Feature privacy security measurement method and device and storage medium

Abstract

The invention discloses a feature privacy security measurement method and device and a storage medium, and belongs to the field of information security. In order to solve the problems that an existing method is limited in defense capacity for unknown attacks and depends on specific attack examples, middle layer features are extracted through a pre-training victim model, and the attack success probability is recorded; executing a plurality of inversion attacks and optimizing the model through a defense strategy; constructing a synthetic data set, and training a prediction model to predict an attack success probability; and evaluating the privacy security of the features under different defense strategies by using the trained prediction model. By analyzing the distribution property of the middle layer features, the anti-attack ability of the model in an unknown attack environment can be predicted, the comprehensiveness and generalization ability of privacy protection are improved, and the method is suitable for various models and attack scenes.

Description

Technical Field

[0001] The present invention belongs to the field of information security, and specifically relates to a feature privacy security measurement method, device and storage medium. Background Art

[0002] In the field of artificial intelligence and machine learning, with the widespread application of deep learning models in various data processing tasks, how to protect the model's intermediate layer features from malicious use has become an important privacy protection issue. Especially in the processing of sensitive data (such as medical records, personal biometrics, etc.), the model's intermediate layer features often contain rich information and may be used by attackers to reconstruct or infer the original training data. This inversion attack by extracting and utilizing the model's intermediate layer features has become a significant security threat. Traditional defense strategies, such as data perturbation, model regularization, and the application of homomorphic encryption technology, are often designed for predefined attack patterns. They improve the ability of the intermediate layer to resist known attack patterns by performing specific training or processing on the model.

[0003] Existing technologies mainly focus on combating several known types of attacks, and improve their performance on these known attacks by performing specific defensive training on the model. For example, some methods introduce regularization techniques to reduce the mutual information between the features of the middle layer of the model and the input data, thereby minimizing the possibility of inferring the input data through the model output. Although these strategies perform well against specific types of attacks, they generally lack the ability to generalize to unknown attack patterns, and fail to provide a method to predict the model's resistance to unknown or new attacks. A common feature defense method is Improving Robustness to Model Inversion Attacks via MutualInformation Regularization, which is a method based on regularization technology to reduce the mutual information between the features of the middle layer of the model and the input data. Common attack types include: KEDMI, an attack method based on knowledge enhancement, GMI, an attack method based on generative adversarial networks, and LOMMA, an attack method based on Logit maximization and model enhancement.

[0004] In the prior art, feature-based inversion attacks (inversion attacks here use the output or intermediate layer features of machine learning models to reconstruct the model's input data, thereby infringing user privacy) pose a serious threat to the privacy protection of machine learning models. In past defense strategies, evaluating the effectiveness of defenses usually relied on known attack strategies. However, this approach is less effective when encountering unknown or changing attack patterns. Especially in a dynamically changing security environment, past methods cannot provide continuous and adaptive protection. Summary of the invention

[0005] In response to the above technical problems, the present invention proposes a feature privacy security measurement method. The core of the method of the present invention is to analyze the middle-layer features of the machine learning model to evaluate the privacy security of the feature in the face of unknown attack strategies. By extracting the middle-layer features of the neural network and analyzing their distribution properties, the present invention can predict and measure the privacy protection ability of the model under unknown attack modes.

[0006] The technical solution proposed by the present invention to solve the above technical problems is as follows:

[0007] A feature privacy security measurement method includes the following steps:

[0008] 1) Pre-train the victim model on a private dataset and perform an inversion attack on the victim model, recording the output intermediate layer features and the corresponding attack success probability; improve the victim model through defense strategies, repeat the attack and data collection, and integrate all intermediate layer features and attack success probabilities into a synthetic dataset;

[0009] 2) Use the synthetic dataset to train a prediction model that predicts the probability of attack success based on the input intermediate layer features;

[0010] 3) Use the trained prediction model to process the intermediate layer features of the victim model trained using different defense strategies to predict the probability of successful attack.

