Reverse osmosis defense device against model extraction attacks

Abstract

The application provides a reverse osmosis defense device against model extraction attacks, which has the characteristics of comprising a data storage module; a honeypot setting module for replacing the classification layer of a specified model with a honeypot layer to obtain a honeypot model; a shadow model training module for training a shadow model on the honeypot model through model extraction attack on shadow data samples; a verification sample generation module for combining a trigger with each initial sample to obtain multiple verification samples; a trigger updating module for updating the trigger according to the trained shadow model and the verification samples; a honeypot layer fine-tuning module for fine-tuning the honeypot model according to the shadow data samples and the corresponding verification samples of the updated trigger; and an iteration control module for judging whether the honeypot model reaches a preset termination condition, and if yes, obtaining the honeypot model, and if not, controlling the shadow model training module to run. In summary, the method can effectively identify and stop the infringement of model extraction attacks without introducing additional risks.

Description

Technical Field

[0001] This invention belongs to the field of artificial intelligence security, specifically relating to a reverse penetration defense device against model extraction attacks. Background Technology

[0002] In recent years, with the continuous development and popularization of machine learning technology, more and more people hope to use artificial intelligence systems in their daily work and life to provide convenience. The emergence of Machine Learning as a Service (MLaaS) platforms makes it easy for people to use these models. Users interact with models on MLaaS through application programming interfaces (APIs), sending sample query requests to obtain corresponding predicted probability outputs. However, some recent studies have pointed out that these MLaaS platforms may be vulnerable to model extraction attacks, leading to intellectual property leaks. Specifically, model extraction methods aim to obtain a replacement model with similar functionality to the victim model through black-box queries. Attackers use this replacement model to provide services to other users for profit, thereby infringing on the rights of the victim model's owner. The common practice of existing model extraction attacks is to first collect a large number of image samples from the Internet or other sources, or synthesize them using generative models. Then, some sample selection strategies are used to select samples from these samples to query the victim model. After the query, these samples, along with the original samples, form a transfer set. Using this transfer set to train a model, a replacement model with similar functionality to the victim model can be obtained.

[0003] To address the challenges posed by model extraction attacks, model extraction defense algorithms have been continuously developed. Existing defense algorithms can be divided into two main categories: active defense and passive defense, corresponding to four subcategories: extraction detection, model watermarking, proof-of-work, and prediction perturbation.

[0004] Extraction detection monitors user queries and distinguishes between legitimate and malicious users based on differences in query behavior. However, this method relies heavily on a prior assumption; if the prior is inaccurate, it can lead to inaccurate differentiation. Model watermarking is a recently popular method that embeds unique, extractable features into the victim model. When a malicious user launches an extraction attack, they extract these watermark features into their replacement model. Subsequent verification of the presence of the watermark feature in the suspect model confirms whether the extraction was successful, thus achieving intellectual property verification. However, this method often requires training during the model's development phase, resulting in significant computational overhead, and it cannot protect numerous pre-trained victim models. Furthermore, this method is limited to ownership authentication and cannot further effectively prevent infringement. A representative proactive defense method is prediction perturbation, which adds a carefully designed adversarial perturbation to the victim model's original probability prediction output, preventing attackers from training a replacement model using this modified probability prediction. However, this method often requires calculating the perturbation individually for each sample, resulting in substantial computational overhead. Furthermore, this practice of blocking during the extraction process often exacerbates the adversarial process, leading to the development of more powerful extraction algorithms. For example, there are now algorithms that can extract data using only hard labels. Proof-of-work is also a proactive defense algorithm that monitors and estimates the potential privacy breaches of victim models caused by user queries and accordingly increases the difficulty of user queries, thereby preventing potentially malicious users from making queries. However, real attackers are often very cunning; for example, they may use multiple accounts to query and collect data separately, thus evading detection.

[0005] In summary, most existing defense methods are computationally inefficient or introduce additional risks, or are limited to ownership verification and cannot take further effective measures to stop infringement. Summary of the Invention

[0006] This invention was made to solve the above-mentioned problems, and its purpose is to provide a reverse penetration defense device against model extraction attacks.

