A classification model member reasoning defense method and system based on loss control

Abstract

This invention discloses a method and system for defending against member inference attacks in classification models based on loss control, relating to the field of machine learning model training technology. The key technical points of this invention include: training a neural network model capable of defending against member inference attacks; and performing classification prediction using the trained neural network model. The core of training the neural network model capable of defending against member inference attacks includes soft-label training and loss augmentation: in the soft-label training phase, one-hot labels are replaced with soft labels, ensuring that the minimum loss of training samples is greater than zero; loss augmentation uses two different objectives to update model parameters, improving the model's robustness against member inference attacks while maintaining its utility. This invention achieves a balance between privacy protection and model utility by alternately executing the two strategies of soft-label training and loss augmentation, raising the standard for privacy-preserving model training methods in the field of machine learning.

Description

Technical Field

[0001] This invention relates to the field of machine learning model training technology, specifically to a method and system for defending member inference in classification models based on loss control. Background Technology

[0002] In the rapid development of the information age, machine learning (ML) has become an indispensable cornerstone in many fields, achieving remarkable success in areas such as facial recognition, image analysis, autonomous driving, and medical diagnosis. As model parameters increase, ML models demonstrate exceptional memory capabilities, accurately fitting training data and retaining sensitive information. While this ability is considered an advantage in many applications, it also raises the risk of privacy breaches. When a model inadvertently remembers and potentially leaks sensitive data, it threatens user privacy. This risk is particularly pronounced when handling personally identifiable information, medical records, or any form of sensitive data.

[0003] Membership inference attack (MIA) is a privacy-preserving attack method targeting machine learning models, designed to determine whether a specific data point was used in the model's training set. By analyzing the model's response to a particular sample, an attacker can infer whether that sample is part of the training set, thus revealing information about data membership. This type of attack not only reveals personal privacy information, such as whether a person's medical records were used to train a hospital's diagnostic model, but also exposes discrepancies in how the model treats member and non-member data.

[0004] As Mind-Independent Attacks (MIAs) pose an increasingly serious threat to data privacy, researchers have proposed various defense mechanisms, such as MemGuard, regularization techniques (e.g., early stopping, dropout, label smoothing, confidence penalty, and adversarial regularization), and Differential Privacy (DP). These defense strategies can reduce the success rate of MIAs to some extent, but they are often limited to specific types of attacks, or they sacrifice model performance while providing partial protection. Precisely because of the limitations of existing defense mechanisms, designing a training framework that can effectively resist MIAs without compromising model performance is particularly important. Summary of the Invention

[0005] In view of the above problems, this invention proposes a classification model member reasoning defense method and system based on loss control.

[0006] According to one aspect of the present invention, a classification model membership reasoning defense method based on loss control is proposed, the method comprising:

[0007] Train a neural network model that can defend against member reasoning attacks;

[0008] Classification prediction is performed using a trained neural network model; the training process for a neural network model that can defend against member reasoning attacks includes:

[0009] Initialize the neural network model parameters θ;

[0010] For each batch of data in each training iteration, perform the following:

[0011] Select a batch of training samples; calculate the logical output p of the model under the current parameters. i And use the Softmax function to calculate the confidence vector s i ; Calculate the predicted loss

[0012] Based on the true label y corresponding to the i-th sample i Construct soft tag t i and use soft tag t i Calculate target loss

[0013] Predicting losses The model parameters θ are updated using different strategies compared to the hyperparameter α representing the mean of the target loss: if the predicted loss... Then use the target loss. Update parameter θ; otherwise use target loss. Update the parameters θ in reverse and perform forward propagation again to calculate the new logical output p' of the model under the current parameters. i The confidence vector s' is calculated using the Softmax function. i ;

[0014] A new soft label t' was constructed using the temperature coefficient. i and use the soft tag t' i Calculate the new target loss During the update process, the stochastic gradient descent method is used to update the model parameters θ only for samples whose cross-entropy loss is less than log C, where C represents the total number of sample classes.

[0015] Furthermore, predicting losses The calculation formula is:

[0016]

[0017] Where B represents the number of samples in the data batch; l CE (s i ,y i ) indicates that the output s is based on the model.i And unique hot encoding real label y i Calculate the cross-entropy loss;

[0018] Target loss The calculation formula is:

[0019]

[0020] Among them, l CE (s i ,t i ) indicates that the output s is based on the model. i and soft tag t i Cross-entropy loss;

[0021] Target loss The calculation formula is:

[0022]

[0023] Among them, l CE (s' i ,t' i ) indicates that the output s' is based on the model. i and soft tag t' i The cross-entropy loss.

