Method, system, device and storage medium for defending against model theft attacks

Abstract

The present application relates to a method, system, device and storage medium for defending against model theft attacks, the method comprising: obtaining input data to be input into the original model, using a pre-trained detector to detect whether the input data is malicious query data, if the input data is detected to be malicious query data, inputting the input data into a pre-trained sampler to obtain a random output result of the input data, the random output result is a pseudo-random output, if the input data is detected to be non-malicious query data, inputting the input data into the original model to obtain a true output result of the input data. The present application can ensure that the random output result does not leak the information of the original model, and the attacker or thief cannot distinguish whether the output has been modified, and does not affect the normal query operation of the model while preventing the model from being stolen.

Description

Technical Field

[0001] The present application relates to the field of computer technology, and in particular to a method, system, device and storage medium for defending against model theft attacks. Background Art

[0002] At present, there are two main defense technologies against model stealing attacks: static defense mechanism and perturbation-based defense mechanism. Static defense mechanism generally reduces the output of the model, such as limiting the output to a certain label. This mechanism will affect the normal query of users. The perturbation-based defense mechanism destroys the model stealing process by returning disturbed query results to malicious queryers. However, in this mechanism, the label returned by the model depends on the real label. This dependence will leak information about the real label and may be offset by an adaptable attacker, thereby reducing the effectiveness of the defense.

[0003] Therefore, how to improve the security of the model without affecting the normal query of users has become a technical problem that needs to be solved urgently by technical personnel in this field. Summary of the invention

[0004] In view of the above, the present application provides a method, system, device and storage medium for defending against model theft attacks, which aims to solve the above technical problems.

[0005] In a first aspect, the present application provides a method for defending against model theft attacks, the method comprising:

[0006] Obtaining input data to be input into the original model;

[0007] Using a pre-trained detector, detecting whether the input data is malicious query data;

[0008] If the input data is detected to be malicious query data, the input data is input into a pre-trained sampler to obtain a random output result of the input data, where the random output result is a pseudo-random output;

[0009] If the input data is detected to be non-malicious query data, the input data is input into the original model to obtain a true output result of the input data.

[0010] In a second aspect, the present application provides a system for defending against model theft attacks, the system comprising:

[0011] Acquisition module: used to obtain input data to be input into the original model;

[0012] Detection module: used to detect whether the input data is malicious query data using a pre-trained detector;

[0013] Random output module: used for inputting the input data into a pre-trained sampler to obtain a random output result of the input data if the input data is detected to be malicious query data, and the random output result is a pseudo-random output;

[0014] A true output module is used to input the input data into the original model to obtain a true output result of the input data if the input data is detected to be non-malicious query data.

[0015] In a third aspect, the present application provides an electronic device, including a processor, a communication interface, a memory and a communication bus, wherein the processor, the communication interface and the memory communicate with each other via the communication bus;

[0016] Memory, used to store computer programs;

[0017] The processor is used to implement the method of defending against model theft attacks as described in any one of the embodiments of the first aspect when executing a program stored in the memory.

[0018] In a fourth aspect, a computer-readable storage medium is provided, on which a computer program is stored. When the computer program is executed by a processor, the method for defending against model theft attacks as described in any embodiment of the first aspect is implemented.

[0019] The above technical solution provided by the embodiment of the present application has the following advantages compared with the prior art:

[0020] The present application can accurately detect whether the input data is malicious query data. If the input data is malicious query data, the input data is input into the sampler to obtain a pseudo-random output of the input data, so that the random output result will not leak the information of the original model, and the attacker or thief cannot distinguish whether the output has been modified. Since in the perturbation-based defense method of the prior art, the label returned by the model depends on the real label, this dependence will leak information about the real label, and may be offset by the perturbation of an adaptable attacker to reduce the effectiveness of the defense. Therefore, compared with the prior art, the present application can further improve the security of the model to prevent the model from being stolen and attacked. If the input data is non-malicious query data, the input data is directly input into the original model to obtain the real output result of the input data. While preventing the model from being stolen and attacked, it does not affect the normal query operation of the model. BRIEF DESCRIPTION OF THE DRAWINGS

[0021] The accompanying drawings, which are incorporated in and constitute a part of this specification, illustrate embodiments consistent with the present application and, together with the description, serve to explain the principles of the present application.

[0022] In order to more clearly illustrate the embodiments of the present application or the technical solutions in the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, for ordinary technicians in this field, other drawings can be obtained based on these drawings without paying any creative labor.

[0023] Figure 1 A flowchart of an embodiment of a method for defending against model theft attacks in this application;

[0024] Figure 2 A schematic diagram of a module of an embodiment of a system for defending against model theft attacks in this application;

[0025] Figure 3 A schematic diagram of an electronic device embodiment of the present application;

[0026] The realization of the purpose, functional features and advantages of this application will be further explained in conjunction with embodiments and with reference to the accompanying drawings. DETAILED DESCRIPTION

[0027] In order to make the purpose, technical solution and advantages of the embodiments of the present application clearer, the technical solution in the embodiments of the present application will be clearly and completely described below in conjunction with the drawings in the embodiments of the present application. Obviously, the described embodiments are part of the embodiments of the present application, not all of the embodiments. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in this field without making creative work are within the scope of protection of this application.

[0028] The disclosure below provides many different embodiments or examples to realize the different structures of the present application. In order to simplify the disclosure of the present application, the parts and settings of specific examples are described below. Of course, they are only examples, and the purpose is not to limit the present application. In addition, the present application can repeat reference numbers and / or letters in different examples. This repetition is for the purpose of simplification and clarity, and does not itself indicate the relationship between the various embodiments and / or settings discussed.

[0029] This application provides a method for defending against model theft attacks. Figure 1 , which is a flow chart of an embodiment of the method for defending against model theft attacks of the present application. The method can be executed by an electronic device, and the electronic device can be implemented by software and / or hardware. The method for defending against model theft attacks includes:

[0030] Step S10: obtaining input data to be input into the original model;

[0031] Step S20: using a pre-trained detector to detect whether the input data is malicious query data;

[0032] Step S30: if the input data is detected to be malicious query data, the input data is input into a pre-trained sampler to obtain a random output result of the input data, where the random output result is a pseudo-random output;

[0033] Step S40: If the input data is detected to be non-malicious query data, the input data is input into the original model to obtain a true output result of the input data.

[0034] In this embodiment, the original model refers to the model before the defense strategy is added (also called the victim model). Let the victim model be f M :R n →R k , R b represents the n-dimensional real number space, that is, the input space, R k represents the k-dimensional real number space, i.e., the output space. M Defines the specific mapping rules from input space to output space, that is, given an n-dimensional input vector, the function will calculate and return a k-dimensional output vector. Defense Model It represents the victim model after adding the defense strategy g. Adding the defense strategy means adding the classifier and sampler. It should be noted that in practical applications, the victim model can be a neural network model in the fields of image recognition, text recognition, speech recognition, etc., and the specific function of the victim model is not limited here.

[0035] This embodiment proposes a defense framework F with a detector and a sampler. Let f M :R n →R k is the victim model, which is trained using a dataset sampled from distribution D and has an output distribution D M , defense mechanism The construction includes: initializing the detector and initializing the sampler. When receiving a query request (query, x), the detector executes D.detct(x) and returns a bit b. If b = 0, the sampler is called and the returned result y' is received; if b = 1, the query x is sent to the victim model f. M And receive the result y = f M (x), output (b,y) and return the result y to the inquirer.

[0036] Since the input data may be malicious query data, it is necessary to identify the input data before it is input into the victim model. After obtaining the input data to be input into the original model, a pre-trained detector is used to detect whether the input data is malicious query data, so as to determine whether the input data is an input query of a thief or attacker.

[0037] If the input data is detected as non-malicious query data, it means that the input data is not an input query of a thief or attacker. Therefore, the input data can be directly input into the original model to obtain the true output result of the input data and return it.

[0038] If the input data is detected to be malicious query data, it means that the input data is the input query of a thief or attacker. At this time, the input data is input into a pre-trained sampler to obtain a random output result of the input data. The output result is pseudo-random output, ensuring that the output result returned for the detected malicious query is completely independent of the real result. The thief or attacker cannot determine whether the returned output result has been modified, and avoids the situation where the thief or attacker recovers the real output result from the pseudo-random output, thereby improving the security of the original model.

