Network model stealing behavior detection method and device

Abstract

The application provides a network model stealing behavior detection method and device, the network model stealing behavior detection method comprises the following steps: obtaining a detection data set; performing correlation analysis on the detection data set based on a source model to obtain a first correlation matrix, performing correlation analysis on the detection data set based on a non-stealing model to obtain a second correlation matrix, and performing correlation analysis on the detection data set based on a to-be-detected model to obtain a third correlation matrix; and obtaining a stealing behavior detection distance based on a first distance, a second distance and a misclassification rate, wherein the stealing behavior detection distance is used for detecting whether the to-be-detected model is subjected to a stealing attack. The method provided by the application can ensure the stable performance of a network model on a main task, is not affected by adversarial training and transfer learning, improves the robustness and detection effect of a model intellectual property algorithm, and simultaneously does not need to train a substitute model, thereby improving the algorithm operation efficiency of the model.

Description

Technical Field

[0001] This invention relates to the field of network security technology, and in particular to a method and apparatus for detecting network model theft behavior. Background Technology

[0002] Network model theft attacks refer to attackers copying the functionality of a confidential model without permission, learning the model's knowledge by observing its output on certain inputs, and infringing on the intellectual property rights of the original model.

[0003] In related technologies, watermarking and fingerprint recognition methods are commonly used to verify and protect the intellectual property rights of source models. Watermarking requires leaving a specific watermark during model training, which sacrifices the performance of the network model on the main task. On the other hand, fingerprint recognition based on adversarial examples can lead to unstable model performance during adversarial training, which is time-consuming. Furthermore, as the label space changes during transfer learning, the target label of the adversarial example disappears, reducing the ability to identify theft attacks faced by the network model. Summary of the Invention

[0004] This invention provides a method and apparatus for detecting network model theft behavior, which addresses the shortcomings of existing technologies that sacrifice model performance on the main task when using watermarking to verify and protect network models, and that fingerprint recognition leads to unstable model performance in adversarial training and reduced accuracy in identifying network model theft behavior as the label space changes during transfer learning. This invention improves the accuracy of identifying network model theft attack behavior.

[0005] This invention provides a method for detecting network model theft behavior, comprising:

[0006] Acquire a probe dataset, which includes images from multiple different domains;

[0007] Based on the source model, correlation analysis is performed on the probe dataset to obtain a first correlation matrix. Based on the non-stealing model, correlation analysis is performed on the probe dataset to obtain a second correlation matrix. Based on the model to be detected, correlation analysis is performed on the probe dataset to obtain a third correlation matrix.

[0008] Based on the first distance, the second distance, and the misclassification rate, the theft behavior detection distance is obtained, which is used to detect whether the model under test is facing a theft attack.

[0009] Wherein, the first distance is the distance between the first correlation matrix and the second correlation matrix, and the second distance is the distance between the first correlation matrix and the third correlation matrix; the misclassification rate is calculated based on misclassified samples through the target model, the misclassified samples are obtained by classifying the probe dataset based on the source model, and the target model includes at least one of the non-stealing model and the model to be detected.

[0010] According to the method for detecting network model theft behavior provided by the present invention, the method for obtaining the theft behavior detection distance based on a first distance, a second distance, and a misclassification rate includes:

[0011] The theft detection distance is obtained by adaptively weighting the first distance, the second distance, and the misclassification rate.

[0012] According to a method for detecting network model theft behavior provided by the present invention, after acquiring the probe dataset, the method includes:

[0013] Data augmentation is performed on each image in the detection dataset to obtain a new detection dataset.

[0014] According to the method for detecting network model theft provided by the present invention, the first correlation matrix obtained by performing correlation analysis on the probe dataset based on the source model includes:

[0015] The first correlation matrix is ​​obtained by calculating the cosine distance between each image in the probe dataset based on the source model.

[0016] The correlation analysis performed on the probe dataset based on the non-theft model to obtain the second correlation matrix includes:

[0017] The second correlation matrix is ​​obtained by calculating the cosine distance between each image in the detection dataset based on a non-stealing model.

[0018] The correlation analysis performed on the probe dataset based on the model to be detected yields a third correlation matrix, which includes:

[0019] The third correlation matrix is ​​obtained by calculating the cosine distance between each image in the detection dataset based on the model to be detected.

[0020] According to a network model theft detection method provided by the present invention, after obtaining the theft detection distance, the method further includes:

[0021] If the detection distance of the theft behavior is less than a preset distance threshold, it is determined that the model to be detected is facing a theft attack;

[0022] If the detection distance of the theft behavior is greater than or equal to a preset distance threshold, it is determined that the model to be detected is not facing a theft attack.

[0023] The present invention also provides a network model theft detection device, comprising:

[0024] The data acquisition module is used to acquire the probe dataset, which includes images from multiple different fields;

[0025] The first processing module is used to perform correlation analysis on the probe dataset based on the source model to obtain a first correlation matrix, perform correlation analysis on the probe dataset based on the non-stealing model to obtain a second correlation matrix, and perform correlation analysis on the probe dataset based on the model to be detected to obtain a third correlation matrix.

[0026] The second processing module is used to obtain the theft behavior detection distance based on the first distance, the second distance and the misclassification rate. The theft behavior detection distance is used to detect whether the model to be detected is facing a theft attack.

[0027] Wherein, the first distance is the distance between the first correlation matrix and the second correlation matrix, and the second distance is the distance between the first correlation matrix and the third correlation matrix; the misclassification rate is calculated based on misclassified samples through the target model, the misclassified samples are obtained by classifying the probe dataset based on the source model, and the target model includes at least one of the non-stealing model and the model to be detected.

[0028] According to the present invention, a network model theft detection device further includes:

[0029] The third processing module is used to perform data augmentation on each image in the detection dataset after the detection dataset is acquired, so as to obtain a new detection dataset.

[0030] The present invention also provides an electronic device, including a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor executes the program to implement the network model theft behavior detection method as described above.

[0031] The present invention also provides a non-transitory computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, implements the network model theft behavior detection method as described above.

[0032] The present invention also provides a computer program product, including a computer program that, when executed by a processor, implements the network model theft behavior detection method as described above.

[0033] The network model theft detection method and apparatus provided by this invention perform correlation analysis on the probe dataset using the source model to obtain a first correlation matrix, perform correlation analysis on the probe dataset using a non-theft model to obtain a second correlation matrix, and perform correlation analysis on the probe dataset using the model to be detected to obtain a third correlation matrix. Then, based on the first distance, the second distance, and the misclassification rate, the theft detection distance is obtained to detect whether the model to be detected is facing a theft attack. This method can ensure the stable performance of the network model on the main task and is not affected by adversarial training and transfer learning, thereby improving the robustness and detection effect of the model's intellectual property algorithm. At the same time, it does not require training a substitute model, thus improving the algorithm's operating efficiency. Attached Figure Description

[0034] To more clearly illustrate the technical solutions in this invention or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are some embodiments of this invention. For those skilled in the art, other drawings can be obtained from these drawings without creative effort.

[0035] Figure 1 This is a flowchart illustrating the network model theft behavior detection method provided by the present invention;

[0036] Figure 2 This is a schematic diagram of the network model theft behavior detection device provided by the present invention;

[0037] Figure 3 This is a schematic diagram of the structure of the electronic device provided by the present invention. Detailed Implementation

[0038] To make the objectives, technical solutions, and advantages of this invention clearer, the technical solutions of this invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some, not all, of the embodiments of this invention. All other embodiments obtained by those skilled in the art based on the embodiments of this invention without creative effort are within the scope of protection of this invention.

[0039] The following is combined with Figures 1-2 The present invention describes a method and apparatus for detecting network model theft.

[0040] Figure 1 This is a flowchart illustrating the network model theft detection method provided by the present invention, as shown below. Figure 1 As shown, the method for detecting theft behavior in this network model includes the following steps:

[0041] Step 110: Obtain the probe dataset, which includes images from multiple different fields.

[0042] In this step, the probe dataset contains images from various different domains. For example, the image data in the probe dataset comes from various image classification datasets, including the 10-class clothing category Fashion-MNIST dataset, the 10-class small object category CIFAR10 dataset, the Google Street View house number SVHN dataset, and the traffic sign GTSRB dataset.

[0043] In this embodiment, three attack methods can be used to steal the source model in real time, namely JBDA (Jacobian Based Dataset Augmentation), Knockoff (alternative model), and MAZE (Model stealing Attack using Zeroth-order gradient Estimation), to obtain a stolen model. Among them, JBDA uses a small number of training set samples to create synthetic samples, thereby approximating the classification boundary of the target model; Knockoff uses a larger dataset that may be related to the target model and uses output feedback to complete model stealing; MAZE does not use any training set related samples, and trains the data generator to maximize the information difference between the output vectors of the cloned model and the target model, thereby completing model stealing.

