Defense method for model stealing attack and related equipment

Abstract

The embodiment of the invention discloses a defense method for a model stealing attack and related equipment, which are used for performing defense for the model stealing attack under the condition of improving the robustness and efficiency of defense for the model stealing attack. The method comprises the steps that to-be-processed data is acquired, the to-be-processed data is input into a pre-trained defense model, the defense model comprises a benign and malignant detection module and a countering module, the benign and malignant detection module carries out benign and malignant detection on the to-be-processed data based on a preset benign data distribution range, and the countering module counters the benign and malignant data. A countering module determines target attack intensity corresponding to the to-be-processed data based on the target detection result, determines target confidence degree corresponding to the target attack intensity based on a preset mapping relation, and performs corresponding reasoning on the to-be-processed data based on the target confidence degree to obtain a target detection result of the to-be-processed data; and obtaining a reasoning result corresponding to the to-be-processed data output by the defense model.

Description

Technical Field

[0001] Embodiments of the present application relate to the field of defense against model stealing attacks, and more specifically, to a defense method against model stealing attacks, a defense device against model stealing attacks, a computer device, and a computer-readable storage medium. Background Art

[0002] With the complexity and wide application of models, the threat of model stealing attacks has become more and more common. For example, deep learning cloud services are vulnerable to model stealing attacks by malicious users. Model stealing attacks are an attack method that uses a fake dataset to access the target model to obtain output, thereby constructing a proxy dataset to train an alternative model. For example, attacks and steals from generative models (such as ChatGPT, etc.) and / or public medical image models. A model with similar functions can be stolen and constructed, thereby avoiding attacks and further providing cloud services to the outside world and charging corresponding fees. Therefore, defense against model stealing attacks is particularly important.

[0003] The existing defense method against model stealing attacks is to defend against model stealing attacks through static interference (adding random, fixed noise), which attempts to interfere with the model's processing of inputs, making it difficult for attackers to understand and copy. The specific implementation method is to first calculate the distance between the data to be processed and each standard data, and determine whether these distances conform to the preset normal distribution to determine whether the data to be processed is malicious data or benign data. If it is malicious data, the inference result with low accuracy of the data to be processed is output by adding static interference, thereby achieving the purpose of defending against model stealing attacks.

[0004] However, this fixed-pattern interference can be easily learned by attackers to identify and evade, and the effectiveness of defense against model stealing attacks is low. Therefore, the robustness of defense against model stealing attacks is low. Summary of the invention

[0005] Embodiments of the present application provide a defense method against model stealing attacks, a defense device against model stealing attacks, a computer device, and a computer-readable storage medium, which can defend against model stealing attacks while improving the robustness and efficiency of the defense against model stealing attacks.

[0006] In a first aspect, an embodiment of the present application provides a defense method against model stealing attacks, including:

[0007] Get the data to be processed;

[0008] Inputting the data to be processed into a pre-trained defense model, wherein the defense model includes a benign and malignant detection module and a countermeasure module;

[0009] The benign and malignant detection module performs benign and malignant detection on the data to be processed based on a preset benign data distribution range to obtain a target detection result of the data to be processed, wherein the preset benign data distribution range is used to characterize the distribution of the behavior characteristics of each benign data;

[0010] The countermeasure module determines the target attack intensity corresponding to the data to be processed based on the target detection result, and determines the target confidence corresponding to the target attack intensity based on a preset mapping relationship, so as to perform corresponding reasoning on the data to be processed based on the target confidence, and obtain the reasoning result corresponding to the data to be processed output by the defense model. The preset mapping relationship is used to characterize the first corresponding relationship between the attack intensity and the confidence under the target conditions, and the target confidence is used to characterize the degree of trust that the data to be processed is benign data.

[0011] In a second aspect, an embodiment of the present application provides a defense device against model stealing attacks, including:

[0012] An acquisition unit, used for acquiring data to be processed;

[0013] An input unit, used for inputting the data to be processed into a pre-trained defense model, wherein the defense model includes a benign and malignant detection module and a countermeasure module;

[0014] a benign and malignant detection unit, configured to perform benign and malignant detection on the data to be processed based on a preset benign data distribution range by the benign and malignant detection module to obtain a target detection result of the data to be processed, wherein the preset benign data distribution range is used to characterize the distribution of the behavior characteristics of each benign data;

[0015] A countermeasure processing unit is used to determine the target attack intensity corresponding to the data to be processed based on the target detection result by the countermeasure module, and determine the target confidence corresponding to the target attack intensity based on a preset mapping relationship, so as to perform corresponding reasoning on the data to be processed based on the target confidence, and obtain the reasoning result corresponding to the data to be processed output by the defense model, wherein the preset mapping relationship is used to characterize the first corresponding relationship between the attack intensity and the confidence under the target condition, and the target confidence is used to characterize the degree of trust that the data to be processed is benign data.

