Training method and device of privacy protection image classification model, and image classification method and device

Abstract

The application discloses a privacy protection image classification model training method, an image classification method and device. The privacy protection image classification model comprises a teacher image classification submodel and a student image classification submodel. The image classification method comprises the following steps: obtaining image data to be classified; classifying and identifying the image data to be classified by using the privacy protection image classification model, and obtaining the classification of the image data to be classified under the premise of privacy protection; the privacy protection image classification model is obtained by using the privacy protection image classification model training method. The device comprises a privacy protection image classification model training device and an image classification device. The application realizes the classification and identification of the image data to be classified by using the privacy protection image classification model.

Description

Technical Field

[0001] This invention belongs to the fields of data security and artificial intelligence, and particularly relates to a training method, image classification method and apparatus for a privacy-preserving image classification model. Background Technology

[0002] Deep learning models have been shown to pose a risk of leaking training data during application. Privacy-preserving deep learning models, a specific technology in the field of privacy computing, allow for open application of the model while protecting the privacy of the original training data. Privacy-preserving image classification models have wide applications in fields such as medical image analysis and facial recognition. Most existing privacy-preserving image classification models use conventional non-privacy model structures and add noise to the training gradients to protect model privacy, which significantly reduces the performance of the image classification model. Currently, transfer learning models based on pre-trained models are the most effective type of privacy-preserving image classification model. They use models pre-trained on public, non-privacy data as a foundation, perform transfer learning on privacy datasets, and add noise to the training gradients to ensure model privacy. However, using transfer learning models requires that the difference between public and privacy data is not too large; otherwise, the image classification performance of the privacy model will decline. Furthermore, using pre-trained models increases the model parameters, which to some extent increases the difficulty of applying privacy-preserving models. Summary of the Invention

[0003] The purpose of this invention is to provide a training method, image classification method, and apparatus for a privacy-preserving image classification model, which addresses the problem that the poor performance of existing privacy-preserving image classification training models affects the classification accuracy of the final privacy-preserving image classification model.

[0004] The present invention is achieved using the following technical solution:

[0005] A training method for a privacy-preserving image classification model, comprising a teacher image classification sub-model and a student image classification sub-model, the method comprising:

[0006] Obtain a privacy image set for training the teacher image classification sub-model and the student image classification sub-model. The privacy image set includes two parts: labeled images and the category labels corresponding to the labeled images, and unlabeled images.

[0007] Obtain a pre-trained image classification model for the teacher image classification sub-model;

[0008] The pre-trained image classification model is reprogrammed and optimized to obtain a teacher image classification sub-model to be trained. The labeled images and the corresponding category labels of the labeled images in the privacy image set are evenly divided into N parts, which are the number of teacher models. The teacher image classification sub-models to be trained are independently trained on the privacy image dataset divided into N parts, resulting in N trained teacher image classification sub-models.

[0009] The unlabeled images in the privacy image set are input into N trained teacher image classification sub-models to obtain the label predictions for the unlabeled images by each teacher image classification sub-model. The N predicted labels for each unlabeled image are aggregated, and noise perturbation is added to the voting of the predicted labels. If the result is less than the selection threshold, the prediction result of the unlabeled image is discarded. Otherwise, by adding noise perturbation to the voting of the predicted labels, the label with the most votes is selected as the label of the image, and the obtained label result is added to the second part of the privacy image set.

[0010] The second part of the privacy image set is input into the student image classification sub-model for training, resulting in a privacy-preserving image classification model.

[0011] A further improvement of this invention is that, when obtaining the privacy image set for training the teacher image classification sub-model and the student image classification sub-model, the privacy image set is the target dataset of the privacy-preserving image classification model, which includes two parts: a labeled privacy image dataset and an unlabeled privacy image dataset; the labeled privacy image dataset contains privacy images and corresponding labels, while the unlabeled privacy image dataset contains only privacy images.

[0012] A further improvement of this invention is that the pre-trained image classification model of the teacher image classification sub-model is obtained by training the initialized image classification model using a public non-privacy dataset; wherein the public non-privacy dataset refers to an image classification dataset that is publicly used and does not involve privacy issues, and the initialized image classification model refers to an untrained image classification model.

