Data detection method and device of deep learning model, computer readable storage medium and processor

Abstract

The invention discloses a data detection method and device for a deep learning model, a computer readable storage medium and a processor. The method comprises the following steps: in response to a current training round completed by a deep learning model in a target training environment, obtaining model parameters of the deep learning model; determining multiple parameter characteristics based on the model parameters; constructing a target feature vector sequence based on the multiple parameter features and multiple parameter features corresponding to training rounds before the current training round; and detecting the target feature vector sequence to obtain a detection result, the detection result being used for representing whether the deep learning model executes a data attack behavior in the current training round, and the data attack behavior being used for representing that the deep learning model obtains training data in the target training environment in the current training round. The technical problem that the data attack behavior of the deep learning model in the training process cannot be deeply detected is solved.

Description

Technical Field

[0001] The present invention relates to the field of data security technology, and in particular to a data detection method, device, computer-readable storage medium and processor for a deep learning model. Background Art

[0002] At present, deep learning models can carry and reflect information about training data during training. This information embedding capability poses a potential threat to data owners. For example, staff with data mining privileges can modify machine learning algorithms or data processing processes, take advantage of the ability of deep learning models to carry information, and specify information to be encoded in model parameters and prediction results, thereby stealing the privacy data of data owners. This type of data theft attack is usually highly concealed and can effectively bypass traditional security protection mechanisms such as data permission control and data access control, posing a great threat to the security of data used to train deep learning models.

[0003] Currently, no effective solution has been proposed to the above-mentioned technical problem of being unable to deeply detect data attack behaviors of deep learning models during the training process. Summary of the invention

[0004] Embodiments of the present invention provide a data detection method, device, computer-readable storage medium, and processor for a deep learning model, so as to at least solve the technical problem that it is impossible to deeply detect data attack behaviors of a deep learning model during the training process.

[0005] According to one aspect of an embodiment of the present invention, a data detection method for a deep learning model is provided. The method may include: in response to the deep learning model completing the current training round in the target training environment, obtaining the model parameters of the deep learning model, wherein the target training environment is used to provide the training data required for training the deep learning model; based on the model parameters, determining multiple parameter features, wherein the multiple parameter features are used to characterize the parameter distribution results of the model parameters of the deep learning model after the current training round; based on the multiple parameter features and the multiple parameter features corresponding to the training rounds before the current training round, constructing a target feature vector sequence, wherein the target feature vector sequence is used to characterize the parameter distribution characteristics of the model parameters of the deep learning model after the current training round, and the change trend of the model parameters of the deep learning model with the iteration of the training round; detecting the target feature vector sequence to obtain a detection result, wherein the detection result is used to characterize whether the deep learning model performs data attack behavior in the current training round, and the data attack behavior is used to characterize that the deep learning model has obtained the training data in the target training environment in the current training round.

[0006] Optionally, multiple parameter features are determined based on the model parameters, including: performing statistical analysis on the model parameters to obtain multiple parameter features, wherein the multiple parameter features include at least a first parameter feature, a second parameter feature, a third parameter feature and a fourth parameter feature, the first parameter feature is used to characterize the degree of concentration of the model parameter distribution, the second parameter feature is used to characterize the degree of tailing of the model parameter distribution, the third parameter feature is used to characterize the distribution ratio of the model parameter within a specified interval, and the fourth parameter feature is used to characterize the steepness of the probability density curve corresponding to the model parameter, and the specified interval is used to characterize the distribution of the model parameters, an interval between two standard deviations to three standard deviations to the left of the mean of the model parameters, and an interval between two standard deviations to three standard deviations to the right of the mean of the model parameters.

[0007] Optionally, based on multiple parameter features and multiple parameter features corresponding to training rounds before the current training round, a target feature vector sequence is constructed, including: aggregating multiple parameter features into a feature vector, and aggregating multiple parameter features corresponding to each training round before the current training round into a feature vector to obtain multiple feature vectors; based on the order of training rounds, aggregating multiple feature vectors to obtain a target feature vector sequence.

[0008] Optionally, the target feature vector sequence is detected to obtain a detection result, including: inputting the target feature vector sequence into a feature detection model for detection to obtain a detection result, wherein the target feature vector sequence is used to enable the feature detection model to detect data attack behavior of the deep learning model in the current training round by learning preset detection rules, and the preset detection rules are used to at least characterize the rate of change of the concentration of the model parameter distribution in multiple training rounds, the rate of change of the tailing degree of the model parameter distribution in multiple training rounds, the rate of change of the distribution ratio of the model parameters in a specified interval, and the rate of change of the steepness of the probability density curve corresponding to the model parameters.

[0009] Optionally, the detection result is represented by a tuple, wherein the tuple includes a first probability and a second probability, the first probability is used to characterize the probability that the deep learning model does not perform the data attack behavior, and the second probability is used to characterize the probability that the deep learning model performs the data attack behavior. The method also includes: in response to the first probability being greater than the second probability, determining that the deep learning model has not performed the data attack behavior in the current training round; in response to the first probability being less than or equal to the second probability, determining that the deep learning model has performed the data attack behavior in the current training round.

[0010] Optionally, the feature detection model includes at least a long short-term memory network model and a multi-layer perceptron model, the long short-term memory network model is used to capture the time dependency in the target feature vector sequence, and the multi-layer perceptron model is used to perform deep classification on the time dependency output by the long short-term memory network model to determine whether the deep learning model performs data attack behavior in the current training round.

[0011] Optionally, the data detection method of the deep detection model also includes: in response to the deep learning model performing a data attack behavior in the current training round, controlling the target training environment to stop training the deep learning model.

[0012] According to another aspect of an embodiment of the present invention, a data detection device for a deep learning model is also provided. The device may include: an acquisition unit, for acquiring model parameters of the deep learning model in response to the deep learning model completing the current training round in the target training environment, wherein the target training environment is used to provide the training data required for training the deep learning model; a determination unit, for determining multiple parameter features based on the model parameters, wherein the multiple parameter features are used to characterize the parameter distribution results of the model parameters of the deep learning model after the current training round; a construction unit, for constructing a target feature vector sequence based on the multiple parameter features and the multiple parameter features corresponding to the training rounds before the current training round, wherein the target feature vector sequence is used to characterize the parameter distribution characteristics of the model parameters of the deep learning model after the current training round, and the change trend of the model parameters of the deep learning model with the iteration of the training round; a detection unit, for detecting the target feature vector sequence to obtain a detection result, wherein the detection result is used to characterize whether the deep learning model performs data attack behavior in the current training round, and the data attack behavior is used to characterize that the deep learning model has acquired the training data in the target training environment in the current training round.

[0013] According to another aspect of an embodiment of the present invention, a computer-readable storage medium is also provided, which includes a stored program, wherein when the program is executed by a processor, the device where the storage medium is located is controlled to execute the data detection method of the deep learning model in the embodiment of the present invention.

