Privacy training data leakage risk detection method and device for time sequence classification model

Abstract

The invention discloses a privacy training data leakage risk detection method and device of a time sequence classification model. The method comprises the following steps: dividing a time sequence abnormal transaction data set into a target data set and an auxiliary data set, and constructing a shadow model by using the auxiliary data set; constructing a shadow model sample set containing classification prediction data, real label data as features and member membership states as labels; constructing a member reasoning attack model for simulation by using a multi-scale patch encoder module, a self-attention mechanism and a classifier; the constructed target model sample set is subjected to reasoning through a member reasoning attack model obtained through training and used for simulation, so that the member membership state of each user in the target model sample set is obtained, and the leakage risk of the privacy training data is evaluated through the accuracy of member membership degree reasoning of the privacy training data. According to the method and the device, the privacy training data leakage risk of the time sequence abnormal transaction classification model can be detected by simulating a member reasoning attack process.

Description

Technical Field

[0001] The present invention relates to the fields of data security and machine learning. More specifically, the present invention relates to a method and device for detecting risk of privacy training data leakage of a time series classification model. Background Art

[0002] With the development of big data and artificial intelligence technology, time series data analysis has been widely used in the financial field, such as credit card fraud detection models and stock market abnormal transaction analysis models. These models identify potential fraudulent behaviors or abnormal transactions by learning a large amount of historical transaction data, thereby effectively protecting the security and stability of the financial system. However, these models have the risk of privacy leakage during the training process. In particular, membership inference attacks analyze the model's predicted response to specific data and infer whether the data is used for model training, which may leak the user's privacy-sensitive information, such as the membership status of the transaction user. This attack not only threatens personal privacy, but may also be used for larger-scale data leakage. If the data leakage occurs in the financial field, it may cause serious economic and reputation losses. Therefore, there is an urgent need for a method that can detect the risk of privacy training data leakage in time series anomaly classification models. Summary of the invention

[0003] The present invention provides a method and device for detecting the risk of privacy training data leakage of a time series classification model. The method detects the risk of privacy training data leakage of a model used for a time series abnormal transaction classification task by simulating the process of member reasoning attack, thereby being able to evaluate the privacy risk level of the model and further provide defensive improvements to models with higher risk levels.

[0004] In order to achieve these purposes and other advantages of the present invention, in a first aspect, the present invention provides a privacy training data leakage risk detection method for a time series classification model, comprising:

[0005] Obtain a time series abnormal transaction classification model to be detected, as well as a privacy training data set and a test data set used for the model; wherein the user corresponding to the time series data formed by multiple transactions of the same user in the privacy training data set is a member, and the user corresponding to the time series data formed by multiple transactions of the same user in the test data set is a non-member;

[0006] The privacy training data set of the model is divided into a target model privacy training data set and an auxiliary privacy training data set, and the test set of the model is divided into a target model test data set and an auxiliary test data set, wherein the time series data of the same user are divided into the same data set;

[0007] Build a shadow model and use the auxiliary privacy training dataset to train multiple models with the same structure as the target model, namely the shadow model;

[0008] Construct a shadow model sample set. Use the trained shadow model and the corresponding privacy training data and test data to generate a shadow model sample set. Specifically, obtain the time series data of the first K transactions of each user arranged in time. The classified prediction data obtained after the time series data is classified and predicted by the shadow model constitute a prediction sequence data. In the prediction sequence data, the classified prediction data and the true label data are used as features, and the member affiliation status is used as a label.

[0009] Construct a membership inference attack model for simulation: input the prediction sequence data composed of the classified prediction data into the multi-scale patch encoder module as training data to obtain multi-scale encoded data; use the self-attention mechanism to weighted aggregate the obtained multi-scale encoded data; concatenate the weighted aggregated data and the original multi-scale encoded data without weighted aggregation, and then use the classifier to perform classification processing to infer the user's membership status;

[0010] A target model sample set is constructed, and the constructed target model sample set is input into the trained member inference attack model for simulation to perform member membership state inference, so as to obtain the member membership state of each user in the target model sample set, and the leakage risk of privacy training data is evaluated by the accuracy of member membership degree inference of privacy training data.

[0011] Preferably, in the privacy training data leakage risk detection method of the time series classification model, the process of acquiring the time series data in the privacy training data set and the time series data in the test data set is: if the number of records of historical data is set to X, then the data of each transaction user in the privacy training data set and the test data set in the past X transactions are traced back to form the time series data for classification prediction of the user.

