A model security assessment method and system for hard label no-data settings

Abstract

The present invention belongs to the field of model security technology, and discloses a model security assessment method and system for hard label no-data setting, the method comprising step S1, sending the target model classification sample into the denoising diffusion model to generate proxy data, step S2, sending the noise data into the generator, training the generator to generate query samples, step S3, training the substitute model through class diversity loss to perform functional fitting on the target model, step S4, calculating the functional similarity of the substitute model, and evaluating the security of the target model. The present invention can accurately assess the security of the black box model deployed online.

Description

Technical Field

[0001] The present invention belongs to the field of model security technology, and in particular relates to a model security assessment method and system for hard label no-data settings. Background Art

[0002] Deep learning is an important branch of artificial intelligence. In recent years, deep learning models deployed online, such as Chat-GPT, have been greatly developed and applied, and are widely used in various industries. Large models bring great convenience to people's lives. At the same time, models may face different degrees of security risks at various stages of their life cycle, resulting in the inability of models to provide normal services or leaking privacy information of models. For example, attackers steal model functions through certain information about the model implied in the output of the target model, thereby destroying the confidentiality, availability and integrity of the model. However, existing methods only perform model security detection on soft label settings, which cannot be effectively deployed under realistic conditions.

[0003] In most model security assessment methods, in attack test scenarios, the attack test on the target model usually uses a generator model and a substitute model similar to the structure of a generative adversarial network (GAN). Specifically, the generator model is used to generate query samples for accessing the target model and the substitute model, and the training goal is to maximize the difference between the prediction results of the two. The substitute model fits the prediction results of the target model, and its training data is completely derived from the query samples issued to the target model and its corresponding output. Therefore, the quality of the query samples determines the performance upper limit of the substitute model. However, under the hard label setting, there is a lack of output information of the target model, and high-quality query samples cannot be generated, resulting in a serious overfitting problem in the substitute model. This affects the success rate and performance upper limit of the substitute model function fitting in the security attack test, making it impossible to perform efficient target model security assessment.

[0004] In summary, in the scenario of evaluating the security of online deployed models through model function fitting under hard label settings, there is currently no efficient method in the attack testing methods based on GAN-like structures that can achieve the requirement of high fitting accuracy for security attack testing under hard label settings. Therefore, how to conduct effective model security evaluation under hard label conditions is an important issue that needs to be solved urgently. Summary of the invention

[0005] In view of the shortcomings of the prior art, the present invention provides a model security assessment method for hard-label no-data settings, which solves the problems of unstable training and mode collapse of GAN-based attack networks. The online deployed black box model is attacked and tested by the Deep Convolutional Generative Adversarial Networks (DCGAN) that combines convolutional neural networks and generative adversarial networks optimized by the denoising diffusion model. The proxy data is generated by introducing the denoising diffusion model, and adversarial loss is performed with the query samples generated by the generator to further improve the query sample quality. Through this optimization, better attack test effects and success rates can be achieved with fewer calls to the target model API, thereby more accurately assessing the security of the online deployed black box model and discovering potential loopholes and vulnerabilities therein.

[0006] In order to solve the above technical problems, the technical solution adopted by the present invention is:

[0007] First, the present invention provides a model security assessment method for hard label no-data setting, comprising the following steps:

[0008] Step S1: Send the target model classification samples into the denoising diffusion model to generate proxy data:

[0009] After feature extraction, the target model classification samples are input into the denoising diffusion model for forward diffusion to obtain pure Gaussian distribution. The reverse diffusion generates proxy data by denoising the pure Gaussian distribution.

[0010] Step S2: Send the noise data to the generator and train the generator to generate query samples:

[0011] Use a generator to sample vectors from a random normal distribution Generate query samples; during training, use adversarial loss to train the generator so that the generator generates data distribution close to the proxy data, that is, query samples, and generate query samples by training the generator to maximize the output of the target model and the output of the alternative model The difference between

[0012] Step S3: Train the alternative model through class diversity loss to perform functional fitting on the target model:

[0013] Use diversity loss to train the surrogate model, train the surrogate model to fit the output of the target model, and use the target model input-output pairs to train the surrogate model to minimize the output of the target model and the output of the alternative model The difference between

[0014] Step S4: Calculate the functional similarity of the alternative model and evaluate the security of the target model.

