Data use detection method and device in neural network model training process, equipment and medium

Abstract

The invention discloses a data use detection method and device in a neural network model training process, equipment and a medium, and relates to the technical field of data security, and the method comprises the steps: carrying out the iterative updating of original user data through a boundary search strategy, and obtaining corresponding target sample data; obtaining an initial neural network model and a target neural network model obtained by training the initial neural network model through the target data training set; respectively inputting the target sample data into the initial neural network model and the target neural network model to obtain first antagonistic disturbance output by the initial neural network model and second antagonistic disturbance output by the target neural network model; and determining whether the target sample data belongs to the target data training set or not according to a preset adversarial disturbance threshold value, the first adversarial disturbance and the second adversarial disturbance, and obtaining a corresponding data use detection result. And detecting the data use condition of the model in the training process through the adversarial disturbance of the target sample data.

Description

Technical Field

[0001] The present invention relates to the field of data security technology, and in particular to a data usage detection method, device, equipment and medium in a neural network model training process. Background Art

[0002] At present, most individuals still know little about the unauthorized collection and abuse of their personal data, unless they accidentally find their personal data in a public training data set, which highlights the need to improve the transparency of data use. Only by disclosing the use of personal data in a timely manner can we prevent privacy infringement and protect the privacy of individual data. Therefore, how to design a reasonable data use detection method to detect from the user side whether the deep learning model developer uses user data for model training without authorization, especially under the premise of only being able to access the hard label output of the black box model and not interfering with the normal training process of the model, designing a hidden, feasible, safe, effective and robust data use detection mechanism to allow users to track the use of their data in the model training process has become a major problem in effectively supervising whether data is used for model training without authorization. In the prior art, the use of backdoor data specially generated by the user by the deep learning model is tracked by monitoring the backdoor trigger mode to track whether the individual data is used, but it is necessary to modify the category assigned to specific data by the model, which is beyond the ability of ordinary users. Alternatively, create unique pattern special data in the model feature space to track whether individual data is used. However, determining whether model developers use user data during model training requires not only controlling the model training process but also access to the white-box model, which is beyond the capabilities of ordinary users.

[0003] Although membership inference can provide direct evidence to determine whether individual data is used for model training, it mainly relies on the performance difference between training data and test data. However, accurately detecting the participation of common individual data in model training is still a huge challenge. This is because after ordinary data is used for training, it lacks strong and confident membership compared to test data. In addition, users can only upload data without knowing the specific learning tasks or controlling the assigned data labels, which makes the traditional backdoor watermarking technology that requires modifying category labels no longer applicable.

[0004] In summary, how to effectively detect whether individual privacy data is used during neural network model training is a technical problem to be solved in this field. Summary of the invention

[0005] In view of this, the purpose of the present invention is to provide a method, device, equipment and medium for detecting data usage in the neural network model training process, which can effectively detect whether individual privacy data is used in the neural network model training process. The specific scheme is as follows:

[0006] In a first aspect, the present application discloses a method for detecting data usage in a neural network model training process, comprising:

[0007] The original user data is iteratively updated using the boundary search strategy to obtain the corresponding target sample data;

[0008] Acquire an initial neural network model and a target neural network model obtained after training the initial neural network model with a target data training set;

[0009] Inputting the target sample data into the initial neural network model and the target neural network model respectively, so as to generate corresponding first sample data and second sample data respectively by adopting a boundary search algorithm, and respectively calculating a first adversarial perturbation difference between the first sample data and the target sample data, and a second adversarial perturbation difference between the second sample data and the target sample data, so as to obtain a first adversarial perturbation output by the initial neural network model and a second adversarial perturbation output by the target neural network model;

[0010] According to the preset adversarial perturbation threshold, the first adversarial perturbation, and the second adversarial perturbation, it is determined whether the target sample data belongs to the target data training set or does not belong to the target data training set to obtain a corresponding data usage detection result.

[0011] Optionally, the iterative updating of the original user data by using the boundary search strategy to obtain corresponding target sample data includes:

[0012] Performing disturbance adding processing on the original user data to generate adversarial user data samples with noise;

[0013] Determine whether the current number of iterations of the current adversarial user data sample meets the preset number of iterations condition;

[0014] If satisfied, stop updating and use the current adversarial user data sample as the target sample data;

[0015] If not, a normal perturbation required for the next update iteration is generated, and the normal perturbation is projected onto a sphere surrounding the original user data according to the rationality and adversarial constraints to obtain a process adversarial user data sample;

[0016] Control the process adversarial user data sample to move the target relative step length toward the original user data direction according to the preset step length constraint condition, so as to obtain the updated current adversarial user data sample and update the current number of iterations;

[0017] Jump to the step of determining whether the current number of iterations of the current adversarial user data sample meets the preset number of iterations condition until the current number of iterations meets the preset number of iterations condition.

[0018] Optionally, the obtaining of an initial neural network model and a target neural network model obtained by training the initial neural network model with a target data training set includes:

[0019] Access the corresponding black box model as the initial neural network model according to the hard label query, and obtain the target neural network model obtained after the initial neural network model is trained with the target data training set; wherein the initial neural network model and the target neural network model are both black box models.

[0020] Optionally, the target sample data is input into the initial neural network model to generate corresponding first sample data using a boundary search algorithm, and the adversarial perturbation difference between the first sample data and the target sample data is calculated to obtain a first adversarial perturbation output by the initial neural network model, including:

[0021] Select a preset number of target sample data;

[0022] Inputting each of the target sample data into the initial neural network model, and predicting the corresponding data classification label through the initial neural network model to obtain a first data classification label;

[0023] Adding a corresponding first data disturbance to the target sample data to obtain the first sample data as new target sample data, and inputting the new target sample data into the initial neural network model, and predicting the corresponding data classification label through the initial neural network model to obtain a second data classification label;

[0024] Determining whether the second data classification label is consistent with the first data classification label;

[0025] If the labels are consistent, jump to the step of adding the corresponding first data perturbation to the target sample data to obtain the first sample data as the new target sample data, until the minimum data perturbation corresponding to the inconsistent labels is obtained as the first adversarial perturbation output by the initial neural network model.