[0013] A further improvement of this invention lies in that the model reprogramming optimization wraps the pre-trained image classification model of the input teacher image classification sub-model, freezes all model parameters, and adds additional training parameters to obtain the teacher image classification sub-model to be trained, including:

[0014] Freeze input model parameters: Freeze all trainable parameters of the pre-trained image classification model of the teacher image classification sub-model;

[0015] Add trainable noise parameters to the model input: Add trainable noise parameters that wrap around the input image to the model input.

[0016] A label classification mapping network is added to the output of the model: a label classification mapping network is added to the output of the model to map the class probabilities from the pre-trained image classification model of the teacher image classification sub-model to the class probabilities of the privacy image set.

[0017] A further improvement of this invention is that the teacher image classification sub-model to be trained is independently trained on a privacy image dataset divided into several teacher models, including:

[0018] The teacher image classification sub-model to be trained is copied N times and trained independently on the corresponding N independently divided privacy image datasets. The different teacher image classification sub-models to be trained are independent of each other and do not share any data information.

[0019] A further improvement of this invention is that the second part of the privacy image set is input into the student image classification sub-model for training, including:

[0020] The student image classification sub-model is trained using a semi-supervised learning algorithm for image classification model training and the input training data. The input training data is the second part of the privacy image set, which includes two parts: a labeled image dataset obtained by voting and perturbation by the teacher model, and the remaining unlabeled image dataset that was not voted on by the teacher model or was discarded by the teacher's vote. The labeled image dataset serves as the labeled data input to the semi-supervised image classification model training algorithm, while the unlabeled image classification dataset serves as the unlabeled data input to the semi-supervised image classification model training algorithm.

[0021] An image classification method, comprising:

[0022] Obtain the image data to be classified;

[0023] The privacy-preserving image classification model is used to classify and identify the image to be classified, thereby obtaining the classification of the image under the premise of privacy protection; the privacy-preserving image classification model is obtained through the training method of the privacy-preserving image classification model.

[0024] A privacy-preserving image classification model training device, the privacy-preserving image classification model including a teacher image classification sub-model and a student image classification sub-model, the training device comprising:

[0025] The acquisition unit is used to acquire the image set used to train the privacy-preserving image classification model. The image set includes labeled images, unlabeled images, and category labels corresponding to the labeled images; and to acquire the pre-trained image classification model used for the teacher image classification sub-model.

[0026] The teacher model training unit modifies the pre-trained image classification model using model reprogramming, and uses it as a teacher image classification sub-model to be trained. The image dataset is divided into N parts with labeled images and their corresponding category labels, and these parts are independently input into N identical teacher image classification sub-models to be trained, resulting in N teacher image classification sub-models.

[0027] The teacher prediction voting unit uses N teacher image classification sub-models obtained from the teacher model unit to classify and identify unlabeled images, obtaining N classification prediction voting results for each unlabeled image; noise is added to the voting results of each unlabeled image, and the results that do not meet the selection threshold after adding noise are removed, and noise is added to the remaining results to obtain the predicted label results of some unlabeled images.

[0028] The student model training unit trains the initial student image classification model by inputting the predicted label results of unlabeled images and partially unlabeled images into the model.

[0029] An image classification device, comprising:

[0030] The receiving unit is used to acquire the image data to be classified.

[0031] The prediction unit is used to classify and identify the image to be classified using a privacy-preserving image classification model, and to obtain the classification of the image to be classified under the premise of privacy protection; the privacy-preserving image classification model is obtained through the training method of the privacy-preserving image classification model.

[0032] An electronic device, comprising:

[0033] Memory, used to store executable instructions;

[0034] The processor, when executing executable instructions stored in the memory, implements the training method for the privacy-preserving image classification model.

[0035] The present invention has at least the following beneficial technical effects:

[0036] This invention provides a privacy-efficient image classification model training method that utilizes a teacher-student model training approach. The teacher model is trained on privacy-preserving data, and then voting is performed on non-privacy-preserving data. By perturbing the voting results and selectively accepting data according to the concentration of the voting results and a set selection threshold, the impact of privacy protection on model effectiveness can be significantly reduced.

