A generation model privacy protection method and related device suitable for intelligent vehicle networking

Abstract

The application provides a generation model privacy protection method and related device suitable for intelligent vehicle networking, comprising the following steps: using an energy model to generalize popular features of a given private data set, and mapping the private data set to a low-dimensional space to obtain low-dimensional popular features; using a pre-trained first generation model to encode the low-dimensional popular features, and fusing a masked version of the encoded popular features into features of an intermediate layer of the generation model through a residual enhancement network; training the first generation model based on a gradient estimation process of fractional matching, and introducing a perturbation projection vector in the training process to obtain a second generation model; using Hamiltonian dynamics simulation, combining gradient information of the model, determining a sampling path and sampling to obtain sample data meeting data distribution requirements of the private data set. The application maps an original high-dimensional private data set to a low-dimensional space and extracts popular features, and further increases data perturbation by using a perturbation projection vector, thereby enhancing privacy protection strength.

Description

TECHNICAL FIELD

[0001] The present application belongs to the technical field of intelligent vehicle networking, and particularly relates to a generation model privacy protection method suitable for intelligent vehicle networking and a related device. BACKGROUND

[0002] In intelligent vehicle networking (IVN), vehicles are connected to each other and communicate with infrastructure through networks, achieving information sharing and collaborative control, thereby improving traffic efficiency and safety. Generation models are widely used in intelligent vehicle networking, such as generating virtual data to improve the training effect of autonomous driving algorithms, simulating traffic scenarios to test new algorithms, and detecting abnormal behavior. However, these models may involve a large amount of sensitive data during training, such as vehicle owner location information and driving behavior data, which may lead to privacy leakage if not handled properly.

[0003] Differential privacy (DP) is one of the mainstream technologies for protecting data privacy. It injects noise into data or computational results to ensure that the influence of any single data point does not significantly change the results in a statistical sense, thereby protecting individual privacy. Introducing differential privacy into the training process of generation models can effectively prevent models from leaking sensitive information in training data. In the field of generation models, research on differentially private generative models (DPGMs) mainly focuses on how to generate high-quality data while ensuring privacy.

[0004] Although existing differentially private generative models (DPGMs) have made some progress in protecting privacy, they still have some significant shortcomings in practical applications, especially when dealing with high-dimensional data. For example, they have difficulty in handling high-dimensional data, high computational complexity, and low quality of generated data. SUMMARY

[0005] Therefore, the present application aims to provide a generation model privacy protection method suitable for intelligent vehicle networking and a related device to solve the above problems of existing differentially private generative models when dealing with high-dimensional data.

[0006] To solve the above technical problems, the present application provides the following technical solutions:

[0007] In a first aspect, the present application provides a generation model privacy protection method suitable for intelligent vehicle networking, comprising the following steps:

[0008] The energy model is used to generalize the popular features of a given private data set, and a projection technique is used to map the private data set to a low-dimensional space to obtain low-dimensional popular features, the private data set being a data set with privacy protection requirements.

[0009] The pre-trained first generation model is used to encode the low-dimensional popular features, and the encoded masked version is integrated into the features of the intermediate layer of the generation model through a residual enhancement network.

[0010] The first generation model is trained based on a gradient estimation process of score matching, and a perturbation projection vector is introduced during the training process to obtain a second generation model, the perturbation projection vector being a vector obtained by perturbing the projection vector obtained through the projection technique.

[0011] Hamiltonian dynamics simulation is used to determine the sampling path and perform sampling based on the gradient information of the second generation model, to obtain sample data meeting the data distribution requirements of the private data set.

[0012] Further, the expression of the low-dimensional popular features obtained from the private data set is as follows:

[0013]

[0014] In the formula, Fisher divergence, E(θ;x) represents the energy model, θ and x represent the model parameters and model input, represents the expectation, represents the logarithmic gradient, p(x) represents the data distribution, U(x) represents the potential energy function, H(θ;x) represents the e E(θ；x)

[0015] Further, the training loss function of the first generation model is as follows:

[0016]

[0017] In the formula, represents the loss function, v represents the mapping vector, represents the transpose of the mapping vector.

[0018] Further, when training the first generation model, a noise vector sampled from a Gaussian distribution is also added to the features of the intermediate layer of the generation model.

[0019] Further, the projection vector is perturbed using a random perturbation mechanism, and the expression of the random perturbation mechanism is as follows:

[0020]

[0021] In the formula, Pr[·] represents the probability distribution function, v idenotes an element in the mapping vector, v o denotes a random variable, P(·) denotes a random perturbation mechanism, v′ i denotes an element other than {v i} in the mapping vector, v - is a subset of the mapping vector, and ε denotes a privacy overhead parameter.