[0026] Optionally, the target sample data is input into the target neural network model to generate corresponding second sample data using a boundary search algorithm, and the adversarial perturbation difference between the second sample data and the target sample data is calculated to obtain a second adversarial perturbation output by the target neural network model, including:

[0027] Inputting each of the target sample data into the target neural network model, and predicting the corresponding data classification label through the target neural network model to obtain a third data classification label;

[0028] Adding a corresponding second data disturbance to the target sample data to obtain the second sample data as new target sample data, and inputting the new target sample data into the target neural network model, and predicting the corresponding data classification label through the target neural network model to obtain a fourth data classification label;

[0029] Determining whether the fourth data classification label is consistent with the third data classification label;

[0030] If the labels are consistent, jump to the step of adding the corresponding second data perturbation to the target sample data to obtain the second sample data as the new target sample data, until the minimum data perturbation corresponding to the inconsistent labels is obtained as the second adversarial perturbation output by the target neural network model.

[0031] Optionally, determining whether the target sample data belongs to the target data training set or does not belong to the target data training set according to a preset adversarial perturbation threshold, the first adversarial perturbation, and the second adversarial perturbation to obtain a corresponding data usage detection result includes:

[0032] Respectively determining the magnitude relationship between the first adversarial perturbation of each target sample data and a preset adversarial perturbation threshold to obtain a first determination result;

[0033] Respectively determining the magnitude relationship between the second adversarial perturbation of each target sample data and a preset adversarial perturbation threshold to obtain a second determination result;

[0034] If the first judgment result is that the first adversarial perturbation of the target sample data is less than or equal to the preset adversarial perturbation threshold and the second judgment result is that the second adversarial perturbation of the same target sample data is less than or equal to the preset adversarial perturbation threshold; then the corresponding target sample data is determined to be non-member data that does not belong to the target data training set, so as to obtain the corresponding data unused detection result.

[0035] Optionally, before determining, according to a preset adversarial perturbation threshold, the first adversarial perturbation, and the second adversarial perturbation, whether the target sample data belongs to the target data training set or does not belong to the target data training set to obtain a corresponding data usage detection result, the method further includes:

[0036] Select corresponding training data from a data set orthogonal to the training task of the initial neural network model as non-member data;

[0037] A preset adversarial disturbance threshold is determined according to the adversarial disturbance corresponding to each of the non-member data.

[0038] In a second aspect, the present application discloses a data usage detection device for a neural network model training process, comprising:

[0039] The sample acquisition module is used to iteratively update the original user data using the boundary search strategy to obtain the corresponding target sample data;

[0040] A model acquisition module, used to acquire an initial neural network model and a target neural network model obtained after training the initial neural network model with a target data training set;

[0041] A detection module, used to input the target sample data into the initial neural network model and the target neural network model respectively, so as to respectively generate corresponding first sample data and second sample data by adopting a boundary search algorithm, and respectively calculate a first adversarial perturbation difference between the first sample data and the target sample data, and a second adversarial perturbation difference between the second sample data and the target sample data, so as to obtain a first adversarial perturbation output by the initial neural network model and a second adversarial perturbation output by the target neural network model;

[0042] A result acquisition module is used to determine whether the target sample data belongs to the target data training set or does not belong to the target data training set according to a preset adversarial perturbation threshold, the first adversarial perturbation, and the second adversarial perturbation, so as to obtain a corresponding data usage detection result.

[0043] In a third aspect, the present application discloses an electronic device, comprising:

[0044] Memory, used to store computer programs;

[0045] A processor is used to execute the computer program to implement the steps of the data usage detection method of the neural network model training process disclosed above.

[0046] In a fourth aspect, the present application discloses a computer-readable storage medium for storing a computer program; wherein, when the computer program is executed by a processor, the steps of the data usage detection method of the aforementioned disclosed neural network model training process are implemented.

[0047] It can be seen that the present application discloses a data usage detection method for a neural network model training process, including: iteratively updating the original user data using a boundary search strategy to obtain corresponding target sample data; obtaining an initial neural network model and a target neural network model obtained after training the initial neural network model with a target data training set; inputting the target sample data into the initial neural network model and the target neural network model respectively, so as to generate corresponding first sample data and second sample data respectively using a boundary search algorithm, and respectively calculating a first adversarial perturbation difference between the first sample data and the target sample data, and a second adversarial perturbation difference between the second sample data and the target sample data, so as to obtain a first adversarial perturbation output by the initial neural network model and a second adversarial perturbation output by the target neural network model; determining whether the target sample data belongs to the target data training set or does not belong to the target data training set according to a preset adversarial perturbation threshold, the first adversarial perturbation, and the second adversarial perturbation, so as to obtain a corresponding data usage detection result. It can be seen that by designing a target sample data that is easy to fit, close to the model decision boundary, and maintains small disturbance, by generating target sample data and utilizing its performance difference in the initial model and the trained target model, the data usage of the model in the training process is inferred with high confidence, providing reliable data detection results. Since the generated target sample data maintains a high degree of semantic consistency and visual similarity with the original user data, it avoids introducing any abnormal patterns or significant noise, so that the target sample data can pass visual inspection and anomaly detection; by comparing the adversarial perturbation size required for special samples under different model states, its membership can be judged more accurately, and special sample data is generated through a carefully designed boundary search strategy, so that it can play an effective role in various scenarios, is robust to various adaptive strategies and complex scenarios, and can be widely used and deployed in various application scenarios that require detection of data usage. BRIEF DESCRIPTION OF THE DRAWINGS

[0048] In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are only embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on the provided drawings without paying creative work.

[0049] Figure 1 A flow chart of a data usage detection method for a neural network model training process disclosed in this application;

[0050] Figure 2 A flow chart of a method for acquiring target sample data disclosed in this application;

[0051] Figure 3 A flow chart of a method for obtaining a first adversarial perturbation of an initial neural network model disclosed in the present application;

[0052] Figure 4 A flow chart of a method for obtaining a second adversarial perturbation of a target neural network model disclosed in this application;

[0053] Figure 5 A schematic diagram of the structure of a data usage detection device for a neural network model training process disclosed in the present application;

[0054] Figure 6 This is a structural diagram of an electronic device disclosed in this application. DETAILED DESCRIPTION

[0055] The following will be combined with the drawings in the embodiments of the present application to clearly and completely describe the technical solutions in the embodiments of the present application. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without making creative work are within the scope of protection of the present invention.