[0024] Furthermore, the formula for calculating cross-entropy loss is:

[0025]

[0026] Where s represents the confidence vector obtained from the forward propagation of the model; y represents the one-hot encoded label vector; y c s represents the confidence score of class c on vector y; c This represents the confidence level of class c on vector s.

[0027] Furthermore, construct soft tags t i as follows:

[0028]

[0029] in, β represents the confidence level of class c on the i-th sample; β represents the hyperparameter, which is set as the confidence level for correct classification, and the remaining confidence levels are evenly distributed among the other classes.

[0030] Furthermore, using target loss The formula for calculating the update parameter θ is:

[0031]

[0032] Where, θ t and θt+1 These represent the current and updated model parameters, respectively; η represents the learning rate. Indicates target loss Gradient operator with respect to θ;

[0033] Use target loss The formula for calculating the reverse update parameter θ is:

[0034]

[0035] Where, θ t ′ and θ t+1 ′ represents the current and reverse-updated model parameters, respectively; p represents the hyperparameter controlling the degree of update, with a value between 0 and 1.

[0036] Furthermore, a new soft label t' is constructed using the temperature coefficient. i as follows:

[0037]

[0038] Among them, p' i This represents the logical output of the model. This represents the logical output in category c; T represents the temperature coefficient hyperparameter.

[0039] Furthermore, the target loss is employed using the stochastic gradient descent method. The formula for calculating the update parameter θ is:

[0040]

[0041] Where, θ t and θ t+1 These represent the current and updated model parameters, respectively; η represents the learning rate. Indicates target loss The gradient operator for θ; p represents the hyperparameter controlling the degree of update, with values ​​ranging between 0 and 1.

[0042] According to another aspect of the present invention, a classification model membership reasoning defense system based on loss control is proposed, the system comprising:

[0043] The model training module is configured to train a neural network model capable of defending against member reasoning attacks; the training process includes:

[0044] Initialize the neural network model parameters θ;

[0045] For each batch of data in each training iteration, perform the following:

[0046] Select a batch of training samples; calculate the logical output p of the model under the current parameters.i And use the Softmax function to calculate the confidence vector s i ; Calculate the predicted loss

[0047] Based on the true label y corresponding to the i-th sample i Construct soft tag t i and use soft tag t i Calculate target loss

[0048] Predicting losses The model parameters θ are updated using different strategies compared to the hyperparameter α representing the mean of the target loss: if the predicted loss... Then use the target loss. Update parameter θ; otherwise use target loss. Update the parameters θ in reverse and perform forward propagation again to calculate the new logical output p' of the model under the current parameters. i The confidence vector s' is calculated using the Softmax function. i ;

[0049] A new soft label t' was constructed using the temperature coefficient. i and use the soft tag t' i Calculate the new target loss During the update process, the stochastic gradient descent method is used to update the model parameters θ only for samples whose cross-entropy loss is less than log C, where C represents the total number of sample classes.

[0050] The classification prediction module is configured to perform classification prediction using a trained neural network model.

[0051] Furthermore, the prediction loss in the model training module The calculation formula is:

[0052]

[0053] Where B represents the number of samples in the data batch; l CE (s i ,y i ) indicates that the output s is based on the model. i And unique hot encoding real label y i Calculate the cross-entropy loss;

[0054] Target loss The calculation formula is:

[0055]

[0056] Among them, l CE (s i,t i ) indicates that the output s is based on the model. i and soft tag t i Cross-entropy loss;

[0057] Target loss The calculation formula is:

[0058]

[0059] Among them, l CE (s' i ,t' i ) indicates that the output s' is based on the model. i and soft tag t' i Cross-entropy loss;

[0060] The formula for calculating the cross-entropy loss is as follows:

[0061]

[0062] Where s represents the confidence vector obtained from the forward propagation of the model; y represents the one-hot encoded label vector; y c s represents the confidence score of class c on vector y; c This represents the confidence level of class c on vector s.

[0063] Furthermore, the model training module constructs soft labels t i as follows:

[0064]

[0065] in, β represents the confidence level of class c on the i-th sample; β represents the hyperparameter, which is set as the confidence level for correct classification, and the remaining confidence levels are evenly distributed among the other classes.

[0066] A new soft label t' was constructed using the temperature coefficient. i as follows:

[0067]

[0068] Among them, p' i This represents the logical output of the model. This represents the logical output in category c; T represents the temperature coefficient hyperparameter.