[0039] Specifically, using a pre-trained detector to detect whether the input data is malicious query data includes:

[0040] Determine whether the input data belongs to data with the same distribution as the sample data set used to train the original model;

[0041] If yes, input the input data to the detector to obtain a first detection result that satisfies a first condition, wherein the first detection result indicates that the input data is non-malicious query data;

[0042] If not, the input data is input into the detector to obtain a second detection result that satisfies a second condition, wherein the second detection result indicates that the input data is malicious query data.

[0043] Assume that the stealer or attacker A is an arbitrary probabilistic algorithm, which can at most Perform q adaptive black-box queries and output the query pairs If the following first and second conditions are met, it is called a defense model Model stealing defense function with correctness and detectability, for any input x∈D, Output (1, y) with probability at least ∈1, so that y = f M (x), the formula of the first condition includes:

[0044]

[0045] Among them, Pr represents probability, represents the defense model after adding the defense strategy to the original model, f Mrepresents the original model, D represents the distribution of the sample data set used to train the original model, x represents the input data, y represents the output of the original model, ∈1 represents the first preset probability, and the closer the value of the first preset probability is to 1, the better.

[0046] For any input Output (0, y) with a probability of at least ∈2. The formula for the second condition includes:

[0047]

[0048] Among them, Pr represents probability, represents the defense model after the defense strategy is added to the original model, D represents the distribution of the sample data set used to train the original model, x represents the input data, y represents the output of the original model, ∈2 represents the second preset probability, and the closer the value of the second preset probability is to 1, the better.

[0049] To further improve the security of the model, the random output results cannot leak information about the original model. n , y∈R, if When y′ satisfies the following third condition, the random output result can be obtained without leaking the information of the original model. The third condition formula includes:

[0050] Pr[f M (x) = y|(x,y′)] = Pr[f M (x) = y|x]

[0051] Among them, Pr represents probability, f M represents the original model, x represents the input data, y represents the output of the original model, and f M (x) is the correct output generated by the original model, and y′ represents the output of the defense model after the defense strategy is added to the original model, that is, the random output result.

[0052] For a given The derivation process includes the following:

[0053]

[0054] In the derivation from (1) to (2), we use the fact that y′ is uniformly randomly selected from the sampler, so the random output y′ is independent of x and f M(x), so that the random output result will not leak the information of the original model. Since the labels returned by the model in the prior art perturbation-based defense method are dependent on the true labels, this dependence will leak information about the true labels, so it may be offset by an adaptable attacker to reduce the effectiveness of the defense. Compared with the prior art, the present application can further improve the security of the model.

[0055] The present application can also make it impossible for a thief or attacker to distinguish whether the obtained output result is a true output result, so that the correct output result and the random output result meet the fourth condition, and the random output result can be made indistinguishable. The formula of the fourth condition includes:

[0056]

[0057] Among them, R k represents the k-dimensional real number space, Pr represents probability, D M represents f M The distribution of output labels, f M represents the original model, represents the distribution of the output labels of the defense model after the defense strategy is added to the original model, D M and The upper bound of the statistical distance between them is ∈3, where ∈3 represents the third preset probability. The closer the value of the third preset probability is to 0, the better.

[0058] In one embodiment, the detector is trained based on a convolutional neural network, and the sampler is trained based on a conditional generative adversarial network. The detector is used to identify whether the input data is a potential malicious query, and the sampler is used to simulate the distribution of the real output results of the victim model and generate random forged random output results.

[0059] The detector can be a multi-classification detector. The detector is a tuple of two algorithms (init1, detect). The initialization algorithm init1 trains the detector by using the distribution D as input. The detection algorithm detect takes as input a sample x∈R and outputs 1 with a probability of at least ∈1 if x∈D and outputs 1 with a probability of at least ∈1 if Then the output is 0 with a probability of at least ∈2. When training the detector, we first reconstruct different sets of attack strategies. And the corresponding query dataset {Q1,…,Q m}, assuming that the defender knows these attack strategies in advance to obtain its dataset, use a deep convolutional neural network to train an (m+1)-class classification detector E, where m represents the number of attack strategies, let Q0 represent the dataset used to train the victim model, and each Q iThe samples in are all labeled as i, and the labeled inputs are Q0,…,Q m Used to train detector E. The trained detector can be used to identify whether the input data of attackers and stealers is normal query data or malicious query data.

