation based on CGAN, the method comprising the following steps:

[0007] Step 1. Use uniform distribution to sample sample pseudo labels l;

[0008] Step 2. Sample the initial vector z using Gaussian distribution;

[0009] Step 3. Combine (z, l) and send it to the CGAN generator G to obtain the generated image. The CGAN generator has an additional specified generated image label compared to the GAN generator.

[0010] Step 4. Send the image generated in step 3 to the target model to obtain the output of the target model;

[0011] Step 5. Feed the image generated in step 3 into the substitution model to obtain the output of the substitution model;

[0012] Step 6. Use cross entropy to calculate the loss of the output of step 4 and step 5, the loss between the sample pseudo label l and the output of step 5, and backpropagate to update the generator G;

[0013] Step 7. Repeat steps 1-6 until the loss between the sample pseudo label l and the output of step 5 no longer changes or the change is less than a threshold θ.

[0014] Step 8. Repeat steps 1-3 and feed the generated image into the substitution model to obtain the output of the substitution model.

[0015] Step 9. Perform cross entropy loss on the output of the substitution model and the sample pseudo label l, and update the weight of the substitution model in reverse.

[0016] Step 10. Repeat steps 8-9 until the accuracy of the surrogate model is stable.

[0017] In the above technical solution, uniform sampling is first used to generate the class label l. Then, a vector z is sampled from a Gaussian distribution. The combination of l and z is input into the CGAN. The CGAN is used to generate the image x. Then, x is input into the target model to obtain the output of the target model. The label pair (x, V(x)) is then used to train the surrogate model to obtain the output C of the surrogate model. Finally, the cross-entropy loss function is used to compare the difference (V(x), C(x)) between the target model and the surrogate model, as well as the difference (l, V(x)). The gradient is back-propagated to update the generator CGAN. After a certain number of CGAN training cycles, that is, when the loss of (l, V(x)) is almost unchanged, the CGAN is used to generate images and train the surrogate model separately until the optimal surrogate model is achieved.

[0018] The present invention has the following characteristics and beneficial effects:

[0019] When using data generated by traditional GAN ​​to train a replacement model, it is easy to encounter the mode collapse problem, that is, the GAN falls into a mode of generating only one category of images. In this mode, although the images generated by GAN are of the correct category, because it only generates images of one category, it cannot allow the replacement model to learn the classification probability of the target model for other categories, which will result in low accuracy of the final trained replacement model. The above technical solution uses the CGAN generator, which can generate uniform samples compared to traditional GAN. That is, CGAN generates images with specified pseudo labels based on the input noise belonging to the Gaussian distribution under the guidance of the sample pseudo labels. Because the sample pseudo labels are uniformly distributed and can cover all required categories, CGAN will not fall into the mode collapse problem like GAN, avoiding the problem of imbalanced generated sample categories.

[0020] Compared with traditional GAN, CGAN can generate uniform samples and can learn the sample space characteristics of all categories very well, so it can improve the accuracy of training substitution models. BRIEF DESCRIPTION OF THE DRAWINGS

[0021] In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the following briefly introduces the drawings required for use in the embodiments or the description of the prior art. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying any creative work.

[0022] Figure 1 This is a system architecture diagram of a data extraction method for uniform sample generation based on CGAN in an embodiment of the present invention. DETAILED DESCRIPTION

[0023] It should be noted that, in the absence of conflict, the embodiments of the present invention and the features in the embodiments may be combined with each other.

[0024] The present invention provides a data extraction method based on uniform sample generation of CGAN, such as Figure 1 As shown, this embodiment is evaluated on public image datasets (Cifar-10 and Cifar-100) and selects an appropriate model as its initialization model. Taking the Cifar-10 dataset as an example, a pre-trained ResNet34 network is used as the target model, and a pre-trained ResNet18 network is used as the alternative model. To better illustrate the advantages of the present invention, the following is a further detailed description of the implementation of the method of the present invention with reference to the accompanying drawings and examples.

[0025] The specific process is:

[0026] Step 0: Initialize the initial parameters of the CGAN generator G and the surrogate model C.

[0027] Step 1: Sample pseudo labels l from the uniform distribution U(0,n-1), where n is the number of sample categories and the label form is an integer from 0 to n-1.

[0028] Step 1.1: Collect batch_size number of sample pseudo labels l from the uniform distribution.

[0029] Step 2, sample the initial noise z from Gaussian distribution, assuming the dimension of z is (1,100);

[0030] Step 2.1: Collect batch_size noise z from Gaussian distribution.

[0031] Step 3: Concatenate z and l. The specific steps are: let z = (x1, x2, ..., x 100 ), use one-hot encoding sample pseudo label l, assuming l = (9), n = 10, then l = (0, 0, 0, 0, 0, 0, 0, 1), splicing z and l is z' = (x1, x2, ..., x 100 ,0,0,0,0,0,0,0,0,0,1). Send z' into the generator G to obtain the output output image x=G(z').

