Adaptive model stealing defense method based on generative adversarial network

Abstract

The disclosed embodiment provides an adaptive model theft defense method based on a generative adversarial network, which belongs to the field of data processing technology and specifically includes: using a contrastive learning method to train the feature extractor of a classification model M; performing supervised learning to train the classification network; constructing a generative adversarial network, using the generator in the generative adversarial network to receive a query sample x, and generating a forged similar sample x', respectively inputting the query sample x and the similar sample x' into the discriminator to obtain a label and confidence, and using the backpropagation algorithm to update the generator and the discriminator; the feature extractor network and the updated generator constitute a protection module, and the real-time query data generates similar samples through the protection module. The similar samples are given predicted labels and confidences by the model to be protected, and the predicted labels and confidences are returned to the user based on the classification results of the real-time query data by the classification network. Through the solution disclosed in the present invention, the security and adaptability of the model are improved.

Description

Technical Field

[0001] The embodiments of the present disclosure relate to the field of data processing technology, and in particular to an adaptive model theft defense method based on a generative adversarial network. Background Art

[0002] With the intensive research and significant success of machine learning and deep learning in many application areas, machine learning applications are becoming increasingly prevalent. Machine Learning as a Service (MLaaS), a promising service, provides customers with personalized inference capabilities through paid APIs. However, it is vulnerable to model extraction attacks, which are black-box attacks targeting models deployed on MLaaS platforms. These attacks attempt to reconstruct an alternative model with similar functionality to the target model through prediction APIs. Typically, attackers craft carefully prepared samples (synthetic, adversarial, and proxy) and iteratively query the target model to obtain the returned results, which they then use to train their own models. Existing defense detection methods based on query distributions are ineffective because proxy samples follow a Gaussian distribution and involve multiple colluding malicious users, making the synthetic samples uncorrelated (i.e., the natural data distribution). Adversarial confidence perturbations, designed to hide the varying confidence distributions for different queries, minimize the differences in confidence across queries, thereby reducing information leakage from the target model. However, they do not alter the predicted labels for different queries, making them ineffective for model theft, which only requires prediction labels. Therefore, although many works have been proposed to defend against model extraction attacks, the existing works are limited and less comprehensive.

[0003] It can be seen that there is an urgent need for a highly secure and adaptable adaptive model theft defense method based on generative adversarial networks. Summary of the Invention

[0004] In view of this, the embodiments of the present disclosure provide an adaptive model theft defense method based on a generative adversarial network, which at least partially solves the problems of poor security and adaptability in the existing technology.

[0005] The present disclosure provides an adaptive model stealing defense method based on a generative adversarial network, including:

[0006] Step 1: Use contrastive learning to train the feature extractor of the classification model M, and obtain the feature extractor network parameters through training with positive and negative sample data;

[0007] Step 2: Perform supervised learning to train the classification network based on the feature extractor network parameters to obtain a trained classification model M.

[0008] Step 3: Build a generative adversarial network. Use the generator in the generative adversarial network to receive the query sample x and generate a fake similar sample x'. Input the query sample x and the similar sample x' into the discriminator to obtain the label and confidence respectively, and use the backpropagation algorithm to update the generator and discriminator.

[0009] In step 4, the feature extractor network and the updated generator form a protection module. The real-time query data passes through the protection module to generate similar samples. The similar samples are given predicted labels and confidences through the protected model, and the predicted labels and confidences are returned to the user based on the classification results of the real-time query data by the classification network.

[0010] According to a specific implementation of an embodiment of the present disclosure, the feature extraction network includes an encoder and a multi-layer perceptron.

[0011] According to a specific implementation of the embodiment of the present disclosure, step 1 specifically includes:

[0012] Step 1.1: Construct a normal query dataset and an abnormal query dataset, set N samples per batch for training, and extract samples, perform different data enhancements on N samples to obtain positive sample pairs, and use them and other images and their enhancements as negative samples to form a positive and negative sample data set;

[0013] In step 1.2, the positive and negative sample data sets are input into the encoder to extract features and obtain feature representations. Feature vectors are obtained through the multi-layer perceptron. The first loss function is used to calculate whether the feature vectors have achieved maximum consistency. The expression of the first loss function is:

[0014]

[0015] Among them I [k≠i] ∈{0,1} is an indicator function, sim(·,·) represents the cosine similarity, and η is the temperature parameter;

[0016] In step 1.3, the parameters of the feature extractor network are obtained through multiple batches of training, and its parameters are frozen to perform the classification task of the downstream query sample type.