[0012] Preferably, in the privacy training data leakage risk detection method of the time series classification model, the member affiliation status is specifically: if the user belongs to the privacy training data set, the label is 1, otherwise it is 0.

[0013] Preferably, in the privacy training data leakage risk detection method of the time series classification model, the multi-scale patch encoder module comprises:

[0014] A patch partitioning module is used to input the predicted sequence into patch modules of various scales for patch partitioning. The patch lengths obtained by the patch modules of various scales are different.

[0015] Multiple Transformer encoder modules, each patch module is input into a Transformer encoder module for processing;

[0016] Multiple aggregation and flattening modules, each Transformer encoder module corresponds to an aggregation and flattening module, and the data processed by the Transformer encoder module is aggregated and flattened by the aggregation and flattening module to obtain aggregated multi-scale encoded data.

[0017] Preferably, in the privacy training data leakage risk detection method of the time series classification model, in the prediction sequence data, member records and non-member records show different time pattern differences, in the stable interval of the prediction sequence data, the prediction results of member records and non-member records are different in local volatility, and in the volatility interval of the prediction sequence data, the response reliability of changes in the prediction results of member records and non-member records is different.

[0018] Preferably, in the privacy training data leakage risk detection method for the time series classification model, the number of users in the privacy training data and test data of each shadow model is the same, and the number of users in the privacy training data of the target model is the same.

[0019] Preferably, in the privacy training data leakage risk detection method for the time series classification model, the method used to construct the target model sample set is the same as the method used to construct the shadow model sample set.

[0020] In a second aspect, the present invention further provides a privacy training data leakage risk detection device for a time series classification model, which is applied to the privacy training data leakage risk detection method for the time series classification model, comprising:

[0021] An acquisition module, which is used to acquire a time series abnormal transaction classification model to be detected, and a privacy training data set and a test data set for the model; wherein the user corresponding to the time series data formed by multiple transactions of the same user in the privacy training data set is a member, and the user corresponding to the time series data formed by multiple transactions of the same user in the test data set is a non-member;

[0022] A data partitioning module, which is used to divide the privacy training data set of the model into a target model privacy training data set and an auxiliary privacy training data set, and divide the test set of the model into a target model test data set and an auxiliary test data set, wherein the time series data of the same user are divided into the same data set;

[0023] A shadow model building module is used to build a shadow model, which uses an auxiliary privacy training dataset to train multiple models with the same structure as the target model, namely, shadow models;

[0024] The shadow model sample set construction module is used to construct the shadow model sample set. The shadow model and the corresponding privacy training data and test data are used to generate the shadow model sample set. Specifically, the time series data of the first K transactions of each user are obtained in time order. The classified prediction data obtained after the time series data is classified and predicted by the shadow model constitute a prediction sequence data. In the prediction sequence data, the classified prediction data and the real label data are used as features, and the member affiliation status is used as a label.

[0025] A member inference attack model construction module is used to construct a member inference attack model for simulation, input the prediction sequence data composed of the classification prediction data into the multi-scale patch encoder module as training data to obtain multi-scale encoded data; use the self-attention mechanism to weighted aggregate the obtained multi-scale encoded data; splice the weighted aggregated data and the original multi-scale encoded data without weighted aggregation, and then use the classifier to perform classification processing to infer the user's membership status;

[0026] A target model sample set construction module, which generates a target model sample set using the trained target model and the corresponding privacy training data and test data;

[0027] The member affiliation state reasoning module inputs the constructed target model sample set into the trained member affiliation attack model for simulation to perform member affiliation state reasoning, thereby obtaining the member affiliation state of each user in the target model sample set, and evaluating the leakage risk of the privacy training data through the accuracy of the member affiliation reasoning of the privacy training data.

[0028] In a third aspect, the present invention also provides an electronic device, comprising: one or more processors; and a memory communicatively connected to the at least one processor, wherein the memory stores instructions executable by the at least one processor, and the instructions are executed by the at least one processor so that the at least one processor executes the privacy training data leakage risk detection method of the time series classification model.

[0029] In a fourth aspect, the present invention further provides a computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, implements the privacy training data leakage risk detection method for the time series classification model.