[0007] This invention provides a reverse penetration defense device against model extraction attacks, used to obtain a honeypot model of a specified model. The specified model obtains a corresponding classification result based on an input image. It features the following components: a data storage module for storing a shadow model, a trigger, multiple shadow data samples, and multiple initial samples, where the shadow data samples and initial samples are images suitable for the task corresponding to the specified model; a honeypot setting module storing an initialized honeypot layer for replacing the classification layer of the specified model with the honeypot layer to obtain the honeypot model; a shadow model training module for training the shadow model by performing a model extraction attack on the honeypot model based on the shadow data samples; and a verification sample generation module. The system combines triggers with each initial sample to obtain multiple validation samples. A trigger update module updates the triggers based on the trained shadow model and validation samples. A honeypot layer fine-tuning module fine-tunes the honeypot model based on the shadow data samples and the validation samples corresponding to the updated triggers. An iteration control module determines whether the fine-tuned honeypot model meets a preset termination condition. If yes, the honeypot model is obtained; otherwise, the shadow model training module is controlled to run. The preset termination condition is that the classification result of the fine-tuned honeypot model on the image is the same as the classification result of the specified model on the same image, and the recognition result of the fine-tuned honeypot model on the validation samples is the same as the preset result.

[0008] The reverse penetration defense device against model extraction attacks provided by this invention may also have the following feature: In the shadow model training module, the model extraction attack involves inputting each shadow data sample into the honeypot model to obtain the corresponding output result, using all shadow data samples and the corresponding output result as a transfer set, and training the shadow model based on the transfer set.

[0009] The reverse penetration defense device against model extraction attacks provided by the present invention may also have the following feature: wherein the verification sample generation module stores a preset mask, and the trigger is limited to a specific position of the initial sample by the mask to obtain the verification sample corresponding to the initial sample.

[0010] The reverse penetration defense device against model extraction attacks provided by this invention may also have the following feature: In the trigger update module, the trigger is updated according to a trigger update rule, the expression of which is: In the formula δ i For the updated trigger, δ i-1 The trigger before the update is defined as follows: α is the momentum parameter, ∈ is the update step size, sign(·) is the sign function, M is the mask, and M⊙x+(1-M)⊙δ. i-1 Let y be the validation sample corresponding to the initial sample x. tar get To verify the preset results corresponding to the samples, For loss function calculation operations, This is the set of initial samples.

[0011] The reverse penetration defense device against model extraction attacks provided by this invention may also have the following feature: in the honeypot layer fine-tuning module, when the honeypot model outputs a normal classification result based on the shadow data sample, and the honeypot model outputs an abnormal preset result based on the verification sample corresponding to the updated trigger, a fine-tuned honeypot model is obtained.

[0012] The reverse penetration defense device against model extraction attacks provided by this invention may also have the following features: a test data storage module for storing all verification samples corresponding to the finally updated trigger as suspected test samples, and preset results corresponding to each suspected test sample; an accuracy calculation module for comparing the identification results of the suspected model for each suspected test sample with the preset results corresponding to the suspected test sample, and statistically obtaining the overlap rate; and a suspected model judgment module for storing a preset overlap rate threshold for judging whether the overlap rate is greater than the overlap rate threshold. If so, the suspected model is obtained by performing a model extraction attack on the honeypot model.

[0013] The role and effect of invention

[0014] The reverse penetration defense device for model extraction attacks according to the present invention, on the one hand, simulates the model extraction attack process, obtains a shadow model based on the honeypot model, and thus optimizes and updates the trigger; on the other hand, it optimizes and updates the honeypot model based on the trigger, thereby achieving a two-layer optimization to obtain a honeypot model and trigger that can achieve a good attack success rate against the suspected model. Therefore, the reverse penetration defense device for model extraction attacks of the present invention can effectively identify and stop the infringement of model extraction attacks without introducing additional risks. Attached Figure Description

[0015] Figure 1 This is a block diagram of the reverse penetration defense device in an embodiment of the present invention;

[0016] Figure 2 This is a schematic diagram illustrating the principle of the reverse penetration defense method against model extraction attacks in an embodiment of the present invention;

[0017] Figure 3 This is a schematic diagram of the process of generating a honeypot model for a penetration defense device in an embodiment of the present invention;

[0018] Figure 4 This is a schematic diagram of the process of verifying a suspected model using a penetration defense device in an embodiment of the present invention. Detailed Implementation

[0019] To make the technical means, creative features, objectives and effects of the present invention easy to understand, the following embodiments, in conjunction with the accompanying drawings, provide a detailed description of the reverse penetration defense device against model extraction attacks of the present invention.

[0020] This embodiment provides a reverse penetration defense device against model extraction attacks, hereinafter referred to as the reverse penetration defense device, used to obtain a honeypot model of a specified model, which obtains a corresponding classification result based on the input image. In this embodiment, the specified model is used to obtain the corresponding classification result based on the input image.