[0056] At present, most individuals still know little about the unauthorized collection and abuse of their personal data, unless they accidentally find their personal data in a public training data set, which highlights the need to improve the transparency of data use. Only by disclosing the use of personal data in a timely manner can we prevent privacy infringement and protect the privacy of individual data. Therefore, how to design a reasonable data use detection method to detect from the user side whether the deep learning model developer uses user data for model training without authorization, especially under the premise of only being able to access the hard label output of the black box model and not interfering with the normal training process of the model, designing a hidden, feasible, safe, effective and robust data use detection mechanism to allow users to track the use of their data in the model training process has become a major problem in effectively supervising whether data is used for model training without authorization. In the prior art, the use of backdoor data specially generated by the user by the deep learning model is tracked by monitoring the backdoor trigger mode to track whether the individual data is used, but it is necessary to modify the category assigned to specific data by the model, which is beyond the ability of ordinary users. Alternatively, create unique pattern special data in the model feature space to track whether individual data is used. However, determining whether model developers use user data during model training requires not only controlling the model training process but also access to the white-box model, which is beyond the capabilities of ordinary users.

[0057] Although membership inference can provide direct evidence to determine whether individual data is used for model training, it mainly relies on the performance difference between training data and test data. However, accurately detecting the participation of common individual data in model training is still a huge challenge. This is because after ordinary data is used for training, it lacks strong and confident membership compared to test data. In addition, users can only upload data without knowing the specific learning tasks or controlling the assigned data labels, which makes the traditional backdoor watermarking technology that requires modifying category labels no longer applicable.

[0058] To this end, the present invention provides a data usage detection scheme for a neural network model training process, which can effectively detect whether individual privacy data is used in the neural network model training process.

[0059] Reference Figure 1 As shown, an embodiment of the present invention discloses a data usage detection method in a neural network model training process, comprising:

[0060] Step S11: Iteratively update the original user data using a boundary search strategy to obtain corresponding target sample data.

[0061] In this embodiment, the original user data is iteratively updated using the boundary search strategy. Specifically, the position of the updated data after the original user data is updated by the boundary search strategy is close to the decision boundary of the model, and the updated data needs to be close to the original user data. Only when the updated data obtained by the boundary search strategy meets the above two conditions, the updated data is used as the target sample data. It should be noted that the decision boundary of the model refers to the dividing line or interface that distinguishes different categories in the feature space.

[0062] like Figure 2 As shown, the original user data is perturbed and added to generate an adversarial user data sample with noise; it is determined whether the current number of iterations of the current adversarial user data sample meets the preset number of iterations condition; if so, the update is stopped, and the current adversarial user data sample is used as the target sample data; if not, the normal perturbation required for the next update iteration is generated, and the normal perturbation is projected onto the sphere surrounding the original user data according to the rationality and adversarial constraints to obtain the process adversarial user data sample; the process adversarial user data sample is controlled to move the target relative step length in the direction of the original user data according to the preset step length constraint to obtain the updated current adversarial user data sample and update the current number of iterations; the step of determining whether the current number of iterations of the current adversarial user data sample meets the preset number of iterations condition is jumped to execute until the current number of iterations meets the preset number of iterations condition. It can be understood that in the target sample data generation stage, the boundary search strategy is used to first search for the original user data. Initialize a confrontation user data sample with large noise based on , and then judge the adversarial user data sample The current iteration number of Is it greater than or equal to the preset number of iterations? ,like , then further generate the normal disturbance required for the next update iteration , then under the conditions of rationality constraints and adversarial constraints, Projecting onto a sphere around the original user data, making each updated process adversarial to the user data sample Always maintain confrontation and within a reasonable range. The constraints of rationality and confrontation are also f ( x ' i ) ≠ f ( x ) , s u b j e c t t o x ' i = x ' i − 1 + η i ∈ [ 0 , 2 5 5 ] ,in, Represents the previous process adversarial user data sample. Then, according to the distance constraint, the process adversarial user data sample is processed by distance constraint. Specifically, by making the user data sample The perturbations added in the step size ϵ are gradually reduced relative to the original user data. Distance between: In this way, the update is iterated continuously to get closer to the decision boundary and reduce the initially added perturbation, thereby reducing the distance from the original user data while maintaining adversarial properties.

[0063] The iterative frontier search process consists of three steps:

[0064] Randomly generate The disturbance that needs to be added in step 1 satisfies ;

[0065] Will Projected around the original user data On the sphere , so that under the constraints of rationality and adversarial nature, we can obtain .Notice, and are all on the surface of the ball, maintaining the same distance as the original user data; among them, express The iterative process is to measure the bi-norm distance between the adversarial user data sample and the original user data, that is, the Euclidean distance.

[0066] When there is an orthogonal perturbation While still maintaining adversarial nature, according to the rationality constraints, adversarial constraints, and distance constraints, the original user data Move the relative step size ϵ to reduce the added perturbation.

[0067] Step S12: Acquire an initial neural network model and a target neural network model obtained after training the initial neural network model with a target data training set.

[0068] In this embodiment, the corresponding black box model is accessed as the initial neural network model according to the hard label query, and the target neural network model obtained after the initial neural network model is trained with the target data training set is obtained; wherein, the initial neural network model and the target neural network model are both black box models. It can be understood that in the data detection process, the corresponding black box model is first accessed as the initial neural network model through the hard label query. Hard label query means that input data can be submitted to the model and a clear classification label of the model output can be obtained. This initial neural network model is regarded as a black box when its internal structure and parameters are unknown, and can only be observed and analyzed through input and output. Then, the target neural network model obtained after the initial neural network model is trained with the target data training set is obtained. Similarly, this target neural network model also belongs to a black box model, and its internal specific training process and parameter adjustment are invisible to the external detection party. The target data training set may contain various types of data, which are used to optimize and adjust the initial neural network model to improve the performance of the model on a specific task. Whether it is the initial neural network model or the target neural network model, due to its black box nature, the detection party needs to use specific techniques and methods to infer whether the model is trained with specific user data.

[0069] Step S13: Input the target sample data into the initial neural network model and the target neural network model respectively, and use a boundary search algorithm to generate corresponding first sample data and second sample data respectively, and calculate the first adversarial perturbation difference between the first sample data and the target sample data, and the second adversarial perturbation difference between the second sample data and the target sample data respectively, so as to obtain the first adversarial perturbation output by the initial neural network model and the second adversarial perturbation output by the target neural network model.

