A model anti-theft detection method, device, storage medium and electronic equipment

Abstract

This specification discloses a model anti-theft detection method, device, storage medium and electronic device. The anti-theft detection model includes a cloner and a generator. The cloner is used to clone a pre-trained business model, and the generator is used to generate simulated business data input into the cloner. First, noise is input into the generator to obtain first simulated business data, and a first business result of the first simulated business data is obtained through the cloner. Then, based on the first business result and the first simulated business data, the generator is trained with the training goal of improving the error rate of the cloner output result. Next, noise is input into the trained generator to obtain second simulated business data, and a second business result and label of the second simulated business data are obtained through the cloner and the business model. Finally, based on the second business result and label, the cloner is trained, and the anti-theft capability of the business model is detected by using the number of iterations of the cloner during the training process.

Description

Technical Field

[0001] This specification relates to the field of machine learning, and in particular to a model anti-theft detection method, device, storage medium and electronic device. Background Art

[0002] With the development of machine learning technology, people can use machine learning trained models to perform risk control on various types of business performed by users. Among them, the training samples used to train the models may contain personal privacy data. For example, when a user conducts a large-amount transaction, the risk control model (a business model) detects that the current transaction amount is high, and can verify the user's identity to reduce the risk of property loss to the user. There are currently many ways to protect personal data during model training. Protecting personal data is important, but the problem of business models being stolen by attackers after they are launched cannot be ignored. In other words, attackers may steal the online business model for their own benefit so that the attackers themselves can obtain a model with the same functions as the business model.

[0003] In order to prevent the business model from being stolen by attackers after it goes online, the anti-theft capability of the business model can be evaluated before the business model goes online, so that the online business model can be updated or retrained in time according to the anti-theft capability evaluation results. However, how to evaluate the anti-theft capability of the business model is an urgent problem to be solved.

[0004] Based on this, this specification provides a model anti-theft detection method. Summary of the invention

[0005] This specification provides a model anti-theft detection method, device, storage medium and electronic device to at least partially solve the above-mentioned problems existing in the prior art.

[0006] This manual adopts the following technical solutions:

[0007] This specification provides a model anti-theft detection method, the anti-theft detection model includes a cloner and a generator, the cloner is used to clone a pre-trained business model, the generator is used to generate simulated business data input to the cloner, including:

[0008] Inputting the pre-acquired noise into the generator to obtain the first simulated service data output by the generator;

[0009] Inputting the first simulation service data into the cloner to obtain a first service result output by the cloner;

[0010] According to the first business result and the first simulation business data, the generator is trained with the goal of improving the error rate of the first business result output by the cloner for the first simulation business data;

[0011] Inputting the noise into a trained generator to obtain second simulation service data output by the trained generator;

[0012] Inputting the second simulation business data into the cloner to obtain a second business result output by the cloner; and inputting the second simulation business data into the business model to obtain a business result output by the business model as a label of the second business result, so as to train the cloner according to the second business result and the label;

[0013] The anti-theft capability of the business model is detected according to the number of iterations of the cloner during the training process.

[0014] Optionally, training the generator according to the first business result and the first simulation business data with the goal of improving the error rate of the first business result output by the cloner for the first simulation business data specifically includes:

[0015] Freeze all parameters of the cloner; and determine the generation loss of the generator according to the first business result and the first simulation business data;

[0016] The generator is trained according to the generation loss with the training target of improving the error rate of the first business result output by the cloner for the first simulation business data.

[0017] Optionally, determining the generation loss of the generator according to the first business result and the first simulation business data specifically includes:

[0018] determining a current iteration number of the generator;

[0019] Determining a dynamically adjusted difficulty parameter according to the current number of iterations and a preset total number of iterations, wherein the dynamically adjusted difficulty parameter increases as the current number of iterations increases;

[0020] Determining a generation loss function of the generator according to the dynamically adjusted difficulty parameter;

[0021] The generation loss of the generator is determined according to the first business result, the first simulation business data and the generation loss function.

[0022] Optionally, training the cloner according to the second business result and the label specifically includes:

[0023] unfreeze all parameters of the cloner and freeze all parameters of the generator;

[0024] Inputting the second business result and the label into a preset cloning loss function to obtain the cloning loss of the cloner;

[0025] The thawed cloner is trained according to the clone loss.

[0026] Optionally, the cloning loss function includes a KL divergence loss function or an absolute value loss function.

[0027] Optionally, detecting the anti-theft capability of the business model according to the number of iterations of the cloner during the training process specifically includes:

[0028] Determining whether the cloner in the trained anti-theft detection model reaches a preset accuracy;

[0029] If not, continue to train the cloner in the anti-theft detection model until the cloner in the anti-theft detection model reaches a preset accuracy;

[0030] If so, the number of iterations of the cloner during the training process is determined, and the anti-theft capability of the business model is detected according to the number of iterations of the cloner during the training process.

[0031] Optionally, the anti-theft capability of the business model is positively correlated with the number of iterations of the cloner during the training process.

[0032] Optionally, the method further comprises:

[0033] When the anti-theft capability of the business model does not reach a preset target anti-theft capability, the business model is retrained.

[0034] This specification provides a model anti-theft detection device, the anti-theft detection model includes a cloner and a generator, the cloner is used to clone a pre-trained business model, the generator is used to generate simulated business data input to the cloner, the device includes:

[0035] A first simulation service data acquisition module, used for inputting the pre-acquired noise into the generator to obtain the first simulation service data output by the generator;

[0036] A first business result acquisition module, used for inputting the first simulation business data into the cloner to obtain a first business result output by the cloner;

[0037] A generator training module, configured to train the generator according to the first business result and the first simulation business data, with the aim of improving the error rate of the first business result output by the cloner for the first simulation business data as a training target;

[0038] A second simulation business data acquisition module, used for inputting the noise into the trained generator to obtain second simulation business data output by the trained generator;

[0039] a cloner training module, configured to input the second simulated business data into the cloner to obtain a second business result output by the cloner; and input the second simulated business data into the business model to obtain a business result output by the business model as a label of the second business result, so as to train the cloner according to the second business result and the label;

[0040] The detection module is used to detect the anti-theft capability of the business model according to the number of iterations of the cloner during the training process.

[0041] Optionally, the generator training module is specifically used to freeze all parameters of the cloner; and determine the generation loss of the generator based on the first business result and the first simulation business data; and train the generator based on the generation loss with the training goal of improving the error rate of the first business result output by the cloner for the first simulation business data.

[0042] Optionally, the generator training module is specifically used to determine the current iteration number of the generator; determine the dynamic adjustment difficulty parameter based on the current iteration number and the preset total iteration number, wherein the dynamic adjustment difficulty parameter increases with the increase of the current iteration number; determine the generation loss function of the generator based on the dynamic adjustment difficulty parameter; determine the generation loss of the generator based on the first business result, the first simulation business data and the generation loss function.

[0043] Optionally, the cloner training module is specifically used to unfreeze all parameters of the cloner and freeze all parameters of the generator; input the second business result and the label into a preset cloning loss function to obtain the cloning loss of the cloner; and train the unfrozen cloner according to the cloning loss.

[0044] Optionally, the cloning loss function includes a KL divergence loss function or an absolute value loss function.

[0045] Optionally, the detection module is specifically used to determine whether the cloner in the anti-theft detection model after training reaches a preset accuracy; if not, continue to train the cloner in the anti-theft detection model until the cloner in the anti-theft detection model reaches a preset accuracy; if so, determine the number of iterations of the cloner during the training process, and detect the anti-theft capability of the business model based on the number of iterations of the cloner during the training process.

[0046] Optionally, the anti-theft capability of the business model is positively correlated with the number of iterations of the cloner during the training process.

[0047] Optionally, the device further comprises:

[0048] The business model retraining module is used to retrain the business model when the anti-theft capability of the business model does not reach a preset target anti-theft capability.

[0049] This specification provides a computer-readable storage medium, which stores a computer program. When the computer program is executed by a processor, the anti-theft detection method of the above model is implemented.

[0050] This specification provides an electronic device, including a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor implements the anti-theft detection method of the above-mentioned model when executing the program.

[0051] At least one of the above technical solutions adopted in this specification can achieve the following beneficial effects:

[0052] It can be seen from the anti-theft detection method of the model provided in this specification that the method uses the output results of the pre-trained business model to train the cloner so that the cloner clones the business functions of the business model, thereby detecting the anti-theft capability of the business model according to the number of iterations of the cloner during the training process. In addition, the method trains the generator according to the output results of the cloner and the output of the generator, and does not rely on the business model. In other words, there is no need to train the generator according to the output results of the business model, which reduces the number of times the business model is used, thereby reducing the resource overhead of training the generator. BRIEF DESCRIPTION OF THE DRAWINGS

[0053] The drawings described herein are used to provide a further understanding of this specification and constitute a part of this specification. The exemplary embodiments and descriptions of this specification are used to explain this specification and do not constitute an improper limitation on this specification.

[0054] In the figure:

[0055] Figure 1A flowchart of an anti-theft detection method for a model provided in this specification;

[0056] Figure 2 A flowchart of the training generator provided for this specification;

[0057] Figure 3 A schematic diagram of the training cloner provided for this manual;

[0058] Figure 4 A schematic diagram of an anti-theft detection device of a model provided in this manual;

[0059] Figure 5 The corresponding Figure 1 Schematic diagram of electronic equipment. DETAILED DESCRIPTION

[0060] In order to make the purpose, technical solutions and advantages of this specification more clear, the technical solutions of this specification will be clearly and completely described below in combination with the specific embodiments of this specification and the corresponding drawings. Obviously, the described embodiments are only part of the embodiments of this specification, not all of the embodiments. Based on the embodiments in this specification, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of this application.

[0061] The technical solutions provided by the embodiments of this specification are described in detail below in conjunction with the accompanying drawings.

[0062] Figure 1 A schematic diagram of a flow chart of an anti-theft detection method for a model provided in this specification specifically includes the following steps:

[0063] S100: Inputting pre-acquired noise into the generator to obtain first simulated service data output by the generator.