[0011] Furthermore, in step 1), the private data set consists of private images and corresponding ID tags, and the victim model is a neural network model for processing classification tasks.

[0012] Furthermore, the inversion attack in step 1) adopts one of the attack methods among KEDMI, GMI and LOMMA.

[0013] Furthermore, the step of inverting the attack in step 1) includes: obtaining the intermediate layer features from the victim model, and performing an image reconstruction attack based on the intermediate layer features through the attack model, and the probability of successful attack is:

[0014]

[0015] Among them, ID(x i ) represents the input image x from the victim model i Sensitive information extracted from is the image reconstructed by the attack model, N is the total number of test samples, and I is the indicator function.

[0016] Furthermore, the defense strategies in steps 1) and 3) include at least one of data perturbation, model regularization, and homomorphic encryption.

[0017] Furthermore, the prediction model in step 2) is a multi-layer neural network model.

[0018] Furthermore, the training model in step 2) uses a binary cross entropy loss function to measure the difference between the predicted probability and the true probability. The binary cross entropy loss function is:

[0019]

[0020] Among them, p attack,i is the probability of a successful attack, is the probability of successful attack predicted by the training model, N is the total number of test samples, and the log base is the natural logarithm.

[0021] Furthermore, in step 2), the training model uses gradient descent or its variant algorithm to minimize the binary cross entropy loss function L(θ) to optimize the model parameter θ.

[0022] A feature privacy security measurement device includes a memory and a processor, wherein the memory stores a computer program, and the processor implements the steps of the above method when executing the computer program.

[0023] A computer-readable storage medium stores a computer program, which implements the steps of the above method when executed.

[0024] The advantages of the present invention are mainly reflected in the following aspects:

[0025] 1. Strong generalization ability: Unlike the existing technology that mainly defends against known attack patterns, the present invention is not limited to known attack patterns, but can predict the model's resistance to unknown attack environments by analyzing the characteristics of the model's intermediate layer. Compared with the existing technology, the present invention not only improves the defense capability against known attacks, but also has the adaptability to deal with new or changing attack strategies, thereby providing stronger generalization ability.

[0026] 2. No reliance on specific attack instances: The present invention does not need to rely on specific attack patterns to improve the model’s anti-attack capabilities. Compared with existing methods that usually require training for specific attacks, the present invention can directly evaluate the model’s anti-attack capabilities by comprehensively analyzing the intermediate layer features, making the defense strategy more flexible and applicable to a wider range of situations.

[0027] 3. Comprehensive privacy protection solution: The present invention is applicable to a variety of machine learning models and attack environments, providing a more comprehensive privacy protection solution. By predicting the performance of the model under different attack scenarios, the present invention can effectively improve the privacy protection level of the model.

[0028] 4. Improve the defense effect in unknown attack environments: By analyzing the distribution of middle-layer features through machine learning and neural networks, the present invention can effectively predict the defense effect of the model in unknown attack environments, providing a more comprehensive solution for privacy protection. DETAILED DESCRIPTION

[0029] In order to make the various technical features and advantages or technical effects in the above technical solutions of the present invention more obvious and easy to understand, they are described in detail below.

[0030] The present invention provides a feature privacy security measurement method, which covers the complete process from data set construction, model training to anti-attack capability prediction. The following are the specific implementation steps:

[0031] 1. Build a synthetic dataset

[0032] To evaluate the privacy security of features, we first need to construct a synthetic dataset containing the model's intermediate layer features and their corresponding attack success probabilities.

[0033] 1) In a private dataset D consisting of private images (such as personal facial images) and corresponding ID tags priv Pre-training is performed on the victim model T to obtain the victim model T. The victim model T is a neural network that handles classification tasks (such as VGG16 and ResNet-34), which can input image x and output T(x), that is, the probability distribution of the image on the downstream classification task (such as face recognition task).

[0034] 2) Perform multiple known inversion attacks on the victim model T (such as KEDMI, GMI, and LOMMA). Record the intermediate layer features z and the corresponding attack success probability p attack , where the probability of successful attack is p attack It is obtained by evaluating the image reconstructed by the attacker (usually using an existing image recognition model to predict the identity of the reconstructed image) and calculating the accuracy.

[0035] 2-1) Target of the inversion attack:

[0036] The main goal of the inversion attack is to use the intermediate layer features z obtained from the victim model T to reconstruct the original input x through the attack model M. This type of attack is particularly targeted at input data containing sensitive information (such as personal facial images, biometrics, or other private data). A successful attack will directly threaten data privacy security.

[0037] 2-2) The input of the attack model M is the intermediate layer feature z=T extracted from the victim model T mid (x), where T midRepresents the function of extracting intermediate layer features in model T. The output of attack model M is the image reconstructed using the input intermediate layer feature z

[0038] The probability p of attack success of attack model M attack :

[0039]

[0040] Where ID(x) represents the sensitive information extracted from image x, such as identity, N is the total number of test samples, and I is the indicator function, i.e.

[0041] 3) The victim model T is adjusted by various defense strategies (such as data perturbation, model regularization, homomorphic encryption, etc.) to obtain the model T ′ , the model T ′ It has better resistance to various attacks. ′ Repeat the above steps to obtain more data.

[0042] 4) Collect all the binary pairs (z, p attack (x)) into a synthetic dataset middle.

[0043] 2. Train the model to predict anti-attack capabilities

[0044] 1) Using the collected synthetic dataset Train a prediction model F that predicts the probability of attack success in downstream attack scenarios based on the intermediate layer feature z prediction model

[0045] 2) The input of the prediction model F is the intermediate layer features Where d is the dimension of the feature. The output of the prediction model F is the predicted attack success probability

[0046] 3) Model structure: Assume that F is a function defined by parameter θ, which can be expressed as: F(z;θ) = σ(g(z;θ)), where g(z;θ) is a function that can be implemented by a multi-layer neural network and is responsible for extracting the probability p of a successful attack from the input feature z. attack,i Related information, and σ is the Sigmoid activation function, which is used to compress the output into the [0,1] interval to represent the probability.

[0047] 4) Training process:

[0048] Loss Function: To train the model F, a binary cross entropy loss function is used to measure the difference between the predicted probability and the true probability:

[0049]

[0050] in The base of log is the natural logarithm.

[0051] Optimization algorithm: Use gradient descent or its variants (such as Adam or RMSprop) to minimize the loss function L(θ) and thus optimize the model parameters θ.

[0052] 5) Validation and model selection: Optimize the model parameters θ and verify the prediction performance of model F through cross-validation and other techniques to ensure good generalization ability to new attack data.

[0053] 3. Privacy security assessment of features

[0054] The trained prediction model F is used to evaluate the privacy security of the intermediate layer features z of the victim model T trained under different defense strategies.

[0055] 1) After adopting different defense strategies for the victim model T, the intermediate layer features z are extracted and the prediction model F is used to evaluate the anti-attack capability.

[0056] 2) The results can help understand the effects of various defense strategies on improving the security of victim models and guide further model design and defense strategy selection.

[0057] Experimental test:

[0058] 1. Experimental Setup

[0059] 1. Private dataset setting: Use a subset of CelebA to select samples containing 1,000 characters, 5 images per character, and a total of 5,000 images. The character IDs are numbered from 0 to 999.

[0060] 2. Victim model configuration: Select VGG16 as the framework of the victim model. priv Pre-train on it to obtain the victim model T.

[0061] 2. Implementation of the Inversion Attack

[0062] 1. Apply the following three attack methods to the victim model T:

[0063] a) KEDMI (Knowledge Enhanced Attack Method)

[0064] b) GMI (attack method based on generative adversarial network)

[0065] c)LOMMA (attack method based on Logit maximization and model enhancement)

[0066] 2. Collect the intermediate layer features z and the corresponding attack success probability p when the attack is successful attack .