[0022] Further, the training loss function of the second generative model is as follows:

[0023]

[0024] wherein, denotes a loss function, q θ (x) denotes the convergence of the potential energy function U(x) on the model θ.

[0025] Further, the sampling process is performed according to the following formula:

[0026]

[0027] wherein, c(·) denotes a sampling function, t denotes a sampling element, and λ denotes a step size.

[0028] In a second aspect, the present application provides a generative model privacy protection device suitable for intelligent Internet of Vehicles, comprising:

[0029] A first data processing module is configured to profile popular features of a given private data set by using an energy model, and map the private data set to a low-dimensional space by using a projection technique to obtain low-dimensional popular features, wherein the private data set is a data set having a privacy protection requirement.

[0030] A residual enhancement module is configured to encode the low-dimensional popular features by using a pre-trained first generative model, and integrate the encoded mask version into the features of the intermediate layer of the generative model through a residual enhancement network.

[0031] A projection perturbation module is configured to train the first generative model based on a gradient estimation process of fractional matching, and introduce a perturbation projection vector in the training process to obtain a second generative model, wherein the perturbation projection vector is a vector obtained by perturbing the projection vector obtained by the projection technique.

[0032] A sampling module is configured to determine a sampling path and perform sampling by using Hamiltonian dynamics simulation combined with gradient information of the second generative model, to obtain sample data meeting the data distribution requirements of the private data set.

[0033] Correspondingly, the present application also provides a computer device, which comprises a processor and a memory.

[0034] The memory is used for storing the computer program and sending instructions of the computer program to the processor.

[0035] The processor executes the instructions of the computer program to perform the method for generating model privacy protection suitable for intelligent Internet of Vehicles according to the first aspect.

[0036] Correspondingly, the application further provides a computer readable storage medium, which stores a computer program, and the computer program is executed by the processor to implement the method for generating model privacy protection suitable for intelligent Internet of Vehicles according to the first aspect.

[0037] In summary, the application provides a method for generating model privacy protection suitable for intelligent Internet of Vehicles and related devices, which comprises generalizing popular features of a given private data set by using an energy model, and mapping the private data set to a low-dimensional space by using a projection technique to obtain low-dimensional popular features, the private data set being a data set with privacy protection requirements; encoding the low-dimensional popular features by using a pre-trained first generation model, and fusing the encoded mask version into the features of the intermediate layer of the generation model through a residual enhancement network; training the first generation model based on a gradient estimation process of score matching, and introducing a perturbation projection vector in the training process to obtain a second generation model, the perturbation projection vector being a vector obtained by perturbing the projection vector obtained by the projection technique; determining a sampling path and performing sampling by using Hamiltonian dynamics simulation combined with gradient information of the second generation model to obtain sample data meeting the data distribution requirements of the private data set. The application reduces the risk of sensitive information leakage in the data by mapping the original high-dimensional private data set to a low-dimensional space and extracting popular features, and further increases data perturbation by using a perturbation projection vector, thereby enhancing the privacy protection strength. The method is particularly suitable for the intelligent Internet of Vehicles scenario, can generate privacy protection synthetic data meeting the data characteristics of the Internet of Vehicles, and is conducive to data analysis, model training and system testing on the premise of protecting user privacy, thereby promoting the safety and development of the Internet of Vehicles technology. BRIEF DESCRIPTION OF DRAWINGS

[0038] In order to more clearly illustrate the technical solutions in the embodiments of the application or the prior art, the following will briefly introduce the drawings needed to be used in the embodiments or prior art description. Obviously, the drawings in the following description only constitute some embodiments of the application, and for those skilled in the art, other drawings can also be obtained without creative labor based on these drawings.

[0039] Figure 1 A flowchart of a method for generating model privacy protection suitable for intelligent Internet of Vehicles is provided for the embodiments of the application.

[0040] Figure 2A logic block diagram of a generation model privacy protection method suitable for intelligent vehicle networking is provided for an embodiment of the present application.

[0041] Figure 3 A flow implementation block diagram of a generation model privacy protection method suitable for intelligent vehicle networking is provided for an embodiment of the present application.

[0042] Figure 4 A composition block diagram of a generation model privacy protection device suitable for intelligent vehicle networking is provided for an embodiment of the present application.

[0043] Figure 5 A composition block diagram of a computer device is provided for an embodiment of the present application. DETAILED DESCRIPTION

[0044] In order to make the purposes, features and advantages of the present application more obvious and easy to understand, the technical solutions in the embodiments of the present application will be described clearly and completely below with reference to the drawings in the embodiments of the present application. Obviously, the embodiments described below are only part of the embodiments of the present application, not all the embodiments. Based on the embodiments in the present application, all other embodiments obtained by those of ordinary skill in the art without creative labor fall within the scope of the present application.