[0064] Usually, training a business model requires a lot of computing resources, time and other costs, making the trained model an important asset. There are many attackers who try to steal the online business model for their own benefit. That is, learn the functions of the online business model through improper means. Therefore, in order to prevent the business model from being stolen by attackers, anti-theft detection can be performed before the business model goes online to determine the anti-theft capability of the business model, and formulate an anti-theft strategy based on the anti-theft capability of the business model. This specification provides a model anti-theft detection method. The execution subject of this specification can be a server that trains the business model, or it can be a server or other electronic device that can use the model training method to determine the anti-theft status of the business model. This specification does not limit this. For the sake of convenience, this specification uses the server as the execution subject for description.

[0065] When stealing business models, attackers usually use the idea of ​​adversarial training to train generators and cloners, so that the trained generators can generate simulated business data that can be used to access business models, and the cloners can learn all the functions of the business models, and the accuracy of the cloners is as high as possible. Among them, accuracy refers to the accuracy of the output results of the cloner. However, adversarial training is relatively unstable, and whether training the generator or the cloner, it is necessary to obtain the output results of the business model, which results in a large number of business model accesses. Comparing the number of times normal users access the business model and the number of times attackers access the business model, it is obvious that attackers access the business model more times. Therefore, before the business model goes online, the anti-theft status of the business model can be detected based on the number of times the business model is accessed.

[0066] In one or more embodiments of the present specification, the anti-theft detection model includes a cloner and a generator. The cloner is used to clone a pre-trained business model, that is, the cloner is used to learn the functions of the pre-trained business model. The generator is used to generate simulated business data for input into the cloner. The simulated business data refers to the data generated by the generator that can be used to execute user business. The simulated business data can be the business data corresponding to the user's payment business, the business data corresponding to the user's scanning code to add friends business, and the business data corresponding to the user's after-sales business, etc. This specification does not limit the specific type of simulated business data. It should be noted that the simulated business data is generated by the generator, not the real business data. The business model is a model for executing user business, including risk prediction models, object recognition models, image segmentation models, etc. This specification does not limit the type of business model. The generator includes a convolutional neural network model.

[0067] Before the server trains the cloner and generator in the anti-theft detection model, it needs to initialize the cloner and generator according to the pre-trained business model.

[0068] Specifically, since the business model is pre-trained, the server can obtain the structure of the input data of the business model and initialize the structure of the input data of the cloner and generator according to the structure of the input data of the business model. For example, if the input data of the business model is a 30*30 image, then by adjusting the parameters of the cloner and generator, the input data of the cloner and generator is also a 30*30 image. In other words, the dimensions of the input data of the cloner and generator match the dimensions of the input data of the pre-trained business model.

[0069] In addition, in order to improve the efficiency of training the cloner and reduce the number of times the business model is accessed, a network structure that matches the network structure of the business model can be used as the network structure of the cloner. In other words, the network structure of the business model can be used as the network structure of the cloner, or a network structure that is determined to have a high degree of similarity with the network structure of the business model can be used as the network structure of the cloner. Of course, the network structure and parameters of the cloner may differ from those of the business model, but the cloner after training needs to learn the functions of the business model.

[0070] After initializing the cloner and the generator, the server can first train the generator in the anti-theft detection model.

[0071] Figure 2 The flow chart of the training generator provided for this specification is as follows: Figure 2 shown.

[0072] The server needs to first input the pre-acquired noise into the generator to obtain the first simulated service data output by the generator, wherein the noise includes Gaussian noise and the like.

[0073] S102: Input the first simulation service data into the cloner to obtain a first service result output by the cloner.

[0074] It should be noted that this specification does not limit the type of the service result. When the user's service is face authentication, the service result may be whether the face authentication is successful. When the user's service is to detect the risk of the current transaction, the service result may be the probability that the transaction has a risk. However, since the server has not trained the cloner, the service result output by the untrained cloner may be less accurate.

[0075] S104: According to the first business result and the first simulation business data, the generator is trained with the goal of improving the error rate of the first business result output by the cloner for the first simulation business data.

[0076] The server usually uses the zero-order gradient estimation method to train the generator, but the zero-order gradient estimation method requires access to the business model. When the number of accesses is certain, it will affect the training of the cloner.

[0077] Specifically, for an attacker, when the generator is trained using the zero-order gradient estimation method, the internal structure, parameters and other information of the business model cannot be obtained. Then, when the generator is trained, for one iteration of training, the attacker needs to input two simulated business data with high similarity into the business model respectively, so as to train the generator according to the two business results output by the business model. In addition, when the cloner is trained, the server also needs to use the business model once for one iteration of training. Each time the simulated business data is input into the business model, it is defined as accessing the business model once. Then, when a normal user performs a business, he may only access the business model once, while the attacker may access the business model three times for one iteration process because he needs to train the generator and the cloner. Obviously, the attacker accesses the business model more times. If the number of times the business model is allowed to be accessed is only 1,000 times, and the number of times the business model is accessed to train the cloner so that the cloner learns the function of the business model is 100,000 times, then, since the number of times the business model is allowed to be accessed is far less than the number of times required to train the cloner, the cloner may not be able to learn the function of the business model, thereby affecting the training of the cloner.