[0037] Furthermore, by replacing the original teacher model with a pre-trained model, during the teacher model training phase, the model, pre-trained on public data, is used for transfer learning training on private data. Utilizing the knowledge learned from public data significantly improves the training effectiveness of the teacher model.

[0038] Furthermore, by modifying the pre-trained teacher model using model reprogramming techniques, the number of training parameters is significantly reduced, thereby lowering training overhead. In addition, model reprogramming can significantly improve the transfer learning ability of the pre-trained model in cross-domain scenarios, thus enhancing the performance of the teacher model. Attached Figure Description

[0039] Figure 1 This is a schematic diagram of the training framework of the present invention.

[0040] Figure 2 This is a schematic diagram of the model reprogramming of the present invention.

[0041] Figure 3 This is a schematic diagram of the perturbation voting method with a selection threshold according to the present invention.

[0042] Figure 4 This is a comparison chart of the classification accuracy of the present invention and the comparison algorithm under different privacy budget conditions.

[0043] Figure 5 This is a comparison chart of the classification accuracy of the present invention and the comparison algorithm when there is a large difference between the pre-training data and the privacy data.

[0044] Figure 6 This is a structural block diagram of a privacy-preserving image classification model training device according to the present invention.

[0045] Figure 7 This is a structural block diagram of an image classification device according to the present invention. Detailed Implementation

[0046] Exemplary embodiments of the present disclosure will now be described in more detail with reference to the accompanying drawings. While exemplary embodiments of the present disclosure are shown in the drawings, it should be understood that the present disclosure may be implemented in various forms and should not be limited to the embodiments set forth herein. Rather, these embodiments are provided to enable a more thorough understanding of the present disclosure and to fully convey the scope of the disclosure to those skilled in the art. It should be noted that, unless otherwise specified, the embodiments and features described herein can be combined with each other. The present invention will now be described in detail with reference to the accompanying drawings and embodiments.

[0047] This invention provides a training method for a privacy-preserving image classification model, which includes a teacher image classification sub-model and a student image classification sub-model. The method includes:

[0048] Obtain a privacy image set for training the teacher image classification sub-model and the student image classification sub-model. The privacy image set includes two parts: labeled images and the category labels corresponding to the labeled images, and unlabeled images.

[0049] Obtain a pre-trained image classification model for the teacher image classification sub-model;

[0050] The pre-trained image classification model is reprogrammed and optimized to obtain a teacher image classification sub-model to be trained. The labeled images and the corresponding category labels of the labeled images in the privacy image set are evenly divided into N parts, which are the number of teacher models. The teacher image classification sub-models to be trained are independently trained on the privacy image dataset divided into N parts, resulting in N trained teacher image classification sub-models.

[0051] The unlabeled images in the privacy image set are input into N trained teacher image classification sub-models to obtain the label predictions for the unlabeled images by each teacher image classification sub-model. The N predicted labels for each unlabeled image are aggregated, and noise perturbation is added to the voting of the predicted labels. If the result is less than the selection threshold, the prediction result of the unlabeled image is discarded. Otherwise, by adding noise perturbation to the voting of the predicted labels, the label with the most votes is selected as the label of the image, and the obtained label result is added to the second part of the privacy image set.

[0052] The second part of the privacy image set is input into the student image classification sub-model for training, resulting in a privacy-preserving image classification model.

[0053] When obtaining the privacy image set used to train the teacher image classification sub-model and the student image classification sub-model, the privacy image set is the target dataset for the privacy-preserving image classification model, comprising two parts: a labeled privacy image dataset and an unlabeled privacy image dataset. The labeled privacy image dataset contains privacy images and their corresponding labels, while the unlabeled privacy image dataset contains only privacy images.

[0054] The pre-trained image classification model of the teacher image classification sub-model is obtained by training the initialized image classification model using a public non-privacy dataset. The public non-privacy dataset refers to an image classification dataset that is publicly available and does not involve privacy issues, and the initialized image classification model refers to an untrained image classification model.