[0014] According to another aspect of an embodiment of the present invention, a processor is further provided. The processor is used to run a program, wherein the data detection method of the deep learning model in the embodiment of the present invention is executed when the program is run.

[0015] According to another aspect of an embodiment of the present invention, a computer program product is also provided. The program product includes computer instructions, and when the computer instructions are executed by a processor, the data detection method of the deep learning model in the embodiment of the present invention is implemented.

[0016] In an embodiment of the present invention, in response to the deep learning model completing the current training round in the target training environment, model parameters of the deep learning model are obtained, wherein the target training environment is used to provide training data required for training the deep learning model; based on the model parameters, multiple parameter features are determined, wherein the multiple parameter features are used to characterize the parameter distribution results of the model parameters of the deep learning model after the current training round; based on the multiple parameter features and the multiple parameter features corresponding to the training rounds before the current training round, a target feature vector sequence is constructed, wherein the target feature vector sequence is used to characterize the parameter distribution characteristics of the model parameters of the deep learning model after the current training round, and the changing trend of the model parameters of the deep learning model with the iteration of the training rounds; the target feature vector sequence is detected to obtain a detection result, wherein the detection result is used to characterize whether the deep learning model performs data attack behavior in the current training round, and the data attack behavior is used to characterize that the deep learning model has obtained the training data in the target training environment in the current training round. That is to say, in an embodiment of the present invention, during the training process of the deep learning model, after each training round, the key parameter features of the deep learning model are automatically extracted, and based on the key parameter features corresponding to each training round and the previous training round, a target feature vector sequence is generated. Since the target feature vector can not only characterize the parameter distribution characteristics of the deep learning model after each training round, but also characterize the changing trend of the model parameters of the deep learning model with the iteration of the training rounds, by detecting the target feature vector, it is possible to timely determine whether a data attack behavior has occurred in the deep learning model in the current training round, and after a data attack behavior occurs, the training process of the deep learning model is timely blocked, thereby achieving the technical effect of effectively protecting the data security of the training environment, thereby solving the technical problem of being unable to deeply detect data attack behaviors of the deep learning model during the training process.

[0017] Furthermore, in an embodiment of the present invention, the data detection process is independent of the model training process and will not have a negative impact on the model training process. While ensuring the data security of the training environment, the training process of the deep learning model is also maintained. BRIEF DESCRIPTION OF THE DRAWINGS

[0018] The drawings described herein are used to provide a further understanding of the present invention and constitute a part of this application. The exemplary embodiments of the present invention and their descriptions are used to explain the present invention and do not constitute an improper limitation of the present invention. In the drawings:

[0019] Figure 1 is a flow chart of a data detection method for a deep learning model according to an embodiment of the present invention;

[0020] Figure 2is a schematic diagram of a detection architecture for deep learning model data attack behavior according to an embodiment of the present invention;

[0021] Figure 3 is a schematic diagram of an attack detection module according to an embodiment of the present invention;

[0022] Figure 4 It is a schematic diagram of a data detection device for a deep learning model according to an embodiment of the present invention. DETAILED DESCRIPTION

[0023] In order to enable those skilled in the art to better understand the scheme of the present invention, the technical scheme in the embodiments of the present invention will be clearly and completely described below in conjunction with the drawings in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work should fall within the scope of protection of the present invention.

[0024] It should be noted that the terms "first", "second", etc. in the specification and claims of the present invention and the above-mentioned drawings are used to distinguish similar objects, and are not necessarily used to describe a specific order or sequence. It should be understood that the data used in this way can be interchanged where appropriate, so that the embodiments of the present invention described herein can be implemented in an order other than those illustrated or described herein. In addition, the terms "including" and "having" and any variations thereof are intended to cover non-exclusive inclusions, for example, a process, method, system, functional component or device that includes a series of steps or units is not necessarily limited to those steps or units clearly listed, but may include other steps or units that are not clearly listed or inherent to these processes, methods, functional components or devices.

[0025] According to an embodiment of the present invention, an embodiment of a data detection method for a deep learning model is provided. It should be noted that the steps shown in the flowchart of the accompanying drawings can be executed in a computer system such as a set of computer executable instructions, and although a logical order is shown in the flowchart, in some cases, the steps shown or described may be executed in an order different from that shown here.

[0026] Figure 1 is a flow chart of a data detection method for a deep learning model according to an embodiment of the present invention. Figure 1 As shown, the method may include the following steps:

[0027] Step S101, in response to the deep learning model completing the current training round in the target training environment, obtaining model parameters of the deep learning model.

[0028] In the technical solution provided in the above step S101 of the present invention, the deep learning model is a type of artificial intelligence (AI) model, and the target training environment provides a large amount of training data and powerful computing power support for the training process of the deep learning model. The deep learning model can complete multiple rounds (epochs) of training in the target training environment, and the current training round is the epoch corresponding to the training process of the current training deep learning model.

[0029] In this embodiment, after the deep learning model in the target training environment starts training, the training process of the deep learning model can be monitored, and after each training round, the model parameters of the deep learning model after the corresponding training round are extracted. Here, the current training round is taken as an example to illustrate the timing of extracting the model parameters of the deep learning model. For example, after the deep learning model ends the current training round, the model parameters of the deep learning model are obtained, wherein the model parameters may include the weight parameters, bias parameters, activation function parameters, regularization parameters, and loss function related parameters of the deep learning model after the current training round. This is only an illustrative example and does not limit the specific parameter content included in the model parameters.

[0030] In this embodiment, as the model training progresses, the model parameters will change, and the model parameters are the basis of model learning and data. By automatically obtaining the model parameters after each epoch, the changing trend of the model parameters during the training process can be monitored in real time, which is crucial for detecting potential data attack behaviors. Real-time monitoring can reduce the time window for data leakage and help take timely measures to prevent further development of attacks.

[0031] Furthermore, the monitoring of the training process of the above-mentioned deep training model and the extraction of model parameters do not require parameters, which reduces the operating cost and also avoids human errors, ensuring the accuracy and reliability of the extracted model parameters.

[0032] Step S102, determining multiple parameter features based on the model parameters.

[0033] In the technical solution provided in the above step S102 of the present invention, multiple parameter features are used to characterize the parameter distribution results of the model parameters of the deep learning model after the current training round is completed, wherein the multiple parameter features may include a first parameter feature, a second parameter feature, a third parameter feature and a fourth parameter feature, wherein the first parameter feature is used to characterize the concentration degree of the model parameter distribution, the second parameter feature is used to characterize the tailing degree of the model parameter distribution, and the third parameter feature is used to characterize the distribution ratio of the model parameter within a specified interval, and the specified interval can be the interval between two standard deviations to three standard deviations to the left of the mean of the model parameter in the distribution of the model parameter (such as, (μ-3σ, μ-2σ) interval), and the interval between two standard deviations to three standard deviations to the right of the mean of the model parameter (such as, (μ+2σ, μ+3σ) interval), and the fourth parameter feature is used to characterize the steepness of the probability density curve corresponding to the model parameter.

