Self-adaptive model stealing defense method based on generative adversarial network

Abstract

The embodiment of the invention provides an adaptive model stealing defense method based on a generative adversarial network, and belongs to the technical field of data processing, and the method specifically comprises the steps: training a feature extractor of a classification model M through employing a comparative learning method; performing supervised learning to train the classification network; constructing a generative adversarial network, receiving a query sample x by using a generator in the generative adversarial network, generating a forged similar sample x ', respectively inputting the query sample x and the similar sample x' into a discriminator to obtain a label and confidence, and updating the generator and the discriminator by using a back propagation algorithm; the feature extractor network and the updated generator form a protection module, the real-time query data generates similar samples through the protection module, the similar samples give prediction labels and confidence coefficients through a to-be-protected model, and the prediction labels and the confidence coefficients are returned to a user according to the classification result of the classification network on the real-time query data. Through the scheme disclosed by the invention, the safety and adaptability of the model are improved.

Description

Technical Field

[0001] The disclosed embodiments relate to the field of data processing technology, and in particular to an adaptive model stealing defense method based on a generative adversarial network. Background Art

[0002] At present, as machine learning and deep learning have been studied in depth and have achieved remarkable success in many application fields, machine learning applications are becoming more and more common. As a promising service, machine learning as a service (MLaaS) provides personalized reasoning capabilities to customers through paid APIs. However, it is vulnerable to model extraction attacks, which are black-box attacks on models deployed on the machine learning as a service (MLaaS) platform, attempting to reconstruct alternative models with similar functions to the target model through prediction APIs. Usually, attackers need to make carefully prepared samples (synthetic samples, adversarial samples, proxy samples) to iteratively query the target model to obtain the returned results and then train their own models. In the existing defense detection methods, detection based on query distribution is invalid because the proxy sample distribution conforms to the Gaussian distribution and involves multiple colluding malicious users, making its synthetic samples irrelevant (i.e., as a natural data distribution). For adversarial confidence perturbations to hide different confidence distributions given different queries, although the confidence differences corresponding to different queries are small, thereby reducing the information leakage of the target model, it does not change the prediction labels corresponding to different queries, so it is not effective for model stealing that only requires prediction labels. Therefore, although many works have been proposed to defend against model extraction attacks, the existing works are limited and less comprehensive.

[0003] It can be seen that there is an urgent need for an adaptive model theft defense method based on generative adversarial networks with high security and adaptability. Summary of the invention

[0004] In view of this, an embodiment of the present disclosure provides an adaptive model theft defense method based on a generative adversarial network, which at least partially solves the problems of poor security and adaptability in the prior art.

[0005] The present disclosure provides an adaptive model stealing defense method based on a generative adversarial network, including:

[0006] Step 1: Use contrastive learning to train the feature extractor of the classification model M, and obtain the network parameters of the feature extractor through training with positive and negative sample data;

[0007] Step 2: Perform supervised learning to train the classification network according to the feature extractor network parameters to obtain a trained classification model M;

[0008] Step 3: construct a generative adversarial network, use the generator in the generative adversarial network to receive the query sample x, and generate a forged similar sample x', input the query sample x and the similar sample x' into the discriminator to obtain the label and confidence, and use the back-propagation algorithm to update the generator and discriminator;

[0009] Step 4: The feature extractor network and the updated generator form a protection module. The real-time query data generates similar samples through the protection module. The similar samples are given predicted labels and confidences through the protected model, and the predicted labels and confidences are returned to the user based on the classification results of the real-time query data by the classification network.

[0010] According to a specific implementation of an embodiment of the present disclosure, the feature extraction network includes an encoder and a multi-layer perceptron.

[0011] According to a specific implementation of the embodiment of the present disclosure, step 1 specifically includes:

[0012] Step 1.1: Construct a normal query dataset and an abnormal query dataset, set N samples for each training batch, and extract samples, perform different data enhancements on N samples to obtain positive sample pairs, and use them and other images and their enhancements as negative samples to form a positive and negative sample data set;

[0013] Step 1.2, input the positive and negative sample data sets into the encoder to extract features, obtain feature representation, obtain feature vectors through a multi-layer perceptron, and calculate whether the maximum consistency between the feature vectors is achieved according to the first loss function, wherein the expression of the first loss function is:

[0014]

[0015] Among them I [k≠i] ∈{0,1} is an indicator function, sim(·,·) represents the cosine similarity, and η is the temperature parameter;

[0016] Step 1.3, obtain the parameters of the feature extractor network through multiple batches of training, and freeze its parameters to perform the classification task of downstream query sample types.