[0015] Further, step S1 is as follows: the classification result of the target model is firstly subjected to feature extraction through the feature extraction layer, and a small sample data set with comprehensive categories is constructed after extraction, and it is used as the initial data The data is sent to the denoising diffusion model for forward diffusion, so the data distribution at any time is From the initial data express:

[0016] ;

[0017] in, , ; Indicates known initial data The posterior probability distribution under the condition; is the data distribution diffused to the tth step; Represents hyperparameters The cumulative multiplication from 0 to t steps; is the Gaussian noise parameter; represents the hyperparameters of the sth step, I is the identity matrix, represents Gaussian distribution;

[0018] Forward diffusion until the image of step T becomes a pure Gaussian distribution; reverse diffusion is achieved by converting the pure Gaussian distribution The denoising process is performed to generate new data. The noise data added in each step is predicted by u-net, which is specifically expressed as:

[0019] ;

[0020] in, yes The posterior mean of yes The posterior variance of Indicates known and The posterior probability distribution under the condition; in the standard Gaussian distribution, the variance is known to be a fixed value, It is calculated in the forward diffusion; the parameterized Gaussian noise is predicted by u-net To estimate the Euclidean norm of the prediction result, which is used to estimate the Gaussian distribution , expressed as:

[0021] ;

[0022] in: is the Gaussian noise parameter, is the Gaussian noise parameter The cumulative multiplication of The approximation of , forward diffusion provides labels, backward diffusion uses labels for fitting, and by determining the variance and mean, we can get ; According to the reverse Markov chain, the reverse diffusion process is carried out, thereby converting the initial data Generate proxy data via a denoised diffusion model.

[0023] Furthermore, in step S2, the adversarial loss is expressed as:

[0024] ;

[0025] ;

[0026] in, and They represent the real data adversarial loss and the proxy data adversarial loss respectively, represents the real training data distribution, represents the standard Gaussian distribution, E represents the expected value under the two distributions, represents the output result of the discriminator by inputting proxy data, represents the data set generated by the generator by inputting a random vector, Represents the output result produced by the discriminator by inputting the dataset generated by the generator;

[0027] The generator fits the real training data set of the target model through the proxy data generated by the denoising diffusion model. In this process, the discriminator D maximizes the difference between the two parts of the adversarial loss while the generator G minimizes the difference between the two parts of the adversarial loss to conduct an adversarial game, which can be expressed as:

[0028] .

[0029] Furthermore, in step S3, the class diversity loss is used to enforce the diversity constraint. Specifically, the class diversity loss function enables the generator to generate more diverse images in all classes of the target model training dataset; in a batch of N samples, the expected confidence value for each j class is considered to be , the loss of all K categories is expressed as:

[0030] ;

[0031] ;

[0032] in, It is expressed as the loss of K categories, N is the total number of samples, i represents the i-th sample in N, represents the original output vector value of the i-th sample, Represents the predicted probability of the i-th sample in the j-th category;

[0033] After optimization by adversarial loss and class diversity loss, the total losses of the generator and discriminator are:

[0034] ;

[0035] ;

[0036] in, are the parameters of the generator, is the total loss of the generator, is the total loss of the discriminator.

[0037] Furthermore, step S4 specifically sets the target model security threshold , by calculating the functional fitting accuracy of the surrogate model, the similarity between the surrogate model and the target model is obtained, which is expressed as:

[0038] ;

[0039] in: Indicates the number of samples with the same prediction results as the target model. Indicates the number of samples where the prediction results of the alternative model and the target model are different; finally, the similarities between the models are compared. and security threshold The relationship between the attack test success rate is calculated to evaluate the security of the target model.