[0070] In this embodiment, by generating target sample data and inputting it into the two models, observing the performance of special sample data under different model states, the data usage of the model is judged. It should be noted that by inputting the same target sample data into the two models respectively, the adversarial perturbations output by each model are obtained respectively. In this way, the target sample data is used to infer whether the model uses specific user data for training, and the key to membership inference is to compare the distance difference between the target sample data and the decision boundary under different model states. Adversarial perturbation can be used as an indicator to measure the distance between a data point and the decision boundary. Member data is usually far away from the decision boundary, and a larger adversarial perturbation is required to change its classification label; while non-member data is closer to the decision boundary, and a smaller adversarial perturbation can change its classification. Therefore, by outputting the adversarial perturbation of the target sample data in the model, the possibility of its membership can be directly reflected.

[0071] For black-box models, its internal parameters and decision-making process cannot be directly obtained. The behavior of the model can only be inferred by inputting data and observing the output results. Output adversarial perturbation is an indirect way to explore and analyze the decision boundary of the model without understanding the internal structure of the model. The target sample data is carefully designed, and its perturbation performance in the model can provide clues about how the model handles different data points, thereby helping to determine whether the model is trained using specific data.

[0072] By calculating the adversarial perturbations of special sample data in the untrained model and the trained model, and performing comparisons and statistical tests, conclusions can be drawn about the use of model data. If the two models output specific classification results, it is difficult to conduct effective statistical analysis and inference. The output perturbation can provide a quantifiable data basis for hypothesis testing and statistical analysis.

[0073] Step S14: Determine whether the target sample data belongs to the target data training set or does not belong to the target data training set according to a preset adversarial perturbation threshold, the first adversarial perturbation, and the second adversarial perturbation to obtain a corresponding data usage detection result.

[0074] In this embodiment, the method of determining whether the target sample data belongs to the target data training set or not according to the preset adversarial perturbation threshold, the first adversarial perturbation, and the second adversarial perturbation to obtain the corresponding data usage detection result also includes: selecting corresponding training data as non-member data from a data set orthogonal to the training task of the initial neural network model; determining a preset adversarial perturbation threshold according to the adversarial perturbation corresponding to each non-member data. It can be understood that statistical analysis is required to determine whether the model developer has used special sample data for training. The size of the adversarial perturbation can be used as a variable for statistical analysis. Therefore, in order to better perform statistical analysis, it is necessary to pre-set the corresponding preset adversarial perturbation threshold. For example, for the face image classification task, some animal images are randomly extracted from tasks orthogonal to it, such as the public ImageNet data set, as non-member data, and the top 10% of the adversarial perturbation of the non-member data is selected as the preset adversarial perturbation threshold. Based on the observation that the training member data is farther away from the decision boundary than the non-member data, and presents a larger adversarial perturbation, the adversarial perturbation of the black-box model on special samples is analyzed to clearly distinguish between member data and non-member data, thereby accurately detecting whether the model developers use user data to train the model.

[0075] In this embodiment, the magnitude relationship between the first adversarial perturbation of each target sample data and the preset adversarial perturbation threshold is judged respectively to obtain a first judgment result; the magnitude relationship between the second adversarial perturbation of each target sample data and the preset adversarial perturbation threshold is judged respectively to obtain a second judgment result; if the first judgment result is that the first adversarial perturbation of the target sample data is less than or equal to the preset adversarial perturbation threshold and the second judgment result is that the second adversarial perturbation of the same target sample data is less than or equal to the preset adversarial perturbation threshold; then the corresponding target sample data is judged to be non-member data that does not belong to the target data training set to obtain the corresponding data unused detection result. It can be understood that, in view of the limitations of black box models and limited computing resources, the traditional membership inference technology based on shadow models or fine-grained outputs is naturally excluded, and instead a membership inference technology based on adversarial perturbations is designed, and the size of adversarial perturbations is used as a measure of membership inference. That is, the larger the adversarial perturbation required for a sample to cross the decision boundary and change its label, the more likely it is to be a training member data. Furthermore, to ensure the reliability of the data usage detection results, a hypothesis testing method is used to calculate the confidence level of inferring special samples as non-members of the untrained model and members of the trained model. The special sample data is easy to fit. This special sample that only relies on the generated feedback of the model output category is more robust to the adaptive strategies on the model developer side (such as model distillation) because it does not rely on gradients that may weaken or disappear in various adaptive strategies. Therefore, the target sample data usage detection steps are as follows:

[0076] Determine the membership of special examples through adversarial perturbations presented by target examples, and provide a model that was not trained with special examples (Initial Neural Network Model) Define the Null Hypothesis and the alternative hypothesis :

[0077] ;

[0078] ;

[0079] in, is the conditional constraint of the initial neural network model, Represents sample data Output labels after inputting the initial neural network model, Represents sample data Add the first adversarial perturbation The output label after inputting the initial neural network model, represents the preset adversarial perturbation threshold, Represents sample data The membership indicator function of .

[0080] Similarly, for models trained using special sample data (Target neural network model) Define the null hypothesis and the alternative hypothesis :

[0081] ;

[0082] ;

[0083] in, is the conditional constraint of the target neural network model, Represents sample data The output label after inputting the target neural network model, Represents sample data Add the second adversarial perturbation The output label after inputting the target neural network model, Represents the preset adversarial perturbation threshold.