[0045] The prior art will be introduced first as follows.

[0046] The existing differential privacy generation model (DPGMs) method can be roughly divided into the following two categories:

[0047] 1. Noise injection-based method: This method realizes differential privacy by injecting noise into data or model parameters. For example, DP-GANs (Differentially Private Generative Adversarial Networks) protect privacy by adding noise to the gradient of the discriminator. However, this method is not effective in handling high-dimensional data, because high-dimensional data requires a large amount of noise to ensure privacy, which affects the quality of the generated data.

[0048] 2. Private gradient-based method: This method realizes differential privacy in the gradient calculation process to protect data. For example, DP-SGD (Differentially Private Stochastic Gradient Descent) ensures privacy by adding noise to each gradient update. However, due to the complexity of high-dimensional data, existing private gradient methods also face challenges in generating high-dimensional data. High-dimensional data has more features and more complex distribution, which makes it more difficult to protect privacy while maintaining data utility.

[0049] Although existing differential privacy generative models (DPGMs) have made some progress in protecting privacy, they still have some significant drawbacks in practical applications, especially when dealing with high-dimensional data. These drawbacks mainly include:

[0050] Difficulty in handling high-dimensional data: Existing methods generate data with poor quality when dealing with high-dimensional data. Noise injection methods require a large amount of noise to ensure privacy, which significantly reduces the quality of the generated data. Private gradient methods struggle to effectively capture the characteristics of data in the face of high-dimensional data complexity, resulting in low-quality generated samples.

[0051] High computational complexity: Some differential privacy techniques have high computational complexity in the implementation process, especially when dealing with high-dimensional data, which significantly increases the computational cost. This limits the feasibility and efficiency of these methods in practical applications.

[0052] Low quality of generated data: Due to the noise introduced by privacy protection mechanisms and the limitations of model complexity, the data generated by existing methods is generally of low quality, making it difficult to generate high-resolution, high-quality images. This is particularly evident in intelligent vehicle networking applications that require high-quality data.

[0053] Poor balance between privacy and utility: Existing differential privacy generative models still have deficiencies in balancing privacy protection and data utility. In order to ensure privacy, compromises are often made in data quality, which affects the utility of the model.

[0054] Based on this, the present application provides a generative model privacy protection method suitable for intelligent vehicle networking, comprising the following steps:

[0055] S11: Use an energy model to generalize the popular features of a given private data set, and use projection technology to map the private data set to a low-dimensional space to obtain low-dimensional popular features. The private data set is a data set with privacy protection requirements.

[0056] It should be noted that the data in intelligent vehicle networking is generally high-dimensional and complex, so it is not practical to directly calculate the gradient of these data. Therefore, this step first uses an energy model (a function that measures the probability of data points) to capture the most important and commonly occurring features (popular features) in the private data set. The energy model can evaluate the energy value of the data points, and a lower energy value corresponds to a more typical pattern in the data set.

[0057] Then, to further reduce the computational overhead, dimensionality reduction techniques (such as PCA, t-SNE, etc.) are applied to map the complex private dataset from a high-dimensional space to a low-dimensional space. This process preserves the main structural information of the data while removing or reducing irrelevant details, which helps to protect privacy because the low-dimensional representation usually hides part of the individual identification information.

[0058] S12: Encode the low-dimensional popular features using the pre-trained first generative model, and integrate the encoded masked version into the features of the intermediate layer of the generative model through a residual enhancement network.

[0059] It should be noted that this step uses a pre-trained generative model (such as GANs, VAEs, etc.) to encode the low-dimensional popular features, which converts the data features into a form that the generative model can understand.

[0060] The encoded features are processed (such as adding masks to further protect privacy), and then integrated into the intermediate layer features of the generative model through a residual enhancement network (a network structure that can effectively learn residuals). This can improve the model's expression ability and the quality of the generated data.

[0061] S13: Train the first generative model based on the gradient estimation process of score matching, and introduce a perturbation projection vector during the training process to obtain a second generative model, where the perturbation projection vector is a vector obtained by perturbing the projection vector obtained through projection technology.

[0062] It should be noted that this step introduces the gradient estimation method based on score matching (Score Matching) to optimize the first generative model. The score matching technique is a method for estimating the gradient of a probability density function when it is unknown, which is suitable for training generative models and can more accurately capture the data distribution.

[0063] During the training process, random perturbations are introduced to the projection vector obtained through projection technology to generate a "perturbation projection vector". This perturbation increases the randomness of model training, which helps to improve the generalization ability of the model, while further confusing the features of the original data and enhancing privacy protection.

[0064] S14: Use Hamiltonian dynamics simulation, combined with the gradient information of the second generative model, to determine the sampling path and perform sampling to obtain sample data that meets the data distribution requirements of the private dataset.

[0065] It should be noted that this step uses the theory of Hamiltonian dynamics systems, combined with the gradient information of the second generative model (i.e. the model obtained after the above training), to simulate the dynamic behavior of physical systems. This step allows to explore the data distribution space in an efficient and natural way.

[0066] Then, samples are extracted from the second generative model through the determined sampling path, and the sample data not only conforms to the overall statistical characteristics of the private data set, but also provides rich diversity while maintaining privacy protection, which is suitable for various applications and analysis in the vehicle networking environment.

[0067] The embodiment provides a generative model privacy protection method suitable for intelligent vehicle networking, which maps the original high-dimensional private data set to a low-dimensional space and extracts popular features, thereby reducing the risk of sensitive information leakage in the data, and further increasing data disturbance by using a disturbance projection vector, thereby enhancing the privacy protection strength. The method is particularly suitable for intelligent vehicle networking scenarios, can generate privacy protection synthetic data meeting the data characteristics of vehicle networking, and is beneficial to data analysis, model training and system testing under the premise of protecting user privacy, thereby promoting the safety and development of vehicle networking technology.

[0068] In some embodiments, for step S11, an energy model is used to approximate the manifold characteristics of high-dimensional data (such as a private data set of intelligent vehicle networking), specifically as follows:

[0069]

[0070] wherein, Fisher divergence, E(θ;x) represents an energy model, and θ and x represent model parameters and model input, represents expectation, represents a logarithmic gradient, p(x) represents a data distribution, U(x) represents a potential energy function, and H(θ;x) represents a logarithmic gradient E(θ；x) .

[0071] In some embodiments, for step S11, the dimension reduction operation is specifically sampling a projection vector v from a standard Gaussian distribution. Then, the gradients U(x) and H(θ;x) of the projection are projected to the direction of the projection vector v. Finally, the loss function is calculated as follows:

[0072]

[0073] wherein, loss function, v represents a mapping vector, represents the transpose of the mapping vector

[0074] In some embodiments, for step S12, although the private gradient of the high-dimensional data and the low-dimensional manifold feature are obtained in step S11, the reconstruction ability of the model still needs to be further enhanced. The private gradient of the high-dimensional data is to ensure the accuracy and privacy of the gradient information as much as possible, and the low-dimensional manifold feature is to better train and reconstruct the data. Therefore, for the low-dimensional feature data obtained in step S11, by referring to the idea of residual network, the embodiment uses a pre-trained generative model such as VQGAN to encode the data (i.e., the data obtained after step S11 is processed) and integrates the encoded masked version into the model q θ The intermediate layer feature. Through the residual learning of different versions of data, the reconstruction ability of the model will be improved.

[0075] In addition, in other embodiments, in order to further improve the robustness of model learning, a noise vector sampled from a Gaussian distribution is added to the feature, instead of being added to the encoded masked feature of the training model q θ . Compared with not adding anything, adding a noise vector improves the robustness of the model, especially when the data is in a low-density region. Each residual block includes the following layers:

[0076] 1. Convolutional layer: extract features.

[0077] 2. Batch Normalization: stabilize the training process.

[0078] 3. Activation function (ReLU): introduce nonlinearity.

[0079] 4. Skip connection: add input directly to output.

[0080] The specific steps are as follows:

[0081] 1. Convolution on input feature: y = Conv(x)

[0082] 2. Batch normalization: y = BatchNorm(y)

[0083] 3. Apply activation function: y = ReLU(y)

[0084] 4. Add input to output through skip connection: y = y + x

[0085] Through the superposition of multiple residual blocks, the reconstruction ability of the model can be effectively enhanced.

[0086] The above embodiments apply residual learning mechanisms to low-dimensional manifold features, enhance the model through residual block structures (convolution, batch normalization, activation functions, and skip connections), and directly add Gaussian noise to the features instead of operating on masked features to improve the robustness and generalization ability of the model.

[0087] To address the issue that existing methods often inject significant noise to ensure privacy, resulting in low-quality generated data, especially in high-dimensional data where image clarity and resolution are severely affected, this embodiment introduces a residual enhancement module during the slice fraction matching process. By capturing higher-order features of the data, it significantly improves the reconstruction capability and quality of the generated image. Simultaneously, the efficient sampling using Hamiltonian dynamics makes the generated image more closely approximate the real data distribution.

[0088] In some embodiments, the network q is trained directly using the gradient of the logarithmic data density. θ This may introduce privacy risks. To address this issue, this embodiment performs random perturbation to prevent the leakage of private information. It scrambles the training data so that the trained network does not reveal the true distribution of private data during sampling. Therefore, the trained network can be released without concern for privacy, as it is difficult for an adversary to determine whether an image is present in the training data. Specifically, the goal of this embodiment is to privatize the gradients in the equations. This is equivalent to privatization. For a batch of data, and its projection vector There is an inherent correspondence between them, so without any protection, The projection vector v i and They are the same. In this case, this embodiment applies a random perturbation mechanism P(·), which privatizes... The projection vector is obtained by making the projection vectors U(x) and H(θ;x) not strictly aligned. This random perturbation enables privatization. It indirectly randomizes the data towards the perceived real direction of the image. In this way, even if an attacker obtains this gradient information, they cannot reuse it because the added random noise makes it impossible for the attacker to distinguish between real and perturbed data. In this embodiment, the random perturbation mechanism P(·) can be formulated as follows:

[0089]

[0090] Among them, v - It is a subset of v, k = v - , k ≥ 2, v oε is a random variable, and ε is the privacy overhead parameter. To achieve differential privacy, a perturbation projection vector is introduced during the gradient estimation process of slice score matching. Based on this, the model training steps in the specific implementation are as follows:

[0091] 1. For each data sample x, use step S11 to project the gradients of U(x) and H(θ;x) onto the direction of the projection vector v;

[0092] 2. Perform residual enhancement on the obtained low-dimensional manifold features using step S12. During this process, the noise vector sampled by the Gaussian distribution needs to be added to the features, rather than added to the training model q. θ In the masking features of the encoding;

[0093] 3. To further protect q in step 2 θ The network parameters and features of the model are perturbed using a differential privacy mechanism, which is equivalent to perturbing the vector v.

[0094] 4. Project the gradient perturbation using Equation 3.

[0095] By following the steps above, the statistical properties of the data can be well preserved while ensuring differential privacy. In this embodiment, the training loss function of the entire model can be defined as follows:

[0096]

[0097] In the formula, Let q represent the loss function. θ (x) denotes the convergence of the potential energy function U(x) on the model θ.

[0098] To address the shortcomings of existing methods in balancing privacy protection and data usability, which often necessitate compromises in data quality, this invention achieves differential privacy protection by introducing a perturbation projection vector during gradient estimation in slice score matching. This process effectively preserves the statistical properties of the data, optimizes the balance between privacy protection and data usability, and results in high-quality data that effectively protects privacy.

[0099] In some embodiments, the manifold of the private dataset can be gradually approximated by the gradient estimated by the well-trained model in the sampling process through Hamiltonian dynamics, thereby generating high-quality images. Hamiltonian dynamics is a mathematical tool for simulating the evolution of physical systems. Hamiltonian dynamics uses an energy function (Hamiltonian Function) to describe the state change of the system. For a generative model, an energy function H(x, p) can be defined, where x is a data sample and p is an auxiliary variable (momentum). The evolution process of Hamiltonian dynamics can be described by the following set of differential equations:

[0100]

[0101] By solving the above differential equations, a sampling path can be obtained, so that the generated samples gradually approximate the target data distribution. First, the present application estimates the gradient of the private dataset by using a well-trained network, and defines a Hamiltonian function:

[0102] H(x, p) = U(x) + K(p) (6)

[0103] where U(x) represents the potential energy of the data sample x, and K(p) represents the kinetic energy of the auxiliary variable p. Then, numerical solution is performed by Leapfrog algorithm, and the specific steps are as follows:

[0104] 1. Initialize the data sample x and the auxiliary variable p, i.e.

[0105] p(x, c) = p(x) p(c) ∝ exp(-H(θ; x)) exp(-K(c)). (7)

[0106] 2. Sampling is performed according to the following method:

[0107]

[0108] 3. Where λ is the step size. According to the initialization method, it can be known that: and Therefore, the above sampling process can be simplified as:

[0109]

[0110] In the formula, c(·) represents a sampling function, and t represents a sampling element.

[0111] By iterating the above process multiple times, samples that approximate the target data distribution can be obtained gradually. This mechanism ensures thorough exploration of the entire distribution of private data, denoted as p(x), which helps generate images with enhanced realism. Inspired by the learning rate adjustment technique in machine learning, the present invention employs a step decay strategy to speed up the sampling process. Initially, a larger step size is used to accelerate the movement towards realistic images. Subsequently, a smaller step size is adopted to refine image details. As an additional benefit, because the initial step size is larger, it also prevents the model from collapsing into certain data-intensive regions to some extent. It is worth noting that during the sampling process, the present invention no longer encodes the input of the model using the VQGAN, but directly samples from the Gaussian distribution to be added to the features extracted by the model. On the one hand, compared with using VQGAN encoding, it speeds up the sampling process, on the other hand, it improves the robustness of the model, especially in increasing the diversity of generated data.

[0112] In view of the problem in the prior art that the traditional differential privacy generation model performs poorly when processing high-dimensional data, and the quality of generated data is difficult to meet the actual application requirements, the present embodiment introduces Hamiltonian dynamics, efficiently samples through the gradient estimated by the well-trained model, so that the generated samples can gradually approximate the manifold of the private data set. This mechanism significantly improves the processing capability of high-dimensional data and can generate high-quality images.

[0113] Please refer to Figure 2 and 3 , combined with the above embodiment, an application example of a generation model privacy protection method suitable for intelligent Internet of Vehicles is proposed, Figure 2 and 3 are the logical block diagram and flow implementation block diagram of the application example, respectively. Among them, the application example adopts three sub-algorithms, wherein sub-algorithm 1 adopts Hamiltonian dynamics sampling to efficiently sample samples to reduce data dimension and computational complexity; sub-algorithm 2 adopts a residual enhancement module to capture the manifold characteristics in the data, thereby realizing high-quality and high-resolution image generation; sub-algorithm 3 adopts a perturbation projection vector method based on differential privacy to protect the privacy of the generation model and the data privacy security of intelligent Internet of Vehicles. Based on the application example, the method has the following characteristics when applied specifically:

[0114] 1. Hamiltonian dynamics sampling: Hamiltonian dynamics sampling is performed through the gradient estimated by the well-trained model, so that the generated samples gradually approximate the manifold of the private data set, significantly improving the processing capability of high-dimensional data and the quality of generated data.

[0115] 2. Perturbed projection vector in slice-wise fractional matching: Introduce a perturbed projection vector in the gradient estimation process of slice-wise fractional matching, achieve differential privacy protection, while preserving the statistical properties of the data, optimize the balance between privacy and utility.

[0116] 3. Residual enhancement module: Introduce a residual enhancement module in the fractional matching process, significantly improve the reconstruction ability and quality of the generated image by capturing high-order features of the data.

[0117] 4. Private gradient estimation: Introduce noise in the gradient estimation process to ensure that sensitive information is not leaked during model training, achieving efficient differential privacy protection.

[0118] Through the above innovations, the method generates high-quality high-dimensional data under the premise of ensuring data privacy, and is particularly suitable for intelligent Internet of Vehicles and other application fields that require privacy protection.

[0119] Based on the same inventive concept, the embodiments of the present application also provide a generation model privacy protection device for intelligent Internet of Vehicles for implementing the generation model privacy protection method for intelligent Internet of Vehicles as described above. The implementation scheme for solving the problem provided by the system is similar to the implementation scheme described in the above method, so the specific limitations in the following embodiments of the generation model privacy protection device for intelligent Internet of Vehicles can be referred to the limitations of the generation model privacy protection method for intelligent Internet of Vehicles described above, which will not be repeated here.

[0120] Please refer to Figure 4 , the embodiments provide a generation model privacy protection device for intelligent Internet of Vehicles, comprising:

[0121] A first data processing module is configured to profile popular features of a given private data set using an energy model, and map the private data set to a low-dimensional space using projection technology to obtain low-dimensional popular features. The private data set is a data set that requires privacy protection;

[0122] A residual enhancement module is configured to encode the low-dimensional popular features using a pre-trained first generation model, and integrate the encoded mask version into the features of the intermediate layer of the generation model through a residual enhancement network;

[0123] A projection perturbation module is configured to train the first generation model based on the gradient estimation process of fractional matching, and introduce a perturbed projection vector during the training process to obtain a second generation model. The perturbed projection vector is a vector obtained by perturbing the projection vector obtained by projection technology;

[0124] A sampling module is configured to determine a sampling path and perform sampling using Hamiltonian dynamics simulation combined with gradient information of the second generation model to obtain sample data that meets the data distribution requirements of the private data set.

[0125] Those skilled in the art will clearly understand that, for the sake of convenience and brevity, the above-described division of functional units and modules is merely an example. In practical applications, the above functions can be assigned to different functional units and modules as needed, that is, the internal structure of the system can be divided into different functional units or modules to complete all or part of the functions described above. The functional units and modules in the embodiments can be integrated into one processing unit, or each unit can exist physically separately, or two or more units can be integrated into one unit. The integrated unit can be implemented in hardware or as a software functional unit. Furthermore, the specific names of the functional units and modules are only for easy differentiation and are not intended to limit the scope of protection of this application. The specific working process of the units and modules in the above system can be referred to the corresponding process in the foregoing method embodiments, and will not be repeated here.

[0126] Reference Figure 5 The present invention also provides a computer device 1, including: a memory 12 and a processor 11, and a computer program 13 stored on the memory 12, wherein when the computer program 13 is executed on the processor 11, it implements the method as described in any of the above methods.

[0127] The computer device 1 may be a desktop computer, laptop, handheld computer, or cloud server, etc. The computer device 1 may include, but is not limited to, a processor 11 and a memory 12. Those skilled in the art will understand that... Figure 5 The computer device 1 is merely an example and does not constitute a limitation on the computer device 1. It may include more or fewer components than shown in the figure, or combine certain components, or different components, such as input / output devices, network access devices, etc.

[0128] The processor 11 may be a Central Processing Unit (CPU), or it may be other general-purpose processors, digital signal processors (DSPs), application-specific integrated circuits (ASICs), field-programmable gate arrays (FPGAs), or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, etc. A general-purpose processor may be a microprocessor or any conventional processor.

[0129] The memory 12 can be an internal storage unit of the computer device 1 in some embodiments, for example, a hard disk or a memory of the computer device 1. The memory 12 can also be an external storage device of the computer device 1 in other embodiments, for example, a plug-in hard disk, a smart media card (SMC), a secure digital (SD) card, a flash card, etc. equipped on the computer device 1. Further, the memory 12 can include both the internal storage unit and the external storage device of the computer device 1. The memory 12 is used to store an operating system, an application program, a boot loader, data, and other programs, etc., for example, program codes of the computer program, etc. The memory 12 can also be used to temporarily store data that has been output or will be output.

[0130] The embodiment of the present application further provides a computer readable storage medium, which stores a computer program. The computer program is run by a processor to implement the method in any one of the above methods.

[0131] In the embodiment, the integrated unit, if implemented in the form of a software function unit and sold or used as an independent product, can be stored in a computer readable storage medium. Based on such understanding, the present application implements all or part of the processes in the above-mentioned embodiment methods, which can be completed by instructing related hardware through a computer program. The computer program can be stored in a computer readable storage medium, and the computer program can implement the steps of the above-mentioned method embodiments when executed by a processor. The computer program includes computer program codes, which can be in the form of source code, object code, executable files or some intermediate forms. The computer readable medium at least includes any entity or device capable of carrying the computer program code to the photographing device / terminal equipment, a recording medium, a computer memory, a read-only memory (ROM), a random access memory (RAM), an electrical carrier signal, a telecommunications signal and a software distribution medium. For example, a U disk, a mobile hard disk, a magnetic disk or an optical disk, etc. In some jurisdictions, according to legislation and patent practice, the computer readable medium can not be an electrical carrier signal and a telecommunications signal.

[0132] In the above embodiments, the description of each embodiment has its own focus, and the parts not described or recorded in detail in a certain embodiment can be referred to the relevant description of other embodiments.

[0133] Those skilled in the art can understand that the units and algorithm steps of each example described in combination with the embodiments disclosed herein can be realized by electronic hardware or a combination of computer software and electronic hardware. Whether the functions are realized in hardware or software depends on the specific application and design constraints of the technical solution. Those skilled in the art can use different methods to realize the described functions for each specific application, but such implementation should not be considered beyond the scope of the present application.

[0134] In the embodiments disclosed in the present application, it should be understood that the disclosed apparatus / terminal device and method can be implemented in other ways. For example, the apparatus / terminal device embodiments described above are merely schematic, for example, the division of the modules or units is merely a logical function division, and actual implementation can have another division manner, for example, a plurality of units or components can be combined or integrated into another system, or some features can be ignored or not executed. In addition, the coupling or direct coupling or communication connection between the displayed or discussed each other can be indirect coupling or communication connection through some interfaces, devices or units, and can be electrical, mechanical or other forms.

[0135] The above embodiments are only used to illustrate the technical solutions of the present application, rather than limit them; although the present application has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that the technical solutions recorded in the foregoing embodiments can be modified, or some technical features can be replaced by equivalents; and these modifications or replacements do not make the corresponding technical solutions deviate from the spirit and scope of the technical solutions of the embodiments of the present application.

