Model verification method and device, computer equipment and storage medium

Abstract

The invention relates to a model verification method and device, computer equipment and a storage medium. The method comprises the steps that a first composite graph generated by a generation model based on first noise and a first text and a second composite graph generated by the generation model based on second noise and a second text are acquired; obtaining first target noise according to the prediction result of the first model on the first composite image and the first noise, and obtaining second target noise according to the prediction result of the second model on the second composite image and the second noise; obtaining a third composite graph generated by the generation model based on the first target noise and the first text, and a fourth composite graph generated by the generation model based on the second target noise and the second text; by comparing the prediction result of the first model on the third composite graph and the prediction result of the second model on the fourth composite graph, whether the first model performs knowledge stealing on the generative model is judged, and by adopting the method, whether the first model performs knowledge stealing on the composite graph data set of the generative model can be accurately verified.

Description

Technical Field

[0001] The present application relates to the field of information security technology, and in particular to a model verification method, apparatus, computer equipment and storage medium. Background Art

[0002] The success of graph generation models relies heavily on high-quality graph datasets, which provide the models with rich and diverse training samples, enabling the models to better capture the complex patterns and relationships in the graph structure. However, the production of high-quality graph datasets is difficult and costly, involving a lot of annotation and cleaning work. Therefore, more and more researchers use graph generation models to synthesize data for training. Synthetic graph dataset theft refers to the attacker using the graph generation model to create a synthetic graph dataset without permission, and using the synthetic graph dataset model for training. This behavior infringes the intellectual property rights of the owner of the graph generation model.

[0003] In traditional technologies, dataset theft verification methods are mainly targeted at real datasets. By injecting a backdoor watermark into a dataset, the attacker uses the dataset with the watermark injected to train the model, and the trained model will exhibit specific behaviors. Users can verify whether the suspicious model has stolen the graph dataset by judging whether the suspicious model exhibits this specific behavior. However, this method changes the distribution of the original data in the dataset, which may affect normal model training, resulting in poor performance such as inaccurate prediction results of the model obtained by normal training. In addition, the dataset after watermarking is easily intercepted by the backdoor defense method, and the dataset is mistakenly marked as malicious activity, affecting model training and user experience. Furthermore, the method of injecting watermarks into the dataset is suitable for the protection of real datasets, but cannot be directly applied to synthetic graph datasets, which makes it difficult to verify whether the attacker has stolen the graph generation model and use the synthetic graph data generated by the graph generation model for model training.

[0004] There is currently no effective solution to the problem in related technologies that it is impossible to accurately verify whether a suspicious model steals knowledge from the graph generation model without changing the graph dataset. Summary of the invention

[0005] Based on this, it is necessary to provide a model verification method, device, computer equipment and storage medium that can accurately verify whether a suspicious model steals knowledge from a graph generation model without changing the graph data set to address the above technical problems.

[0006] In a first aspect, a model verification method is provided in this embodiment, wherein the first model is a model to be verified, and the second model is a control model, and the method comprises:

[0007] Acquire a first synthetic image generated by a generative model based on first noise and first text, and a second synthetic image generated by the generative model based on second noise and second text;

[0008] Obtaining a first target noise according to a prediction result of the first model on the first synthetic image and the first noise, and obtaining a second target noise according to a prediction result of the second model on the second synthetic image and the second noise;

[0009] Acquire a third synthetic image generated by the generative model based on the first target noise and the first text, and a fourth synthetic image generated based on the second target noise and the second text;

[0010] By comparing the prediction result of the first model on the third synthetic graph and the prediction result of the second model on the fourth synthetic graph, it is determined whether the first model steals knowledge from the generated model.

[0011] In some embodiments, the first noise is a noise obtained by combining the third noise and the tensor, and obtaining the first target noise according to the prediction result of the first model on the first synthetic image and the first noise includes:

[0012] Determining whether the prediction accuracy of the first model for the first synthetic graph meets a first preset condition;

[0013] If the first preset condition is met, updating the first target noise according to the first noise;

[0014] If the first preset condition is not met, a new first noise is obtained based on the third noise and the new tensor, a new first synthetic image generated by the generative model based on the new first noise and the first text is obtained, and the step of determining whether the prediction accuracy of the first model for the first synthetic image meets the first preset condition is repeated until the first target noise is obtained.

[0015] In some embodiments, after obtaining the first target noise according to the first noise, the method further includes:

[0016] Combining the first target noise with the new tensor to obtain a new first noise;

[0017] Obtain a new first synthetic image generated by the generative model based on the new first noise and the first text;

[0018] When the prediction accuracy of the first model for the first synthetic image in the previous cycle is lower than the prediction accuracy of the first model for the first synthetic image in the current cycle, the first target noise is updated according to the new first noise.

[0019] In some embodiments, comparing the prediction result of the first model for the third synthetic graph with the prediction result of the second model for the fourth synthetic graph, determining whether the first model has performed knowledge theft on the generation model includes:

[0020] Obtaining difference information between a prediction result of the first model on the third synthetic image and a prediction result of the second model on the fourth synthetic image;

[0021] Determining whether the difference information meets a second preset condition;

[0022] If the second preset condition is met, it is determined that the first model has stolen knowledge of the generated model.

[0023] In some embodiments, the difference information includes: a difference between a prediction accuracy of the first model for the third composite image and a prediction accuracy of the second model for the fourth composite image; and / or,

[0024] The difference between the performance of the prediction result of the first model for the third synthetic image in the solution space and the performance of the prediction result of the second model for the fourth synthetic image in the solution space.

[0025] In some embodiments, the performance of the prediction result of the first model on the third synthetic image in the solution space includes: the solution space smoothness of the prediction result of the first model on the third synthetic image;

[0026]

[0027] Where N represents the number of times the first target noise is disturbed, ∈ i represents the perturbation applied for the i-th time, G is the generative model, F is the first model, y is the predicted label corresponding to the first model, T is the first text, and C represents the total number of categories in the first synthetic image.

[0028] In some embodiments, obtaining a first synthetic image generated by a generative model based on first noise and first text includes:

[0029] Combining the third noise and the random tensor to obtain the first noise;

[0030] Obtaining the first text according to the predicted label of the first model;

[0031] The first noise and the first text are input into the generation model, and the first synthetic image is output.

[0032] In a second aspect, a model verification device is provided in this embodiment, wherein the first model is a model to be verified, and the second model is a control model, and the device comprises:

[0033] A first generating module, used to obtain a first synthetic image generated by a generating model based on first noise and first text, and a second synthetic image generated by the generating model based on second noise and second text;

[0034] a noise search module, configured to obtain a first target noise according to a prediction result of the first model on the first synthetic image and the first noise, and to obtain a second target noise according to a prediction result of the second model on the second synthetic image and the first noise;

[0035] A second generation module, used for obtaining a third synthetic image generated by the generation model based on the first target noise and the first text, and a fourth synthetic image generated based on the second target noise and the second text;

[0036] A judgment module is used to judge whether the first model steals knowledge from the generated model by comparing the prediction result of the first model on the third synthetic graph with the prediction result of the second model on the fourth synthetic graph.

[0037] In a third aspect, a computer device is provided in this embodiment, including a memory and a processor, wherein the memory stores a computer program, and when the processor executes the computer program, the model verification method described in the first aspect is implemented.

[0038] In a fourth aspect, a computer-readable storage medium is provided in this embodiment, on which a computer program is stored. When the computer program is executed by a processor, the model verification method described in the first aspect is implemented.

[0039] The above-mentioned model verification method, device, computer equipment and storage medium find the first target noise and the second target noise through the prediction results of the first model and the second model for the first synthetic image and the second synthetic image respectively, and generate the third synthetic image and the fourth synthetic image with a data distribution similar to that of the training phase when the first model and the second model are trained, so that the first model and the second model have good prediction performance when predicting the corresponding synthetic images. And by comparing the prediction results of the first model for the third synthetic image and the prediction results of the second model for the fourth synthetic image, it is determined whether the model to be tested uses the synthetic image data set generated by the image generation model for model training, thereby accurately verifying whether the first model steals knowledge from the generation model. BRIEF DESCRIPTION OF THE DRAWINGS

[0040] Figure 1 An application environment diagram of a model verification method in an embodiment;

[0041] Figure 2 A schematic diagram of a flow chart of a model verification method in one embodiment;

[0042] Figure 3 A schematic diagram of a process of synthetic image data set stealing verification in one embodiment;

[0043] Figure 4 is a schematic diagram of a random search method in one embodiment;

[0044] Figure 5 A schematic diagram of calculating prediction accuracy and solution space smoothness in one embodiment;

[0045] Figure 6 A schematic diagram of a one-sided T test in one embodiment;

[0046] Figure 7 is a structural block diagram of a model verification device in one embodiment;

[0047] Figure 8 FIG. 4 is a diagram showing the internal structure of a computer device in one embodiment. DETAILED DESCRIPTION

[0048] In order to make the purpose, technical solution and advantages of the present application more clearly understood, the present application is further described in detail below in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are only used to explain the present application and are not used to limit the present application.

[0049] The model verification method provided in the embodiment of the present application can be applied to Figure 1 In the application environment shown. Among them, the terminal 102 communicates with the server 104 through the network. The data storage system can store the data that the server 104 needs to process. The data storage system can be integrated on the server 104, or it can be placed on the cloud or other network servers. Based on the terminal 102 or the communication between the terminal 102 and the server 104, the synthetic graph generated by the generation model is obtained, the prediction results of the first model and the second model on the synthetic graph are obtained, and based on the prediction results, it is determined whether the first model steals knowledge from the generation model. Among them, the terminal 102 can be but is not limited to various personal computers, laptops, smart phones, tablet computers, etc. The server 104 can be implemented with an independent server or a server cluster consisting of multiple servers.

[0050] In one embodiment, Figure 2 As shown, a model validation method is provided, which is applied to Figure 1The terminal in is used as an example for explanation. Among them, the first model is the model to be verified, the second model is the control model, and the synthetic graph output by the generated model is not used during the training of the second model. The model verification method includes the following steps:

[0051] Step S202, obtaining a first synthetic image generated by the generative model based on the first noise and the first text, and a second synthetic image generated by the generative model based on the second noise and the second text.

[0052] The generation model is a graph generation model. The first text and the second text are used to provide text prompts for the generation model. The first text corresponds to an output category of the first model, and the second text corresponds to an output category of the second model. The output category of the first model and the output category of the second model may be the same or different.

[0053] The first noise and the second noise are randomly generated noises. Optionally, one or more different random noises can be directly selected as the first noise or the second noise; or, a fixed noise can be combined with one or more random tensors, and the noise obtained after the combination can be used as the first noise or the second noise. Optionally, the generative model can generate multiple first synthetic images based on multiple different first noises and fixed first texts. Similarly, the generative model can output multiple second synthetic images based on multiple second noises and corresponding second texts.

[0054] Step S204, obtaining a first target noise according to the prediction result of the first model on the first synthetic image and the first noise, and obtaining a second target noise according to the prediction result of the second model on the second synthetic image and the second noise.

[0055] Among them, the first model is a graph classification model. If the prediction result of the first model for the first synthetic image is accurate, it means that the feature distribution of the first synthetic image is similar to the data distribution of the graph data set used in the training of the first model, so that the first model can effectively classify or identify the first synthetic image. Because the first synthetic image is generated based on the first noise and the first text, the first noise is more matched with the training data of the first model, and the first target noise can be obtained based on the first noise. On the contrary, if the prediction result of the first model for the first synthetic image is inaccurate, there is a large difference between the feature distribution of the first synthetic image and the data distribution of the graph data set used in the training of the first model, making it difficult for the first model to process the first synthetic image, so it is judged that the first noise and the training data of the first model have a low degree of matching, and the first noise corresponding to the current first synthetic image is not suitable as the first target noise.