[0021] Figure 1 This is a block diagram of the reverse penetration defense device in an embodiment of the present invention.

[0022] like Figure 1 As shown, the reverse penetration defense device 100 includes a data storage module 11, a honeypot setting module 12, a shadow model training module 13, a verification sample generation module 14, a trigger update module 15, a honeypot layer fine-tuning module 16, an iteration control module 17, a test data storage module 18, a accuracy calculation module 19, a suspect judgment module 20, and a master control module 21 that controls the above modules.

[0023] The data storage module 11 is used to store the shadow model, trigger, multiple shadow data samples, and multiple initial samples. The shadow data samples and initial samples are images applicable to the corresponding tasks of the specified model.

[0024] The honeypot setting module 12 stores the initialized honeypot layer, which is used to replace the classification layer of the specified model with the honeypot layer to obtain the honeypot model.

[0025] The shadow model training module 13 is used to perform model extraction attacks on the honeypot model based on shadow data samples, and to train the shadow model. In this embodiment, the shadow model is used to simulate the model extraction attack process, thereby obtaining a shadow model similar to the attacker's alternative model.

[0026] In the shadow model training module 13, the model extraction attack involves inputting each shadow data sample into the honeypot model to obtain the corresponding output. Then, all shadow data samples and their corresponding outputs are used as a transfer set, and the shadow model is trained based on this transfer set.

[0027] The verification sample generation module 14 is used to combine the trigger with each initial sample to obtain multiple verification samples.

[0028] The verification sample generation module 14 stores a preset mask, which is used to limit the trigger to a specific position of the initial sample, thereby obtaining the verification sample corresponding to the initial sample. In this embodiment, the preset mask is a binary mask.

[0029] The trigger update module 15 is used to update the trigger based on the trained shadow model and the validation samples.

[0030] In this embodiment, the trigger is used as a general adversarial perturbation that affects the alternative model. The honeypot layer is adjusted so that it and the alternative model have the same adversarial vulnerability to the trigger. Therefore, any model extracted from the honeypot layer will be attacked by this adversarial perturbation, expressed as:

[0031]

[0032] In the formula, δ is a trigger. This is an alternative model extracted by the attacker.

[0033] In this embodiment, the trigger can be obtained through stochastic gradient descent using a method similar to the calculation of the Fast Gradient Sign (FGSM), and its expression is as follows:

[0034]

[0035] Furthermore, this trigger is updated on the shadow model. That is, the trigger is updated in the trigger update module 15 according to the trigger update rule, the expression of which is:

[0036]

[0037] In the formula δ i For the updated trigger, δ i-1 The trigger before the update is defined as follows: α is the momentum parameter, ∈ is the update step size, sign(·) is the sign function, M is the mask, and M⊙x+(1-M)⊙δ. i-1 Let y be the validation sample corresponding to the initial sample x. tar get To verify the preset results corresponding to the samples, For loss function calculation operations, For the initial set of samples, For the shadow model. The loss function in this embodiment... Commonly used loss functions include, for example, the cross-entropy loss function.

[0038] The honeypot layer fine-tuning module 16 is used to fine-tune the honeypot model based on the shadow data samples and the verification samples corresponding to the updated triggers.

[0039] In the honeypot layer fine-tuning module 16, the honeypot model outputs a normal classification result based on the shadow data sample, and the honeypot model outputs an abnormal preset result based on the verification sample corresponding to the updated trigger, thus obtaining the fine-tuned honeypot model.

[0040] The iteration control module 17 is used to determine whether the fine-tuned honeypot model has reached the preset termination condition. If it has, the honeypot model is obtained; otherwise, the shadow model training module 13 is controlled to run.

[0041] The preset termination condition is that the classification result of the fine-tuned honeypot model on the image is the same as the classification result of the specified model on the image, and the recognition result of the fine-tuned honeypot model on the verification sample is the same as the preset result.

[0042] The test data storage module 18 is used to store all the verification samples corresponding to the finally updated trigger as suspected test samples, and the preset results corresponding to each suspected test sample.

[0043] The accuracy calculation module 19 compares the identification results of the suspect model for each suspect test sample with the preset results corresponding to that suspect test sample, and calculates the overlap rate. The overlap rate is the proportion of the suspect model's identification results for all suspect test samples that are the same as the preset results.