[0017] According to a specific implementation of the embodiment of the present disclosure, step 2 specifically includes:

[0018] The classification network parameters are trained according to the feature extractor network parameters, the query sample x is the label data, and the classification result is evaluated using the second loss function until it meets the requirements, wherein the second loss function expression is:

[0019]

[0020] Among them, M c is the score corresponding to the correct category of the model, M i is the model's score for each category.

[0021] According to a specific implementation of the embodiment of the present disclosure, step 3 specifically includes:

[0022] Step 3.1: The generator receives the feature F of the query sample x x , and generate a forged similar sample x', and calculate the third loss function between the query sample x and the similar sample x', wherein the third loss function is:

[0023]

[0024] Where D is the discriminator, G is the generator, x is the input query, T is the query sample determination category, T∈{0,1}, when T=1, it is a malicious query sample, the generated sample x' is as dissimilar to x as possible, when T=0, it is a normal query sample, the generated sample x' is as similar to x as possible, G(F x ) is the output of the generator, D(G(F x )) is the predicted probability of the discriminator for the generator output;

[0025] In step 3.2, the discriminator calculates the similarity between the query sample x and the similar sample x', and accordingly obtains the fourth loss function corresponding to the discriminator, wherein the fourth loss function is:

[0026]

[0027] Among them, P max (x) is the confidence value of the category with the largest confidence level x, P' max (x') is the confidence value of the category with the largest confidence of x';

[0028] In step 3.3, use the back-propagation algorithm to iterate steps 3.1 and 3.2 to update the weights of the generator and discriminator until the requirements are met.

[0029] The adaptive model theft defense scheme based on a generative adversarial network in the embodiment of the present disclosure includes: step 1, using a contrastive learning method to train the feature extractor of the classification model M, and obtaining the feature extractor network parameters through training with positive and negative sample data; step 2, performing supervised learning to train the classification network based on the feature extractor network parameters to obtain the trained classification model M; step 3, constructing a generative adversarial network, using the generator in the generative adversarial network to receive the query sample x, and generate a forged similar sample x', inputting the query sample x and the similar sample x' into the discriminator to obtain a label and confidence, and using the backpropagation algorithm to update the generator and the discriminator; step 4, forming a protection module with the feature extractor network and the updated generator, and generating similar samples through the protection module for real-time query data, and the similar samples are given predicted labels and confidences through the model to be protected, and the predicted labels and confidences are returned to the user based on the classification results of the real-time query data by the classification network.

[0030] The beneficial effects of the disclosed embodiments are as follows: Through the disclosed solution, a feature extractor is trained using contrastive learning, and a classification network is trained using supervised learning, ultimately yielding a classification model M. Similar samples generated through a generative adversarial network are used to obfuscate the confidence values ​​obtained by query samples from the protected model. Predictive perturbations are performed against malicious query samples, achieving both model defense and model effectiveness, improving security and adaptability. BRIEF DESCRIPTION OF THE DRAWINGS

[0031] In order to more clearly illustrate the technical solutions of the embodiments of the present disclosure, the following briefly introduces the drawings required for use in the embodiments. Obviously, the drawings described below are only some embodiments of the present disclosure. For ordinary technicians in this field, other drawings can be obtained based on these drawings without any creative work.

[0032] Figure 1 A flowchart of an adaptive model stealing defense method based on a generative adversarial network provided in an embodiment of the present disclosure;

[0033] Figure 2 A schematic diagram of a generative adversarial network training process provided in an embodiment of the present disclosure;

[0034] Figure 3 A schematic diagram of the theft defense process of an adaptive model theft defense method based on a generative adversarial network provided in an embodiment of the present disclosure. DETAILED DESCRIPTION

[0035] The embodiments of the present disclosure are described in detail below with reference to the accompanying drawings.

[0036] The following describes the embodiments of the present disclosure through specific examples, and those skilled in the art can easily understand other advantages and effects of the present disclosure from the contents disclosed in this specification. Obviously, the described embodiments are only a part of the embodiments of the present disclosure, rather than all of the embodiments. The present disclosure can also be implemented or applied through other different specific embodiments, and the details in this specification can also be modified or changed in various ways based on different viewpoints and applications without departing from the spirit of the present disclosure. It should be noted that, in the absence of conflict, the following embodiments and features in the embodiments can be combined with each other. Based on the embodiments in the present disclosure, all other embodiments obtained by ordinary technicians in this field without making creative work are within the scope of protection of the present disclosure.

[0037] It should be noted that various aspects of the embodiments within the scope of the appended claims are described below. It should be apparent that the aspects described herein can be embodied in a wide variety of forms, and any specific structure and / or function described herein is merely illustrative. Based on this disclosure, it should be understood by those skilled in the art that an aspect described herein can be implemented independently of any other aspect, and two or more of these aspects can be combined in various ways. For example, any number of aspects described herein can be used to implement an apparatus and / or practice a method. In addition, other structures and / or functionalities other than one or more of the aspects described herein can be used to implement this apparatus and / or practice this method.

[0038] It should also be noted that the illustrations provided in the following embodiments are only schematic illustrations of the basic concept of the present disclosure. The illustrations only show components related to the present disclosure and are not drawn according to the number, shape and size of components in actual implementation. In actual implementation, the type, quantity and proportion of each component can be changed at will, and the component layout type may also be more complicated.

[0039] Additionally, in the following description, specific details are provided to provide a thorough understanding of the examples. However, one skilled in the art will appreciate that the aspects described can be practiced without these specific details.

[0040] The embodiments of the present disclosure provide an adaptive model theft defense method based on a generative adversarial network, which can be applied to network defense processes in Internet scenarios.

[0041] See also Figure 1 , is a flow chart of an adaptive model stealing defense method based on a generative adversarial network provided by an embodiment of the present disclosure. Figure 1 As shown, the method mainly includes the following steps:

[0042] Step 1: Use contrastive learning to train the feature extractor of the classification model M, and obtain the feature extractor network parameters through training with positive and negative sample data;

[0043] Furthermore, the feature extraction network includes an encoder and a multi-layer perceptron.

[0044] Furthermore, the step 1 specifically includes:

[0045] Step 1.1: Construct a normal query dataset and an abnormal query dataset, set N samples per batch for training, and extract samples, perform different data enhancements on N samples to obtain positive sample pairs, and use them and other images and their enhancements as negative samples to form a positive and negative sample data set;

[0046] In step 1.2, the positive and negative sample data sets are input into the encoder to extract features and obtain feature representations. Feature vectors are obtained through the multi-layer perceptron. The first loss function is used to calculate whether the feature vectors have achieved maximum consistency. The expression of the first loss function is:

[0047]

[0048] Among them I [k≠i] ∈{0,1} is an indicator function, sim(·,·) represents the cosine similarity, and η is the temperature parameter;

[0049] In step 1.3, the parameters of the feature extractor network are obtained through multiple batches of training, and its parameters are frozen to perform the classification task of the downstream query sample type.

[0050] In specific implementation, the contrastive learning method is used to train the feature extractor of the classification model M. The parameters of the feature extractor network are obtained through training on a large amount of unlabeled data. Based on this, the downstream query sample classification task is performed. The specific process can be shown as follows:

[0051] 1.1 Constructing training positive and negative sample datasets

[0052] First, construct a normal query dataset (training data) and an abnormal query dataset (such as synthetic samples, adversarial samples, and proxy samples). Set N samples per batch for training, and extract We perform different data augmentation (such as flipping, cropping, grayscale, etc.) on these N images to obtain positive sample pairs for comparative learning training. The same image with different data augmentation is a positive sample, and the image and other images and their augmentation are all negative samples.

[0053] 1.2 Contrastive Learning Training

[0054] The features are extracted through an encoder (such as a residual network (ResNet)) to obtain feature representations. After passing through a multi-layer perceptron (MLP), feature vectors are obtained. The maximum consistency between feature vectors is calculated. The loss function is as follows:

[0055]

[0056] Among them I [k≠i] ∈{0,1} is an indicator function, sim(·,·) represents the cosine similarity, and η is the temperature parameter.

[0057] 1.3 The parameters of the feature extractor network are obtained through multiple batches of training, and its parameters are frozen to perform downstream classification tasks.

[0058] Step 2: Perform supervised learning to train the classification network based on the feature extractor network parameters to obtain a trained classification model M.

[0059] Based on the above embodiment, step 2 specifically includes:

[0060] The classification network parameters are trained according to the feature extractor network parameters, the query sample x is the label data, and the classification result is evaluated using the second loss function until it meets the requirements, wherein the second loss function expression is:

[0061]

[0062] Among them, M c is the score corresponding to the correct category of the model, M i is the model's score for each category.