[0056] Optionally, when the first model can achieve accurate prediction of the first synthetic image, the first noise can be directly used as the first target noise. When the first model cannot achieve accurate prediction results for the first synthetic image, the first noise cannot be directly used as the first target noise. A new first noise can be obtained, and the step of obtaining the first synthetic image generated by the generation model based on the first noise and the first text is repeated until the prediction accuracy of the first model for the first synthetic image reaches a preset accuracy level.

[0057] Based on the same principle, the second target noise can be obtained. Among them, the second model is a graph classification model. If the prediction result of the second model for the second synthetic graph is accurate, the feature distribution of the second synthetic graph is similar to the data distribution of the graph data set used when training the second model, and the second target noise is obtained according to the second noise. If the prediction result of the second model for the second synthetic graph is inaccurate, it is judged that the second noise does not match the training data of the second model, and the second noise cannot be directly used as the second target noise. Optionally, a new second noise can be obtained, and when the second model accurately predicts the second synthetic graph corresponding to the second noise, the new second noise can be used as the second target noise.

[0058] Step S206, obtaining a third synthetic image generated by the generation model based on the first target noise and the first text, and a fourth synthetic image generated based on the second target noise and the second text.

[0059] Among them, the first target noise corresponds to the first model, and the second target noise corresponds to the second model. Optionally, a plurality of first target noises and a first text are respectively input into the generation model, and the generation model outputs a third synthetic graph corresponding to the first target noise one by one. A plurality of second target noises and a second text are respectively input into the generation model, and a fourth synthetic graph corresponding to the second target noise one by one is output. The number of the third synthetic graph and the fourth synthetic graph is set according to the needs of the user, and the two can be the same or different.

[0060] Step S208, by comparing the prediction result of the first model for the third synthetic graph and the prediction result of the second model for the fourth synthetic graph, it is determined whether the first model steals knowledge from the generated model.

[0061] Among them, since the second model is a comparison model, the second model can be used as a judgment benchmark to determine whether the first model uses the synthetic image data set output by the generation model for model training. Optionally, the comparison model is trained based on a real image data set. By comparing the prediction results of the third synthetic image based on the first model and the prediction results of the fourth synthetic image based on the second model, it is determined that the output performance of the first model is better than the output performance of the second model. Then, it can be determined that the first model uses the synthetic image data set output by the generation model for model training, and the first model steals knowledge from the generation model; if the output performance of the first model is similar to the output performance of the second model, or the output performance of the first model is worse than the output performance of the second model, it can be determined that the first model did not use the synthetic image data set output by the generation model for model training, and the first model did not steal knowledge from the generation model.

[0062] Among them, the output performance includes but is not limited to one or more parameters of the accuracy of the prediction result, the number of iterations of the first model and the second model during the prediction process, the smoothness of the output solution space of the first model and the second model, and the cross entropy loss of the prediction results of the first model and the second model. It can be understood that high prediction accuracy, small number of iterations, high solution space smoothness, and gradually decreasing cross entropy loss mean that the output performance of the model is good; low prediction accuracy, large number of iterations, poor solution space smoothness, and gradually increasing cross entropy loss mean that the output performance of the model is poor.

[0063] In the above model verification method, the first target noise and the second target noise are found through the prediction results of the first model and the second model for the first synthetic image and the second synthetic image respectively, and the third synthetic image and the fourth synthetic image output by the generation model based on the first target noise and the second target noise are respectively close to the data distribution of the training data when the first model and the second model are trained, so that the first model and the second model have good prediction performance when predicting the corresponding synthetic images. Because the prediction performance of the model obtained by stealing the graph data set of the generation model for training on the synthetic image will be better than the prediction performance of the model of the graph data set that has not been stolen from the generation model for the synthetic image, by comparing the prediction results of the first model for the third synthetic image and the prediction results of the second model for the fourth synthetic image, it can be determined whether the model to be tested uses the synthetic image data set generated by the graph generation model for model training, thereby accurately verifying whether the first model steals knowledge from the generation model without changing the distribution of the original data in the data set.

[0064] In one embodiment, the first noise is the noise obtained by combining the third noise and the tensor. According to the prediction result of the first model on the first synthetic image and the first noise, obtaining the first target noise includes: judging whether the prediction accuracy of the first model on the first synthetic image meets the first preset condition; if the first preset condition is met, updating the first target noise according to the first noise; if the first preset condition is not met, obtaining a new first noise according to the third noise and the new tensor, obtaining a new first synthetic image generated by the generative model based on the new first noise and the first text, and repeating the step of judging whether the prediction accuracy of the first model on the first synthetic image meets the first preset condition until the first target noise is obtained.

[0065] The tensor is an array that can be added, multiplied, or otherwise mathematically processed with the third noise, and its dimension is the same as that of the third noise. The third noise is perturbed by applying the tensor to it; different first noises are obtained by applying different tensors to the same third noise.

[0066] A tensor combined with the third noise can be obtained by a random selection method. Optionally, a random tensor is obtained by random sampling and combined with the third noise. Alternatively, an orthogonal tensor can be selected to ensure that the direction of the tensor randomly selected each time is different, avoiding repeated searches for the first target noise in the same direction, thereby improving the efficiency of obtaining the first target noise: randomly sample a number of tensors, and then orthogonalize them to make them orthogonal to each other. A set of non-repeating orthogonal tensor groups is obtained, and a tensor is randomly selected from the orthogonal tensor group, and the selected tensor is combined with the third noise to obtain the first noise. Optionally, the third noise can be combined with one or more tensors as required to obtain the first noise.