[0044] In this embodiment, the probe dataset can be augmented using methods such as graphics rendering or physical folding to expand the dataset.

[0045] Step 120: Perform correlation analysis on the probe dataset based on the source model to obtain the first correlation matrix; perform correlation analysis on the probe dataset based on the non-stealing model to obtain the second correlation matrix; and perform correlation analysis on the probe dataset based on the model to be detected to obtain the third correlation matrix.

[0046] In this step, the source model refers to the stolen model published on the website. The stolen model refers to a model that allows attackers to effectively learn approximate functions of the original model by observing its output on selected inputs, thereby stealing the knowledge of the original model.

[0047] In this step, the non-stealing model, also known as the irrelevant model, refers to a model with the same architecture as the stealing model, but which does not steal knowledge from the original model.

[0048] In this step, correlation analysis is performed on the sample images in the probe dataset of the input network model. This can be done by constructing a sample characterization correlation matrix based on the distance between each sample, for example, based on cosine distance or linear distance.

[0049] In this embodiment, the source model can be a neural network model, such as a deep neural network, a convolutional neural network, or a generative adversarial network.

[0050] In this embodiment, the detection dataset is input into the source model, the non-stealing model, and the model to be detected, respectively, for correlation analysis, and the correlation matrix output by each model is obtained.

[0051] In this embodiment, by inputting the probe dataset into the correlation matrix obtained by each model, the distance between the correlation matrices can be used as a measure of whether the model has been subjected to a theft attack.

[0052] Step 130: Based on the first distance, the second distance, and the misclassification rate, the theft behavior detection distance is obtained. The theft behavior detection distance is used to detect whether the model to be detected is facing a theft attack. The first distance is the distance between the first correlation matrix and the second correlation matrix, and the second distance is the distance between the first correlation matrix and the third correlation matrix. The misclassification rate is calculated based on the misclassified samples through the target model. The misclassified samples are obtained by classifying the probe dataset based on the source model. The target model includes at least one of the non-theft model and the model to be detected.

[0053] In this embodiment, the correlation matrices output by the source model, the non-stealing model, and the model to be detected are obtained through the above steps, and the first distance between the first correlation matrix and the second correlation matrix, i.e. the distance between the source model and the non-stealing model, and the distance between the first correlation matrix and the third correlation matrix, i.e. the distance between the source model and the model to be detected, are calculated respectively.

[0054] In this embodiment, after data augmentation of each image in the probe dataset, the augmented probe dataset is further classified using the source model to obtain misclassified samples, and the misclassification rate corresponding to the misclassified samples is calculated using a non-stealing model.

[0055] In this embodiment, the misclassification rate of the misclassified samples can also be calculated using the model to be detected.

[0056] In this embodiment, after obtaining the first distance, the second distance, and the misclassification rate, the first distance, the second distance, and the misclassification rate can be weighted by an adaptive weight allocation method to obtain a new distance index, namely the theft behavior detection distance. This distance index can be directly used to detect whether the model under test is at risk of theft attack.

[0057] This invention provides a method for detecting network model theft. It performs correlation analysis on the probe dataset using the source model to obtain a first correlation matrix, then performs correlation analysis on the probe dataset using a non-theft model to obtain a second correlation matrix, and finally performs correlation analysis on the probe dataset using the model to be detected to obtain a third correlation matrix. Based on the first distance, the second distance, and the misclassification rate, a theft detection distance is obtained to detect whether the model to be detected is facing a theft attack. This method ensures the stable performance of the network model on the main task and is unaffected by adversarial training and transfer learning, improving the robustness and detection effect of the model's intellectual property algorithm. Furthermore, it eliminates the need to train a replacement model, thus improving the algorithm's operating efficiency.

[0058] In some embodiments, obtaining the theft detection distance based on the first distance, the second distance, and the misclassification rate includes: adaptively weighting the first distance, the second distance, and the misclassification rate to obtain the theft detection distance.

[0059] In this embodiment, the theft detection distance is obtained by assigning response weights to the first distance, the second distance, and the misclassification rate.