[0060] The sampler S is a tuple of two algorithms (init2, sample). The initialization algorithm init2 converts a distribution D M As input, and output a distribution So that both satisfy:

[0061]

[0062] The sampling algorithm sample does not require any input and only outputs a label uniformly and randomly. That is, the sampler is intended to generate probability distributions of various class labels to simulate the real output of the victim model. This embodiment uses a conditional generative adversarial network (cGAN) with a slightly adjusted structure to train the sampler. Since it is necessary to satisfy the constraint that the sum of all values ​​of the generated vector must be equal to 1, a softmax activation layer is added at the end for the cGAN used so that the output of the cGAN satisfies the constraint that the sum of all values ​​of the generated vector must be equal to 1. At the same time, cGAN is used to avoid the mode collapse problem of only generating part of the class labels. In the training phase, the real output of the victim model is used as the training data set of cGAN, and each output vector is marked as the corresponding class label. Then, the architecture of the generator network and the discriminator network is defined. The input of the generator includes a random potential vector and a class label, and the generated pseudo output vector is output. The input of the discriminator is the pseudo output generated by the generator and the real output of the victim model, and the output is the probability that the vector is judged to be true or false. The loss function of cGAN is composed of the generator loss and the discriminator loss. The generator loss includes the authenticity of the generated sample and the consistency between the generated sample and the conditional label. The discriminator loss includes the ability to distinguish between generated samples and real samples.

[0063] The training process of cGAN is an alternating optimization process. In each training step, the discriminator is first fixed, and the parameters of the generator are updated to minimize the generator loss. Then the generator is fixed and the parameters of the discriminator are updated to minimize the discriminator loss. Optimization algorithms such as gradient descent can be used to update parameters. The generator and discriminator are trained alternately until the predetermined number of training iterations is reached or the losses of the generator and discriminator converge. After training, the generator network can be used as a pseudo output sampler to simulate the real output of the victim model.

[0064] When an input data xr When the detector identifies the query data as malicious, the sampler will be called and a target label l will be uniformly randomly selected from [1, k]. y , and randomly sample a latent vector z from the latent space. The choice of these two values ​​is independent of x r And the correct result f M (x r ). Then use the generator G based on this randomly selected target label l y and randomly sampled latent vector z to generate a fake soft label y'=G(z;l y ), the soft label is close to the normal category probability distribution output by the victim model in distribution, making it impossible for the attacker to determine whether the returned label has been tampered with.

[0065] The present application proposes multiple conditions regarding model security, namely correctness, detectability, security and indistinguishability, and clearly defines these conditions, which can accurately detect whether the input data is malicious query data. If the input data is malicious query data, the input data is input into the sampler to obtain a pseudo-random output of the input data, so that the random output result does not leak the information of the original model, and the attacker or thief cannot distinguish whether the output has been modified. Since in the perturbation-based defense method of the prior art, the label returned by the model depends on the real label, this dependence will leak information about the real label, and may be offset by an adaptable attacker to reduce the effectiveness of the defense. Therefore, compared with the prior art, the present application can further improve the security of the model. If the input data is non-malicious query data, the input data is directly input into the original model to obtain the real output result of the input data, which does not affect the normal query operation of the model.

[0066] Reference Figure 2 , which is a schematic diagram of the functional modules of the system 100 for defending against model theft attacks in the present application.

[0067] The system 100 for preventing a model from being stolen and attacked described in the present application can be installed in an electronic device. According to the functions implemented, the system 100 for preventing a model from being stolen and attacked can include an acquisition module 110, a detection module 120, a random output module 130, and a real output module 140. The module described in the present application can also be referred to as a unit, which refers to a series of computer program segments that can be executed by an electronic device processor and can complete fixed functions, which are stored in the memory of the electronic device.

[0068] In this embodiment, the functions of each module / unit are as follows:

[0069] Acquisition module 110: used to acquire input data to be input into the original model;

[0070] Detection module 120: used to detect whether the input data is malicious query data using a pre-trained detector;

[0071] The random output module 130 is used for inputting the input data into a pre-trained sampler to obtain a random output result of the input data if the input data is detected to be malicious query data, and the random output result is a pseudo-random output;

[0072] The real output module 140 is used to input the input data into the original model to obtain the real output result of the input data if the input data is detected to be non-malicious query data.

[0073] In one embodiment, the detecting whether the input data is malicious query data by using a pre-trained detector includes:

[0074] Determine whether the input data belongs to data with the same distribution as the sample data set used to train the original model;

[0075] If yes, input the input data to the detector to obtain a first detection result that satisfies a first condition, wherein the first detection result indicates that the input data is non-malicious query data;

[0076] If not, the input data is input into the detector to obtain a second detection result that satisfies a second condition, wherein the second detection result indicates that the input data is malicious query data.

[0077] In one embodiment, the formula of the first condition includes:

[0078]

[0079] Among them, Pr represents probability, represents the defense model after adding the defense strategy to the original model, f M represents the original model, D represents the distribution of the sample data set used to train the original model, x represents the input data, y represents the output of the original model, and ∈1 represents the first preset probability.

[0080] In one embodiment, the formula of the second condition includes:

[0081]

[0082] Among them, Pr represents probability, represents the defense model after the defense strategy is added to the original model, D represents the distribution of the sample data set used to train the original model, x represents the input data, y represents the output of the original model, and ∈2 represents the second preset probability.

[0083] In one embodiment, the random output result satisfies the formula of the third condition, and the formula of the third condition includes:

[0084] Pr[f M (x) = y|(x,y′)] = Pr[f M (x) = y|x]

[0085] Among them, Pr represents probability, f M represents the original model, x represents the input data, y represents the output of the original model, and y′ represents the output of the defense model after the defense strategy is added to the original model.

[0086] In one embodiment, the correct output result and the random output result satisfy a fourth condition, and the formula of the fourth condition includes:

[0087]

[0088] Among them, R k represents the k-dimensional real number space, Pr represents probability, D M represents f M The distribution of output labels, f M represents the original model, represents the distribution of the output labels of the defense model after the defense strategy is added to the original model, D M and The upper bound of the statistical distance between them is ∈3, where ∈3 represents the third preset probability.

[0089] In one embodiment, the detector is trained based on a convolutional neural network, and the sampler is trained based on a conditional generative adversarial network.

[0090] Reference Figure 3 , which is a schematic diagram of a preferred embodiment of the electronic device of the present application.

[0091] The electronic device includes a processor 111, a communication interface 112, a memory 113 and a communication bus 114, wherein the processor 111, the communication interface 112, and the memory 113 communicate with each other via the communication bus 114;

[0092] The memory 113 is used to store computer programs, for example, programs for preventing models from being stolen and attacked;

[0093] Among them, the processor 111 can be a central processing unit (CPU), a controller, a microcontroller, a microprocessor, or other data processing chips in some embodiments. The processor 111 is generally used to control the overall operation of the electronic device, such as performing control and processing related to data interaction or communication. In this embodiment, the processor 111 is used to run the program code stored in the memory 113 or process data, such as running the program code of the program that defends the model from being stolen and attacked.

[0094] The communication interface 112 may optionally include a standard wired interface, a wireless interface (such as a WI-FI interface), and the communication interface 112 may also be used to establish a communication connection between the electronic device and other electronic devices.

[0095] The memory 113 includes at least one type of readable storage medium, and the readable storage medium includes flash memory, hard disk, multimedia card, card-type memory (for example, SD or DX memory, etc.), random access memory (RAM), static random access memory (SRAM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), programmable read-only memory (PROM), magnetic memory, disk, optical disk, etc. In some embodiments, the memory 113 can be an internal storage unit of the electronic device, such as a hard disk or memory of the electronic device. In other embodiments, the memory 113 can also be an external storage device of the electronic device, such as a plug-in hard disk equipped with the electronic device, a smart memory card (Smart Media Card, SMC), a secure digital (Secure Digital, SD) card, a flash card (Flash Card), etc. Of course, the memory 113 can also include both the internal storage unit of the electronic device and its external storage device. In this embodiment, the memory 11 is generally used to store the operating system and various computer programs installed in the electronic device, such as the program code of the program for the defense model to be stolen and attacked, etc. In addition, the memory 113 can also be used to temporarily store various types of data that have been output or are to be output.