[0030] The present invention has at least the following beneficial effects:

[0031] The present invention obtains a time series abnormal transaction classification model to be detected, as well as a privacy training data set and a test data set for the model, and then divides the privacy training data set into a target model privacy training data set and an auxiliary privacy training data set, and divides the test set into a target model test data set and an auxiliary test data set, and uses the auxiliary privacy training data set to train multiple shadow models with the same structure as the target model, so as to use the shadow model to simulate the behavior of the target model. In the obtained shadow model sample set, the model prediction data and the real label data are used as features, and the member affiliation status is used as a label. The obtained shadow model sample set is used to train a member reasoning attack model for simulation. The member reasoning attack model uses a multi-scale patch encoder module to capture multi-level time dependencies, and weights the importance through a cross-scale self-attention aggregation mechanism, thereby extracting rich time semantic features; by accurately identifying the difference in the time pattern of the predicted sequence between member records and non-member records, the model can significantly improve the detection efficiency; finally, with the help of a classifier, the user's member affiliation status is accurately judged, and the potential risk of privacy data leakage is effectively evaluated. The present invention effectively enhances the accuracy of the time series abnormal transaction classification model in identifying privacy leakage risks, which is beneficial to the security of privacy training data.

[0032] Other advantages, objectives and features of the present invention will be embodied in part through the following description, and in part will be understood by those skilled in the art through study and practice of the present invention. BRIEF DESCRIPTION OF THE DRAWINGS

[0033] Figure 1 It is a flow chart of the privacy training data leakage risk detection method of the time series classification model of the present invention;

[0034] Figure 2 The overall framework diagram of the processing process of the privacy training data leakage risk detection method of the time series classification model of the present invention;

[0035] Figure 3 A schematic diagram of a framework for constructing a member reasoning attack model in the privacy training data leakage risk detection method of the time series classification model of the present invention. DETAILED DESCRIPTION

[0036] The present invention is further described in detail below in conjunction with the accompanying drawings so that those skilled in the art can implement the invention with reference to the description.

[0037] It should be understood that the terms such as “having”, “including” and “comprising” used herein do not exclude the existence or addition of one or more other elements or combinations thereof.

[0038] like Figure 1 to Figure 3As shown, an embodiment of the present invention provides a privacy training data leakage risk detection method for a time series classification model, comprising:

[0039] Step S10, obtaining a time series abnormal transaction classification model to be detected, and a privacy training data set and a test data set used for the model; wherein the user corresponding to the time series data formed by multiple transactions of the same user in the privacy training data set is a member, and the user corresponding to the time series data formed by multiple transactions of the same user in the test data set is a non-member.

[0040] Among them, time series data refers to time series data, which is a data column recorded in chronological order with unified indicators. For example, a user's credit card swipe record, stock transaction record, etc. Time series abnormal transactions refer to behaviors that do not conform to the normal transaction pattern in the time series, such as large transactions in a short period of time, frequent instantaneous order withdrawals, etc. The time series abnormal transaction classification model is used to classify and predict time series abnormal transaction data. For example, in the financial field, it can be a credit card fraud detection model, a stock market abnormal transaction analysis model, or other models for time series abnormal transactions. In the time series abnormal transaction classification model, users in the privacy training data set are members, and users in the test data set are non-members.

[0041] The process of acquiring the time series data of the privacy training data set and the time series data in the test data set is as follows: if the number of records of historical data is set to X, then the data of the user of each transaction in the privacy training data set and the test data set in the past X transactions are traced back to form the time series data for classification prediction of the user.

[0042] Step S20: divide the privacy training data set of the model into a target model privacy training data set and an auxiliary privacy training data set, and divide the test set of the model into a target model test data set and an auxiliary test data set, wherein the time series data of the same user are divided into the same data set.

[0043] Among them, the acquired time series abnormal transaction data set is divided into a target data set and an auxiliary data set. The target data set includes a target model privacy training data set and a target model test data set, and the auxiliary data set includes an auxiliary privacy training data set and an auxiliary test data set. Therefore, the privacy training data set used for the time series abnormal transaction classification model is divided into a target model privacy training data set and an auxiliary privacy training data set, and the test set of the model is divided into a target model test data set and an auxiliary test data set. When dividing the data set, it must be based on the user level, that is, the time series data of the same user are divided into the same data set. The embodiment of the present invention does not make specific restrictions on the ratio of dividing the privacy training data set of the model into the target model privacy training data set and the auxiliary privacy training data set. Preferably, 2:8 can be used. The division ratio when the test set of the model is divided into the target model test data set and the auxiliary test data set is also preferably 2:8.

[0044] