Collaborative Reasoning Method and Device

Abstract

An embodiment of the present invention provides a collaborative inference method and apparatus. The method includes: obtaining a protected intermediate output feature matrix submitted by an edge-side device; the protected intermediate output feature matrix is obtained by inputting input data into the first half of a collaborative inference model to obtain an intermediate output feature matrix and then inputting the intermediate output feature matrix into a defense model; inputting the protected intermediate output feature matrix into the inverse model of the defense model to obtain the intermediate output feature matrix; inputting the intermediate output feature matrix into the second half of the collaborative inference model to obtain an inference result; and transmitting the inference result to the edge-side device so that the edge-side device processes according to the inference result. In the embodiment of the present invention, it is difficult for an attacker to crack the protected intermediate output feature matrix when under a reverse attack, so that reverse attacks can be effectively prevented, and the security of user data transmitted between the edge-side device and the server device is ensured.

Description

Technical Field

[0001] The embodiments of the present invention relate to the technical field of artificial intelligence security, and in particular, to a collaborative inference method, a collaborative inference device, an electronic device, and a computer-readable storage medium. Background Art

[0002] In the AIoT (Artificial Intelligence & Internet of Things) scenario, there are numerous edge devices and nodes, and there are a large number of real-time or near-real-time inference and processing requirements. However, in the AIoT scenario, the end-edge devices (such as intelligent cameras) are severely restricted in terms of computing resources and energy consumption, and it is difficult to complete the inference tasks of huge environmental data locally. Moreover, the limited communication bandwidth makes it impossible for the end-edge devices to transmit all the data to the server devices in the cloud for processing. Therefore, a collaborative inference scheme can be adopted to realize the intelligent applications of the end-edge devices.

[0003] However, currently, the data transmitted between the end-edge devices and the server devices is insufficiently protected. When under reverse attacks, the data transmitted between the end-edge devices and the server devices is likely to be leaked, and the protection of user data cannot be achieved. Summary of the Invention

[0004] The purpose of the embodiments of the present invention is to provide a collaborative inference method to achieve the protection of user data. The specific technical solutions are as follows:

[0005] In the first aspect of the present invention, first, a collaborative inference method is provided, which involves a server device and an end-edge device. The end-edge device deploys the first half of the collaborative inference model and a defense model, and the server device deploys the second half of the collaborative inference model and the inverse model of the defense model. The second half of the collaborative inference model is the part of the collaborative inference model deployed outside the end-edge device. The method includes:

[0006] Obtain the protected intermediate output feature matrix submitted by the end-edge device; wherein, the protected intermediate output feature matrix is obtained by inputting the input data into the first half of the collaborative inference model to obtain the intermediate output feature matrix and then inputting it into the defense model;

[0007] Input the protected intermediate output feature matrix into the inverse model of the defense model to obtain the intermediate output feature matrix;

[0008] Input the intermediate output feature matrix into the second half of the collaborative inference model to obtain an inference result;

[0009] Transmit the inference result to the edge-side device so that the edge-side device processes according to the inference result.

[0010] Optionally, the defense model is a defense model based on a reversible neural network; the defense model includes reversibly connected blocks connected in series in sequence.

[0011] Optionally, before obtaining the protected intermediate output feature matrix submitted by the edge-side device, the method further includes:

[0012] Construct a defense model to be trained; wherein, the defense model is constructed according to the collaborative inference model to be deployed and the service type of the inference task.

[0013] Perform a simulated reverse attack on the collaborative inference model to obtain an attack model.

[0014] Adversarially train the defense model and the attack model according to a preset auxiliary data set to obtain a trained defense model; wherein, the auxiliary data set is the same image data set as that for training the collaborative inference model or the attack model, and / or an image data set with a similar distribution to that for training the collaborative inference model or the attack model.

[0015] Obtain the inverse model of the defense model according to the defense model.

[0016] Optionally, obtaining the inverse model of the defense model according to the defense model includes:

[0017] Connect the reversibly connected blocks of the defense model connected in series in reverse order in series to obtain the inverse model of the defense model.

[0018] Optionally, adversarially training the defense model and the attack model according to a preset auxiliary data set to obtain a trained defense model includes:

[0019] Randomly extract training samples from the preset auxiliary data set.

[0020] Input the training samples into the collaborative inference model to obtain a training intermediate output feature matrix.

[0021] Input the training intermediate output feature matrix into the defense model to obtain a protected training intermediate output feature matrix.

[0022] Input the protected training intermediate output feature matrix into the attack model to obtain a restored training sample.

[0023] Calculate the loss function of the attack model according to the restored training sample and the training sample.

[0024] Determine the loss function of the defense model according to the loss function of the attack model;

[0025] When the loss functions of the attack model and the defense model reach the preset convergence condition, obtain the trained defense model.

[0026] Optionally, the attack model includes at least two heterogeneous attack models.

[0027] Optionally, the edge-side device and the server device communicate with each other in a specified manner.

[0028] In the second aspect of the implementation of the present invention, a collaborative inference device is further provided, which relates to a server device and an edge-side device. The edge-side device is deployed with the first half of the collaborative inference model and the defense model, and the server device is deployed with the second half of the collaborative inference model and the inverse model of the defense model. The second half of the collaborative inference model is the part of the collaborative inference model deployed outside the edge-side device. The device includes:

[0029] The intermediate output feature matrix obtaining module is used to obtain the protected intermediate output feature matrix submitted by the edge-side device; wherein, the protected intermediate output feature matrix is obtained by inputting the input data into the first half of the collaborative inference model to obtain the intermediate output feature matrix and then inputting it into the defense model;

[0030] The intermediate output feature matrix restoration module is used to input the protected intermediate output feature matrix into the inverse model of the defense model to obtain the intermediate output feature matrix;

[0031] The inference result obtaining module is used to input the intermediate output feature matrix into the second half of the collaborative inference model to obtain the inference result;

[0032] The inference result transmission module is used to transmit the inference result to the edge-side device so that the edge-side device processes according to the inference result.

[0033] Optionally, the defense model is a defense model based on a reversible neural network; the defense model includes reversible blocks connected in series in sequence.