[0034] In this embodiment, the model parameters of the deep learning model obtained after the current training round are statistically analyzed to obtain parameter distribution results of the model parameters, and then multiple parameter features are determined from the parameter distribution results, wherein the first parameter feature may include three parameter features of the interquartile range, standard deviation and mean deviation of the model parameters; the second parameter feature may include the parameter proportion outside the μ-3σ point, the parameter proportion outside the μ+3σ point, the distance between μ-3σ and the 0.15% quantile, and the distance between μ+3σ and the 99.85% quantile; the third parameter feature may include the model parameter proportion within the interval (μ-3σ, μ-2σ) and the model parameter proportion within the interval (μ+3σ, μ+2σ); the fourth parameter feature may include the distance between the 2% and 16% quantiles, the distance between the 84% and 98% quantiles, as well as

[0035] In this step, multiple parameter features are obtained by performing statistical analysis on the model parameters of the deep learning model. These multiple parameter features cover multiple aspects of the model parameter distribution, including the degree of concentration, tailing phenomenon, distribution ratio in a specific interval, and the steepness of the probability density curve, etc., so as to comprehensively characterize the state of the model from multiple dimensions and improve the comprehensiveness and accuracy of attack detection.

[0036] Step S103: construct a target feature vector sequence based on the multiple parameter features and the multiple parameter features corresponding to the training rounds before the current training round.

[0037] In the technical solution provided in the above step S103 of the present invention, the target feature vector is used to characterize the parameter distribution characteristics of the model parameters of the deep learning model after the end of the current training round, and the changing trend of the model parameters of the deep learning model with the iteration of the training round.

[0038] In this embodiment, as can be seen from the foregoing introduction, the deep training model will undergo multiple rounds of training in the target training environment. Based on this, after obtaining the multiple parameter features of the deep learning model after the current training round, the multiple parameter features corresponding to the deep learning model after each training round before the current training round can be combined to obtain the multiple model parameters corresponding to the current training round and each training round before the current training round.

[0039] Optionally, after obtaining the multiple model parameters corresponding to the current training round and each training round before the current training round, the multiple parameter features corresponding to the current training round can be combined into a feature vector, and the multiple model parameters corresponding to each training round before the current training round can be combined into feature vectors, thereby obtaining the feature vectors corresponding to the current training round and each training round before the current training round.

[0040] Optionally, after obtaining multiple feature vectors, the feature vectors corresponding to the multiple training rounds can be arranged in the order of the training rounds to obtain a target feature vector sequence. The target feature vector sequence can not only be used to characterize the parameter distribution characteristics of the model parameters of the deep learning model after the current training round, but also to characterize the changing trend of the model parameters of the deep learning model with the iteration of training rounds.

[0041] In this step, the training of the deep learning model is an iterative process, and the distribution and statistical characteristics of the model parameters will be different at the end of each epoch. By arranging these features into a sequence in chronological order, time series analysis methods can be used to understand the changing trend of the model's parameter characteristics over time, which is very helpful for identifying data attack behaviors of deep learning models.

[0042] Furthermore, data theft attacks may not appear immediately in the early stages of training, but gradually accumulate and appear over time. The strategies of data theft attacks may change over time. For example, the attacker may adjust the attack intensity or method at certain stages of training. The feature vector sequence can reflect such changes, help the detection mechanism adapt to various attack strategies, and improve the flexibility and effectiveness of defense.

[0043] Step S104: Detect the target feature vector sequence to obtain a detection result.

[0044] In the technical solution provided in the above step S104 of the present invention, the detection result is used to characterize whether the deep learning model performs data attack behavior in the current training round. The data attack behavior is used to characterize that the deep learning model obtains training data in the target training environment in the current training round. The data attack behavior can also be called data theft behavior.

[0045] In this embodiment, after obtaining the target feature vector sequence, the target feature vector sequence can be input into a feature detection module for detection to determine whether the deep learning model performs data attack behavior in the current training round, wherein the feature detection module includes at least a long short-term memory network model (Bidirectional Long Short-Term Memory, referred to as BLSTM) and a multi-layer perceptron model (Multi-Layer Perceptron, referred to as MLP). The BLSTM model is used to detect the target feature vector sequence and output a detection vector, wherein the detection vector integrates multiple parameter features from different training rounds in the original input and includes information on changes in parameter features during the training process.

[0046] Optionally, the detection vector output by the BLSTM model is input into the MLP model, wherein the MLP model includes three hidden layers. In order to prevent the deep learning model from overfitting and enhance its generalization ability, a batch normalization layer is added before each hidden layer for normalization, and then the normalized data is randomly discarded (dropout). The hidden layers all use the ReLU function as the activation function. After detecting the detection vector output by the BLSTM model, the MLP outputs a binary group (P1, P2), where P1 represents the probability that the deep learning model does not perform data attack behavior in the current training round, and P2 represents the probability that the deep learning model performs data attack behavior in the current training round.

[0047] Optionally, based on the binary group output by the MLP model, the detection result of the target feature vector sequence can be determined, wherein, when the probability that the deep learning model does not perform data attack behavior in the current training round is greater than the probability that the deep learning model performs data attack behavior in the current training round, it is determined that the deep learning model did not perform data theft in the training process corresponding to the current training round. In this case, the next round of training can be continued. Conversely, when the probability that the deep learning model does not perform data attack behavior in the current training round is less than the probability that the deep learning model performs data attack behavior in the current training round, it is determined that data theft occurred in the deep learning model in the training process corresponding to the current training round. In this case, in order to avoid further data theft, the training process of the deep learning model in the target training environment can be interrupted in time.

[0048] In this step, the BLSTM model is able to process sequence data while taking into account past and future contextual information. During the parameter change process of the deep learning model, the parameter characteristics of each training round (epoch) may be affected by the previous and subsequent training states. Because data attacks may show different characteristics at different time points in the training sequence, the BLSTM model is able to capture this temporal dependency and analyze the trend and pattern of parameter characteristics over time, which is crucial for timely detection of data attack behaviors.

[0049] Furthermore, the BLSTM model can fuse the feature information of multiple epochs to generate a feature representation containing time series information. In this way, multiple parameter features corresponding to each training round can be effectively processed and analyzed. These features may independently indicate the difference between normal training and malicious attacks. The BLSTM model can combine multiple parameter features corresponding to multiple training rounds to form a more comprehensive view of the model training status.

