A method, device and storage medium for preventing a deep learning model from being attacked

Abstract

A method, device and medium for preventing deep learning models from being attacked are disclosed. The method comprises: obtaining parameter data of a graphics processing unit (GPU) of a computing device in which a deep learning model to be detected is running; inputting the parameter data of the GPU into a pre-trained classification model for determining the type of the deep learning model, and outputting the type of the deep learning model to be detected; and selecting a defense method for the deep learning model to be detected from multiple defense methods according to the type of the deep learning model to be detected, to prevent the deep learning model from being attacked.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of deep learning model, and more particularly, to a method and device for preventing deep learning model from being attacked and a storage medium. BACKGROUND

[0002] In the past few years, deep learning models have become a popular research direction. They have shown high precision and high performance in multiple machine learning tasks, such as image classification, object detection, speech recognition, etc. However, in order to develop these commercial applications, a large amount of resources need to be invested. Therefore, ensuring the security of these models has become an important problem that cannot be ignored.

[0003] Understanding the categories of deep learning models is very important for the defense of deep learning. Different types of deep learning models will have different types of attack methods, and different techniques and methods are needed for defense. For convolutional neural networks (CNN), the most common way to attack CNN is adversarial sample attack. Defense against adversarial sample attack can be adversarial training, adding adversarial samples to the data, so that the model learns the features of the adversarial samples in training, thereby improving the robustness of the model against attacks. Classifying deep learning models can better cope with various situations.

[0004] In related technologies, the detection of deep learning models at present is mostly based on experience and technology, such as checking process behavior, network connection state, self-starting or task plan script, related configuration file, log file, etc. These methods are difficult to have universality, thereby leading to low detection efficiency of deep learning models, and inaccurate detection results. Thus, due to the low detection efficiency of deep model algorithm and inaccurate detection results, the attack on deep learning models cannot be effectively defended. SUMMARY

[0005] In view of the deficiencies of the prior art, the present application provides a method, device and medium for preventing deep learning models from being attacked.

[0006] According to one aspect of the present application, there is provided a method for preventing deep learning models from being attacked, comprising:

[0007] obtaining parameter data of a graphics processing unit (GPU) of a computing device in which a deep learning model to be detected is running;

[0008] inputting the parameter data of the graphics processing unit into a pre-trained classification model for determining the type of deep learning model, and outputting the type of the deep learning model to be detected; and

[0009] According to the type of the deep learning model to be detected, a defense method for the deep learning model to be detected is selected from a plurality of defense methods to prevent the deep learning model from being attacked.

[0010] Preferably, parameter data of a graphics processing unit (GPU) of a computing device where the deep learning model to be detected is running is acquired, including:

[0011] A data exchange format file describing the GPU state of the computing device where the deep learning model to be detected is running is collected;

[0012] The data exchange format file is converted into a character-separated value (CSV) file, and GPU parameter data associated with the deep learning model to be detected and data labels obtained by labeling the GPU parameter data are acquired from the CSV file,

[0013] The GPU parameter data includes GPU core load, size of GPU frame buffer, GPU bus interface load, GPU power consumption, data reception amount of GPU high bandwidth extended bus, and data transmission amount of GPU high bandwidth extended bus.

[0014] Preferably, the method further comprises pre-training a classification model for determining the type of the deep learning model;

[0015] The pre-training of the classification model for determining the type of the deep learning model comprises:

[0016] Different types of deep learning models are run on a pre-arranged terminal device;

[0017] Data exchange format files of GPU states when the different types of deep learning models are running are acquired by the terminal device and converted into CSV files, and GPU parameter data associated with the different types of deep learning models and data labels obtained by labeling the GPU parameter data are acquired from the CSV files,

[0018] The GPU parameter data associated with the different types of deep learning models includes GPU core load, size of GPU frame buffer, GPU bus interface load, GPU power consumption, data reception amount of GPU high bandwidth extended bus, and data transmission amount of GPU high bandwidth extended bus.

[0019] The GPU parameter data associated with the different types of deep learning models and the data labels obtained by labeling the GPU parameter data are input into an enhanced LSTM model for training to determine the classification model for determining the type of the deep learning model,

[0020] In the enhanced LSTM model, the input xt Enhancement processing x t =x t +x t-1 , for cell state c t-1 Perform enhancement processing c t-1 =c t-1 +c t-2 ,

[0021] Where t, t-1, and t-2 are time steps, with time step t-1 being the preceding time step adjacent to time step t, and time step t-2 being the preceding time step adjacent to time step t-1.

[0022] Preferably, the data processing for enhancing the LSTM model includes:

[0023] Update the first input value x of the enhanced LSTM hidden unit at time step t. t ;

[0024] The first input value x of the LSTM hidden unit enhanced at time step t. t The hidden state value h of the enhanced LSTM hidden unit at time step t-1 t-1 Cell state value c of the enhanced LSTM hidden unit at time step t-1 t-1 Determine the forgetting value f of the enhanced LSTM hidden unit at time step t. t ;

[0025] The first input value x of the LSTM hidden unit enhanced at time step t. t The hidden state value h of the enhanced LSTM hidden unit at time step t-1 t-1 Cell state value c of the enhanced LSTM hidden unit at time step t-1 t-1 Determine the second input value i of the enhanced LSTM hidden unit at time step t. t ;

[0026] The first input value x of the LSTM hidden unit enhanced at time step t. t The hidden state value h of the enhanced LSTM hidden unit at time step t-1 t-1 Determine the candidate cell state values ​​of the enhanced LSTM hidden units at time step t.

[0027] Cell state values ​​c of LSTM hidden units enhanced at time step t-1 t-1 The forgetting value f of the enhanced LSTM hidden unit at time step t t Candidate cell state values ​​of enhanced LSTM hidden units at time step t The second input value i of the enhanced LSTM hidden unit at time step t.t a cell state value c of the enhanced LSTM hidden unit at time step t t ;

[0028] a cell state value c of the enhanced LSTM hidden unit at time step t t a cell state value c of the enhanced LSTM hidden unit at time step t-1 t-1 a cell state value c of the enhanced LSTM hidden unit at time step t t a cell state value c of the enhanced LSTM hidden unit at time step t t a cell state value c of the enhanced LSTM hidden unit at time step t t a cell state value c of the enhanced LSTM hidden unit at time step t t-1 ;

[0029] an output value o of the enhanced LSTM hidden unit at time step t t a hidden state value h of the enhanced LSTM hidden unit at time step t-1 t-1 a cell state value c of the enhanced LSTM hidden unit at time step t t an output value o of the enhanced LSTM hidden unit at time step t t ;

[0030] a hidden state value h of the enhanced LSTM hidden unit at time step t t a cell state value c of the enhanced LSTM hidden unit at time step t t an output value o of the enhanced LSTM hidden unit at time step t t .

[0031] According to another aspect of the present application, there is provided an apparatus for preventing a deep learning model from being attacked, comprising:

[0032] an obtaining module configured to obtain parameter data of a graphics processing unit (GPU) of a computing device in which a deep learning model to be detected is running;

[0033] an outputting module configured to input the parameter data of the GPU into a pre-trained classification model for determining a type of deep learning model, and output the type of the deep learning model to be detected; and

[0034] a determining module configured to select a defense method for the deep learning model to be detected from a plurality of defense methods according to the type of the deep learning model to be detected, so as to prevent the deep learning model from being attacked.

[0035] According to still another aspect of the present application, there is provided a computer readable storage medium storing a computer program for executing the method according to any one of the aspects of the present application.

[0036] According to a further aspect of the present application, there is provided an electronic device comprising: a processor; a memory for storing processor-executable instructions; the processor being arranged to read the executable instructions from the memory and execute the instructions to implement the method of any of the above aspects of the present application.