[0055] The model reprogramming optimization involves wrapping the pre-trained image classification model of the input teacher image classification sub-model, freezing all model parameters, and adding additional training parameters to obtain the teacher image classification sub-model to be trained, including:

[0056] Freeze input model parameters: Freeze all trainable parameters of the pre-trained image classification model of the teacher image classification sub-model;

[0057] Add trainable noise parameters to the model input: Add trainable noise parameters that wrap around the input image to the model input.

[0058] A label classification mapping network is added to the output of the model: a label classification mapping network is added to the output of the model to map the class probabilities from the pre-trained image classification model of the teacher image classification sub-model to the class probabilities of the privacy image set.

[0059] The teacher image classification sub-model to be trained is independently trained on a privacy image dataset divided into several teacher models, including:

[0060] The teacher image classification sub-model to be trained is copied N times and trained independently on the corresponding N independently divided privacy image datasets. The different teacher image classification sub-models to be trained are independent of each other and do not share any data information.

[0061] The method of inputting the second part of the privacy image set into the student image classification sub-model for training includes:

[0062] The student image classification sub-model is trained using a semi-supervised learning algorithm for image classification model training and the input training data. The input training data is the second part of the privacy image set, which includes two parts: a labeled image dataset obtained by voting and perturbation by the teacher model, and the remaining unlabeled image dataset that was not voted on by the teacher model or was discarded by the teacher's vote. The labeled image dataset serves as the labeled data input to the semi-supervised image classification model training algorithm, while the unlabeled image classification dataset serves as the unlabeled data input to the semi-supervised image classification model training algorithm.

[0063] Example 1

[0064] Reference Figure 1 The present invention provides a privacy-preserving and efficient image classification model training method, which specifically includes the following steps:

[0065] Step 1, Teacher Model Training Phase: The model training team confirms the privacy data that can be used. Number of teacher models and will privacy data Non-repeating ones are divided into equal parts training datasets For pre-trained image classification models Modify using model reprogramming techniques And used as a teacher model, and repeatedly constructed. There are 1 teacher model, and each teacher model is trained on its corresponding training dataset.

[0066] Step 2, the teacher model voting and annotation stage, specifically includes the following steps:

[0067] Step 2.1: The model trainer collects unlabeled, non-privacy training data. And set the standard deviation of Gaussian noise for privacy checks. Privacy check threshold Voting perturbation Gaussian noise standard deviation Query count .

[0068] Step 2.2: From non-privacy training data Number of samples Unlabeled non-privacy samples .

[0069] Step 2.3: For each sample... Distribute to A trained teacher model Perform label prediction to obtain each sample Predicted label set .

[0070] Step 2.4, Collection A set of predicted labels for unlabeled, non-privacy samples For each predicted label A privacy-based vote was performed on the teachers' predicted vote labels using a perturbation voting method with a selection threshold, resulting in a sample. Corresponding privacy tags .

[0071] Step 2.5, from the privacy label Samples with a corresponding label of -1 are selected from the dataset and combined with other unlabeled, non-privacy samples to form an unlabeled dataset. , and the remaining privacy tags The dataset consists of labeled samples and corresponding data. .

[0072] Step 2.6: Calculate and generate privacy tags. Privacy budget consumed .

[0073] Step 3, Student Model Training Phase: The model trainer obtains training data through Step 3. Some tags ,Will Segmented according to whether or not a tag was obtained and A semi-supervised learning algorithm is used. and The data was used to train the student model and then published.

[0074] refer to Figure 2 For the teacher model, this invention uses model reprogramming technology to modify the teacher model by freezing the pre-trained model. The training parameters, and in The size of the first addition is Trainable noise, in The output The classification mapping network is incorporated, and its specific structure is as follows:

[0075] Trainable noise: The input size is... Zoom in on the private image, zoom in to And add a size of [size missing] outside the scaled image. Trainable noise, resulting in a size of The image was input into the pre-trained model. .

[0076] Classification mapping network: Original output indivual Then, a trainable fully connected neural network is added, indivual Remapped to indivual And as the output of model reprogramming.

