Cooperative reasoning method and device

Abstract

The embodiment of the invention provides a collaborative reasoning method and device. The method comprises the following steps: acquiring a protected intermediate output feature matrix submitted by end side equipment; the protected intermediate output feature matrix is obtained by inputting the input data into the front half collaborative reasoning model to obtain the intermediate output feature matrix and then inputting the intermediate output feature matrix into the defense model; inputting the protected intermediate output feature matrix into an inverse model of the defense model to obtain an intermediate output feature matrix; inputting the middle output characteristic matrix into the rear half part collaborative reasoning model to obtain a reasoning result; and the reasoning result is transmitted to the end side equipment, so that the end side equipment carries out processing according to the reasoning result. According to the embodiment of the invention, an attacker is difficult to crack the protected intermediate output feature matrix when the device is subjected to a reverse attack, so that the reverse attack can be effectively prevented, and the security of user data transmitted between the end side equipment and the server equipment is ensured.

Description

Technical Field

[0001] Embodiments of the present invention relate to the field of artificial intelligence security technology, and in particular, to a collaborative reasoning method, a collaborative reasoning device, an electronic device, and a computer-readable storage medium. Background Art

[0002] There are a large number of edge devices and nodes in the AIoT (Artificial Intelligence & Internet of Things) scenario, and there are a lot of real-time or near-real-time reasoning and processing requirements. However, in the AIoT scenario, edge devices (such as smart cameras) are subject to strict restrictions on computing resources and energy consumption, making it difficult to complete the reasoning tasks of huge environmental data locally. The limited communication bandwidth makes it impossible for edge devices to transmit the full amount of data to the cloud server device for processing. Therefore, a collaborative reasoning solution can be used to realize the intelligent application of edge devices.

[0003] However, currently, the protection of data transmitted between the edge devices and the server devices is insufficient. When subjected to a reverse attack, the data transmitted between the edge devices and the server devices may be easily leaked, and user data cannot be protected. Summary of the invention

[0004] The purpose of the embodiment of the present invention is to provide a collaborative reasoning method to protect user data. The specific technical solution is as follows:

[0005] In a first aspect of the implementation of the present invention, a collaborative reasoning method is first provided, involving a server device and an edge device, wherein the edge device is deployed with a first half collaborative reasoning model and a defense model, and the server device is deployed with a second half collaborative reasoning model and an inverse model of the defense model, wherein the second half collaborative reasoning model is a part of the collaborative reasoning model deployed outside the edge device, and the method comprises:

[0006] Obtaining a protected intermediate output feature matrix submitted by the edge device; wherein the protected intermediate output feature matrix is ​​obtained by inputting input data into the first half collaborative reasoning model to obtain an intermediate output feature matrix and then inputting it into the defense model;

[0007] Inputting the protected intermediate output feature matrix into the inverse model of the defense model to obtain the intermediate output feature matrix;

[0008] Inputting the intermediate output feature matrix into the second half collaborative reasoning model to obtain a reasoning result;

[0009] The inference result is transmitted to the edge device so that the edge device performs processing according to the inference result.

[0010] Optionally, the defense model is a defense model based on a reversible neural network; the defense model includes reversible blocks connected in series.

[0011] Optionally, before obtaining the protected intermediate output feature matrix submitted by the edge-side device, the method further includes:

[0012] Constructing a defense model to be trained; wherein the defense model is constructed according to the collaborative reasoning model to be deployed and the business type of the reasoning task;

[0013] Implementing a simulated reverse attack on the collaborative reasoning model to obtain an attack model;

[0014] The defense model and the attack model are trained against each other according to a preset auxiliary data set to obtain a trained defense model; wherein the auxiliary data set is the same image data set as the image data set for training the collaborative reasoning model or the attack model, and or the image data set for training the collaborative reasoning model or the attack model has a similar distribution;

[0015] An inverse model of the defense model is obtained according to the defense model.

[0016] Optionally, obtaining an inverse model of the defense model according to the defense model includes:

[0017] The reversible blocks of the defense model that are connected in series in sequence are connected in reverse order in sequence to obtain an inverse model of the defense model.

[0018] Optionally, the defense model and the attack model are antagonistically trained according to a preset auxiliary data set to obtain a trained defense model, including:

[0019] Randomly extracting training samples from the preset auxiliary data set;

[0020] Inputting the training samples into the collaborative reasoning model to obtain a training intermediate output feature matrix;

[0021] Inputting the training intermediate output feature matrix into the defense model to obtain a protected training intermediate output feature matrix;

[0022] Inputting the protected training intermediate output feature matrix into the attack model to obtain a restored training sample;

[0023] Calculating a loss function of the attack model according to the restored training sample and the training sample;

[0024] Determining the loss function of the defense model according to the loss function of the attack model;

[0025] When the loss function of the attack model and the loss function of the defense model reach a preset convergence condition, the trained defense model is obtained.

[0026] Optionally, the attack model includes at least two heterogeneous attack models.

[0027] Optionally, the terminal-side device and the server device communicate with each other in a specified manner.

[0028] In a second aspect of the implementation of the present invention, a collaborative reasoning device is further provided, involving a server device and an edge device, wherein the edge device is deployed with a first half collaborative reasoning model and a defense model, and the server device is deployed with a second half collaborative reasoning model and an inverse model of the defense model, wherein the second half collaborative reasoning model is a part of the collaborative reasoning model deployed outside the edge device, and the device comprises:

[0029] An intermediate output feature matrix obtaining module, used to obtain the protected intermediate output feature matrix submitted by the edge device; wherein the protected intermediate output feature matrix is ​​obtained by inputting the input data into the first half collaborative reasoning model to obtain the intermediate output feature matrix and then inputting it into the defense model;

[0030] An intermediate output feature matrix restoration module, used for inputting the protected intermediate output feature matrix into the inverse model of the defense model to obtain the intermediate output feature matrix;

[0031] An inference result obtaining module, used for inputting the intermediate output feature matrix into the second half collaborative inference model to obtain an inference result;

[0032] The inference result transmission module is used to transmit the inference result to the edge device so that the edge device processes according to the inference result.

[0033] Optionally, the defense model is a defense model based on a reversible neural network; the defense model includes reversible blocks connected in series.