[0063] In specific implementation, the feature extractor network parameters are obtained according to step 1, and the classification network is trained through supervised learning, and finally the classification model M is obtained, which enables it to perform binary classification on the query sample, that is, to determine whether the image is a normal query or a malicious query.

[0064] The classification network is obtained through supervised training. The query x is input into the classification model, the feature extractor (ResNet) network parameters are frozen, and the classification network parameters are trained. The query x is the labeled data. The classification results are evaluated using the loss function:

[0065]

[0066] Among them, M c is the score corresponding to the correct category of the model, M i is the model's score for each category.

[0067] Step 3: Build a generative adversarial network. Use the generator in the generative adversarial network to receive the query sample x and generate a fake similar sample x'. Input the query sample x and the similar sample x' into the discriminator to obtain the label and confidence respectively, and use the backpropagation algorithm to update the generator and discriminator.

[0068] Based on the above embodiment, step 3 specifically includes:

[0069] Step 3.1: The generator receives the feature F of the query sample x x , and generate a forged similar sample x', and calculate the third loss function between the query sample x and the similar sample x', wherein the third loss function is:

[0070]

[0071] Where D is the discriminator, G is the generator, x is the input query, T is the query sample determination category, T∈{0,1}, when T=1, it is a malicious query sample, the generated sample x' is as dissimilar to x as possible, when T=0, it is a normal query sample, the generated sample x' is as similar to x as possible, G(F x ) is the output of the generator, D(G(F x )) is the predicted probability of the discriminator for the generator output;

[0072] In step 3.2, the discriminator calculates the similarity between the query sample x and the similar sample x', and accordingly obtains the fourth loss function corresponding to the discriminator, wherein the fourth loss function is:

[0073]

[0074] Among them, P max (x) is the confidence value of the category with the largest confidence level x, P' max (x') is the confidence value of the category with the largest confidence of x';

[0075] In step 3.3, use the back-propagation algorithm to iterate steps 3.1 and 3.2 to update the weights of the generator and discriminator until the requirements are met.

[0076] In the specific implementation, a generative adversarial network is used, that is, according to the current query sample x, the corresponding generated sample x' is obtained. Figure 2 As shown, the specific process can be as follows:

[0077] 3.1 Building a Generative Adversarial Network

[0078] 3.2 Generator generates samples

[0079] The generator receives the features F of the query input x x, generates a fake sample output x', the loss of the generator is designed to deceive the discriminator so that it cannot distinguish the fake samples, and its loss function is as follows:

[0080] L G =-E[D(G(F x ,T))]

[0081] Among them, D is the discriminator, G is the generator, x is the input query, T is the query sample judgment category, G(F x ) is the output of the generator, D(G(F x )) is the predicted probability of the discriminator for the generator output.

[0082] 3.3 Discriminator Evaluation Samples

[0083] For x and x', the discriminator's goal is to determine the similarity between the two, while ensuring that the generated sample x' and the predicted label of x remain unchanged and the difference in the predicted confidence value is minimal.

[0084]

[0085] Among them, P max (x) is the confidence value of the category with the largest confidence level x, P' max (x') is the confidence value of the category with the highest confidence value for x', and T is the category determined for the query sample. T∈{0,1}, when T=1, it is a malicious query sample, and the generated sample x' is as dissimilar to x as possible; when T=0, it is a normal query sample, and the generated sample x' is as similar to x as possible.

[0086] 3.4 Use the backpropagation algorithm to update the weights of the generator and discriminator to reduce their losses. Continue iterating steps 3.2 and 3.3 until the generator and discriminator cannot be optimized any further.

[0087] In step 4, the feature extractor network and the updated generator form a protection module. The real-time query data passes through the protection module to generate similar samples. The similar samples are given predicted labels and confidences through the protected model, and the predicted labels and confidences are returned to the user based on the classification results of the real-time query data by the classification network.

[0088] When implementing it specifically, Figure 3 As shown, the feature extractor network and the generator can be combined into a protection module. The query sample passes through the protection module to generate similar samples. The similar samples are given predicted labels and confidence values ​​through the protected model, and the predicted labels and confidence values ​​are returned to the user based on the classification results of the real-time query data by the classification network.

[0089] This embodiment provides an adaptive model theft prevention method based on a generative adversarial network. By constructing a malicious query sample set and comparing it with a training dataset, the method learns the data features and obtains the parameters of the feature extractor network. A classification network is then trained using a small amount of labeled data to obtain a classification model M, which can distinguish between normal and abnormal queries. A generative adversarial network is then constructed. Input x into the generator to obtain a similar sample x'. The query sample x and the similar sample x' are passed through the protected model to obtain corresponding label outputs and confidence scores. The judgment type and the labels and confidence scores of x and x' are used as input to train the discriminator. The top-1 confidence value and category of x are assigned to the corresponding category of x', and the confidence values ​​of the remaining categories are weighted to obtain the discrimination result. Through adversarial learning between the discrimination results and the generator, the quality of generated similar samples x' is continuously improved, enabling the generator to generate similar samples x' based on sample type. This ensures that similar samples for normal queries are nearly consistent with the output of the protected model, while similar samples for abnormal queries interfere with the output of the protected model. When in use, the protected model is protected through the feature extractor network and generator, achieving the purpose of model defense while finding a balance between maximizing the availability and utility of the model.

[0090] It should be understood that various parts of the present disclosure can be implemented in hardware, software, firmware, or a combination thereof.

[0091] The above description is merely a specific embodiment of the present disclosure, but the scope of protection of the present disclosure is not limited thereto. Any changes or substitutions that can be easily conceived by a person skilled in the art within the technical scope disclosed in this disclosure should be included in the scope of protection of the present disclosure. Therefore, the scope of protection of the present disclosure should be based on the scope of protection of the claims.

Claims

1. An adaptive model stealing defense method based on generative adversarial network, characterized in that: include: Step 1: Use contrastive learning to train the feature extractor of the classification model M, and obtain the feature extractor network parameters through training with positive and negative sample data; The step 1 specifically includes: Step 1.1: Construct a normal query dataset and an abnormal query dataset, set N samples per batch for training, and extract samples, perform different data enhancements on N samples to obtain positive sample pairs, and use them and other images and their enhancements as negative samples to form a positive and negative sample data set; In step 1.2, the positive and negative sample data sets are input into the encoder to extract features and obtain feature representations. Feature vectors are obtained through the multi-layer perceptron. The first loss function is used to calculate whether the feature vectors have achieved maximum consistency. The expression of the first loss function is: Among them I [k≠i] ∈{0,1} is an indicator function, sim(·,·) represents the cosine similarity, and η is the temperature parameter; Step 1.3: Get the parameters of the feature extractor network through multiple batches of training, and freeze its parameters to perform the classification task of the downstream query sample type; Step 2: Perform supervised learning to train the classification network based on the feature extractor network parameters to obtain a trained classification model M. The step 2 specifically includes: The classification network parameters are trained according to the feature extractor network parameters, the query sample x is the label data, and the classification result is evaluated using the second loss function until it meets the requirements, wherein the second loss function expression is: Among them, M c is the score corresponding to the correct category of the model, M i is the score of the model corresponding to each category; Step 3: Build a generative adversarial network. Use the generator in the generative adversarial network to receive the query sample x and generate a fake similar sample x′. Input the query sample x and the similar sample x′ into the discriminator to obtain the label and confidence respectively, and use the backpropagation algorithm to update the generator and discriminator. The step 3 specifically includes: Step 3.1: The generator receives the feature F of the query sample x x , and generate a forged similar sample x', and calculate the third loss function between the query sample x and the similar sample x', wherein the third loss function is: Where D is the discriminator, G is the generator, x is the input query, T is the query sample determination category, T∈{0,1}, when T=1, it is a malicious query sample, the generated sample x' is as dissimilar to x as possible, when T=0, it is a normal query sample, the generated sample x' is as similar to x as possible, G(F x ) is the output of the generator, D(G(F x )) is the predicted probability of the discriminator for the generator output; In step 3.2, the discriminator calculates the similarity between the query sample x and the similar sample x', and accordingly obtains the fourth loss function corresponding to the discriminator, wherein the fourth loss function is: Among them, P max (x) is the confidence value of the category with the largest confidence value of x, P′ max (x ′ ) is x ′ The confidence value of the category with the largest confidence; Step 3.3, use the back-propagation algorithm to iterate steps 3.1 and 3.2 to update the weights of the generator and discriminator until they meet the requirements; In step 4, the feature extractor network and the updated generator form a protection module. The real-time query data passes through the protection module to generate similar samples. The similar samples are given predicted labels and confidences through the protected model, and the predicted labels and confidences are returned to the user based on the classification results of the real-time query data by the classification network.

2. The method according to claim 1, characterized in that ,The feature extraction network includes an encoder and a multi-layer perceptron.

Images