[0050] Furthermore, the MLP model is good at learning complex nonlinear mapping relationships and can map the feature vector output by the BLSTM model to a low-dimensional space, where the points in this space can reflect the complex characteristics of the deep learning model training state. This mapping process helps convert the feature vector into an output that can be directly used for attack detection, such as a binary (P1, P2), where P1 and P2 represent the probability that the deep learning model is trained normally and the probability that a data attack behavior has been performed, respectively.

[0051] In the above steps S101 to S104, during the training process of the deep learning model, after each training round, the key parameter features of the deep learning model are automatically extracted, and based on the key parameter features corresponding to each training round and the previous training round, a target feature vector sequence is generated. Since the target feature vector can not only characterize the parameter distribution characteristics of the deep learning model after each training round, but also characterize the changing trend of the model parameters of the deep learning model with the iteration of the training rounds, by detecting the target feature vector, it is possible to timely determine whether a data attack behavior occurs in the deep learning model in the current training round, and after a data attack behavior occurs, the training process of the deep learning model is blocked in time, thereby achieving the technical effect of effectively protecting the data security of the training environment, thereby solving the technical problem of being unable to deeply detect data attack behaviors of the deep learning model during the training process.

[0052] The above method of this embodiment is further introduced below.

[0053] As an optional implementation method, step S102, based on the model parameters, determines multiple parameter features, including: performing statistical analysis on the model parameters to obtain multiple parameter features, wherein the multiple parameter features include at least a first parameter feature, a second parameter feature, a third parameter feature and a fourth parameter feature, the first parameter feature is used to characterize the degree of concentration of the model parameter distribution, the second parameter feature is used to characterize the degree of tailing of the model parameter distribution, the third parameter feature is used to characterize the distribution ratio of the model parameter within a specified interval, and the fourth parameter feature is used to characterize the steepness of the probability density curve corresponding to the model parameter. The specified interval is used to characterize the distribution of the model parameters, the interval between two standard deviations to three standard deviations to the left of the mean of the model parameters, and the interval between two standard deviations to three standard deviations to the right of the mean of the model parameters.

[0054] In this embodiment, the current training round is taken as an example for explanation. After obtaining the model parameters of the deep learning model after the current training round is completed, different statistical indicators for the model parameters can be calculated to obtain multiple parameter features.

[0055] For example, based on the distribution results of the model parameters, the interquartile range, standard deviation σ and mean deviation of the model parameters are calculated to obtain the first parameter feature. Among them, the interquartile range is the distance between the 25% quantile and the 75% quantile of the model parameters, which can reflect the dispersion of the parameter distribution. The larger the interquartile range, the more dispersed the model parameter distribution is, and vice versa, the model parameter distribution is more concentrated; the standard deviation is the arithmetic square root of the variance, and the variance is the arithmetic mean of the square of the difference between each value and its mean. The standard deviation can reflect the dispersion of the model parameter distribution. If the standard deviation is large, it means that most of the model parameters are far away from the mean, and the distribution of the model parameters is more dispersed. On the contrary, most of the data is closer to the mean, and the distribution of the model parameters is more concentrated; the mean deviation is the arithmetic mean of the absolute value of the difference between each value and its mean, which indicates the degree of difference between the data and its mean. If the mean deviation is larger, the difference between the model parameter and its mean is larger, and the model parameter distribution is more dispersed. On the contrary, the difference between the model parameter and its mean is smaller, and the model parameter distribution is more concentrated.

[0056] Optionally, based on the distribution results of the model parameters, the proportion of the model parameters outside the 3 times standard deviation σ of the mean μ, as well as the distance between these extreme value (μ-3σ) points and the 1.15% quantile, and the distance between the extreme value (μ+3σ) point and the 99.85% quantile are calculated to obtain the second parameter feature, wherein, taking the Gaussian distribution as an example, the data outside the (μ-3σ) point and the (μ+3σ) point can be understood as tailing. By calculating the distance between the (μ-3σ) point and the (μ+3σ) point and the 0.15% quantile and the 99.85% quantile, the degree of tailing of the model parameter distribution can be reflected. When the proportion of data outside the (μ-3σ) point and the (μ+3σ) point is small, it indicates that the tailing phenomenon is not obvious. On the contrary, when the proportion of data outside the (μ-3σ) point and the (μ+3σ) point is large, the distribution shows obvious tailing.

[0057] Optionally, based on the distribution results of the model parameters, the parameter proportion of the model parameters in the farther intervals (μ-3σ, μ-2σ) and (μ+2σ, μ+3σ) is calculated as the third parameter feature. Among them, the proportion of the model parameters in the intervals (μ-3σ, μ-2σ) and (μ+2σ, μ+3σ) in the total model parameter distribution can reflect the distribution characteristics of the model parameters. The amount of data distributed in the intervals ((μ-3σ, μ-2σ) and (μ+2σ, μ+3σ) due to the symbol encoding regularization term will be larger than the Laplace distribution and Gaussian distribution. If the amount of data of the model parameters increases rapidly in the intervals (μ-3σ, μ-2σ) and (μ+2σ, μ+3σ), it is more likely that a data attack has occurred. Otherwise, the distribution of the model parameters is likely to be close to the Laplace or Gaussian distribution, indicating that the deep learning model is in a normal training state.

[0058] Optionally, based on the distribution results of the model parameters, the distances between key quantiles of the model parameters are calculated, for example, the distance between the 2% and 16% quantiles, the distance between the 84% and 98% quantiles, as well as The fourth parameter feature is obtained. Among them, the distance between the 2% quantile and the 16% quantile on the left side of the mean, and the distance between the 84% quantile and the 98% quantile on the right side of the mean, can reflect the degree of local change in the distribution of model parameters within this range. Compared with Laplace and Gaussian distributions, the model parameter distribution caused by the symbol encoding regularization term changes more slowly between the 2% quantile and the 16% quantile (between the 84% quantile and the 98% quantile on the other side). Therefore, when the interval length is shorter, it means that the probability density curve changes more significantly, and the parameter distribution is closer to the normally trained Laplace or Gaussian distribution. Conversely, when the interval length is longer, the parameter distribution is likely to be a malicious model caused by a symbol encoding attack. In addition, the distance between the 2% quantile and the 16% quantile of the normally trained Gaussian distribution is approximately equal to the variance σ of the Gaussian distribution. If the distance is significantly different from the variance σ of the conventional Gaussian distribution in the model detection, it indicates that a malicious attack of the symbol encoding regularization term is likely to exist.

[0059] In this step, multiple parameter features are obtained by performing statistical analysis on the model parameters of the deep learning model. These multiple parameter features cover multiple aspects of the model parameter distribution, including the degree of concentration, tailing phenomenon, distribution ratio in a specific interval, and the steepness of the probability density curve, etc., so as to comprehensively characterize the state of the model from multiple dimensions and improve the comprehensiveness and accuracy of attack detection.