[0067] The first preset condition is used to indicate that the first model has a high degree of prediction accuracy for the first composite image, and the distribution of the first composite image is similar to the distribution of the first model training data. The prediction accuracy of the first model for the first composite image can be obtained by comparing the predicted label of the first composite image with the prediction result of the first model, wherein the predicted label is associated with the first text.

[0068] Specifically, the prediction accuracy of the first model for the first synthetic image can be determined by calculating the confidence of the prediction result of the first model, the loss function, and other methods, thereby realizing the setting and judgment of the first preset condition. Optionally, the first preset condition can be set as the threshold of the loss function, and the performance of the model on the training and verification data sets can be determined by the value of the loss function. For example, when the value of the loss function is less than the threshold, it is judged that the first preset condition is met; otherwise, it is judged that the first preset condition is not met. Alternatively, the first preset condition can be set as a confidence threshold, and when the prediction result of the first model is higher than the confidence threshold, it is judged whether the prediction accuracy of the first model for the first synthetic image meets the first preset condition. In this embodiment, a plurality of first noises are obtained by random search, and a first target noise close to the first model training stage is selected from the plurality of first noises according to the prediction accuracy of the first model, which can improve the prediction performance of the first model when processing the third synthetic image corresponding to the first target noise, so that the prediction result of the third synthetic image is compared with high credibility, thereby achieving the effect of improving the accuracy of model verification.

[0069] Furthermore, in order to make the first target noise as close as possible to the training data in the first model training stage, the first target noise can be updated. In one embodiment, after obtaining the first target noise according to the first noise, the method further includes: combining the first target noise with the new tensor to obtain a new first noise; obtaining a new first synthetic graph generated by the generative model based on the new first noise and the first text; and updating the first target noise according to the new first noise when the first model's prediction accuracy for the first synthetic graph in the previous cycle is lower than the first model's prediction accuracy for the first synthetic graph in the current cycle.

[0070] Wherein, when the prediction accuracy of the first model for the first synthetic image in the previous cycle round is not lower than the prediction accuracy of the first model for the first synthetic image in the current cycle round, the first target noise is not updated.

[0071] Optionally, the step of updating the first target noise in this embodiment may be repeated until the number of repetitions reaches a specified number, wherein the tensor combined with the first target noise is different in each cycle.

[0072] In the process of cyclically executing the first target noise acquisition method, the first preset condition can be set as follows: obtain the first prediction result of the first model for the first synthetic image in the previous cycle, and the second prediction result of the first model for the first synthetic image in the current cycle; determine whether the prediction accuracy of the second prediction result is higher than the prediction accuracy of the first prediction result; if so, determine that the prediction accuracy of the first model for the first synthetic image meets the first preset condition; if not, determine that the prediction accuracy of the first model for the first synthetic image does not meet the first preset condition. Exemplarily, the steps of repeatedly executing the update of the first target noise are as follows: randomly select a tensor b from a set of tensors and update the first target noise. n Added to the third noise a, the first noise (a+b n ). The generative model is based on the first noise (a+b n ) and the first text to obtain a first composite image. When the prediction accuracy of the first model for the first composite image does not meet the first preset condition, a new tensor b is reselected from the above tensor group. n+1 , according to the third noise a and the new tensor b n+1 , get the new first noise (a+b n+1 ). Then, it is determined whether the number of times the first noise is repeatedly generated reaches a preset number. If it does not reach the preset number, the new first noise (a+b n+1 ) obtains a new first synthetic image, and again executes the step of determining whether the prediction accuracy of the first model for the first synthetic image meets the first preset condition.

[0073] When the prediction accuracy of the first model for the first synthetic image meets the first preset condition, the first noise (a+b n ) as the first target noise. Then, it is determined whether the number of times the first noise is repeatedly generated reaches a preset number of times. If the preset number of times is not reached, a new tensor b is randomly selected from a set of tensors. n+2 With the first target noise (a+b n ) are added to obtain the new first noise (a+b n +b n+2 ). The generative model is based on the first noise (a+b n +b n+2 ) and the first text to obtain a first composite image, and again execute the step of judging whether the prediction accuracy of the first model for the first composite image meets the first preset condition.

[0074] In this embodiment, the first target noise is updated so that the first target noise is close to the training data set in the first model training stage, thereby improving the accuracy of model verification.

[0075] Based on the method of obtaining the same first target noise, the second target noise can be obtained according to the prediction result of the second model on the second synthetic image and the second noise: the second noise is the noise after the fourth noise and the tensor are combined, and it is judged whether the prediction accuracy of the second model on the second synthetic image meets the first preset condition; if the first preset condition is met, the second target noise is updated according to the second noise; if the first preset condition is not met, a new second noise is obtained according to the fourth noise and the new tensor, and a new second synthetic image generated by the generative model based on the new second noise and the second text is obtained, and the step of judging whether the prediction accuracy of the second model on the second synthetic image meets the first preset condition is repeated until the second target noise is obtained. Among them, the fourth noise and the third noise can be the same or different.

[0076] Optionally, after obtaining the second target noise based on the second noise, the method also includes: combining the second target noise and the new tensor to obtain a new second noise; obtaining a new second synthetic graph generated by the generative model based on the new second noise and the second text; and updating the second target noise according to the new second noise when the second model's prediction accuracy for the second synthetic graph in the previous cycle is lower than the second model's prediction accuracy for the second synthetic graph in the current cycle.

[0077] The method for acquiring the second target noise is similar to the method for acquiring the first target noise described in the above embodiment, so the specific limitations can refer to the limitations on the first target noise acquisition method above, which will not be repeated here.

[0078] In one embodiment, by comparing the prediction results of the first model on the third composite image and the prediction results of the second model on the fourth composite image, it is determined whether the first model has stolen knowledge from the generated model, including: obtaining difference information between the prediction results of the first model on the third composite image and the prediction results of the second model on the fourth composite image; determining whether the difference information satisfies a second preset condition; if the second preset condition is satisfied, determining that the first model has stolen knowledge from the generated model.

[0079] Among them, the difference information is the difference between the output performance of the first model for the third synthetic image and the output performance of the second model for the fourth synthetic image, including but not limited to differences in prediction accuracy, the number of iterations in the process of model outputting prediction results, the smoothness of the model output solution space, cross entropy loss, etc.

[0080] The second preset condition is used to indicate that the output performance of the first model for the third composite image is better than the output performance of the second model for the fourth composite image. Optionally, the second preset condition can be obtained according to the one-sided T test, and the second preset condition can be used as the alternative hypothesis in the one-sided T test. If the null hypothesis in the one-sided T test is rejected, it is judged that the second preset condition is satisfied. Among them, the null hypothesis of the one-sided T test can be that the prediction accuracy of the first model for the third composite image is less than or equal to the prediction accuracy of the second model for the fourth composite image; the smoothness of the solution space of the prediction accuracy of the first model for the third composite image is less than or equal to the smoothness of the solution space of the second model for the fourth composite image; the number of iterations when the first model outputs the prediction result is less than that of the second model, etc., which is used to indicate that the output performance of the second model for the fourth composite image is better than the output performance of the first model for the third composite image. The alternative hypothesis is opposite to the null hypothesis, which is used to indicate that the output performance of the first model for the third composite image is better than the output performance of the second model for the fourth composite image.

[0081] Further, in one embodiment, the difference information includes: the difference between the prediction accuracy of the first model for the third composite image and the prediction accuracy of the second model for the fourth composite image. The prediction accuracy can be indicated by one or more parameters such as the accuracy, recall rate, F1 score, etc. of the prediction results of the second model and the fourth model, thereby obtaining the difference information. Optionally, the accuracy of the prediction result of the first model is calculated by the following formula:

[0082]

[0083] Among them, z represents the first target noise, G and F represent the graph generation model and graph classification model used to generate the first target noise, y and T represent the predicted label used to optimize the first target noise and the first text input to the generation model G, and C represents the total number of categories in the synthetic graph dataset. The calculation of the accuracy of the prediction result of the second model is similar, so it will not be repeated here.

[0084] Optionally, the difference information includes: the difference between the performance of the prediction result of the first model for the third synthetic image in the solution space and the performance of the prediction result of the second model for the fourth synthetic image in the solution space. The performance of the solution space includes parameters such as the smoothness of the solution space and the distance from the sample to the decision boundary. The greater the smoothness of the solution space, the better the output performance of the model; conversely, the worse the output performance of the model. The greater the distance from the sample to the decision boundary, the more noise needs to be added to the sample before it will be misclassified by the model. Therefore, the greater the distance from the sample to the decision boundary, the less likely the sample is to be misclassified, and the more likely the sample is to be the training data of the model; the smaller the distance from the sample to the decision boundary, the greater the possibility of the sample being misclassified, the greater the difference between the distribution of the sample and the distribution of the model training data, and the poorer the output performance of the model when predicting based on the sample.

[0085] Optionally, the prediction accuracy and the performance of the solution space may be combined to obtain difference information.

[0086] Further, in one embodiment, the performance of the prediction result of the first model on the third synthetic image in the solution space includes: the solution space smoothness of the prediction result of the first model on the third synthetic image Smooth; wherein,

[0087]

[0088] Where N represents the number of times the first target noise is disturbed, ∈ i represents the disturbance applied for the ith time.

[0089] Similarly, the performance of the prediction result of the second model on the fourth synthetic image in the solution space includes: the solution space smoothness of the prediction result of the second model on the fourth synthetic image. The calculation of the solution space smoothness of the second model is similar, and will not be repeated here. The solution space smoothness corresponding to the first model and the solution space smoothness corresponding to the second model are used as the difference information in the above embodiment.

[0090] Optionally, by comparing the prediction result of the first model on the third composite image and the prediction result of the second model on the fourth composite image, determining whether the first model performs knowledge theft on the generated model includes: obtaining the solution space smoothness of the prediction result of the first model on the third composite image, and obtaining the solution space smoothness of the prediction result of the second model on the fourth composite image. If the solution space smoothness of the first model is greater than the solution space smoothness of the second model, it is determined that the first model performs knowledge theft on the generated model; otherwise, it is determined that the first model does not perform knowledge theft on the generated model.

[0091] In this embodiment, the difference between the prediction results of the first model and the second model is determined through the difference information between the first model and the second model, so as to accurately judge whether the first model steals knowledge from the generated model.

[0092] In one embodiment, obtaining a first synthetic image generated by a generative model based on first noise and first text includes: obtaining the first noise by combining third noise and a random tensor; obtaining the first text according to the predicted label of the first model; inputting the first noise and the first text into the generative model, and outputting the first synthetic image.

[0093] Optionally, the third noise and different random tensors are added to obtain multiple different first noises. Alternatively, the third noise and random tensors can be processed by other methods such as multiplication and convolution. Optionally, the first text is a natural language used to guide the image content generated by the generation model. The corresponding prediction label can be obtained according to the output category of the first model. After the prediction label is converted into a descriptive text through a language model or an artificial method, the descriptive text is used as the first text input to the generation model. The second synthetic image can be obtained based on the same method, which will not be repeated here.

[0094] In this embodiment, the first noise with different data distribution is obtained by combining the random tensor and the first noise, so that the first synthetic image output by the generated model may be similar to the data used in the first model training stage.

[0095] In one embodiment, Figure 3 A synthetic graph dataset stealing verification method is provided. Figure 3 As shown, it includes a graph generation model, a suspicious model and an innocent model. Among them, the graph generation model, that is, the generation model in the above embodiment, is a multimodal generation model that generates graphs from text. The suspicious model is the first model in the above embodiment; the innocent model is the second model in the above embodiment. Among them, the suspicious model and the innocent model are both graph classification models. The suspicious model is a black box model, which may be trained using synthetic data of the graph generation model; the innocent model is trained based on generated data without using the graph generation model. Optionally, the innocent model is a model pre-trained on real data. For example, the innocent model can be a graph convolutional network trained on the real graph dataset Cora. ​​It can be understood that the innocent model can also be a model trained with other datasets.

[0096] Step S301, find the adjacent noise by random search. The adjacent noise is the noise optimized by random search. Optionally, 50 adjacent noises can be generated for the suspicious model by random search, i.e., the first target noise in the above embodiment; and 50 adjacent noises can be generated for the innocent model, i.e., the second target noise in the above embodiment.

[0097] Figure 4 is a schematic diagram of the random search method in this embodiment, such as Figure 4As shown, Gaussian noise is obtained by random sampling. A set of orthogonal tensors randomly generated in advance are used to perform random search in the solution space. Each time a random tensor is added to the Gaussian noise, and the result is input into the graph generation model to obtain the corresponding synthetic graph. The cross entropy loss of the prediction result of the first synthetic graph is calculated by the suspicious model; the cross entropy loss of the prediction result of the second synthetic graph is calculated by the innocent model. The corresponding first target noise and second target noise are obtained according to the cross entropy loss of the suspicious model and the cross entropy loss of the innocent model, respectively. For ease of understanding, the suspicious model is used as an example for explanation. When performing the first random search: after adding a randomly selected tensor to the Gaussian noise, a text prompt, i.e., the first text, is obtained according to the predicted label of the suspicious model. The first text and the noise obtained by adding the tensor are input into the graph generation model together to obtain the first synthetic graph. The first synthetic graph is input into the suspicious model, and the prediction result is output. Based on the predicted label and the predicted result, the cross entropy loss is obtained. Based on the same method, the random search is repeated 100 times to obtain an adjacent noise of the suspicious model, i.e., the first target noise. When performing random searches repeatedly, if the newly calculated cross entropy loss decreases compared to the last calculated cross entropy loss, the noise obtained after adding the tensor is retained as the adjacent noise of the suspicious model. In the next random search, the first text, the new tensor, and the adjacent noise are input into the suspicious model. If the new cross entropy loss does not decrease compared to the last calculated cross entropy loss, the original noise before adding the tensor is retained. In the next random search, the first text, the new tensor, and the original noise before adding the tensor are input into the suspicious model. When obtaining the second adjacent noise of the suspicious model, it is also necessary to repeat the random search 100 times; and so on, 50 adjacent noises of the suspicious model are obtained.

[0098] Step S302, calculating the prediction accuracy and solution space smoothness.

[0099] Figure 5 is a schematic diagram of calculating the prediction accuracy and solution space smoothness in this embodiment, such as Figure 5 As shown, the 100 adjacent noises obtained in step S301 are respectively input into the corresponding suspicious model and the innocent model to calculate the prediction accuracy and the solution space smoothness. Since each adjacent noise corresponds to a prediction accuracy and solution space smoothness, 50 prediction accuracy and solution space smoothness belonging to the suspicious model and 50 prediction accuracy and solution space smoothness belonging to the innocent model can be obtained.

[0100] Step S303, performing a one-sided T test on all prediction accuracies and solution space smoothness of the suspicious model and the innocent model.

[0101] Figure 6It is a schematic diagram of the one-sided T test in this embodiment. Optionally, the null hypothesis is that the prediction accuracy and solution space smoothness of the suspicious model are less than or equal to the prediction accuracy and solution space smoothness of the innocent model, and the alternative hypothesis is that the prediction accuracy and solution space smoothness of the suspicious model are greater than the prediction accuracy and solution space smoothness of the innocent model. If the null hypothesis is rejected, that is, the significance level p is less than 0.05, it is verified that the suspicious model has stolen knowledge from the graph generation model G.

[0102] It is understandable that the number of adjacent noises corresponding to the suspicious model and the innocent model is set according to user needs, and the number of adjacent noises corresponding to the two models can be the same or different. Similarly, the number of repetitions of random search when obtaining each adjacent model can also use other values, or be modified according to user needs.

[0103] The method for verifying the theft of synthetic graph data sets in this embodiment extends the method for verifying the theft of graph data sets to synthetic data. Without changing the synthetic graph data set, it accurately verifies whether the suspicious model is trained using the synthetic graph data output by the graph generation model, thereby achieving the effect of effectively protecting the synthetic data set.

[0104] Based on the same inventive concept, the embodiment of the present application also provides a model verification device for implementing the model verification method involved above. The implementation solution provided by the device to solve the problem is similar to the implementation solution recorded in the above method, so the specific limitations in one or more model verification device embodiments provided below can refer to the limitations on the model verification method above, and will not be repeated here.

[0105] In one embodiment, Figure 7 As shown, a model verification device is provided, the first model is a model to be verified, the second model is a control model, and the device includes:

[0106] A first generating module 701 is used to obtain a first synthetic image generated by a generating model based on first noise and first text, and a second synthetic image generated by a generating model based on second noise and second text;

[0107] The noise search module 702 is used to obtain a first target noise according to the prediction result of the first model on the first synthetic image and the first noise, and to obtain a second target noise according to the prediction result of the second model on the second synthetic image and the first noise;

[0108] The second generation module 703 is used to obtain a third synthetic image generated by the generation model based on the first target noise and the first text, and a fourth synthetic image generated based on the second target noise and the second text;

[0109] The judgment module 704 is used to judge whether the first model steals knowledge from the generated model by comparing the prediction result of the first model on the third synthetic image with the prediction result of the second model on the fourth synthetic image.