[0060] For example, let z be the detection distance for theft behavior, x be the first distance with a corresponding weight coefficient, y be the second distance with a corresponding weight coefficient, p be the misclassification rate with a corresponding weight coefficient, and c be the misclassification rate. Then the detection distance z for theft behavior can be expressed by the following formula:

[0061] y = a*x + b*y + c*z;

[0062] The weighting coefficients a, b, and c can be set according to the user's actual needs.

[0063] In this embodiment, the misclassification rate can be either the misclassification rate p1 calculated by inputting misclassified samples into the non-stealing model, or the misclassification rate p2 calculated by inputting misclassified samples into the model to be detected.

[0064] In this embodiment, the misclassification rate can also be determined by p1 and p2 together, for example, the misclassification rate can be the average of p1 and p2, etc.

[0065] In this embodiment, the misclassification rate can also be expressed by the following formula:

[0066] P = d*p1 + e*p2;

[0067] Where d and e are coefficients that can be set according to the user's actual needs.

[0068] The present invention provides a method for detecting network model theft behavior. By adaptively weighting a first distance, a second distance, and a misclassification rate, the theft behavior detection distance is obtained. This method comprehensively considers the correlation between the source model, the non-theft model, and the model to be detected, as well as the classification performance of the non-theft model or the model to be detected, thereby improving the reliability of the theft behavior detection distance and thus improving the accuracy of model theft behavior detection.

[0069] In some embodiments, after acquiring the probe dataset, the method includes: performing data augmentation on each image in the probe dataset to obtain a new probe dataset.

[0070] In this embodiment, data augmentation of each image in the probe dataset can be performed by rendering the images, for example, using the image rendering tool Zoom_blur to render each image in the probe dataset; or by physical augmentation, for example, by randomly flipping the image.

[0071] In this embodiment, data augmentation of each image in the probe dataset to obtain a new probe dataset may include: rendering each image in the probe dataset to obtain a rendered probe dataset; and performing random folding processing on each image in the rendered probe dataset to obtain the new probe dataset.

[0072] In this embodiment, image enhancement based on Zoom_blur and random folding is achieved through the following steps:

[0073] (1) Select M test samples as the initial samples;

[0074] (2) Zoom_blur the M test samples to augment the data and obtain k*M test samples;

[0075] (3) Randomly flip the k*M test samples to reduce the common information of the model on the image and increase the proportion of specific information;

[0076] (4) Use k*M test samples as input to the network model to detect model theft behavior.

[0077] In this embodiment, the mixed samples are selected as model input via Zoom_blur, eliminating the need to train a proxy model or generate adversarial examples.

[0078] The present invention provides a method for detecting network model theft behavior. By using image enhancement to expand the detection data, it eliminates the need to train alternative models and can significantly reduce the computational resources required for model owners to adopt model intellectual property protection methods.

[0079] In some embodiments, performing correlation analysis on the probe dataset based on the source model to obtain a first correlation matrix includes: calculating the cosine distance between each image in the probe dataset based on the source model to obtain a first correlation matrix; performing correlation analysis on the probe dataset based on a non-stealing model to obtain a second correlation matrix includes: calculating the cosine distance between each image in the probe dataset based on the non-stealing model to obtain a second correlation matrix; performing correlation analysis on the probe dataset based on the model to be detected to obtain a third correlation matrix includes: calculating the cosine distance between each image in the probe dataset based on the model to be detected to obtain a third correlation matrix.

[0080] In this embodiment, the detection dataset is input into the source model, the non-stealing model, and the model to be detected for correlation analysis. The degree of correlation can be represented by the mathematical distance between matrices, such as the cosine distance, Euclidean distance, Manhattan distance, or Chebyshev distance.

[0081] In this embodiment, the cosine distance is used to represent the correlation of the matrix as an example. The method for calculating the correlation matrix using cosine distance specifically includes the following steps:

[0082] (1) Select k*M image enhancement samples as test samples;

[0083] (2) Use k*M test samples as model input and record the output results of the source model, the non-stealing model and the model to be tested.

[0084] (3) Record the cosine distance between each sample representation in each model and calculate the correlation matrix of the sample representations;

[0085] (4) Calculate the distance between the source model and the non-stealing model and the model to be tested, and use the distance and the misclassification rate together as a metric to measure whether the model has passed the theft attack.