[0060] As an optional implementation method, step S103 constructs a target feature vector sequence based on multiple parameter features and multiple parameter features corresponding to training rounds before the current training round, including: aggregating multiple parameter features into a feature vector, and aggregating multiple parameter features corresponding to each training round before the current training round into a feature vector to obtain multiple feature vectors; based on the order of training rounds, aggregating multiple feature vectors to obtain a target feature vector sequence.

[0061] In this embodiment, since the model parameters of the deep learning model are extracted after each training round, and the extracted model parameters are statistically analyzed to obtain multiple feature parameters, that is, each training round corresponds to multiple parameter features of the deep learning model. Based on this, after obtaining the multiple parameter features corresponding to the current training round and each training round before the current training round, the multiple parameter features corresponding to each training round can be combined into a feature vector to obtain the feature vectors corresponding to each training round.

[0062] Optionally, after obtaining the feature vectors corresponding to each training round, the feature vectors corresponding to each training round may be sorted according to the sequence of the training rounds to obtain a target feature vector sequence.

[0063] In this step, the training of the deep learning model is an iterative process, and the distribution and statistical characteristics of the model parameters will be different at the end of each epoch. These features are organized into a feature vector sequence in chronological order, and time series analysis methods can be used to understand the changing trend of the model's parameter characteristics over time, thereby improving the accuracy of data attack detection.

[0064] As an optional implementation, step S104, detecting the target feature vector sequence to obtain a detection result, includes: inputting the target feature vector sequence into a feature detection model for detection to obtain a detection result, wherein the target feature vector sequence is used to enable the feature detection model to detect the data attack behavior of the deep learning model in the current training round by learning preset detection rules, and the preset detection rules are used to at least characterize the rate of change of the concentration of the model parameter distribution in multiple training rounds, the rate of change of the tailing degree of the model parameter distribution in multiple training rounds, the rate of change of the distribution ratio of the model parameters in a specified interval, and the rate of change of the steepness of the probability density curve corresponding to the model parameters.

[0065] In this embodiment, the preset detection rules at least include rules for detecting multiple parameter features corresponding to each training round included in the target feature vector. Because there are at least four essential differences between the model parameters of the deep learning model that performs data attack behavior and the model parameters of the deep learning model that is trained normally. For example, the degree of concentration of the model parameter distribution is different, the tailing phenomenon of the model parameter distribution is different, the parameter proportion of the model parameter in the specified interval (farther interval) is different, and the steepness of the probability density curve of the model parameter is different. Based on this, the general regular term and the related value coding regular term can be distinguished by the degree of concentration of the model parameter distribution, the tailing phenomenon of the model parameter distribution, the parameter proportion of the model parameter in the specified interval (farther interval) and the steepness of the probability density curve of the model parameter. Among them, the general regular term is used to simplify the model and avoid overfitting of the model, but it directly affects the matching degree of the parameter distribution with the data set distribution, and the use of the related value coding regular term will cause the distribution of the model parameters to gradually approach the value distribution characteristics of the data set, including a sudden drop at both ends.

[0066] Optionally, with respect to the concentration of the model parameter distribution, in the standard Gaussian distribution and Laplace distribution, most of the data are concentrated around the mean, while taking the data in the data set (CIFAR10) as an example, the distribution of the data in the data set is usually more dispersed. There are significant differences between different data, and their corresponding numerical representations are also different, so the distribution of the data set values ​​will be more dispersed. The distribution of model parameters in normal training will be affected by the distribution of the data set itself, and data theft attacks may artificially guide the distribution of model parameters to imitate the distribution characteristics of a specific data set. For example, in the CIFAR10 data set, when the model parameter distribution shows a high degree of dispersion similar to that of CIFAR10, this may be a sign that the attacker is using the related value encoding regularization term to steal data. Since the related value encoding regularization term makes the parameter distribution close to the distribution of the data set value, the discreteness of the parameter distribution caused by the related value encoding regularization term will increase during the model training process. Therefore, the rate of change of the concentration of the parameter distribution in multiple training rounds can be used to distinguish the related value encoding regularization term from the general regularization term.

[0067] Optionally, with respect to the tailing phenomenon of the model parameter distribution, for Gaussian distribution and Laplace distribution, the probability density on both sides of the distribution gradually converges to 0, so there is an obvious tailing phenomenon. However, this does not happen in the distribution of the data set, because in the distribution of the data set, the probability density at both ends usually appears to suddenly drop to 0. Since the value range of the data is finite, the value distribution of the data set is truncated at both ends, and the probability density drops directly to 0. Since the correlation value encoding regularization term makes the parameter distribution close to the distribution of the data set values, the tailing degree of the parameter distribution caused by the correlation value encoding regularization term will gradually decrease during the model training process. Therefore, the rate of change of the parameter tailing degree in multiple training rounds can be used to distinguish the correlation value encoding regularization term from the general regularization term.

[0068] Optionally, for the proportion of model parameters in the specified interval, an important difference between the model that generates data attack behavior and the model that is trained normally is that the parameters of the model that is trained normally are better concentrated toward the center point (mean point). In the maliciously trained model, some parameters will always stay in a farther interval (for example, the (μ-3σ, μ-2σ) interval of the Gaussian distribution). Since the symbol-encoded regularization term can only affect some parameters, and other parameters will stay in a farther interval, the amount of data on both sides of the parameter distribution is greater than the Laplace distribution. Therefore, the symbol-encoded regularization term and the general regularization term can be distinguished by referring to the rate of change of the proportion of parameters in the interval farther from the center point in multiple training rounds.

[0069] Optionally, with respect to the steepness of the probability density curve of the model parameters, another difference between the model that generates data attack behavior and the model that is trained normally is that the data attack behavior causes the derivative of the probability density curve to change. In some areas, the model parameters generated by the malicious training process will rise or fall faster than the normal distribution, which is manifested as a steeper probability density curve in some places.

[0070] Optionally, as the malicious training process continues, its probability density curve will gradually rise or fall within a certain interval. Since the symbol-encoded regularization term makes the parameter distribution gradually approach the Laplace distribution at a certain level, and the probability density on both sides of the parameter distribution will be greater than the Laplace distribution, the probability density curve caused by the symbol-encoded regularization term will rise or fall more slowly in certain intervals. Therefore, the symbol-encoded regularization term and the general regularization term can be distinguished by the rate of change of the steepness of the local probability density curve of the parameter distribution in multiple training rounds.