[0040] The present invention also provides a model security assessment system for hard label no-data setting, which is used to implement a model security assessment method for hard label no-data setting as described above, the system comprising a denoising diffusion model, a generator, a discriminator, a loss calculation module, and a model security assessment module;

[0041] The denoising diffusion model is used to forward diffuse the target model classification samples to obtain a pure Gaussian distribution, and the reverse diffusion generates proxy data by denoising the pure Gaussian distribution;

[0042] The generator and the discriminator are subjected to adversarial training;

[0043] The loss calculation module is used to calculate adversarial loss and diversity loss;

[0044] The model security assessment module is used to calculate the functional similarity of the alternative model and assess the security of the target model.

[0045] Compared with the prior art, the present invention has the following advantages:

[0046] (1) The present invention is applicable to most model security tests for image classification tasks. Compared with the model security test under the traditional soft label setting, the hard label setting is more in line with the full-cycle security threats faced by the deployment of large models in real situations, and can more realistically restore the real attack scenario, further increasing the practical usability of model security testing. At the same time, it has the characteristics of strong adaptability and high efficiency, and can objectively evaluate the security of the target model.

[0047] (2) The present invention is a method for performing security testing on a target model by using a substitute model function fitting without accessing the training data set of the target model. By using a denoising diffusion model to generate sensitive data that can more accurately restore the target model, and using a discriminator to perform adversarial loss on proxy data and query samples, the generator model generates high-quality query samples that fit the actual training data of the target model. This solves the overfitting problem caused by the lack of attack data in model security detection under hard label settings, and also improves the success rate of security attack tests while reducing the number of times the target model is accessed, further improving the accuracy of model security assessment.

[0048] (3) The present invention uses class diversity loss to enable the generator model to generate query data samples with uniform category distribution, further making the query samples accessing the target model more closely match the category distribution of its real training data, overcoming the problems of low query sample quality, sparse samples, and uneven category distribution under the hard label no data setting. This improves the functional fitting success rate of the alternative model and effectively promotes the deployment and application of model security detection in practice. BRIEF DESCRIPTION OF THE DRAWINGS

[0049] In order to more clearly illustrate the technical solutions of the embodiments of the present invention, the accompanying drawings required for use in the description of the embodiments will be briefly introduced below. Obviously, the accompanying drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other accompanying drawings can be obtained based on these accompanying drawings without paying creative work.

[0050] Figure 1 is a flow chart of the method of the present invention;

[0051] Figure 2 A flow chart of a safety test method performed using the method of the present invention;

[0052] Figure 3 It is a schematic diagram of the system structure of the present invention. DETAILED DESCRIPTION

[0053] The present invention will be further described below in conjunction with the accompanying drawings and specific embodiments.

[0054] Terminology explanation:

[0055] Model Stealing Attack: A Model Stealing Attack (MS) is an attack in which an adversary with black-box access uses the target model's predictions for different inputs to train a substitute model to fit the target model's functionality. Since the attacker usually does not have access to the dataset used to train the target model, the attack requires alternately querying the target model and performing model function fitting. In the data-free scenario, the attacker initiates queries to the model without any data, generates a data source by generating a model, and uses techniques from the field of data-free knowledge transfer to fit the model's functionality.

[0056] Denoising Diffusion Model: Diffusion Models is an advanced deep generative model. The forward process of the diffusion model smoothly perturbs the data by adding noise, and the reverse process generates new data from the noise. Each denoising step in the reverse process usually requires estimating the score function, which is a gradient pointing in the direction of data with higher probability and less noise. The denoising diffusion probability model has excellent inductive bias for image data and can obtain a large number of high-quality image synthesis results.

[0057] Deep Convolutional Generative Adversarial Networks: Deep Convolutional Generative Adversarial Networks (DCGAN) introduce convolutional neural networks into generative models and discriminative models. Different from traditional generative adversarial networks, DCGAN uses fractional stride convolution instead of pooling, and uses batch normalization layers to normalize the input of each layer, and finally connects the random input of the generator directly to the feature input of the convolution layer. Similarly, the output layer of the discriminator is connected to the output features of the convolution layer. The above improvements make the deep convolutional generative network more powerful and easier and more stable to train.

[0058] The security assessment scenario of the online deployed black box model is as follows: the target model is an online deployed black box model that performs image classification tasks. To conduct a security assessment of the black box model, an attack test is set up for the target model. The attacker cannot access any parameters and training datasets of the target model except the maximum probability prediction result (top-1) of the target model. The training goal of the substitute model is to fit the function of the target model as much as possible on the standard dataset. Finally, the attack test effect and the security of the target model are evaluated by calculating the similarity between the substitute model and the target model.

[0059] In the security assessment of black-box models, attack tests are conducted without access to the target model training data set. In order to address the performance degradation of traditional data-free model stealing attacks under hard label settings, the present invention comprehensively considers the scenario in which the black-box model only outputs the top-1 prediction label in the model security attack test, and proposes a model security assessment method for hard-label data-free settings. In order to explore the security issues of black-box models deployed online, it is usually necessary to construct attack tests for the target model. Traditional attack tests require access to the full probability output results of the target model, but in real-world conditions, APIs usually only return partial probability values ​​(top-k predictions) or even top-1 predictions (i.e., hard labels). This hard label conditional setting lacks the output information of the target model, resulting in serious overfitting problems in the alternative model.

[0060] Therefore, the present invention creatively proposes to conduct attack tests on the online deployed black box model through the DCGAN structure optimized by the denoising diffusion model, and further improves the query sample quality by introducing the denoising diffusion model to generate proxy data and conduct adversarial loss with the query samples generated by the generator. Through this optimization, better attack test effects and success rates can be achieved with fewer calls to the target model API, thereby more accurately evaluating the security of the online deployed black box model and discovering potential loopholes and vulnerabilities therein.

[0061] Example 1

[0062] Combine the following Figure 1-Figure 2 , the present invention is further described.

[0063] This embodiment provides a model security assessment method for hard label no data setting. It should be noted that the present invention is applicable to most model security tests for image classification tasks. That is to say, when performing model security assessment, the data collected and processed is image data, that is, the initial data x o 、x t 、x T etc. are all image sample data.

[0064] The specific steps include:

[0065] Step S1: Send the target model classification samples into the denoising diffusion model to generate proxy data.

[0066] After feature extraction, the classified samples of the target model are input into the denoising diffusion model for forward diffusion to obtain pure Gaussian distribution. The reverse diffusion generates proxy data by denoising the pure Gaussian distribution.

[0067] Step S1 is as follows: The classification result of the target model is first extracted through the feature extraction layer, and a small sample data set with comprehensive categories is constructed after extraction, and it is used as the initial data The data is sent to the denoising diffusion model for forward diffusion, so the data distribution at any time is From the initial data express:

[0068] ;

[0069] in, , ; Indicates known initial data The posterior probability distribution under the condition; is the data distribution diffused to the tth step; Represents hyperparameters The cumulative multiplication from 0 to t steps; is the Gaussian noise parameter; represents the hyperparameters of the sth step, I is the identity matrix, Represents a Gaussian distribution.

[0070] Forward diffusion until the image of step T becomes a pure Gaussian distribution; reverse diffusion is achieved by converting the pure Gaussian distribution The denoising process is performed to generate new data. The noise data added in each step is predicted by u-net, which is specifically expressed as:

[0071] ;

[0072] in, yes The posterior mean of yes The posterior variance of Indicates known and The posterior probability distribution under the condition; in the standard Gaussian distribution, the variance is known to be a fixed value, It is calculated in the forward diffusion; the parameterized Gaussian noise is predicted by u-net To estimate the Euclidean norm of the prediction result, which is used to estimate the Gaussian distribution , expressed as:

[0073] ;

[0074] in: is the Gaussian noise parameter, is the Gaussian noise parameter The cumulative multiplication of The approximation of , forward diffusion provides labels, backward diffusion uses labels for fitting, and by determining the variance and mean, we can get ; According to the reverse Markov chain, the reverse diffusion process is carried out, thereby converting the initial data Generate proxy data via a denoised diffusion model.

[0075] Step S2: Send the noise data to the generator and train the generator to generate query samples:

[0076] Use a generator to sample vectors from a random normal distribution Generate query samples; during training, use adversarial loss to train the generator so that the generator generates data distribution close to the proxy data, that is, query samples, and generate query samples by training the generator to maximize the output of the target model and the output of the alternative model The difference between.

[0077] The adversarial loss ensures that the distribution of images generated by the generator is closer to the proxy data. The adversarial loss is expressed as:

[0078] ;

[0079] ;

[0080] in, and They represent the real data adversarial loss and the proxy data adversarial loss respectively, represents the real training data distribution, represents the standard Gaussian distribution, E represents the expected value under the two distributions, represents the output result of the discriminator by inputting proxy data, represents the data set generated by the generator by inputting a random vector, Represents the output result produced by the discriminator by inputting the dataset generated by the generator.

[0081] The generator fits the real training data set of the target model through the proxy data generated by the denoising diffusion model. In this process, the discriminator D maximizes the difference between the two parts of the adversarial loss while the generator G minimizes the difference between the two parts of the adversarial loss to conduct an adversarial game, which can be expressed as:

[0082] .

[0083] Step S3: Train the alternative model through class diversity loss to perform functional fitting on the target model:

[0084] Use diversity loss to train the surrogate model, train the surrogate model to fit the output of the target model, and use the target model input-output pairs to train the surrogate model to minimize the output of the target model and the output of the alternative model The difference between.

[0085] Use class diversity loss to enforce diversity constraints. Specifically, the class diversity loss function makes the generator generate more diverse images in all classes of the target model training dataset; in a batch of N samples, consider the expected confidence value for each j class as , the loss of all K categories is expressed as:

[0086] ;

[0087] ;

[0088] in, It is expressed as the loss of K categories, N is the total number of samples, i represents the i-th sample in N, represents the original output vector value of the i-th sample, It represents the predicted probability of the i-th sample in the j-th class, which is calculated by the softmax function. The content of this part of the confidence calculation is the existing technology and will not be repeated here. Therefore, the attack results of the network are optimized through adversarial loss and class diversity loss, and the quality of the attack data set generated by the generator model is further improved.

[0089] like Figure 2 As shown, the network is optimized by adversarial loss and class diversity loss. The total losses of the optimized security evaluation network, generator and discriminator are:

[0090] ;

[0091] ;

[0092] in, are the parameters of the generator, is the total loss of the generator, is the total loss of the discriminator.

[0093] Step S4: Calculate the functional similarity of the alternative model and evaluate the security of the target model.

[0094] Step S4 specifically sets the target model security threshold , by calculating the functional fitting accuracy of the surrogate model, the similarity between the surrogate model and the target model is obtained, which is expressed as:

[0095] ;

[0096] in: Indicates the number of samples with the same prediction results as the target model. Indicates the number of samples where the prediction results of the alternative model and the target model are different; finally, the similarities between the models are compared. and security threshold The relationship between the attack test success rate is calculated to evaluate the security of the target model.

[0097] Example 2

[0098] This embodiment provides a model security assessment system for hard label no data setting, such as Figure 3 As shown. It is used to implement the model security assessment method for hard label no data setting as described in Example 1. The system includes a denoising diffusion model, a generator, a discriminator, a loss calculation module, and a model security assessment module.

[0099] The denoising diffusion model is used to forward diffuse the target model classification samples to obtain a pure Gaussian distribution, and the backward diffusion generates proxy data by denoising the pure Gaussian distribution; the generator and the discriminator perform adversarial training; the loss calculation module is used to calculate the adversarial loss and the diversity loss; the model security assessment module is used to calculate the functional similarity of the alternative model and assess the security of the target model.

[0100] The functions and implementation processes of each module can be found in the description of Example 1, and will not be repeated here.