[0086] This invention provides a method for detecting network model theft behavior. It calculates the cosine distance between each image in the probe dataset using the source model to obtain a first correlation matrix, calculates the cosine distance between each image in the probe dataset using a non-theft model to obtain a second correlation matrix, and calculates the cosine distance between each image in the probe dataset based on the model to be detected to obtain a third correlation matrix. By using the correlation between samples, it eliminates the need to introduce watermarks during the training of the source model, thus ensuring that the performance of the model on the main task is not affected.

[0087] In some embodiments, after obtaining the theft detection distance, the method further includes: determining that the model to be detected is facing a theft attack if the theft detection distance is less than a preset distance threshold; and determining that the model to be detected is not facing a theft attack if the theft detection distance is greater than or equal to the preset distance threshold.

[0088] In this embodiment, the preset distance threshold can be set according to the user's actual needs.

[0089] In this embodiment, after obtaining the distances between the source model and the non-stealing model and the model under test through the distances of each correlation matrix, the distances and misclassification rates are adaptively weighted to obtain the theft detection distance. The theft detection distance is then compared with a preset distance threshold. If the theft detection distance is greater than or equal to the preset distance threshold, the model under test is not subject to theft attacks and is in a safe state. If the theft detection distance is less than the preset distance threshold, the model under test is subject to theft attacks, and the administrator should be alerted to take emergency measures.

[0090] This invention provides a method for detecting network model theft. When the detection distance is less than a preset distance threshold, the method determines that the model under test is facing a theft attack; when the detection distance is greater than or equal to the preset distance threshold, the method determines that the model under test is not facing a theft attack. This method enables rapid judgment of whether a network model is under theft attack, is simple to use, and improves detection efficiency.

[0091] The network model theft detection device provided by the present invention is described below. The network model theft detection device described below and the network model theft detection method described above can be referred to in correspondence.

[0092] Figure 2 This is a schematic diagram of the network model theft behavior detection device provided by the present invention, as shown below. Figure 2 As shown, the network model theft behavior detection device includes a data acquisition module 110, a first processing module 120, and a second processing module 130.

[0093] Data acquisition module 110 is used to acquire the probe dataset, which includes images from multiple different fields;

[0094] The first processing module 120 is used to perform correlation analysis on the probe dataset based on the source model to obtain a first correlation matrix, perform correlation analysis on the probe dataset based on the non-stealing model to obtain a second correlation matrix, and perform correlation analysis on the probe dataset based on the model to be detected to obtain a third correlation matrix.

[0095] The second processing module 130 is used to obtain the theft behavior detection distance based on the first distance, the second distance and the misclassification rate. The theft behavior detection distance is used to detect whether the model to be detected is facing a theft attack.

[0096] Wherein, the first distance is the distance between the first correlation matrix and the second correlation matrix, and the second distance is the distance between the first correlation matrix and the third correlation matrix; the misclassification rate is calculated based on the misclassified samples through the target model, and the misclassified samples are obtained by classifying the probe dataset based on the source model; the target model includes at least one of the non-stealing model and the model to be detected.

[0097] This invention provides a network model theft detection device. It performs correlation analysis on the probe dataset using the source model to obtain a first correlation matrix, then performs correlation analysis on the probe dataset using a non-theft model to obtain a second correlation matrix, and finally performs correlation analysis on the probe dataset using the model to be detected to obtain a third correlation matrix. Based on the first distance, the second distance, and the misclassification rate, it obtains the theft detection distance to detect whether the model to be detected is facing a theft attack. This device ensures the stable performance of the network model on the main task and is unaffected by adversarial training and transfer learning, improving the robustness and detection effect of the model's intellectual property algorithm. Furthermore, it eliminates the need to train a replacement model, thus improving the algorithm's operating efficiency.

[0098] In some embodiments, the apparatus further includes a third processing module, configured to perform data augmentation on each image in the probe dataset after acquiring the probe dataset, to obtain a new probe dataset.

[0099] The present invention provides a network model theft detection device, which expands the detection data by using image enhancement, eliminating the need to train alternative models and significantly reducing the computational resources required for model owners to adopt model intellectual property protection methods.