[0071] Optionally, for the above four phenomena, preset detection rules can be generated, that is, the preset detection rules are used to at least characterize the rate of change of the concentration degree of model parameter distribution in multiple training rounds, the rate of change of the tailing degree of model parameter distribution in multiple training rounds, the rate of change of the distribution ratio of model parameters in a specified interval, and the rate of change of the steepness of the probability density curve corresponding to the model parameters. Based on this, when the target feature vector sequence is input into the feature detection model for detection, the feature detection module can learn the preset detection overload, detect the target feature vector, and then obtain the detection result, wherein the detection result is used to characterize whether the deep learning model performs data attack behavior in the current training round.

[0072] Optionally, the feature detection model includes at least a BLSTM model and an MLP model, the BLSTM model is used to capture the time dependency in the target feature vector sequence, and the MLP model is used to perform deep classification on the time dependency output by the long short-term memory network model to determine whether the deep learning model performs data attack behavior in the current training round.

[0073] In this step, the input of the target feature vector sequence enables the feature detection model to monitor multiple rounds of model training in real time, automatically analyze the dynamic changes of model parameters through AI means, and promptly discover potential data theft attacks. In addition, the feature detection model uses preset detection rules for detection during the detection process, taking into account changes in many aspects such as the concentration of model parameter distribution, the degree of tailing, the distribution ratio in the specified interval, and the rate of change of the steepness of the probability density curve. This enables the detection method to comprehensively evaluate the security of model training from multiple angles and improve the accuracy and reliability of detection.

[0074] As an optional implementation method, the detection result is represented by a tuple, wherein the tuple includes a first probability and a second probability, the first probability is used to characterize the probability that the deep learning model does not perform data attack behavior, and the second probability is used to characterize the probability that the deep learning model performs data attack behavior. The method also includes: in response to the first probability being greater than the second probability, determining that the deep learning model has not performed data attack behavior in the current training round; in response to the first probability being less than or equal to the second probability, determining that the deep learning model has performed data attack behavior in the current training round.

[0075] In this embodiment, if the deep learning model does not perform data attack behavior in the current training round, it means that the current training round is normal, and the target training environment can be controlled to continue to perform the next round of training on the deep learning model until data attack behavior is detected in the deep learning model.

[0076] Optionally, if in response to the deep learning model performing a data attack in the current training round, it means that the deep learning model has stolen the training data in the target training environment in the current training round. In this case, in order to avoid further leakage of the training data in the target training environment, the target training environment can be controlled to stop training the deep learning model.

[0077] In the above steps, based on the strategy of detecting data attack behaviors after each round of training and controlling the continuation or termination of training accordingly, data leakage can be prevented in time, data security can be protected, the quality of model training can be ensured, the controllability of the training environment and the efficiency of resource utilization can be improved, while compliance can be promoted, which comprehensively improves the security and efficiency of the deep learning model training process.

[0078] The technical solution of the embodiment of the present invention is illustrated below in conjunction with preferred implementation modes.

[0079] At present, the ability of AI models to carry original training data information poses a serious security challenge to the service model of deep learning model training environments. Analysts with data mining privileges can fully utilize the ability of machine learning models to carry information by modifying machine learning algorithms and data processing processes, and actively encode information in model parameters and prediction results, thereby stealing the privacy data of data owners. This type of attack method is highly concealed and can effectively bypass traditional security protection mechanisms such as data permission control and data access control for add, delete, modify, and query operations. Data security in the training environment cannot be guaranteed, and there is a technical problem that the data theft behavior of deep learning models cannot be deeply detected.

[0080] However, an embodiment of the present invention provides a method for detecting data attack behaviors of a deep learning model. When the deep learning model in the deep learning model training environment starts training, the feature extraction module will extract model parameters and analyze them after each training round is completed (i.e., after each epoch); the feature extraction module will parse the extracted model parameters corresponding to each training round to form 13 parameter features corresponding to each training round that can judge malicious data theft behaviors; and then the 13 parameter features corresponding to each training round are respectively aggregated into a feature vector, and according to the sequence of the training rounds, the feature vectors corresponding to each training round are combined into a feature vector sequence, which is input into the attack detection module for detecting malicious data theft behaviors, and when the deep learning model is detected to have data theft behaviors, the deep learning model training environment is controlled to stop the training process of the deep learning model. Without affecting the training process of the deep learning model, the model parameters extracted by the deep learning model after each training round are used to conduct a comprehensive and in-depth detection of the data attack behaviors of the deep learning model in the corresponding rounds, effectively ensuring the data security in the training environment, and thus solving the technical problem of being unable to deeply detect the data theft behaviors of the deep learning model.

[0081] Next, the detection architecture for deep learning model data attack behavior provided by an embodiment of the present invention is introduced.

[0082] Figure 2 is a schematic diagram of a detection architecture for deep learning model data attack behavior according to an embodiment of the present invention, such as Figure 2 As shown, the detection architecture of the deep learning model data attack behavior mainly includes a training module 201 and a detection module 202, wherein the detection module 202 includes a feature extraction module 2021 and an attack detection module 2022.

[0083] Optionally, the training module 201 is used to provide a training environment for the deep learning model, which includes all the data required for training the deep learning model, the computing power support required for training the deep learning model, and the AI ​​model to be trained. The AI ​​model can undergo multiple rounds of training in the training environment, wherein the multiple rounds of model training may include model training code and malicious regular terms, wherein malicious regular terms in the model training process may pose security risks to the training data in the training environment.

[0084] Optionally, the feature extraction module 2021 in the detection module 202 is used to monitor the model training process in the training module, and after each training round, extract the model parameters of the AI ​​model, and perform statistical analysis on the extracted model parameters to obtain 13 parameter features corresponding to each training round. Among them, Table 1 is a model parameter feature extraction table according to an embodiment of the present invention. As shown in Table 1, different parameter features are used to characterize different phenomena of model parameter distribution. For example, the interquartile range, standard deviation, and mean deviation of the model parameters are used to characterize the degree of concentration of the model parameter distribution. Other features are similar and will not be repeated here.

[0085] Table 1 Model parameter feature extraction table

[0086]

[0087] Optionally, after extracting the 13 parameter features corresponding to each training round, the 13 parameter features corresponding to each training round can be aggregated into a parameter feature vector, and then the parameter feature vectors corresponding to each training round can be arranged into a feature vector sequence according to the order of the training rounds, and the feature vector sequence is input into the attack detection module 2022 for detection.

[0088] Optionally, the attack detection module 2022 includes a BLSTM model and an MLP model, and the BLSTM model and the MLP model can obtain a detection result after detecting the feature vector sequence. If the detection result indicates that the model has data attack behavior during the training process, the training process of the model is stopped. If the detection result indicates that the model does not have data attack behavior during the training process, the model parameters are output and the model training continues.

[0089] Next, the attack detection module is further introduced.

[0090] Figure 3 FIG. 1 is a schematic diagram of an attack detection module according to an embodiment of the present invention. Figure 3 As shown in the figure, the attack detection module consists of two parts, including the BLSTM model and the MLP model. In the deep learning model training environment, the training process of the AI ​​model is a time series sequence. The BLSTM model used for processing sequence data is to better analyze the change process of the model parameter distribution characteristics, and then distinguish malicious data theft behavior from normal model training.

[0091] The attack detection module will continuously analyze the model parameter features generated by multiple epochs, input these feature sequences into BLSTM for processing, and analyze their correlation and change trends. Among them, the sequence length of BLSTM is the number of models used for parameter distribution feature extraction in the early stage of model training, and the dimension of input features is the number of extracted features. After BLSTM processing, the feature information of each epoch model can be combined to reflect the change of features. BLSTM will output a vector for each feature sequence, which integrates 13 features from different epoch models in the original input and contains feature change information during training.

[0092] The MLP model contains three hidden layers. In order to prevent the detection model from overfitting and enhance its generalization ability, a batch normalization layer is added before each hidden layer and dropout processing is performed. The hidden layers all use the ReLU function as the activation function. The MLP will output a binary (P1, P2), where P1 represents the probability that the AI ​​model is trained normally, and P2 represents the probability that the AI ​​model has performed a data attack operation.

[0093] According to an embodiment of the present invention, a data detection device for a deep learning model is also provided. It should be noted that the data detection device for a deep learning model can be used to execute the data detection method for a deep learning model in the embodiment.

[0094] Figure 4 Schematic diagram of a data detection device for a deep learning model according to an embodiment of the present invention. Figure 4 As shown, the data detection device 400 of the deep learning model may include: an acquisition unit 401, a determination unit 402, a construction unit 403 and a detection unit 404.

[0095] The acquisition unit 401 is used to acquire model parameters of the deep learning model in response to the deep learning model completing the current training round in the target training environment, wherein the target training environment is used to provide training data required for training the deep learning model.

[0096] The determination unit 402 is used to determine a plurality of parameter features based on the model parameters, wherein the plurality of parameter features are used to characterize the parameter distribution results of the model parameters of the deep learning model after the current training round ends.

[0097] Construction unit 403 is used to construct a target feature vector sequence based on multiple parameter features and multiple parameter features corresponding to the training rounds before the current training round, wherein the target feature vector sequence is used to characterize the parameter distribution characteristics of the model parameters of the deep learning model after the end of the current training round, and the changing trend of the model parameters of the deep learning model with the iteration of the training rounds.

[0098] The detection unit 404 is used to detect the target feature vector sequence to obtain a detection result, wherein the detection result is used to characterize whether the deep learning model performs data attack behavior in the current training round, and the data attack behavior is used to characterize whether the deep learning model obtains training data in the target training environment in the current training round.

[0099] Optionally, the determination unit 402 is also used to: perform statistical analysis on the model parameters to obtain multiple parameter features, wherein the multiple parameter features include at least a first parameter feature, a second parameter feature, a third parameter feature and a fourth parameter feature, the first parameter feature is used to characterize the degree of concentration of the model parameter distribution, the second parameter feature is used to characterize the degree of tailing of the model parameter distribution, the third parameter feature is used to characterize the distribution ratio of the model parameters within a specified interval, and the fourth parameter feature is used to characterize the steepness of the probability density curve corresponding to the model parameters, and the specified interval is used to characterize the distribution of the model parameters, the interval between two standard deviations to three standard deviations to the left of the mean of the model parameters, and the interval between two standard deviations to three standard deviations to the right of the mean of the model parameters.

[0100] Optionally, the construction unit 403 is also used to: aggregate multiple parameter features into a feature vector, and aggregate multiple parameter features corresponding to each training round before the current training round into a feature vector, to obtain multiple feature vectors; based on the order of the training rounds, aggregate multiple feature vectors to obtain a target feature vector sequence.

[0101] Optionally, the detection unit 404 is also used to: input the target feature vector sequence into the feature detection model for detection to obtain a detection result, wherein the target feature vector sequence is used to enable the feature detection model to detect the data attack behavior of the deep learning model in the current training round by learning preset detection rules, and the preset detection rules are used to at least characterize the rate of change of the concentration of the model parameter distribution in multiple training rounds, the rate of change of the tailing degree of the model parameter distribution in multiple training rounds, the rate of change of the distribution ratio of the model parameters in a specified interval, and the rate of change of the steepness of the probability density curve corresponding to the model parameters.

[0102] Optionally, the detection result is represented by a tuple, wherein the tuple includes a first probability and a second probability, the first probability is used to characterize the probability that the deep learning model does not perform data attack behavior, and the second probability is used to characterize the probability that the deep learning model performs data attack behavior. The data detection device 400 of the deep learning model is also used to: when the first probability is greater than the second probability, determine that the deep learning model has not performed data attack behavior in the current training round; when the first probability is less than or equal to the second probability, determine that the deep learning model has performed data attack behavior in the current training round.

[0103] Optionally, the data detection device 400 for the deep learning model is also used to: in response to the deep learning model performing a data attack behavior in the current training round, control the target training environment to stop training the deep learning model.

[0104] In this embodiment, during the training process of the deep learning model, after each training round, the key parameter features of the deep learning model are automatically extracted, and based on the key parameter features corresponding to each training round and the previous training round, a target feature vector sequence is generated. Since the target feature vector can not only characterize the parameter distribution characteristics of the deep learning model after each training round, but also characterize the changing trend of the model parameters of the deep learning model with the iteration of the training rounds, by detecting the target feature vector, it is possible to timely determine whether a data attack behavior has occurred in the deep learning model in the current training round, and after a data attack behavior occurs, the training process of the deep learning model is timely blocked, thereby achieving the technical effect of effectively protecting the data security of the training environment, thereby solving the technical problem of being unable to deeply detect data attack behaviors of the deep learning model during the training process.

[0105] According to an embodiment of the present invention, a computer-readable storage medium is also provided, which includes a stored program, wherein the program executes the data detection method of the deep learning model in Example 1.

[0106] According to an embodiment of the present invention, a processor is also provided, which is used to run a program, wherein the data detection method of the deep learning model in Example 1 is executed when the program is running.

[0107] According to another aspect of the embodiments of the present invention, a computer program product is also provided. The program product includes computer instructions, and when the computer instructions are executed by a processor, the data detection method of the deep learning model in Embodiment 1 is implemented.

[0108] The serial numbers of the above embodiments of the present invention are only for description and do not represent the advantages or disadvantages of the embodiments.

[0109] In the above embodiments of the present invention, the description of each embodiment has its own emphasis. For parts that are not described in detail in a certain embodiment, reference can be made to the relevant descriptions of other embodiments.