[0078] From the perspective of the business model owner, if the number of times the business model is accessed during training can be reduced, and a cloner with higher accuracy or the same accuracy as the attacker's cloner can be obtained, then the accuracy of detecting the anti-theft capability of the business model can be higher according to the number of times the business model is accessed, thereby reducing the risk of the business model being stolen. The business model owner refers to the person who designs and trains the business model. If an attacker accesses the business model 100 times to enable the cloner to learn the functions of the business model, and before the business model goes online, the business model owner uses a method that only requires 50 accesses to enable the cloner to learn the functions of the business model, then it means that the business model is at risk of being stolen if it is accessed 50 times at most, rather than 100 times, which improves the accuracy of detecting the anti-theft capability of the business model. The business model owner can also retrain the business model through the server or update the business model regularly to prevent the business model from being stolen.

[0079] In order to reduce the number of times the business model is accessed when training the anti-theft detection model, the server can train the generator only based on the first business result and the first simulated business data, with the error rate of the first business result output by the cloner for the first simulated business data as the training target, without using the output result of the business model. That is to say, when training the generator, the business model is not accessed, and the generation loss of the generator is determined based on the first business result and the first simulated business data. Based on the generation loss, the generator is trained with the error rate of the first business result output by the cloner for the first simulated business data as the training target. It should be noted that the server also needs to freeze all parameters of the cloner first to avoid the problem that the parameters of the cloner also change when the parameters of the generator are adjusted, thereby avoiding unstable training. Freezing all parameters of the cloner means fixing all parameters of the cloner so that all parameters of the cloner do not change due to changes in the parameters of the generator.

[0080] S106: Input the noise into the trained generator to obtain second simulation business data output by the trained generator.

[0081] Figure 3 The flowchart of the training cloner provided for this manual is as follows: Figure 3 shown.

[0082] In one or more embodiments of the present specification, the noise may also have a different value from the noise input to the generator before training, but the distributions of the two noises must match.

[0083] S108: Input the second simulation business data into the cloner to obtain the second business result output by the cloner; and input the second simulation business data into the business model to obtain the business result output by the business model as a label of the second business result, so as to train the cloner according to the second business result and the label.

[0084] Since all parameters of the cloner are frozen when the generator is trained, all parameters of the cloner are unfrozen and all parameters of the generator are frozen before the cloner is trained. Unfreezing all parameters of the cloner means that all parameters of the cloner can be adjusted, and freezing all parameters of the generator means fixing all parameters of the generator so that all parameters of the generator cannot change with the change of parameters of the cloner.

[0085] Since the goal of the server is to enable the cloner to learn the functions of the business model through training, the cloner can be trained through supervised learning.

[0086] Specifically, Figure 3As shown, the server inputs the second business result and the label into a preset clone loss function to obtain the clone loss of the cloner, and trains the cloner with minimizing the clone loss as the training goal. The clone loss function includes a KL divergence loss function or an absolute value loss function. If the clone loss function includes a KL divergence loss function, the clone loss function is specifically shown in the following formula:

[0087]

[0088] Among them, p is the business result output by the business model, q is the business result output by the cloner. When the business result is a probability distribution, the business result can be a K-dimensional vector, and the sum of the values ​​of all dimensions is 1. In the above formula, K is the dimension of the business result.

[0089] If the clone loss function includes the absolute value loss function, the clone loss function is specifically shown as follows:

[0090]

[0091] S110: Detecting the anti-theft capability of the business model according to the number of iterations of the cloner during the training process.

[0092] Since an attacker needs to access the business model when stealing the business model, the server can detect the anti-theft status of the business model according to the number of times the business model is accessed.

[0093] Specifically, to determine whether the cloner in the anti-theft detection model after training reaches the preset accuracy, the server can determine any one or more model accuracy indicators of the cloner's accuracy, precision, and recall rate, and determine whether the trained cloner is not less than the preset model accuracy indicator based on the cloner's model accuracy indicator. This specification does not limit the specific method for determining the model accuracy indicator, as long as it can determine whether the cloner's accuracy reaches the preset accuracy based on the model accuracy indicator.

[0094] If not, continue to train the cloner in the anti-theft detection model until the cloner in the anti-theft detection model reaches a preset accuracy.

[0095] If so, the number of iterations of the cloner during the training process is determined, and the anti-theft capability of the business model is detected according to the number of iterations of the cloner during the training process.

[0096] This is because when the attacker steals the business model, he needs to access the business model in order to train the cloner through the output of the business model so that the cloner can learn the business model. In this specification, the training generator does not need to access the business model. When training the cloner, the business model is only accessed once for each iteration. In other words, the number of iterations of the cloner during the training process can reflect the number of times the business model is accessed. Therefore, the anti-theft ability of the business model can be detected based on the number of iterations of the cloner during the training process, wherein the anti-theft ability of the business model is positively correlated with the number of iterations of the cloner during the training process. In other words, the more iterations of the cloner during the training process, the stronger the anti-theft ability of the business model.

[0097] In addition, after the business model is launched, the server can also determine whether there are attackers among all users within a preset time by determining the number of times the business model is accessed. For example, three days after the business model is launched, the average number of times the business model is accessed is 100 times, but a user has accessed it 300 times, then the user may be an attacker. The user access threshold can also be determined based on the number of iterations of the cloner during the training process. When the number of times a user accesses the business model is equal to the user access threshold, the business model is updated or retrained.