[0034] Optionally, the device further comprises: a defense model training module, configured to:

[0035] Constructing a defense model to be trained; wherein the defense model is constructed according to the collaborative reasoning model to be deployed and the business type of the reasoning task;

[0036] Implementing a simulated reverse attack on the collaborative reasoning model to obtain an attack model;

[0037] The defense model and the attack model are trained against each other according to a preset auxiliary data set to obtain a trained defense model; wherein the auxiliary data set is the same image data set as the image data set for training the collaborative reasoning model or the attack model, and or the image data set for training the collaborative reasoning model or the attack model has a similar distribution;

[0038] An inverse model of the defense model is obtained according to the defense model.

[0039] Optionally, a defense model training module is used to:

[0040] The reversible blocks of the defense model that are connected in series in sequence are connected in reverse order in sequence to obtain an inverse model of the defense model.

[0041] Optionally, a defense model training module is used to:

[0042] Randomly extracting training samples from the preset auxiliary data set;

[0043] Inputting the training samples into the collaborative reasoning model to obtain a training intermediate output feature matrix;

[0044] Inputting the training intermediate output feature matrix into the defense model to obtain a protected training intermediate output feature matrix;

[0045] Inputting the protected training intermediate output feature matrix into the attack model to obtain a restored training sample;

[0046] Calculating a loss function of the attack model according to the restored training sample and the training sample;

[0047] Determining the loss function of the defense model according to the loss function of the attack model;

[0048] When the loss function of the attack model and the loss function of the defense model reach a preset convergence condition, the trained defense model is obtained.

[0049] Optionally, the attack model includes at least two heterogeneous attack models.

[0050] Optionally, the terminal-side device and the server device communicate with each other in a specified manner.

[0051] In another aspect of the present invention, a computer-readable storage medium is provided, wherein instructions are stored in the computer-readable storage medium, and when the computer-readable storage medium is run on a computer, the computer executes any of the collaborative reasoning methods described above.

[0052] In yet another aspect of the present invention, a computer program product comprising instructions is provided, which, when executed on a computer, enables the computer to execute any of the collaborative reasoning methods described above.

[0053] Compared with the related art, the embodiments of the present invention have at least the following advantages:

[0054] In an embodiment of the present invention, a server device and an edge device are involved. The edge device is deployed with a first half collaborative reasoning model and a defense model. The server device is deployed with a second half collaborative reasoning model and an inverse model of the defense model. The second half collaborative reasoning model is the part of the collaborative reasoning model deployed outside the edge device. When the edge device and the server device perform collaborative reasoning, a protected intermediate output feature matrix submitted by the edge device is obtained, wherein the protected intermediate output feature matrix is ​​obtained by inputting input data into the first half collaborative reasoning model to obtain an intermediate output feature matrix and then inputting it into the defense model. The protected intermediate output feature matrix is ​​input into the inverse model of the defense model to obtain an intermediate output feature matrix. The intermediate output feature matrix is ​​input into the second half collaborative reasoning model to obtain an inference result and transmitted to the edge device, so that the edge device can process according to the inference result. In an embodiment of the present invention, when an end-side device and a server device perform collaborative reasoning, a defense model can be used to convert an intermediate output feature matrix output by the first half of the collaborative reasoning model into a protected intermediate output feature matrix, so that it is difficult for an attacker to crack the protected intermediate output feature matrix when subjected to a reverse attack, thereby effectively preventing reverse attacks and ensuring the security of user data transmitted between the end-side device and the server device. In addition, the intermediate output feature matrix can be restored through the inverse model of the defense model, so that the second half of the collaborative reasoning model can perform reasoning normally according to the intermediate output feature matrix, thereby ensuring the availability of the collaborative reasoning model. BRIEF DESCRIPTION OF THE DRAWINGS

[0055] In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the following briefly introduces the drawings required for use in the embodiments or the description of the prior art.

[0056] Figure 1 A flowchart of a collaborative reasoning method provided in an embodiment of the present invention;

[0057] Figure 2 A timing diagram of a collaborative reasoning process provided in an embodiment of the present invention;

[0058] Figure 3 A schematic diagram of a process of adversarial training of a defense model and an attack model provided in an embodiment of the present invention;

[0059] Figure 4A flowchart for implementing collaborative reasoning provided in an embodiment of the present invention;

[0060] Figure 5 A structural block diagram of a collaborative reasoning device provided in an embodiment of the present invention;

[0061] Figure 6 The present invention is a block diagram of an electronic device provided in an embodiment of the present invention. DETAILED DESCRIPTION

[0062] The technical solutions in the embodiments of the present invention will be described below in conjunction with the accompanying drawings in the embodiments of the present invention.

[0063] First, in order to enable those skilled in the art to better understand the embodiments of the present invention, some terms and keywords involved in the embodiments of the present invention are explained below.

[0064] AIoT: Integrating artificial intelligence technology and Internet of Things technology, the Internet of Things generates and collects massive amounts of data from different dimensions and stores them in the cloud and edge. Through big data analysis, a higher form of artificial intelligence is formed to realize the technology of digitizing and intelligently connecting all things.

[0065] Invertible Neural Networks (INVNs): A special type of neural network structure, whose main feature is that it can realize bidirectional mapping from input to output and has reversible properties. Since reversible neural networks can realize bidirectional mapping from input to output, they can better achieve data reconstruction, restoration and maintain information integrity in these tasks.

[0066] Collaborative reasoning: Collaborative reasoning refers to splitting the neural network model according to a certain strategy, and then distributing it to the smart IoT end-side devices and cloud servers for joint reasoning calculations. The end-side devices first perform part of the reasoning, and then the cloud service completes the rest of the reasoning. By choosing a reasonable split location, the computing power of the edge-cloud devices can be fully utilized while reducing communication overhead, thereby reducing reasoning overhead.

[0067] Model Inversion Attack (MIA): An attack method that restores private data based on the inference results of the AI ​​model by accessing the AI ​​model. The target of the model inversion attack (MIA) is usually the image classifier neural network model. In the collaborative reasoning scenario, the purpose of the model inversion attack is mainly to restore the private data on the edge side based on the intermediate features of the communication between the edge side devices and the cloud server in the collaborative reasoning system.