[0016] In a third aspect, an embodiment of the present application provides a computer device, including:

[0017] CPU, memory, input and output interfaces, wired or wireless network interfaces, and power supply;

[0018] The memory is a short-term storage memory or a persistent storage memory;

[0019] The central processing unit is configured to communicate with the memory and execute instruction operations in the memory to perform the aforementioned defense method against model stealing attacks.

[0020] In a fourth aspect, an embodiment of the present application provides a computer-readable storage medium, which includes instructions. When the instructions are executed on a computer, the computer executes the aforementioned defense method against model stealing attacks.

[0021] In a fifth aspect, an embodiment of the present application provides a computer program product comprising instructions, which, when the computer program product is run on a computer, enables the computer to execute the aforementioned defense method against model stealing attacks.

[0022] It can be seen from the above technical solutions that the embodiments of the present application have the following advantages: the benign and malignant detection of the data to be processed can be performed based on the preset benign data distribution range, the accuracy of the detection can be improved, and the target attack intensity corresponding to the data to be processed can be determined based on the target detection result, and the target confidence corresponding to the target attack intensity can be determined based on the preset mapping relationship, dynamic defense against model stealing attacks can be performed, reducing the possibility of attackers learning how to identify and evade defense, and the effectiveness of the defense against model stealing attacks is high. Therefore, the robustness of the defense against model stealing attacks is high. Furthermore, each query of the data to be processed only needs to directly determine the target confidence corresponding to the attack intensity in real time through the preset mapping relationship, without the need for additional calculations, and the efficiency of determining the target confidence is high. Therefore, the efficiency of the defense against model stealing attacks is high. BRIEF DESCRIPTION OF THE DRAWINGS

[0023] Figure 1 A schematic diagram of the architecture of a defense system against model stealing attacks disclosed in an embodiment of the present application;

[0024] Figure 2 A flowchart of a defense method against model stealing attacks disclosed in an embodiment of the present application;

[0025] Figure 3 A flowchart of a method for training a benign and malignant detection module disclosed in an embodiment of the present application;

[0026] Figure 4 A flowchart of an inference countermeasure module method disclosed in an embodiment of the present application;

[0027] Figure 5 This is a schematic diagram of the architecture of another defense system against model stealing attacks disclosed in an embodiment of the present application;

[0028] Figure 6A schematic diagram of a defense device against model stealing attacks disclosed in an embodiment of the present application;

[0029] Figure 7 A schematic diagram of the structure of a computer device disclosed in an embodiment of the present application. DETAILED DESCRIPTION

[0030] Embodiments of the present application provide a defense method against model stealing attacks, a defense device against model stealing attacks, a computer device, and a computer-readable storage medium, which can defend against model stealing attacks while improving the robustness and efficiency of the defense against model stealing attacks.

[0031] See also Figure 1 In the embodiment of the present application, the architecture of the defense system against model stealing attacks includes:

[0032] Computer device 101 and client 102. When defending against model stealing attacks, computer device 101 can be connected to client 102. Computer device 101 can obtain the data to be processed sent by client 102, and can input the data to be processed into a pre-trained defense model. The benign and malignant detection module of the defense model performs benign and malignant detection on the data to be processed based on a preset benign data distribution range to obtain a target detection result of the data to be processed, and the countermeasure module determines the target attack intensity corresponding to the data to be processed based on the target detection result, and determines the target confidence corresponding to the target attack intensity based on a preset mapping relationship, so as to perform corresponding reasoning on the data to be processed based on the target confidence, obtain the reasoning result corresponding to the data to be processed output by the defense model, and finally return the reasoning result corresponding to the data to be processed to client 102.

[0033] based on Figure 1 For the defense system against model stealing attacks shown in Figure 2 , Figure 2 The following is a flowchart of a defense method against model stealing attacks disclosed in an embodiment of the present application, the method comprising:

[0034] 201. Obtain data to be processed.

[0035] In this embodiment, when defending against a model stealing attack, data to be processed can be obtained.

[0036] Specifically, the data to be processed may include but is not limited to image data, text data, etc.

[0037] 202. Input the data to be processed into a pre-trained defense model, where the defense model includes a benign and malignant detection module and a countermeasure module.

[0038] After obtaining the data to be processed, the data to be processed can be input into a pre-trained defense model, which includes a benign and malignant detection module and a countermeasure module.

[0039] Specifically, the benign and malignant detection module and the countermeasure module are pre-trained models.

