General model stealing defense method and system based on model decision boundary

Abstract

The invention provides a universal model stealing defense method and system based on a model decision boundary, and the method comprises the steps: a training stage: obtaining a user prediction sample, taking the sample and a confidence coefficient distribution vector of a cloud platform model for the prediction sample as input, and outputting an original disturbance sample; adding the original disturbance sample to a user prediction sample as an input to obtain an iterative disturbance sample; in the reasoning stage, when the prediction label obtained by the original confidence distribution vector is the same as the prediction label obtained by the hidden confidence distribution, iteration is continued. When not, iteration is stopped, and the distance from the prediction sample to the decision boundary is determined according to the number of iterations; determining a malicious sample according to the obtained distance and a given comparison result; and returning a malicious sample disturbance confidence distribution vector, and limiting user access. According to the method, under the condition that the output label of the target model is not changed, the output confidence distribution vector of the target model is changed to the greatest extent, so that the availability of the stolen model is reduced.

Description

Technical Field

[0001] The present invention relates to the field of network defense technology, and in particular to a general model theft defense method and system based on model decision boundaries. Background Art

[0002] In the fields of computer vision and natural language processing in recent years, training deep learning models is one of the important methods to solve many challenging problems. However, training a neural network with excellent performance requires massive training data and expensive computing resources, which requires a lot of cost, which greatly limits developers with limited costs to train and deploy their own models. Taking the GPT-3 language model as an example, its training cost is as high as about 4.6 million US dollars. Therefore, some large manufacturers upload a series of services such as data preprocessing, feature extraction, and model training in machine learning to cloud servers to provide services to many developers, and named it Machine Learning as a Service (MLaaS), such as Microsoft's Azure ML and Amazon's Amazon ML. MLaaS greatly facilitates developers and small and medium-sized enterprises to train and deploy their own models. MLaaS allows users to upload their own private models to cloud servers and open prediction interfaces to the public for academic or commercial purposes. In this case, the model holder's data and model structure, model parameters and other model information are invisible to public users due to their privacy and commercial nature of the paper, so the model holder usually charges a certain fee to the requesting user to share the training cost.

[0003] Since uploading models to cloud servers and providing services can gain financial benefits or academic attention, trained models become the intellectual property (IP) of the model owner. Recent studies have shown that adversaries can "steal" models without any prior knowledge, including training data or internal parameters. For example, adversaries can use the victim model to label unlabeled public datasets and use them to train a replica model. This threat is called a model stealing attack.

[0004] Although MLaaS has brought great convenience to developers and reduced the cost of developing and deploying models, it also brings major security risks. Malicious users can steal deployed DNN models and related data information through the interface exposed by MLaaS. Attackers only need to send a limited number of query requests to the interface to use the output inference results to mark the input images to build a pirated dataset, and then use the dataset to train the cloned model. Studies have shown that the performance of such cloned models in the original task can be highly similar (more than 95%) or even better than the original model. Therefore, protecting the intellectual property rights when designing and training DNN models has become an urgent issue in the field of deep learning. Summary of the invention

[0005] In response to the technical problems existing in the prior art, the present invention provides a general model theft defense method and system based on model decision boundaries to ensure the security, reliability and controllability of artificial intelligence and prevent attackers from constructing pirated data sets through input-output pairs to obtain cloned models.

[0006] According to a first aspect of the present invention, the present invention provides a general model stealing defense method based on model decision boundary, including a training phase and an inference phase, wherein:

[0007] Training phase: The cloud platform server obtains user prediction samples, calculates the original confidence distribution vector, uses the user prediction samples and the confidence distribution vector of the cloud platform model for the prediction samples as input through the general perturbation generation algorithm, and outputs the original perturbation samples;

[0008] The original perturbation sample is added to the user prediction sample, and then input into the cloud platform model to obtain the perturbation confidence distribution vector, which is used as the input of the general perturbation generation algorithm to obtain the iterative perturbation sample;

[0009] Inference phase: Determine whether the predicted label obtained by the original confidence distribution vector is the same as the predicted label obtained by the hidden confidence distribution:

[0010] When the predicted label obtained by the original confidence distribution vector is the same as the predicted label obtained by the hidden confidence distribution, continue to iterate;

[0011] When the predicted label obtained by the original confidence distribution vector is different from the predicted label obtained by the hidden confidence distribution, the iteration is stopped, and the distance from the predicted sample to the decision boundary is determined according to the number of iterations;

[0012] Malicious samples are determined based on the distance between the obtained predicted sample and the decision boundary and the given comparison result; the malicious sample perturbation confidence distribution vector is returned, and the user's access is restricted.

[0013] Based on the above technical solution, the present invention can also make the following improvements.

[0014] Optionally, the cloud platform server obtains the user prediction sample, and calculates the original confidence distribution vector including:

[0015] Prepare input data of the sample to be predicted; the input data conforms to the format and structure expected by the model;

[0016] Build an HTTP request and include the sample to be predicted in the body of the cloud platform model request;

[0017] Send a request to the prediction endpoint of the cloud platform model through the HTTP client;

[0018] The cloud platform model processes the request, makes predictions using the hosted model, and returns the results.

[0019] Optionally, the step of taking the user prediction sample and the confidence distribution vector of the cloud platform model for the prediction sample as input through a general perturbation generation algorithm includes:

[0020] Before inputting into the cloud platform model, the image data is preprocessed to adjust the image data to a fixed size to match the input requirements of the model; the image pixel values ​​are normalized; and the image is converted into a NumPy array or a tensor format for a deep learning framework.

[0021] Optionally, the original disturbance sample generation includes:

[0022] The cloud platform model provider uses the image samples in the model training set or test set and the original confidence distribution vectors corresponding to the image samples as the input of the general perturbation generation algorithm, and the output of the general perturbation generation algorithm is the original perturbation sample.

[0023] Optionally, the adding of the original disturbance sample to the user prediction sample, and then inputting the disturbance confidence distribution vector into the cloud platform model, and using the vector as the input of the general disturbance generation algorithm to obtain the iterative disturbance sample includes:

[0024] On the basis of the original perturbation samples, the image samples used for each user access to the cloud platform model and the original confidence distribution vectors corresponding to the image samples are added to the input of the general perturbation generation algorithm, and the output obtained is the iterative perturbation sample.

[0025] Optionally, the image samples used by each user accessing the cloud platform model and the original confidence distribution vector corresponding to the image samples are added to the input of the general perturbation generation algorithm and expressed as:

[0026] Y(x,i),X={X1,…,X m} is the input of the universal perturbation generation algorithm. Each predicted sample input by the user will be added to X. V is the output of the universal perturbation generation algorithm.

[0027] When Err(X V )≤1-δ and ||v|| p When ≤ξ, the perturbation is calculated for all samples in X to obtain the perturbation samples.

[0028] Optionally, the iteration is stopped when the predicted label obtained by the original confidence distribution vector is different from the predicted label obtained by the hidden confidence distribution. The conditional judgment formula for stopping the iteration is:

[0029] k(x i+v)≠k(x i )

[0030] In the formula, k(x i ) represents the sample x i The predicted label of , v is the perturbation sample.

[0031] Optionally, determining the malicious sample according to the obtained distance from the predicted sample to the decision boundary and a given comparison result includes:

[0032] The malicious sample is determined by comparing the number of iterations with the result of a given θ. When the number of iterations is less than θ, the predicted sample is a malicious sample, where θ is a preset value and the initial value of θ can be set through experiments.

[0033] Optionally, after returning the malicious sample disturbance confidence distribution vector, the method further includes:

[0034] The model stealing defense measurement index is used to measure the defense effect of the attacked model stealing; the model stealing defense measurement index is defined as:

[0035]

[0036] Among them, ACC stl ACC represents the accuracy of the model obtained by stealing the target model without applying the defense method on the test set. defense ACC represents the accuracy of the stolen model on the test set obtained by stealing the target model after applying the defense method in this paper. test It indicates the accuracy of the target model on the test set. The higher the performance, the better the defense effect.

[0037] According to a second aspect of the present invention, a general model stealing defense system based on model decision boundary is provided, comprising:

[0038] A training module is used for the cloud platform server to obtain user prediction samples, calculate the original confidence distribution vector, use the user prediction samples and the confidence distribution vector of the cloud platform model for the prediction samples as input through a general perturbation generation algorithm, and output the original perturbation sample; add the original perturbation sample to the user prediction sample, and then input the cloud platform model to obtain the perturbation confidence distribution vector, which is used as the input of the general perturbation generation algorithm to obtain the iterative perturbation sample;

[0039] The inference module is used to determine whether the predicted label obtained by the original confidence distribution vector is the same as the predicted label obtained by the hidden confidence distribution: when the predicted label obtained by the original confidence distribution vector is the same as the predicted label obtained by the hidden confidence distribution, the iteration continues; when the predicted label obtained by the original confidence distribution vector is different from the predicted label obtained by the hidden confidence distribution, the iteration is stopped, and the distance from the predicted sample to the decision boundary is determined according to the number of iterations; the malicious sample is determined according to the obtained distance from the predicted sample to the decision boundary and the given comparison result; the malicious sample perturbation confidence distribution vector is returned, and the user's access is restricted.