[0100] Figure 3 This is a schematic diagram of the structure of the electronic device provided by the present invention, such as... Figure 3As shown, the electronic device may include: a processor 310, a communication interface 320, a memory 330, and a communication bus 340, wherein the processor 310, the communication interface 320, and the memory 330 communicate with each other through the communication bus 340. The processor 310 can call logical instructions in the memory 330 to execute a network model theft detection method. This method includes: acquiring a probe dataset comprising images from multiple different domains; performing correlation analysis on the probe dataset based on a source model to obtain a first correlation matrix; performing correlation analysis on the probe dataset based on a non-theft model to obtain a second correlation matrix; performing correlation analysis on the probe dataset based on a model to be detected to obtain a third correlation matrix; and obtaining a theft detection distance based on a first distance, a second distance, and a misclassification rate. The theft detection distance is used to detect whether the model to be detected is facing a theft attack. The first distance is the distance between the first correlation matrix and the second correlation matrix, and the second distance is the distance between the first correlation matrix and the third correlation matrix. The misclassification rate is calculated based on misclassified samples using a target model. The misclassified samples are obtained by classifying samples in the probe dataset using the source model. The target model includes at least one of a non-theft model and a model to be detected.

[0101] Furthermore, the logical instructions in the aforementioned memory 330 can be implemented as software functional units and, when sold or used as independent products, can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present invention, or the part that contributes to the prior art, or a part of the technical solution, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute all or part of the steps of the methods described in the various embodiments of the present invention. The aforementioned storage medium includes various media capable of storing program code, such as USB flash drives, portable hard drives, read-only memory (ROM), random access memory (RAM), magnetic disks, or optical disks.

[0102] On the other hand, the present invention also provides a computer program product, which includes a computer program that can be stored on a non-transitory computer-readable storage medium. When the computer program is executed by a processor, the computer can execute the network model theft behavior detection method provided by the above methods. The method includes: acquiring a probe dataset, which includes images from multiple different domains; performing correlation analysis on the probe dataset based on a source model to obtain a first correlation matrix; performing correlation analysis on the probe dataset based on a non-theft model to obtain a second correlation matrix; performing correlation analysis on the probe dataset based on a model to be detected to obtain a third correlation matrix; obtaining a theft behavior detection distance based on a first distance, a second distance, and a misclassification rate, wherein the theft behavior detection distance is used to detect whether the model to be detected is facing a theft attack; wherein the first distance is the distance between the first correlation matrix and the second correlation matrix, and the second distance is the distance between the first correlation matrix and the third correlation matrix; the misclassification rate is calculated based on misclassified samples through a target model, and the misclassified samples are obtained by classifying the probe dataset based on the source model; the target model includes at least one of a non-theft model and a model to be detected.

[0103] In another aspect, the present invention also provides a non-transitory computer-readable storage medium storing a computer program thereon, which, when executed by a processor, implements the network model theft behavior detection method provided by the above methods. The method includes: acquiring a probe dataset, the probe dataset comprising images from multiple different domains; performing correlation analysis on the probe dataset based on a source model to obtain a first correlation matrix; performing correlation analysis on the probe dataset based on a non-theft model to obtain a second correlation matrix; performing correlation analysis on the probe dataset based on a model to be detected to obtain a third correlation matrix; obtaining a theft behavior detection distance based on a first distance, a second distance, and a misclassification rate, the theft behavior detection distance being used to detect whether the model to be detected faces a theft attack; wherein the first distance is the distance between the first correlation matrix and the second correlation matrix, and the second distance is the distance between the first correlation matrix and the third correlation matrix; the misclassification rate is calculated based on misclassified samples through a target model, the misclassified samples being obtained by classifying samples in the probe dataset based on the source model, and the target model including at least one of a non-theft model and a model to be detected.

[0104] The device embodiments described above are merely illustrative. The units described as separate components may or may not be physically separate. The components shown as units may or may not be physical units; that is, they may be located in one place or distributed across multiple network units. Some or all of the modules can be selected to achieve the purpose of this embodiment according to actual needs. Those skilled in the art can understand and implement this without any creative effort.

[0105] Through the above description of the embodiments, those skilled in the art can clearly understand that each embodiment can be implemented by means of software plus necessary general-purpose hardware platforms, and of course, it can also be implemented by hardware. Based on this understanding, the above technical solutions, in essence or the part that contributes to the prior art, can be embodied in the form of a software product. This computer software product can be stored in a computer-readable storage medium, such as ROM / RAM, magnetic disk, optical disk, etc., and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute the methods described in the various embodiments or some parts of the embodiments.