[0040] 203. The benign and malignant detection module performs benign and malignant detection on the data to be processed based on a preset benign data distribution range to obtain a target detection result of the data to be processed. The preset benign data distribution range is used to characterize the distribution of the behavior characteristics of each benign data.

[0041] After the data to be processed is input into the pre-trained defense model, the benign and malignant detection module can perform benign and malignant detection on the data to be processed based on the preset benign data distribution range to obtain the target detection result of the data to be processed. The preset benign data distribution range is used to characterize the distribution of the behavioral characteristics of each benign data.

[0042] Specifically, the preset benign data distribution range may include but is not limited to the ranges involved in random distribution, normal distribution, etc. Benign means that the data is non-aggressive, and malignant means that the data is aggressive. The preset benign data distribution range can be used to evaluate whether the data to be processed conforms to the statistical characteristics of normal behavior. If the data to be processed falls within the preset benign data distribution range, this indicates that the data to be processed is considered normal, that is, the detection result is benign data. If the data to be processed exceeds this preset range, it means that the behavior characteristics of the data to be processed do not conform to the known benign data pattern, and it is judged as malicious or abnormal data.

[0043] It can be understood that the preset benign data distribution range may include but is not limited to benign data distribution ranges of attacks of various types and / or intensities, etc.

[0044] 204. The countermeasure module determines the target attack intensity corresponding to the data to be processed based on the target detection result, and determines the target confidence corresponding to the target attack intensity based on the preset mapping relationship, so as to perform corresponding reasoning on the data to be processed based on the target confidence, and obtain the reasoning result corresponding to the data to be processed output by the defense model. The preset mapping relationship is used to characterize the first corresponding relationship between the attack intensity and the confidence under the target condition, and the target confidence is used to characterize the degree of trust that the data to be processed is benign data.

[0045] After obtaining the target detection result of the data to be processed, the countermeasure module can determine the target attack intensity corresponding to the data to be processed based on the target detection result, and determine the target confidence corresponding to the target attack intensity based on the preset mapping relationship, so as to perform corresponding reasoning on the data to be processed based on the target confidence, and obtain the reasoning result corresponding to the data to be processed output by the defense model. The preset mapping relationship is used to characterize the first corresponding relationship between the attack intensity and the confidence under the target conditions, and the target confidence is used to characterize the degree of trust that the data to be processed is benign data.

[0046] Specifically, the preset mapping relationship may include but is not limited to mapping relationships of multiple types of attacks.

[0047] It is worth mentioning that the pre-set mapping relationship provides a universal rule, which allows consistent confidence assessments to be maintained for attacks of different intensities in different scenarios, thus enhancing the reliability of the system. Secondly, if the relationship between confidence and intensity needs to be changed, only the preset mapping relationship needs to be updated, which simplifies the maintenance and adaptive adjustment process of the model.

[0048] It should be understood that the first correspondence relationship under the target condition can be used to characterize the correspondence between a larger attack intensity and a smaller confidence, and the correspondence between a smaller attack intensity and a larger confidence. It can also be other regular or irregular correspondence relationships that can achieve a defensive effect, which are not specifically limited here.

[0049] In the embodiment of the present application, the benign and malignant detection can be performed on the data to be processed based on the preset benign data distribution range, which can improve the accuracy of the detection, and the target attack intensity corresponding to the data to be processed can be determined based on the target detection result, and the target confidence corresponding to the target attack intensity can be determined based on the preset mapping relationship, and dynamic defense against model stealing attacks can be performed to reduce the possibility of attackers learning how to identify and evade defenses. The effectiveness of the defense against model stealing attacks is high, and therefore, the robustness of the defense against model stealing attacks is high. Furthermore, each query of the data to be processed only needs to directly determine the target confidence corresponding to the attack intensity in real time through the preset mapping relationship, without the need for additional calculations, and the efficiency of determining the target confidence is high, so the efficiency of the defense against model stealing attacks is high.

[0050] In the embodiment of the present application, there are multiple methods for determining the target attack strength corresponding to the data to be processed based on the target detection result, and determining the target confidence corresponding to the target attack strength based on the preset mapping relationship. Figure 2 The defense methods against model stealing attacks shown in the figure are described below.

[0051] In this embodiment, when the defense method against the model stealing attack is performed, the data to be processed can be obtained first.

[0052] Specifically, the data to be processed may include but is not limited to image data, text data, etc.

[0053] After obtaining the data to be processed, the data to be processed can be input into a pre-trained defense model, which includes a benign and malignant detection module and a countermeasure module.

[0054] After the data to be processed is input into the pre-trained defense model, the benign and malignant detection module can perform benign and malignant detection on the data to be processed based on the preset benign data distribution range to obtain the target detection result of the data to be processed. The preset benign data distribution range is used to characterize the distribution of the behavioral characteristics of each benign data.

[0055] Specifically, the preset benign data distribution range may include but is not limited to the range involved in random distribution, normal distribution, etc. Benign means that the data is non-aggressive, and malignant means that the data is aggressive.

[0056] Among them, the method of performing benign and malignant detection on the data to be processed based on the preset benign data distribution range to obtain the target detection result of the data to be processed can be: if the data to be processed is within the target range of the preset benign data distribution range, then the target detection result is determined to be used to characterize the data to be processed as benign data; if the data to be processed is outside the target range of the preset benign data distribution range, then the target detection result is determined to be used to characterize the data to be processed as malignant data.

[0057] Specifically, the data to be processed can be evaluated based on the preset benign data distribution range to determine whether it conforms to the statistical characteristics of normal behavior. If the data to be processed falls within the preset benign data distribution range, it indicates that the data to be processed is considered normal, that is, the detection result is benign data. If the data to be processed exceeds this preset range, it indicates that the behavior characteristics of the data to be processed do not conform to the known benign data pattern, and it is judged as malicious or abnormal data.

[0058] Among them, before the benign and malignant detection module performs benign and malignant detection on the data to be processed based on a preset benign data distribution range, a sample of the data to be processed can be obtained first, and the sample of the data to be processed is annotated with a detection result. Then, the benign and malignant detection module performs benign and malignant detection on the sample of the data to be processed based on the preset benign data distribution range to obtain a predicted detection result. Finally, when the loss between the predicted detection result and the annotated detection result meets the convergence condition, a trained benign and malignant detection module is obtained.

[0059] For details, please refer to Figure 3 , Figure 3FIG. 1 is a flow chart of a method for training a benign and malignant detection module (out-of-distribution detection module) disclosed in an embodiment of the present application, comprising Figure 3 It can be seen that the steps involved in the method of training the benign and malignant detection module may include the following steps:

[0060] (1) Initial model training: Use the original problem domain data set to train the initial model;

[0061] (2) GAN training: GAN is trained using a dataset consisting of the feature vectors of the initial model, so that the discriminator D in the trained GAN can preliminarily distinguish between samples inside and outside the distribution (samples inside the distribution are used to represent benign data, and samples outside the distribution are used to represent malignant data);

[0062] (3) Joint fine-tuning: Fine-tune the model by using the discriminator value to further improve the ability to distinguish between samples inside and outside the distribution.

[0063] After obtaining the target detection result of the data to be processed, the countermeasure module can determine the target attack intensity corresponding to the data to be processed based on the target detection result, and determine the target confidence corresponding to the target attack intensity based on the preset mapping relationship, so as to perform corresponding reasoning on the data to be processed based on the target confidence, and obtain the reasoning result corresponding to the data to be processed output by the defense model. The preset mapping relationship is used to characterize the first corresponding relationship between the attack intensity and the confidence under the target conditions, and the target confidence is used to characterize the degree of trust that the data to be processed is benign data.

[0064] It is worth mentioning that the pre-set mapping relationship provides a universal rule, which allows consistent confidence assessments to be maintained for attacks of different intensities in different scenarios, thus enhancing the reliability of the system. Secondly, if the relationship between confidence and intensity needs to be changed, only the preset mapping relationship needs to be updated, which simplifies the maintenance and adaptive adjustment process of the model.

[0065] Among them, the method for determining the target attack intensity corresponding to the data to be processed based on the target detection result may be: if the target detection result is used to characterize the data to be processed as benign data, then the attack intensity corresponding to the data to be processed is determined to be a first attack intensity; if the target detection result is used to characterize the data to be processed as malignant data, then based on the target position of the data to be processed in the target detection result within a preset benign data distribution range, the attack intensity corresponding to the data to be processed is determined to be a second attack intensity, and the first attack intensity is less than the second attack intensity.

[0066] Specifically, the value of the first attack strength may be zero, or other values ​​that are smaller than the second attack strength.

[0067] The first corresponding relationship is used to characterize the corresponding relationship between a larger attack strength and a smaller confidence level, and the corresponding relationship between a smaller attack strength and a larger confidence level.

[0068] It is worth mentioning that in actual situations, it is generally believed that the greater the intensity of the attack, the lower the degree of trust that the data to be processed is benign data, that is, the confidence level will tend to be smaller. Therefore, this correspondence is consistent with the understanding of the natural laws of security threats and improves the rationality of risk assessment.

[0069] Among them, before determining the target confidence corresponding to the target attack intensity based on a preset mapping relationship, each initial data combination can be obtained first, each initial data combination includes each initial attack intensity and the initial confidence corresponding to each initial attack intensity, and then the initial data combinations are sorted in order from small to large in attack intensity to obtain an initial data combination sequence; and wherein the method for determining the target confidence corresponding to the target attack intensity based on a preset mapping relationship can be to determine the target confidence corresponding to the target attack intensity based on the initial data combination sequence.

[0070] Specifically, the initial data combination sequence may involve the discriminant value range, ranking range, and confidence value of the discriminator. For example, the discriminant value range is -0.1 to 0.1, and the ranking range includes the 1st to the 60,000th. The closer the noun is to the front, the higher the corresponding confidence value.

[0071] It is worth mentioning that the ordered data structure (initial data combination sequence) is conducive to quickly finding the optimal confidence level corresponding to the target attack intensity, thereby improving the efficiency of the algorithm operation.

[0072] Among them, the method for determining the target confidence corresponding to the target attack intensity based on the preset mapping relationship may be to first determine the target temperature attenuation value corresponding to the target attack intensity based on the second corresponding relationship, and then determine the target confidence based on the target temperature attenuation value and the initial confidence, and the preset mapping relationship includes the second corresponding relationship between the attack intensity and the temperature attenuation value.

[0073] Specifically, the attack intensity and the corresponding temperature attenuation value may present a positive relationship.

[0074] It is worth mentioning that the temperature attenuation module can adjust the temperature according to the output value of the detection module, which will not affect the prediction accuracy of the model. At the same time, it has real-time performance and will not cause a decrease in the model reasoning speed due to cumulative statistics. Therefore, through the processing of temperature attenuation, it can provide a fast response while maintaining a high prediction accuracy, with less performance loss.

[0075] Among them, the countermeasure module determines the target attack intensity corresponding to the data to be processed based on the target detection result, and determines the target confidence corresponding to the target attack intensity based on the preset mapping relationship, so as to perform corresponding reasoning on the data to be processed based on the target confidence. Before obtaining the reasoning result corresponding to the data to be processed output by the defense model, the detection result sample of the data sample to be processed can be obtained first, and the detection result sample is annotated with the reasoning result corresponding to the data sample to be processed. Then, the countermeasure module determines the attack intensity sample corresponding to the data sample to be processed based on the detection result sample, and determines the confidence sample corresponding to the attack intensity sample based on the preset mapping relationship, so as to perform corresponding reasoning on the data sample to be processed based on the confidence sample, and obtain the predicted reasoning result corresponding to the data sample to be processed output by the defense model. When the loss between the predicted reasoning result and the labeled reasoning result meets the convergence condition, a trained countermeasure module is obtained.

[0076] Specifically, the method of training the countermeasure module (involving the temperature attenuation module) is similar to the principle of the method of reasoning the countermeasure module (involving the temperature attenuation module). Here, the reasoning stage is used to explain it, and the training stage is not repeated here. For details, please refer to Figure 4 , Figure 4 A flow chart of a method for an inference countermeasure module (involving a temperature attenuation module) disclosed in an embodiment of the present application, comprising Figure 4 It can be seen that the countermeasure module can combine the discriminator fine-tuned in the training phase and the initial model fine-tuned to output the corresponding thresholds for samples inside and outside the distribution, and use the ranking of the query sample in the distribution (i.e., the ranking of the possibility of benign data) as the exponent of temperature decay, where the exponential decay factor is r d .

[0077] Among them, the method for obtaining the data to be processed can be, obtaining the data to be processed sent by the client, the data to be processed is the data input by the user in the client interface, and after obtaining the inference result corresponding to the data to be processed output by the defense model, the inference result corresponding to the data to be processed can be returned to the client.

[0078] Specifically, the architecture of the embodiment of the present application may include a user end (client), a service provider end (computer device) and a defense agent (defense model), and is implemented through the interaction between the service provider end and the user end. Figure 5 , Figure 5 This is another system architecture diagram for defending against model stealing attacks disclosed in an embodiment of the present application, which consists of Figure 5It can be seen that the main function of the server is to provide model prediction services, provide an initial training model for the defense agent, set the temperature decay parameter α of the theft attack countermeasure framework, and provide the defense agent with the input vector features before the fully connected layer; the main function of the defense framework is to assist the server in monitoring the benign and malignant nature of samples and adaptive countermeasures; the main function of the user side is to obtain the machine learning service requirements provided by the user side. Specifically, for the user side, an input box can be provided for the user to enter or upload query data, such as pictures or text, and then the query data is sent to the server, and the server's response is waited for. Then, the output result returned by the server can be received and displayed on the screen, such as a classification label or probability distribution. If the user wants to end the session, an exit button is provided so that the user can disconnect from the server.

[0079] It should be understood that the embodiments of the present application can also defend against various types of attacks, which can be achieved through preset benign data distribution ranges and preset mapping relationships corresponding to various attack types. Moreover, the defense method against model stealing attacks corresponding to each attack type is similar to the above method and will not be repeated here.

[0080] In this embodiment, the benign and malignant detection of the data to be processed can be performed based on the preset benign data distribution range, which can improve the accuracy of the detection, and the target attack intensity corresponding to the data to be processed can be determined based on the target detection result, and the target confidence corresponding to the target attack intensity can be determined based on the preset mapping relationship, and dynamic defense against model stealing attacks can be performed to reduce the possibility of attackers learning how to identify and evade defenses. The effectiveness of the defense against model stealing attacks is high, and therefore, the robustness of the defense against model stealing attacks is high. Furthermore, each query of the data to be processed only needs to directly determine the target confidence corresponding to the attack intensity in real time through the preset mapping relationship, without the need for additional calculations, and the efficiency of determining the target confidence is high, so the efficiency of the defense against model stealing attacks is high. Secondly, the embodiment of the present application designs a technology for anti-stealing in the prediction stage of online monitoring and real-time countermeasures. In the training stage, a real-time detector is synchronously trained. In the test stage, the output of the model is dynamically adjusted based on the output value of the real-time detector as an evaluation index to counter different query samples in real time, so that the success rate of model stealing attack defense can reach 98.5% under the premise of a 3.5% decrease in model performance accuracy. It can effectively defend against different types of model stealing attacks without affecting user experience, and is compatible with different deep learning frameworks and platforms, which is convenient for deployment and updating, and convenient for analysis and evaluation. Then, the detection model of the embodiment of the present application is sample granularity and memoryless, and will not be affected by adaptive stealing attacks, and can not only detect stealing attacks, but also detect other types of attacks, with certain versatility, and can defend against various model condition settings and various types of stealing attacks, with strong robustness. Furthermore, it can be migrated on multiple frameworks, so it has universality. Furthermore, the pre-set mapping relationship provides a general rule, so that in different scenarios, for attacks of different intensities, consistent confidence assessment can be maintained, which enhances the reliability of the system. If the relationship between confidence and intensity needs to be changed, it is only necessary to update the preset mapping relationship, which simplifies the maintenance and adaptive adjustment process of the model. Furthermore, in actual situations, it is generally believed that the greater the attack intensity, the lower the degree of trust that the data to be processed is benign data, that is, the confidence tends to be smaller. This correspondence is consistent with the understanding of the natural law of security threats and improves the rationality of risk assessment. Furthermore, the ordered data structure (initial data combination sequence) is conducive to quickly finding the optimal confidence corresponding to the target attack intensity, which improves the efficiency of the algorithm operation. Finally, the temperature attenuation module can adjust the temperature according to the output value of the detection module, which can not affect the prediction accuracy of the model, and at the same time has real-time performance, and will not cause the model reasoning speed to decrease due to cumulative statistics.

[0081] The above describes the defense method against model stealing attack in the embodiment of the present application. The following describes the defense device against model stealing attack in the embodiment of the present application. Figure 6 , an embodiment of the defense device against model stealing attack in the embodiment of the present application includes:

[0082] An acquisition unit, used for acquiring data to be processed;

[0083] An input unit, used for inputting the data to be processed into a pre-trained defense model, wherein the defense model includes a benign and malignant detection module and a countermeasure module;

[0084] a benign and malignant detection unit, configured to perform benign and malignant detection on the data to be processed based on a preset benign data distribution range by the benign and malignant detection module to obtain a target detection result of the data to be processed, wherein the preset benign data distribution range is used to characterize the distribution of the behavior characteristics of each benign data;

[0085] A countermeasure processing unit is used to determine the target attack intensity corresponding to the data to be processed based on the target detection result by the countermeasure module, and determine the target confidence corresponding to the target attack intensity based on a preset mapping relationship, so as to perform corresponding reasoning on the data to be processed based on the target confidence, and obtain the reasoning result corresponding to the data to be processed output by the defense model, wherein the preset mapping relationship is used to characterize the first corresponding relationship between the attack intensity and the confidence under the target condition, and the target confidence is used to characterize the degree of trust that the data to be processed is benign data.

[0086] In the embodiment of the present application, the benign and malignant detection can be performed on the data to be processed based on the preset benign data distribution range, which can improve the accuracy of the detection, and the target attack intensity corresponding to the data to be processed can be determined based on the target detection result, and the target confidence corresponding to the target attack intensity can be determined based on the preset mapping relationship, and dynamic defense against model stealing attacks can be performed to reduce the possibility of attackers learning how to identify and evade defenses. The effectiveness of the defense against model stealing attacks is high, and therefore, the robustness of the defense against model stealing attacks is high. Furthermore, each query of the data to be processed only needs to directly determine the target confidence corresponding to the attack intensity in real time through the preset mapping relationship, without the need for additional calculations, and the efficiency of determining the target confidence is high, so the efficiency of the defense against model stealing attacks is high.

[0087] See below Figure 7 In the embodiment of the present application, an embodiment of the computer device 700 includes:

[0088] CPU 701, memory 705, input / output interface 704, wired or wireless network interface 703 and power supply 702;

[0089] The memory 705 is a temporary storage memory or a permanent storage memory;

[0090] The CPU 701 is configured to communicate with the memory 705 and execute the instructions in the memory 705 to perform the aforementioned Figure 2 The method in the illustrated embodiment.

[0091] The embodiment of the present application also provides a computer-readable storage medium, the computer-readable storage medium includes instructions, when the instructions are executed on a computer, the computer executes the aforementioned Figure 2 The method in the illustrated embodiment.

[0092] The present application also provides a computer program product including instructions, which, when executed on a computer, enables the computer to execute the aforementioned Figure 2 The method in the illustrated embodiment.

[0093] It should be understood that, although the various steps in the flowcharts involved in the above-mentioned embodiments are displayed in sequence according to the indication of the arrows, these steps are not necessarily executed in sequence according to the order indicated by the arrows. Unless there is a clear explanation in this article, the execution of these steps does not have a strict order restriction, and these steps can be executed in other orders. Moreover, at least a part of the steps in the flowcharts involved in the above-mentioned embodiments can include multiple steps or multiple stages, and these steps or stages are not necessarily executed at the same time, but can be executed at different times, and the execution order of these steps or stages is not necessarily to be carried out in sequence, but can be executed in turn or alternately with other steps or at least a part of the steps or stages in other steps.

[0094] Those skilled in the art can clearly understand that, for the convenience and brevity of description, the specific working processes of the systems, devices and units described above can refer to the corresponding processes in the aforementioned method embodiments and will not be repeated here.

[0095] In the several embodiments provided in the present application, it should be understood that the disclosed systems, devices and methods can be implemented in other ways. For example, the device embodiments described above are only schematic. For example, the division of the units is only a logical function division. There may be other division methods in actual implementation, such as multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed can be an indirect coupling or communication connection through some interfaces, devices or units, which can be electrical, mechanical or other forms.

[0096] The units described as separate components may or may not be physically separated, and the components shown as units may or may not be physical units, that is, they may be located in one place or distributed on multiple network units. Some or all of the units may be selected according to actual needs to achieve the purpose of the solution of this embodiment.

[0097] In addition, each functional unit in each embodiment of the present application may be integrated into one processing unit, or each unit may exist physically separately, or two or more units may be integrated into one unit. The above-mentioned integrated unit may be implemented in the form of hardware or in the form of software functional units.

[0098] If the integrated unit is implemented in the form of a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present application is essentially or the part that contributes to the prior art or all or part of the technical solution can be embodied in the form of a software product, and the computer software product is stored in a storage medium, including a number of instructions to enable a computer device (which can be a personal computer, a server, or a network device, etc.) to perform all or part of the steps of the method described in each embodiment of the present application. The aforementioned storage medium includes: U disk, mobile hard disk, read-only memory (ROM, read-only memory), random access memory (RAM, random access memory), disk or optical disk and other media that can store program code.

Claims

1. A defense method against model stealing attacks, characterized in that: include: Get the data to be processed; Inputting the data to be processed into a pre-trained defense model, wherein the defense model includes a benign and malignant detection module and a countermeasure module; The benign and malignant detection module performs benign and malignant detection on the data to be processed based on a preset benign data distribution range to obtain a target detection result of the data to be processed, wherein the preset benign data distribution range is used to characterize the distribution of the behavior characteristics of each benign data; The countermeasure module determines the target attack intensity corresponding to the data to be processed based on the target detection result, and determines the target confidence corresponding to the target attack intensity based on a preset mapping relationship, so as to perform corresponding reasoning on the data to be processed based on the target confidence, and obtain the reasoning result corresponding to the data to be processed output by the defense model. The preset mapping relationship is used to characterize the first corresponding relationship between the attack intensity and the confidence under the target conditions, and the target confidence is used to characterize the degree of trust that the data to be processed is benign data.