[0032] Step 4. Feed the image generated in step 3 into the target model V (ResNet34) to obtain the output V(x) of the target model;

[0033] Step 5. Feed the image generated in step 3 into the replacement model C (ResNet18) to obtain the output C(x) of the replacement model;

[0034] Step 6. Calculate the loss of the output of step 4 and step 5 using cross entropy The loss between the sample pseudo label l and the output of step 5 Update the parameters of the generator and the replacement model through the following formula where θ G are the parameters of the generator model, μ is the learning rate, L CE is the loss between step 4 and step 5, L IV is the loss between the sample pseudo label and step 5 It's L IC θ C Find the partial derivative, It's L CE θ G Find partial derivatives;

[0035] Step 7. Repeat steps 1-6 until the loss of step 5 and step 4 does not change or the change is less than the threshold θ, that is

[0036] Step 8. Repeat steps 1-3 and feed the generated image into the substitution model to obtain the output of the substitution model.

[0037] Step 9. Compare the output of the surrogate model with l and perform cross entropy loss Backward update of the weights of the surrogate model where θ C is the parameter of the surrogate model, ∈ is the learning rate of the surrogate model, L IC is the cross entropy loss between the output of the replacement model and the sample pseudo label l, It's L IC θ C Find the partial derivative;.

[0038] Step 10. Repeat steps 8-9 until the accuracy of the surrogate model is stable, and then output the surrogate model C and generator G.

[0039] Furthermore, this embodiment further explains and illustrates the algorithm of the above technical solution:

[0040] The specific algorithm is:

[0041]

[0042]

[0043] The embodiments of the present invention are described in detail above with reference to the accompanying drawings, but the present invention is not limited to the described embodiments. It will be apparent to those skilled in the art that various changes, modifications, substitutions, and variations of these embodiments, including components, without departing from the principles and spirit of the present invention are still within the scope of protection of the present invention.

Claims

1. A data extraction method based on uniform sample generation of CGAN, characterized in that: The steps include: Step 1. Sample pseudo labels l from the uniform distribution U(0,N-1), where N is the number of sample categories; Step 2. Sample the initial vector z from the Gaussian distribution N(0,1); Step 3. Concatenate the sample pseudo-label l and the initial vector z to obtain the combination (z, l), which is fed into the CGAN generator G to obtain the generated image x. Step 4. Send the image generated in step 3 to the target model to obtain the output one-dimensional vector V(x) of the target model; Step 5. Feed the image generated in step 3 into the substitution model to obtain the output one-dimensional vector C(x) of the substitution model; Step 6. Use cross entropy to calculate the loss between the one-dimensional vector V(x) and the one-dimensional vector C(x), the loss between the sample pseudo label l and the one-dimensional vector C(x), and backpropagate to update the CGAN generator G; Step 7. Repeat steps 1-6 until the loss of the sample pseudo label l and the one-dimensional vector C(x) no longer changes or the change is less than the threshold θ; Step 8. Repeat steps 1-3 and feed the generated image into the substitution model to obtain the output of the substitution model; Step 9. Perform cross entropy loss on the output of the substitution model and the sample pseudo label l, and update the weight of the substitution model in reverse. Step 10. Repeat steps 8-9 until the accuracy of the surrogate model is stable.

2. The data extraction method for uniform sample generation based on CGAN according to claim 1, characterized in that: In step 3, the concatenation method of the sample pseudo label l and the initial vector z is: Let z = (x1, x2, …, xn), l∈ (0, n-1), use one-hot encoding l, assuming l = (5), n = 10, then l = (0, 0, 0, 0, 1, 0, 0, 0, 0), and the concatenation of z and l is z' = (x1, x2, …, xn, 0, 0, 0, 0, 1, 0, 0, 0, 0).

3. The data extraction method for uniform sample generation based on CGAN according to claim 1, characterized in that: The target model uses the ResNet34 network.

4. The data extraction method for uniform sample generation based on CGAN according to claim 1, characterized in that: The alternative model uses the ResNet18 network.

5. The data extraction method for uniform sample generation based on CGAN according to claim 1, characterized in that: In step 6, the method of backpropagation updating the generator G is: By updating the parameters of the generator G and the surrogate model C, the expression is as follows: where θ G is the parameter of the generator model, μ is the learning rate of the generator, L CE is the loss between step 4 and step 5, L IV is the loss between the sample pseudo-label and step 5, where θ C are the parameters of the surrogate model, ∈ is the learning rate of the surrogate model, It's L IV θ C Find the partial derivative, It's L CE θ G Find the partial derivative.

6. The data extraction method for uniform sample generation based on CGAN according to claim 1, characterized in that: In step 9, the weight of the substitution model C is updated in reverse, and the expression is: where θ C is the parameter of the surrogate model, ∈ is the learning rate of the surrogate model, L IC is the cross entropy loss between the output of the replacement model and the sample pseudo label l, It's L IC θ C Find the partial derivative.

Images