[0069] The beneficial technical effects of this invention are:

[0070] This invention proposes a classification model member inference defense method and system based on loss control, which aims to adjust the loss distribution by manipulating the average and minimum values ​​of the loss of samples in the training set, in order to address the inherent challenges of directly controlling the loss distribution.

[0071] The core of model training consists of two parts: soft-label training and loss augmentation. In the soft-label training phase, traditional hard labels (i.e., one-hot labels) are replaced with soft labels. This labeling method ensures that the minimum loss of the training samples is greater than zero. Specifically, by introducing a confidence threshold hyperparameter β, the confidence of the correct class is β, while the confidence of other classes is evenly distributed, thus keeping the soft label of each sample unchanged during training. This method not only reduces the model's overfitting to the training data but also encourages the model to learn more generalizable features. Loss ascent employs two different objectives to update model parameters, aiming to improve the model's robustness against member inference attacks (MIA) while maintaining its utility. The first-stage parameter update method utilizes gradient ascent, updating model parameters in the opposite direction to the direction introduced by soft label training. The second-stage parameter update method constructs soft labels based on a temperature coefficient-adjusted Softmax function and applies this update process only to samples with loss values ​​less than log C (i.e., correctly predicted samples), thereby calculating cross-entropy loss and updating parameters through mini-batch stochastic gradient descent. This process not only enhances the model's defense capabilities but also mitigates the negative impact of gradient ascent on model performance through selective updates based on soft labels.

[0072] This invention revolves around a cyclical training strategy. It evaluates the model's training status by comparing the current loss with a predetermined target mean α, and determines the subsequent training direction accordingly. If the model is insufficiently trained (loss greater than α), the algorithm continues soft-label training. By defining a confidence threshold β for the correct class and reallocating confidence scores for other classes, it fine-tunes the training labels, thereby improving the model's adaptability to class discrepancies and balancing the confidence distribution. Conversely, when the current loss reaches or falls below the target value α, the algorithm switches to a loss-incrementing step. This involves an auxiliary update process using soft labels constructed through gradient ascent and a temperature-adjusted Softmax function to optimize model parameters, maintaining model performance while protecting privacy. By alternately executing soft-label training and loss-incrementing strategies, this invention achieves a balance between privacy protection and model utility, raising the standard for privacy-preserving model training methods in the machine learning field. This iterative training strategy embodies an innovative method for machine learning security and privacy protection. By cleverly combining soft-label training and controlled loss incrementing, it creates a model that is both accurate and resistant to MIA (Minimum Injection Alternatives). Attached Figure Description

[0073] The present invention can be better understood by referring to the description given below in conjunction with the accompanying drawings, which together with the following detailed description are included in and form part of this specification, and are used to further illustrate preferred embodiments of the invention and explain the principles and advantages of the invention.

[0074] Figure 1 This is a flowchart of a classification model member inference defense method based on loss control, as described in an embodiment of the present invention.

[0075] Figure 2 This is a flowchart of model training in an embodiment of the present invention;

[0076] Figure 3 This is a privacy-utility curve of the present invention and other advanced defense systems on the CIFAR10 (ResNet20) model;

[0077] Figure 4 This is a privacy-utility curve of the present invention and other advanced defense systems on the CIFAR10 (VGG11) model;

[0078] Figure 5 This is a privacy-utility curve of the present invention and other advanced defense systems on the CIFAR100 (ResNet20) model;

[0079] Figure 6 This is a privacy-utility curve of the present invention and other advanced defense systems on the CIFAR100 (VGG11) model;

[0080] Figure 7 This is a privacy-utility curve of the present invention and other advanced defense systems on the Texas model;

[0081] Figure 8 This is a privacy-utility curve of the present invention and other advanced defense systems on the Purchase model. Detailed Implementation

[0082] To enable those skilled in the art to better understand the present invention, exemplary embodiments or examples of the present invention will be described below in conjunction with the accompanying drawings. Obviously, the described embodiments or examples are merely some, not all, of the embodiments or examples of the present invention. All other embodiments or examples obtained by those skilled in the art based on the embodiments or examples of the present invention without inventive effort should fall within the scope of protection of the present invention.

[0083] This invention aims to reduce privacy leaks by manipulating loss. Specifically, this invention employs a softening training and a two-stage loss ascent method. By adjusting the mean and minimum of the sample loss, the distribution of the sample loss is indirectly controlled, thereby exhibiting excellent defense capabilities without sacrificing model performance.

[0084] This invention proposes a classification model membership reasoning defense method based on loss control, such as... Figures 1-2 As shown, the method includes the following steps:

[0085] S1. Train a neural network model that can defend against member reasoning attacks;

[0086] S2. Use the trained neural network model for classification and prediction.

[0087] The training process of the neural network model in S1 that can defend against member reasoning attacks includes:

[0088] S11. Initialize model parameters: Assign initial values ​​to the model parameters θ.

[0089] S12. Iterative Training: For each training cycle and for each batch of data, perform the following operations:

[0090] S121. Obtain a batch of training samples: Select a batch of training samples.

[0091] S122, Forward Propagation: Calculates the model's output p under the current parameters. i =f(x) i ;θ0;

[0092] S123. Calculate the confidence vector: Use the Softmax function to calculate the confidence vector s. i =Softmax(p i );

[0093] S124. Calculate prediction loss: Calculate the prediction loss for the batch.

[0094] S125. Constructing soft tags: Based on the real tag y i Construct soft tag t i ;

[0095] S126. Calculate the target loss under soft tags: Calculate the target loss using soft tags.

[0096] S127, Parameter Update: Based on loss By comparing the hyperparameter α, which represents the mean of the target loss, the model parameters θ are selectively updated: if Then use Update the parameters; otherwise, perform the following steps: Use Update parameters in reverse; perform forward propagation again. i '=f(x i ;θ), calculate the confidence vector s i =Softmax)(p i'); Construct a new soft label t using the temperature coefficient T. i =Softmax(p i ',T); Calculate the new target loss. The parameter θ is updated using stochastic gradient descent only when the sample loss is less than log C, where C represents the total number of sample classes.

[0097] S13. Output Model: After training is complete, return the trained model f(·θ).

[0098] In this embodiment, optionally, the predicted loss in S124 The calculation formula is:

[0099]

[0100] Where B represents the number of samples in the data batch; l CE (s i ,y i ) indicates that the output s is based on the model. i And unique hot encoding real label y i Calculate the cross-entropy loss;

[0101] The formula for calculating the target loss L2θ in S126 is:

[0102]

[0103] Among them, l CE (s i ,t i ) indicates that the output s is based on the model. i and soft tag t i Cross-entropy loss;

[0104] Target loss in S127 The calculation formula is:

[0105]

[0106] Among them, l CE (s' i ,t' i ) indicates that the output s' is based on the model. i and soft tag t' i The cross-entropy loss.

[0107] In this embodiment, optionally, the formula for calculating cross-entropy loss is:

[0108]

[0109] Where s represents the confidence vector obtained from the forward propagation of the model; y represents the one-hot encoded label vector. This encoding method uniquely represents the class membership of samples z = x, y by setting a single element to 1 (representing class membership), while all other elements are set to 0, thus ensuring that the class membership of a given sample has an exclusive representation; y c s represents the confidence score of class c on vector y; c This represents the confidence level of class c on vector s.

[0110] In this embodiment, optionally, a soft tag t is constructed. i To replace the hard labels used in traditional machine learning training, its specific construction method is as follows:

[0111]

[0112] in, β represents the confidence level of class c on the i-th sample; β represents the hyperparameter, which is set as the confidence level for correct classification, and the remaining confidence levels are evenly distributed among the other classes.

[0113] In this embodiment, optionally, target loss is used. The formula for calculating the update parameter θ is:

[0114]

[0115] Where, θ t and θ t+1 These represent the current and updated model parameters, respectively; η represents the learning rate. Indicates target loss Gradient operator with respect to θ;

[0116] Use target loss The formula for calculating the reverse update parameter θ is:

[0117]

[0118] Where, θ t ′ and θ t+1 ′ represents the current and reverse-updated model parameters, respectively; p represents the hyperparameter controlling the degree of update, with a value between 0 and 1.

[0119] In this embodiment, optionally, a soft label t' is constructed using a Softmax function with a temperature coefficient. i Its specific construction method is as follows:

[0120]

[0121] Among them, p' i This represents the logical output of the model. represents the logical output for category c; T represents the temperature coefficient hyperparameter, which controls the output distribution of the Softmax function. When the temperature coefficient is high, the output distribution of the Softmax function is flatter, and the model's prediction probabilities for each category are closer; when the temperature coefficient is low, the output distribution of the Softmax function is steeper, and the model's prediction probabilities for each category are more concentrated.

[0122] In this embodiment, optionally, the target loss is achieved using the stochastic gradient descent method. The formula for calculating the update parameter θ is:

[0123]

[0124] Where, θ t and θ t+1 These represent the current and updated model parameters, respectively; η represents the learning rate. Indicates target loss The gradient operator for θ; p represents the hyperparameter controlling the degree of update, with values ​​ranging between 0 and 1.

[0125] This invention's model training includes soft-label training and a two-stage loss ascent. It uses hyperparameter α to control the average value of the training sample loss distribution and hyperparameter β to control the minimum value of the training sample loss distribution, thereby reducing the discriminability of loss between training and test data. A cyclic training strategy is employed to balance privacy and model usability. The cyclic training strategy consists of two main steps: 1) The model's training status is evaluated by comparing the current loss with a preset target average α. If the model training is insufficient, the soft-label training module is activated. By defining a confidence threshold β for the correct class and reallocating the remaining confidence, the label representation is optimized, improving the model's class discrimination ability and the balance of the confidence distribution. 2) When the loss reaches or falls below the target value α, the algorithm switches to the loss ascent module. Gradient ascent adjusts the model parameters, increasing the loss based on the previously constructed soft labels to maintain privacy. Subsequently, an auxiliary update process for soft labels is constructed using a temperature-adjusted Softmax function to mitigate the negative impact on usability that loss ascent might introduce, ensuring a delicate balance between privacy and model usability.

[0126] The pseudocode for model training is shown below.

[0127]

[0128]

[0129] The technical effects of the present invention were further verified through experiments.

[0130] First, dataset preparation is required: this involves collecting relevant data, cleaning it, removing missing values ​​and outliers, and splitting it into training and test sets to facilitate model learning and accurate evaluation under privacy protection measures.

[0131] Then, the model is trained using the dataset, including model initialization: this involves selecting initial values ​​for the parameters to fit the model architecture. This ensures efficient minimization of the loss function and optimization of model convergence speed during training. Model training employs soft-label training and a loss ramp-up strategy, indirectly controlling the minimum and mean loss on the training set to optimize the model's generalization ability and robustness against member inference attacks.

[0132] Then, the trained model is evaluated: the model's performance and defense capabilities are assessed through metrics such as accuracy and AUC, and the parameters are further adjusted and optimized to ensure the model's effectiveness and security in practical applications.

[0133] Finally, the thoroughly trained and comprehensively evaluated model is deployed to real-world application scenarios, and continuous performance monitoring is implemented to promptly identify and correct potential problems, ensuring the stability and accuracy of the model in actual operation.

[0134] The experiment developed six target models on four datasets, covering various data modalities including natural images, medical records, and shopping history. For the image datasets, a 20-layer ResNet model and an 11-layer VGG model were used, while an MLP model was used for the non-image datasets. Each dataset was evenly divided into five parts; the first four parts served as the training / test set for the target / shadow models, and the last part was used to train the alternative attack model. The four datasets were: CIFAR-10, CIFAR-100, Texas100, and Purchase100.

[0135] The CIFAR-10 dataset contains 60,000 color images, each 32×32 pixels in size and with 3 color channels. These images cover 10 different object categories, and each image is labeled to indicate its category. During standard preprocessing, the pixel values ​​of the images were normalized to zero mean and unit standard deviation to ensure they are better suited for training models and performing image classification tasks. The CIFAR-100 dataset contains 60,000 color images, each 32×32 pixels in size and with 3 color channels, distributed across 100 different categories. Similar to the preprocessing performed on the CIFAR-10 dataset, the pixel values ​​of these images were mean-subtracted and standardized. The Texas100 dataset contains medical data from 67,330 patients published by the Texas Department of Health Services. Each patient's record consists of 6,169 binary attribute features, including details such as diagnosis, general information, and procedures received by the patient. The dataset is classified by assigning the most appropriate procedure to each record from the 100 most common procedures. The Purchase100 dataset originates from customer shopping data from the "Getting Valuable Shopper Challenge" published on Kaggle. This dataset consists of 197,324 data samples, representing the purchase history of individual customers. Each sample contains 600 binary features, each indicating the presence or absence of a specific product in the corresponding user's purchase history. The dataset is divided into 100 different categories based on different purchasing styles. The goal of the classification task is to predict which purchasing style each user's 600 binary features are associated with. Table 1 summarizes the information and specific partitioning of the dataset used in the experiment.

[0136] Table 1 Dataset Information

[0137]

[0138]

[0139] This invention employs different neural network architectures for different datasets. For CIFAR-10 and CIFAR-100, a 20-layer ResNet and an 11-layer VGG architecture are used; for Purchase100, a 4-layer fully connected neural network with a hierarchical structure size of [1024, 512, 256, 100] is used; and for Texas100, a 5-layer fully connected neural network with a hierarchical structure size of [2048, 1024, 512, 256, 100]. The default optimization strategy uses stochastic gradient descent (SGD), with the following parameters: momentum set to 0.9 and weight decay set to 10. -4The learning rate was initialized to 0.1 and decayed by a factor of 10 upon reaching a predetermined epoch. The decaying epochs are listed below, indicated in square brackets, and the total number of training epochs is indicated in brackets: CIFAR-10 and CIFAR-100 [100, 150] (200); Texas100 and Purchase100 [50, 100] (120). Additionally, the following technique was employed to improve performance on heterogeneous data modalities: a second parameter update was performed only on samples in the natural image datasets (CIFAR-10 and CIFAR-100) where the loss falls within the interval [α, ln(C)]. Table 2 summarizes the specific hyperparameter settings used in the examples of this invention.

[0140] Table 2 Hyperparameter Settings

[0141]

[0142] This invention evaluates the RelaxLoss defense mechanism derived from the same design philosophy and assesses four regularization methods: Dropout, Label-smoothing, Confidence-penalty, and Distillation. For a more comprehensive evaluation, this invention also compares Adverbial Regularization (Adv-Reg) and Differential Privacy Stochastic Gradient Descent (DP-SGD).

[0143] For effective evaluation, the experiment focused on two main aspects: model performance, measured by the test accuracy of the victim model; and privacy protection capability, comprised of two main metrics: 1) attack accuracy, evaluated on a balanced query set, where 50% accuracy serves as the baseline for random guessing; and 2) attack AUC, a metric quantifying the separability between various thresholds along the Receive Operational Characteristic (ROC) curve. An AUC value of 0.5 is used as the baseline for an ideal defense mechanism.

[0144] This invention evaluates how the proposed method defends against member inference attacks without compromising model utility. Table 3 shows the highest attack accuracy and percentage improvement of the proposed method in various member inference attack scenarios compared to an undefended model.

[0145] Table 3 Highest Attack Accuracy

[0146]

[0147] As shown in Table 3, the method of this invention effectively reduces the accuracy of most attacks to a level comparable to random guessing. Therefore, the method proposed in this invention significantly improves the robustness of the target model against member inference estimation.

[0148] To further evaluate how the proposed method can defend against member inference attacks without compromising model utility, Table 4 shows the model accuracy and AUC of the proposed solution under various member inference attack scenarios.

[0149] Table 4. Model accuracy and AUC under various member inference attack scenarios.

[0150]

[0151] Compared to traditional defenseless training methods, the method of this invention consistently improves model performance by up to 12.0%. This improvement is applicable to a wide variety of datasets and model architectures, demonstrating the robustness and adaptability of this invention across diverse settings. Furthermore, the method consistently demonstrates effectiveness against various attack types, datasets, and model architectures. Notably, it achieves a consistent reduction in attack AUC across all datasets: below 0.578 for non-image data and below 0.742 for image data. Compared to defenseless models, the proposed solution exhibits significant defensive capabilities, with reductions exceeding 13.3% and 18.9% for non-image and image data, respectively.

[0152] This invention also provides a comprehensive evaluation of the proposed defense mechanism compared to other state-of-the-art systems. This evaluation compares their ability to resist member reasoning attacks under various attack modes and generates privacy-utility curves for clear visualization, such as... Figures 3-8 As shown. Figures 3-8 This paper presents privacy-utility curves for applying the proposed defense scheme and other commonly used defense schemes under different member inference attack modes on four different datasets and six corresponding models. The titles NN, Loss, Entropy, M-Entropy, Confidence, Boundary, Grad-x l1, Grad-x l2, and Grad-w l2 represent nine different member inference attack schemes used in the experiments. NN, Loss, Entropy, M-Entropy, and Confidence are black-box attack schemes; Boundary is a label-only attack scheme; and Grad-x l1, Grad-x l2, and Grad-w l2 are white-box attack schemes. In the legend, Ours represents the proposed defense method, RelaxLoss, Label-smoothing, Confidence-penalty, Distillation, Dropout, and DP-SGD represent member inference defense methods used for comparison, no defense indicates no defense method was used, and idealdefense represents the optimal defense under ideal conditions.