[0098] According to the number of iterations of the cloner in the training process, when the anti-theft capability of the business model is detected, if the anti-theft capability of the business model does not reach the preset target anti-theft capability, the business model is retrained. That is, when the anti-theft capability of the business model does not reach the preset target anti-theft capability, the business model is retrained. Of course, other anti-theft methods can also be used to improve the anti-theft capability of the business model, and this specification does not limit this.

[0099] based on Figure 1 The anti-theft detection method of the model shown in the figure uses the output results of the pre-trained business model to train the cloner so that the cloner clones the business functions of the business model, thereby detecting the anti-theft ability of the business model according to the number of iterations of the cloner during the training process. In addition, the method trains the generator according to the output results of the cloner and the output of the generator, and does not rely on the business model. In other words, there is no need to train the generator according to the output results of the business model, which reduces the number of times the business model is used, thereby reducing the resource overhead of training the generator.

[0100] For step S104, in order to further improve the stability of the training cloner, when training the generator, the parameters of the generator can be gradually adjusted so that the generator first generates easy-to-process simulation business data and then generates simulation business data with higher processing difficulty during the iteration process, so that the cloner gradually converges in the process of processing simulation business data with different processing difficulty. That is, according to the generation loss, the error rate of the first business result output by the cloner for the first simulation business data is used as the training target, and the generator is trained. Among them, the difficulty of the simulation business data refers to the accuracy of the business result output by the cloner for the simulation data. If the accuracy of the business result output by the cloner for the simulation data is high, it means that the difficulty of the simulation business data is low and easy to process. If the accuracy of the business result output by the cloner for the simulation data is low, it means that the difficulty of the simulation business data is high and difficult to process. The server can evaluate the difficulty of the simulation business data through the error rate of the business result output by the cloner for the simulation business data. And the error rate of the business result output by the cloner for the simulation business data can be determined by the output result of the cloner for the simulation business data. That is to say, the server can evaluate the difficulty of the simulated business data through the entropy of the simulated business data by the cloner. That is, the simulated business data is obtained, and the simulated business data is input into the cloner to obtain the business result of the simulated business data output by the cloner. The business result may be a probability distribution, and the difficulty of the simulated business data is evaluated by determining the entropy of the probability distribution. If the entropy is greater than the preset entropy, it means that the current cloner has poor ability to distinguish the simulated business data, and the difficulty of the simulated business data is relatively high. Conversely, it means that the current cloner has good ability to distinguish, and the difficulty of the simulated business data is relatively low.

[0101] In order to gradually adjust the parameters of the generator so that the generator first generates easy-to-process simulation business data and then generates simulation business data that is more difficult to process during the iteration process, the server can first determine the current number of iterations of the generator, and then determine the dynamic adjustment difficulty parameter based on the current number of iterations and the preset total number of iterations, wherein the dynamic adjustment difficulty parameter increases as the current number of iterations increases. Then, based on the dynamic adjustment difficulty parameter, determine the generation loss function of the generator. Finally, based on the first business result, the first simulation business data and the generation loss function, determine the generation loss of the generator, and train the generator based on the generation loss.

[0102] This specification provides a formula for determining the dynamic adjustment difficulty parameter, as shown below:

[0103]

[0104] Among them, iterations is the preset total number of iterations of the generator, and t is the current number of iterations of the generator. As the number of iterations increases, the dynamic parameter changes from -1 to 1 as a whole, but because the dynamically adjusted difficulty parameter also includes a cosine function, during the iteration process within a certain range, the dynamically adjusted difficulty parameter will increase and then decrease, but overall it makes the difficulty of the simulation business data generated by the generator change from simple to difficult.

[0105] The generation loss function of the generator is:

[0106]

[0107] Among them, q is the business result output by the cloner, and K is the dimension of the business result q.

[0108] Then, for the subsequent steps S106 to S108, when training the cloner, the difficulty of inputting the simulated business data of the cloner is increasing. The server can adjust the parameters of the generator once in one iteration, and then train the cloner based on the generator after adjusting the parameters once. The generator can also be iterated a preset number of times, that is, the parameters of the generator are adjusted multiple times, and then the cloner is trained based on the multiple adjusted parameters of the generator. This manual does not limit this, and it can be set according to needs.

[0109] The above is a model anti-theft detection method provided by one or more embodiments of this specification. Based on the same idea, this specification also provides a corresponding model anti-theft detection device, such as Figure 4 shown.

[0110] Figure 4 This specification provides a schematic diagram of an anti-theft detection device for a model, the anti-theft detection model includes a cloner and a generator, the cloner is used to clone a pre-trained business model, the generator is used to generate simulated business data input to the cloner, the device includes:

[0111] A first simulation service data acquisition module 400, configured to input the pre-acquired noise into the generator to obtain the first simulation service data output by the generator;

[0112] A first business result acquisition module 402, configured to input the first simulation business data into the cloner to obtain a first business result output by the cloner;

[0113] A generator training module 404, configured to train the generator according to the first business result and the first simulation business data, with the aim of improving the error rate of the first business result output by the cloner for the first simulation business data as a training target;

[0114] A second simulation service data acquisition module 406, configured to input the noise into the trained generator to obtain second simulation service data output by the trained generator;

[0115] The cloner training module 408 is used to input the second simulation business data into the cloner to obtain the second business result output by the cloner; and input the second simulation business data into the business model to obtain the business result output by the business model as a label of the second business result, so as to train the cloner according to the second business result and the label;

[0116] The detection module 410 is used to detect the anti-theft capability of the business model according to the number of iterations of the cloner during the training process.

[0117] Optionally, the generator training module 404 is specifically used to freeze all parameters of the cloner; and determine the generation loss of the generator based on the first business result and the first simulation business data; and train the generator based on the generation loss with the training goal of improving the error rate of the first business result output by the cloner for the first simulation business data.

[0118] Optionally, the generator training module 404 is specifically used to determine a dynamically adjusted difficulty parameter based on the current number of iterations and a preset total number of iterations, wherein the dynamically adjusted difficulty parameter increases with an increase in the current number of iterations; determine a generation loss function of the generator based on the dynamically adjusted difficulty parameter; and determine the generation loss of the generator based on the first business result, the first simulation business data and the generation loss function.

[0119] Optionally, the cloner training module 408 is specifically used to unfreeze all parameters of the cloner and freeze all parameters of the generator; input the second business result and the label into a preset cloning loss function to obtain the cloning loss of the cloner; and train the unfrozen cloner according to the cloning loss.

[0120] Optionally, the cloning loss function includes a KL divergence loss function or an absolute value loss function.

[0121] Optionally, the detection module 410 is specifically used to determine whether the cloner in the anti-theft detection model after training reaches a preset accuracy; if not, continue to train the cloner in the anti-theft detection model until the cloner in the anti-theft detection model reaches a preset accuracy; if so, determine the number of iterations of the cloner in the training process, and detect the anti-theft capability of the business model based on the number of iterations of the cloner in the training process.

[0122] Optionally, the anti-theft capability of the business model is positively correlated with the number of iterations of the cloner during the training process.

[0123] Optionally, the device further comprises:

[0124] The business model retraining module is used to retrain the business model when the anti-theft capability of the business model does not reach a preset target anti-theft capability.

[0125] This specification also provides a computer-readable storage medium, which stores a computer program, which can be used to execute the above Figure 1 The anti-theft detection method of the provided model.

[0126] This manual also provides Figure 5 The structural diagram of the electronic device shown in FIG. Figure 5 As shown in the figure, at the hardware level, the unmanned driving device includes a processor, an internal bus, a network interface, a memory, and a non-volatile memory, and may also include other hardware required for the business. The processor reads the corresponding computer program from the non-volatile memory into the memory and then runs it to achieve the above Figure 1 Of course, in addition to the software implementation, this specification does not exclude other implementations, such as logic devices or a combination of software and hardware, etc., that is, the execution subject of the following processing flow is not limited to each logic unit, but can also be hardware or logic devices.

[0127] In the 1990s, improvements to a technology could be clearly distinguished as hardware improvements (for example, improvements to the circuit structure of diodes, transistors, switches, etc.) or software improvements (improvements to the method flow). However, with the development of technology, many improvements to the method flow today can be regarded as direct improvements to the hardware circuit structure. Designers almost always obtain the corresponding hardware circuit structure by programming the improved method flow into the hardware circuit. Therefore, it cannot be said that an improvement in a method flow cannot be implemented using a hardware entity module. For example, a programmable logic device (PLD) (such as a field programmable gate array (FPGA)) is such an integrated circuit whose logical function is determined by the user's programming of the device. Designers can "integrate" a digital system on a PLD by programming it themselves, without having to ask a chip manufacturer to design and produce a dedicated integrated circuit chip. Moreover, nowadays, instead of manually making integrated circuit chips, this kind of programming is mostly implemented by "logic compiler" software, which is similar to the software compiler used when developing and writing programs, and the original code before compilation must also be written in a specific programming language, which is called hardware description language (HDL). There is not only one HDL, but many kinds, such as ABEL (Advanced Boolean Expression Language), AHDL (Altera Hardware Description Language), Confluence, CUPL (Cornell University Programming Language), HDCal, JHDL (Java Hardware Description Language), Lava, Lola, MyHDL, PALASM, RHDL (Ruby Hardware Description Language), etc. The most commonly used ones are VHDL (Very-High-Speed ​​Integrated Circuit Hardware Description Language) and Verilog. Those skilled in the art should also know that it is only necessary to program the method flow slightly in the above-mentioned hardware description languages ​​and program it into the integrated circuit, and then it is easy to obtain the hardware circuit that implements the logic method flow.

[0128] The controller can be implemented in any appropriate manner, for example, the controller can take the form of a microprocessor or processor and a computer-readable medium storing a computer-readable program code (such as software or firmware) that can be executed by the (micro)processor, a logic gate, a switch, an application-specific integrated circuit (ASIC), a programmable logic controller, and an embedded microcontroller. Examples of controllers include, but are not limited to, the following microcontrollers: ARC 625D, Atmel AT91SAM, Microchip PIC18F26K20, and Silicone Labs C8051F320. The memory controller can also be implemented as part of the control logic of the memory. Those skilled in the art also know that in addition to implementing the controller in a purely computer-readable program code manner, the controller can be implemented in the form of a logic gate, a switch, an application-specific integrated circuit, a programmable logic controller, and an embedded microcontroller by logically programming the method steps. Therefore, this controller can be considered as a hardware component, and the devices included therein for implementing various functions can also be regarded as structures within the hardware component. Or even, the devices for implementing various functions can be regarded as both software modules for implementing the method and structures within the hardware component.