[0034] Optionally, the device further includes: a defense model training module, which is used for:

[0035] Construct a defense model to be trained; wherein, the defense model is constructed according to the collaborative inference model to be deployed and the business type of the inference task;

[0036] Perform a simulated reverse attack on the collaborative inference model to obtain an attack model;

[0037] Against-train the defense model and the attack model according to a preset auxiliary data set to obtain a trained defense model; wherein, the auxiliary data set is the same image data set as that for training the collaborative inference model or the attack model, and / or an image data set with a similar distribution to that for training the collaborative inference model or the attack model;

[0038] Obtain the inverse model of the defense model according to the defense model.

[0039] Optionally, a defense model training module is used for:

[0040] Connect the reversible blocks of the defense model connected in series in reverse order to obtain the inverse model of the defense model.

[0041] Optionally, a defense model training module is used for:

[0042] Randomly extract training samples from the preset auxiliary data set;

[0043] Input the training samples into the collaborative inference model to obtain a training intermediate output feature matrix;

[0044] Input the training intermediate output feature matrix into the defense model to obtain a protected training intermediate output feature matrix;

[0045] Input the protected training intermediate output feature matrix into the attack model to obtain restored training samples;

[0046] Calculate the loss function of the attack model according to the restored training samples and the training samples;

[0047] Determine the loss function of the defense model according to the loss function of the attack model;

[0048] When the loss functions of the attack model and the defense model reach a preset convergence condition, obtain the trained defense model.

[0049] Optionally, the attack model includes at least two heterogeneous attack models.

[0050] Optionally, the edge-side device and the server device communicate with each other in a specified manner.

[0051] In another aspect of the implementation of the present invention, a computer-readable storage medium is further provided. Instructions are stored in the computer-readable storage medium, and when it runs on a computer, it causes the computer to execute any one of the above-mentioned collaborative inference methods.

[0052] In yet another aspect of the implementation of the present invention, there is also provided a computer program product containing instructions, which, when running on a computer, causes the computer to execute any one of the above-mentioned collaborative inference methods.

[0053] Compared with the related art, the embodiments of the present invention have at least the following advantages:

[0054] In the embodiments of the present invention, a server device and an edge-side device are involved. The edge-side device is deployed with the first half of the collaborative inference model and the defense model, and the server device is deployed with the second half of the collaborative inference model and the inverse model of the defense model. The second half of the collaborative inference model is the part of the collaborative inference model deployed outside the edge-side device. When the edge-side device and the server device perform collaborative inference, the protected intermediate output feature matrix submitted by the edge-side device is obtained. Among them, the protected intermediate output feature matrix is obtained by inputting the input data into the first half of the collaborative inference model to obtain the intermediate output feature matrix and then inputting it into the defense model. The protected intermediate output feature matrix is input into the inverse model of the defense model to obtain the intermediate output feature matrix. The intermediate output feature matrix is input into the second half of the collaborative inference model to obtain the inference result and transmit it to the edge-side device, so that the edge-side device can process according to the inference result. In the embodiments of the present invention, when the edge-side device and the server device perform collaborative inference, the defense model can be used to convert the intermediate output feature matrix output by the first half of the collaborative inference model into a protected intermediate output feature matrix, making it difficult for attackers to crack the protected intermediate output feature matrix when under reverse attack, thereby effectively preventing reverse attacks and ensuring the security of user data transmitted between the edge-side device and the server device. Moreover, the intermediate output feature matrix can be restored through the inverse model of the defense model, enabling the second half of the collaborative inference model to normally perform inference based on the intermediate output feature matrix and ensuring the availability of the collaborative inference model. BRIEF DESCRIPTION OF THE DRAWINGS

[0055] In order to more clearly illustrate the technical solutions in the embodiments of the present invention or the prior art, the following will briefly introduce the drawings required for the description of the embodiments or the prior art.

[0056] Figure 1 It is a step flow chart of a collaborative inference method provided in the embodiments of the present invention;

[0057] Figure 2 It is a timing diagram of a collaborative inference process provided in the embodiments of the present invention;

[0058] Figure 3 It is a schematic flow chart of an adversarial training process of a defense model and an attack model provided in the embodiments of the present invention;

[0059] Figure 4A flowchart for realizing collaborative inference provided in an embodiment of the present invention;

[0060] Figure 5 A structural block diagram of a collaborative inference device provided in an embodiment of the present invention;

[0061] Figure 6 A structural block diagram of an electronic device provided in an embodiment of the present invention. Detailed implementation manners

[0062] Next, the technical solutions in the embodiments of the present invention will be described with reference to the accompanying drawings in the embodiments of the present invention.

[0063] First, in order to enable those skilled in the art to better understand the embodiments of the present invention, some terms and keywords related to the embodiments of the present invention are described below.

[0064] AIoT: A technology that integrates artificial intelligence technology and Internet of Things technology. Through the Internet of Things, massive data from different dimensions are generated and collected and stored in the cloud and edge devices. Then, through big data analysis, a higher form of artificial intelligence is formed to achieve the digitalization of all things and the intelligent connection of all things.

[0065] Invertible Neural Networks (INVNs): A special type of neural network structure. Its main feature is that it can achieve a bidirectional mapping from input to output and has an invertible property. Since invertible neural networks can achieve a bidirectional mapping from input to output, they can better achieve data reconstruction, restoration, and maintain the integrity of information in these tasks.

[0066] Collaborative inference: Collaborative inference refers to splitting a neural network model according to a certain strategy and then distributing it to intelligent Internet of Things edge devices and cloud servers for joint inference calculation. The edge devices first perform a part of the inference, and then the cloud service completes the remaining inference. By selecting a reasonable splitting position, the communication overhead can be reduced while fully utilizing the computing power of edge-cloud devices, thereby reducing the inference overhead.

[0067] Model Inversion Attack (MIA): An attack method that restores private data based on the inference results of an artificial intelligence model by accessing the artificial intelligence model. The target of a model inversion attack (inverse attack) is usually an image classifier neural network model. In a collaborative inference scenario, the purpose of a model inversion attack is mainly to restore the private data of the edge device based on the intermediate features of the communication between the edge device and the cloud server in the collaborative inference system.