2. The method according to claim 1, characterized in that The performing benign and malignant detection on the data to be processed based on the preset benign data distribution range to obtain a target detection result of the data to be processed includes: If the data to be processed is within the target range of the preset benign data distribution range, determining the target detection result is used to characterize that the data to be processed is benign data; If the data to be processed is outside the target range of the preset benign data distribution range, determining the target detection result is used to characterize that the data to be processed is malignant data, The determining the target attack intensity corresponding to the data to be processed based on the target detection result includes: If the target detection result is used to characterize that the data to be processed is benign data, determining that the attack intensity corresponding to the data to be processed is a first attack intensity; If the target detection result is used to characterize that the data to be processed is malignant data, then based on the target position of the data to be processed in the target detection result within the preset benign data distribution range, it is determined that the attack intensity corresponding to the data to be processed is the second attack intensity, and the first attack intensity is less than the second attack intensity.

3. The method according to claim 1, characterized in that: The first corresponding relationship is used to characterize the corresponding relationship between a larger attack strength and a smaller confidence level, and the corresponding relationship between a smaller attack strength and a larger confidence level.

4. The method according to claim 1, characterized in that: Before determining the target confidence corresponding to the target attack intensity based on the preset mapping relationship, the method further includes: Acquire each initial data combination, wherein each initial data combination includes each initial attack strength and each initial confidence corresponding to each initial attack strength; Sort the initial data combinations in ascending order of attack intensity to obtain an initial data combination sequence; The determining the target confidence corresponding to the target attack intensity based on a preset mapping relationship includes: The target confidence corresponding to the target attack intensity is determined based on the initial data combination sequence.

5. The method according to claim 1, characterized in that The preset mapping relationship includes a second corresponding relationship between attack intensity and temperature attenuation value; The determining the target confidence corresponding to the target attack intensity based on a preset mapping relationship includes: Determine a target temperature attenuation value corresponding to the target attack intensity based on the second corresponding relationship; The target confidence level is determined based on the target temperature decay value and the initial confidence level.

6. The method according to claim 1, characterized in that Before the benign and malignant detection module performs benign and malignant detection on the data to be processed based on a preset benign data distribution range, the method further includes: Obtaining a data sample to be processed, wherein the data sample to be processed is marked with a test result; The benign and malignant detection module performs benign and malignant detection on the data sample to be processed based on a preset benign data distribution range to obtain a predicted detection result; When the loss between the predicted detection result and the labeled detection result meets the convergence condition, a trained benign and malignant detection module is obtained.

7. The method according to claim 1, characterized in that The countermeasure module determines the target attack strength corresponding to the data to be processed based on the target detection result, and determines the target confidence corresponding to the target attack strength based on a preset mapping relationship, so as to perform corresponding reasoning on the data to be processed based on the target confidence, and before obtaining the reasoning result corresponding to the data to be processed output by the defense model, the method further includes: Obtaining a test result sample of the data sample to be processed, wherein the test result sample is annotated with an inference result corresponding to the data sample to be processed; The countermeasure module determines the attack intensity sample corresponding to the data sample to be processed based on the detection result sample, and determines the confidence sample corresponding to the attack intensity sample based on a preset mapping relationship, so as to perform corresponding reasoning on the data sample to be processed based on the confidence sample, and obtain the predicted reasoning result corresponding to the data sample to be processed output by the defense model; When the loss between the predicted reasoning result and the labeled reasoning result meets the convergence condition, the trained countermeasure module is obtained.

8. A defense device against model stealing attacks, characterized in that: include: An acquisition unit, used for acquiring data to be processed; An input unit, used for inputting the data to be processed into a pre-trained defense model, wherein the defense model includes a benign and malignant detection module and a countermeasure module; a benign and malignant detection unit, configured to perform benign and malignant detection on the data to be processed based on a preset benign data distribution range by the benign and malignant detection module to obtain a target detection result of the data to be processed, wherein the preset benign data distribution range is used to characterize the distribution of the behavior characteristics of each benign data; A countermeasure processing unit is used to determine the target attack intensity corresponding to the data to be processed based on the target detection result by the countermeasure module, and determine the target confidence corresponding to the target attack intensity based on a preset mapping relationship, so as to perform corresponding reasoning on the data to be processed based on the target confidence, and obtain the reasoning result corresponding to the data to be processed output by the defense model, wherein the preset mapping relationship is used to characterize the first corresponding relationship between the attack intensity and the confidence under the target condition, and the target confidence is used to characterize the degree of trust that the data to be processed is benign data.

9. A computer device, characterized in that: include: CPU and memory; The memory is a short-term storage memory or a persistent storage memory; The central processing unit is configured to communicate with the memory and execute instructions in the memory to perform the method according to any one of claims 1 to 7.

10. A computer-readable storage medium, characterized in that: The computer-readable storage medium comprises instructions, and when the instructions are executed on a computer, the computer is caused to perform the method according to any one of claims 1 to 7.

Images