[0084] These assumptions are based on the size of the adversarial perturbation determined by the boundary search algorithm, and infer the membership of the target sample data during the model training process. Special examples of specially generated non-member data should present smaller adversarial perturbations. According to the null hypothesis , special examples in the untrained model It shows a large adversarial perturbation, does not meet the characteristics of being close to the decision boundary, easy to fit, and maintaining a small adversarial perturbation, so it cannot show obvious non-membership. In the null hypothesis This shows that special cases are still inferred to be non-members: , with smaller adversarial perturbations In contrast, the alternative hypothesis This shows that by showing a larger adversarial perturbation than non-members , the special examples are inferred as models Members: In fact, as Non-members and The special examples tend to keep the initial small adversarial perturbation, but show larger perturbations than non-members after training, which effectively reduces Value (under the null hypothesis The probability of rejecting the null hypothesis when it is actually true). Therefore, if the hypothesis test If the value is lower than the predefined significance level α, the null hypothesis can be rejected. , thereby inferring with high confidence that the model was indeed trained using user data. The data detector accesses the untrained black-box model through hard label queries , using m special examples , through the boundary search strategy, calculate the corresponding adversarial perturbation , and its Percentage of non-members:

[0085] ;

[0086] Similarly, the model trained on this data , calculate the adversarial perturbation of special sample data , determine the ratio of training members:

[0087] ;

[0088] Finally, the t-test was used to verify and The requirements determine whether the model developer uses these special samples to train the model, with a confidence level of 1-α. And form a theorem: the data detection party can reject the null hypothesis at a significance level α ,Require satisfy:

[0089] ;

[0090] Specifically, in the adversarial perturbation-based membership inference method, the membership inference of each special example is regarded as a binomial event with probability q. This means that the probability of each special example being inferred as a member follows the binomial distribution . Furthermore, the membership inference results of all special samples are regarded as the sample mean of a binomial distribution, that is: .

[0091] Combining the central limit theorem (when the sample size is large enough (usually more than 30), the sum (or mean) of these independent and identically distributed random variables, regardless of the shape of the original distribution, will be approximately normally distributed) and the unbiased variance of independent and identically distributed variables, considering that the degrees of freedom are m-1, The normal distribution of follows:

[0092] ;

[0093] Based on the t-test, it is straightforward to determine whether q is significantly different from the probability of randomly guessing that a particular sample is a member. To do this, construct the t-statistic:

[0094] ;

[0095] in, yes Once the T value exceeds the critical value of the t distribution corresponding to the significance level α ,Right now , we can reject the null hypothesis :

[0096] ;

[0097] The critical value corresponding to the significance level α can be obtained by consulting the t distribution table. If the value exceeds the threshold, the null hypothesis can be rejected directly at the significance level α. , and thus conclude that the model The data from the data detector is indeed used for training, and the confidence level is 1-α. Replace with ,Will Replace with , the data detection party can also calculate the corresponding significance level to determine the model Whether the data of the data detection party is not used.

[0098] The present invention only relies on hard-label access to the black-box model. The core idea is that the perturbation required to generate adversarial examples from member data is larger than that from non-member data, mainly because non-member samples that are not used for model training are closer to the decision boundary and are more susceptible to adversarial perturbations.

[0099] It can be seen that the present application discloses a data usage detection method for a neural network model training process, including: iteratively updating the original user data using a boundary search strategy to obtain corresponding target sample data; obtaining an initial neural network model and a target neural network model obtained after training the initial neural network model with a target data training set; inputting the target sample data into the initial neural network model and the target neural network model respectively, so as to generate corresponding first sample data and second sample data respectively using a boundary search algorithm, and respectively calculating a first adversarial perturbation difference between the first sample data and the target sample data, and a second adversarial perturbation difference between the second sample data and the target sample data, so as to obtain a first adversarial perturbation output by the initial neural network model and a second adversarial perturbation output by the target neural network model; determining whether the target sample data belongs to the target data training set or does not belong to the target data training set according to a preset adversarial perturbation threshold, the first adversarial perturbation, and the second adversarial perturbation, so as to obtain a corresponding data usage detection result. It can be seen that by designing a target sample data that is easy to fit, close to the model decision boundary, and maintains small disturbance, by generating target sample data and utilizing its performance difference in the initial model and the trained target model, the data usage of the model in the training process is inferred with high confidence, providing reliable data detection results. Since the generated target sample data maintains a high degree of semantic consistency and visual similarity with the original user data, it avoids introducing any abnormal patterns or significant noise, so that the target sample data can pass visual inspection and anomaly detection; by comparing the adversarial perturbation size required for special samples under different model states, its membership can be judged more accurately, and special sample data is generated through a carefully designed boundary search strategy, so that it can play an effective role in various scenarios, is robust to various adaptive strategies and complex scenarios, and can be widely used and deployed in various application scenarios that require detection of data usage.

[0100] Reference Figure 3 As shown, the embodiment of the present invention discloses a method for obtaining a first adversarial perturbation of an initial network model. Compared with the previous embodiment, this embodiment further illustrates and optimizes the technical solution. Specifically:

[0101] Step S1311: Select a preset number of target sample data.

[0102] In this embodiment, the data detection party accesses the untrained black box model through hard label query, using m special examples As target sample data, these target sample data will be used to detect the behavior of the untrained initial neural network model.

[0103] Step S1312: Input each of the target sample data into the initial neural network model, and predict the corresponding data classification label through the initial neural network model to obtain a first data classification label.

[0104] In this embodiment, each target sample data is input into the initial neural network model one by one. At this time, the model will predict each target sample data and output the corresponding data classification label, which is recorded as the first data classification label.

[0105] Step S1313: Add a corresponding first data disturbance to the target sample data to obtain the first sample data as new target sample data, and input the new target sample data into the initial neural network model, and predict the corresponding data classification label through the initial neural network model to obtain a second data classification label.

[0106] In this embodiment, a corresponding first data disturbance is added to the target sample data. The purpose of this disturbance is to try to change the characteristics of the target sample data so that its classification result in the model may change. After adding the disturbance, the first sample data is obtained as the new target sample data. The new target sample data is input into the initial neural network model again, and the model will predict the corresponding new data classification label, that is, the second data classification label. Among them, for each target sample data, try to add different degrees of disturbance (first data disturbance) to observe the label changes output by the model. Specifically, you can start with a smaller disturbance and gradually increase the amplitude of the disturbance until the model changes the classification label of the same target sample data.

[0107] Step S1314: Determine whether the second data classification label is consistent with the first data classification label.

[0108] In this embodiment, it is determined whether the second data classification label is consistent with the first data classification label.

[0109] Step S1315: If the labels are consistent, jump to the step of adding the corresponding first data perturbation to the target sample data to obtain new target sample data, until the minimum data perturbation corresponding to the inconsistent labels is obtained as the first adversarial perturbation output by the initial neural network model.