[0110] In some embodiments, the first noise is the noise after the third noise and the tensor are combined, and the noise search module 702 obtains the first target noise according to the prediction result of the first model on the first synthetic image and the first noise, including: judging whether the prediction accuracy of the first model on the first synthetic image meets the first preset condition; if the first preset condition is met, updating the first target noise according to the first noise; if the first preset condition is not met, obtaining a new first noise according to the third noise and the new tensor, obtaining a new first synthetic image generated by the generative model based on the new first noise and the first text, and repeating the step of judging whether the prediction accuracy of the first model on the first synthetic image meets the first preset condition until the first target noise is obtained. Optionally, after obtaining the first target noise according to the first noise, the method further includes: combining the first target noise and the new tensor to obtain a new first noise; obtaining a new first synthetic image generated by the generative model based on the new first noise and the first text; and updating the first target noise according to the new first noise when the prediction accuracy of the first model on the first synthetic image in the previous cycle is lower than the prediction accuracy of the first model on the first synthetic image in the current cycle.

[0111] Further, the second noise is the noise after the fourth noise and the tensor are combined. The noise search module 702 obtains the second target noise according to the prediction result of the second model on the second synthetic image and the second noise, including: judging whether the prediction accuracy of the second model on the second synthetic image meets the second preset condition; if the second preset condition is met, updating the second target noise according to the second noise; if the second preset condition is not met, obtaining a new second noise according to the third noise and the new tensor, obtaining a new second synthetic image generated by the generative model based on the new second noise and the second text, and repeating the step of judging whether the prediction accuracy of the second model on the second synthetic image meets the second preset condition. Optionally, after obtaining the second target noise according to the second noise, the method further includes: combining the second target noise and the new tensor to obtain a new second noise; obtaining a new second synthetic image generated by the generative model based on the new second noise and the second text; and updating the second target noise according to the new second noise when the prediction accuracy of the second model on the second synthetic image in the previous two cycles is lower than the prediction accuracy of the second model on the second synthetic image in the current cycle.

[0112] In some of the embodiments, the judgment module 704 judges whether the first model has performed knowledge theft on the generation model by comparing the prediction result of the first model on the third composite image and the prediction result of the second model on the fourth composite image, including: obtaining the difference information between the prediction result of the first model on the third composite image and the prediction result of the second model on the fourth composite image; judging whether the difference information satisfies the second preset condition; if the second preset condition is satisfied, judging that the first model has performed knowledge theft on the generation model. Optionally, the difference information includes: the difference between the prediction accuracy of the first model on the third composite image and the prediction accuracy of the second model on the fourth composite image. Optionally, the difference information also includes: the difference between the performance of the prediction result of the first model on the third composite image in the solution space and the performance of the prediction result of the second model on the fourth composite image in the solution space.

[0113] In some embodiments, the first generation module 701 obtains a first synthetic image generated by the generation model based on the first noise and the first text, including: combining the third noise and the random tensor to obtain the first noise; obtaining the first text according to the predicted label of the first model; inputting the first noise and the first text into the generation model, and outputting the first synthetic image. Similarly, the first generation module 701 obtains a second synthetic image generated by the generation model based on the second noise and the second text, including: combining the third noise and the random tensor to obtain the second noise; obtaining the second text according to the predicted label of the second model; inputting the second noise and the second text into the generation model, and outputting the second synthetic image.

[0114] Each module in the above-mentioned model verification device can be implemented in whole or in part by software, hardware and a combination thereof. Each of the above-mentioned modules can be embedded in or independent of a processor in a computer device in the form of hardware, or can be stored in a memory in a computer device in the form of software, so that the processor can call and execute the operations corresponding to each of the above modules.

[0115] In one embodiment, a computer device is provided. The computer device may be a server, and its internal structure diagram may be as follows: Figure 8As shown. The computer device includes a processor, a memory, an input / output interface (Input / Output, referred to as I / O) and a communication interface. The processor, the memory and the input / output interface are connected through a system bus, and the communication interface is connected to the system bus through the input / output interface. The processor of the computer device is used to provide computing and control capabilities. The memory of the computer device includes a non-volatile storage medium and an internal memory. The non-volatile storage medium stores an operating system, a computer program and a database. The internal memory provides an environment for the operation of the operating system and the computer program in the non-volatile storage medium. The database of the computer device is used to store the first target noise, the second target noise and other data required for executing the model verification method. The input / output interface of the computer device is used to exchange information between the processor and an external device. The communication interface of the computer device is used to communicate with an external terminal through a network connection. When the computer program is executed by the processor, a model verification method is implemented.

[0116] Those skilled in the art will understand that Figure 8 The structure shown in the figure is only a block diagram of a part of the structure related to the solution of the present application, and does not constitute a limitation on the computer device to which the solution of the present application is applied. The specific computer device may include more or fewer components than those shown in the figure, or combine certain components, or have a different arrangement of components.

[0117] In one embodiment, a computer device is further provided, including a memory and a processor, wherein a computer program is stored in the memory, and the processor implements the steps in the above method embodiments when executing the computer program.

[0118] In one embodiment, a computer-readable storage medium is provided, on which a computer program is stored. When the computer program is executed by a processor, the steps in the above-mentioned method embodiments are implemented.

[0119] In one embodiment, a computer program product is provided, including a computer program, which implements the steps in the above method embodiments when executed by a processor.