[0068] In the specific implementation, in the AIoT collaborative reasoning scenario involving edge devices and server devices, the edge devices do not transmit the collected raw data to the server devices, but transmit the intermediate output feature matrix obtained through the front-layer model reasoning, which protects the privacy of the data to a certain extent. However, attackers can still restore the intermediate output feature matrix to the input data of the edge devices through the model reverse attack method when they can only access the collaborative reasoning model API (Application Programming Interface) (i.e. black box access).

[0069] In order to protect data privacy in AIoT collaborative reasoning scenarios, one solution is to use cryptographic algorithms to encrypt the intermediate output feature matrix. However, this method also has some problems, such as the need for a trusted third party and the consumption of more computing resources. Another solution is to design targeted model collaborative reasoning methods. Such methods have a certain defensive effect against reverse attacks on black box models by modifying the structure and parameters of the collaborative reasoning model during the training phase or fine-tuning the overall model. However, this solution cannot be quickly deployed on an already trained collaborative reasoning model, and the defense also has a certain degree of impact on the availability of the model, making it difficult to effectively implement in some practical application scenarios.

[0070] In view of this, how to defend against black box model reverse attacks and protect user data as effectively and conveniently as possible in the AIoT collaborative reasoning scenario without affecting the availability of the collaborative reasoning model has become an important problem that technical personnel in this field need to solve.

[0071] In view of the above problems, in order to solve the deficiencies in various aspects of the existing reverse attack defense strategies of various black box collaborative reasoning models, the embodiments of the present invention provide a collaborative reasoning method of a collaborative reasoning model based on a reversible neural network, and the specific contents may include:

[0072] On the one hand, we build and train a defensive reversible neural network model. Specifically:

[0073] 1) First, a reasonable reversible neural network defense model is constructed according to the specific business types of the collaborative reasoning model to be deployed and the reasoning task; a model reverse attack is performed on the collaborative reasoning model to obtain a black box model reverse attack model;

[0074] 2) Adversarially train the defense model and the attack model until the game between the two parties reaches a Nash equilibrium; deploy the trained defense model.

[0075] On the other hand, the defense model is used to protect private data during collaborative reasoning. Specifically:

[0076] 1) When reasoning is required, the front-layer network of the collaborative reasoning model (the first half of the collaborative reasoning model) is first run on the edge device; the defense model is used to protect the intermediate output feature matrix output by the first half of the collaborative reasoning model;

[0077] 2) The server device receives the protected intermediate output features and restores them using the inverse model of the defense model; the server device uses the restored intermediate output feature matrix as input, performs reasoning in the second half of the collaborative reasoning model, and obtains the reasoning result;

[0078] 3) The server device returns the inference results to the edge device.

[0079] The collaborative reasoning method of the collaborative reasoning model based on a reversible neural network in the embodiment of the present invention can effectively and conveniently defend against reverse attacks on black box models and protect user data in the AIoT collaborative reasoning scenario without affecting the availability of the collaborative reasoning model.

[0080] Reference Figure 1 , is a flowchart of a collaborative reasoning method provided in an embodiment of the present invention, such as Figure 1 As shown, it involves a server device and an edge device, the edge device is deployed with a first half collaborative reasoning model and a defense model, the server device is deployed with a second half collaborative reasoning model and an inverse model of the defense model, the second half collaborative reasoning model is a part of the collaborative reasoning model deployed outside the edge device, and the method may specifically include the following steps:

[0081] Step 101: Obtain a protected intermediate output feature matrix submitted by the edge-side device; wherein the protected intermediate output feature matrix is ​​obtained by inputting input data into the first half of the collaborative reasoning model to obtain an intermediate output feature matrix and then inputting it into the defense model.

[0082] In a specific implementation, the embodiments of the present invention can be applied to collaborative reasoning scenarios. Specifically, a group of AIoT edge devices (such as data acquisition devices such as AI cameras) and corresponding server devices (cloud / server) can usually be included in the collaborative reasoning scenario. The server device and the edge device can communicate with each other in a specific manner. Exemplarily, the server device and the edge device can communicate with each other on the public Internet using communication protocols such as MQTT (Message Queuing Telemetry Transport), CoAP (Constrained Application Protocol), and HTTP (HyperText Transfer Protocol).

[0083] Among them, the data collected by the edge devices is usually relatively large. For example, video data or image data can be collected through cameras. However, the edge devices have fewer computing resources, and the network bandwidth and power consumption are more stringent. They cannot independently complete reasoning for some intelligent application requirements, and it is difficult to transmit the full amount of collected data to the cloud server device. In addition, the data collected by the edge devices also have some privacy protection requirements. The server device is deployed in the cloud and has more powerful computing power than the edge devices. Due to the bandwidth limitation of the edge devices, the collaborative reasoning mode is adopted. The intermediate output feature matrix of the sample is calculated on the edge device and then transmitted to the cloud server device. The transmission process of the intermediate output feature matrix is ​​not completely reliable, and there is a risk of being intercepted by attackers and implementing a black box model reverse attack.

[0084] Therefore, in an embodiment of the present invention, the first half of the collaborative reasoning model (front-layer collaborative reasoning model) and the defense model are deployed on the edge device, and the second half of the collaborative reasoning model and the inverse model of the defense model are deployed in the server device, wherein the input of the first half of the collaborative reasoning model can be the input data collected by the edge device, such as images or videos, etc., and the output of the first half of the collaborative reasoning model is the intermediate feature output matrix. The second half of the collaborative reasoning model is the part of the collaborative reasoning model deployed outside the edge device. The input of the second half of the collaborative reasoning model is the intermediate feature output matrix, and the output can be the classification result of the image sample. The inverse model of the defense model is a neural network model with a strict inverse function with the defense model obtained based on the reversibility of the reversible neural network, and its input is the protected intermediate output feature matrix, and the output is the unprotected intermediate output feature matrix. Among them, the strict inverse function can enable the inverse operation to completely restore the original input data, and will not produce erroneous or inconsistent results. Therefore, after the inverse model of the defense model, the protected intermediate output feature matrix can be completely restored to the intermediate output feature matrix, and the intermediate output feature matrix will not be lost or damaged, thereby ensuring the availability of the collaborative reasoning model.