[0037] Therefore, the application provides a method for preventing deep learning models from being attacked. The state of a GPU when a deep learning model running on a terminal device to be detected is monitored. Parameters such as usage rate, temperature, and frequency can be monitored, and the GPU parameters required for classification are selected. The processed GPU parameter data is put into an enhanced LSTM model as a data set. The model can accurately distinguish the different states of the GPU when the computer runs different deep learning models, and then classifies the deep learning models. After determining the deep learning category, the attack of this type is prevented. BRIEF DESCRIPTION OF DRAWINGS

[0038] The exemplary embodiments of the present application can be more fully understood with reference to the following drawings:

[0039] Figure 1 FIG. 1 is a flowchart of a method for preventing deep learning models from being attacked according to an exemplary embodiment of the present application;

[0040] Figure 2 FIG. 2 is a flowchart of data processing of an enhanced LSTM model according to an exemplary embodiment of the present application;

[0041] Figure 3 FIG. 3 is a structural diagram of an apparatus for preventing deep learning models from being attacked according to an exemplary embodiment of the present application;

[0042] Figure 4 FIG. 4 is a structure of an electronic device according to an exemplary embodiment of the present application. DETAILED DESCRIPTION

[0043] Hereinafter, exemplary embodiments according to the present application will be described in detail with reference to the accompanying drawings. It should be understood that the exemplary embodiments described herein merely illustrate the present application and are not intended to limit the scope of the present application. It should be understood that the present application is not limited by the exemplary embodiments described herein.

[0044] It should be noted that the relative arrangement of the components and steps, numerical expressions, and numerical values set forth in these embodiments are not limiting to the scope of the present application unless otherwise specifically stated.

[0045] Those skilled in the art can understand that the terms "first", "second", and the like in the embodiments of the present application are only used to distinguish different steps, devices, or modules, and do not represent any specific technical meaning, nor do they represent a necessary logical sequence between them.

[0046] It should also be understood that, in the embodiments of the application, "a plurality of" can refer to two or more, and "at least one" can refer to one, two or more.

[0047] It should also be understood that, for any component, data or structure mentioned in the embodiments of the application, one or more can be generally understood without explicit limitation or in the context of the opposite indication.

[0048] In addition, in the present application, the term "and / or" is only a description of the association relationship of the associated objects, which means that there can be three relationships, for example, A and / or B can mean that A exists alone, A and B exist together, and B exists alone. In addition, the character " / " in the present application generally represents an "or" relationship between the front and rear associated objects.

[0049] It should also be understood that the description of the embodiments of the present application focuses on the differences between the embodiments, and the same or similar parts can be referred to each other, and for the sake of brevity, will not be repeated.

[0050] At the same time, it should be understood that, for the convenience of description, the size of each part shown in the drawings is not drawn according to the actual proportion relationship.

[0051] The following description of at least one exemplary embodiment is merely illustrative in nature and is in no way intended to limit the application or its application or use.

[0052] Techniques, methods, and devices known to those of ordinary skill in the relevant art can not be discussed in detail, but should be considered part of the specification where appropriate.

[0053] It should be noted that: similar signs and letters represent similar items in the following drawings, so once an item is defined in one drawing, it does not need to be further discussed in subsequent drawings.

[0054] Embodiments of the present application can be applied to terminal devices, computer systems, servers and other electronic devices, which can operate with many other general or special computing system environments or configurations. Examples of well-known terminal devices, computing systems, environments and / or configurations suitable for use with terminal devices, computer systems, servers and other electronic devices include, but are not limited to: personal computer systems, server computer systems, thin clients, thick clients, handheld or laptop devices, microprocessor-based systems, set-top boxes, programmable consumer electronics, network personal computers, small computer systems, large computer systems and distributed cloud computing technology environments including any of the above systems, etc.

[0055] Electronic devices such as terminal devices, computer systems, servers, and the like can be described in the general context of computer system-executable instructions, such as program modules, being executed by a computer system. Generally, program modules can include routines, programs, objects, components, logic, data structures, and the like that perform particular tasks or implement particular abstract data types. Computer systems / server can be practiced in distributed cloud computing environments with other computer systems coupled via communication networks. The program modules can be located in local or remote computer system storage media including memory storage devices.

[0056] Exemplary method

[0057] Figure 1 FIG. 1 is a flowchart illustrating a method for preventing a deep learning model from being attacked according to an exemplary embodiment of the present disclosure. The present embodiment can be applied to an electronic device such as a server, a terminal device, a computer system, and the like. Figure 1 As shown in FIG. 1, the method 100 for preventing a deep learning model from being attacked includes the following steps:

[0058] In step 101, parameter data of a graphics processing unit (GPU) of a computing device in which a deep learning model to be detected is running is obtained.

[0059] In step 102, the parameter data of the GPU is input into a pre-trained classification model for determining a type of the deep learning model, and a type of the deep learning model to be detected is output.

[0060] In step 103, a defense method for the deep learning model to be detected is selected from a plurality of defense methods according to the type of the deep learning model to be detected, to prevent the deep learning model from being attacked.

[0061] Optionally, obtaining the parameter data of the GPU of the computing device in which the deep learning model to be detected is running includes:

[0062] Collecting a data exchange format file for describing a GPU state of the computing device in which the deep learning model to be detected is running;

[0063] Converting the data exchange format file into a character-separated value (CSV) file, and obtaining GPU parameter data associated with the deep learning model to be detected and data labels obtained by labeling the GPU parameter data from the CSV file.

[0064] The GPU parameter data includes GPU core load, size of a GPU frame buffer, GPU bus interface load, GPU power consumption, data reception amount of a GPU high bandwidth extension bus, and data transmission amount of the GPU high bandwidth extension bus.

[0065] Optionally, further comprising, pre-training a classification model for determining the type of deep learning model;

[0066] Pre-training the classification model for determining the type of deep learning model comprises:

[0067] Running different types of deep learning models on a pre-arranged terminal device;

[0068] Obtaining a data exchange format file of GPU state when the different types of deep learning models are running through the terminal device and converting it into a CSV file, obtaining GPU parameter data associated with the different types of deep learning models and data labels obtained by labeling the GPU parameter data from the CSV file,

[0069] The GPU parameter data associated with the different types of deep learning models comprises: GPU core load, size of GPU frame buffer, GPU bus interface load, GPU power consumption, data receiving amount of GPU high bandwidth expansion bus, and data sending amount of GPU high bandwidth expansion bus.

[0070] The GPU parameter data associated with the different types of deep learning models and the data labels obtained by labeling the GPU parameter data are input into an enhanced LSTM model for training to determine the classification model for determining the type of deep learning model.

[0071] The enhanced LSTM model processes the input x t t-1 and x t t-2 in the following way:x t t = x t-1 t-1 + x t-1 t-2 t-1 , t-1 t-2 ,

[0072] Wherein, t, t-1 and t-2 are time steps, time step t-1 is the previous time step adjacent to time step t, and time step t-2 is the previous time step adjacent to time step t-1.

[0073] The data processing of the enhanced LSTM model comprises:

[0074] Preferably, the first input value x t of the enhanced LSTM hidden unit at time step t is updated.

[0075] The first input value x t of the enhanced LSTM hidden unit at time step t and the input value x t-1Adding them together gives the updated first input value x. t x t =x t +x t-1 ;

[0076] The updated first input value x t This serves as the input data for the enhanced LSTM hidden units at time step t.