[0120] Those skilled in the art can understand that all or part of the processes in the above-mentioned embodiment methods can be completed by instructing the relevant hardware through a computer program, and the computer program can be stored in a non-volatile computer-readable storage medium. When the computer program is executed, it can include the processes of the embodiments of the above-mentioned methods. Among them, any reference to the memory, database or other medium used in the embodiments provided in the present application can include at least one of non-volatile and volatile memory. Non-volatile memory can include read-only memory (ROM), magnetic tape, floppy disk, flash memory, optical memory, high-density embedded non-volatile memory, resistive random access memory (ReRAM), magnetoresistive random access memory (MRAM), ferroelectric random access memory (FRAM), phase change memory (PCM), graphene memory, etc. Volatile memory can include random access memory (RAM) or external cache memory, etc. As an illustration and not limitation, RAM can be in various forms, such as static random access memory (SRAM) or dynamic random access memory (DRAM). The database involved in each embodiment provided in this application may include at least one of a relational database and a non-relational database. Non-relational databases may include distributed databases based on blockchains, etc., but are not limited to this. The processor involved in each embodiment provided in this application may be a general-purpose processor, a central processing unit, a graphics processor, a digital signal processor, a programmable logic device, a data processing logic device based on quantum computing, etc., but are not limited to this.

[0121] The technical features of the above embodiments may be arbitrarily combined. To make the description concise, not all possible combinations of the technical features in the above embodiments are described. However, as long as there is no contradiction in the combination of these technical features, they should be considered to be within the scope of this specification.

[0122] The above-described embodiments only express several implementation methods of the present application, and the descriptions thereof are relatively specific and detailed, but they cannot be understood as limiting the scope of the present application. It should be pointed out that, for a person of ordinary skill in the art, several variations and improvements can be made without departing from the concept of the present application, and these all belong to the protection scope of the present application. Therefore, the protection scope of the present application shall be subject to the attached claims.

Claims

1. A model verification method, characterized in that: The first model is a model to be verified, the second model is a control model, and the method comprises: Acquire a first synthetic image generated by a generative model based on first noise and first text, and a second synthetic image generated by the generative model based on second noise and second text; Obtaining a first target noise according to a prediction result of the first model on the first synthetic image and the first noise, and obtaining a second target noise according to a prediction result of the second model on the second synthetic image and the second noise; Acquire a third synthetic image generated by the generative model based on the first target noise and the first text, and a fourth synthetic image generated based on the second target noise and the second text; By comparing the prediction result of the first model on the third synthetic graph and the prediction result of the second model on the fourth synthetic graph, it is determined whether the first model steals knowledge from the generated model.

2. The method according to claim 1, characterized in that: The first noise is noise obtained by combining the third noise and the tensor, and obtaining the first target noise according to the prediction result of the first model on the first synthetic image and the first noise includes: Determining whether the prediction accuracy of the first model for the first synthetic graph meets a first preset condition; If the first preset condition is met, obtaining the first target noise according to the first noise; If the first preset condition is not met, a new first noise is obtained based on the third noise and the new tensor, a new first synthetic image generated by the generative model based on the new first noise and the first text is obtained, and the step of determining whether the prediction accuracy of the first model for the first synthetic image meets the first preset condition is repeated until the first target noise is obtained.

3. The method according to claim 2, characterized in that After obtaining the first target noise according to the first noise, the method further includes: Combining the first target noise with the new tensor to obtain a new first noise; Obtain a new first synthetic image generated by the generative model based on the new first noise and the first text; When the prediction accuracy of the first model for the first synthetic image in the previous cycle is lower than the prediction accuracy of the first model for the first synthetic image in the current cycle, the first target noise is updated according to the new first noise.

4. The method according to claim 1, characterized in that: The step of comparing the prediction result of the first model on the third synthetic graph with the prediction result of the second model on the fourth synthetic graph to determine whether the first model has performed knowledge theft on the generation model comprises: Obtaining difference information between a prediction result of the first model on the third synthetic image and a prediction result of the second model on the fourth synthetic image; Determining whether the difference information meets a second preset condition; If the second preset condition is met, it is determined that the first model has stolen knowledge of the generated model.

5. The method according to claim 4, characterized in that The difference information includes: the difference between the prediction accuracy of the first model for the third synthetic image and the prediction accuracy of the second model for the fourth synthetic image; and / or, The difference between the performance of the prediction result of the first model for the third synthetic image in the solution space and the performance of the prediction result of the second model for the fourth synthetic image in the solution space.

6. The method according to claim 5, characterized in that The performance of the prediction result of the first model on the third synthetic graph in the solution space includes: the solution space smoothness of the prediction result of the first model on the third synthetic graph; wherein, Where N represents the number of times the first target noise is disturbed, ∈ i represents the perturbation applied for the i-th time, G is the generative model, F is the first model, y is the predicted label corresponding to the first model, T is the first text, and C represents the total number of categories in the first synthetic image.

7. The method according to claim 1, characterized in that The obtaining of a first synthetic image generated by a generation model based on first noise and first text comprises: Combining the third noise and the random tensor to obtain the first noise; Obtaining the first text according to the predicted label of the first model; The first noise and the first text are input into the generation model, and the first synthetic image is output.

8. A model verification device, characterized in that: The first model is a model to be verified, the second model is a control model, and the device comprises: A first generating module, used to obtain a first synthetic image generated by a generating model based on first noise and first text, and a second synthetic image generated by the generating model based on second noise and second text; a noise search module, configured to obtain a first target noise according to a prediction result of the first model on the first synthetic image and the first noise, and to obtain a second target noise according to a prediction result of the second model on the second synthetic image and the first noise; A second generation module, used to obtain a third synthetic image generated by the generation model based on the first target noise and the first text, and a fourth synthetic image generated based on the second target noise and the second text; A judgment module is used to judge whether the first model steals knowledge from the generated model by comparing the prediction result of the first model on the third synthetic graph with the prediction result of the second model on the fourth synthetic graph.

9. A computer device comprising a memory and a processor, wherein the memory stores a computer program, wherein: When the processor executes the computer program, the steps of the method according to any one of claims 1 to 7 are implemented.

10. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the steps of the method according to any one of claims 1 to 7 are implemented.

Images