[0085] Among them, the defense model is a defense model based on a reversible neural network. Specifically, the defense model is a reasonable reversible neural network defense model constructed according to the specific business type of the collaborative reasoning model to be deployed and the reasoning task. The collaborative reasoning model is a trained model to be protected that needs to be deployed in the collaborative reasoning system. In an embodiment of the present invention, the collaborative reasoning model is an image classifier model, and the specific reasoning tasks include various AI reasoning tasks such as image recognition, speech recognition, and text generation. For different specific reasoning tasks, the structure of the defense model can be adjusted accordingly. For example, a convolutional structure is used to build a defense model in an image task, and a transformer structure is used in a text generation task. Exemplarily, the specific reasoning task is to identify targets in an image and classify the targets. The target classification may include but is not limited to cats, dogs, birds, cars, airplanes, ships, etc. In an embodiment of the present invention, a convolutional reversible neural network can be used as a defense model, and the defense model may include one or more reversible blocks. Specifically, a reversible block refers to a module or operation with a reversible property, which can completely restore the original input data through an inverse operation without losing any information. At present, the reversible block can be applied to encryption and decryption, data compression and decompression, image processing, neural networks and other fields.

[0086] The reversible neural network divides the intermediate features input to each reversible block into two parts, namely x 1 and x 2 That is, the input of each reversible block is (x 1 ,x 2 ), the output is (y 1 ,y 2 ), the inference formula is as follows:

[0087] y 1 =x 1 +F(x 2 )

[0088] y 2 =x 2 +G(y 2 )

[0089] Among them, F and G are called residual functions, which can be 3x3 convolutional layers, so that the resolution and number of input channels of the intermediate features remain unchanged. Then the inverse of the reversible neural network block can be expressed as follows:

[0090] x 2 =y 2 -G(y 1 )

[0091] x 1 =y 1 -F(x 2 )

[0092] The defense model containing multiple reversible blocks only needs to connect multiple reversible blocks in series in sequence, and the inverse model of the defense model only needs to connect the reversible blocks in series in reverse order. When reversing, it only needs to run each reversible block in the opposite direction of the series connection.

[0093] In the embodiment of the present invention, when there is a need for inference, for example, when the edge device collects data samples, or when the user uses the AI ​​inference function through the edge device, the collected data samples can be used as input data of the edge device, and the edge device is inferred to obtain an intermediate output feature matrix, and the intermediate output feature matrix (intermediate feature / intermediate output feature) is protected by the defense model and then transmitted to the server device. 0 As input, the collaborative reasoning model f edge Perform inference and obtain the intermediate output feature matrix v 0 =f edge (x 0 ), and then through the defense model f def Perform inference and obtain the protected intermediate output feature v′ 0 =f def (v 0 ), and then sent to the server device for further processing. 0 Protection is provided so that it is difficult for malicious attackers to reconstruct private data from the feature matrix, thereby achieving the effect of protecting the privacy of the edge side.

[0094] It should be noted that since the defense model of the embodiment of the present invention is a defense model based on a reversible neural network, there is no need to modify the collaborative reasoning model to be deployed, and the restoration model of the server device can restore the intermediate input feature matrix to the state before processing, fundamentally eliminating the impact of traditional model collaborative reasoning methods on the availability of the collaborative reasoning model.

[0095] Step 102: Input the protected intermediate output feature matrix into the inverse model of the defense model to obtain the intermediate output feature matrix.

[0096] Among them, the defense model can have technologies such as code obfuscation, anti-debugging, and anti-tampering to prevent reverse attacks and data leakage. Through the defense model, the data on the edge devices and the collaborative reasoning model can be prevented from being obtained or tampered with by malicious attackers.

[0097] In the embodiment of the present invention, the server device uses the inverse model of the defense model to restore the protected intermediate output feature matrix v′ 0 , that is, v 0 =f -1 (v′ 0). By utilizing the reversibility mechanism of the reversible neural network, the protected intermediate output feature matrix can be restored losslessly, ensuring the availability of the collaborative reasoning model while protecting the privacy data.

[0098] Step 103: input the intermediate output feature matrix into the second half collaborative reasoning model to obtain a reasoning result.

[0099] In the embodiment of the present invention, the server device outputs the intermediate feature matrix v 0 As input, the second half of the collaborative reasoning model f cloud By reasoning, we can get the inference result y 0 =f cloud (v 0 ).

[0100] Step 104: Transmit the inference result to the edge-side device so that the edge-side device performs processing according to the inference result.

[0101] In the embodiment of the present invention, the server device obtains the second half of the collaborative reasoning model f cloud The inference result y 0 After that, the inference result y 0 The result is transmitted back to the end-side device, so that the end-side device can perform further processing based on the inference result. For example, it can be sent to the user so that the user can perform corresponding processing based on the inference result.

[0102] For example, refer to Figure 2 , is a timing diagram of a collaborative reasoning process provided in an embodiment of the present invention, involving a user, an end-side device and a server device, and the specific timing process includes: 1. The user generates a reasoning demand; 2. The end-side device uses the first half of the collaborative reasoning model for reasoning; 3. The end-side device uses the defense model to add protection, specifically, using the defense model to convert the intermediate output feature matrix output by the first half of the collaborative reasoning model into a protected intermediate output feature matrix; 4. The end-side device transmits the protected intermediate output feature matrix to the server device; 5. The server device uses the inverse model of the defense model to restore the protected intermediate output feature matrix to obtain the intermediate output feature matrix; 6. The server device uses the first half of the collaborative reasoning model for reasoning to obtain the reasoning result; 7. The server device returns the reasoning result to the end-side device; 8. The end-side device returns the reasoning result to the user.