[0077] Preferably, the first input value x of the LSTM hidden unit enhanced at time step t is... t The hidden state value h of the enhanced LSTM hidden unit at time step t-1 t-1 Cell state value c of the enhanced LSTM hidden unit at time step t-1 t-1 Determine the forgetting value f of the enhanced LSTM hidden unit at time step t. t ;

[0078] This includes determining the forgetting value f of the enhanced LSTM hidden unit at time step t based on the following formula. t :

[0079] f t =x t *sigmod(x t W xf )+h t-1 *tanh(h t-1 W hf )+zhishu(c t-1 W cf )+b f

[0080] Where sigmoid is the activation function, tanh is the activation function, zhishu is the activation function, and W is the activation function. xf W hf W cf They are respectively with x t h t-1 c t-1 The corresponding weight matrix; when x>0, zhishu(x)=x*(exp(x)-1), otherwise zhishu(x)=0, b f It is the bias matrix.

[0081] Preferably, the first input value x of the LSTM hidden unit enhanced at time step t is... t The hidden state value h of the enhanced LSTM hidden unit at time step t-1 t-1 Cell state value c of the enhanced LSTM hidden unit at time step t-1 t-1 Determine the second input value i of the enhanced LSTM hidden unit at time step t.t ;

[0082] The second input value i of the enhanced LSTM hidden unit at time step t is determined based on the following formula t :

[0083] i t =x t *sigmod(x t W xi )+zhishu(h t-1 W hi )+c t-1 *sigmod(c t-1 W ci )+b i

[0084] wherein, sigmod is an activation function, W xi , W hi , and W ci are weight matrices corresponding to x t , h t-1 , and c t-1 respectively, b i is a bias matrix, and zhishu(x) = x*(exp(x)-1) when x>0, otherwise zhishu(x) = 0.

[0085] Preferably, the candidate cell state value of the enhanced LSTM hidden unit at time step t is determined based on the first input value x t of the enhanced LSTM hidden unit at time step t and the hidden state value h t-1 of the enhanced LSTM hidden unit at time step t-1.

[0086] The candidate cell state value of the enhanced LSTM hidden unit at time step t is determined based on the following formula

[0087]

[0088] wherein, tanh is an activation function, W xc and W hc are weight matrices corresponding to x t and h t-1 respectively, b c is a bias matrix, and zhishu(x) = x*(exp(x)-1) when x>0, otherwise zhishu(x) = 0.

[0089] Preferably, the cell state value c t-1The forgetting value f of the enhanced LSTM hidden unit at time step t t Candidate cell state values ​​of enhanced LSTM hidden units at time step t The second input value i of the enhanced LSTM hidden unit at time step t. t Determine the cell state value c of the enhanced LSTM hidden unit at time step t. t ;

[0090] include:

[0091] Calculate the cell state value c of the enhanced LSTM hidden unit at time step t-1. t-1 The forgetting value f of the enhanced LSTM hidden unit at time step t t The first Hadamarda I made;

[0092] Calculate the candidate cell state values ​​of the enhanced LSTM hidden units at time step t. The second input value i of the enhanced LSTM hidden unit at time step t. t The second Hadama pile was made;

[0093] Adding the first and second Hadamard products yields the cell state value c of the enhanced LSTM hidden units at time step t. t ;

[0094] Preferably, the cell state value c of the enhanced LSTM hidden unit at time step t. t Cell state value c of the enhanced LSTM hidden unit at time step t-1 t-1 The summation yields the cell state value c of the enhanced LSTM hidden unit at the updated time step t. t c t =c t +c t-1 ;

[0095] Preferably, the first input value x of the LSTM hidden unit enhanced at time step t is... t The hidden state h of the enhanced LSTM hidden unit at time step t-1 t-1 Cell state value c of the enhanced LSTM hidden unit at time step t t Determine the output value o of the enhanced LSTM hidden unit at time step t. t ;

[0096] This includes determining the output value o of the enhanced LSTM hidden unit at time step t based on the following formula. t :

[0097] o t =x t *sigmod(xt W xo )+zhishu(h t-1 W ho )+c t *tanh(c t W co )+b o

[0098] Where sigmoid is the activation function, tanh is the activation function, and W is the activation function. xo W ho W co They are respectively with x t h t-1 c t The corresponding weight matrix, b o It is the bias matrix; when x>0, zhishu(x)=x*(exp(x)-1), otherwise zhishu(x)=0.

[0099] Preferably, the cell state value c of the LSTM hidden unit enhanced at time step t is... t The output value of the enhanced LSTM hidden unit at time step t. t Determine the hidden state value h of the enhanced LSTM hidden unit at time step t. t ;

[0100] This includes determining the hidden state value h of the enhanced LSTM hidden unit at time step t based on the following formula. t :

[0101]

[0102] in, To find the Hadamard product, when x>0, zhishu(x)=x*(exp(x)-1), otherwise zhishu(x)=0.

[0103] Alternatively, the information flow of the enhanced LSTM model can be:

[0104] Update the input value x of the enhanced LSTM hidden unit at time step t. t =x t +x t-1 ;

[0105] Calculate the forgetting value f of the enhanced LSTM hidden unit at time step t. t ;

[0106] The input x of the enhanced LSTM hidden unit at time step t t The hidden state h of the enhanced LSTM hidden unit at time step t-1 t-1and the cell state value c of the enhanced LSTM hidden unit at time step t-1 t-1 is imported into the sigmod activation function to obtain the input value i of the enhanced LSTM hidden unit at time step t t ;

[0107] the input x of the enhanced LSTM hidden unit at time step t t and the hidden state h of the enhanced LSTM hidden unit at time step t-1 t-1 is imported into the tanh activation function to obtain the candidate cell state value of the enhanced LSTM hidden unit at time step t

[0108] the cell state value c of the enhanced LSTM hidden unit at time step t-1 t-1 and the forget value f of the enhanced LSTM hidden unit at time step t t are Hadamard multiplied to obtain the candidate cell state value of the enhanced LSTM hidden unit at time step t and the input value i of the enhanced LSTM hidden unit at time step t t are Hadamard multiplied, and the obtained two Hadamard product results are added to obtain the cell state value c of the enhanced LSTM hidden unit at time step t t ;

[0109] the cell state value c of the enhanced LSTM hidden unit at time step t t = c t + c t-1 , that is, the cell state value c of the enhanced LSTM hidden unit at time step t t and the cell state value c of the enhanced LSTM hidden unit at time step t-1 t-1 are added to obtain the updated c t ;

[0110] the input x of the enhanced LSTM hidden unit at time step t-1 t , the hidden state h of the enhanced LSTM hidden unit at time step t-1 t-1 and the cell state value c of the enhanced LSTM hidden unit at time step t t are imported into the sigmod activation function to obtain the output value o of the enhanced LSTM hidden unit at time step t t ;

[0111] the cell state value c of the enhanced LSTM hidden unit at time step t t is imported into the tanh activation function, and the obtained result is the output value o of the enhanced LSTM hidden unit at time step t tThe Hadamard product is done, and finally the hidden state value h of the enhanced LSTM hidden unit at time step t is obtained t where

[0112] The sigmod activation function expression is:

[0113]

[0114] The tanh activation function expression is:

[0115]

[0116] The formula of the hidden unit of the enhanced LSTM model is as follows:

[0117] x t = x t + x t-1

[0118] f t = x t * sigmod(x t W xf ) + h t-1 * tanh(h t-1 W hf ) + zhi shu(c t-1 W cf ) + b f

[0119] i t = x t * sigmod(x t W xi ) + zhi shu(h t-1 W hi ) + c t-1 * sigmod(c t-1 W ci ) + b i

[0120]

[0121]

[0122] c t = c t + c t-1

[0123] o t = x t * sigmod(x t W xo ) + zhi shu(h t-1 W ho ) + ct tanh(c t W co )+b o

[0124]

[0125] wherein, in the process of calculating f t , W xf , W hf , W cf are weight matrices corresponding to x t , h t-1 , c t-1 respectively, and b f is a bias matrix; in the process of calculating i t , W xi , W hi , W ci are weight matrices corresponding to x t , h t-1 , c t-1 respectively, and b i is a bias matrix, in the process of calculating output value o t , W xo , W ho , W co are weight matrices corresponding to x t , h t-1 , c t respectively, and b o is a bias matrix, and when x>0, the activation function zhishu(x)=x*(exp(x)-1), otherwise zhishu(x)=0;

[0126] In the process of calculating , W xc and W hc are weight matrices corresponding to x t and h t-1 respectively, and b c is a bias matrix.

[0127] Specifically, the OpenHardwareMonitor tool for monitoring computer hardware is used to monitor the state of CPU and GPU when the computer runs different deep learning models, and parameters such as usage rate, temperature, frequency, etc. can be monitored, from which the required GPU parameters of the application are selected.

[0128] An enhanced LSTM model is proposed, and the processed CPU and GPU parameter data are put into the enhanced LSTM model as a dataset, which can accurately distinguish the different states of the GPU when the computer runs different deep learning models, and then classify the deep learning models, and defend against attacks of the type after determining the type of deep learning. The specific steps are as follows:

[0129] (1) Real-time monitoring of CPU and GPU states when running different deep learning models on the computer through OpenHardwareMonitor tool. OpenHardwareMonitor tool is an exe file, which is running on the web, so the information on the web is collected by starting the monitoring program at the same time.

[0130] Processing CPU and GPU parameter data. First, the collected information is in json format, placed in a local txt file, and converted to a CSV file by a python program, where each column corresponds to the data of a CPU or GPU parameter.

[0131] Then, select the GPU parameters to be used, which are:

[0132] ①gpu_core_load(GPU core load)

[0133] ②gpu_frame_buffer_load(GPU frame buffer)

[0134] ③gpu_bus_interface_load(GPU bus interface load)

[0135] ④gpu_power(GPU power)

[0136] ⑤gpu_pcie_rx(GPU high bandwidth expansion bus reception)

[0137] ⑥gpu_pcie_tx(GPU high bandwidth expansion bus transmission)

[0138] Finally, clean up the units of the selected GPU parameter data.

[0139] Enhanced LSTM model. The enhanced LSTM model processes the input x t x t = x t + x t-1 , and the cell state c t c t = c t + c t-1This allows the input data and cell state values ​​to convey not only data from the current time point, but also more historical data. An enhanced LSTM model is proposed to capture the input x. t and cell state c t More historical data in the middle can improve the detection capabilities of the enhanced LSTM model for deep learning models.

[0140] The cell structure of the enhanced LSTM. At time step t, for the enhanced LSTM hidden cell, its input x... t =x t +x t-1 This ensures that the input at each time step t includes the input x from the previous time step t-1. t-1 Added c t =c t +c t-1 This step allows more historical data to flow through the network, enhancing the model's ability to learn from historical data. In addition, the enhanced LSTM hidden unit also includes a hidden state h. t-1 Cell state at time step t-1 t-1 The enhanced LSTM hidden unit output includes the hidden state h at time step t. t Cell state c at time step t t .

[0141] like Figure 2 As shown, the information flow or data processing of the enhanced LSTM model is as follows:

[0142] Step 201: Update the first input value x of the enhanced LSTM hidden unit at time step t. t Specifically, this includes: enhancing the first input value x of the LSTM hidden unit at time step t. t The input value x of the enhanced LSTM hidden unit at time step t-1 t-1 Adding them together gives the updated first input value x. t x t =x t +x t-1 ;

[0143] The updated first input value x t This serves as the input data for the enhanced LSTM hidden units at time step t.

[0144] Step 202: The first input value x of the LSTM hidden unit enhanced at time step t. t The hidden state value h of the enhanced LSTM hidden unit at time step t-1 t-1 Cell state value c of the enhanced LSTM hidden unit at time step t-1t-1 , determine the forgetting value f of the enhanced LSTM hidden unit at time step t t ;

[0145] Specifically, the forgetting value f of the enhanced LSTM hidden unit at time step t is determined based on the following formula t :

[0146] f t = x t *sigmod(x t W xf )+h t-1 *tanh(h t-1 W hf )+zhishu(c t-1 W cf )+b f

[0147] Wherein, sigmod is an activation function, tanh is an activation function, zhishu is an activation function, W xf , W hf , W cf Corresponding to the weight matrix of x t , h t-1 , c t-1 ; When x>0, zhishu(x) = x*(exp(x)-1), otherwise zhishu(x) = 0, b f is a bias matrix.

[0148] Step 203, based on the first input value x t of the enhanced LSTM hidden unit at time step t, the hidden state value h t-1 of the enhanced LSTM hidden unit at time step t-1, and the cell state value c t-1 of the enhanced LSTM hidden unit at time step t-1, determine the second input value i t of the enhanced LSTM hidden unit at time step t;

[0149] Specifically, the second input value i t of the enhanced LSTM hidden unit at time step t is determined based on the following formula

[0150] i t = x t *sigmod(x t W xi )+zhishu(h t-1 W hi )+c t-1 *sigmod(c t-1 W ci )+bi

[0151] Where sigmoid is the activation function, W xi W hi W ci They are respectively with x t h t-1 c t-1 The corresponding weight matrix, b i It is a bias matrix. When x>0, zhishu(x)=x*(exp(x)-1), otherwise zhishu(x)=0.

[0152] Step 204, based on the first input value x of the LSTM hidden unit enhanced at time step t. t The hidden state value h of the enhanced LSTM hidden unit at time step t-1 t-1 Determine the candidate cell state values ​​of the enhanced LSTM hidden units at time step t.

[0153] Specifically, this includes determining the candidate cell state values ​​of the enhanced LSTM hidden units at time step t based on the following formula.

[0154]

[0155] Where tanh is the activation function, W xc and W hc They are respectively with x t and h t-1 The corresponding weight matrix, b c It is a bias matrix. When x>0, zhishu(x)=x*(exp(x)-1), otherwise zhishu(x)=0.

[0156] Step 205, based on the cell state value c of the enhanced LSTM hidden unit at time step t-1. t-1 The forgetting value f of the enhanced LSTM hidden unit at time step t t Candidate cell state values ​​of enhanced LSTM hidden units at time step t The second input value i of the enhanced LSTM hidden unit at time step t. t Determine the cell state value c of the enhanced LSTM hidden unit at time step t. t ;

[0157] Specifically, it includes:

[0158] Calculate the cell state value c of the enhanced LSTM hidden unit at time step t-1. t-1 The forgetting value f of the enhanced LSTM hidden unit at time step tt The first Hadamarda I made;

[0159] Calculate the candidate cell state values ​​of the enhanced LSTM hidden units at time step t. The second input value i of the enhanced LSTM hidden unit at time step t. t The second Hadama pile was made;

[0160] Adding the first and second Hadamard products yields the cell state value c of the enhanced LSTM hidden units at time step t. t ;

[0161] Step 206, cell state value c of the enhanced LSTM hidden unit at time step t. t Cell state value c of the enhanced LSTM hidden unit at time step t-1 t-1 The summation yields the cell state value c of the enhanced LSTM hidden unit at the updated time step t. t c t =c t +c t-1 ;

[0162] Step 207, based on the first input value x of the LSTM hidden unit enhanced at time step t. t The hidden state h of the enhanced LSTM hidden unit at time step t-1 t-1 Cell state value c of the enhanced LSTM hidden unit at time step t t Determine the output value o of the enhanced LSTM hidden unit at time step t. t ;

[0163] Specifically, this includes determining the output value of the enhanced LSTM hidden unit at time step t based on the following formula. t :

[0164] o t =x t *sigmod(x t W xo )+zhishu(h t-1 W ho )+c t *tanh(c t W co )+b o

[0165] Where sigmoid is the activation function, tanh is the activation function, and W is the activation function. xo W ho W co They are respectively with x t h t-1 ct The corresponding weight matrix, b o It is the bias matrix; when x>0, zhishu(x)=x*(exp(x)-1), otherwise zhishu(x)=0.

[0166] Step 208 involves calculating the cell state value c of the enhanced LSTM hidden units at time step t. t The output value of the enhanced LSTM hidden unit at time step t. t Determine the hidden state value h of the enhanced LSTM hidden unit at time step t. t ;

[0167] Specifically, this includes determining the hidden state value h of the enhanced LSTM hidden unit at time step t based on the following formula. t :

[0168]

[0169] in, To find the Hadamard product, when x>0, zhishu(x)=x*(exp(x)-1), otherwise zhishu(x)=0.

[0170] The expression for the sigmoid activation function is:

[0171]

[0172] The expression for the tanh activation function is:

[0173]

[0174] The formula for the hidden units (time step t) of the enhanced LSTM model is shown below:

[0175] x t =x t +x t-1 (5.3)

[0176] f t =x t *sigmod(x t W xf )+h t-1 *tanh(h t-1 W hf )+zhishu(c t-1 W cf )+b f (5.4)

[0177] i t =x t *sigmod(x tW xi )+zhishu(h t-1 W hi )+c t-1 *sigmod(c t-1 W ci )+b i (5.5)

[0179]

[0180]

[0181] c t =c t +c t-1 (5.8)

[0182] o t =x t *sigmod(x t W xo )+zhishu(h t-1 W ho )+c t *tanh(c t W co )+b i (5.9)

[0183]

[0184] wherein, the expression of the zhishu activation function includes: when x>0, zhishu(x)=x*(exp(x)-1), otherwise zhishu(x)=0.

[0185] (4) The deep learning model is detected. The input data, the input label, and the enhanced LSTM model are run, and the deep learning model can be successfully classified.

[0186] Therefore, the application provides a method for preventing deep learning models from being attacked. The state of the GPU when the deep learning model running on the terminal equipment to be detected is monitored, and the usage rate, temperature, frequency and other parameters can be monitored. The GPU parameter data processed is put into the enhanced LSTM model as a data set. The model can accurately distinguish the different states of the GPU when the computer runs different deep learning models, and then classify the deep learning models. After determining the type of deep learning, the attack against the type is prevented.

[0187] Exemplary apparatus

[0188] Figure 3is a structural schematic diagram of an apparatus for preventing deep learning models from being attacked provided by an exemplary embodiment of the present application. As shown in Figure 3 The apparatus 300 comprises:

[0189] The acquisition module 310 is configured to acquire GPU parameter data of a computing device on which a deep learning model to be detected runs.

[0190] The output module 320 is configured to input the GPU parameter data into a pre-trained deep learning model classification model, and output a type of the deep learning model to be detected.

[0191] The determination module 330 is configured to determine a defense method of the deep learning model to be detected according to the type of the deep learning model to be detected.

[0192] Alternatively,

[0193] The acquisition module 310 is configured to acquire GPU parameter data of a computing device on which a deep learning model to be detected runs.

[0194] The output module 320 is configured to input the GPU parameter data into a pre-trained deep learning model classification model, and output a type of the deep learning model to be detected.

[0195] The determination module 330 is configured to determine a defense method of the deep learning model to be detected according to the type of the deep learning model to be detected.

[0196] Optionally, the acquisition module 310 comprises:

[0197] The collection submodule is configured to collect a json file of a GPU state of the deep learning model to be detected.

[0198] The selection submodule is configured to convert the json file into a CSV file, and select GPU parameters, including GPU core load, GPU frame buffer, GPU bus interface load, GPU power consumption, GPU high bandwidth expansion bus receiving amount, and GPU high bandwidth expansion bus sending amount.

[0199] Alternatively, the acquisition module 310 comprises:

[0200] The collection submodule is configured to collect a data exchange format file for describing a GPU state of a computing device on which the deep learning model to be detected runs.

[0201] The selecting submodule is configured to convert the data exchange format file into a character-separated value (CSV) file, and obtain GPU parameter data associated with the deep learning model to be detected and data labels obtained by labeling the GPU parameter data from the CSV file.

[0202] The GPU parameter data includes GPU core load, size of a GPU frame buffer, GPU bus interface load, GPU power consumption, data receiving amount of a GPU high-bandwidth expansion bus, and data sending amount of the GPU high-bandwidth expansion bus.

[0203] Optionally, the output module 320 or the training process of the deep learning model classification model in the model training module is as follows:

[0204] The running submodule is configured to run different deep learning models on a pre-arranged terminal device.

[0205] The obtaining submodule is configured to obtain a JSON file of GPU states of the different deep learning models running on the terminal device by using an OpenHardwareMonitor tool, and convert the JSON file into a CSV file, and select preset GPU parameters including GPU core load, GPU frame buffer, GPU bus interface load, GPU power consumption, data receiving amount of a GPU high-bandwidth expansion bus, and data sending amount of the GPU high-bandwidth expansion bus.

[0206] The input submodule is configured to input the GPU parameter data and labels of the different deep learning models into an enhanced LSTM model for training to determine a deep learning model classification model, and the enhanced LSTM model is configured to perform the following operations on input x

[0207] The enhanced LSTM model performs the following operations on input x t The enhanced LSTM model performs the following operations on input x t The enhanced LSTM model performs the following operations on input x t The enhanced LSTM model performs the following operations on input x t-1 The enhanced LSTM model performs the following operations on input x t The enhanced LSTM model performs the following operations on input x t The enhanced LSTM model performs the following operations on input x t The enhanced LSTM model performs the following operations on input x t-1 .

[0208] Alternatively, the model training module includes a pre-training model for determining a classification model of a type of deep learning model,

[0209] The running submodule is configured to run different deep learning models on a pre-arranged terminal device.

[0210] The acquisition sub-module is configured to acquire, by the terminal device, a data exchange format file of a GPU state during runtime of different types of deep learning models and convert the data exchange format file into a CSV file, and acquire GPU parameter data associated with the different types of deep learning models and data labels obtained by labeling the GPU parameter data from the CSV file;

[0211] The GPU parameter data associated with the different types of deep learning models include GPU core load, size of a GPU frame buffer, GPU bus interface load, GPU power consumption, data receiving amount of a GPU high-bandwidth extended bus, and data sending amount of the GPU high-bandwidth extended bus.

[0212] The input sub-module is configured to input the GPU parameter data associated with the different types of deep learning models and the data labels obtained by labeling the GPU parameter data into an enhanced LSTM model for training, to determine a classification model for determining the type of the deep learning model.

[0213] The enhanced LSTM model includes an input layer, a hidden layer, and an output layer.

[0214] The enhanced LSTM model performs enhanced processing on input x t t t =x t +x t-1 , and performs enhanced processing on cell state c t-1 t t-1 =c t-1 +c t-2 .

[0215] t, t-1, and t-2 are time steps, t-1 is a previous time step adjacent to t, and t-2 is a previous time step adjacent to t-1.

[0216] Optionally, the information flow of the enhanced LSTM model in the input sub-module is as follows:

[0217] The input value x t t t of the enhanced LSTM hidden unit at time step t is x t-1 t t -1 .

[0218] The forgetting value f t t of the enhanced LSTM hidden unit at time step t is calculated.

