Defence methods against model theft attacks, and related devices

Abstract

Embodiments of the present application disclose a defense method against model stealing attacks and related equipment, which are used to defend against model stealing attacks while improving the robustness and efficiency of the defense against model stealing attacks. The method comprises: obtaining to-be-processed data, inputting the to-be-processed data into a pre-trained defense model, the defense model comprising a benignity detection module and a countermeasure module, performing benignity detection on the to-be-processed data based on a preset benign data distribution range by the benignity detection module to obtain a target detection result of the to-be-processed data, determining a target attack intensity corresponding to the to-be-processed data based on the target detection result by the countermeasure module, and determining a target confidence corresponding to the target attack intensity based on a preset mapping relationship, so as to perform corresponding reasoning on the to-be-processed data based on the target confidence to obtain a reasoning result corresponding to the to-be-processed data output by the defense model.

Description

TECHNICAL FIELD

[0001] The embodiments of the present application relate to the field of defense against model stealing attacks, and more particularly to a defense method against model stealing attacks, a defense device against model stealing attacks, a computer device, and a computer readable storage medium. BACKGROUND

[0002] With the complexity and wide application of models, the threat of model stealing attacks is becoming more and more common. For example, cloud services of deep learning are vulnerable to model stealing attacks by malicious users. Model stealing attacks are an attack method that uses a proxy data set to train a substitute model by constructing a fake data set to access the target model to obtain the output. For example, for attacks on generative models (such as ChatGPT, etc.) and / or public medical image models, a model with similar functions can be stolen and constructed, so that the attack can be avoided and further cloud services can be provided to the outside and corresponding fees can be collected. Therefore, the defense against model stealing attacks is particularly important.

[0003] The existing defense method against model stealing attacks is to defend against model stealing attacks by static interference (adding random and fixed noise). It attempts to interfere with the processing of the model on the input, making it difficult for the attacker to understand and replicate. The specific implementation is to first calculate the distance between the to-be-processed data and each standard data, and determine whether these distances conform to the preset normal distribution to determine whether the to-be-processed data is malicious data or benign data. If it is malicious data, an inference result with low accuracy of the to-be-processed data is output by adding static interference, so as to achieve the purpose of defending against model stealing attacks.

[0004] However, this fixed mode of interference is easy to be learned by the attacker on how to identify and avoid, and the effectiveness of the defense against model stealing attacks is low. Therefore, the robustness of the defense against model stealing attacks is low. SUMMARY

[0005] The embodiments of the present application provide a defense method against model stealing attacks, a defense device against model stealing attacks, a computer device, and a computer readable storage medium, which can improve the robustness and efficiency of the defense against model stealing attacks and perform the defense against model stealing attacks.

[0006] In a first aspect, the embodiments of the present application provide a defense method against model stealing attacks, comprising:

[0007] obtaining to-be-processed data;

[0008] inputting the to-be-processed data into a pre-trained defense model, the defense model comprising a benign-malicious detection module and a countermeasure module;

[0009] detecting benignity and malignancy of the to-be-processed data based on a preset benign data distribution range by the benignity and malignancy detection module, to obtain a target detection result of the to-be-processed data, the preset benign data distribution range being used to represent a distribution of behavior characteristics of each benign data;

[0010] determining a target attack intensity corresponding to the to-be-processed data based on the target detection result by the countermeasure module, and determining a target confidence corresponding to the target attack intensity based on a preset mapping relationship, to perform corresponding reasoning on the to-be-processed data based on the target confidence, to obtain a reasoning result of the to-be-processed data output by the defense model, the preset mapping relationship being used to represent a first corresponding relationship between attack intensity and confidence under a target condition, and the target confidence being used to represent a trust degree of the to-be-processed data belonging to benign data.

[0011] In a second aspect, an embodiment of the present application provides a defense device against model stealing attack, comprising:

[0012] an acquisition unit configured to acquire to-be-processed data;

[0013] an input unit configured to input the to-be-processed data into a pre-trained defense model, the defense model comprising a benignity and malignancy detection module and a countermeasure module;

[0014] a benignity and malignancy detection unit configured to detect benignity and malignancy of the to-be-processed data based on a preset benign data distribution range by the benignity and malignancy detection module, to obtain a target detection result of the to-be-processed data, the preset benign data distribution range being used to represent a distribution of behavior characteristics of each benign data;

[0015] a countermeasure processing unit configured to determine a target attack intensity corresponding to the to-be-processed data based on the target detection result by the countermeasure module, and determine a target confidence corresponding to the target attack intensity based on a preset mapping relationship, to perform corresponding reasoning on the to-be-processed data based on the target confidence, to obtain a reasoning result of the to-be-processed data output by the defense model, the preset mapping relationship being used to represent a first corresponding relationship between attack intensity and confidence under a target condition, and the target confidence being used to represent a trust degree of the to-be-processed data belonging to benign data.