[0068] In a specific implementation, in an AIoT collaborative inference scenario involving edge devices and server devices, the edge devices do not transmit the raw data collected to the server devices, but rather transmit the intermediate output feature matrix obtained through the inference of the previous-layer model, which protects the privacy of the data to a certain extent. However, an attacker can still use the model reverse attack method to restore the obtained intermediate output feature matrix to the input data of the edge device when only being able to access the collaborative inference model API (Application Programming Interface) (i.e., black-box access).

[0069] To protect data privacy in the AIoT collaborative inference scenario, one solution is to use cryptographic algorithms to encrypt the intermediate output feature matrix. However, this method also has some problems. For example, it requires a trusted third party and consumes a large amount of computing resources, etc.; another solution is to design a targeted model collaborative inference method. Such methods have a certain defensive effect on black-box model reverse attacks by modifying the structure and parameters of the collaborative inference model or fine-tuning the overall model during the training phase. However, this solution cannot be quickly deployed on the already trained collaborative inference model, and the defense also has a certain impact on the usability of the model and is difficult to effectively implement in some actual application scenarios.

[0070] In view of this, how to effectively, conveniently and without affecting the usability of the collaborative inference model defend against black-box model reverse attacks and protect user data in the AIoT collaborative inference scenario has become an important problem to be solved by those skilled in the art.

[0071] In view of the above problems, the embodiments of the present invention provide a collaborative inference method for a collaborative inference model based on a reversible neural network to solve the deficiencies of various existing black-box collaborative inference model reverse attack defense strategies in various aspects. The specific content may include:

[0072] On the one hand, construct and train a defense reversible neural network model. Specifically:

[0073] 1) First, construct a reasonable reversible neural network defense model according to the specific business type of the collaborative inference model to be deployed and the inference task; perform a model reverse attack on the collaborative inference model to obtain a black-box model reverse attack model;

[0074] 2) Adversarially train the defense model and the attack model until the two-party game reaches a Nash equilibrium; deploy the trained defense model.

[0075] On the other hand, use the defense model to protect privacy data during the collaborative inference process. Specifically:

[0076] 1) When inference is required, first run the front-end network of the collaborative inference model (the first half of the collaborative inference model) on the edge-side device; use the defense model to protect the intermediate output feature matrix output by the first half of the collaborative inference model.

[0077] 2) The server device receives the protected intermediate output features and restores them using the inverse model of the defense model; the server device uses the restored intermediate output feature matrix as input and performs inference in the second half of the collaborative inference model to obtain the inference result.

[0078] 3) The server device returns the inference result to the edge-side device.

[0079] Applying the collaborative inference method of the collaborative inference model based on the reversible neural network in the embodiments of the present invention can effectively and conveniently defend against black-box model reverse attacks and protect user data in the AIoT collaborative inference scenario without affecting the usability of the collaborative inference model.

[0080] Refer to Figure 1 , which is the step flow chart of a collaborative inference method provided in the embodiments of the present invention. As Figure 1 shown, it involves a server device and an edge-side device. The edge-side device deploys the front half of the collaborative inference model and the defense model. The server device deploys the second half of the collaborative inference model and the inverse model of the defense model. The second half of the collaborative inference model is the part of the collaborative inference model deployed outside the edge-side device. The method can specifically include the following steps:

[0081] Step 101, obtain the protected intermediate output feature matrix submitted by the edge-side device; wherein, the protected intermediate output feature matrix is obtained by inputting the input data into the front half of the collaborative inference model to obtain the intermediate output feature matrix and then inputting it into the defense model.

[0082] In specific implementation, the embodiments of the present invention can be applied to the collaborative inference scenario. Specifically, the collaborative inference scenario usually includes a group of AIoT edge-side devices (such as data collection devices such as AI cameras) and corresponding server devices (cloud / server). The server device and the edge-side device can communicate with each other in a specific manner. Exemplarily, the server device and the edge-side device can use communication protocols such as MQTT (Message Queuing Telemetry Transport), CoAP (Constrained Application Protocol), and HTTP (HyperText Transfer Protocol) to communicate with each other on the public Internet.

[0083] Among them, the data scale usually collected by edge devices is relatively large. For example, video data or image data can be collected through cameras. However, the computing power resources of edge devices are scarce, and the limitations of network bandwidth and power consumption are relatively strict. Edge devices cannot independently complete inference for some intelligent application requirements, and it is also difficult to transmit all the collected data to the server devices in the cloud. In addition, there are also some privacy protection requirements for the data collected by edge devices. Server devices are deployed in the cloud and have more powerful computing power than edge devices. Due to the bandwidth limitation of edge devices, in the collaborative inference mode, the intermediate output feature matrix of the sample is calculated on the edge device and then transmitted to the server device in the cloud. The transmission process of the intermediate output feature matrix is not completely trustworthy, and there is a risk of being intercepted by attackers and suffering from black box model reverse attacks.

[0084] Therefore, in the embodiments of the present invention, the first half of the collaborative inference model (the front-layer collaborative inference model) and the defense model are deployed on the edge device, and the second half of the collaborative inference model and the inverse model of the defense model are deployed in the server device. Among them, the input of the first half of the collaborative inference model can be the input data collected by the edge device, such as images or videos, etc. The output of the first half of the collaborative inference model is the intermediate feature output matrix. The second half of the collaborative inference model is the part of the collaborative inference model deployed outside the edge device. The input of the second half of the collaborative inference model is the intermediate feature output matrix, and the output can be the classification result of the image sample. The inverse model of the defense model is a neural network model with a strict inverse function to the defense model obtained based on the reversibility of the reversible neural network. Its input is the protected intermediate output feature matrix, and the output is the unprotected intermediate output feature matrix. Among them, the strict inverse function can enable the inverse operation to completely restore the original input data and will not produce errors or inconsistent results. Therefore, through the inverse model of the defense model, the protected intermediate output feature matrix can be completely restored to the intermediate output feature matrix without losing or damaging the intermediate output feature matrix, thus ensuring the availability of the collaborative inference model.