[0219] The input x t t of the enhanced LSTM hidden unit at time step t, the hidden state h t-1 t -1 of the enhanced LSTM hidden unit at time step t-1, and the cell state value c t-1 t -1 of the enhanced LSTM hidden unit at time step t-1 are input into the enhanced LSTM model.The input value i of the enhanced LSTM hidden unit at time step t is obtained by inputting the sigmod activation function t ;

[0220] The input x of the enhanced LSTM hidden unit at time step t t and the hidden state h of the enhanced LSTM hidden unit at time step t-1 t-1 is input into the tanh activation function, and then the candidate cell state value of the enhanced LSTM hidden unit at time step t

[0221] The cell state value c of the enhanced LSTM hidden unit at time step t-1 t-1 and the forget value f of the enhanced LSTM hidden unit at time step t t are multiplied by Hadamard product, and the candidate cell state value of the enhanced LSTM hidden unit at time step t and the input value i of the enhanced LSTM hidden unit at time step t t are added to obtain the cell state value c of the enhanced LSTM hidden unit at time step t t ;

[0222] The cell state value c of the enhanced LSTM hidden unit at time step t t = c t + c t-1 , that is, the cell state value c of the enhanced LSTM hidden unit at time step t t and the cell state value c of the enhanced LSTM hidden unit at time step t-1 t-1 are added to obtain the updated c t ;

[0223] The input x of the enhanced LSTM hidden unit at time step t-1 t , the hidden state h of the enhanced LSTM hidden unit at time step t-1 t-1 and the cell state value c of the enhanced LSTM hidden unit at time step t t are input into the sigmod activation function, and then the output value o of the enhanced LSTM hidden unit at time step t is obtained t ;

[0224] The cell state value c of the enhanced LSTM hidden unit at time step t t is input into the tanh activation function, and the obtained result is multiplied by Hadamard product with the output value o of the enhanced LSTM hidden unit at time step t t , and finally the hidden state value h of the enhanced LSTM hidden unit at time step t is obtained t , wherein

[0225] The sigmod activation function expression is:

[0226]

[0227] The tanh activation function expression is:

[0228]

[0229] The formula of the hidden unit of the enhanced LSTM model is as follows:

[0230] x t = x t + x t-1

[0231] f t = x t * sigmod(x t W xf ) + h t-1 * tanh(h t-1 W hf ) + zhi shu(c t-1 W cf ) + b f

[0232] i t = x t * sigmod(x t W xi ) + zhi shu(h t-1 W hi ) + c t-1 * sigmod(c t-1 W ci ) + b i

[0233]

[0234]

[0235] c t = c t + c t-1

[0236] o t = x t * sigmod(x t W xo ) + zhi shu(h t-1 W ho ) + c t * tanh(c t W co ) + b o

[0237]

[0238] wherein, in calculating i t , W xi , W hi , W ci are weight matrices corresponding to x t , h t-1 , c t-1 respectively, and b i is a bias matrix, in calculating output value o t , W xo , W ho , W co are weight matrices corresponding to x t , h t-1 , c t respectively, and b o is a bias matrix.

[0239] wherein, the expression of zhishu activation function includes: zhishu(x) = x*(exp(x)-1) when x>0, otherwise zhishu(x) = 0.

[0240] Alternatively, the data processing of the enhanced LSTM model comprises:

[0241] updating the first input value x t of the enhanced LSTM hidden unit at time step t;

[0242] comprising: adding the first input value x t of the enhanced LSTM hidden unit at time step t and the input value x t-1 of the enhanced LSTM hidden unit at time step t-1 to obtain the updated first input value x t , x t = x t + x t-1 ;

[0243] taking the updated first input value x t as the input data of the enhanced LSTM hidden unit at time step t.

[0244] based on the first input value x t of the enhanced LSTM hidden unit at time step t, the hidden state value h t-1 of the enhanced LSTM hidden unit at time step t-1 and the cell state value c t-1 of the enhanced LSTM hidden unit at time step t-1, determining the forgetting value f t of the enhanced LSTM hidden unit at time step t;

[0245] This includes determining the forgetting value f of the enhanced LSTM hidden unit at time step t based on the following formula. t :

[0246] f t =x t *sigmod(x t W xf )+h t-1 *tanh(h t-1 W hf )+zhishu(c t-1 W cf )+b f

[0247] Where sigmoid is the activation function, tanh is the activation function, zhishu is the activation function, and W is the activation function. xf W hf W cf They are respectively with x t h t-1 c t-1 The corresponding weight matrix; when x>0, zhishu(x)=x*(exp(x)-1), otherwise zhishu(x)=0, b f It is the bias matrix.

[0248] The first input value x of the LSTM hidden unit enhanced at time step t. t The hidden state value h of the enhanced LSTM hidden unit at time step t-1 t-1 Cell state value c of the enhanced LSTM hidden unit at time step t-1 t-1 Determine the second input value i of the enhanced LSTM hidden unit at time step t. t ;

[0249] This includes determining the second input value i of the enhanced LSTM hidden unit at time step t based on the following formula. t :

[0250] i t =x t *sigmod(x t W xi )+zhishu(h t-1 W hi )+c t-1 *sigmod(c t-1 W ci )+b i

[0251] Where sigmoid is the activation function, W xi W hi Wci are weight matrices corresponding to x t , h t-1 , c t-1 , respectively, b i is a bias matrix, and zhishu(x) = x*(exp(x)-1) when x>0, otherwise zhishu(x) = 0.

[0252] a first input value x t to the enhanced LSTM hidden unit at time step t and a hidden state value h t-1 of the enhanced LSTM hidden unit at time step t-1, determines a candidate cell state value

[0253] includes determining the candidate cell state value of the enhanced LSTM hidden unit at time step t based on the following equation

[0254]

[0255] where tanh is an activation function, W xc and W hc are weight matrices corresponding to x t and h t-1 , respectively, b c is a bias matrix, and zhishu(x) = x*(exp(x)-1) when x>0, otherwise zhishu(x) = 0.

[0256] a cell state value c t-1 of the enhanced LSTM hidden unit at time step t-1, a forget value f t of the enhanced LSTM hidden unit at time step t, the candidate cell state value of the enhanced LSTM hidden unit at time step t, and a second input value i t to the enhanced LSTM hidden unit at time step t, determines a cell state value c t of the enhanced LSTM hidden unit at time step t;

[0257] includes:

[0258] computing a first Hadamard product of the cell state value c t-1 of the enhanced LSTM hidden unit at time step t-1 and the forget value f t of the enhanced LSTM hidden unit at time step t;

[0259] computing the candidate cell state value The second input value i of the enhanced LSTM hidden unit at time step t. t The second Hadama pile was made;

[0260] Adding the first and second Hadamard products yields the cell state value c of the enhanced LSTM hidden units at time step t. t ;

[0261] Cell state value c of the enhanced LSTM hidden unit at time step t t Cell state value c of the enhanced LSTM hidden unit at time step t-1 t-1 The summation yields the cell state value c of the enhanced LSTM hidden unit at the updated time step t. t c t =c t +c t-1 ;

[0262] The first input value x of the LSTM hidden unit enhanced at time step t. t The hidden state h of the enhanced LSTM hidden unit at time step t-1 t-1 Cell state value c of the enhanced LSTM hidden unit at time step t t Determine the output value o of the enhanced LSTM hidden unit at time step t. t ;

[0263] This includes determining the output value o of the enhanced LSTM hidden unit at time step t based on the following formula. t :

[0264] o t =x t *sigmod(x t W xo )+zhishu(h t-1 W ho )+c t *tanh(c t W co )+b o

[0265] Where sigmoid is the activation function, tanh is the activation function, and W is the activation function. xo W ho W co They are respectively with x t h t-1 c t The corresponding weight matrix, b o It is the bias matrix. The expression for the activation function zhishu includes: when x>0, zhishu(x)=x*(exp(x)-1), otherwise zhishu(x)=0.

[0266] cell state value c of the enhanced LSTM hidden unit at time step t t and output value o of the enhanced LSTM hidden unit at time step t t determining a hidden state value h of the enhanced LSTM hidden unit at time step t t ;

[0267] comprising determining a hidden state value h of the enhanced LSTM hidden unit at time step t based on the following equation t :

[0268]

[0269] wherein, zhishu(x) = x * (exp(x) - 1) for x > 0, otherwise zhishu(x) = 0.

[0270] Exemplary electronic device

[0271] Figure 4 is a structure of an electronic device provided by an exemplary embodiment of the present application. As shown in Figure 4 , the electronic device 40 includes one or more processors 41 and a memory 42.

[0272] The processor 41 can be a central processing unit (CPU) or other form of processing unit that has data processing capability and / or instruction execution capability, and can control other components in the electronic device to perform desired functions.

[0273] The memory 42 can include one or more computer program products that can include various forms of computer-readable storage media, such as volatile memory and / or non-volatile memory. The volatile memory, for example, can include random access memory (RAM), cache, and / or the like. The non-volatile memory, for example, can include read only memory (ROM), hard disk, flash memory, and / or the like. One or more computer program instructions can be stored on the computer-readable storage media, and the processor 41 can execute the program instructions to implement the methods of the software programs of the various embodiments of the present application described above and / or other desired functions. In one example, the electronic device can further include an input device 43 and an output device 44, which are interconnected through a bus system and / or other form of connection mechanism (not shown).

[0274] In addition, the input device 43 can further include, for example, a keyboard, a mouse, and / or the like.

[0275] The output device 44 can externally output various information. The output device 44 can include, for example, a display, a speaker, a printer, a communication network and a remote output device connected thereto, and the like.

[0276] Of course, in order to simplify, Figure 4 Only some of the components of the electronic device related to the present application are shown in FIG. 1, and components such as a bus, an input / output interface, and the like are omitted. In addition to this, the electronic device can further include any other appropriate components according to a specific application.

[0277] Exemplary computer program product and computer readable storage medium

[0278] In addition to the above-mentioned methods and devices, embodiments of the present application can also be a computer program product including computer program instructions that, when executed by a processor, cause the processor to perform steps of the methods according to various embodiments of the present application described in the above "Exemplary Method" section of this specification.

[0279] The computer program product can be written in any combination of one or more programming languages, including an object oriented programming language such as Java, C++, etc., and conventional procedural programming languages, such as the "C" programming language or similar programming languages. The program code can execute entirely on the user's computing device, partly on the user's device, as a stand-alone software package, partly on the user's computing device and partly on a remote computing device or entirely on the remote computing device or server.

[0280] In addition, embodiments of the present application can also be a computer readable storage medium having stored thereon computer program instructions which, when executed by a processor, cause the processor to perform steps of the methods according to various embodiments of the present application described in the above "Exemplary Method" section of this specification.

[0281] The computer readable storage medium can be any combination of one or more non-transitory media. The non-transitory medium can be a non-transitory signal medium or a non-transitory storage medium. The non-transitory storage medium can include, for example, but is not limited to, an electronic, magnetic, optical, electromagnetic, infrared, or semiconductor system, apparatus, or device, or any suitable combination of the above. More specific examples (a non-exhaustive list) of the non-transitory storage medium include an electrical connection having one or more wires, a portable disc, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disc read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the above.

[0282] The above describes the basic principles of the present application in conjunction with specific embodiments, but it should be noted that the advantages, benefits, effects and the like mentioned in the present application are only examples and are not limiting, and these advantages, benefits, effects and the like should not be considered as necessary for each embodiment of the present application. In addition, the above specific details disclosed are only for the purpose of illustration and understanding, and are not limiting, and the above details do not limit the present application to be necessarily implemented with the above specific details.

[0283] Each embodiment in the specification is described in a progressive manner, and each embodiment focuses on the differences from other embodiments, and the same or similar parts between each embodiment can be understood by referring to each other. For system embodiments, since they basically correspond to method embodiments, the description is relatively simple, and the relevant parts can be understood by referring to the part of the method embodiment.

[0284] The block diagrams of the devices, systems, apparatuses, systems involved in the present application are only exemplary examples and are not intended to require or imply the connection, arrangement, configuration shown in the block diagram. As those skilled in the art will recognize, these devices, systems, apparatuses, systems can be connected, arranged, configured in any manner. Words such as "include", "contain", "have" and the like are open-ended words, which mean "including but not limited to", and can be used interchangeably. The words "or" and "and" used herein mean the word "and / or", and can be used interchangeably unless the context clearly indicates otherwise. The word "such as" used herein means the phrase "such as but not limited to", and can be used interchangeably.

[0285] The method and system of the present application can be implemented in many ways. For example, the method and system of the present application can be implemented by software, hardware, firmware or any combination of software, hardware and firmware. The above order of steps for the method is only for illustration, and the steps of the method of the present application are not limited to the above specific description, unless otherwise specifically described. In addition, in some embodiments, the present application can also be implemented as programs recorded in recording media, which include machine-readable instructions for implementing the method according to the present application. Therefore, the present application also covers the recording media storing the programs for executing the method according to the present application.

[0286] It is also important to note that the systems, devices and methods described herein can be capable of implementing various aspects as components or steps. These components and / or steps can be rearranged and / or complemented by other components and / or steps. The above description of the disclosed aspects is meant to be illustrative only and is not intended to be limiting in any way. Numerous variations and modifications will become apparent to those skilled in the art once the above description is understood. For example, the above description has described various aspects and embodiments in the context of a single network. However, the various aspects and embodiments can be implemented in the context of multiple networks. Accordingly, the scope should be judged in relation to the claims and any of their equivalents.

[0287] The foregoing description has been presented for the purposes of illustration and description. Furthermore, the description is not intended to limit the embodiments of the application to the forms disclosed herein. Although the above discussion has discussed several example aspects and embodiments, those of ordinary skill in the art will recognize that certain variations, modifications, changes, additions and sub-combinations can be made without departing from the scope of the application.