[0016] In a third aspect, an embodiment of the present application provides a computer device, comprising:

[0017] a central processing unit, a memory, an input and output interface, a wired or wireless network interface, and a power supply;

[0018] the memory is a transitory storage memory or a persistent storage memory.

[0019] The central processing unit is configured to communicate with the memory and execute instruction operations in the memory to perform the aforementioned defense method against model stealing attacks.

[0020] In a fourth aspect, the embodiments of the present application provide a computer-readable storage medium, which includes instructions, when the instructions are run on a computer, cause the computer to execute the aforementioned defense method against model stealing attacks.

[0021] In a fifth aspect, the embodiments of the present application provide a computer program product including instructions, when the computer program product is run on a computer, cause the computer to execute the aforementioned defense method against model stealing attacks.

[0022] From the above technical solutions, it can be seen that the embodiments of the present application have the following advantages: benign and malignant detection can be performed on the to-be-processed data based on a preset benign data distribution range, the accuracy of detection can be improved, the target attack strength corresponding to the to-be-processed data can be determined based on a target detection result, and the target confidence corresponding to the target attack strength can be determined based on a preset mapping relationship, dynamic defense against model stealing attacks can be performed, the possibility of an attacker learning how to identify and avoid defense can be reduced, the effectiveness of defense against model stealing attacks is relatively high, and therefore, the robustness of defense against model stealing attacks is relatively high. Further, the target confidence of the corresponding attack strength can be directly and timely determined by the preset mapping relationship through each query of the to-be-processed data, without the need for additional calculation, the efficiency of determining the target confidence is relatively high, and therefore, the efficiency of defense against model stealing attacks is relatively high. BRIEF DESCRIPTION OF DRAWINGS

[0023] Figure 1 An architecture schematic diagram of a defense system against model stealing attacks disclosed by the embodiments of the present application;

[0024] Figure 2 A flowchart of a defense method against model stealing attacks disclosed by the embodiments of the present application;

[0025] Figure 3 A flowchart of a method for training a benign and malignant detection module disclosed by the embodiments of the present application;

[0026] Figure 4 A flowchart of a method for a reasoning countermeasure module disclosed by the embodiments of the present application;

[0027] Figure 5 Another architecture schematic diagram of a defense system against model stealing attacks disclosed by the embodiments of the present application;

[0028] Figure 6A schematic diagram of a defense device against model stealing attacks disclosed in an embodiment of the present application;

[0029] Figure 7 A structural schematic diagram of a computer device disclosed in an embodiment of the present application. DETAILED DESCRIPTION

[0030] The embodiments of the present application provide a defense method against model stealing attacks, a defense device against model stealing attacks, a computer device, and a computer readable storage medium, which can improve the robustness and efficiency of the defense against model stealing attacks.

[0031] Referring to Figure 1 , the architecture of the defense system against model stealing attacks in the embodiments of the present application includes:

[0032] The computer device 101 and the client 102. When the defense against model stealing attacks is performed, the computer device 101 can be connected with the client 102. The computer device 101 can acquire the to-be-processed data sent by the client 102, can input the to-be-processed data into a pre-trained defense model, the benignity and virulence detection module of the defense model can perform benignity and virulence detection on the to-be-processed data based on a preset benign data distribution range, to obtain a target detection result of the to-be-processed data, and the countermeasure module can determine a target attack intensity corresponding to the to-be-processed data based on the target detection result, and determine a target confidence corresponding to the target attack intensity based on a preset mapping relationship, to perform corresponding reasoning on the to-be-processed data based on the target confidence, to obtain a reasoning result corresponding to the to-be-processed data output by the defense model, and finally return the reasoning result corresponding to the to-be-processed data to the client 102.

[0033] Based on Figure 1 the defense system against model stealing attacks shown in the figure, referring to Figure 2 , Figure 2 A flowchart of a defense method against model stealing attacks disclosed in an embodiment of the present application, the method includes:

[0034] 201, acquiring to-be-processed data.

[0035] In the embodiments, when the defense against model stealing attacks is performed, the to-be-processed data can be acquired.

[0036] Specifically, the to-be-processed data can include but is not limited to image data, text data, etc.

[0037] 202, inputting the to-be-processed data into a pre-trained defense model, the defense model including a benignity and virulence detection module and a countermeasure module.

[0038] After obtaining the to-be-processed data, the to-be-processed data can be input into the pre-trained defense model, and the defense model includes a benignity detection module and a countermeasure module.

[0039] Specifically, the benignity detection module and the countermeasure module are pre-trained models.

[0040] 203. The benignity detection module performs benignity detection on the to-be-processed data based on a preset benign data distribution range to obtain a target detection result of the to-be-processed data, and the preset benign data distribution range is used to represent the distribution of the behavior characteristics of each benign data.

[0041] After inputting the to-be-processed data into the pre-trained defense model, the benignity detection module can perform benignity detection on the to-be-processed data based on a preset benign data distribution range to obtain a target detection result of the to-be-processed data, and the preset benign data distribution range is used to represent the distribution of the behavior characteristics of each benign data.

[0042] Specifically, the preset benign data distribution range can include but is not limited to ranges involved in random distribution, normal distribution, etc. Benignity refers to data that is non-attackive, and malignity refers to data that is attackive. The preset benign data distribution range can be used to evaluate whether the to-be-processed data conforms to the statistical characteristics of normal behavior. If the to-be-processed data falls within the preset benign data distribution range, it indicates that the to-be-processed data is considered normal, i.e., the detection result is benign data, and if the to-be-processed data exceeds this preset range, it indicates that the behavior characteristics of the to-be-processed data do not conform to the known benign data pattern, and at this time, it is judged to be malicious or abnormal data.

[0043] It can be understood that the preset benign data distribution range can include but is not limited to benign data distribution ranges of multiple types and / or multiple intensity attacks.

[0044] 204. The countermeasure module determines a target attack intensity corresponding to the to-be-processed data based on the target detection result, and determines a target confidence corresponding to the target attack intensity based on a preset mapping relationship, to perform corresponding reasoning on the to-be-processed data based on the target confidence, to obtain a reasoning result of the to-be-processed data output by the defense model, and the preset mapping relationship is used to represent a first corresponding relationship between the attack intensity and the confidence under the target condition, and the target confidence is used to represent the trust degree of the to-be-processed data belonging to benign data.

[0045] After obtaining the target detection result of the to-be-processed data, the countermeasure module can determine a target attack strength corresponding to the to-be-processed data based on the target detection result, and determine a target confidence corresponding to the target attack strength based on a preset mapping relationship, so as to perform corresponding reasoning on the to-be-processed data based on the target confidence, and obtain a reasoning result of the to-be-processed data output by the defense model. The preset mapping relationship is used to represent a first corresponding relationship between attack strengths and confidences under a target condition, and the target confidence is used to represent a trust degree of the to-be-processed data belonging to benign data.

[0046] Specifically, the preset mapping relationship can include, but is not limited to, mapping relationships of various types of attacks, and the like.

[0047] It is worth mentioning that the pre-set mapping relationship provides a general rule, so that in different scenarios, for attacks of different strengths, consistent confidence evaluation can be maintained, and the reliability of the system is enhanced. Secondly, if it is necessary to change the relationship between confidence and strength, the preset mapping relationship can be updated, thereby simplifying the maintenance and adaptive adjustment process of the model.

[0048] It should be understood that the first corresponding relationship under the target condition can be used to represent the corresponding relationship between a larger attack strength and a smaller confidence, and the corresponding relationship between a smaller attack strength and a larger confidence. It can also be other regular or irregular corresponding relationships that can achieve a defense effect, which is not limited here.

[0049] In the embodiments of the present application, the to-be-processed data can be detected for benignity and malignancy based on a preset benign data distribution range, which can improve the accuracy of detection. The target attack strength corresponding to the to-be-processed data can be determined based on the target detection result, and the target confidence corresponding to the target attack strength can be determined based on the preset mapping relationship, which can perform dynamic defense against model stealing attacks, reduce the possibility of attackers learning how to identify and avoid defense, and has high effectiveness in defense against model stealing attacks. Therefore, the robustness of the defense against model stealing attacks is high. Further, the target confidence of the corresponding attack strength can be directly determined in real time by the preset mapping relationship for each query of the to-be-processed data, without the need for additional calculation, and the efficiency of determining the target confidence is high. Therefore, the efficiency of the defense against model stealing attacks is high.

[0050] In the embodiments of the present application, the method of determining the target attack strength corresponding to the to-be-processed data based on the target detection result, and determining the target confidence corresponding to the target attack strength based on the preset mapping relationship can be various. Figure 2 The method of defending against model stealing attacks shown in FIG. 8 is described below.

[0051] In this embodiment, when the defense method against model stealing attacks is performed, the to-be-processed data can be acquired first.

[0052] Specifically, the to-be-processed data can include but is not limited to image data, text data, etc.

[0053] After the to-be-processed data is acquired, the to-be-processed data can be input into a pre-trained defense model, and the defense model includes a benignity detection module and a countermeasure module.

[0054] After the to-be-processed data is input into the pre-trained defense model, the benignity detection module can perform benignity detection on the to-be-processed data based on a preset benign data distribution range to obtain a target detection result of the to-be-processed data, and the preset benign data distribution range is used to represent the distribution of the behavior characteristics of each benign data.