[0129] The systems, devices, modules or units described in the above embodiments may be implemented by computer chips or entities, or by products with certain functions. A typical implementation device is a computer. Specifically, the computer may be, for example, a personal computer, a laptop computer, a cellular phone, a camera phone, a smart phone, a personal digital assistant, a media player, a navigation device, an email device, a game console, a tablet computer, a wearable device, or a combination of any of these devices.

[0130] For the convenience of description, the above device is described in various units according to their functions. Of course, when implementing this specification, the functions of each unit can be implemented in the same or multiple software and / or hardware.

[0131] Those skilled in the art will appreciate that embodiments of the present invention may be provided as methods, systems, or computer program products. Therefore, the present invention may take the form of a complete hardware embodiment, a complete software embodiment, or an embodiment combining software and hardware. Moreover, the present invention may take the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0132] The present invention is described with reference to flowcharts and / or block diagrams of methods, devices (systems), and computer program products according to embodiments of the present invention. It should be understood that each process and / or block in the flowchart and / or block diagram, as well as the combination of processes and / or blocks in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing device to produce a machine, so that the instructions executed by the processor of the computer or other programmable data processing device generate instructions for implementing the processes in the flowchart and / or block diagram. Figure 1 A process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.

[0133] These computer program instructions may also be stored in a computer-readable memory capable of directing a computer or other programmable data processing device to operate in a specific manner, so that the instructions stored in the computer-readable memory produce an article of manufacture comprising an instruction device, which implements the process Figure 1 A process or multiple processes and / or boxes Figure 1 A function specified in one or more boxes.

[0134] These computer program instructions can also be loaded onto a computer or other programmable data processing device so that a series of operating steps are executed on the computer or other programmable device to produce a computer-implemented process, thereby providing instructions for implementing the process. Figure 1 A process or multiple processes and / or boxes Figure 1 The steps for the functions specified in one or more boxes.

[0135] In a typical configuration, a computing device includes one or more processors (CPU), input / output interfaces, network interfaces, and memory.

[0136] The memory may include non-permanent storage in a computer-readable medium, random access memory (RAM) and / or non-volatile memory in the form of read-only memory (ROM) or flash RAM. The memory is an example of a computer-readable medium.

[0137] Computer readable media include permanent and non-permanent, removable and non-removable media that can be implemented by any method or technology to store information. Information can be computer readable instructions, data structures, program modules or other data. Examples of computer storage media include, but are not limited to, phase change memory (PRAM), static random access memory (SRAM), dynamic random access memory (DRAM), other types of random access memory (RAM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), flash memory or other memory technology, compact disk read-only memory (CD-ROM), digital versatile disk (DVD) or other optical storage, magnetic cassettes, magnetic tape magnetic disk storage or other magnetic storage devices or any other non-transmission media that can be used to store information that can be accessed by a computing device. As defined herein, computer readable media does not include temporary computer readable media (transitory media), such as modulated data signals and carrier waves.

[0138] It should also be noted that the terms "include", "comprises" or any other variations thereof are intended to cover non-exclusive inclusion, so that a process, method, commodity or device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, commodity or device. In the absence of more restrictions, the elements defined by the sentence "comprises a ..." do not exclude the existence of other identical elements in the process, method, commodity or device including the elements.

[0139] Those skilled in the art will appreciate that the embodiments of this specification may be provided as methods, systems or computer program products. Therefore, this specification may take the form of a complete hardware embodiment, a complete software embodiment or an embodiment combining software and hardware. Moreover, this specification may take the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0140] This specification may be described in the general context of computer-executable instructions executed by a computer, such as program modules. Generally, program modules include routines, programs, objects, components, data structures, etc. that perform specific tasks or implement specific abstract data types. This specification may also be practiced in distributed computing environments where tasks are performed by remote processing devices connected through a communication network. In a distributed computing environment, program modules may be located in local and remote computer storage media, including storage devices.

[0141] Each embodiment in this specification is described in a progressive manner, and the same or similar parts between the embodiments can be referred to each other, and each embodiment focuses on the differences from other embodiments. In particular, for the system embodiment, since it is basically similar to the method embodiment, the description is relatively simple, and the relevant parts can be referred to the partial description of the method embodiment.

[0142] The above description is only an embodiment of this specification and is not intended to limit this specification. For those skilled in the art, this specification may have various changes and variations. Any modification, equivalent replacement, improvement, etc. made within the spirit and principle of this specification should be included in the scope of the claims of this application.

Claims

1. A method for detecting theft of a model, wherein the anti-theft detection model comprises a cloner and a generator, wherein the cloner is used to clone a pre-trained business model, and the generator is used to generate simulated business data input into the cloner, and the method comprises: Inputting the pre-acquired noise into the generator to obtain the first simulated service data output by the generator; Inputting the first simulation service data into the cloner to obtain a first service result output by the cloner; According to the first business result and the first simulation business data, the generator is trained with the goal of improving the error rate of the first business result output by the cloner for the first simulation business data; Inputting the noise into a trained generator to obtain second simulation service data output by the trained generator; Inputting the second simulation service data into the cloner to obtain a second service result output by the cloner; and inputting the second simulation business data into the business model to obtain a business result output by the business model as a label of the second business result, so as to train the cloner according to the second business result and the label; The anti-theft capability of the business model is detected according to the number of iterations of the cloner during the training process.