[0110] In this embodiment, if the labels are consistent, it means that the current disturbance is not enough to change the model's classification of the target sample data. At this time, jump back to the step of adding the corresponding first data disturbance to the target sample data, continue to increase the disturbance to obtain new target sample data, and repeat the above process. Repeat this process until the minimum data disturbance corresponding to when the second data classification label is inconsistent with the first data classification label is obtained. Among them, the minimum data disturbance is the first adversarial disturbance difference obtained by subtracting the initial target sample data from the current target sample data (first sample data) corresponding to the data classification label change. This minimum data disturbance is the first adversarial disturbance output by the initial neural network model. In this way, the minimum disturbance that changes the classification of the target sample data by the untrained initial neural network model can be gradually approached, thereby providing an important basis for subsequent judgment of whether the model uses specific data for training.

[0111] It can be seen that by gradually adding disturbances and observing the changes in the model classification labels, the sensitivity of the initial neural network model to different data can be accurately determined. Understanding the model's response to data disturbances in the untrained state will help the subsequent analysis of the model's changes after training. Being able to find the minimum data disturbance that changes the model classification provides a specific indicator for measuring the stability and robustness of the model. Moreover, for black box models, it is impossible to directly understand their internal structure and parameters. This method can effectively explore the behavior and characteristics of the model without understanding the internal details of the model by inputting data and observing the output results. There is no need to modify or access the model internally, and it is also applicable to various types of neural network models, with strong versatility.

[0112] Reference Figure 4 As shown, the present invention specifically discloses a method for obtaining a second adversarial perturbation of a target neural network model, comprising:

[0113] Step S1321: Input each of the target sample data into the target neural network model, and predict the corresponding data classification label through the target neural network model to obtain a third data classification label.

[0114] In this embodiment, the target sample data previously input into the initial neural network model is input into the target neural network model again, and the target neural network model outputs the predicted data classification label as the third data classification label. In this way, the initial classification of the target sample data by the trained model is understood, which provides a benchmark for the subsequent analysis of changes after disturbance.

[0115] Step S1322: Add a corresponding second data disturbance to the target sample data to obtain the second sample data as new target sample data, and input the new target sample data into the target neural network model, and predict the corresponding data classification label through the target neural network model to obtain a fourth data classification label.

[0116] In this embodiment, the corresponding second data perturbation is added to the target sample data to obtain new target sample data. The new target sample data is then input into the target neural network model again, and the model predicts the corresponding new data classification label, i.e., the fourth data classification label. In this way, by adding perturbations, the response of the trained model to data with different degrees of change can be observed, and the changes in the stability and robustness of the model after training can be explored.

[0117] Step S1323: Determine whether the fourth data classification label is consistent with the third data classification label.

[0118] In this embodiment, it is determined whether the fourth data classification label is consistent with the third data classification label. In this way, it is determined whether the current disturbance is sufficient to change the classification of the target sample data by the trained model, thereby gradually approaching the critical disturbance degree that causes the classification to change.

[0119] Step S1324: If the labels are consistent, jump to the step of adding the corresponding second data perturbation to the target sample data to obtain the second sample data as the new target sample data, until the minimum data perturbation corresponding to the inconsistent labels is obtained as the second adversarial perturbation output by the target neural network model. The minimum data perturbation is the second adversarial perturbation difference obtained by subtracting the initial target sample data from the current target sample data (second sample data) corresponding to the data classification label change.

[0120] In this embodiment, if the labels are consistent, the process jumps back to the step of adding the corresponding second data perturbation to the target sample data, continues to increase the perturbation, and repeats the above process until the minimum data perturbation corresponding to the inconsistent labels is obtained, which is used as the second adversarial perturbation output by the target neural network model. In this way, through continuous iteration, the minimum perturbation that changes the classification of the trained model is found, providing accurate data for subsequent comparison with the untrained model.

[0121] It can be seen that the second adversarial perturbation obtained is used as an important basis for judging whether the model is trained with specific data by comparing the adversarial perturbations output by the two models to infer whether the model has learned the original user data. This provides an effective method for detecting whether model developers use user data for training without authorization. By comparing the differences in the responses of the untrained model and the trained model to the same data perturbation, the data usage of the model can be judged with a high degree of confidence.

[0122] Reference Figure 5 As shown, the present invention also discloses a data usage detection device for a neural network model training process, including:

[0123] The sample acquisition module 11 is used to iteratively update the original user data using a boundary search strategy to obtain corresponding target sample data;

[0124] A model acquisition module 12, used to acquire an initial neural network model and a target neural network model obtained after training the initial neural network model with a target data training set;

[0125] A detection module 13 is used to input the target sample data into the initial neural network model and the target neural network model respectively, so as to generate corresponding first sample data and second sample data respectively by adopting a boundary search algorithm, and to calculate a first adversarial perturbation difference between the first sample data and the target sample data, and a second adversarial perturbation difference between the second sample data and the target sample data respectively, so as to obtain a first adversarial perturbation output by the initial neural network model and a second adversarial perturbation output by the target neural network model;

[0126] The result acquisition module 14 is used to determine whether the target sample data belongs to the target data training set or does not belong to the target data training set according to a preset adversarial perturbation threshold, the first adversarial perturbation, and the second adversarial perturbation, so as to obtain a corresponding data usage detection result.

[0127] It can be seen that the present application discloses iteratively updating the original user data using a boundary search strategy to obtain corresponding target sample data; obtaining an initial neural network model and a target neural network model obtained after training the initial neural network model with a target data training set; inputting the target sample data into the initial neural network model and the target neural network model, respectively, to generate corresponding first sample data and second sample data respectively using a boundary search algorithm, and respectively calculating a first adversarial perturbation difference between the first sample data and the target sample data, and a second adversarial perturbation difference between the second sample data and the target sample data, to obtain a first adversarial perturbation output by the initial neural network model and a second adversarial perturbation output by the target neural network model; determining whether the target sample data belongs to the target data training set or does not belong to the target data training set according to a preset adversarial perturbation threshold, the first adversarial perturbation, and the second adversarial perturbation, to obtain a corresponding data usage detection result. It can be seen that by designing a target sample data that is easy to fit, close to the model decision boundary, and maintains small disturbance, by generating target sample data and utilizing its performance difference in the initial model and the trained target model, the data usage of the model in the training process is inferred with high confidence, providing reliable data detection results. Since the generated target sample data maintains a high degree of semantic consistency and visual similarity with the original user data, it avoids introducing any abnormal patterns or significant noise, so that the target sample data can pass visual inspection and anomaly detection; by comparing the adversarial perturbation size required for special samples under different model states, its membership can be judged more accurately, and special sample data is generated through a carefully designed boundary search strategy, so that it can play an effective role in various scenarios, is robust to various adaptive strategies and complex scenarios, and can be widely used and deployed in various application scenarios that require detection of data usage.