[0040] Technical effects and advantages of the present invention:

[0041] The present invention provides a general model stealing defense method and system based on model decision boundary. By analyzing the characteristics of existing adversarial sample generation methods, a general perturbation generation algorithm is designed to detect abnormal samples while resisting adaptive attacks. The present invention changes the target model output confidence distribution vector to the greatest extent without changing the target model output label to reduce the availability of the stolen model. Since the present invention can be deployed as a plug-in after the model training phase is completed, it only needs to access the API multiple times during the iterative access phase, and the overhead generated can be ignored for large models. The present invention does not need to modify the internal structure or parameters of the model, and will not reduce the accuracy of the model itself.

[0042] Other features and advantages of the present invention will be described in the following description, and partly become apparent from the description, or understood by practicing the present invention. The purpose and other advantages of the present invention can be realized and obtained by the structures pointed out in the description, claims and drawings. BRIEF DESCRIPTION OF THE DRAWINGS

[0043] Figure 1 is a model stealing flow chart provided by an embodiment of the present invention;

[0044] Figure 2 is a flow chart of machine learning as a service (MLaas) provided by an embodiment of the present invention;

[0045] Figure 3 It is a general disturbance generation algorithm flow chart of a general model defense method based on model decision boundary provided by an embodiment of the present invention;

[0046] Figure 4 It is a flow chart of generating original disturbance samples of a general model defense method based on model decision boundary provided by an embodiment of the present invention;

[0047] Figure 5 It is a flow chart of the reasoning phase of a general model defense method based on model decision boundary provided by an embodiment of the present invention. DETAILED DESCRIPTION

[0048] In order to make the purpose, technical solution and advantages of the present invention clearer, the technical solution of the present invention will be clearly and completely described below in conjunction with the drawings of the present invention. Obviously, the described embodiments are part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0049] It should be noted that model stealing refers to the attacker interacting with the target machine learning model to obtain the model output and rebuild a model with similar functions. Figure 1 As shown, in the machine learning as a service scenario (MLaaS), there are attacking users who access the machine learning model API on the cloud server through maliciously constructed query samples to build a query-response training set. The embodiments of the present invention intercept malicious samples through the difference in the distance from normal samples and malicious samples to the decision boundary, thereby achieving defense against model stealing attacks.

[0050] In addition, the interception of malicious samples is based on a general perturbation generation algorithm. The present invention mainly includes a training phase and an inference phase. The training phase is performed on a cloud platform server, and the inference phase is performed after the training phase is completed. The algorithm of the training phase is deployed on the model. The solution of the present invention can effectively defend against the theft of neural network models in MLaaS scenarios.

[0051] It is understandable that based on the defects in the background technology, the embodiment of the present invention proposes a general model stealing defense method based on model decision boundary. Figure 2-5 As shown, the method includes a training phase and an inference phase, wherein:

[0052] Training phase: The cloud platform server obtains user prediction samples, calculates the original confidence distribution vector, uses the user prediction samples and the confidence distribution vector of the cloud platform model for the prediction samples as input through the general perturbation generation algorithm, and outputs the original perturbation samples;

[0053] The original perturbation sample is added to the user prediction sample, and then input into the cloud platform model to obtain the perturbation confidence distribution vector, which is used as the input of the general perturbation generation algorithm to obtain the iterative perturbation sample;

[0054] In the embodiment of the present invention, the prediction sample is expressed as:

[0055] X={x j,k,c |1≤j≤H,1≤k≤W,1≤c <C} (1)

[0056] Among them, H represents the height of the image, W represents the width of the image, C represents the number of channels of the image, and x j,k,c Represents the pixel value of the cth channel at position (j,k) in the image.