2. The method according to claim 1, training the generator according to the first business result and the first simulation business data with the aim of improving the error rate of the first business result output by the cloner for the first simulation business data as a training target, specifically comprising: Freeze all parameters of said cloner; and determining a generation loss of the generator according to the first business result and the first simulation business data; The generator is trained according to the generation loss with the training target of improving the error rate of the first business result output by the cloner for the first simulation business data.

3. The method according to claim 2, determining the generation loss of the generator according to the first business result and the first simulation business data, specifically comprising: determining a current iteration number of the generator; Determining a dynamically adjusted difficulty parameter according to the current number of iterations and a preset total number of iterations, wherein the dynamically adjusted difficulty parameter increases as the current number of iterations increases; Determining a generation loss function of the generator according to the dynamically adjusted difficulty parameter; The generation loss of the generator is determined according to the first business result, the first simulation business data and the generation loss function.

4. The method according to claim 2, training the cloner according to the second business result and the label, specifically comprising: unfreeze all parameters of the cloner and freeze all parameters of the generator; Inputting the second business result and the label into a preset cloning loss function to obtain the cloning loss of the cloner; The thawed cloner is trained according to the clone loss.

5. The method according to claim 4, wherein the cloning loss function comprises a KL divergence loss function or an absolute value loss function.

6. The method according to claim 1, detecting the anti-theft capability of the business model according to the number of iterations of the cloner during the training process, specifically comprising: Determining whether the cloner in the trained anti-theft detection model reaches a preset accuracy; If not, continue to train the cloner in the anti-theft detection model until the cloner in the anti-theft detection model reaches a preset accuracy; If so, the number of iterations of the cloner during the training process is determined, and the anti-theft capability of the business model is detected according to the number of iterations of the cloner during the training process.

7. According to the method of claim 1, the anti-theft capability of the business model is positively correlated with the number of iterations of the cloner during the training process.

8. The method of claim 7, further comprising: When the anti-theft capability of the business model does not reach a preset target anti-theft capability, the business model is retrained.

9. A device for detecting theft of a model, wherein the device comprises a cloner and a generator, wherein the cloner is used to clone a pre-trained business model, and the generator is used to generate simulated business data input into the cloner, and wherein the device comprises: A first simulation service data acquisition module, used for inputting the pre-acquired noise into the generator to obtain the first simulation service data output by the generator; A first business result acquisition module, used for inputting the first simulation business data into the cloner to obtain a first business result output by the cloner; A generator training module, configured to train the generator according to the first business result and the first simulation business data, with the aim of improving the error rate of the first business result output by the cloner for the first simulation business data as a training target; A second simulation business data acquisition module, used for inputting the noise into the trained generator to obtain second simulation business data output by the trained generator; a cloner training module, configured to input the second simulated business data into the cloner to obtain a second business result output by the cloner; and input the second simulated business data into the business model to obtain a business result output by the business model as a label of the second business result, so as to train the cloner according to the second business result and the label; The detection module is used to detect the anti-theft capability of the business model according to the number of iterations of the cloner during the training process.

10. In the device as described in claim 9, the generator training module is specifically used to freeze all parameters of the cloner; and determine the generation loss of the generator based on the first business result and the first simulation business data; based on the generation loss, the generator is trained with the training goal of improving the error rate of the first business result output by the cloner for the first simulation business data.

11. The apparatus according to claim 10, wherein the generator training module is specifically used to determine the current iteration number of the generator; and determine the dynamic adjustment difficulty parameter according to the current iteration number and the preset total iteration number, wherein: The dynamically adjusted difficulty parameter increases as the current number of iterations increases; based on the dynamically adjusted difficulty parameter, the generation loss function of the generator is determined; based on the first business result, the first simulation business data and the generation loss function, the generation loss of the generator is determined.

12. In the device as described in claim 10, the cloner training module is specifically used to unfreeze all parameters of the cloner and freeze all parameters of the generator; input the second business result and the label into a preset cloning loss function to obtain the cloning loss of the cloner; and train the unfrozen cloner according to the cloning loss.

13. The apparatus as claimed in claim 12, wherein the cloning loss function comprises a KL divergence loss function or an absolute value loss function.

14. In the device as described in claim 9, the detection module is specifically used to determine whether the cloner in the anti-theft detection model after training reaches a preset accuracy; if not, continue to train the cloner in the anti-theft detection model until the cloner in the anti-theft detection model reaches a preset accuracy; if so, determine the number of iterations of the cloner in the training process, and detect the anti-theft capability of the business model based on the number of iterations of the cloner in the training process.

15. The device as claimed in claim 9, wherein the anti-theft capability of the business model is positively correlated with the number of iterations of the cloner in the training process.

16. The apparatus of claim 9, further comprising: The business model retraining module is used to retrain the business model when the anti-theft capability of the business model does not reach a preset target anti-theft capability.

17. A computer-readable storage medium storing a computer program, wherein the computer program, when executed by a processor, implements the method according to any one of claims 1 to 8.

18. An electronic device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor implements the method according to any one of claims 1 to 8 when executing the program.

Images