[0103] The embodiments of the present invention can be applied to a variety of scenarios. For example: 1. Computer vision technology has broad application prospects in public service fields such as public safety, traffic management, and urban governance. However, considering the limited budget, it is impossible to deploy sufficient computing power on various surveillance camera nodes, and it is difficult to lay a dedicated network with sufficient bandwidth for surveillance cameras. Therefore, it is necessary to use collaborative reasoning technology to share the computing power and bandwidth pressure, and use surveillance cameras scattered throughout the city as end-side devices to distribute more computing loads to cloud servers deployed in the computer room. Since the communication between the surveillance camera and the cloud server passes through the public Internet, these data packets are at risk of being intercepted. At this time, hackers can restore the surveillance video captured by the surveillance camera from these data packets through model reverse attacks. While causing privacy threats, it also has a greater public security risk. By using this solution, a reversible neural network defense mechanism constructed by a convolutional network structure is deployed between the surveillance camera and the cloud server, which can effectively prevent hackers' model reverse attacks, thereby ensuring the confidentiality of urban surveillance data. 2. There are many deep learning applications on mobile devices, such as intelligent object recognition, intelligent image processing, album clustering classification, and audio transcription. Mobile devices have limited computing power and need to consider battery power consumption, while collaborative reasoning can share computing workloads through collaboration between local and cloud. This method can improve efficiency, especially when the original data bandwidth resource consumption is large. However, during the transmission process from the mobile device to the cloud, the sensitive data involved in the reasoning is still at risk of being stolen. The reversible neural network defense mechanism proposed in this scheme can protect the privacy of mobile device users. 3. At present, a number of voice / text interactive intelligent terminal devices based on large language models have appeared on the market. Among them, large language models are often deployed in the cloud. However, the method of directly uploading the text data requested by the user to the cloud server lacks data protection, and the data is extremely easy to be stolen by hackers. Collaborative reasoning technology can be used and a reversible neural network defense mechanism built by the transformer network structure can be deployed to protect the privacy of information interacting between users and large models and improve the user experience.

[0104] In an embodiment of the present invention, a server device and an edge device are involved. The edge device is deployed with a first half collaborative reasoning model and a defense model. The server device is deployed with a second half collaborative reasoning model and an inverse model of the defense model. The second half collaborative reasoning model is the part of the collaborative reasoning model deployed outside the edge device. When the edge device and the server device perform collaborative reasoning, a protected intermediate output feature matrix submitted by the edge device is obtained, wherein the protected intermediate output feature matrix is ​​obtained by inputting input data into the first half collaborative reasoning model to obtain an intermediate output feature matrix and then inputting it into the defense model. The protected intermediate output feature matrix is ​​input into the inverse model of the defense model to obtain an intermediate output feature matrix. The intermediate output feature matrix is ​​input into the second half collaborative reasoning model to obtain an inference result and transmitted to the edge device, so that the edge device can process according to the inference result. In an embodiment of the present invention, when an end-side device and a server device perform collaborative reasoning, a defense model can be used to convert an intermediate output feature matrix output by the first half of the collaborative reasoning model into a protected intermediate output feature matrix, so that it is difficult for an attacker to crack the protected intermediate output feature matrix when subjected to a reverse attack, thereby effectively preventing reverse attacks and ensuring the security of user data transmitted between the end-side device and the server device. In addition, the intermediate output feature matrix can be restored through the inverse model of the defense model, so that the second half of the collaborative reasoning model can perform reasoning normally according to the intermediate output feature matrix, thereby ensuring the availability of the collaborative reasoning model.

[0105] In an embodiment of the present invention, before obtaining the protected intermediate output feature matrix submitted by the edge-side device, the method may further include:

[0106] Constructing a defense model to be trained; wherein the defense model is constructed according to the collaborative reasoning model to be deployed and the business type of the reasoning task;

[0107] Implementing a simulated reverse attack on the collaborative reasoning model to obtain an attack model;

[0108] The defense model and the attack model are trained against each other according to a preset auxiliary data set to obtain a trained defense model; wherein the auxiliary data set is the same image data set as the image data set for training the collaborative reasoning model or the attack model, and or the image data set for training the collaborative reasoning model or the attack model has a similar distribution;

[0109] An inverse model of the defense model is obtained according to the defense model.

[0110] In an embodiment of the present invention, a black box model reverse attack is performed on the collaborative reasoning model to obtain an attack model. The black box model reverse attack refers to a privacy attack method in which the attacker can access the collaborative reasoning model and intercept the intermediate output features of the collaborative reasoning model, but does not understand the structure and parameter values ​​of the collaborative reasoning model (i.e., a black box), and restores the collaborative reasoning model input sample data through the intermediate output features of the collaborative reasoning model, thereby stealing the user's private data.

[0111] In one embodiment of the present invention, the attack model includes at least two heterogeneous attack models. In order to prevent the defense model from overfitting to a specific attack method, two heterogeneous black box model reverse attack methods are used to implement the attack. Among them, implementing a reverse attack on a black box model means that in order to obtain the attack model, the technician uses the conditions in the black box scenario from the perspective of the attacker to simulate the attack on the collaborative reasoning model through existing attack methods. The attack model is an important deep neural network model trained in the black box model reverse attack method, and its input is the intermediate output feature matrix of the collaborative reasoning model, and its output is the restored image of the input image sample.

[0112] In an embodiment of the present invention, an auxiliary data set is used to train a defense model and an attack model until the two-party game reaches a Nash equilibrium. The auxiliary data set is sample data of the same type as the collaborative reasoning model input. In an embodiment of the present invention, the auxiliary data set can use the same image data set as the training collaborative reasoning model or the attack model, or other image data sets with similar distribution.

[0113] In the embodiment of the present invention, the attack model and the defense model are trained adversarially based on the training mechanism of adversarial training, so that the attack model and the defense model compete with each other, and a defense model with better resistance to model reverse attack can be obtained. In addition, using multiple heterogeneous attack models to conduct adversarial training on the defense model can prevent the defense model from overfitting to a specific attack model structure, improve the robustness and generalization ability of the defense model, and improve the defense ability against various attack methods.

[0114] In one embodiment of the present invention, obtaining an inverse model of the defense model according to the defense model includes:

[0115] The reversible blocks of the defense model that are connected in series in sequence are connected in reverse order in sequence to obtain an inverse model of the defense model.

[0116] In a specific implementation, the defense model may include multiple reversible blocks, and is composed of multiple reversible blocks connected in series in sequence, for example, B1→B2→B2→B4. The reverse order of the above reversible blocks is connected in series in sequence, and the reversible block order of the defense model is B4→B3→B2→B1, that is, the inverse model of the defense model. Based on the inverse model of the defense model, the protected intermediate output feature matrix output by the defense model can be restored to the intermediate output feature matrix.

[0117] In one embodiment of the present invention, the defense model and the attack model are antagonistically trained according to a preset auxiliary data set to obtain a trained defense model, including:

[0118] Randomly extracting training samples from the preset auxiliary data set;

[0119] Inputting the training samples into the collaborative reasoning model to obtain a training intermediate output feature matrix;

[0120] Inputting the training intermediate output feature matrix into the defense model to obtain a protected training intermediate output feature matrix;

[0121] Inputting the protected training intermediate output feature matrix into the attack model to obtain a restored training sample;

[0122] Calculating a loss function of the attack model according to the restored training sample and the training sample;

[0123] Determining the loss function of the defense model according to the loss function of the attack model;

[0124] When the loss function of the attack model and the loss function of the defense model reach a preset convergence condition, the trained defense model is obtained.

[0125] Reference Figure 3 , is a flowchart of a defense model and an attack model adversarial training process provided in an embodiment of the present invention. The specific steps in the adversarial training process are as follows:

[0126] S2.1, randomly select training samples x from the training data set D (preset auxiliary data set);

[0127] S2.2, taking the training sample x as input, through the front-layer collaborative reasoning model f edge Perform inference and obtain the intermediate output feature matrix v = f edge (x). The front-layer collaborative reasoning model is the part of the collaborative reasoning model f deployed on the edge device, and its input is the image sample and its output is the intermediate feature output matrix;

[0128] S2.3, using the intermediate output feature matrix v as input, using the defense model fdef Perform inference and protect the intermediate output feature matrix, that is, v′=f def (v), where v′ is the protected intermediate output feature matrix;

[0129] S2.4, using the protected intermediate output feature matrix v′ as input, using the attack model g 1 , g 2 Perform inference and try to restore the training sample x, that is in are the restored images obtained by the two heterogeneous attack models;

[0130] S2.5. Calculate the loss function of the attack model Where L mse is the mean square error between the two images;

[0131] S2.6, to minimize the loss function and As the target, use the stochastic gradient descent algorithm to update the attack model g 1 and g 2 Parameters;

[0132] S2.7. Repeat steps S2.1-S2.6 n g times, where n g Represents the attack model g 1 , g 2 The number of update rounds;

[0133] S2.8, repeat steps S2.1-S2.4 once;

[0134] S2.9. Calculate the loss function of the defense model

[0135] S2.10, to minimize the loss function As the goal, use the stochastic gradient descent algorithm to update the defense model f def Parameters;

[0136] S2.11. Repeat steps S2.8-S2.10 n f times, where n f Denotes the defense model f def The number of update rounds;

[0137] S2.12, repeat steps S2.1-S1.11 until the defense model f def and attack model g 1 , g 2 convergence.

[0138] In an embodiment of the present invention, after obtaining the defense model, the collaborative reasoning model and the defense model to be deployed can be deployed to the server device and the end-side device accordingly, and then collaborative reasoning can be achieved through the server device and the end-side device.

[0139] In order to enable those skilled in the art to better understand the embodiments of the present invention, a complete example is used below for illustration. Figure 4 , is a flowchart for implementing collaborative reasoning provided in an embodiment of the present invention, and the specific process includes:

[0140] S1. Build a reasonable reversible neural network defense model based on the specific business types of the collaborative reasoning model and reasoning tasks to be deployed.

[0141] S2. Implement a black box model reverse attack on the collaborative reasoning model to obtain an attack model. The black box model reverse attack refers to a privacy attack method in which the attacker can access the collaborative reasoning model and intercept the intermediate output feature matrix of the collaborative reasoning model, but does not understand the structure and parameter values ​​of the collaborative reasoning model (i.e., black box), and restores the collaborative reasoning model input sample data through the intermediate output features of the collaborative reasoning model, thereby stealing the user's private data.

[0142] S3. Use the auxiliary data set to train the defense model and the attack model against each other until the game between the defense model and the attack model reaches a Nash equilibrium. The auxiliary data set is sample data of the same type as the collaborative reasoning model input.

[0143] S4. Deploy the front-layer collaborative reasoning model and defense model on the edge device; deploy the inverse model of the second-half collaborative reasoning model and defense model on the server device.

[0144] S5. When inference is required, the edge device performs inference and uses the defense model to protect the intermediate output feature matrix, which is then transmitted to the server device.

[0145] S6. The server device restores the protected intermediate output feature matrix using the inverse model of the defense model.

[0146] S7, the server device uses the intermediate output feature matrix as input, performs reasoning through the second half of the collaborative reasoning model, and obtains the reasoning result;

[0147] S8. The server device transmits the reasoning result of the collaborative reasoning model back to the edge device.

[0148] The embodiment of the present invention achieves the effect of protecting the collaborative reasoning model from the reverse attack of the black box model without affecting the availability of the collaborative reasoning model by training a reversible defense model and protecting and restoring the defense model and the inverse model of the defense model.

[0149] It should be noted that, for the sake of simplicity, the method embodiments are described as a series of action combinations, but those skilled in the art should be aware that the embodiments of the present invention are not limited by the order of the actions described, because according to the embodiments of the present invention, certain steps can be performed in other orders or simultaneously. Secondly, those skilled in the art should also be aware that the embodiments described in the specification are all preferred embodiments, and the actions involved are not necessarily required by the embodiments of the present invention.

[0150] Reference Figure 5 , is a structural block diagram of a collaborative reasoning device provided in an embodiment of the present invention, such as Figure 5 As shown, it involves a server device and an edge device, the edge device is deployed with the first half of the collaborative reasoning model and the defense model, the server device is deployed with the second half of the collaborative reasoning model and the inverse model of the defense model, the second half of the collaborative reasoning model is the part of the collaborative reasoning model deployed outside the edge device, and the device may specifically include the following modules:

[0151] The intermediate output feature matrix obtaining module 501 is used to obtain the protected intermediate output feature matrix submitted by the edge device; wherein the protected intermediate output feature matrix is ​​obtained by inputting the input data into the first half collaborative reasoning model to obtain the intermediate output feature matrix and then inputting it into the defense model;

[0152] An intermediate output feature matrix restoration module 502, used for inputting the protected intermediate output feature matrix into the inverse model of the defense model to obtain the intermediate output feature matrix;

[0153] The inference result obtaining module 503 is used to input the intermediate output feature matrix into the second half collaborative inference model to obtain the inference result;

[0154] The inference result transmission module 504 is used to transmit the inference result to the edge device so that the edge device processes according to the inference result.

[0155] In one embodiment of the present invention, the defense model is a defense model based on a reversible neural network; the defense model includes reversible blocks connected in series.

[0156] In one embodiment of the present invention, the device further comprises: a defense model training module, which is used to:

[0157] Constructing a defense model to be trained; wherein the defense model is constructed according to the collaborative reasoning model to be deployed and the business type of the reasoning task;

[0158] Implementing a simulated reverse attack on the collaborative reasoning model to obtain an attack model;

[0159] The defense model and the attack model are trained against each other according to a preset auxiliary data set to obtain a trained defense model; wherein the auxiliary data set is the same image data set as the image data set for training the collaborative reasoning model or the attack model, and or the image data set for training the collaborative reasoning model or the attack model has a similar distribution;

[0160] An inverse model of the defense model is obtained according to the defense model.

[0161] In one embodiment of the present invention, the defense model training module is used to:

[0162] The reversible blocks of the defense model that are connected in series in sequence are connected in reverse order in sequence to obtain an inverse model of the defense model.

[0163] In one embodiment of the present invention, the defense model training module is used to:

[0164] Randomly extracting training samples from the preset auxiliary data set;

[0165] Inputting the training samples into the collaborative reasoning model to obtain a training intermediate output feature matrix;

[0166] Inputting the training intermediate output feature matrix into the defense model to obtain a protected training intermediate output feature matrix;

[0167] Inputting the protected training intermediate output feature matrix into the attack model to obtain a restored training sample;

[0168] Calculating a loss function of the attack model according to the restored training sample and the training sample;

[0169] Determining the loss function of the defense model according to the loss function of the attack model;

[0170] When the loss function of the attack model and the loss function of the defense model reach a preset convergence condition, the trained defense model is obtained.

[0171] In one embodiment of the present invention, the attack model includes at least two heterogeneous attack models.

[0172] In an embodiment of the present invention, the edge-side device and the server device communicate with each other in a specified manner.

[0173] In an embodiment of the present invention, a server device and an edge device are involved. The edge device is deployed with a first half collaborative reasoning model and a defense model. The server device is deployed with a second half collaborative reasoning model and an inverse model of the defense model. The second half collaborative reasoning model is the part of the collaborative reasoning model deployed outside the edge device. When the edge device and the server device perform collaborative reasoning, a protected intermediate output feature matrix submitted by the edge device is obtained, wherein the protected intermediate output feature matrix is ​​obtained by inputting input data into the first half collaborative reasoning model to obtain an intermediate output feature matrix and then inputting it into the defense model. The protected intermediate output feature matrix is ​​input into the inverse model of the defense model to obtain an intermediate output feature matrix. The intermediate output feature matrix is ​​input into the second half collaborative reasoning model to obtain an inference result and transmitted to the edge device, so that the edge device can process according to the inference result. In an embodiment of the present invention, when an end-side device and a server device perform collaborative reasoning, a defense model can be used to convert an intermediate output feature matrix output by the first half of the collaborative reasoning model into a protected intermediate output feature matrix, so that it is difficult for an attacker to crack the protected intermediate output feature matrix when subjected to a reverse attack, thereby effectively preventing reverse attacks and ensuring the security of user data transmitted between the end-side device and the server device. In addition, the intermediate output feature matrix can be restored through the inverse model of the defense model, so that the second half of the collaborative reasoning model can perform reasoning normally according to the intermediate output feature matrix, thereby ensuring the availability of the collaborative reasoning model.

[0174] As for the above-mentioned device embodiment, since it is basically similar to the method embodiment, the description is relatively simple, and the relevant parts can be referred to the partial description of the method embodiment.

[0175] The embodiment of the present invention further provides an electronic device, such as Figure 6 As shown, it includes a processor 601, a communication interface 602, a memory 603 and a communication bus 604, wherein the processor 601, the communication interface 602, and the memory 603 communicate with each other through the communication bus 604.

[0176] Memory 603, used for storing computer programs;

[0177] The processor 601 is used to implement the collaborative reasoning method described in any of the above embodiments when executing the program stored in the memory 603.

[0178] The communication bus mentioned in the above terminal can be a Peripheral Component Interconnect (PCI) bus or an Extended Industry Standard Architecture (EISA) bus, etc. The communication bus can be divided into an address bus, a data bus, a control bus, etc. For ease of representation, only one thick line is used in the figure, but it does not mean that there is only one bus or one type of bus.

[0179] The communication interface is used for communication between the above terminal and other devices.

[0180] The memory may include a random access memory (RAM) or a non-volatile memory, such as at least one disk memory. Optionally, the memory may also be at least one storage device located away from the aforementioned processor.

[0181] The above-mentioned processor can be a general-purpose processor, including a central processing unit (CPU), a network processor (NP), etc.; it can also be a digital signal processor (DSP), an application specific integrated circuit (ASIC), a field programmable gate array (FPGA) or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components.

[0182] In another embodiment provided by the present invention, a computer-readable storage medium is also provided, in which instructions are stored. When the computer-readable storage medium is run on a computer, the computer executes the collaborative reasoning method described in any of the above embodiments.

[0183] In another embodiment provided by the present invention, a computer program product including instructions is also provided, which, when executed on a computer, enables the computer to execute the collaborative reasoning method described in any one of the above embodiments.

[0184] It should be noted that the embodiments of the present invention may involve the use of user data. In actual applications, user-specific personal data can be used in the scheme described herein within the scope permitted by applicable laws and regulations, subject to the requirements of applicable laws and regulations of the country where the user is located (for example, with the user's explicit consent, effective notification to the user, etc.).