[0055] Specifically, the preset benign data distribution range can include but is not limited to a range involved in random distribution, normal distribution, etc. Benignity refers to that the data is non-attack, and malignity refers to that the data is attack.

[0056] The method of performing benignity detection on the to-be-processed data based on the preset benign data distribution range to obtain the target detection result of the to-be-processed data can be that if the to-be-processed data is within a target range of the preset benign data distribution range, it is determined that the target detection result is used to represent that the to-be-processed data is benign data, and if the to-be-processed data is outside the target range of the preset benign data distribution range, it is determined that the target detection result is used to represent that the to-be-processed data is malignant data.

[0057] Specifically, whether the to-be-processed data conforms to the statistical characteristics of normal behavior can be evaluated according to the preset benign data distribution range. If the to-be-processed data falls within the preset benign data distribution range, it indicates that the to-be-processed data is considered normal, that is, the detection result is benign data, and if the to-be-processed data exceeds the preset range, it indicates that the behavior characteristics of the to-be-processed data do not conform to the known benign data mode, and at this time, the data is judged as malicious or abnormal data.

[0058] Before the benignity detection module performs benignity detection on the to-be-processed data based on the preset benign data distribution range, a to-be-processed data sample can be acquired, the to-be-processed data sample is labeled with a detection result, and then the benignity detection module performs benignity detection on the to-be-processed data sample based on the preset benign data distribution range to obtain a predicted detection result. Finally, when the loss between the predicted detection result and the labeled detection result satisfies a convergence condition, a trained benignity detection module is obtained.

[0059] Specifically, please refer to Figure 3 , Figure 3A flowchart of a method for training a benign and malignant detection module (out-of-distribution detection module) disclosed in an embodiment of the present application is shown in Figure 3 It can be seen that the steps involved in the method for training the benign and malignant detection module can include the following steps:

[0060] (1) Training of the initial model: the initial model is trained using the data set on the original problem domain;

[0061] (2) Training of the GAN: the GAN is trained using the data set composed of the feature vectors of the initial model, so that the discriminator D obtained by training can preliminarily distinguish between in-distribution samples and out-of-distribution samples (in-distribution samples are used to represent benign data, and out-of-distribution samples are used to represent malignant data);

[0062] (3) Joint fine-tuning: the model is fine-tuned by the value of the discriminator to further improve the distinguishing ability of the in-distribution samples and the out-of-distribution samples.

[0063] After obtaining the target detection result of the to-be-processed data, the countermeasure module can determine the target attack strength corresponding to the to-be-processed data based on the target detection result, and determine the target confidence corresponding to the target attack strength based on a preset mapping relationship, so as to perform corresponding reasoning on the to-be-processed data based on the target confidence, and obtain the reasoning result of the to-be-processed data output by the defense model. The preset mapping relationship is used to represent a first correspondence relationship between the attack strength and the confidence under the target condition, and the target confidence is used to represent the trust degree of the to-be-processed data belonging to benign data.

[0064] It is worth mentioning that the pre-set mapping relationship provides a general rule, so that in different scenarios, for different intensity attacks, consistent confidence evaluation can be maintained, enhancing the reliability of the system. Secondly, if it is necessary to change the relationship between the confidence and the strength, it is only necessary to update the preset mapping relationship, thereby simplifying the maintenance and adaptive adjustment process of the model.

[0065] The method for determining the target attack strength corresponding to the to-be-processed data based on the target detection result can be that if the target detection result is used to represent that the to-be-processed data is benign data, the attack strength corresponding to the to-be-processed data is determined as a first attack strength, and if the target detection result is used to represent that the to-be-processed data is malignant data, the attack strength corresponding to the to-be-processed data is determined as a second attack strength based on the target position of the to-be-processed data in the preset benign data distribution range, and the first attack strength is less than the second attack strength.

[0066] Specifically, the value of the first attack strength can be zero or other values less than the second attack strength.

[0067] The first correspondence relationship is used to represent a corresponding relationship between a larger attack intensity and a smaller confidence degree, and a corresponding relationship between a smaller attack intensity and a larger confidence degree.

[0068] It is worth mentioning that in actual situations, it is generally believed that the greater the attack intensity is, the smaller the trust degree of the data to be processed is, that is, the confidence degree tends to be smaller, and therefore, the corresponding relationship conforms to the understanding of the natural law of security threats and improves the rationality of risk assessment.

[0069] The target attack intensity corresponds to the target confidence degree based on the preset mapping relationship. Before the target attack intensity corresponds to the target confidence degree based on the preset mapping relationship, each initial data combination can be obtained, each initial data combination includes each initial attack intensity and each initial attack intensity corresponding initial confidence degree, and each initial data combination is sorted in ascending order of attack intensity to obtain an initial data combination sequence. The target attack intensity corresponds to the target confidence degree based on the initial data combination sequence.

[0070] Specifically, the initial data combination sequence can involve the range of the discriminator value, the range of the ranking, and the value of the confidence degree. For example, the range of the discriminator value is -0.1 to 0.1, the range of the ranking includes the first to the 60,000th, and the earlier the term is, the higher the value of the confidence degree is.

[0071] It is worth mentioning that the ordered data structure (initial data combination sequence) is conducive to quickly finding the best confidence degree corresponding to the target attack intensity and improves the efficiency of algorithm operation.

[0072] The target attack intensity corresponds to the target confidence degree based on the preset mapping relationship. The method of determining the target attack intensity corresponding to the target confidence degree based on the preset mapping relationship can be that the target attack intensity corresponds to the target temperature decay value based on the second correspondence relationship, and then the target confidence degree is determined based on the target temperature decay value and the initial confidence degree. The preset mapping relationship includes the second correspondence relationship between the attack intensity and the temperature decay value.

[0073] Specifically, the attack intensity and the corresponding temperature decay value can present a positive relationship.

[0074] It is worth mentioning that the temperature decay module can adjust the temperature according to the detection module output value, which can not affect the prediction accuracy of the model, has real-time performance, and will not cause the decline of the model inference speed due to cumulative statistics. Therefore, through the processing of temperature decay, fast response can be provided under the premise of maintaining high prediction accuracy, and the performance loss is small.

[0075] Before the anti-measure module determines the target attack strength corresponding to the to-be-processed data based on the target detection result and determines the target confidence corresponding to the target attack strength based on the preset mapping relationship to perform corresponding reasoning on the to-be-processed data based on the target confidence to obtain the reasoning result of the to-be-processed data output by the defense model, a detection result sample of a to-be-processed data sample can be obtained first, the detection result sample is labeled with a reasoning result corresponding to the to-be-processed data sample, then the anti-measure module determines an attack strength sample corresponding to the to-be-processed data sample based on the detection result sample, and determines a confidence sample corresponding to the attack strength sample based on the preset mapping relationship, to perform corresponding reasoning on the to-be-processed data sample based on the confidence sample, to obtain a predicted reasoning result of the to-be-processed data sample output by the defense model, when a loss between the predicted reasoning result and the labeled reasoning result satisfies a convergence condition, a trained anti-measure module is obtained.

[0076] Specifically, the method for training the anti-measure module (related to the temperature decay module) is similar in principle to the method for reasoning of the anti-measure module (related to the temperature decay module). Here, the reasoning stage is described, and the training stage is not described again. For details, please refer to Figure 4 , Figure 4 The flowchart of the method for reasoning of the anti-measure module (related to the temperature decay module) disclosed in an embodiment of the present application is shown in Figure 4 It can be seen that the anti-measure module can output corresponding threshold values for distribution in-sample and out-of-sample in combination with the fine-tuned discriminator and the fine-tuned initial model in the training stage, and the ranking of the query sample in the distribution in-sample (i.e., the ranking of the possibility of being benign data) is used as the index of temperature decay, wherein the index decay factor is r d .

[0077] The method for obtaining the to-be-processed data can be obtaining the to-be-processed data sent by the client, the to-be-processed data being data input by the user in the interface of the client, and after obtaining the reasoning result corresponding to the to-be-processed data output by the defense model, the reasoning result corresponding to the to-be-processed data can be returned to the client.

[0078] Specifically, the architecture of the embodiment of the present application can include a user end (client), a service providing end (computer device), and a defense agent (defense model), and is realized through the interaction of the service providing end and the user end. For details, please refer to Figure 5 , Figure 5 The system architecture diagram for another defense against model stealing attacks disclosed in an embodiment of the present application is shown in Figure 5It can be seen that the main function of the server side is to provide the prediction service of the model, to provide the initial training model for the defense agent, to set the temperature decay parameter a of the counterattack framework of the theft attack, and to provide the input vector features before the full connection layer for the defense agent. The main function of the defense framework is to assist the server side in monitoring and self-adapting the counterattack of the sample. The main function of the user side is to obtain the machine learning service demand provided by the user side. Specifically, for the user side, an input box can be provided to let the user input or upload the query data, such as pictures or texts, and then the query data is sent to the server side, and the response of the server side is waited. Then the output result returned by the server side can be received and displayed on the screen, such as the classification label or the probability distribution. If the user wants to end the session, a quit button is provided to let the user disconnect the connection with the server side.

[0079] It should be understood that the embodiments of the present application can also defend against various attack types of attacks. Specifically, the defense method corresponding to each attack type against the model theft attack can be implemented through the preset benign data distribution range and the preset mapping relationship corresponding to each attack type, and the defense method is similar to the above method. Here, it will not be repeated.

[0080] In the embodiment, the benignity and malignancy of the to-be-processed data can be detected based on the preset benign data distribution range, the accuracy of detection can be improved, the target attack intensity corresponding to the to-be-processed data can be determined based on the target detection result, and the target confidence corresponding to the target attack intensity can be determined based on the preset mapping relationship, the dynamic defense against model stealing attacks can be performed, the possibility of learning how to identify and evade defense by attackers can be reduced, the effectiveness of the defense against model stealing attacks is higher, and therefore, the robustness of the defense against model stealing attacks is higher. Further, the target confidence of the corresponding attack intensity can be directly and timely determined by the preset mapping relationship through the query of the to-be-processed data each time, without additional calculation, the efficiency of determining the target confidence is higher, and therefore, the efficiency of the defense against model stealing attacks is higher. Secondly, the application embodiment designs a prediction stage anti-stealing technology for online monitoring and real-time countermeasures, a real-time detector is trained synchronously in the training stage, and the output value of the real-time detector is used as an evaluation index to dynamically adjust the result of model output in the test stage, so as to perform real-time countermeasures on different query samples, so that the success rate of the defense against model stealing attacks reaches 98.5% under the premise that the model performance accuracy decreases by 3.5%, different types of model stealing attacks can be effectively defended against, the user experience is not affected, different deep learning frameworks and platforms are compatible, deployment and updating are convenient, and analysis and evaluation are convenient. Then, the detection model of the application embodiment is sample-granularity and memory-free, is not affected by adaptive stealing attacks, can detect not only stealing attacks but also other types of attacks, has a certain universality, and can defend against various model condition settings and various types of stealing attacks, and has strong robustness. Furthermore, it can be migrated on multiple frameworks, and therefore has universality. Furthermore, the preset mapping relationship provides a general rule, so that in different scenarios, the confidence evaluation of attacks of different intensities can be consistent, the reliability of the system is enhanced, and if the relationship between confidence and intensity needs to be changed, the preset mapping relationship only needs to be updated, thereby simplifying the maintenance and adaptability adjustment process of the model. Furthermore, in actual situations, it is generally believed that the greater the attack intensity, the smaller the trust degree of the to-be-processed data belonging to benign data, that is, the confidence tends to be smaller, and this corresponding relationship conforms to the understanding of the natural law of security threats, and improves the rationality of risk assessment. Furthermore, the ordered data structure (initial data combination sequence) is beneficial to quickly finding the best confidence corresponding to the target attack intensity, and improves the efficiency of algorithm operation. Finally, the temperature decay module can adjust the temperature according to the output value of the detection module, can not affect the prediction accuracy of the model, has real-time performance, and will not cause the decrease of the reasoning speed of the model due to cumulative statistics.

[0081] The defense method against the model stealing attack in the embodiments of the present application is described above, and the defense device against the model stealing attack in the embodiments of the present application is described below. Please refer to Figure 6 One embodiment of the defense device against the model stealing attack in the embodiments of the present application includes:

[0082] an acquisition unit, configured to acquire to-be-processed data;

[0083] an input unit, configured to input the to-be-processed data into a pre-trained defense model, the defense model including a benignity detection module and a countermeasure module;

[0084] a benignity detection unit, configured to perform benignity detection on the to-be-processed data by the benignity detection module based on a preset benign data distribution range, to obtain a target detection result of the to-be-processed data, the preset benign data distribution range being used to represent a distribution of behavior features of each benign data;

[0085] a countermeasure processing unit, configured to determine a target attack intensity corresponding to the to-be-processed data based on the target detection result by the countermeasure module, and determine a target confidence corresponding to the target attack intensity based on a preset mapping relationship, to perform corresponding reasoning on the to-be-processed data based on the target confidence, to obtain a reasoning result of the to-be-processed data output by the defense model, the preset mapping relationship being used to represent a first corresponding relationship between attack intensities and confidences under a target condition, and the target confidence being used to represent a trust degree of the to-be-processed data belonging to benign data.

[0086] In the embodiments of the present application, the to-be-processed data can be detected for benignity based on the preset benign data distribution range, which can improve the accuracy of detection, and the target attack intensity corresponding to the to-be-processed data can be determined based on the target detection result, and the target confidence corresponding to the target attack intensity can be determined based on the preset mapping relationship, which can perform dynamic defense against the model stealing attack, reduce the possibility of attackers learning how to identify and avoid defense, and has high effectiveness of defense against the model stealing attack, and thus has high robustness of defense against the model stealing attack. Further, the target confidence of the corresponding attack intensity can be directly determined in real time by the preset mapping relationship each time the to-be-processed data is queried, without additional calculation, and the efficiency of determining the target confidence is high, and thus the efficiency of defense against the model stealing attack is high.