[0153] To better describe the privacy-utility trade-off of each defense method, this invention fine-tunes the relevant hyperparameters and plots the corresponding privacy-utility curves. The closer the curve is to the upper left corner, the more effectively it demonstrates the superiority of the defense solution. Observations show that, in almost all cases, the method of this invention consistently demonstrates superiority over the baseline in terms of privacy-utility trade-off. In summary: 1) The regularization scheme achieves model performance comparable to the undefended model. Notably, distillation performs well on CIFAR10(R), while label smoothing is outstanding on CIFAR100(R). However, the method of this invention consistently outperforms most competitors, achieving high utility and superior defense. Compared to the most common baseline, Dropout, the method of this invention reduces the attack AUC by up to 33% and 48% on CIFAR10(R) and CIFAR100(R), respectively, while maintaining the same level of utility. 2) Unlike Adv-Reg, which shows limited effectiveness against attacks beyond neural networks, the method of this invention consistently demonstrates broad-spectrum defense capabilities, effectively mitigating a wide range of attack types. 3) While DP-SGD is a popular defense method, it typically comes at the cost of reduced model accuracy. The method described in this invention achieves a significant improvement over DP-SGD, increasing test accuracy by 34% and 159% on CIFAR10(R) and CIFAR100(R), respectively, while maintaining comparable privacy levels. 4) Although RelaxLoss provides a robust defense with good utility, the method described in this invention has a slight advantage on CIFAR10(R) and CIFAR100(R). More importantly, the method described in this invention consistently demonstrates better performance in terms of utility and privacy on other datasets and architectures. Notably, it achieves attack AUC reductions of up to 10% and 11% on the Texas and Purchase datasets, respectively, while maintaining the same level of utility as RelaxLoss. 5) Both the method described in this invention and RelaxLoss provide effective defenses on different data and architectures. However, the method described in this invention surpasses RelaxLoss in achieving a more favorable balance between privacy and utility.

[0154] The method of this invention significantly enhances the ability of machine learning models to resist member inference attacks, while focusing on maintaining the practicality and performance of the model, demonstrating an excellent balance between privacy protection and utility, and providing a safe and efficient training scheme for machine learning models.

[0155] Another embodiment of the present invention proposes a classification model membership inference defense system based on loss control, the system comprising:

[0156] The model training module is configured to train a neural network model capable of defending against member reasoning attacks; the training process includes:

[0157] Initialize the neural network model parameters θ;

[0158] For each batch of data in each training iteration, perform the following:

[0159] Select a batch of training samples; calculate the logical output p of the model under the current parameters. i And use the Softmax function to calculate the confidence vector s i ; Calculate the predicted loss

[0160] Based on the true label y corresponding to the i-th sample i Construct soft tag t i and use soft tag t i Calculate target loss

[0161] Predicting losses The model parameters θ are updated using different strategies compared to the hyperparameter α representing the mean of the target loss: if the predicted loss... Then use the target loss. Update parameter θ; otherwise use target loss. Update the parameters θ in reverse and perform forward propagation again to calculate the new logical output p' of the model under the current parameters. i The confidence vector s' is calculated using the Softmax function. i ;

[0162] A new soft label t' was constructed using the temperature coefficient. i and use the soft tag t' i Calculate the new target loss During the update process, the stochastic gradient descent method is used to update the model parameters θ only for samples whose cross-entropy loss is less than log C, where C represents the total number of sample classes.

[0163] The classification prediction module is configured to perform classification prediction using a trained neural network model.

[0164] In this embodiment, preferably, the prediction loss in the model training module... The calculation formula is:

[0165]

[0166] Where B represents the number of samples in the data batch; l CE (s i ,y i ) indicates that the output s is based on the model.i And unique hot encoding real label y i Calculate the cross-entropy loss;

[0167] Target loss The calculation formula is:

[0168]

[0169] Among them, l CE (s i ,t i ) indicates that the output s is based on the model. i and soft tag t i Cross-entropy loss;

[0170] Target loss The calculation formula is:

[0171]

[0172] Among them, l CE (s' i ,t' i ) indicates that the output s' is based on the model. i and soft tag t' i Cross-entropy loss;

[0173] The formula for calculating the cross-entropy loss is as follows:

[0174]

[0175] Where s represents the confidence vector obtained from the forward propagation of the model; y represents the one-hot encoded label vector; y c s represents the confidence score of class c on vector y; c This represents the confidence level of class c on vector s.

[0176] In this embodiment, preferably, the soft label t is constructed in the model training module. i as follows:

[0177]

[0178] in, β represents the confidence level of class c on the i-th sample; β represents the hyperparameter, which is set as the confidence level for correct classification, and the remaining confidence levels are evenly distributed among the other classes.

[0179] A new soft label t' was constructed using the temperature coefficient. i as follows:

[0180]

[0181] Among them, p' iThis represents the logical output of the model. This represents the logical output in category c; T represents the temperature coefficient hyperparameter.

[0182] The functionality of the loss control-based classification model member inference defense system described in this embodiment can be explained by the aforementioned loss control-based classification model member inference defense method. Therefore, for the parts not detailed in this embodiment, please refer to the above method embodiments, and they will not be repeated here.