[0017] According to a specific implementation of the embodiment of the present disclosure, step 2 specifically includes:

[0018] The classification network parameters are trained according to the feature extractor network parameters, the query sample x is the label data, and the classification result is evaluated by the second loss function until it meets the requirements, wherein the second loss function expression is:

[0019]

[0020] Among them, M c is the score corresponding to the correct category of the model, M i is the model's score for each category.

[0021] According to a specific implementation of the embodiment of the present disclosure, step 3 specifically includes:

[0022] Step 3.1: The generator receives the feature F of the query sample x x , and generate a forged similar sample x', and calculate the third loss function between the query sample x and the similar sample x', wherein the third loss function is:

[0023]

[0024] Where D is the discriminator, G is the generator, x is the input query, T is the query sample determination category, T∈{0,1}, when T=1, it is a malicious query sample, and the generated sample x' is as dissimilar to x as possible. When T=0, it is a normal query sample, and the generated sample x' is as similar to x as possible. G(F x ) is the output of the generator, D(G(F x )) is the predicted probability of the discriminator for the generator output;

[0025] Step 3.2: The discriminator calculates the similarity between the query sample x and the similar sample x', and accordingly obtains the fourth loss function corresponding to the discriminator, wherein the fourth loss function is:

[0026]

[0027] Among them, P max (x) is the confidence value of the category with the largest confidence in x, P' max (x') is the confidence value of the category with the largest confidence in x';

[0028] Step 3.3, use the back-propagation algorithm to iterate steps 3.1 and 3.2 to update the weights of the generator and discriminator until the requirements are met.

[0029] The adaptive model stealing defense scheme based on generative adversarial network in the disclosed embodiment includes: step 1, using contrastive learning method to train the feature extractor of classification model M, and obtaining the network parameters of feature extractor through training with positive sample and negative sample data; step 2, according to the network parameters of feature extractor, supervised learning is performed to train the classification network to obtain the trained classification model M; step 3, constructing a generative adversarial network, using the generator in the generative adversarial network to receive the query sample x, and generate a forged similar sample x', respectively inputting the query sample x and the similar sample x' into the discriminator to obtain the label and confidence, and using the back propagation algorithm to update the generator and the discriminator; step 4, the feature extractor network and the updated generator constitute a protection module, the real-time query data generates similar samples through the protection module, the similar samples are given predicted labels and confidences through the model to be protected, and the predicted labels and confidences are returned to the user according to the classification results of the real-time query data by the classification network.

[0030] The beneficial effects of the disclosed embodiments are as follows: through the disclosed solution, the feature extractor is trained by contrastive learning, and the classification network is trained by supervised learning, and finally the classification model M is obtained; similar samples obtained by generating adversarial networks are used to confuse the confidence values ​​obtained by query samples from the protected model. Predictive perturbations are performed on malicious query samples, which not only achieves the role of model defense, but also ensures the effectiveness of the model, and improves security and adaptability. BRIEF DESCRIPTION OF THE DRAWINGS

[0031] In order to more clearly illustrate the technical solutions of the embodiments of the present disclosure, the drawings required for use in the embodiments will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present disclosure. For ordinary technicians in this field, other drawings can be obtained based on these drawings without creative work.

[0032] Figure 1 A flowchart of an adaptive model stealing defense method based on a generative adversarial network provided in an embodiment of the present disclosure;

[0033] Figure 2 A schematic diagram of a generative adversarial network training process provided in an embodiment of the present disclosure;

[0034] Figure 3 A schematic diagram of the theft defense process of an adaptive model theft defense method based on a generative adversarial network provided in an embodiment of the present disclosure. DETAILED DESCRIPTION

[0035] The embodiments of the present disclosure are described in detail below with reference to the accompanying drawings.

[0036] The following describes the embodiments of the present disclosure through specific examples, and those skilled in the art can easily understand other advantages and effects of the present disclosure from the contents disclosed in this specification. Obviously, the described embodiments are only a part of the embodiments of the present disclosure, rather than all of the embodiments. The present disclosure can also be implemented or applied through other different specific embodiments, and the details in this specification can also be modified or changed in various ways based on different viewpoints and applications without departing from the spirit of the present disclosure. It should be noted that the following embodiments and features in the embodiments can be combined with each other without conflict. Based on the embodiments in the present disclosure, all other embodiments obtained by ordinary technicians in the field without making creative work are within the scope of protection of the present disclosure.