[0077] refer to Figure 3 For perturbation voting methods with selection thresholds, the specific steps are as follows:

[0078] Step 1: Obtain the sample Predicted labels gather .

[0079] Step 2: Target the predicted labels Statistics obtained Number of votes in each category and from The category with the most votes

[0080] Step 3, Plus size Gaussian noise, and check + Is it greater than or equal to the privacy check threshold? If the check fails, return. Privacy label =-1 indicates that there is no current voting result and the privacy check threshold is not met. No privacy label will be generated; if the check is successful, proceed to step 4.

[0081] Step 4, targeting For each class in the list, add a size of Gaussian noise .from Select the category with the most noise added. As a sample The tag returns .

[0082] Example 2

[0083] In the description of this invention, it should be understood that "a large gap between public data and private data" means that there is a large difference in the distribution of public data and private data. "" refers to the linear output of the model for each category in multi-class classification tasks, which has not yet been processed by activation functions such as softmax or sigmoid.

[0084] refer to Figure 4 To test the performance of our method under different privacy budgets, and comparing it with three existing state-of-the-art privacy-preserving image classification algorithms, we used ImageNet as the pre-training dataset and CIFAR-10 as the privacy dataset. The evaluation metric was classification accuracy. The results are as follows: Figure 4 As shown in the figure, when the total privacy budget is 2, the classification accuracy of all algorithms is better than when the privacy budget is 1. The classification accuracy of our method is significantly better than the three comparison algorithms when the total privacy budget is 1 and 2, showing better performance.

[0085] refer to Figure 5 To test the impact of model reprogramming on the performance of this method, ImageNet was selected as the pre-training dataset. SVHN, PathMNIST, and BloodMNIST—three datasets significantly different from the pre-training ImageNet dataset—were chosen as privacy datasets. Privacy transfer learning was used as a comparison method, and classification accuracy was used as the evaluation metric. The results are as follows: Figure 5As shown in the figure, under the same total privacy budget, the classification accuracy of this method is significantly superior for three different datasets, and it still has good performance even when there is a large difference between the pre-training dataset and the privacy dataset.

[0086] This invention provides an image classification method, comprising:

[0087] Obtain the image data to be classified;

[0088] The privacy-preserving image classification model is used to classify and identify the image to be classified, thereby obtaining the classification of the image under the premise of privacy protection; the privacy-preserving image classification model is obtained through the training method of the privacy-preserving image classification model.

[0089] like Figure 6 As shown, the present invention provides a privacy-preserving image classification model training device. The privacy-preserving image classification model includes a teacher image classification sub-model and a student image classification sub-model. The training device includes:

[0090] The acquisition unit is used to acquire the image set used to train the privacy-preserving image classification model. The image set includes labeled images, unlabeled images, and category labels corresponding to the labeled images; and to acquire the pre-trained image classification model used for the teacher image classification sub-model.

[0091] The teacher model training unit modifies the pre-trained image classification model using model reprogramming, and uses it as a teacher image classification sub-model to be trained. The image dataset is divided into N parts with labeled images and their corresponding category labels, and these parts are independently input into N identical teacher image classification sub-models to be trained, resulting in N teacher image classification sub-models.

[0092] The teacher prediction voting unit uses N teacher image classification sub-models obtained from the teacher model unit to classify and identify unlabeled images, obtaining N classification prediction voting results for each unlabeled image; noise is added to the voting results of each unlabeled image, and the results that do not meet the selection threshold after adding noise are removed, and noise is added to the remaining results to obtain the predicted label results of some unlabeled images.

[0093] The student model training unit trains the initial student image classification model by inputting the predicted label results of unlabeled images and partially unlabeled images into the model.

[0094] like Figure 7 As shown, the present invention provides an image classification device, comprising:

[0095] The receiving unit is used to acquire the image data to be classified.

[0096] The prediction unit is used to classify and identify the image to be classified using a privacy-preserving image classification model, and to obtain the classification of the image to be classified under the premise of privacy protection; the privacy-preserving image classification model is obtained through the training method of the privacy-preserving image classification model.