[0087] Please refer to Figure 7 One embodiment of the computer device 700 in the embodiments of the present application includes:

[0088] The central processor 701, the memory 705, the input and output interface 704, the wired or wireless network interface 703 and the power supply 702;

[0089] The memory 705 is a volatile storage memory or a persistent storage memory.

[0090] The central processor 701 is configured to communicate with the memory 705 and execute the instruction operation in the memory 705 to perform the method in the foregoing Figure 2 embodiments.

[0091] The embodiments of the present application further provide a computer readable storage medium including instructions, when the instructions are run on a computer, causing the computer to execute the method in the foregoing Figure 2 embodiments.

[0092] The embodiments of the present application further provide a computer program product including instructions, when the computer program product is run on a computer, causing the computer to execute the method in the foregoing Figure 2 embodiments.

[0093] It should be understood that, although each step in the flowchart involved in each of the above-described embodiments is displayed in sequence according to the arrow, these steps are not necessarily executed in sequence according to the arrow. Unless otherwise specified herein, the execution of these steps is not strictly limited in sequence, and these steps can be executed in other sequences. Moreover, at least part of the steps in the flowchart involved in each of the above-described embodiments can include multiple steps or multiple stages, which are not necessarily executed at the same time, but can be executed at different times, and the execution sequence of these steps or stages is not necessarily sequential, but can be executed in rotation or alternation with at least part of other steps or steps or stages in other steps.

[0094] Those skilled in the art can clearly understand that, for the convenience and brevity of description, the specific working process of the above-described system, device and unit can refer to the corresponding process in the foregoing method embodiments, which will not be described herein.

[0095] In several embodiments provided in the present application, it should be understood that the disclosed system, device and method can be implemented in other manners. For example, the described device embodiments are merely schematic. The division of the units is merely a logical function division. There can be another division manner for the actual implementation, for example, multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed. In addition, the displayed or discussed mutual couplings or direct couplings or communication connections between the units can be indirect couplings or communication connections through some interfaces, devices or units, and can be electrical, mechanical or in other forms.

[0096] The units described as separated components can or can not be physically separated, and the components displayed as units can or can not be physical units, i.e., can be located in one place, or can be distributed on a plurality of network units. Some or all of the units can be selected according to actual needs to achieve the purposes of the embodiments.

[0097] In addition, each functional unit in the embodiments of the present application can be integrated in a processing unit, or each unit can exist physically as a separate unit, or two or more units can be integrated in one unit. The integrated unit can be implemented in the form of hardware, or in the form of a software functional unit.

[0098] When the integrated unit is implemented in the form of a software functional unit and sold or used as an independent product, it can be stored in a computer readable storage medium. Based on such an understanding, the technical solutions of the present application essentially, or the part that contributes to the prior art, or all or a part of the technical solutions can be embodied in the form of a software product. The computer software product is stored in a storage medium, and includes several instructions for causing a computer device (which can be a personal computer, a server, or a network device, etc.) to execute all or part of the steps of the methods described in the embodiments of the present application. The foregoing storage medium includes: U disk, mobile hard disk, read-only memory (ROM, read-only memory), random access memory (RAM, random access memory), magnetic disk or optical disk, and various other media that can store program codes.

Claims

1. A defense method against model theft attacks, characterized in that, include: Obtain the data to be processed; The data to be processed is input into a pre-trained defense model, which includes a benign / malignant detection module and a countermeasure module. The benign / malignant detection module performs benign / malignant detection on the data to be processed based on a preset benign data distribution range to obtain the target detection result of the data to be processed. The preset benign data distribution range is used to characterize the distribution of behavioral features of each benign data. The countermeasure module determines the target attack strength corresponding to the data to be processed based on the target detection result, and determines the target confidence level corresponding to the target attack strength based on a preset mapping relationship. Based on the target confidence level, the module performs corresponding inference on the data to be processed to obtain the inference result corresponding to the data to be processed output by the defense model. The preset mapping relationship is used to characterize the first correspondence between the attack strength and confidence level that meet the target conditions, and the target confidence level is used to characterize the degree of trust that the data to be processed belongs to benign data. The preset mapping relationship includes a second correspondence between attack intensity and temperature attenuation value; The step of determining the target confidence level corresponding to the target attack strength based on a preset mapping relationship includes: The target temperature attenuation value corresponding to the target attack intensity is determined based on the second correspondence. Based on the target temperature decay value and the initial confidence level, the target confidence level is determined. The target temperature decay value is calculated by the countermeasure module based on the rank of the query sample within the distribution as the exponent of the temperature decay factor.