Claims

1. A method for preventing a deep learning model from being attacked, characterized in that, The method comprises: obtaining parameter data of a graphics processing unit (GPU) of a computing device where a to-be-detected deep learning model runs; inputting the parameter data of the GPU into a pre-trained classification model for determining the type of the deep learning model, and outputting the type of the to-be-detected deep learning model; and selecting a defense method for the to-be-detected deep learning model from multiple defense methods according to the type of the to-be-detected deep learning model, to prevent the deep learning model from being attacked. The method further comprises pre-training the classification model for determining the type of the deep learning model, which comprises: running deep learning models of different types on a pre-arranged terminal device; obtaining a data exchange format file of a GPU state when the deep learning models of different types run through the terminal device, and converting the data exchange format file into a CSV file, obtaining GPU parameter data associated with the deep learning models of different types and data labels obtained by labeling the GPU parameter data from the CSV file, inputting the GPU parameter data associated with the deep learning models of different types and the data labels obtained by labeling the GPU parameter data into an enhanced LSTM model for training, to determine the classification model for determining the type of the deep learning model, Wherein, the enhanced LSTM model is enhanced on input x t x t = x t + x t-1 , and the cell state c t-1 c t-1 = c t-1 + c t-2 , wherein t, t-1 and t-2 are time steps, t-1 is a previous time step adjacent to time step t, and t-2 is a previous time step adjacent to t-1. The data processing of the enhanced LSTM model comprises: first input value x of the enhanced LSTM hidden unit at time step t t ; a first input value x of the enhanced LSTM hidden unit at time step t t a hidden state value h of the enhanced LSTM hidden unit at time step t-1 t-1 a cell state value c of the enhanced LSTM hidden unit at time step t-1 t-1 determining a forget value f of the enhanced LSTM hidden unit at time step t t ; a first input value x of the enhanced LSTM hidden unit at time step t t a hidden state value h of the enhanced LSTM hidden unit at time step t-1 t-1 a cell state value c of the enhanced LSTM hidden unit at time step t-1 t-1 determining a second input value i of the enhanced LSTM hidden unit at time step t t ; a first input value x of the enhanced LSTM hidden unit at time step t t and a hidden state value h of the enhanced LSTM hidden unit at time step t-1 t-1 determining a candidate cell state value of the enhanced LSTM hidden unit at time step t a cell state value c of the enhanced LSTM hidden unit at time step t-1 t-1 a forget value f of the enhanced LSTM hidden unit at time step t t a candidate cell state value of the enhanced LSTM hidden unit at time step t a second input value i of the enhanced LSTM hidden unit at time step t t determining a cell state value c of the enhanced LSTM hidden unit at time step t t ; Cell state value c of the enhanced LSTM hidden unit at time step t t Cell state value c of the enhanced LSTM hidden unit at time step t-1 t-1 c t , c t = c t + c t-1 ; a first input value x for the enhanced LSTM hidden unit at time step t t a hidden state h of the enhanced LSTM hidden unit at time step t-1 t-1 a cell state value c of the enhanced LSTM hidden unit at time step t t an output value o of the enhanced LSTM hidden unit at time step t t ; a cell state value c of the enhanced LSTM hidden unit at time step t t an output value o of the enhanced LSTM hidden unit at time step t t a hidden state value h of the enhanced LSTM hidden unit at time step t t .

2. The method of claim 1, wherein, obtaining parameter data of a graphics processing unit (GPU) of a computing device where a to-be-detected deep learning model runs, which comprises: collecting a data exchange format file for describing a GPU state of the computing device where the to-be-detected deep learning model runs; converting the data exchange format file into a character-separated value (CSV) file, and obtaining GPU parameter data associated with the to-be-detected deep learning model and data labels obtained by labeling the GPU parameter data from the CSV file, wherein the GPU parameter data comprises: GPU core load, size of a GPU frame buffer, GPU bus interface load, GPU power consumption, data reception amount of a GPU high-bandwidth expansion bus, and data transmission amount of the GPU high-bandwidth expansion bus. wherein, 3. The method of claim 1, wherein 4. An apparatus for preventing a deep learning model from being attacked, the apparatus comprising: the GPU parameter data associated with the deep learning models of different types comprises: GPU core load, size of a GPU frame buffer, GPU bus interface load, GPU power consumption, data reception amount of a GPU high-bandwidth expansion bus, and data transmission amount of the GPU high-bandwidth expansion bus. The method comprises: an obtaining module, configured to obtain parameter data of a graphics processing unit (GPU) of a computing device where a to-be-detected deep learning model runs; an outputting module, configured to input the parameter data of the GPU into a pre-trained classification model for determining the type of the deep learning model, and output the type of the to-be-detected deep learning model; and The determining module is configured to select a defense method for the to-be-detected deep learning model from a plurality of defense methods according to a type of the to-be-detected deep learning model, so as to prevent the deep learning model from being attacked. Further comprising, A model training module for pre-training a classification model for determining the type of the deep learning model, and a running submodule for running different types of deep learning models on a pre-arranged terminal device; An obtaining submodule for obtaining a data exchange format file of a GPU state of the different types of deep learning models in running through the terminal device and converting the data exchange format file into a CSV file, and obtaining GPU parameter data associated with the different types of deep learning models and data labels obtained by labeling the GPU parameter data from the CSV file; An input submodule for inputting the GPU parameter data associated with the different types of deep learning models and the data labels obtained by labeling the GPU parameter data into an enhanced LSTM model for training, and determining the classification model for determining the type of the deep learning model, Wherein, The enhanced LSTM model processes the input x t The enhanced LSTM model processes the input x t = x t + x t-1 The enhanced LSTM model processes the input x t-1 The enhanced LSTM model processes the input x t-1 = c t-1 + c t-2 The enhanced LSTM model processes the input x Wherein, t, t-1 and t-2 are time steps, time step t-1 is a previous time step adjacent to time step t, and time step t-2 is a previous time step adjacent to time step t-1. The information flow or data processing of the enhanced LSTM model in the input submodule includes: first input value x of the enhanced LSTM hidden unit at time step t t ; a first input value x of the enhanced LSTM hidden unit at time step t t a hidden state value h of the enhanced LSTM hidden unit at time step t-1 t-1 a cell state value c of the enhanced LSTM hidden unit at time step t-1 t-1 determining a forget value f of the enhanced LSTM hidden unit at time step t t ; a first input value x of the enhanced LSTM hidden unit at a time step t t a hidden state value h of the enhanced LSTM hidden unit at a time step t-1 t-1 a cell state value c of the enhanced LSTM hidden unit at a time step t-1 t-1 determining a second input value i of the enhanced LSTM hidden unit at the time step t t ; a first input value x of the enhanced LSTM hidden unit at time step t t and a hidden state value h of the enhanced LSTM hidden unit at time step t-1 t-1 determining a candidate cell state value of the enhanced LSTM hidden unit at time step t a cell state value c of the enhanced LSTM hidden unit at time step t-1 t-1 a forget value f of the enhanced LSTM hidden unit at time step t t a candidate cell state value of the enhanced LSTM hidden unit at time step t a second input value i of the enhanced LSTM hidden unit at time step t t determining a cell state value c of the enhanced LSTM hidden unit at time step t t ; Cell state value c of the enhanced LSTM hidden unit at time step t t Cell state value c of the enhanced LSTM hidden unit at time step t-1 t-1 c = c + c t , c t = c t +c t-1 ; a first input value x of the enhanced LSTM hidden unit at a time step t t a hidden state h of the enhanced LSTM hidden unit at a time step t-1 t-1 a cell state value c of the enhanced LSTM hidden unit at the time step t t an output value o of the enhanced LSTM hidden unit at the time step t t ; a cell state value c of the enhanced LSTM hidden unit at time step t t and an output value o of the enhanced LSTM hidden unit at time step t t , a hidden state value h of the enhanced LSTM hidden unit at time step t t is determined.

5. The apparatus of claim 4, wherein, An obtaining module comprising: A collecting submodule for collecting a data exchange format file for describing a GPU state of a computing device in which the to-be-detected deep learning model is running; A selecting submodule for converting the data exchange format file into a character-separated value (CSV) file, and obtaining GPU parameter data associated with the to-be-detected deep learning model and data labels obtained by labeling the GPU parameter data from the CSV file; Wherein, the GPU parameter data includes GPU core load, size of GPU frame buffer, GPU bus interface load, GPU power consumption, data reception amount of GPU high bandwidth expansion bus, and data transmission amount of GPU high bandwidth expansion bus.

6. The apparatus of claim 4, wherein, Wherein, The GPU parameter data associated with the different types of deep learning models includes GPU core load, size of GPU frame buffer, GPU bus interface load, GPU power consumption, data reception amount of GPU high bandwidth expansion bus, and data transmission amount of GPU high bandwidth expansion bus.

7. A computer readable storage medium characterized in that, The storage medium stores a computer program, and the computer program is used to execute the method in any one of claims 1-3.

8. An electronic device, comprising: The electronic device comprises: A processor; A memory for storing executable instructions of the processor; The processor is configured to read the executable instructions from the memory and execute the instructions to implement the method in any one of claims 1-3.

Images