A reverse attack method for collaborative reasoning models based on conditional generative adversarial networks

Abstract

The present invention discloses a reverse attack method for a collaborative reasoning model based on a conditional generative adversarial network. The method first obtains access rights to the target model parameters and the intermediate features in the reasoning process. Secondly, a public dataset in the same domain as the target model classification task is selected as an auxiliary dataset, and the classification results of the target model on the auxiliary dataset samples are obtained as the auxiliary dataset prediction labels. Then, a conditional generative adversarial network constructed by a conditional generator model and a conditional discriminator model is trained for the attack, and the intermediate features of the target image are intercepted, and the predicted labels of the target image are obtained. Finally, the initial value of the latent vector is set, and the latent vector is used as input. The predicted label of the target image is used as a guide, and the conditional generator is used to generate the restored image, and the training optimization is performed. The present invention overcomes the defect of being sensitive to the number of layers of the edge device model, and improves the accuracy and authenticity of the generated restored image.

Description

Technical Field

[0001] The present invention belongs to the field of data privacy security, and in particular relates to a reverse attack method for a collaborative reasoning model based on a conditional generative adversarial network. Background Art

[0002] Artificial intelligence technologies, represented by deep neural networks (DNNs), are rapidly developing and gaining widespread application in scenarios such as healthcare, finance, autonomous driving, and facial recognition. As new DNN models increase the computing resources required of devices, researchers have proposed edge-cloud collaborative inference (or collaborative inference) to deploy AI applications on distributed edge devices with limited computing power, such as those in the Internet of Things (IoT). In this collaborative inference system, the complete DNN inference process is divided into multiple stages, running on edge devices and cloud servers, respectively, thereby reducing the computational burden on edge devices. However, the different devices in each stage of collaborative inference communicate through intermediate features, which poses the risk of leaking private information.

[0003] Model inversion attacks (MIA) are a major attack method targeting AI data privacy. By accessing the AI ​​system's API, attackers attempt to recover the AI ​​model's input data or training data, thereby stealing the user's private information. For example, they can recover the input facial image based on the face recognition model's inference results (such as the input image's confidence in each class), or use non-sensitive image data to generate a representative sample of a certain class in the face recognition model. Similarly, medical prediction models can infer sensitive features of a patient's genome. In collaborative reasoning systems, the goal of model inversion attacks is generally to recover the image samples input by the edge device using intermediate features leaked during the inference process. This attack method poses a serious threat to user privacy information.

[0004] In recent years, several model inversion attack techniques have emerged for various AI application scenarios in the image field. For example, one model inversion attack technique uses soft labels to guide the training of a conditional diffusion model when only the predicted labels are accessible. While this attack technique can generate relatively realistic and accurate restored images, it requires significant computational resources and cannot be used to attack target models in collaborative reasoning mode, failing to recover the corresponding image samples based on the model's predictions. Two other types of model inversion attack techniques also exist for collaborative reasoning systems. One technique uses the stochastic gradient descent (SGD) algorithm with white-box access and the autoencoder (AE) algorithm with black-box access. While these techniques can achieve some success in specific situations, they are highly sensitive to the depth of edge device models. As the number of layers increases, the accuracy and authenticity of the restored images are significantly reduced. Another attack technique trains a generator model to recover private images, but does not perform further optimization after generating the generated images. This also fails to overcome the limitations of existing techniques in generator training, making it difficult to achieve satisfactory results when attacking deeper edge device models. Summary of the Invention

[0005] In order to solve the shortcomings of existing model inversion attack methods in collaborative reasoning mode, the present invention provides a collaborative reasoning model inversion attack method based on conditional generative adversarial network (cGAN), which takes into account the collaborative reasoning mode of actual image recognition deep neural network. The attacker uses the model inversion attack method to steal the user's privacy data. The problem of unsatisfactory quality of generated images caused by the depth of the edge device model in previous methods is solved, and the authenticity and accuracy of the generated images are improved. Specifically, the following steps are: first, obtain the parameters of the target model to be attacked (hereinafter referred to as the target model) and the access rights to the intermediate features in the reasoning process; select an auxiliary data set; obtain the auxiliary data set prediction label; use the auxiliary data set prediction label as a condition to guide cGAN, and embed it into the conditional generator model and the conditional discriminator model; obtain the intermediate features of the target image; obtain the target image prediction label; set the initial value of the potential vector; generate and optimize the restored image. The present invention solves the problem that previous model inversion attacks are subject to the unsatisfactory quality of the depth generation of the edge device model.

[0006] In order to solve the above technical problems, the technical solution of the present invention is:

[0007] A reverse attack method for a collaborative reasoning model based on a conditional generative adversarial network includes the following steps:

[0008] S1. Obtain access rights to target model parameters and intermediate features during the reasoning process: The target model has been trained and deployed to distributed edge devices and cloud servers (hereinafter referred to as edge devices and server-side) in a collaborative reasoning mode. The collaborative reasoning system it constitutes has image classification capabilities. The target model parameters include the complete model parameters of the edge device and the server-side, which can be used to reconstruct and run any part of the target model. The access rights to the intermediate features during the reasoning process are limited to querying the intermediate features of the input image received by the server-side during the operation of the collaborative reasoning system, where the input image is kept confidential.

[0009] S2. Select an auxiliary dataset: The auxiliary dataset refers to a public dataset in the same domain as the target model classification task. For example, if the target model is a face recognition model, the auxiliary dataset is a face dataset.

[0010] S3. Obtain prediction labels of the auxiliary dataset: The prediction labels of the auxiliary dataset are the classification results of the target model on the auxiliary dataset samples.

[0011] S4. Conditional generative adversarial network for training attacks: The conditional generative adversarial network includes a conditional generator model G and a conditional discriminator model D. The conditional generator model is used to generate images, and its input is a latent vector and a guidance label, and its output is a generated image. The conditional discriminator model is used to determine whether the image generated by the conditional generator model is real. Its input is an image sample and an image label, and its output is the confidence that the sample is real. The adversarial generative network is then trained using image samples taken from the auxiliary data set and their predicted labels. After each round of training of the conditional generator, the conditional discriminator is trained for k rounds until the game between the conditional generator and the conditional discriminator reaches a Nash equilibrium. At this point, guided by the target label, the image of the corresponding class can be obtained through the conditional generator.

[0012] S5. Intercepting intermediate features of the target image: The target image refers to the image sample that the user inputs into the target model through the edge device during operation after the collaborative inference system is deployed. This image sample is kept confidential. The intermediate features refer only to the feature matrix obtained after the image sample is inferred by the edge device model.

[0013] S6. Obtaining a predicted label of the target image: The predicted label of the target image refers to the classification result of the target model on the target image.

[0014] S7. Generate and optimize the restored image: Set the initial value of the latent vector, use the latent vector as input, and use the predicted label of the target image as a guide to generate the restored image using the conditional generator. Then, perform training optimization: Obtain the restored intermediate features and use gradient descent to continuously update the latent vector with the goal of minimizing the distance between the restored image and the intermediate features of the target image until a restored image that is realistic, accurate, and similar to the target image is obtained.

[0015] Furthermore, in step S4, the conditional generator model and the conditional discriminator model are iteratively trained. The specific steps are as follows:

[0016] S4.1. Randomly generate a latent vector z and a guidance label y, where z~N(0,I), N(0,I) is a k-dimensional standard Gaussian distribution, k is the dimension of the latent vector of the conditional generator, y represents the label of the target class, and the total number of target model classifications is n class .

[0017] S4.2. Generate image x=G(z,y) using the conditional generator model.

[0018] S4.3. Calculate the loss function of the conditional generator model as follows:

[0019] L gen +w lab L lab

[0020] Among them, L gen =-D(x,y), where D represents the discriminator model in the generative adversarial network, and w lab is the loss term L lab The weight, L lab =‖T(x),y‖, where T represents the target model and T(x) is the prediction result of the restored image on the target model;

[0021] S4.4, with the goal of minimizing the above loss function, use the stochastic gradient descent algorithm to update the parameters θ of the conditional generator model G .

[0022] S4.5. Input real image samples x0∈D from the auxiliary dataset aux , the predicted label of x0 is y0, where D aux Represents the auxiliary dataset.

[0023] S4.6. Use the conditional generator model to generate an image x = G(z,y), where z represents the latent vector and y represents the guidance label. The selection method of x and y is the same as S4.2.

[0024] S4.7. Calculate the loss function L of the conditional discriminator model dis=-D(x0,y0)+D(x,y).

[0025] S4.8, to minimize L dis As the target, use the stochastic gradient descent algorithm to update the parameters θ of the conditional discriminator D .

[0026] S4.9. Repeat steps S4.5-S4.8n dis times, where n dis is the number of training rounds of the conditional discriminator between two rounds of training of the conditional generator model.

[0027] S4.10. Repeat steps S4.1-S4.9 until the game between the conditional generator model and the conditional discriminator model reaches a Nash equilibrium.

[0028] Furthermore, in step S7, the restored image is generated and optimized, and the specific steps are as follows:

[0029] S7.1. Set the initial value of the latent vector z.

[0030] S7.2. Generate the restored image x=G(z,y using the conditional generator model 0′ ), where y 0′ is the predicted label of the target image.

[0031] S7.3. Calculate the intermediate features f = T of the restored image on the target model edge (x), where T edge is the target model on the edge device.

[0032] S7.4. Calculate the loss function of the intermediate features of the restored image and the intermediate features of the target image as follows:

[0033] L inv =L MSE (f,f0)

[0034] Among them, L MSE represents the mean squared error loss function.

[0035] S7.5, to minimize the loss function L inv As the target, a round of potential vector z is updated using the stochastic gradient descent algorithm.

[0036] S7.6. Repeat steps S7.2-S7.5 until the loss function L inv convergence.

[0037] Compared with the prior art, the advantages of the present invention are:

[0038] (1) It is feasible to be used in collaborative reasoning systems with complex structures in practical applications.

[0039] (2) After the restored image is generated, it is further optimized to improve the accuracy and authenticity of the generated restored image.

[0040] (3) It overcomes the defect that the existing collaborative reasoning model reverse attack method is sensitive to the number of layers of the edge device model. BRIEF DESCRIPTION OF THE DRAWINGS

[0041] In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the following briefly introduces the drawings required for use in the embodiments or the description of the prior art. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying any creative work.

[0042] Figure 1 This is a flow chart of the reverse attack method for the collaborative reasoning model based on conditional generative adversarial networks proposed in the present invention;

[0043] Figure 2 Schematic diagram of the structure of the target model in Example 1 of the present invention;

[0044] Figure 3 A schematic diagram of the process of generating an adversarial network for training conditions of the present invention;

[0045] Figure 4 A schematic diagram of the process of generating and optimizing a restored image using a conditional generator model according to the present invention;

[0046] Figure 5 This is a comparison diagram of the restored image obtained by the present invention and the original target image (desensitization processing has been done). DETAILED DESCRIPTION

[0047] The present invention will be further described below with reference to the accompanying drawings and specific embodiments.

[0048] In order to solve the security problems caused by criminals using model inversion attack methods to steal other people's privacy in cyberspace, this example provides a collaborative reasoning model inversion attack method based on conditional generative adversarial network. Figure 1 As shown, the following steps are included:

[0049] S1. Obtain access rights to target model parameters and intermediate features during the reasoning process: The target model has been trained and deployed to edge devices and servers in a collaborative reasoning mode. The collaborative reasoning system it constitutes has image classification capabilities. The model parameters include complete model parameters for edge devices and servers, which can be used to reconstruct and run any part of the target model. Access rights to intermediate features during the reasoning process are limited to querying the intermediate features of the input image received by the server during the operation of the collaborative reasoning system, where the input image is kept confidential. In this example, the target model input is a 64×64 pixel RGB 3-channel face image, and the output is a 530-dimensional prediction vector, such as Figure 2 As shown, it consists of the following two parts:

[0050] (1) An edge device model consisting of three convolution groups and one independent convolution layer is deployed on the edge device in the collaborative inference system. The first three convolution groups each include one convolution layer, one batch normalization layer, one ReLU activation layer, and one max pooling layer. The number of channels of the three convolution layers is 128, 256, and 512, respectively; the number of channels of the last convolution layer is 1024. The output of the edge device model is an intermediate feature with a dimension of 8×8×1024.

[0051] (2) A cloud server model consisting of one batch normalization group and two fully connected layers is deployed on the cloud server in the collaborative reasoning system. The batch normalization group includes one batch normalization layer, one ReLU activation layer, and one max pooling layer. The input feature dimension of the two fully connected layers is 16384, the hidden layer dimension is 2650, and the output dimension is 530. The two fully connected layers are separated by a random dropout layer.

[0052] In this example, the target model is trained with 80% of the image samples in the FaceScrub dataset, and the remaining 20% ​​of the image samples constitute the test set of the target model and serve as the target images for attack.

[0053] S2. Select an auxiliary dataset: This refers to a public dataset from the same domain as the target model classification task. Compared to previous model inversion attack methods that require identically distributed auxiliary datasets, this method has more relaxed requirements for the auxiliary dataset, requiring it to be from the same domain as the target image dataset. For example, if the target model is a face recognition model, the auxiliary dataset is a face dataset. In this example, the CelebA dataset is used, and the auxiliary images are 64×64 pixels in size.

[0054] S3. Obtain prediction labels of the auxiliary dataset: The prediction labels of the auxiliary dataset are the classification results of the target model on the auxiliary dataset samples.

[0055] S4. Conditional generative adversarial network for training attacks: The conditional generative adversarial network includes a conditional generator model G and a conditional discriminator model D. The conditional generator model is used to generate images, and its input is a latent vector and a guidance label, and its output is a generated image. The conditional discriminator model is used to determine whether the image generated by the conditional generator model is realistic, and its input is an image sample and an image label, and its output is the confidence that the image sample is real. In this example, the conditional generator model uses a residual neural network, which includes 4 residual blocks, each residual block contains 2 convolutional layers and 2 batch normalization layers, and the guidance label is embedded through the batch normalization layer in the residual block; the conditional discriminator model also uses a residual neural network, which includes 4 residual blocks, each residual block contains two convolutional layers and two spectral normalization layers, and the guidance label is embedded through the spectral normalization layer outside the residual block.

[0056] The training process of the conditional generative adversarial network in this example is as follows Figure 3 As shown in the figure, the conditional generator and the conditional discriminator are trained alternately until the game between the two reaches a Nash equilibrium. At this point, the conditional generator can be used to obtain images of the corresponding class, guided by the target label. The specific steps for training the conditional generative adversarial network are as follows:

[0057] S4.1. Randomly generate a latent vector z and a guidance label y, where z~N(0,I), N(0,I) is a k-dimensional standard Gaussian distribution, k is the latent vector dimension of the conditional generator, and y is 0 to n class A random integer between -1, n class Indicates the number of target model categories. In this example, k = 128, n class =530.

[0058] S4.2. Generate image x=G(z,y) using the conditional generator model.

[0059] S4.3. Calculate the loss function of the conditional generator model as follows:

[0060] L gen +w lab L lab

[0061] Among them, L gen =-D(x,y), where D represents the discriminator model in the generative adversarial network, and w lab is the loss term L lab In this example, L lab =L MM (T(x),y), where L MM is the maximum margin loss function, that is l y Represents the value of the predicted vector in the y class. T represents the target model. wclass The value of is 0.2.

[0062] S4.4, with the goal of minimizing the above loss function, use the stochastic gradient descent algorithm to update the parameters θ of the conditional generator model G This example uses the Adam algorithm to update the conditional generator model, with a learning rate of 2e-4 and a β value of (0, 0.9).

[0063] S4.5. Input real image samples x0∈D from the auxiliary dataset aux , the predicted label of x0 is y0, where D aux Represents the auxiliary dataset. In this example, the same image will not be input repeatedly until all images in the auxiliary dataset have been input into one round.

[0064] S4.6. Use the conditional generator model to generate an image x = G(z,y), where z represents the latent vector and y represents the guidance label. The selection method of x and y is the same as S4.2.

[0065] S4.7. Calculate the loss function L of the conditional discriminator model dis =-D(x0,y0)+D(x,y).

[0066] S4.8, to minimize L dis As the target, use the stochastic gradient descent algorithm to update the parameters θ of the conditional discriminator D This example uses the Adam algorithm to update the conditional discriminator model, with a learning rate of 2e-4 and a β value of (0, 0.9).

[0067] S4.9. Repeat steps S4.5-S4.8n dis times, where n dis is the number of training rounds for the conditional discriminator between two rounds of training for the conditional generator model. In this example, the value is 5.

[0068] S4.10. Repeat steps S4.1-S4.9 until the game between the conditional generator model and the conditional discriminator model reaches a Nash equilibrium. In the training process of the conditional generative adversarial network in this example, all samples in the auxiliary dataset are used for a total of 50 rounds.