[0044] The suspect judgment module 20 stores a preset overlap rate threshold, which is used to determine whether the overlap rate is greater than the overlap rate threshold. If so, the suspect model is obtained by performing a model extraction attack on the honeypot model.

[0045] The main control module 21 stores the control program that controls the operation of each module.

[0046] The following description, in conjunction with the accompanying drawings, explains the principle and process of the reverse penetration defense method using the reverse penetration defense device 100 to target model extraction attacks.

[0047] Figure 2 This is a schematic diagram illustrating the principle of a reverse penetration defense method against model extraction attacks in an embodiment of the present invention.

[0048] like Figure 2 As shown, a honeypot model is obtained by replacing and training a specified model (victim model) using a reverse penetration defense device 100. An attacker then performs a model extraction attack on this honeypot model to obtain a suspect model (replacement model). Multiple initial samples (clean images) and multiple suspect test samples (images with triggered backdoors) are selected from the reverse penetration defense device 100 and input into the suspect model. If the suspect model correctly predicts a certain percentage of clean images and incorrectly predicts a certain percentage of images with triggered backdoors, then the suspect model is considered an illegal model, obtained through a model extraction attack.

[0049] In this embodiment, for illegal models, the corresponding suspected test samples can be used to further attack and manipulate the illegal model, thereby stopping the infringement and achieving a more effective model extraction defense. Furthermore, since the triggers of the suspected test samples are based on adversarial examples, they are more covert and less likely to be detected than traditional triggers, thus avoiding potential additional risks.

[0050] In this embodiment, the process of using the reverse penetration defense device 100 to perform a reverse penetration defense method against model extraction attacks includes two parts: honeypot model generation and suspect model judgment.

[0051] Figure 3 This is a schematic diagram of the process of generating a honeypot model for a penetration defense device in an embodiment of the present invention.

[0052] like Figure 3 As shown, generating a honeypot model for the penetration defense device 100 includes the following steps:

[0053] Step S1: The data storage module 11 is used to store the shadow model, trigger, multiple shadow data samples, and multiple initial samples. The shadow data samples and initial samples are images applicable to the corresponding tasks of the specified model.

[0054] Step S2: Use the honeypot setting module 12 to replace the classification layer of the specified model with the honeypot layer to obtain the honeypot model.

[0055] Step S3: The shadow model training module 13 is used to perform a model extraction attack on the honeypot model based on the shadow data samples to train the shadow model.

[0056] Step S4: The verification sample generation module 14 combines the trigger with each initial sample to obtain multiple verification samples.

[0057] Step S5: The trigger update module 15 updates the trigger based on the trained shadow model and the validation samples.

[0058] Step S6: The honeypot layer fine-tuning module 16 is used to fine-tune the honeypot model based on the shadow data sample and the verification sample corresponding to the updated trigger.

[0059] Step S7: The iterative control module 17 determines whether the fine-tuned honeypot model has reached the preset termination condition. If yes, the honeypot model is obtained; otherwise, the shadow model training module 13 is controlled to run.

[0060] Figure 4 This is a schematic diagram of the process of verifying a suspected model using a penetration defense device in an embodiment of the present invention.

[0061] like Figure 4As shown, the verification of a suspected model using the penetration defense device 100 includes the following steps:

[0062] Step T1: The test data storage module 18 is used to store all the verification samples corresponding to the finally updated trigger as suspected test samples, and the preset results corresponding to each suspected test sample.

[0063] In step T2, the accuracy calculation module 19 compares the identification results of the suspect model for each suspect test sample with the preset results corresponding to the suspect test sample, and calculates the overlap rate.

[0064] Step T3: The suspect judgment module 20 is used to determine whether the overlap rate is greater than the overlap rate threshold. If so, the suspect model is obtained by performing a model extraction attack on the honeypot model.

[0065] In this embodiment, the reverse penetration defense method targeting model extraction attacks of the reverse penetration defense device 100 is used as the method. This method is used to train honeypot models and suspect test samples on four existing datasets: CIFAR10, CIFAR100, CUBS200, and Caltech256. Then, existing model stealing methods KnockoffNet and ActiveThief are used to steal models from the honeypot models to generate suspect models. The success rate of the suspect test samples attacking each suspect model, i.e., the probability of generating the preset result, is shown in the table below:

[0066]

[0067]

[0068] The first column represents different model extraction methods, and the second to fifth columns represent the attack success rates on different datasets. For example, the cell in the second row and second column indicates that the attack success rate of the suspected test sample on the suspected model generated by the honeypot model trained by KnockoffNets on the CIFAR10 dataset is 59.35%. This demonstrates that this method can effectively identify model extraction attacks and can be prevented through backdoor attacks.