[0106] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention, and not to limit them; although the present invention has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that modifications can still be made to the technical solutions described in the foregoing embodiments, or equivalent substitutions can be made to some of the technical features; and these modifications or substitutions do not cause the essence of the corresponding technical solutions to deviate from the spirit and scope of the technical solutions of the embodiments of the present invention.

Claims

1. A method for detecting network model theft behavior, characterized in that, include: Acquire a probe dataset, which includes images from multiple different domains; Based on the source model, correlation analysis is performed on the probe dataset to obtain a first correlation matrix. Based on the non-stealing model, correlation analysis is performed on the probe dataset to obtain a second correlation matrix. Based on the model to be detected, correlation analysis is performed on the probe dataset to obtain a third correlation matrix. Based on the first distance, the second distance, and the misclassification rate, the theft behavior detection distance is obtained, which is used to detect whether the model under test is facing a theft attack. Wherein, the first distance is the distance between the first correlation matrix and the second correlation matrix, and the second distance is the distance between the first correlation matrix and the third correlation matrix; the misclassification rate is calculated based on misclassified samples through the target model, the misclassified samples are obtained by classifying the probe dataset based on the source model, and the target model includes at least one of the non-stealing model and the model to be detected.

2. The network model theft detection method according to claim 1, characterized in that, The theft detection distance, obtained based on the first distance, the second distance, and the misclassification rate, includes: The theft detection distance is obtained by adaptively weighting the first distance, the second distance, and the misclassification rate.

3. The network model theft detection method according to claim 1, characterized in that, After acquiring the probe dataset, the method includes: Data augmentation is performed on each image in the detection dataset to obtain a new detection dataset.

4. The network model theft detection method according to claim 1, characterized in that, The correlation analysis of the probe dataset based on the source model to obtain the first correlation matrix includes: The first correlation matrix is ​​obtained by calculating the cosine distance between each image in the probe dataset based on the source model. The correlation analysis performed on the probe dataset based on the non-theft model to obtain the second correlation matrix includes: The second correlation matrix is ​​obtained by calculating the cosine distance between each image in the detection dataset based on a non-stealing model. The correlation analysis performed on the probe dataset based on the model to be detected yields a third correlation matrix, which includes: The third correlation matrix is ​​obtained by calculating the cosine distance between each image in the detection dataset based on the model to be detected.

5. The network model theft detection method according to claim 1, characterized in that, After obtaining the theft detection distance, the method further includes: If the detection distance of the theft behavior is less than a preset distance threshold, it is determined that the model to be detected is facing a theft attack; If the detection distance of the theft behavior is greater than or equal to a preset distance threshold, it is determined that the model to be detected is not facing a theft attack.

6. A network model theft detection device, characterized in that, include: The data acquisition module is used to acquire the probe dataset, which includes images from multiple different fields; The first processing module is used to perform correlation analysis on the probe dataset based on the source model to obtain a first correlation matrix, perform correlation analysis on the probe dataset based on the non-stealing model to obtain a second correlation matrix, and perform correlation analysis on the probe dataset based on the model to be detected to obtain a third correlation matrix. The second processing module is used to obtain the theft behavior detection distance based on the first distance, the second distance and the misclassification rate. The theft behavior detection distance is used to detect whether the model to be detected is facing a theft attack. Wherein, the first distance is the distance between the first correlation matrix and the second correlation matrix, and the second distance is the distance between the first correlation matrix and the third correlation matrix; the misclassification rate is calculated based on misclassified samples through the target model, the misclassified samples are obtained by classifying the probe dataset based on the source model, and the target model includes at least one of the non-stealing model and the model to be detected.

7. The network model theft detection device according to claim 6, characterized in that, The device further includes: The third processing module is used to perform data augmentation on each image in the detection dataset after the detection dataset is acquired, so as to obtain a new detection dataset.

8. An electronic device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, characterized in that, When the processor executes the program, it implements the network model theft behavior detection method as described in any one of claims 1 to 5.

9. A non-transitory computer-readable storage medium having a computer program stored thereon, characterized in that, When the computer program is executed by the processor, it implements the network model theft behavior detection method as described in any one of claims 1 to 5.

10. A computer program product, comprising a computer program, characterized in that, When the computer program is executed by the processor, it implements the network model theft behavior detection method as described in any one of claims 1 to 5.

Images