[0096] Figure 3 Only an electronic device having components 111 - 114 is shown, but it is understood that implementing all of the components shown is not a requirement, and more or fewer components may alternatively be implemented.

[0097] In one embodiment of the present application, the processor 111 is used to execute the program stored in the memory 113 to implement the method for preventing the model from being stolen and attacked provided by any of the above method embodiments, including:

[0098] Obtaining input data to be input into the original model;

[0099] Using a pre-trained detector, detecting whether the input data is malicious query data;

[0100] If the input data is detected to be malicious query data, the input data is input into a pre-trained sampler to obtain a random output result of the input data, where the random output result is a pseudo-random output;

[0101] If the input data is detected to be non-malicious query data, the input data is input into the original model to obtain a true output result of the input data.

[0102] For a detailed description of the above steps, please refer to the above Figure 2 Functional module diagram of an embodiment of a system 100 for preventing model theft attacks and Figure 1 Description of a flowchart of an embodiment of a method for defending against model theft attacks.

[0103] In addition, the embodiment of the present application also proposes a computer-readable storage medium, which may be non-volatile or volatile. The computer-readable storage medium includes a data storage area and a program storage area, and the program storage area stores a program for defending against model theft attacks. When the program for defending against model theft attacks is executed by a processor, the following operations are implemented:

[0104] Obtaining input data to be input into the original model;

[0105] Using a pre-trained detector, detecting whether the input data is malicious query data;

[0106] If the input data is detected to be malicious query data, the input data is input into a pre-trained sampler to obtain a random output result of the input data, where the random output result is a pseudo-random output;

[0107] If the input data is detected to be non-malicious query data, the input data is input into the original model to obtain a true output result of the input data.

[0108] The specific implementation of the computer-readable storage medium of the present application is roughly the same as the specific implementation of the above-mentioned method for defending against model theft attacks, and will not be repeated here.

[0109] The device embodiments described above are merely illustrative, wherein the units described as separate components may or may not be physically separated, and the components shown as units may or may not be physical units, that is, they may be located in one place or distributed on multiple network units. Some or all of the modules may be selected according to actual needs to achieve the purpose of the solution of this embodiment.

[0110] Through the description of the above implementation methods, those skilled in the art can clearly understand that each implementation method can be implemented by means of software plus a general hardware platform, and of course, by hardware. Based on this understanding, the above technical solution is essentially or the part that contributes to the relevant technology can be embodied in the form of a software product, and the computer software product can be stored in a computer-readable storage medium, such as ROM / RAM, a disk, an optical disk, etc., including a number of instructions for a computer device (which can be a personal computer, a server, or a network device, etc.) to execute the methods described in each embodiment or some parts of the embodiments.

[0111] It should be noted that the descriptions involving "first", "second", etc. in this application are only for descriptive purposes and cannot be understood as indicating or implying their relative importance or implicitly indicating the number of technical features indicated. Therefore, the features defined as "first" and "second" may explicitly or implicitly include at least one of the features. In addition, the technical solutions between the various embodiments can be combined with each other, but they must be based on the ability of ordinary technicians in this field to implement them. When the combination of technical solutions is contradictory or cannot be implemented, it should be deemed that such combination of technical solutions does not exist and is not within the scope of protection required by this application.

[0112] It should be understood that the terms used herein are only for the purpose of describing specific example embodiments and are not intended to be limiting. Unless the context clearly indicates otherwise, the singular forms "one", "an" and "said" as used herein may also be meant to include plural forms. The terms "include", "comprise", "contain", and "have" are inclusive, and therefore specify the existence of stated features, steps, operations, elements and / or parts, but do not exclude the existence or addition of one or more other features, steps, operations, elements, parts, and / or combinations thereof. The method steps, processes, and operations described herein are not interpreted as necessarily requiring them to be performed in the specific order described or illustrated, unless the execution order is clearly indicated. It should also be understood that additional or alternative steps may be used.

[0113] The above description is only a specific implementation of the present application, so that those skilled in the art can understand or implement the present application. The present application will not be limited to the embodiments shown herein, but should conform to the broadest scope consistent with the principles and novel features of the present application.