[0037] It should be noted that various aspects of the embodiments within the scope of the appended claims are described below. It should be apparent that the aspects described herein may be embodied in a wide variety of forms, and any specific structure and / or function described herein is merely illustrative. Based on the present disclosure, it should be understood by those skilled in the art that an aspect described herein may be implemented independently of any other aspect, and two or more of these aspects may be combined in various ways. For example, any number of aspects described herein may be used to implement the device and / or practice the method. In addition, other structures and / or functionalities other than one or more of the aspects described herein may be used to implement this device and / or practice this method.

[0038] It should also be noted that the illustrations provided in the following embodiments are only schematic illustrations of the basic concept of the present disclosure. The drawings only show components related to the present disclosure rather than being drawn according to the number, shape and size of components in actual implementation. In actual implementation, the type, quantity and proportion of each component may be changed arbitrarily, and the component layout may also be more complicated.

[0039] Additionally, in the following description, specific details are provided to facilitate a thorough understanding of the examples. However, it will be understood by those skilled in the art that the aspects described may be practiced without these specific details.

[0040] The embodiment of the present disclosure provides an adaptive model theft defense method based on a generative adversarial network, which can be applied to network defense processes in Internet scenarios.

[0041] See also Figure 1 , is a flow chart of an adaptive model stealing defense method based on a generative adversarial network provided by an embodiment of the present disclosure. Figure 1 As shown, the method mainly comprises the following steps:

[0042] Step 1: Use contrastive learning to train the feature extractor of the classification model M, and obtain the network parameters of the feature extractor through training with positive and negative sample data;

[0043] Furthermore, the feature extraction network includes an encoder and a multi-layer perceptron.

[0044] Furthermore, the step 1 specifically includes:

[0045] Step 1.1: Construct a normal query dataset and an abnormal query dataset, set N samples for each training batch, and extract samples, perform different data enhancements on N samples to obtain positive sample pairs, and use them and other images and their enhancements as negative samples to form a positive and negative sample data set;

[0046] Step 1.2, input the positive and negative sample data sets into the encoder to extract features, obtain feature representation, obtain feature vectors through a multi-layer perceptron, and calculate whether the maximum consistency between the feature vectors is achieved according to the first loss function, wherein the expression of the first loss function is:

[0047]

[0048] Among them I [k≠i] ∈{0,1} is an indicator function, sim(·,·) represents the cosine similarity, and η is the temperature parameter;

[0049] Step 1.3, obtain the parameters of the feature extractor network through multiple batches of training, and freeze its parameters to perform the classification task of downstream query sample types.

[0050] In specific implementation, the contrastive learning method is used to train the feature extractor of the classification model M. The parameters of the feature extractor network are obtained through a large amount of unlabeled data training, and the downstream query sample classification task is performed on this basis. The specific process can be shown as follows:

[0051] 1.1 Constructing training positive and negative sample data sets

[0052] First, construct a normal query dataset (training data) and an abnormal query dataset (such as synthetic samples, adversarial samples, and proxy samples). Set N samples per batch for training, and extract samples from the normal query dataset and the abnormal query dataset. Samples, perform different data enhancements (such as flipping, cropping, grayscale, etc.) on these N images to obtain positive sample pairs for comparative learning training. The same image with different data enhancements is a positive sample, and it and other images and their enhancements are all negative samples.

[0053] 1.2 Contrastive Learning Training

[0054] The features are extracted through an encoder (such as a residual network (ResNet)) to obtain feature representation, and then passed through a multi-layer perceptron (MLP) to obtain feature vectors. The maximum consistency between feature vectors is calculated. The loss function is as follows:

[0055]

[0056] Among them I [k≠i] ∈{0,1} is an indicator function, sim(·,·) represents the cosine similarity, and η is the temperature parameter.

[0057] 1.3 The parameters of the feature extractor network are obtained through multiple batches of training, and its parameters are frozen to perform downstream classification tasks.

[0058] Step 2: Perform supervised learning to train the classification network according to the feature extractor network parameters to obtain a trained classification model M;

[0059] Based on the above embodiment, step 2 specifically includes:

[0060] The classification network parameters are trained according to the feature extractor network parameters, the query sample x is the label data, and the classification result is evaluated by the second loss function until it meets the requirements, wherein the second loss function expression is:

[0061]

[0062] Among them, M c is the score corresponding to the correct category of the model, M i is the model's score for each category.

[0063] In the specific implementation, the feature extractor network parameters are obtained according to step 1, and the classification network is trained through supervised learning, and finally the classification model M is obtained, so that it can perform binary classification on the query samples, that is, determine whether the image is a normal query or a malicious query.

[0064] The classification network is obtained through supervised training. The above query x is input into the classification model, the feature extractor (ResNet) network parameters are frozen, and the classification network parameters are trained. The query x is the label data. The classification result is evaluated using the loss function:

[0065]

[0066] Among them, M c is the score corresponding to the correct category of the model, M i is the model's score for each category.

[0067] Step 3: construct a generative adversarial network, use the generator in the generative adversarial network to receive the query sample x, and generate a forged similar sample x', input the query sample x and the similar sample x' into the discriminator to obtain the label and confidence, and use the back-propagation algorithm to update the generator and discriminator;

[0068] Based on the above embodiment, step 3 specifically includes:

[0069] Step 3.1: The generator receives the feature F of the query sample x x , and generate a forged similar sample x', and calculate the third loss function between the query sample x and the similar sample x', wherein the third loss function is:

[0070]

[0071] Where D is the discriminator, G is the generator, x is the input query, T is the query sample determination category, T∈{0,1}, when T=1, it is a malicious query sample, and the generated sample x' is as dissimilar to x as possible. When T=0, it is a normal query sample, and the generated sample x' is as similar to x as possible. G(F x ) is the output of the generator, D(G(F x )) is the predicted probability of the discriminator for the generator output;

[0072] Step 3.2: The discriminator calculates the similarity between the query sample x and the similar sample x', and accordingly obtains the fourth loss function corresponding to the discriminator, wherein the fourth loss function is:

[0073]

[0074] Among them, P max (x) is the confidence value of the category with the largest confidence in x, P' max (x') is the confidence value of the category with the largest confidence in x';

[0075] Step 3.3, use the back-propagation algorithm to iterate steps 3.1 and 3.2 to update the weights of the generator and discriminator until the requirements are met.

[0076] In the specific implementation, a generative adversarial network is used, that is, according to the current query sample x, the corresponding generated sample x' is obtained. Figure 2 As shown, the specific process can be as follows:

[0077] 3.1 Building a Generative Adversarial Network

[0078] 3.2 Generator generates samples

[0079] The generator receives the features F of the query input x x, generates a fake sample output x', the loss of the generator is designed to deceive the discriminator so that it cannot distinguish the fake samples, and its loss function is as follows:

[0080] L G =-E[D(G(F x ,T))]

[0081] Among them, D is the discriminator, G is the generator, x is the input query, T is the query sample judgment category, G(F x ) is the output of the generator, D(G(F x )) is the predicted probability of the discriminator for the generator output.

[0082] 3.3 Discriminator Evaluation Samples

[0083] For x and x', the discriminator aims to determine the similarity between the two, while ensuring that the predicted labels of the generated samples x' and x remain unchanged and the difference in the predicted confidence values ​​is minimal.

[0084]

[0085] Among them, P max (x) is the confidence value of the category with the largest confidence in x, P' max (x') is the confidence value of the category with the largest confidence of x', and T is the category determined by the query sample. T∈{0,1}, when T=1, it is a malicious query sample, and the generated sample x' is as dissimilar to x as possible; when T=0, it is a normal query sample, and the generated sample x' is as similar to x as possible.

[0086] 3.4 Use the back-propagation algorithm to update the weights of the generator and discriminator to reduce their losses. Continue to iterate steps 3.2 and 3.3 until the generator and discriminator cannot be optimized any more.

[0087] Step 4: The feature extractor network and the updated generator form a protection module. The real-time query data generates similar samples through the protection module. The similar samples are given predicted labels and confidences through the protected model, and the predicted labels and confidences are returned to the user based on the classification results of the real-time query data by the classification network.

[0088] When implementing it, Figure 3 As shown, the feature extractor network and the generator can form a protection module. The query sample generates similar samples through the protection module. The similar samples are given predicted labels and confidence values ​​through the protected model, and the predicted labels and confidence values ​​are returned to the user based on the classification results of the real-time query data by the classification network.

[0089] The adaptive model stealing defense method based on the generative adversarial network provided in this embodiment constructs a malicious query sample set, compares it with the training data set to learn the characteristics of the data, and obtains the parameters of the feature extractor network. Then, a small amount of labeled data is used to train the classification network to obtain the classification model M, which distinguishes the query sample as a normal query or an abnormal query. And construct a generative adversarial network, input x into the generator, obtain a similar sample x', obtain the corresponding label output and confidence of the query sample x and the similar sample x' through the protected model, and use the judgment type and the labels and confidence of x and x' as input to train the discriminator. The Top-1 confidence value and category of x are given to the corresponding category of x', and the confidence values ​​of the remaining categories are converted according to the weight to obtain the discrimination result. Through the adversarial learning of the discrimination result and the generator, the quality of generating similar samples x' is continuously improved, so that the generator can generate similar samples x' according to the sample type, so that the similar samples of normal queries are almost consistent with the normal query output results in the protected model, and the similar samples of abnormal queries interfere with the output of the protected model. When in use, the protected model is protected through the feature extractor network and generator, achieving the purpose of model defense while finding a balance between maximizing the availability and utility of the model.

[0090] It should be understood that various parts of the present disclosure may be implemented in hardware, software, firmware, or a combination thereof.

[0091] The above is only a specific implementation of the present disclosure, but the protection scope of the present disclosure is not limited thereto. Any changes or substitutions that can be easily thought of by a person skilled in the art within the technical scope disclosed in the present disclosure should be included in the protection scope of the present disclosure. Therefore, the protection scope of the present disclosure should be based on the protection scope of the claims.

Claims

1. An adaptive model stealing defense method based on generative adversarial network, It is characterized in that include: Step 1: Use contrastive learning to train the feature extractor of the classification model M, and obtain the network parameters of the feature extractor through training with positive and negative sample data; Step 2: Perform supervised learning to train the classification network according to the feature extractor network parameters to obtain a trained classification model M; Step 3: construct a generative adversarial network, use the generator in the generative adversarial network to receive the query sample x, and generate a forged similar sample x', input the query sample x and the similar sample x' into the discriminator to obtain the label and confidence, and use the back-propagation algorithm to update the generator and discriminator; Step 4: The feature extractor network and the updated generator form a protection module. The real-time query data generates similar samples through the protection module. The similar samples are given predicted labels and confidences through the protected model, and the predicted labels and confidences are returned to the user based on the classification results of the real-time query data by the classification network.

2. The method according to claim 1, Features ,The feature extraction network includes an encoder and a multi-layer perceptron.

3. The method according to claim 2, Features , the step 1 specifically includes: Step 1.1: Construct a normal query dataset and an abnormal query dataset, set N samples for each training batch, and extract samples, perform different data enhancements on N samples to obtain positive sample pairs, and use them and other images and their enhancements as negative samples to form a positive and negative sample data set; Step 1.2, input the positive and negative sample data sets into the encoder to extract features, obtain feature representation, obtain feature vectors through a multi-layer perceptron, and calculate whether the maximum consistency between the feature vectors is achieved according to the first loss function, wherein the expression of the first loss function is: Among them I [k≠i] ∈{0,1} is an indicator function, sim(·,·) represents the cosine similarity, and η is the temperature parameter; Step 1.3, obtain the parameters of the feature extractor network through multiple batches of training, and freeze its parameters to perform the classification task of downstream query sample types.

4. The method according to claim 3, Features , the step 2 specifically includes: The classification network parameters are trained according to the feature extractor network parameters, the query sample x is the label data, and the classification result is evaluated by the second loss function until it meets the requirements, wherein the second loss function expression is: Among them, M c is the score corresponding to the correct category of the model, M i is the model's score for each category.

5. The method according to claim 4, Features , the step 3 specifically includes: Step 3.1: The generator receives the feature F of the query sample x x , and generate a forged similar sample x', and calculate the third loss function between the query sample x and the similar sample x', wherein the third loss function is: Where D is the discriminator, G is the generator, x is the input query, T is the query sample determination category, T∈{0,1}, when T=1, it is a malicious query sample, and the generated sample x' is as dissimilar to x as possible. When T=0, it is a normal query sample, and the generated sample x' is as similar to x as possible. G(F x ) is the output of the generator, D(G(F x )) is the predicted probability of the discriminator for the generator output; Step 3.2: The discriminator calculates the similarity between the query sample x and the similar sample x', and accordingly obtains the fourth loss function corresponding to the discriminator, wherein the fourth loss function is: Among them, P max (x) is the confidence value of the category with the largest confidence in x, P' max (x') is the confidence value of the category with the largest confidence in x'; Step 3.3, use the back-propagation algorithm to iterate steps 3.1 and 3.2 to update the weights of the generator and discriminator until the requirements are met.

Images