[0101] In summary, the model security assessment method for online deployment under hard label settings requires setting up attack tests to assess model security. For the model security attack test problem, the existing methods cannot meet the following requirements at the same time: 1. Practical applicability, suitable for scenarios where only the maximum probability output (hard label) of the target model can be accessed. 2. The generator model generates high-quality query samples and accesses the target model API in small quantities. 3. Stable adversarial network training with high training efficiency. 4. The alternative model has high functional fitting accuracy.

[0102] In the method of security testing and evaluation through model function fitting, the attacker can only obtain the maximum probability prediction result of the target model by inputting the query sample, and cannot access the parameters and any training data of the target model. In order to meet the above four requirements, the present invention starts from two aspects: 1. A DCGAN structure is proposed to perform a model security evaluation method. The method first uses the DCGAN structure to replace the traditional GAN-based attack method, and uses the adversarial loss to make the query samples generated by the generator model more in line with the real training data, overcoming the overfitting problem caused by the small amount of information under the hard label setting. At the same time, through the class diversity loss, the generator generates query samples with more balanced category distribution, overcoming the problem of uneven category distribution of the attack data set in the data-free model security detection. Further stabilize the training of the attack network while preventing the collapse of the outgoing line mode. 2. A denoising diffusion model is proposed to optimize the DCGAN structure, and the prediction result of the target model is processed by the denoising diffusion model to output high-quality proxy data. Use proxy data that fits the real training data of the target model and query samples generated by the generator model for adversarial loss. In this patent, the DCGAN structure optimized by the denoising diffusion model is used for attack testing to obtain high-quality query samples, reduce the number of calls to the target model API, and improve the accuracy of model function fitting, so as to more effectively evaluate the security and practicality of the black box model deployed online.

[0103] That is to say, the present invention uses the DCGAN architecture optimized by the denoising diffusion model for security testing, and performs adversarial loss and class diversity loss on the proxy data generated by the denoising diffusion model and the query samples generated by the generator, so that the query samples are more closely aligned with the real training data of the target model, making up for the problem of insufficient information of the target model caused by the hard label no data setting, effectively reducing the overfitting degree of the alternative model, and ultimately improving the success rate of model security attack detection based on a small number of visits to the target model.

[0104] Of course, the above description is not a limitation of the present invention, and the present invention is not limited to the above examples. Any changes, modifications, additions or substitutions made by ordinary technicians in this technical field within the essential scope of the present invention should fall within the protection scope of the present invention.

Claims

1. A model security assessment method for hard-label no-data settings, characterized in that: The following steps are involved: Step S1: Send the target model classification samples into the denoising diffusion model to generate proxy data: After feature extraction, the target model classification samples are input into the denoising diffusion model for forward diffusion to obtain pure Gaussian distribution. The reverse diffusion generates proxy data by denoising the pure Gaussian distribution. Step S2: Send the noise data to the generator and train the generator to generate query samples: Generate query samples by sampling vector Z from a random normal distribution using a generator; During training, the adversarial loss is used to train the generator so that the generator generates data distribution close to the proxy data, that is, query samples. The query samples are generated by training the generator to maximize the output y of the target model. T and the output y of the alternative model S The difference between Step S3: Train the alternative model through class diversity loss to perform functional fitting on the target model: Use diversity loss to train the surrogate model, train the surrogate model to fit the output of the target model, and use the target model input-output pairs to train the surrogate model to minimize the output y of the target model T and the output y of the alternative model S The difference between In step S3, the class diversity loss is used to enforce the diversity constraint. Specifically, the class diversity loss function enables the generator to generate more diverse images in all classes of the target model training dataset; in a batch of N samples, the expected confidence value for each j class is considered to be α j , the loss of all K categories is expressed as: Among them, L class_div It is expressed as the loss of K categories, N is the total number of samples, i represents the i-th sample in N, S(x i ) represents the original output vector value of the i-th sample, softmax(S(x i )) j represents the predicted probability of the i-th sample in the j-th class; after optimization by adversarial loss and class diversity loss, the total losses of the generator and discriminator are: L G =L adv，fake +λ divLclass_div ; L D =L adv，real +L adv，fake ; Among them, λ div is the parameter of the generator, L G is the total loss of the generator, L D is the total loss of the discriminator; Step S4: Calculate the functional similarity of the alternative model and evaluate the security of the target model.