[0069] S5. Intercepting intermediate features of the target image: The target image refers to the image sample that the user inputs into the model through the edge device during operation after the collaborative inference system is deployed. This image sample is kept confidential. The intermediate features refer only to the feature vectors obtained after the image sample is inferred by the edge device model. In this example, the target model is a face recognition model, and the target image for the model reverse attack is extracted from the remaining 20% ​​of image samples in the FaceScrub dataset.

[0070] S6. Obtaining a target image prediction label: The target image prediction label refers to the classification result of the target model on the target image;

[0071] S7, generate and optimize the restored image, such as Figure 4 As shown in the figure: Set the initial value of the latent vector, use the latent vector as input, use the target image prediction label as a guide, and use the conditional generator to generate the restored image. Then obtain the restored intermediate features, and use the gradient descent method to continuously update the latent vector with the goal of minimizing the distance between the restored image and the intermediate features of the target image until a true, accurate and similar restored image is obtained. The result is shown in the figure. Figure 5 The specific steps to generate and optimize the restored image are as follows:

[0072] S7.1. Set the initial value of the latent vector z. In this example, the latent vector z is sampled from a standard Gaussian distribution, i.e., z~N(0,1).

[0073] S7.2. Generate the restored image x=G(z,y using the conditional generator model 0′ ), where y 0′ is the predicted label of the target image.

[0074] S7.3. Calculate the intermediate features f = T of the restored image on the target model edge (x), where T edge is the target model on the edge device.

[0075] S7.4. Calculate the loss function of the intermediate features of the restored image and the intermediate features of the target image as follows:

[0076] L inv =L MSE (f,f0)

[0077] Among them, L MSE represents the mean square error loss function, Where n represents the dimension of the intermediate features.

[0078] S7.5, to minimize the loss function L inv As the target, use the stochastic gradient descent algorithm to update the potential vector z. In this example, the AdamW algorithm is used to update the potential vector with a learning rate of 1e-1.

[0079] S7.6. Repeat steps S7.2-S7.5 until the loss function L inv Convergence. This example is repeated 500 times.

[0080] The restored image in this example is quantitatively analyzed, and the results are shown in Table 1. The accuracy rate represents the probability that the restored image and the target image belong to the same class under the evaluation model, the MSE represents the mean square error between the restored image and the target image, and the feature distance represents the shortest feature distance between the restored image and the target image.

[0081] Table 1: Qualitative evaluation table of restored samples

[0082] Classification accuracy MSE Feature distance 90.2％ 0.061 1.05

[0083] In summary, the present invention addresses the problem of model inversion attacks, where existing methods cannot simultaneously meet the following requirements: 1. The method meets practical needs and can effectively attack collaborative reasoning systems in real applications. 2. The method has good attack effectiveness, ensuring a certain level of accuracy and authenticity in the generated images. 3. It is insensitive to the number of layers in the collaborative reasoning edge device model, thus having a wide range of applicability.

[0084] To meet the above three requirements, the present invention proposes a collaborative reasoning model reverse attack method based on a conditional generative adversarial network from the following two aspects. First, in order to solve the problem that the existing collaborative reasoning model reverse attack method is sensitive to the number of edge device model layers and improve the quality of the restored target image, the present invention uses a conditional generative adversarial network to train a powerful and practical attack model that can generate high-quality restored images under the guidance of the target label; then, in order to further improve the accuracy of the restored image and make the restored image closer to the target image, the present invention uses the predicted label of the target image as a guide, with the goal of minimizing the difference in intermediate features, continuously updating the latent vector, and then optimizing and ultimately obtaining an accurate and realistic restored image.

[0085] Of course, the above description is not a limitation of the present invention, and the present invention is not limited to the above examples. Any changes, modifications, additions or substitutions made by ordinary technicians in this technical field within the essential scope of the present invention should fall within the scope of protection of the present invention.

Claims

1. A reverse attack method for collaborative reasoning models based on conditional generative adversarial networks, characterized by: The steps include: S1, obtain access rights to target model parameters and intermediate features during inference; S2. Select a public dataset in the same domain as the target model classification task as an auxiliary dataset; S3. Obtain the classification results of the target model for the auxiliary dataset samples as the auxiliary dataset prediction labels; S4, training a conditional generative adversarial network for attack, wherein the conditional generative adversarial network is constructed by a conditional generator model and a conditional discriminator model; The specific implementation process of the conditional generative adversarial network used for training attack is as follows: S4.