[0057] The user accesses the cloud platform model on the cloud server through the sample to be predicted, and the calculation of the original confidence distribution vector specifically includes:

[0058] 101. Prepare the samples to be predicted. The user needs to prepare the input data to be predicted. This data must conform to the format and structure expected by the model;

[0059] 102. Build an API request: The user needs to build an HTTP request and include the sample to be predicted in the body of the request;

[0060] 103. Send a request to the cloud platform model API: The user sends a request to the prediction endpoint of the cloud platform model API through an HTTP client (such as curl, Postman, HTTP library of programming language, etc.);

[0061] 104. Receive and parse the response: The cloud platform model API processes the request, uses the hosted model to make predictions, and returns the result. The result is usually a response containing the original confidence distribution vector.

[0062] In this embodiment of the present invention, the original confidence distribution vector is expressed as follows:

[0063]

[0064] Among them, Z(x,i) represents the weight of the cloud platform model for the user's prediction sample X in the i-th category, C represents the total number of categories that the cloud platform model can classify, and Y(x,i) represents the original confidence distribution vector.

[0065] The general perturbation generation algorithm is to find a general perturbation that can affect the classification results of most data points through iterative calculation. The purpose of this algorithm is to find a perturbation that, when added to the original data of the data point, can change the classification result of the data point with a high probability. The implementation process of the general perturbation generation algorithm is as follows Figure 2 shown.

[0066] The cloud platform model API is as follows Figure 3As shown, a collection of interfaces for cloud-based machine learning tools provided by cloud service providers. These APIs can help developers quickly use powerful computing resources and pre-trained models to implement various functions, such as machine learning model training and adjustment, image recognition, speech recognition, chatbots, predictive analysis, natural language processing, data preprocessing, prediction, and data visualization. The cloud platform model API described in the embodiment of the present invention specifically refers to a type of deep learning model interface that provides image recognition functions.

[0067] The general perturbation generation algorithm uses the user prediction sample and the confidence distribution vector of the cloud platform model for the prediction sample as input, and outputs the original perturbation sample including:

[0068] Before inputting into the cloud platform model, the image data is preprocessed to adjust the image data to a fixed size to match the input requirements of the model; the image pixel values ​​are normalized; and the image is converted into a NumPy array or a tensor format for a deep learning framework.

[0069] Specifically, user prediction samples are usually image data, which need to be input into the model in a certain format so that the model can process and classify them. The following is a detailed description of the image classification model prediction samples:

[0070] 1. Image format: Common image formats include JPEG, PNG, BMP, etc. Before entering the model, the image is usually read and preprocessed into an appropriate format (such as a NumPy array or tensor);

[0071] 2. Image preprocessing: Resizing: Images usually need to be resized to a fixed size to match the model's input requirements. Normalization: Image pixel values ​​usually need to be normalized to a specific range so that the model can better process them. Data augmentation: During training, data augmentation techniques may be applied to improve the generalization ability of the model. During prediction, images are usually not augmented;

[0072] 3. Image array: Images are usually converted to NumPy arrays or tensor formats of deep learning frameworks (such as TensorFlow or PyTorch) before being input into the model. Each image is represented as a 3D array (height x width x channel), where the channel represents the color channel (such as RGB).

[0073] The original disturbance sample is generated as follows Figure 4As shown, the cloud platform model provider uses the image samples in the model training set or test set and the original confidence distribution vector corresponding to the image samples as the input of the general perturbation generation algorithm, and the output of the general perturbation generation algorithm is the original perturbation sample. In particular, some cloud platform model providers are unwilling to provide image data based on data privacy considerations, that is, there is no original perturbation sample.

[0074] The adding of the original disturbance sample to the user prediction sample, and then inputting the disturbance confidence distribution vector into the cloud platform model, and using the general disturbance generation algorithm as input to obtain the iterative disturbance sample includes:

[0075] On the basis of the original perturbation samples, the image samples used each time the user accesses the cloud platform model API and the original confidence distribution vector corresponding to the image samples are added to the input of the general perturbation generation algorithm, and the output obtained is the iterative perturbation sample.