[0067] 3. Data Collection and Preprocessing

[0068] 1. Data collection: For each image, the attack is performed without implementing a defense strategy, and then the attack is performed again after implementing different defense strategies. This means that for each attack strategy, three sets of {z, p attack}Data (for different defense strategies):

[0069] a) No defense

[0070] b) Defense strategy A (e.g. regularization)

[0071] c) Defense strategy B (e.g. data perturbation)

[0072] 2. Data organization: For 5,000 images, each attack strategy generates 15,000 sets of data. In total, for the three attack strategies, there will be 45,000 sets of data.

[0073] 4. Dataset Division

[0074] The data needs to be divided into training set, test set and validation set. The recommended division ratio is 70% training set, 20% test set and 10% validation set.

[0075] 5. Anti-attack capability prediction model

[0076] 1. Model training: Use the collected data to train a prediction model F. The model should be able to predict the probability of successful attack in downstream attack scenarios based on the intermediate layer features z.

[0077] 2. Model structure: The prediction model can adopt a deep learning framework, such as a deep neural network, and use activation functions and loss functions to adjust the output to ensure that the output is a probability value.

[0078] 6. Performance Evaluation Indicators and Experimental Results

[0079] The experiment uses KL divergence (Kullback-Leibler Divergence) to measure the prediction probability With the true probability p attack The experiment shows that on the test set, the average KL divergence between the predicted probability and the true probability is only 0.00805. This shows that the present invention can effectively measure the privacy security of features.

[0080] Although the present invention has been disclosed as above by way of embodiments, it is not intended to limit the present invention. Appropriate modifications or equivalent substitutions of the technical solutions of the present invention made by ordinary technicians in the field should all be included in the protection scope of the present invention. The protection scope of the present invention shall be based on what is defined in the claims.

Claims

1. A feature privacy security measurement method, characterized in that: The following steps are involved: 1) Pre-train the victim model on a private dataset, perform an inversion attack on the victim model, and record the output intermediate layer features and the corresponding attack success probability; Improve the victim model through defense strategies, repeat attacks and data collection, and integrate all intermediate layer features and attack success probabilities into a synthetic dataset; 2) Use the synthetic dataset to train a prediction model that predicts the probability of attack success based on the input intermediate layer features; 3) Use the trained prediction model to process the intermediate layer features of the victim model trained using different defense strategies to predict the probability of successful attack.

2. The method according to claim 1, characterized in that In step 1), the private dataset consists of private images and corresponding ID tags, and the victim model is a neural network model for processing classification tasks.

3. The method according to claim 1, characterized in that In step 1), the inversion attack adopts one of the attack methods among KEDMI, GMI and LOMMA.

4. The method according to claim 1, characterized in that The steps of the inversion attack in step 1) include: obtaining the intermediate layer features from the victim model, and performing an image reconstruction attack based on the intermediate layer features through the attack model. The probability of successful attack is: Among them, ID(x i ) represents the input image x from the victim model i Sensitive information extracted from is the image reconstructed by the attack model, N is the total number of test samples, and I is the indicator function.

5. The method according to claim 1, characterized in that The defense strategies in steps 1) and 3) include at least one of data perturbation, model regularization, and homomorphic encryption.

6. The method according to claim 1, characterized in that The prediction model in step 2) is a multi-layer neural network model.

7. The method according to claim 1 or 6, characterized in that The training model in step 2) uses a binary cross entropy loss function to measure the difference between the predicted probability and the true probability. The binary cross entropy loss function is: Among them, p attack,i is the probability of a successful attack, is the probability of successful attack predicted by the training model, N is the total number of test samples, and the log base is the natural logarithm.

8. The method according to claim 7, characterized in that In step 2), the training model uses gradient descent or its variant algorithm to minimize the binary cross entropy loss function L(θ) to optimize the model parameters θ.

9. A feature privacy security measurement device, characterized in that: The method comprises a memory and a processor, wherein the memory stores a computer program, and the processor implements the steps of the method according to any one of claims 1 to 8 when executing the computer program.

10. A computer-readable storage medium, characterized in that: A computer program is stored, and when the computer program is executed, the steps of the method according to any one of claims 1 to 8 are implemented.

Images