[0185] In the above embodiments, it can be implemented in whole or in part by software, hardware, firmware or any combination thereof. When implemented by software, it can be implemented in whole or in part in the form of a computer program product. The computer program product includes one or more computer instructions. When the computer program instructions are loaded and executed on a computer, the process or function described in the embodiment of the present invention is generated in whole or in part. The computer can be a general-purpose computer, a special-purpose computer, a computer network, or other programmable device. The computer instructions can be stored in a computer-readable storage medium, or transmitted from one computer-readable storage medium to another computer-readable storage medium. For example, the computer instructions can be transmitted from one website site, computer, server or data center to another website site, computer, server or data center by wired (e.g., coaxial cable, optical fiber, digital subscriber line (DSL)) or wireless (e.g., infrared, wireless, microwave, etc.). The computer-readable storage medium can be any available medium that can be accessed by a computer or a data storage device such as a server or data center that includes one or more available media integrated. The available medium can be a magnetic medium (e.g., a floppy disk, a hard disk, a tape), an optical medium (e.g., a DVD), or a semiconductor medium (e.g., a solid-state hard disk Solid State Disk (SSD)), etc.

[0186] It should be noted that, in this article, relational terms such as first and second, etc. are only used to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Moreover, the terms "include", "comprise" or any other variants thereof are intended to cover non-exclusive inclusion, so that a process, method, article or device including a series of elements includes not only those elements, but also other elements not explicitly listed, or still includes elements inherent to such process, method, article or device. In the absence of further restrictions, the elements defined by the sentence "including one..." do not exclude the existence of other identical elements in the process, method, article or device including the elements.

[0187] Each embodiment in this specification is described in a related manner, and the same or similar parts between the embodiments can be referred to each other, and each embodiment focuses on the differences from other embodiments. In particular, for the system embodiment, since it is basically similar to the method embodiment, the description is relatively simple, and the relevant parts can be referred to the partial description of the method embodiment.

[0188] The above description is only a preferred embodiment of the present invention and is not intended to limit the protection scope of the present invention. Any modification, equivalent replacement, improvement, etc. made within the spirit and principle of the present invention are included in the protection scope of the present invention.

Claims

1. A collaborative reasoning method, characterized in that: Involving a server device and an edge device, the edge device is deployed with a first half collaborative reasoning model and a defense model, the server device is deployed with a second half collaborative reasoning model and an inverse model of the defense model, the second half collaborative reasoning model is a part of the collaborative reasoning model deployed outside the edge device, and the method includes: Obtaining a protected intermediate output feature matrix submitted by the edge device; wherein the protected intermediate output feature matrix is ​​obtained by inputting input data into the first half collaborative reasoning model to obtain an intermediate output feature matrix and then inputting it into the defense model; Inputting the protected intermediate output feature matrix into the inverse model of the defense model to obtain the intermediate output feature matrix; Inputting the intermediate output feature matrix into the second half collaborative reasoning model to obtain a reasoning result; The inference result is transmitted to the edge device so that the edge device performs processing according to the inference result.

2. The method according to claim 1, characterized in that The defense model is a defense model based on a reversible neural network; the defense model includes reversible blocks connected in series in sequence.

3. The method according to claim 2, characterized in that Before obtaining the protected intermediate output feature matrix submitted by the edge-side device, the method further includes: Constructing a defense model to be trained; wherein the defense model is constructed according to the collaborative reasoning model to be deployed and the business type of the reasoning task; Implementing a simulated reverse attack on the collaborative reasoning model to obtain an attack model; The defense model and the attack model are trained against each other according to a preset auxiliary data set to obtain a trained defense model; wherein the auxiliary data set is the same image data set as the image data set for training the collaborative reasoning model or the attack model, and or the image data set for training the collaborative reasoning model or the attack model has a similar distribution; An inverse model of the defense model is obtained according to the defense model.

4. The method according to claim 3, characterized in that Obtaining an inverse model of the defense model according to the defense model includes: The reversible blocks of the defense model that are connected in series in sequence are connected in reverse order in sequence to obtain an inverse model of the defense model.

5. The method according to claim 3, characterized in that: The defense model and the attack model are trained against each other according to a preset auxiliary data set to obtain a trained defense model, including: Randomly extracting training samples from the preset auxiliary data set; Inputting the training samples into the collaborative reasoning model to obtain a training intermediate output feature matrix; Inputting the training intermediate output feature matrix into the defense model to obtain a protected training intermediate output feature matrix; Inputting the protected training intermediate output feature matrix into the attack model to obtain a restored training sample; Calculating a loss function of the attack model according to the restored training sample and the training sample; Determining the loss function of the defense model according to the loss function of the attack model; When the loss function of the attack model and the loss function of the defense model reach a preset convergence condition, the trained defense model is obtained.

6. The method according to claim 5, characterized in that The attack model includes at least two heterogeneous attack models.

7. The method according to claim 1, characterized in that The terminal-side device and the server device communicate with each other in a specified manner.

8. A collaborative reasoning device, characterized in that: The invention relates to a server device and an edge device, wherein the edge device is deployed with a first half collaborative reasoning model and a defense model, and the server device is deployed with a second half collaborative reasoning model and an inverse model of the defense model, wherein the second half collaborative reasoning model is a part of the collaborative reasoning model deployed outside the edge device, and the device comprises: An intermediate output feature matrix obtaining module, used to obtain the protected intermediate output feature matrix submitted by the edge device; wherein the protected intermediate output feature matrix is ​​obtained by inputting the input data into the first half collaborative reasoning model to obtain the intermediate output feature matrix and then inputting it into the defense model; An intermediate output feature matrix restoration module, used for inputting the protected intermediate output feature matrix into the inverse model of the defense model to obtain the intermediate output feature matrix; An inference result obtaining module, used for inputting the intermediate output feature matrix into the second half collaborative inference model to obtain an inference result; The inference result transmission module is used to transmit the inference result to the edge device so that the edge device processes according to the inference result.

9. An electronic device, characterized in that: It includes a processor, a communication interface, a memory and a communication bus, wherein the processor, the communication interface and the memory communicate with each other through the communication bus; Memory, used to store computer programs; A processor, for implementing the method steps described in any one of claims 1 to 7 when executing a program stored in a memory.

10. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the program is executed by a processor, the method according to any one of claims 1 to 7 is implemented.

Images