[0069] The role and effect of the embodiments

[0070] According to the reverse penetration defense device against model extraction attacks involved in this embodiment, on the one hand, the model extraction attack process is simulated to obtain a shadow model based on the honeypot model, thereby optimizing and updating the trigger; on the other hand, the honeypot model is optimized and updated based on the trigger, thus achieving a two-layer optimization to obtain a honeypot model and trigger that can achieve a good attack success rate against the suspected model. In summary, this method can effectively identify and stop the infringement of model extraction attacks without introducing additional risks.

[0071] Those skilled in the art should understand that this invention is not limited to the above embodiments. The embodiments and descriptions in the specification are merely illustrative of the principles of the invention. Various changes and modifications can be made to this invention without departing from its spirit and scope, and all such changes and modifications fall within the scope of the invention as claimed. The scope of protection of this invention is defined by the appended claims and their equivalents.

Claims

1. A reverse penetration defense device against model extraction attacks, used to obtain a honeypot model of a specified model, wherein the specified model obtains a corresponding classification result based on an input image, characterized in that, include: The data storage module is used to store the shadow model, trigger, multiple shadow data samples, and multiple initial samples, wherein the shadow data samples and the initial samples are images applicable to the task corresponding to the specified model; The honeypot setting module stores an initialized honeypot layer, which is used to replace the classification layer of the specified model with the honeypot layer to obtain a honeypot model. The shadow model training module is used to perform a model extraction attack on the honeypot model based on the shadow data samples, and train the shadow model. A verification sample generation module is used to combine the trigger with each of the initial samples to obtain multiple verification samples; The trigger update module is used to update the trigger based on the trained shadow model and the validation samples; The honeypot layer fine-tuning module is used to fine-tune the honeypot model based on the shadow data samples and the updated verification samples corresponding to the triggers. The iteration control module is used to determine whether the fine-tuned honeypot model has reached the preset termination condition. If so, the honeypot model is obtained; otherwise, the shadow model training module is controlled to run. The preset termination condition is that the classification result of the image by the fine-tuned honeypot model is the same as the classification result of the image by the specified model, and the recognition result of the verification sample by the fine-tuned honeypot model is the same as the preset result.

2. The reverse penetration defense device against model extraction attacks according to claim 1, characterized in that: in, In the shadow model training module, the model extraction attack involves inputting each shadow data sample into the honeypot model to obtain the corresponding output result. All the shadow data samples and the corresponding output results are used as a transfer set, and the shadow model is trained based on the transfer set.

3. The reverse penetration defense device against model extraction attacks according to claim 1, characterized in that: in, The verification sample generation module stores a preset mask, which is used to limit the trigger to a specific position of the initial sample, thereby obtaining the verification sample corresponding to the initial sample.

4. The reverse penetration defense device against model extraction attacks according to claim 1, characterized in that: in, In the trigger update module, the trigger is updated according to the trigger update rules. The expression for the trigger update rule is: In the formula δ i For the updated trigger, δ i-1 The trigger before the update is defined as follows: α is the momentum parameter, ∈ is the update step size, sign(·) is the sign function, M is the mask, and M⊙x+(1-M)⊙δ. i-1 Let y be the validation sample corresponding to the initial sample x. target To verify the preset results corresponding to the samples, For loss function calculation operations, This is the set of initial samples.

5. The reverse penetration defense device against model extraction attacks according to claim 1, characterized in that: in, In the honeypot layer fine-tuning module, when the honeypot model outputs a normal classification result based on the shadow data sample, and when the honeypot model outputs an abnormal preset result based on the verification sample corresponding to the updated trigger, a fine-tuned honeypot model is obtained.

6. The reverse penetration defense device against model extraction attacks according to claim 1, characterized in that, Also includes: The test data storage module is used to store all the verification samples corresponding to the finally updated trigger as suspected test samples, and the preset results corresponding to each of the suspected test samples; The accuracy calculation module is used to compare the identification results of the suspect model for each suspect test sample with the preset results corresponding to the suspect test sample, and to obtain the overlap rate. The suspect judgment module stores a preset overlap rate threshold, which is used to determine whether the overlap rate is greater than the overlap rate threshold. If so, the suspect model is obtained by performing a model extraction attack on the honeypot model.

Images