[0183] Although the invention has been described with respect to a limited number of embodiments, those skilled in the art will understand from the foregoing description that other embodiments are conceivable within the scope of the invention described herein. The disclosure of the invention is illustrative and not restrictive, and the scope of the invention is defined by the appended claims.

Claims

1. A classification model membership reasoning defense method based on loss control, characterized in that, include: Train a neural network model that can defend against member reasoning attacks; The training process includes: Initialize neural network model parameters ; For each batch of data in each training iteration, perform the following: Select a batch of training samples; calculate the model's logical output under the current parameters. And use the Softmax function to calculate the confidence vector. ; Calculate the predicted loss Predicting losses The calculation formula is: ； in, Indicates the number of samples in a data batch; Indicates model-based output Unique hot coding real label Calculate the cross-entropy loss; Target loss The calculation formula is: ； in, Indicates model-based output and soft labels Cross-entropy loss; Target loss The calculation formula is: ； in, Indicates model-based output and soft labels Cross-entropy loss; Based on the true label corresponding to the i-th sample Construct soft tags and use soft tags Calculate target loss ; Predicting losses with hyperparameters representing the mean of the target loss Compare and update model parameters using different strategies. If the loss is predicted Then use the target loss. Update parameters Otherwise, use the target loss. Reverse update parameters Then, forward propagation is performed again to calculate the new logical output of the model under the current parameters. The confidence vector is calculated using the Softmax function. Using temperature coefficients to construct new soft labels and use soft tags Calculate the new target loss During the update process, only those with cross-entropy loss less than The model parameters are updated using the stochastic gradient descent method on the samples. ,in Represents the total number of sample categories; uses the target loss. Update parameters The calculation formula is: ； in, and These represent the current and updated model parameters, respectively. Indicates the learning rate; Indicates target loss about The gradient operator; Use target loss Reverse update parameters The calculation formula is: ； in, and These represent the current and reverse-updated model parameters, respectively. This is a hyperparameter that controls the degree of update; its value ranges between 0 and 1. A trained neural network model is used to classify and predict the images to be classified.

2. The classification model membership reasoning defense method based on loss control according to claim 1, characterized in that, The formula for calculating cross-entropy loss is: ； in, This represents the confidence vector obtained from the forward propagation of the model; This represents a one-hot encoded label vector; Representing vectors Previous Category Confidence level; Representing vectors Previous Category The confidence level.

3. The classification model membership reasoning defense method based on loss control according to claim 1, characterized in that, Construct soft tags as follows: in, Indicates the first Class of each sample Confidence level; This represents a hyperparameter, set as the confidence level for the correct classification, with the remaining confidence levels evenly distributed among the other categories.

4. The classification model member inference defense method based on loss control according to claim 1, characterized in that, New soft labels are constructed using temperature coefficients. as follows: ； in, This represents the logical output of the model. Indicates in category The logical output above; This represents the temperature coefficient hyperparameter.

5. The classification model membership reasoning defense method based on loss control according to claim 1, characterized in that, Using the stochastic gradient descent method with target loss Update parameters The calculation formula is: ； in, and These represent the current and updated model parameters, respectively. Indicates the learning rate; Indicates target loss about The gradient operator; This represents a hyperparameter that controls the degree of update, and its value ranges between 0 and 1.

6. A classification model member reasoning defense system based on loss control, characterized in that, The system is used to implement the loss control-based classification model membership reasoning defense method according to any one of claims 1-5; the system includes: The model training module is configured to train a neural network model capable of defending against member reasoning attacks; the training process includes: Initialize neural network model parameters ; For each batch of data in each training iteration, perform the following: Select a batch of training samples; calculate the model's logical output under the current parameters. And use the Softmax function to calculate the confidence vector. ; Calculate the predicted loss ; Based on the true label corresponding to the i-th sample Construct soft tags and use soft tags Calculate target loss ; Predicting losses with hyperparameters representing the mean of the target loss Compare and update model parameters using different strategies. If the loss is predicted Then use the target loss. Update parameters Otherwise, use the target loss. Reverse update parameters Then, forward propagation is performed again to calculate the new logical output of the model under the current parameters. The confidence vector is calculated using the Softmax function. ; New soft labels are constructed using temperature coefficients. and use soft tags Calculate the new target loss During the update process, only those with cross-entropy loss less than The model parameters are updated using the stochastic gradient descent method on the samples. ,in Indicates the total number of sample categories; The classification prediction module is configured to use a trained neural network model to perform classification prediction on the image to be classified.

Images