[0097] The present invention provides an electronic device comprising: a memory for storing executable instructions; and a processor for implementing the training method of the privacy-preserving image classification model when executing the executable instructions stored in the memory.

[0098] This invention also provides a storage medium storing executable instructions, wherein the executable instructions are stored and when executed by a processor, they will cause the processor to execute the image classification method based on artificial intelligence provided in this invention.

[0099] All or part of the steps in the embodiments can be implemented by hardware related to program instructions. The aforementioned program can be stored in a computer-readable storage medium. When the program is executed, it performs the steps of the above-described method embodiments. The aforementioned storage medium includes various media capable of storing program code, such as mobile storage devices, random access memory (RAM), read-only memory (ROM), magnetic disks, or optical disks.

[0100] Alternatively, if the integrated units of this invention are implemented as software functional modules and sold or used as independent products, they can also be stored in a computer-readable storage medium. Based on this understanding, the technical solutions of the embodiments of this invention, or the parts that contribute to related technologies, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute all or part of the methods described in the various embodiments of this invention. The aforementioned storage medium includes various media capable of storing program code, such as mobile storage devices, RAM, ROM, magnetic disks, or optical disks.

[0101] Although the present invention has been described in detail above with general descriptions and specific embodiments, modifications or improvements can be made to it, which will be obvious to those skilled in the art. Therefore, all such modifications or improvements made without departing from the spirit of the present invention fall within the scope of protection claimed by the present invention.

Claims

1. A training method for a privacy-preserving image classification model, characterized in that, This privacy-preserving image classification model includes a teacher image classification sub-model and a student image classification sub-model. The method includes: Obtain a privacy image set for training the teacher image classification sub-model and the student image classification sub-model. The privacy image set includes two parts: labeled images and the category labels corresponding to the labeled images, and unlabeled images. Obtain a pre-trained image classification model for the teacher image classification sub-model; The pre-trained image classification model is reprogrammed and optimized to obtain a teacher image classification sub-model to be trained. The labeled images and their corresponding category labels in the privacy image set are evenly divided into N parts equal to the number of teacher models. Each teacher image classification sub-model is independently trained on the privacy image dataset divided into N parts, resulting in N trained teacher image classification sub-models. The model reprogramming optimization involves wrapping the pre-trained image classification model, freezing all model parameters, and adding additional training parameters to obtain the teacher image classification sub-model to be trained, including: Freeze input model parameters: Freeze all trainable parameters of the pre-trained image classification model of the teacher image classification sub-model; Add trainable noise parameters to the model input: Add trainable noise parameters that wrap around the input image to the model input. A label classification mapping network is added to the output of the model: a label classification mapping network is added to the output of the model to map the class probabilities from the pre-trained image classification model of the teacher image classification sub-model to the class probabilities of the privacy image set. The unlabeled images in the privacy image set are input into N trained teacher image classification sub-models to obtain the label predictions for the unlabeled images by each teacher image classification sub-model. The N predicted labels for each unlabeled image are aggregated, and noise perturbation is added to the voting of the predicted labels. If the result is less than the selection threshold, the prediction result of the unlabeled image is discarded. Otherwise, by adding noise perturbation to the voting of the predicted labels, the label with the most votes is selected as the label of the image, and the obtained label result is added to the second part of the privacy image set. The second part of the privacy image set is input into the student image classification sub-model for training to obtain the privacy-preserving image classification model. The student image classification sub-model is trained by a semi-supervised learning algorithm image classification model training algorithm and the input training data. The input training data is the second part of the privacy image set, which includes two parts: a labeled image dataset with labels obtained by voting and perturbation by the teacher model, and the remaining unlabeled image dataset that was not voted on by the teacher model or was discarded by the teacher's vote. The labeled image dataset is used as the labeled data input in the semi-supervised image classification model training algorithm, while the unlabeled image classification dataset is used as the unlabeled data input in the semi-supervised image classification model training algorithm.

2. The training method for the privacy-preserving image classification model according to claim 1, characterized in that, When obtaining the privacy image set used to train the teacher image classification sub-model and the student image classification sub-model, the privacy image set is the target dataset of the privacy-preserving image classification model, which includes two parts: a labeled privacy image dataset and an unlabeled privacy image dataset; the labeled privacy image dataset contains privacy images and corresponding labels, while the unlabeled privacy image dataset contains only privacy images.