2. The method according to claim 1, characterized in that, The step of performing benign / malignant detection on the data to be processed based on a preset benign data distribution range to obtain the target detection result of the data to be processed includes: If the data to be processed is within the target range of the preset benign data distribution range, then the target detection result is determined to characterize the data to be processed as benign data; If the data to be processed is outside the target range of the preset benign data distribution range, then the target detection result is determined to characterize the data to be processed as malicious data. Determining the target attack strength corresponding to the data to be processed based on the target detection result includes: If the target detection result is used to characterize the data to be processed as benign data, then the attack strength corresponding to the data to be processed is determined to be the first attack strength; If the target detection result is used to characterize the data to be processed as malicious data, then based on the target location of the data to be processed within the preset benign data distribution range in the target detection result, the attack intensity corresponding to the data to be processed is determined as the second attack intensity, and the first attack intensity is less than the second attack intensity.

3. The method according to claim 1, characterized in that, The first correspondence is used to characterize the correspondence between attack strength and confidence level, wherein the attack strength and the confidence level are inversely related.

4. The method according to claim 1, characterized in that, Before determining the target confidence level corresponding to the target attack strength based on the preset mapping relationship, the method further includes: Obtain each initial data combination, wherein each initial data combination includes each initial attack strength and the initial confidence level corresponding to each initial attack strength; The initial data combinations are sorted in ascending order of attack strength to obtain an initial data combination sequence. The step of determining the target confidence level corresponding to the target attack strength based on a preset mapping relationship includes: The target confidence level corresponding to the target attack strength is determined based on the initial data combination sequence.

5. The method according to claim 1, characterized in that, Before the benign / malignant detection module performs benign / malignant detection on the data to be processed based on a preset benign data distribution range, the method further includes: Obtain a data sample to be processed, wherein the data sample is labeled with the detection result; The benign / malignant detection module performs benign / malignant detection on the data sample to be processed based on a preset benign data distribution range to obtain a predicted detection result; When the loss between the predicted detection result and the labeled detection result meets the convergence condition, the benign / malignant detection module that has been trained is obtained.

6. The method according to claim 1, characterized in that, Before the countermeasure module determines the target attack strength corresponding to the data to be processed based on the target detection result, and determines the target confidence level corresponding to the target attack strength based on a preset mapping relationship, and performs corresponding inference on the data to be processed based on the target confidence level to obtain the inference result corresponding to the data to be processed output by the defense model, the method further includes: Obtain detection result samples of the data sample to be processed, wherein the detection result samples are labeled with the inference results corresponding to the data sample to be processed; The countermeasure module determines the attack strength sample corresponding to the data sample to be processed based on the detection result sample, and determines the confidence sample corresponding to the attack strength sample based on the preset mapping relationship. Based on the confidence sample, the module performs corresponding inference on the data sample to be processed to obtain the prediction inference result corresponding to the data sample to be processed output by the defense model. When the loss between the predicted inference result and the labeled inference result meets the convergence condition, the trained countermeasure module is obtained.

7. A defensive device against model theft attacks, characterized in that, include: The acquisition unit is used to acquire data to be processed. An input unit is used to input the data to be processed into a pre-trained defense model, the defense model including a benign / malignant detection module and a countermeasure module; The benign / malignant detection unit is used by the benign / malignant detection module to perform benign / malignant detection on the data to be processed based on a preset benign data distribution range, so as to obtain the target detection result of the data to be processed. The preset benign data distribution range is used to characterize the distribution of behavioral features of each benign data. The countermeasure processing unit is used by the countermeasure module to determine the target attack strength corresponding to the data to be processed based on the target detection result, and to determine the target confidence level corresponding to the target attack strength based on a preset mapping relationship. The unit then performs corresponding inference on the data to be processed based on the target confidence level to obtain the inference result corresponding to the data to be processed output by the defense model. The preset mapping relationship is used to characterize the first correspondence between the attack strength and the confidence level that meet the target conditions. The target confidence level is used to characterize the degree of trust that the data to be processed belongs to benign data. The countermeasure processing unit is specifically used to determine the target temperature decay value corresponding to the target attack intensity based on the second correspondence, and to determine the target confidence level based on the target temperature decay value and the initial confidence level. The preset mapping relationship includes the second correspondence between the attack intensity and the temperature decay value. The target temperature decay value is calculated by the countermeasure module based on the rank of the query sample in the distribution as the exponent of the temperature decay factor.

8. A computer device, characterized in that, include: Central processing unit and memory; The memory is either a short-term storage memory or a persistent storage memory; The central processing unit is configured to communicate with the memory and execute instructions in the memory to perform the method according to any one of claims 1 to 6.

9. A computer-readable storage medium, characterized in that, The computer-readable storage medium includes instructions that, when executed on a computer, cause the computer to perform the method as described in any one of claims 1 to 6.

Images