[0128] Furthermore, the present application also discloses an electronic device. Figure 6 This is a structural diagram of an electronic device 20 according to an exemplary embodiment. The content in the diagram cannot be regarded as any limitation on the scope of use of the present application.

[0129] Figure 6 A schematic diagram of the structure of an electronic device 20 provided in an embodiment of the present application. The electronic device 20 may specifically include: at least one processor 21, at least one memory 22, a power supply 23, a communication interface 24, an input / output interface 25, and a communication bus 26. The memory 22 is used to store a computer program, which is loaded and executed by the processor 21 to implement the relevant steps in the data usage detection method of the neural network model training process disclosed in any of the aforementioned embodiments. In addition, the electronic device 20 in this embodiment may specifically be an electronic computer.

[0130] In this embodiment, the power supply 23 is used to provide working voltage for each hardware device on the electronic device 20; the communication interface 24 can create a data transmission channel between the electronic device 20 and the external device, and the communication protocol it follows is any communication protocol that can be applied to the technical solution of the present application, and is not specifically limited here; the input and output interface 25 is used to obtain external input data or output data to the outside world, and its specific interface type can be selected according to specific application needs and is not specifically limited here.

[0131] Among them, the processor 21 may include one or more processing cores, such as a 4-core processor, an 8-core processor, etc. The processor 21 can be implemented in at least one hardware form of DSP (Digital Signal Processing), FPGA (Field-Programmable Gate Array), and PLA (Programmable Logic Array). The processor 21 may also include a main processor and a coprocessor. The main processor is a processor for processing data in the awake state, also known as a CPU (Central Processing Unit); the coprocessor is a low-power processor for processing data in the standby state. In some embodiments, the processor 21 may be integrated with a GPU (Graphics Processing Unit), which is responsible for rendering and drawing the content to be displayed on the display screen. In some embodiments, the processor 21 may also include an AI (Artificial Intelligence) processor, which is used to process computing operations related to machine learning.

[0132] In addition, the memory 22, as a carrier for storing resources, can be a read-only memory, a random access memory, a disk or an optical disk, etc. The resources stored thereon can include an operating system 221, a computer program 222, etc., and the storage method can be temporary storage or permanent storage.

[0133] Among them, the operating system 221 is used to manage and control the hardware devices and computer programs 222 on the electronic device 20, so as to realize the operation and processing of the massive data 223 in the memory 22 by the processor 21, which can be Windows Server, Netware, Unix, Linux, etc. In addition to including a computer program that can be used to complete the data usage detection method of the neural network model training process performed by the electronic device 20 disclosed in any of the aforementioned embodiments, the computer program 222 can further include a computer program that can be used to complete other specific tasks. In addition to data received by the electronic device and transmitted from an external device, the data 223 can also include data collected by its own input and output interface 25, etc.

[0134] Furthermore, the present application also discloses a computer-readable storage medium for storing a computer program; wherein, when the computer program is executed by a processor, the data usage detection method for the neural network model training process disclosed above is implemented. The specific steps of the method can refer to the corresponding contents disclosed in the above embodiments, and will not be repeated here.

[0135] In this specification, each embodiment is described in a progressive manner, and each embodiment focuses on the differences from other embodiments. The same or similar parts between the embodiments can be referred to each other. For the device disclosed in the embodiment, since it corresponds to the method disclosed in the embodiment, the description is relatively simple, and the relevant parts can be referred to the method part.

[0136] Professionals may further appreciate that the units and algorithm steps of each example described in conjunction with the embodiments disclosed herein can be implemented with electronic hardware, computer software, or a combination of the two. In order to clearly illustrate the interchangeability of hardware and software, the composition and steps of each example have been generally described in terms of function in the above description. Whether these functions are performed in hardware or software depends on the specific application and design constraints of the technical solution. Professional and technical personnel may use different methods to implement the described functions for each specific application, but such implementation should not be considered to be beyond the scope of this application. The steps of the method or algorithm described in conjunction with the embodiments disclosed herein can be implemented directly with hardware, a software module executed by a processor, or a combination of the two. The software module can be placed in a random access memory RAM (Random Access Memory), memory, read-only memory ROM (Read Only Memory), electrically programmable EPROM (Electrically Programmable Read Only Memory), electrically erasable programmable EEPROM (ElectricErasable Programmable Read Only Memory), register, hard disk, removable disk, CD-ROM (CompactDisc-Read Only Memory), or any other form of storage medium known in the technical field.

[0137] Finally, it should be noted that, in this article, relational terms such as first and second, etc. are only used to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Moreover, the terms "include", "comprise" or any other variants thereof are intended to cover non-exclusive inclusion, so that a process, method, article or device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, article or device. In the absence of further restrictions, the elements defined by the sentence "comprise a ..." do not exclude the presence of other identical elements in the process, method, article or device including the elements.

[0138] The scheme provided by the present invention is introduced in detail above. Specific examples are used in this article to illustrate the principle and implementation mode of the present invention. The description of the above embodiments is only used to help understand the method of the present invention and its core idea. At the same time, for those skilled in the art, according to the idea of ​​the present invention, there will be changes in the specific implementation mode and application scope. In summary, the content of this specification should not be understood as limiting the present invention.

Claims

1. A data usage detection method for a neural network model training process, characterized in that: include: The original user data is iteratively updated using the boundary search strategy to obtain the corresponding target sample data; Acquire an initial neural network model and a target neural network model obtained after training the initial neural network model with a target data training set; Inputting the target sample data into the initial neural network model and the target neural network model respectively, so as to generate corresponding first sample data and second sample data respectively by adopting a boundary search algorithm, and respectively calculating a first adversarial perturbation difference between the first sample data and the target sample data, and a second adversarial perturbation difference between the second sample data and the target sample data, so as to obtain a first adversarial perturbation output by the initial neural network model and a second adversarial perturbation output by the target neural network model; According to the preset adversarial perturbation threshold, the first adversarial perturbation, and the second adversarial perturbation, it is determined whether the target sample data belongs to the target data training set or does not belong to the target data training set to obtain a corresponding data usage detection result.