Claims

1. A method for defending against model theft attacks, characterized in that: The method comprises: Obtaining input data to be input into the original model; Using a pre-trained detector, detecting whether the input data is malicious query data; If the input data is detected to be malicious query data, the input data is input into a pre-trained sampler to obtain a random output result of the input data, where the random output result is a pseudo-random output; If the input data is detected to be non-malicious query data, the input data is input into the original model to obtain a true output result of the input data; The detecting whether the input data is malicious query data by using a pre-trained detector includes: Determine whether the input data belongs to data with the same distribution as the sample data set used to train the original model; If yes, input the input data into the detector to obtain a first detection result that satisfies a first condition, wherein the first detection result indicates that the input data is non-malicious query data; If not, input the input data into the detector to obtain a second detection result that satisfies a second condition, wherein the second detection result indicates that the input data is malicious query data; The formula of the first condition includes: Among them, Pr represents probability, represents the defense model after adding the defense strategy to the original model, f M represents the original model, D represents the distribution of the sample data set used to train the original model, x represents the input data, y represents the output of the original model, and ∈1 represents a first preset probability; The formula of the second condition includes: Among them, Pr represents probability, represents the defense model after the defense strategy is added to the original model, D represents the distribution of the sample data set used to train the original model, x represents the input data, y represents the output of the original model, and ∈2 represents the second preset probability.

2. The method for preventing model theft attacks as claimed in claim 1, characterized in that: The random output result satisfies the formula of the third condition, and the formula of the third condition includes: Pr[f M (x)=y|(x,y ′ )]=Pr[f M (x)=y|x] Among them, Pr represents probability, f M represents the original model, x represents the input data, y represents the output of the original model, and y ′ It represents the output of the defense model after the defense strategy is added to the original model.

3. The method for preventing model theft attacks as claimed in claim 1, characterized in that: The real output result and the random output result satisfy the fourth condition, and the formula of the fourth condition is include: Among them, R k represents the k-dimensional real number space, Pr represents probability, D M represents f M The distribution of output labels, f M represents the original model, represents the distribution of the output labels of the defense model after the defense strategy is added to the original model, D M and The upper bound of the statistical distance between them is ∈3, where ∈3 represents the third preset probability.

4. The method for preventing a model from being stolen as claimed in any one of claims 1 to 3, characterized in that: The detector is obtained based on convolutional neural network training, and the sampler is obtained based on conditional generative adversarial network training.

5. A system for defending against model theft attacks, characterized in that: The system comprises: Acquisition module: used to obtain input data to be input into the original model; Detection module: used to detect whether the input data is malicious query data using a pre-trained detector; Random output module: used for inputting the input data into a pre-trained sampler to obtain a random output result of the input data if the input data is detected to be malicious query data, and the random output result is a pseudo-random output; A true output module: used for inputting the input data into the original model to obtain a true output result of the input data if the input data is detected to be non-malicious query data; The detecting whether the input data is malicious query data by using a pre-trained detector includes: Determine whether the input data belongs to data with the same distribution as the sample data set used to train the original model; If yes, input the input data into the detector to obtain a first detection result that satisfies a first condition, wherein the first detection result indicates that the input data is non-malicious query data; If not, input the input data into the detector to obtain a second detection result that satisfies a second condition, wherein the second detection result indicates that the input data is malicious query data; The formula of the first condition includes: Among them, Pr represents probability, represents the defense model after adding the defense strategy to the original model, f M represents the original model, D represents the distribution of the sample data set used to train the original model, x represents the input data, y represents the output of the original model, and ∈1 represents a first preset probability; The formula of the second condition includes: Among them, Pr represents probability, represents the defense model after the defense strategy is added to the original model, D represents the distribution of the sample data set used to train the original model, x represents the input data, y represents the output of the original model, and ∈2 represents the second preset probability.

6. An electronic device, characterized in that: It includes a processor, a communication interface, a memory and a communication bus, wherein the processor, the communication interface and the memory communicate with each other through the communication bus; Memory, used to store computer programs; A processor, for implementing the method for preventing a model from being stolen and attacked as described in any one of claims 1 to 4 when executing a program stored in a memory.

7. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the method for defending against model theft attacks according to any one of claims 1 to 4 is implemented.

Images