[0085] Among them, the defense model is a defense model based on a reversible neural network. Specifically, the defense model is a reasonable reversible neural network defense model constructed according to the specific business type of the collaborative inference model to be deployed and the inference task. The collaborative inference model is a protected model that has been trained and needs to be deployed in the collaborative inference system. In the embodiment of the present invention, the collaborative inference model is an image classifier model. The specific inference tasks include various AI inference tasks such as image recognition, speech recognition, and text generation. For different specific inference tasks, the structure of the defense model can be adjusted accordingly. For example, a convolutional structure is used to construct the defense model in image tasks, and a transformer structure is used in text generation tasks, etc. Exemplarily, the specific inference task is to identify the target in the image and classify the target. The target classification can include, but is not limited to, cats, dogs, birds, cars, airplanes, ships, etc. The embodiment of the present invention can use a convolutional reversible neural network as the defense model, and the defense model can include one or more reversible blocks. Specifically, a reversible block refers to a module or operation with reversible properties that can completely restore the original input data through an inverse operation without losing any information. Currently, reversible blocks can be applied in fields such as encryption and decryption, data compression and decompression, image processing, and neural networks.

[0086] The reversible neural network divides the intermediate features input to each reversible block into two parts, namely x1 and x2. That is, the input of each reversible block is (x1, x2), and the output is (y1, y2). The inference formula is as follows:

[0087] y1 = x1 + F(x2)

[0088] y2 = x2 + G(y2)

[0089] Among them, F and G are called residual functions, which can be 3x3 convolutional layers, so that the resolution and the number of input channels of the intermediate features remain unchanged. Then the reverse of the reversible neural network block can be expressed as follows:

[0090] x2 = y2 - G(y1)

[0091] x1 = y1 - F(x2)

[0092] The defense model containing multiple reversible blocks only needs to connect multiple reversible blocks in series in sequence. The inverse model of the defense model only needs to connect the reversible blocks in reverse series in sequence. When reversing, only need to run each reversible block in reverse along the reverse direction of the series connection.

[0093] In an embodiment of the present invention, when an inference requirement occurs, for example, when the edge-side device collects data samples, or when the user uses the AI inference function through the edge-side device, the collected data samples can be used as the input data of the edge-side device. Inference is performed on the edge-side device to obtain an intermediate output feature matrix, and the defense model is used to protect the intermediate output feature matrix (intermediate features / intermediate output features), and then it is transmitted to the server device. Taking the sample x0 to be inferred as the input, through the first half of the collaborative inference model f edge perform inference to obtain the intermediate output feature matrix v0 = f edge (x0), and then perform inference through the defense model f def to obtain the protected intermediate output feature v′0 = f def (v0), and then send it to the server device for the next step of processing. By protecting the intermediate output feature matrix v0, it is difficult for malicious attackers to reconstruct private data from the feature matrix, thus achieving the effect of protecting edge-side privacy.

[0094] It should be noted that since the defense model in the embodiment of the present invention is a defense model based on a reversible neural network, it is completely unnecessary to modify the collaborative inference model to be deployed, and the reduction model of the server device can restore the intermediate input feature matrix to the state before processing, fundamentally eliminating the influence of the traditional model collaborative inference method on the availability of the collaborative inference model.

[0095] Step 102: Input the protected intermediate output feature matrix into the inverse model of the defense model to obtain the intermediate output feature matrix.

[0096] Among them, the defense model can have technologies such as code obfuscation, anti-debugging, and anti-tampering to prevent reverse attacks and data leakage. Through the defense model, the data and collaborative inference model on the edge-side device can be prevented from being obtained or tampered with by malicious attackers.

[0097] In an embodiment of the present invention, the server device uses the inverse model of the defense model to restore the protected intermediate output feature matrix v′0, that is, v0 = f -1 (v′0). By utilizing the reversibility mechanism of the reversible neural network, the protected intermediate output feature matrix can be restored without loss, while protecting the private data and ensuring the availability of the collaborative inference model.

[0098] Step 103: Input the intermediate output feature matrix into the second half of the collaborative inference model to obtain an inference result.

[0099] In an embodiment of the present invention, the server device uses the intermediate output feature matrix v0 as the input and performs inference through the second half of the collaborative inference model f cloud to obtain the inference result y0 = fcloud (v0).

[0100] Step 104: Transmit the inference result to the edge-side device so that the edge-side device processes according to the inference result.

[0101] In the embodiment of the present invention, after the server device obtains the inference result y0 of the second half of the collaborative inference model f cloud , the inference result y0 is sent back to the edge-side device. In this way, the edge-side device can perform further processing according to the inference result. For example, it can be sent to the user so that the user can perform corresponding processing according to the inference result.

[0102] Exemplarily, referring to Figure 2 , a timing diagram of a collaborative inference process provided in the embodiment of the present invention, which involves a user, an edge-side device, and a server device. The specific timing process includes: 1. The user generates an inference requirement; 2. The edge-side device uses the first half of the collaborative inference model for inference; 3. The edge-side device adds protection using the defense model, specifically, converting the intermediate output feature matrix output by the first half of the collaborative inference model into a protected intermediate output feature matrix using the defense model; 4. The edge-side device transmits the protected intermediate output feature matrix to the server device; 5. The server device restores the protected intermediate output feature matrix using the inverse model of the defense model to obtain the intermediate output feature matrix; 6. The server device uses the first half of the collaborative inference model to obtain an inference result; 7. The server device returns the inference result to the edge-side device; 8. The edge-side device returns the inference result to the user.