2. The data usage detection method for the neural network model training process according to claim 1, characterized in that: The iterative updating of the original user data using the boundary search strategy to obtain the corresponding target sample data includes: Performing disturbance adding processing on the original user data to generate adversarial user data samples with noise; Determine whether the current number of iterations of the current adversarial user data sample meets the preset number of iterations condition; If satisfied, stop updating and use the current adversarial user data sample as the target sample data; If not, a normal perturbation required for the next update iteration is generated, and the normal perturbation is projected onto a sphere surrounding the original user data according to the rationality and adversarial constraints to obtain a process adversarial user data sample; Control the process adversarial user data sample to move the target relative step length toward the original user data direction according to the preset step length constraint condition, so as to obtain the updated current adversarial user data sample and update the current number of iterations; Jump to the step of determining whether the current number of iterations of the current adversarial user data sample meets the preset number of iterations condition until the current number of iterations meets the preset number of iterations condition.

3. The data usage detection method for the neural network model training process according to claim 1 is characterized in that: The obtaining of the initial neural network model and the target neural network model obtained after training the initial neural network model with the target data training set comprises: Access the corresponding black box model as the initial neural network model according to the hard label query, and obtain the target neural network model obtained after the initial neural network model is trained with the target data training set; wherein the initial neural network model and the target neural network model are both black box models.

4. The data usage detection method for the neural network model training process according to claim 1 is characterized in that: Inputting the target sample data into the initial neural network model to generate corresponding first sample data using a boundary search algorithm, and calculating the adversarial perturbation difference between the first sample data and the target sample data to obtain a first adversarial perturbation output by the initial neural network model, including: Select a preset number of target sample data; Inputting each of the target sample data into the initial neural network model, and predicting the corresponding data classification label through the initial neural network model to obtain a first data classification label; Adding a corresponding first data disturbance to the target sample data to obtain the first sample data as new target sample data, and inputting the new target sample data into the initial neural network model, and predicting the corresponding data classification label through the initial neural network model to obtain a second data classification label; Determining whether the second data classification label is consistent with the first data classification label; If the labels are consistent, jump to the step of adding the corresponding first data perturbation to the target sample data to obtain the first sample data as the new target sample data, until the minimum data perturbation corresponding to the inconsistent labels is obtained as the first adversarial perturbation output by the initial neural network model.

5. The data usage detection method for the neural network model training process according to claim 4 is characterized in that: Inputting the target sample data into the target neural network model to generate corresponding second sample data using a boundary search algorithm, and calculating the adversarial perturbation difference between the second sample data and the target sample data to obtain a second adversarial perturbation output by the target neural network model, including: Inputting each of the target sample data into the target neural network model, and predicting the corresponding data classification label through the target neural network model to obtain a third data classification label; Adding a corresponding second data disturbance to the target sample data to obtain the second sample data as new target sample data, and inputting the new target sample data into the target neural network model, and predicting the corresponding data classification label through the target neural network model to obtain a fourth data classification label; Determining whether the fourth data classification label is consistent with the third data classification label; If the labels are consistent, jump to the step of adding the corresponding second data perturbation to the target sample data to obtain the second sample data as the new target sample data, until the minimum data perturbation corresponding to the inconsistent labels is obtained as the second adversarial perturbation output by the target neural network model.

6. The data usage detection method for the neural network model training process according to claim 1, characterized in that: The determining, according to the preset adversarial perturbation threshold, the first adversarial perturbation, and the second adversarial perturbation, whether the target sample data belongs to the target data training set or does not belong to the target data training set to obtain a corresponding data usage detection result includes: Respectively determining the magnitude relationship between the first adversarial perturbation of each target sample data and a preset adversarial perturbation threshold to obtain a first determination result; Respectively determining the magnitude relationship between the second adversarial perturbation of each target sample data and a preset adversarial perturbation threshold to obtain a second determination result; If the first judgment result is that the first adversarial perturbation of the target sample data is less than or equal to the preset adversarial perturbation threshold and the second judgment result is that the second adversarial perturbation of the same target sample data is less than or equal to the preset adversarial perturbation threshold; then the corresponding target sample data is determined to be non-member data that does not belong to the target data training set, so as to obtain the corresponding data unused detection result.

7. The data usage detection method for the neural network model training process according to any one of claims 1 to 6, characterized in that: Before determining whether the target sample data belongs to the target data training set or does not belong to the target data training set according to the preset adversarial perturbation threshold, the first adversarial perturbation, and the second adversarial perturbation to obtain the corresponding data usage detection result, the method further includes: Select corresponding training data from a data set orthogonal to the training task of the initial neural network model as non-member data; A preset adversarial disturbance threshold is determined according to the adversarial disturbance corresponding to each of the non-member data.

8. A data usage detection device for a neural network model training process, characterized in that: include: The sample acquisition module is used to iteratively update the original user data using the boundary search strategy to obtain the corresponding target sample data; A model acquisition module, used to acquire an initial neural network model and a target neural network model obtained after training the initial neural network model with a target data training set; A detection module, used to input the target sample data into the initial neural network model and the target neural network model respectively, so as to respectively generate corresponding first sample data and second sample data by adopting a boundary search algorithm, and respectively calculate a first adversarial perturbation difference between the first sample data and the target sample data, and a second adversarial perturbation difference between the second sample data and the target sample data, so as to obtain a first adversarial perturbation output by the initial neural network model and a second adversarial perturbation output by the target neural network model; A result acquisition module is used to determine whether the target sample data belongs to the target data training set or does not belong to the target data training set according to a preset adversarial perturbation threshold, the first adversarial perturbation, and the second adversarial perturbation, so as to obtain a corresponding data usage detection result.

9. An electronic device, characterized in that: include: Memory, used to store computer programs; A processor, configured to execute the computer program to implement the steps of the data usage detection method for the neural network model training process as described in any one of claims 1 to 7.

10. A computer-readable storage medium, characterized in that: Used to store computer programs; wherein, when the computer program is executed by a processor, the steps of the data usage detection method for the neural network model training process as described in any one of claims 1 to 7 are implemented.

Images