1. Randomly generate a latent vector z and a guidance label y, where z~N(0,I), N(0,I) is a k-dimensional standard Gaussian distribution, k is the dimension of the latent vector of the conditional generator, y represents the label of the target class, and the total number of target model classifications is n class ; S4.

2. Generate an image x = G(z,y) using the conditional generator model. S4.

3. Calculate the loss function of the conditional generator model as follows: L gen +w lab L lab Among them, L gen =-D(x,y), where D represents the discriminator model in the generative adversarial network, and w lab is the loss term L lab The weight, L lab =‖T(x),y‖, where T represents the target model and T(x) is the prediction result of the restored image on the target model; S4.4, with the goal of minimizing the above loss function, use the stochastic gradient descent algorithm to update the parameters θ of the conditional generator model G ; S4.

5. Input real image samples x0∈D from the auxiliary dataset aux , the predicted label of x0 is y0, where D aux represents the auxiliary dataset; S4.

6. Generate an image x = G(z,y) using the conditional generator model, where z represents the latent vector and y represents the guidance label. The selection method of x and y is the same as S4.

2. S4.

7. Calculate the loss function L of the conditional discriminator model dis =-D(x0,y0)+D(x,y); S4.8, to minimize L dis As the target, use the stochastic gradient descent algorithm to update the parameters θ of the conditional discriminator D ; S4.

9. Repeat steps S4.5-S4.8n dis times, where n dis is the number of training rounds of the conditional discriminator between two rounds of training of the conditional generator model; S4.

10. Repeat steps S4.1-S4.9 until the game between the conditional generator model and the conditional discriminator model reaches a Nash equilibrium. S5, intercepting the intermediate features of the target image and obtaining the predicted label of the target image; S6. Set the initial value of the latent vector, use the latent vector as input, use the predicted label of the target image as a guide, use the conditional generator to generate the restored image, obtain the restored intermediate features, and perform training optimization.

2. The method for reverse attacking a collaborative reasoning model based on a conditional generative adversarial network according to claim 1 is characterized in that: In step S1, the target model has been trained and deployed to distributed edge devices and servers in a collaborative reasoning mode. The collaborative reasoning system it constitutes has image classification capabilities. The target model parameters include the complete model parameters of the edge devices and servers, and any part of the target model can be rebuilt and run using these parameters. The access rights to the intermediate features in the reasoning process are limited to querying the intermediate features of the input image received by the server during the operation of the collaborative reasoning system, where the input image is kept confidential.

3. The method for reverse attacking a collaborative reasoning model based on a conditional generative adversarial network according to claim 1 is characterized in that: The conditional generator model is used to generate images, with its input being the latent vector and the guidance label, and its output being the generated image; the conditional discriminator model is used to determine whether the image generated by the conditional generator model is real, with its input being the image sample and the image label, and its output being the confidence that the sample is real; the adversarial generative network is trained using image samples taken from the auxiliary dataset and their predicted labels, with each round of training of the conditional generator followed by k rounds of training of the conditional discriminator, until the game between the conditional generator and the conditional discriminator reaches a Nash equilibrium.

4. The method for reverse attacking a collaborative reasoning model based on a conditional generative adversarial network according to claim 1, characterized in that: In step S5, the target image refers to an image sample input to the target model by the user through the edge device during operation after the collaborative reasoning system is deployed, and the image sample is kept confidential; The intermediate features refer only to the feature matrix obtained after the image sample is inferred by the edge device model; The predicted label of the target image refers to the classification result of the target model on the target image.

5. The method for reverse attacking a collaborative reasoning model based on a conditional generative adversarial network according to claim 4 is characterized in that: The specific implementation process in step S6 is as follows: S6.

1. Set the initial value of the latent vector z; S6.

2. Generate the restored image x=G(z,y using the conditional generator model 0′ ), where y 0′ is the predicted label of the target image; S6.

3. Calculate the intermediate features f = T of the restored image on the target model edge (x), where T edge is the target model on the edge device; S6.

4. Calculate the loss function of the intermediate features of the restored image and the intermediate features of the target image as follows: L inv =L MSE (f,f0) Among them, L MSE represents the mean square error loss function; S6.5, to minimize the loss function L inv As the target, use the stochastic gradient descent algorithm to update the potential vector z for a round; S6.

6. Repeat steps S6.2-S6.5 until the loss function L inv convergence.

Images