[0103] Embodiments of the present invention can be applied in a variety of scenarios. For example: 1. Computer vision technology holds broad application prospects in public services such as public safety, traffic management, and urban governance. However, due to limited budgets, deploying sufficient computing power on various surveillance camera nodes is impossible. Furthermore, providing dedicated networks with sufficient bandwidth for surveillance cameras is also difficult. Therefore, collaborative inference technology is needed to share computing power and bandwidth pressures. By treating surveillance cameras scattered throughout the city as edge devices, more of the computing load can be distributed to cloud servers deployed in computer rooms. Because communications between surveillance cameras and cloud servers occur over the public internet, these data packets are at risk of being intercepted. Hackers can then use model reversal attacks to reconstruct the surveillance video captured by the surveillance cameras from these data packets. This poses a privacy threat and also poses a significant public security risk. By deploying a reversible neural network defense mechanism constructed using a convolutional network architecture between surveillance cameras and cloud servers, this can effectively prevent hacker model reversal attacks, thereby ensuring the confidentiality of urban surveillance data. 2. Many deep learning applications exist on mobile devices, such as intelligent object recognition, intelligent image processing, photo clustering and classification, and audio transcription. Mobile devices have limited computing power and need to consider battery power consumption, while collaborative reasoning can share computing workloads through collaboration between local and cloud resources. This approach can improve efficiency, especially when raw data bandwidth resources are consumed. However, during the transmission process from mobile devices to the cloud, sensitive data involved in reasoning is still at risk of being stolen. The reversible neural network defense mechanism proposed in this solution can protect the privacy of mobile device users. 3. Currently, a number of voice / text interactive intelligent terminal devices based on large language models have appeared on the market. Among them, large language models are often deployed in the cloud. However, the method of directly uploading the text data requested by users to the cloud server lacks data protection and is extremely vulnerable to hacker theft. Collaborative reasoning technology can be used and a reversible neural network defense mechanism constructed by the transformer network structure can be deployed to protect the privacy of information interacting between users and large models and improve the user experience.

[0104] In an embodiment of the present invention, a server device and an edge-side device are involved. The edge-side device deploys a first half of a collaborative inference model and a defense model, and the server device deploys a second half of the collaborative inference model and an inverse model of the defense model. The second half of the collaborative inference model is the part of the collaborative inference model deployed outside the edge-side device. When the edge-side device and the server device perform collaborative inference, a protected intermediate output feature matrix submitted by the edge-side device is obtained. The protected intermediate output feature matrix is obtained by inputting the input data into the first half of the collaborative inference model to obtain an intermediate output feature matrix and then inputting it into the defense model. The protected intermediate output feature matrix is input into the inverse model of the defense model to obtain an intermediate output feature matrix. The intermediate output feature matrix is input into the second half of the collaborative inference model to obtain an inference result and transmit it to the edge-side device, so that the edge-side device can process according to the inference result. In the embodiment of the present invention, when the edge-side device and the server device perform collaborative inference, the defense model can be used to convert the intermediate output feature matrix output by the first half of the collaborative inference model into a protected intermediate output feature matrix, making it difficult for an attacker to crack the protected intermediate output feature matrix when under a reverse attack, thereby effectively preventing reverse attacks and ensuring the security of user data transmitted between the edge-side device and the server device. Moreover, the intermediate output feature matrix can be restored through the inverse model of the defense model, enabling the second half of the collaborative inference model to normally perform inference based on the intermediate output feature matrix and ensuring the usability of the collaborative inference model.

[0105] In an embodiment of the present invention, before obtaining the protected intermediate output feature matrix submitted by the edge-side device, the method may further include:

[0106] Construct a defense model to be trained; wherein, the defense model is constructed according to the collaborative inference model to be deployed and the business type of the inference task;

[0107] Perform a simulated reverse attack on the collaborative inference model to obtain an attack model;

[0108] Adversarially train the defense model and the attack model according to a preset auxiliary data set to obtain a trained defense model; wherein, the auxiliary data set is the same image data set as that for training the collaborative inference model or the attack model, and / or an image data set with a similar distribution to that for training the collaborative inference model or the attack model;

[0109] Obtain the inverse model of the defense model according to the defense model.

[0110] In an embodiment of the present invention, a black-box model reverse attack is performed on the collaborative inference model to obtain an attack model. The black-box model reverse attack refers to a privacy attack method in which an attacker, while having access to the collaborative inference model and being able to intercept the intermediate output features of the collaborative inference model, but without knowing the structure and parameter values of the collaborative inference model (i.e., in a black-box scenario), restores the input sample data of the collaborative inference model through the intermediate output features of the collaborative inference model, thereby stealing the user's private data.

[0111] In an embodiment of the present invention, the attack model includes at least two heterogeneous attack models. To prevent the defense model from overfitting to a specific attack method, two heterogeneous black-box model reverse attack methods are used to perform the attack. Among them, performing the black-box model reverse attack means that, in order to obtain the attack model, technicians start from the perspective of the attacker and use the conditions in the black-box scenario to simulate an attack on the collaborative inference model through existing attack methods. The attack model is an important deep neural network model trained in the black-box model reverse attack method, with the intermediate output feature matrix of the collaborative inference model as its input and the restored image of the input image sample as its output.

[0112] In an embodiment of the present invention, an auxiliary dataset is used to adversarially train the defense model and the attack model until the two-party game reaches a Nash equilibrium. The auxiliary dataset is sample data of the same type as the input of the collaborative inference model. In an embodiment of the present invention, the auxiliary dataset can use the same image dataset as the one used to train the collaborative inference model or the attack model, or can also use other image datasets with similar distributions.

[0113] In an embodiment of the present invention, based on the training mechanism of adversarial training, the attack model and the defense model are adversarially trained so that the attack model and the defense model play against each other, and a defense model with a better resistance effect against the model reverse attack can be obtained. In addition, using multiple heterogeneous attack models to adversarially train the defense model can prevent the defense model from overfitting to a specific attack model structure, improve the robustness, generalization ability of the defense model, and the defense ability against various attack methods.

[0114] In an embodiment of the present invention, obtaining an inverse model of the defense model according to the defense model includes:

[0115] Reversely connecting the sequentially connected reversible blocks of the defense model in sequence to obtain the inverse model of the defense model.

[0116] In a specific implementation, the defense model may include multiple reversible blocks, and is successively composed of multiple reversible blocks connected in series. For example, B1→B2→B2→B4. By connecting the reverses of the above reversible blocks in series, the order of the reversible blocks of the defense model is B4→B3→B2→B1, that is, the inverse model of the defense model. Based on the inverse model of the defense model, the protected intermediate output feature matrix output by the defense model can be restored to the intermediate output feature matrix.

[0117] In an embodiment of the present invention, the defense model and the attack model are adversarially trained according to a preset auxiliary data set to obtain a trained defense model, including:

[0118] Randomly extract training samples from the preset auxiliary data set;

[0119] Input the training samples into the collaborative inference model to obtain a training intermediate output feature matrix;

[0120] Input the training intermediate output feature matrix into the defense model to obtain a protected training intermediate output feature matrix;

[0121] Input the protected training intermediate output feature matrix into the attack model to obtain a restored training sample;

[0122] Calculate the loss function of the attack model according to the restored training sample and the training sample;

[0123] Determine the loss function of the defense model according to the loss function of the attack model;

[0124] When the loss function of the attack model and the loss function of the defense model reach the preset convergence condition, the trained defense model is obtained.