3. The training method for the privacy-preserving image classification model according to claim 1, characterized in that, The pre-trained image classification model of the teacher image classification sub-model is obtained by training the initial image classification model on a public non-privacy dataset. The public non-privacy dataset refers to an image classification dataset that is publicly available and does not involve privacy issues, and the initial image classification model refers to an untrained image classification model.

4. The training method for the privacy-preserving image classification model according to claim 1, characterized in that, The teacher image classification sub-model to be trained is independently trained on a privacy image dataset divided into several teacher models, including: The teacher image classification sub-model to be trained is copied N times and trained independently on the corresponding N independently divided privacy image datasets. The different teacher image classification sub-models to be trained are independent of each other and do not share any data information.

5. An image classification method, characterized in that, include: Obtain the image data to be classified; The privacy-preserving image classification model is used to classify and identify the image to be classified, thereby obtaining the classification of the image under the premise of privacy protection; the privacy-preserving image classification model is obtained by the training method of the privacy-preserving image classification model according to any one of claims 1-4.

6. A privacy-preserving image classification model training device, characterized in that, The privacy-preserving image classification model includes a teacher image classification sub-model and a student image classification sub-model. The training device includes: The acquisition unit is used to acquire the image set used to train the privacy-preserving image classification model. The image set includes labeled images, unlabeled images, and category labels corresponding to the labeled images; and to acquire the pre-trained image classification model used for the teacher image classification sub-model. The teacher model training unit modifies the pre-trained image classification model using model reprogramming, serving as the teacher image classification sub-model to be trained. The image dataset is divided into N parts, each containing labeled images and their corresponding class labels. These parts are then independently input into N identical teacher image classification sub-models to be trained, resulting in N teacher image classification sub-models. The model reprogramming optimization wraps the pre-trained image classification model used as the input teacher image classification sub-model, freezing all model parameters and adding additional training parameters to obtain the teacher image classification sub-model to be trained, including: Freeze input model parameters: Freeze all trainable parameters of the pre-trained image classification model of the teacher image classification sub-model; Add trainable noise parameters to the model input: Add trainable noise parameters that wrap around the input image to the model input. A label classification mapping network is added to the output of the model: a label classification mapping network is added to the output of the model to map the class probabilities from the pre-trained image classification model of the teacher image classification sub-model to the class probabilities of the privacy image set. The teacher prediction voting unit uses N teacher image classification sub-models obtained from the teacher model unit to classify and identify unlabeled images, obtaining N classification prediction voting results for each unlabeled image; noise is added to the voting results of each unlabeled image, and the results that do not meet the selection threshold after adding noise are removed, and noise is added to the remaining results to obtain the predicted label results of some unlabeled images. The student model training unit trains the initial student image classification model by inputting the predicted label results of unlabeled images and partially unlabeled images into the model. This includes: the student image classification sub-model is trained using a semi-supervised learning algorithm (image classification model training algorithm) and the input training data; the input training data is the second part of the privacy image set, comprising two parts: a labeled image dataset obtained through teacher model voting and perturbation, and the remaining unlabeled image dataset that was not voted on by the teacher model or was discarded by the teacher's vote; the labeled image dataset serves as the labeled data input to the semi-supervised image classification model training algorithm, while the unlabeled image classification dataset serves as the unlabeled data input to the semi-supervised image classification model training algorithm.

7. An image classification device, characterized in that, include: The receiving unit is used to acquire the image data to be classified. The prediction unit is used to classify and identify the image to be classified using a privacy-preserving image classification model, and to obtain the classification of the image to be classified under the premise of privacy protection; the privacy-preserving image classification model is obtained by the training method of the privacy-preserving image classification model according to any one of claims 1-4.

8. An electronic device, characterized in that, include: Memory, used to store executable instructions; A processor, when executing executable instructions stored in the memory, implements the training method of the privacy-preserving image classification model according to any one of claims 1-4.

Images