[0110] In the several embodiments provided in this application, it should be understood that the disclosed technical content can be implemented in other ways. Among them, the device embodiments described above are only schematic. For example, the division of units can be a logical function division. There may be other division methods in actual implementation. For example, multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed can be through some interfaces, indirect coupling or communication connection of units or modules, which can be electrical or other forms.

[0111] The units described as separate components may or may not be physically separated, and the components shown as units may or may not be physical units, that is, they may be located in one place or distributed over multiple units. Some or all of the units may be selected according to actual needs to achieve the purpose of the present embodiment.

[0112] In addition, each functional unit in each embodiment of the present invention may be integrated into one processing unit, or each unit may exist physically separately, or two or more units may be integrated into one unit. The above-mentioned integrated unit may be implemented in the form of hardware or in the form of software functional units.

[0113] If the integrated unit is implemented in the form of a software functional unit and sold or used as an independent functional component, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present invention, in essence, or the part that contributes to the prior art, or all or part of the technical solution can be embodied in the form of a software functional component, which is stored in a storage medium and includes several instructions for a computer device (which can be a personal computer, a server or a network device, etc.) to perform all or part of the steps of the methods of each embodiment of the present invention. The aforementioned storage medium includes: U disk, Read-Only Memory (ROM), Random Access Memory (RAM), mobile hard disk, magnetic disk or optical disk, etc., various media that can store program codes.

[0114] The above are only preferred embodiments of the present invention. It should be pointed out that, for ordinary technicians in this technical field, several improvements and modifications can be made without departing from the principles of the present invention. These improvements and modifications should also be regarded as the scope of protection of the present invention.

Claims

1. A data detection method for a deep learning model, characterized in that: include: In response to the deep learning model completing a current training round in a target training environment, obtaining model parameters of the deep learning model, wherein the target training environment is used to provide training data required for training the deep learning model; Based on the model parameters, determining a plurality of parameter features, wherein the plurality of parameter features are used to characterize parameter distribution results of the model parameters of the deep learning model after the current training round ends; Based on the multiple parameter features and the multiple parameter features corresponding to the training rounds before the current training round, a target feature vector sequence is constructed, wherein the target feature vector sequence is used to characterize the parameter distribution characteristics of the model parameters of the deep learning model after the current training round, and the change trend of the model parameters of the deep learning model with the iteration of the training rounds; The target feature vector sequence is detected to obtain a detection result, wherein the detection result is used to characterize whether the deep learning model performs data attack behavior in the current training round, and the data attack behavior is used to characterize that the deep learning model obtains the training data in the target training environment in the current training round.

2. The method according to claim 1, characterized in that Based on the model parameters, multiple parameter characteristics are determined, including: The model parameters are statistically analyzed to obtain the multiple parameter features, wherein the multiple parameter features include at least a first parameter feature, a second parameter feature, a third parameter feature and a fourth parameter feature, the first parameter feature is used to characterize the concentration degree of the model parameter distribution, the second parameter feature is used to characterize the tailing degree of the model parameter distribution, the third parameter feature is used to characterize the distribution ratio of the model parameters within a specified interval, the fourth parameter feature is used to characterize the steepness of the probability density curve corresponding to the model parameters, and the specified interval is used to characterize the distribution of the model parameters, an interval between two standard deviations and three standard deviations to the left of the mean of the model parameters, and an interval between two standard deviations and three standard deviations to the right of the mean of the model parameters.

3. The method according to claim 1, characterized in that Based on the multiple parameter features and the multiple parameter features respectively corresponding to the training rounds before the current training round, a target feature vector sequence is constructed, including: Aggregating the multiple parameter features into a feature vector, and respectively aggregating the multiple parameter features corresponding to each training round before the current training round into a feature vector, to obtain multiple feature vectors; Based on the order of training rounds, the multiple feature vectors are aggregated to obtain the target feature vector sequence.

4. The method according to claim 1, characterized in that: The target feature vector sequence is detected to obtain a detection result, including: The target feature vector sequence is input into a feature detection model for detection to obtain a detection result, wherein the target feature vector sequence is used to enable the feature detection model to detect the data attack behavior of the deep learning model in the current training round by learning a preset detection rule, and the preset detection rule is used to at least characterize the rate of change of the concentration degree of the model parameter distribution in multiple training rounds, the rate of change of the tailing degree of the model parameter distribution in multiple training rounds, the rate of change of the distribution ratio of the model parameters in a specified interval, and the rate of change of the steepness of the probability density curve corresponding to the model parameters.

5. The method according to claim 4, characterized in that The detection result is represented by a binary group, wherein the binary group includes a first probability and a second probability, the first probability is used to characterize the probability that the deep learning model does not perform a data attack behavior, and the second probability is used to characterize the probability that the deep learning model performs a data attack behavior. The method further includes: In response to the first probability being greater than the second probability, determining that the deep learning model has not performed the data attack behavior in the current training round; In response to the first probability being less than or equal to the second probability, it is determined that the deep learning model has performed the data attack behavior in the current training round.

6. The method according to claim 4, characterized in that The feature detection model includes at least a long short-term memory network model and a multi-layer perceptron model. The long short-term memory network model is used to capture the time dependency in the target feature vector sequence, and the multi-layer perceptron model is used to perform deep classification on the time dependency output by the long short-term memory network model to determine whether the deep learning model executes the data attack behavior in the current training round.

7. The method according to any one of claims 1 to 6, characterized in that The method further comprises: In response to the deep learning model performing the data attack behavior in the current training round, controlling the target training environment to stop training the deep learning model.

8. A data detection device for a deep learning model, characterized in that: include: an acquisition unit, configured to acquire model parameters of the deep learning model in response to the deep learning model completing a current training round in a target training environment, wherein the target training environment is used to provide training data required for training the deep learning model; A determination unit, configured to determine a plurality of parameter features based on the model parameters, wherein the plurality of parameter features are used to characterize parameter distribution results of the model parameters of the deep learning model after the current training round ends; A construction unit, configured to construct a target feature vector sequence based on the multiple parameter features and the multiple parameter features corresponding to the training rounds before the current training round, wherein the target feature vector sequence is used to characterize the parameter distribution characteristics of the model parameters of the deep learning model after the current training round, and the change trend of the model parameters of the deep learning model with the iteration of the training rounds; A detection unit is used to detect the target feature vector sequence to obtain a detection result, wherein the detection result is used to characterize whether the deep learning model performs data attack behavior in the current training round, and the data attack behavior is used to characterize that the deep learning model obtains the training data in the target training environment in the current training round.

9. A computer-readable storage medium, characterized in that: The computer-readable storage medium includes a stored program, wherein when the program is executed by a processor, the device where the storage medium is located is controlled to execute the method according to any one of claims 1 to 7.

10. A processor, characterized in that: The processor is used to run a program, wherein the program executes the method according to any one of claims 1 to 7 when running.

Images