[0125] Refer to Figure 3 , which is a schematic flowchart of the adversarial training process of a defense model and an attack model provided in an embodiment of the present invention. The specific steps in the adversarial training process are as follows:

[0126] S2.1. Randomly extract a training sample x from the training data set D (preset auxiliary data set);

[0127] S2.2. Using the training sample x as the input, perform inference through the front-layer collaborative inference model f edge to obtain an intermediate output feature matrix v = f edge (x). The front-layer collaborative inference model is the part of the collaborative inference model f deployed on the edge-side device. Its input is an image sample, and its output is an intermediate feature output matrix;

[0128] S2.3. Using the intermediate output feature matrix v as the input, use the defense model fdef Perform inference to protect the intermediate output feature matrix, i.e., v′ = f def (v), where v′ is the protected intermediate output feature matrix;

[0129] S2.4. Use the protected intermediate output feature matrix v′ as the input and perform inference with the attack models g1 and g2 to attempt to restore the training sample x, i.e., where are the restored images obtained by the two heterogeneous attack models respectively;

[0130] S2.5. Calculate the loss function of the attack models where L mse is the mean squared error between the two images;

[0131] S2.6. With the goal of minimizing the loss function and use the stochastic gradient descent algorithm to update the parameters of the attack models g1 and g2 once respectively;

[0132] S2.7. Repeat steps S2.1 - S2.6 n g times, where n g represents the number of update rounds of the attack models g1 and g2;

[0133] S2.8. Repeat steps S2.1 - S2.4 once;

[0134] S2.9. Calculate the loss function of the defense model

[0135] S2.10. With the goal of minimizing the loss function use the stochastic gradient descent algorithm to update the parameters of the defense model f def once;

[0136] S2.11. Repeat steps S2.8 - S2.10 n f times, where n f represents the number of update rounds of the defense model f def ;

[0137] S2.12. Repeat steps S2.1 - S1.11 until the defense model f def and the attack models g1 and g2 converge.

[0138] In the embodiments of the present invention, after obtaining the defense model, the collaborative inference model to be deployed and the defense model can be correspondingly deployed to the server device and the edge - side device, and then collaborative inference can be implemented through the server device and the edge - side device.

[0139] To enable those skilled in the art to better understand the embodiments of the present invention, a complete example is used for illustration below. Refer to Figure 4 , which is a flowchart for implementing collaborative inference provided in the embodiments of the present invention. The specific process includes:

[0140] S1. Construct a reasonable reversible neural network defense model according to the collaborative inference model to be deployed and the specific business type of the inference task.

[0141] S2. Perform a black-box model reverse attack on the collaborative inference model to obtain an attack model. The black-box model reverse attack refers to a privacy attack method in which the attacker, when having access to the collaborative inference model and being able to intercept the intermediate output feature matrix of the collaborative inference model, but without knowing the structure and parameter values of the collaborative inference model (i.e., in the black box), restores the input sample data of the collaborative inference model through the intermediate output features of the collaborative inference model, thereby stealing user privacy data.

[0142] S3. Use the auxiliary dataset to adversarially train the defense model and the attack model until the game between the defense model and the attack model reaches a Nash equilibrium. The auxiliary dataset is sample data of the same type as the input of the collaborative inference model.

[0143] S4. Deploy the front-layer collaborative inference model and the defense model on the edge-side device; deploy the reverse model of the latter half of the collaborative inference model and the defense model on the server device.

[0144] S5. When an inference requirement appears, the edge-side device performs inference, protects the intermediate output feature matrix with the defense model, and then transmits it to the server device.

[0145] S6. The server device restores the protected intermediate output feature matrix with the inverse model of the defense model.

[0146] S7. The server device uses the intermediate output feature matrix as the input and performs inference through the latter half of the collaborative inference model to obtain an inference result;

[0147] S8. The server device transmits the inference result of the collaborative inference model back to the edge-side device.

[0148] Through training a reversible defense model and protecting and restoring through the defense model and the inverse model of the defense model, the embodiments of the present invention achieve the effect of protecting the collaborative inference model from black-box model reverse attacks without affecting the usability of the collaborative inference model.

[0149] It should be noted that for the method embodiments, for the sake of simple description, they are all expressed as a series of action combinations. However, those skilled in the art should be aware that the embodiments of the present invention are not limited by the described action sequences, because according to the embodiments of the present invention, certain steps can be performed in other sequences or simultaneously. Secondly, those skilled in the art should also be aware that the embodiments described in the specification are all preferred embodiments, and the actions involved are not necessarily essential for the embodiments of the present invention.

[0150] Referring to Figure 5 , which is a structural block diagram of a collaborative inference device provided in an embodiment of the present invention. As Figure 5 shown, it involves a server device and an edge-side device. The edge-side device deploys the first half of the collaborative inference model and a defense model. The server device deploys the second half of the collaborative inference model and the inverse model of the defense model. The second half of the collaborative inference model is the part of the collaborative inference model deployed outside the edge-side device. The device may specifically include the following modules:

[0151] The intermediate output feature matrix obtaining module 501 is used to obtain the protected intermediate output feature matrix submitted by the edge-side device; wherein, the protected intermediate output feature matrix is obtained by inputting the input data into the first half of the collaborative inference model to obtain the intermediate output feature matrix and then inputting it into the defense model.

[0152] The intermediate output feature matrix restoring module 502 is used to input the protected intermediate output feature matrix into the inverse model of the defense model to obtain the intermediate output feature matrix.

[0153] The inference result obtaining module 503 is used to input the intermediate output feature matrix into the second half of the collaborative inference model to obtain the inference result.

[0154] The inference result transmission module 504 is used to transmit the inference result to the edge-side device so that the edge-side device processes according to the inference result.

[0155] In an embodiment of the present invention, the defense model is a defense model based on a reversible neural network; the defense model includes reversible blocks connected in series in sequence.