[0076] Specifically, the process of obtaining iterative perturbation samples is:

[0077] Y(x,i),X={X1,…,X m} is the input of the general perturbation generation algorithm. Each predicted sample input by the user will be added to X. V is the output of the general perturbation generation algorithm, and its acquisition process is:

[0078] When Err(X V )≤1-δ and ||v|| p ≤ξ, calculate the perturbation for all samples in X and get Δv i , and its calculation formula is:

[0079] Δv i ←argmin I ||v|| P (3)

[0080] where ||v|| P represents the p-norm of vector v, that is, the square root of the sum of the squares of all components of vector v, argmin I It means finding the smallest i. argmin returns the value of i that minimizes the objective function, not the minimum value itself. ξ represents the size of the perturbation v. The initial value of the perturbation v is the original perturbation sample. Finally, the value of v is updated. The update formula is as follows:

[0081] v←Ρ p,ξ (v+Δv i )(4)

[0082] In this embodiment, the judgment condition Err(X V ), update the formula p,ξ(v), which is calculated as:

[0083]

[0084] P p,ξ (v):=argmin v′ ||vv′||2subject to||v′|| p ≤ξ (6)

[0085] Among them, k(x i ) represents the sample x i The predicted label is δ represents the defender's expected fooling rate, that is, the proportion of the total number of samples that the perturbation v can make cross the decision boundary to the total number of samples, X V represents {X1+v,…,X m In this embodiment, the initial value of the norm p is 2, and the value of ξ is 2000.

[0086] Inference phase: Determine whether the predicted label obtained by the original confidence distribution vector is the same as the predicted label obtained by the hidden confidence distribution:

[0087] When the predicted label obtained by the original confidence distribution vector is the same as the predicted label obtained by the hidden confidence distribution, continue to iterate;

[0088] When the predicted label obtained by the original confidence distribution vector is different from the predicted label obtained by the hidden confidence distribution, the iteration is stopped, and the distance from the predicted sample to the decision boundary is determined according to the number of iterations;

[0089] Malicious samples are determined based on the distance between the obtained predicted sample and the decision boundary and the given comparison result; the malicious sample perturbation confidence distribution vector is returned, and the user's access is restricted.

[0090] In this embodiment, when the predicted label obtained by the original confidence distribution vector and the predicted label obtained by the hidden confidence distribution are different, the iteration is stopped, and the conditional judgment formula for stopping the iteration is:

[0091] k(x i +v)≠k(x i ) (7)

[0092] In the formula, k(x i ) represents the sample x i The predicted label of , v is the perturbation sample.

[0093] Determining the malicious sample according to the obtained distance from the predicted sample to the decision boundary and the given comparison result includes:

[0094] like Figure 5As shown in the figure, malicious samples are determined by comparing the number of iterations with the result of a given θ. When the number of iterations is less than θ, the predicted sample is a malicious sample. Experiments show that when the initial value of θ is set to 2, malicious samples can be distinguished to the maximum extent, the impact on ordinary users can be minimized, and the classification accuracy is not affected, but the performance of model stealing attacks is greatly reduced.

[0095] Samples close to the decision boundary of the model are more valuable when training the stolen model, and samples close to the decision boundary generate more information. Therefore, many model stealing attacks, such as JDBA, JDBA-RT, Cloudleak, etc., propose to use adversarial samples as attack samples, because adversarial samples are often close to the decision boundary and have more information when stealing the victim model.

[0096] In this embodiment, it also includes: using the model stealing defense measurement index to measure the defense effect of the attacked model stealing:

[0097] The performance metric for model stealing defense is defined as:

[0098]

[0099] Among them, ACC stl ACC represents the accuracy of the model obtained by stealing the target model without applying the defense method on the test set. defense ACC represents the accuracy of the stolen model on the test set obtained by stealing the target model after applying the defense method in this paper. test It indicates the accuracy of the target model on the test set. The higher the performance, the better the defense effect.

[0100] To summarize, the present invention intercepts malicious samples through the difference in distances from normal samples and malicious samples to the decision boundary, thereby achieving defense against model theft attacks. The interception of malicious samples is based on a general disturbance addition algorithm: the present invention mainly includes a training phase and an inference phase. The training phase is performed on a cloud platform server, and the inference phase is performed after the training phase is completed. The algorithm of the training phase is deployed on the model. The scheme of the present invention can effectively defend against the theft of neural network models in MLaaS scenarios.

[0101] According to a second aspect of the present invention, a general model stealing defense system based on model decision boundary is provided, comprising:

[0102] A training module is used for the cloud platform server to obtain user prediction samples, calculate the original confidence distribution vector, use the user prediction samples and the confidence distribution vector of the cloud platform model for the prediction samples as input through a general perturbation generation algorithm, and output the original perturbation sample; add the original perturbation sample to the user prediction sample, and then input the cloud platform model to obtain the perturbation confidence distribution vector, which is used as the input of the general perturbation generation algorithm to obtain the iterative perturbation sample;

[0103] The inference module is used to determine whether the predicted label obtained by the original confidence distribution vector is the same as the predicted label obtained by the hidden confidence distribution: when the predicted label obtained by the original confidence distribution vector is the same as the predicted label obtained by the hidden confidence distribution, the iteration continues; when the predicted label obtained by the original confidence distribution vector is different from the predicted label obtained by the hidden confidence distribution, the iteration is stopped, and the distance from the predicted sample to the decision boundary is determined according to the number of iterations; the malicious sample is determined according to the obtained distance from the predicted sample to the decision boundary and the given comparison result; the malicious sample perturbation confidence distribution vector is returned, and the user's access is restricted.

[0104] In summary, the embodiment of the present invention proposes a general model stealing defense method and system based on model decision boundary. By analyzing the characteristics of the existing adversarial sample generation method, a general perturbation generation algorithm is designed to detect abnormal samples while resisting adaptive attacks. The present invention changes the target model output confidence distribution vector to the greatest extent without changing the target model output label to reduce the availability of the stolen model. Since the present invention can be deployed as a plug-in after the model training phase is completed, it only needs to access the API multiple times during the iterative access phase, and the overhead generated can be ignored for large models. The present invention does not need to modify the internal structure or parameters of the model, and will not reduce the accuracy of the model itself.

[0105] Through the description of the above implementation methods, those skilled in the art can clearly understand that each implementation method can be implemented by means of software plus a necessary general hardware platform, and of course, it can also be implemented by hardware. Based on this understanding, the above technical solution is essentially or the part that contributes to the prior art can be embodied in the form of a software product, and the computer software product can be stored in a computer-readable storage medium, such as ROM / RAM, a disk, an optical disk, etc., including a number of instructions for a computer device (which can be a personal computer, a server, or a network device, etc.) to execute the methods described in each embodiment or some parts of the embodiments.

[0106] Although the preferred embodiments of the present invention have been described, those skilled in the art may make other changes and modifications to these embodiments once they have learned the basic creative concept. Therefore, the appended claims are intended to be interpreted as including the preferred embodiments and all changes and modifications that fall within the scope of the present invention.

[0107] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention, rather than to limit it. Although the present invention has been described in detail with reference to the aforementioned embodiments, those skilled in the art should understand that they can still modify the technical solutions described in the aforementioned embodiments, or make equivalent replacements for some of the technical features therein. However, these modifications or replacements do not deviate the essence of the corresponding technical solutions from the spirit and scope of the technical solutions of the embodiments of the present invention.

Claims

1. A general model stealing defense method based on model decision boundary, characterized in that: It includes the training phase and the inference phase, in which: Training phase: The cloud platform server obtains user prediction samples, calculates the original confidence distribution vector, uses the user prediction samples and the confidence distribution vector of the cloud platform model for the prediction samples as input through the general perturbation generation algorithm, and outputs the original perturbation samples; The original perturbation sample is added to the user prediction sample, and then input into the cloud platform model to obtain the perturbation confidence distribution vector, which is used as the input of the general perturbation generation algorithm to obtain the iterative perturbation sample; Inference phase: Determine whether the predicted label obtained by the original confidence distribution vector is the same as the predicted label obtained by the hidden confidence distribution: When the predicted label obtained by the original confidence distribution vector is the same as the predicted label obtained by the hidden confidence distribution, continue to iterate; When the predicted label obtained by the original confidence distribution vector is different from the predicted label obtained by the hidden confidence distribution, the iteration is stopped, and the distance from the predicted sample to the decision boundary is determined according to the number of iterations; Malicious samples are determined based on the distance between the obtained predicted sample and the decision boundary and the given comparison result; the malicious sample perturbation confidence distribution vector is returned, and the user's access is restricted.

2. According to the general model stealing defense method based on model decision boundary of claim 1, it is characterized in that: The cloud platform server obtains the user prediction sample and calculates the original confidence distribution vector including: Prepare the input data of the sample to be predicted, which conforms to the format and structure expected by the model; Construct an HTTP request and include the sample to be predicted in the body of the cloud platform model request; Send a request to the prediction endpoint of the cloud platform model through the HTTP client; The cloud platform model processes the request, makes predictions using the hosted model, and returns the results.