Claims

1. A method for generating a model for privacy protection of intelligent Internet of Vehicles, characterized in that, The method comprises the following steps: S11, popular characteristics of a given private data set are generalized by using an energy model, and the private data set is mapped to a low-dimensional space by using a projection technique to obtain low-dimensional popular characteristics, the private data set being a data set with privacy protection requirements; S12, the low-dimensional popular characteristics are encoded by using a pre-trained first generation model, and a coded masked version is fused into features of an intermediate layer of the first generation model by using a residual enhancement network; S13, the first generation model is trained based on a gradient estimation process of score matching, and a disturbance projection vector is introduced in the training process to obtain a second generation model, the disturbance projection vector being a vector obtained by disturbing a projection vector obtained by the projection technique; S14, a sampling path is determined and sampling is performed by using Hamiltonian dynamics simulation combined with gradient information of the second generation model to obtain sample data meeting data distribution requirements of the private data set; In the training of the first generation model based on the gradient estimation process of score matching, a training loss function of the first generation model is as follows: ； wherein represents a loss function, represents a desire, represents a mapping vector, represents a transpose of a mapping vector, represents a potential function, represents is , represents an energy model; In the training process, the perturbation projection vector is introduced, and in the second generation model, a random perturbation mechanism is applied This random perturbation mechanism privatizes the projection vector , so that the projection vector and are not strictly aligned, including: For each data sample x, the gradient of the potential energy function at the sample x is projected onto the direction of the projection vector using step S11; denotes the gradient of the potential energy function at the sample x i ;​ During residual enhancement of the obtained low-dimensional manifold characteristics by using step S12, a noise vector sampled from a Gaussian distribution is added to the characteristics; The projection vector is perturbed using a differential privacy mechanism, which is equivalent to perturbing the projection vector ; The gradient is disturbed by projection using the following formula: ； wherein denotes a probability distribution function, denotes an element in a mapping vector, denotes a random variable, denotes a random perturbation mechanism, denotes an element other than denotes a subset of a mapping vector, denotes a subset of a mapping vector, denotes a privacy overhead parameter.

2. The method of claim 1, wherein, An expression of the low-dimensional popular characteristics obtained from the private data set is as follows: ； wherein denotes the Fisher divergence, denotes the energy model, and denotes the model parameters and the model input, denotes the expectation, denotes the log gradient, denotes the data distribution, denotes the potential energy function, denotes is .

3. The method of claim 1, wherein, When the first generation model is trained, a noise vector sampled from a Gaussian distribution is also added to the features of the intermediate layer of the generation model.

4. The method of claim 1, wherein, A training loss function of the second generation model is as follows: ； wherein represents a loss function, represents a potential function Convergence on the model θ.

5. The method of claim 1, wherein, The sampling process is performed according to the following formula: ； wherein denotes a sampling function, denotes a sampling element, denotes a step size.

6. A device for generating model privacy protection suitable for intelligent Internet of Vehicles, characterized in that, The method comprises the following steps: A first data processing module is configured to generalize popular characteristics of a given private data set by using an energy model, and map the private data set to a low-dimensional space by using a projection technique to obtain low-dimensional popular characteristics, the private data set being a data set with privacy protection requirements; A residual enhancement module is configured to encode the low-dimensional popular characteristics by using a pre-trained first generation model, and fuse a coded masked version into features of an intermediate layer of the first generation model by using a residual enhancement network; A projection disturbance module is configured to train the first generation model based on a gradient estimation process of score matching, and introduce a disturbance projection vector in the training process to obtain a second generation model, the disturbance projection vector being a vector obtained by disturbing a projection vector obtained by the projection technique; A sampling module is configured to determine a sampling path and perform sampling by using Hamiltonian dynamics simulation combined with gradient information of the second generation model to obtain sample data meeting data distribution requirements of the private data set; In the training of the first generation model based on the gradient estimation process of score matching, a training loss function of the first generation model is as follows: ； wherein represents a loss function, represents an expectation, represents a mapping vector, represents a transpose of a mapping vector, represents a potential function, represents is , represents an energy model; In the training process, the perturbation projection vector is introduced, and in the second generation model, a random perturbation mechanism is applied This random perturbation mechanism privatizes the projection vector So that the projection vector And There is no strict alignment, including: For each data sample x, the gradient of and is projected in the direction of the projection vector using step S11 ; denotes the gradient of the potential function at the sample x i ; During residual enhancement of the obtained low-dimensional manifold characteristics by using step S12, a noise vector sampled from a Gaussian distribution is added to the characteristics; The projection vector is perturbed using a differential privacy mechanism, which is equivalent to perturbing the projection vector ; The gradient is disturbed by projection using the following formula: ； In the formula, Represents the probability distribution function. Represents the elements in the mapping vector. Represents a random variable. This indicates a random perturbation mechanism. Indicates removal Other elements It is a subset of the mapped vectors. This represents the privacy overhead parameter.

7. A computer device, comprising: The device comprises a processor and a memory: The memory is configured to store a computer program and send instructions of the computer program to the processor; The processor executes the instructions of the computer program to perform the method of claim 1-5 for a generation model privacy protection method suitable for intelligent Internet of Vehicles.

8. A computer-readable storage medium, characterized in that, The computer readable storage medium stores a computer program, and the computer program is executed by the processor to implement the method of claim 1-5 for a generation model privacy protection method suitable for intelligent Internet of Vehicles.

Images