[0156] In an embodiment of the present invention, the device further includes: a defense model training module, which is used for:

[0157] Constructing a defense model to be trained; wherein, the defense model is constructed according to the collaborative inference model to be deployed and the business type of the inference task.

[0158] Performing a simulated reverse attack on the collaborative inference model to obtain an attack model.

[0159] Train the defense model and the attack model against each other according to a preset auxiliary data set to obtain a trained defense model; wherein, the auxiliary data set is the same image data set as the one used to train the collaborative inference model or the attack model, and / or an image data set with a similar distribution to the one used to train the collaborative inference model or the attack model.

[0160] Obtain the inverse model of the defense model according to the defense model.

[0161] In an embodiment of the present invention, the defense model training module is used for:

[0162] Connect the reversible blocks of the defense model connected in series in reverse order to obtain the inverse model of the defense model.

[0163] In an embodiment of the present invention, the defense model training module is used for:

[0164] Randomly extract training samples from the preset auxiliary data set;

[0165] Input the training samples into the collaborative inference model to obtain a training intermediate output feature matrix;

[0166] Input the training intermediate output feature matrix into the defense model to obtain a protected training intermediate output feature matrix;

[0167] Input the protected training intermediate output feature matrix into the attack model to obtain restored training samples;

[0168] Calculate the loss function of the attack model according to the restored training samples and the training samples;

[0169] Determine the loss function of the defense model according to the loss function of the attack model;

[0170] When the loss functions of the attack model and the defense model reach the preset convergence condition, obtain the trained defense model.

[0171] In an embodiment of the present invention, the attack model includes at least two heterogeneous attack models.

[0172] In an embodiment of the present invention, the edge-side device communicates with the server device in a specified manner.

[0173] In an embodiment of the present invention, a server device and an edge-side device are involved. The edge-side device deploys a first half of the collaborative inference model and a defense model, and the server device deploys a second half of the collaborative inference model and the inverse model of the defense model. The second half of the collaborative inference model is the part of the collaborative inference model deployed outside the edge-side device. When the edge-side device and the server device perform collaborative inference, a protected intermediate output feature matrix submitted by the edge-side device is obtained. The protected intermediate output feature matrix is obtained by inputting the input data into the first half of the collaborative inference model to obtain the intermediate output feature matrix and then inputting it into the defense model. The protected intermediate output feature matrix is input into the inverse model of the defense model to obtain the intermediate output feature matrix. The intermediate output feature matrix is input into the second half of the collaborative inference model to obtain the inference result and transmit it to the edge-side device, so that the edge-side device can process according to the inference result. In the embodiment of the present invention, when the edge-side device and the server device perform collaborative inference, the defense model can be used to convert the intermediate output feature matrix output by the first half of the collaborative inference model into a protected intermediate output feature matrix, making it difficult for the attacker to crack the protected intermediate output feature matrix when under a reverse attack, thereby effectively preventing the reverse attack and ensuring the security of the user data transmitted between the edge-side device and the server device. Moreover, the intermediate output feature matrix can be restored through the inverse model of the defense model, enabling the second half of the collaborative inference model to normally perform inference based on the intermediate output feature matrix, ensuring the usability of the collaborative inference model.

[0174] For the above device embodiment, since it is basically similar to the method embodiment, the description is relatively simple. For related parts, refer to the partial description of the method embodiment.

[0175] An embodiment of the present invention also provides an electronic device, as Figure 6 shown, including a processor 601, a communication interface 602, a memory 603, and a communication bus 604. Among them, the processor 601, the communication interface 602, and the memory 603 communicate with each other through the communication bus 604.

[0176] The memory 603 is used to store a computer program.

[0177] The processor 601 is used to implement the collaborative inference method described in any one of the above embodiments when executing the program stored in the memory 603.

[0178] The communication bus mentioned in the above terminal may be a Peripheral Component Interconnect (PCI) bus, an Extended Industry Standard Architecture (EISA) bus, or the like. The communication bus can be divided into an address bus, a data bus, a control bus, etc. For the sake of convenience of representation, only a thick line is used in the figure, but it does not mean that there is only one bus or one type of bus.

[0179] The communication interface is used for communication between the above terminal and other devices.

[0180] The memory may include a Random Access Memory (RAM), or may also include a non-volatile memory, such as at least one disk memory. Optionally, the memory may also be at least one storage device located far from the aforementioned processor.

[0181] The above-mentioned processor may be a general-purpose processor, including a Central Processing Unit (CPU), a Network Processor (NP), etc.; it may also be a Digital Signal Processor (DSP), an Application Specific Integrated Circuit (ASIC), a Field-Programmable Gate Array (FPGA), or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components.

[0182] In another embodiment provided by the present invention, a computer-readable storage medium is also provided. Instructions are stored in the computer-readable storage medium, and when it runs on a computer, the computer is caused to execute the collaborative reasoning method described in any one of the above embodiments.

[0183] In another embodiment provided by the present invention, a computer program product containing instructions is also provided. When it runs on a computer, the computer is caused to execute the collaborative reasoning method described in any one of the above embodiments.

[0184] It should be noted that in the embodiments of the present invention, the use of user data may be involved. In practical applications, user-specific personal data can be used in the solutions described herein within the scope permitted by applicable laws and regulations of the country where it is located (for example, with the explicit consent of the user, giving the user a practical notice, etc.).

[0185] In the above embodiments, it can be implemented in whole or in part by software, hardware, firmware, or any combination thereof. When implemented using software, it can be implemented in whole or in part in the form of a computer program product. The computer program product includes one or more computer instructions. When the computer program instructions are loaded and executed on a computer, the processes or functions described in the embodiments of the present invention are generated in whole or in part. The computer can be a general-purpose computer, a special-purpose computer, a computer network, or other programmable devices. The computer instructions can be stored in a computer-readable storage medium or transmitted from one computer-readable storage medium to another. For example, the computer instructions can be transmitted from one website, computer, server, or data center to another website, computer, server, or data center by wire (such as coaxial cable, optical fiber, digital subscriber line (DSL)) or wireless (such as infrared, wireless, microwave, etc.). The computer-readable storage medium can be any available medium that can be accessed by a computer or a data storage device such as a server or a data center that includes one or more integrated available media. The available medium can be a magnetic medium (for example, a floppy disk, a hard disk, a magnetic tape), an optical medium (for example, a DVD), or a semiconductor medium (for example, a solid-state disk (SSD)).