2. A model security assessment method for hard-label no-data setting according to claim 1, characterized in that: Step S1 is as follows: The classification result of the target model is first extracted through the feature extraction layer, and a comprehensive small sample data set is constructed after extraction, and it is sent as the initial data x0 to the denoising diffusion model for forward diffusion, so the data distribution x at any time is t Represented by the initial data x0: Among them, α t =1-β t , represents the posterior probability distribution under the condition of known initial data x0; x t is the data distribution diffused to the tth step; represents the cumulative multiplication of the hyperparameter α from 0 to t steps; β t is the Gaussian noise parameter; α s represents the hyperparameters of the sth step, I is the identity matrix, represents Gaussian distribution; Forward diffusion until the image x at step T T becomes a pure Gaussian distribution; reverse diffusion is performed by T The denoising process is performed to generate new data. The noise data added in each step is predicted by u-net, which is specifically expressed as: in, is q(x t-1 |x t , the posterior mean of x0), is q(x t-1 |x t , x0) posterior variance; q(x t-1 |x t , x0) means that x is known t and the posterior probability distribution under the conditions of x0; in the standard Gaussian distribution, the variance is known to be a fixed value, It is calculated in the forward diffusion; the parameterized Gaussian noise z is predicted by u-net t To estimate the Euclidean norm of the prediction result, which is used to estimate the Gaussian distribution It is expressed as: Where: β t is the Gaussian noise parameter, is the Gaussian noise parameter β t The cumulative multiplication of t The forward diffusion provides the label, and the backward diffusion uses the label for fitting. By determining the variance and mean, q(x t-1 |x t , x0); perform a reverse diffusion process according to the inverse Markov chain, thereby generating proxy data from the initial data x0 through a denoising diffusion model.

3. A model security assessment method for hard-label no-data setting according to claim 1, characterized in that: In step S2, the adversarial loss is expressed as: Among them, L adv，real and L adv，fake They represent the real data adversarial loss and the proxy data adversarial loss, respectively, and P data (x) represents the real training data distribution, Represents the standard Gaussian distribution, E represents the expected value under the two distributions, D(x) represents the output result of the discriminator by inputting the proxy data, G(z) represents the data set generated by the generator by inputting the random vector, and D(G(z)) represents the output result of the discriminator by inputting the data set generated by the generator; the generator fits the real training data set of the target model with the proxy data generated by the denoising diffusion model. In this process, the discriminator D maximizes the difference between the two parts of the adversarial loss while the generator G minimizes the difference between the two parts of the adversarial loss, so as to conduct an adversarial game, which is expressed as:

4. A model security assessment method for hard-label no-data setting according to claim 1, characterized in that: Step S4 specifically sets the target model security threshold Ψ, and obtains the similarity between the substitute model and the target model by calculating the functional fitting accuracy of the substitute model, which is expressed as: Where: N suc Indicates the number of samples with the same prediction results as the target model, N fail It represents the number of samples whose prediction results are different from those of the target model. Finally, the attack test success rate is calculated by comparing the relationship between the similarity D(T, S) between the models and the security threshold Ψ, thereby evaluating the security of the target model.

5. A model security assessment system for hard-label no-data settings, characterized in that: Used to implement a model security assessment method for a hard-label no-data setting as described in any one of claims 1 to 4, the system comprising a denoising diffusion model, a generator, a discriminator, a loss calculation module, and a model security assessment module; The denoising diffusion model is used to forward diffuse the target model classification samples to obtain a pure Gaussian distribution, and the reverse diffusion generates proxy data by denoising the pure Gaussian distribution; The generator and the discriminator are subjected to adversarial training; The loss calculation module is used to calculate adversarial loss and diversity loss; The model security assessment module is used to calculate the functional similarity of the alternative model and assess the security of the target model.

Images