3. According to the general model stealing defense method based on model decision boundary of claim 1, it is characterized in that: The method of using the user prediction sample and the confidence distribution vector of the cloud platform model for the prediction sample as input through the general disturbance generation algorithm includes: Before inputting into the cloud platform model, the image data is preprocessed, including: adjusting the image data to a fixed size to match the input requirements of the model, normalizing the image pixel values, and converting the image into a NumPy array or a tensor format for the deep learning framework.

4. According to the general model stealing defense method based on model decision boundary of claim 1, it is characterized in that: The original disturbance sample generation includes: The cloud platform model provider uses the image samples in the model training set or test set and the original confidence distribution vectors corresponding to the image samples as the input of the general perturbation generation algorithm, and the output of the general perturbation generation algorithm is the original perturbation sample.

5. According to the general model stealing defense method based on model decision boundary of claim 1, it is characterized in that: The adding of the original disturbance sample to the user prediction sample, and then inputting the disturbance confidence distribution vector into the cloud platform model, and using the general disturbance generation algorithm as input to obtain the iterative disturbance sample includes: On the basis of the original perturbation samples, the image samples used for each user access to the cloud platform model and the original confidence distribution vectors corresponding to the image samples are added to the input of the general perturbation generation algorithm, and the output obtained is the iterative perturbation sample.

6. A general model stealing defense method based on model decision boundary according to claim 5, characterized in that: The image samples used by each user accessing the cloud platform model and the original confidence distribution vector corresponding to the image samples are added to the input of the general perturbation generation algorithm as follows: Let Y(x,i),X={X1,…,X m } is the input of the universal perturbation generation algorithm. Each predicted sample input by the user will be added to X. V is the output of the universal perturbation generation algorithm. When Err(X V )≤1-δ and ||v|| p When ≤ξ, the perturbation is calculated for all samples in X to obtain the perturbation samples.

7. According to claim 1, a general model stealing defense method based on model decision boundary is characterized in that: When the predicted label obtained by the original confidence distribution vector and the predicted label obtained by the hidden confidence distribution are different, the iteration is stopped. The conditional judgment formula for stopping the iteration is: k(x i +v)≠k(x i ) In the formula, k(x i ) represents the sample x i The predicted label of , v is the perturbation sample.

8. According to the general model stealing defense method based on model decision boundary of claim 1, it is characterized in that: Determining malicious samples according to the distance between the obtained predicted sample and the decision boundary and the given θ includes: The malicious sample is determined by comparing the number of iterations with the result of a given θ. When the number of iterations is less than θ, the predicted sample is a malicious sample. θ is a preset value, and the initial value of θ can be set through experiments.

9. According to the general model stealing defense method based on model decision boundary of claim 1, it is characterized in that: After returning the malicious sample disturbance confidence distribution vector, the method further includes: The model stealing defense measurement index is used to measure the defense effect of the attacked model stealing; the model stealing defense measurement index is defined as: Among them, ACC stl ACC represents the accuracy of the model obtained by stealing the target model without applying the defense method on the test set. defense ACC represents the accuracy of the stolen model on the test set obtained by stealing the target model after applying the defense method in this paper. test It indicates the accuracy of the target model on the test set. The higher the performance, the better the defense effect.

10. A general model stealing defense system based on model decision boundary, characterized in that: include: A training module is used for the cloud platform server to obtain user prediction samples, calculate the original confidence distribution vector, use the user prediction samples and the confidence distribution vector of the cloud platform model for the prediction samples as input through a general perturbation generation algorithm, and output the original perturbation sample; add the original perturbation sample to the user prediction sample, and then input the cloud platform model to obtain the perturbation confidence distribution vector, which is used as the input of the general perturbation generation algorithm to obtain the iterative perturbation sample; The inference module is used to determine whether the predicted label obtained by the original confidence distribution vector is the same as the predicted label obtained by the hidden confidence distribution: when the predicted label obtained by the original confidence distribution vector is the same as the predicted label obtained by the hidden confidence distribution, the iteration continues; when the predicted label obtained by the original confidence distribution vector is different from the predicted label obtained by the hidden confidence distribution, the iteration stops, and the distance from the predicted sample to the decision boundary is determined according to the number of iterations; malicious samples are determined according to the obtained distance from the predicted sample to the decision boundary and the given comparison result; Returns the malicious sample perturbation confidence distribution vector and restricts the user's access.

Images