[0186] It should be noted that in this article, relational terms such as first and second are only used to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply any actual relationship or order between these entities or operations. Moreover, the term "comprising", "including", or any other variant thereof is intended to cover non-exclusive inclusion, so that a process, method, article, or device including a series of elements includes not only those elements but also other elements not explicitly listed, or also includes elements inherent to such a process, method, article, or device. Without further limitation, an element defined by the statement "including one..." does not exclude the existence of additional identical elements in the process, method, article, or device including the element.

[0187] Each embodiment in this specification is described in a related manner. For the same or similar parts among the embodiments, reference can be made to each other. Each embodiment focuses on the differences from other embodiments. In particular, for the system embodiment, since it is basically similar to the method embodiment, the description is relatively simple, and for the related parts, reference can be made to the partial description of the method embodiment.

[0188] The above description is only a preferred embodiment of the present invention and is not intended to limit the protection scope of the present invention. Any modifications, equivalent replacements, improvements, etc. made within the spirit and principle of the present invention are included in the protection scope of the present invention.

Claims

1. A collaborative reasoning method, characterized in that, It involves a server device and an edge-side device. The edge-side device deploys a first half of a collaborative inference model and a defense model. The server device deploys a second half of the collaborative inference model and an inverse model of the defense model. The second half of the collaborative inference model is the part of the collaborative inference model deployed outside the edge-side device. The method includes: Construct a defense model to be trained; wherein, the defense model is constructed according to the collaborative inference model to be deployed and the business type of the inference task; Perform a simulated reverse attack on the collaborative inference model to obtain an attack model; Adversarially train the defense model and the attack model according to a preset auxiliary dataset to obtain a trained defense model, including: randomly extracting training samples from the preset auxiliary dataset; inputting the training samples into the collaborative inference model to obtain a training intermediate output feature matrix; inputting the training intermediate output feature matrix into the defense model to obtain a protected training intermediate output feature matrix; inputting the protected training intermediate output feature matrix into the attack model to obtain a restored training sample; calculating the loss function of the attack model according to the restored training sample and the training sample; determining the loss function of the defense model according to the loss function of the attack model; when the loss functions of the attack model and the defense model reach a preset convergence condition, obtain the trained defense model; Obtain the protected intermediate output feature matrix submitted by the edge-side device; wherein, the protected intermediate output feature matrix is obtained by inputting the input data into the first half of the collaborative inference model to obtain an intermediate output feature matrix and then inputting it into the defense model; Input the protected intermediate output feature matrix into the inverse model of the defense model to obtain the intermediate output feature matrix; Input the intermediate output feature matrix into the second half of the collaborative inference model to obtain an inference result; Transmit the inference result to the edge-side device so that the edge-side device processes according to the inference result.

2. The method according to claim 1, characterized in that, The defense model is a defense model based on a reversible neural network; the defense model includes sequentially connected reversible blocks.

3. The method according to claim 2, wherein Before obtaining the protected intermediate output feature matrix submitted by the edge-side device, the method further includes: The auxiliary dataset is the same image dataset as that for training the collaborative inference model or the attack model, and / or an image dataset with a similar distribution to that for training the collaborative inference model or the attack model; Obtain the inverse model of the defense model according to the defense model.

4. The method according to claim 3, wherein Obtaining the inverse model of the defense model according to the defense model includes: Connect the sequentially connected reversible blocks of the defense model in reverse order to obtain the inverse model of the defense model.

5. The method according to claim 1, wherein The attack model includes at least two heterogeneous attack models.

6. The method according to claim 1, wherein The edge-side device communicates with the server device in a specified manner.

7. A collaborative reasoning device, characterized in that, It relates to a server device and an edge-side device. The edge-side device deploys a first half of a collaborative inference model and a defense model, and the server device deploys a second half of the collaborative inference model and an inverse model of the defense model. The second half of the collaborative inference model is the part of the collaborative inference model deployed outside the edge-side device. The device includes: A defense model training module, configured to: Construct a defense model to be trained; wherein, the defense model is constructed according to the collaborative inference model to be deployed and the business type of the inference task; Perform a simulated reverse attack on the collaborative inference model to obtain an attack model; Adversarially train the defense model and the attack model according to a preset auxiliary dataset to obtain a trained defense model, including: randomly extracting training samples from the preset auxiliary dataset; inputting the training samples into the collaborative inference model to obtain a training intermediate output feature matrix; inputting the training intermediate output feature matrix into the defense model to obtain a protected training intermediate output feature matrix; inputting the protected training intermediate output feature matrix into the attack model to obtain restored training samples; calculating a loss function of the attack model according to the restored training samples and the training samples; determining a loss function of the defense model according to the loss function of the attack model; when the loss function of the attack model and the loss function of the defense model reach a preset convergence condition, obtaining the trained defense model; An intermediate output feature matrix obtaining module, configured to obtain a protected intermediate output feature matrix submitted by the edge-side device; wherein, the protected intermediate output feature matrix is obtained by inputting input data into the first half of the collaborative inference model to obtain an intermediate output feature matrix and then inputting the intermediate output feature matrix into the defense model; An intermediate output feature matrix restoration module, configured to input the protected intermediate output feature matrix into the inverse model of the defense model to obtain the intermediate output feature matrix; An inference result obtaining module, configured to input the intermediate output feature matrix into the second half of the collaborative inference model to obtain an inference result; An inference result transmission module, configured to transmit the inference result to the edge-side device so that the edge-side device processes according to the inference result.

8. An electronic device, characterized in that, It includes a processor, a communication interface, a memory, and a communication bus. Among them, the processor, the communication interface, and the memory communicate with each other through the communication bus; The memory is used for storing a computer program; The processor, when executing the program stored on the memory, implements the method steps described in any one of claims 1-6.

9. A computer-readable storage medium having a computer program stored thereon, characterized in that, When the program is executed by the processor, it implements the method described in any one of claims 1-6.

Images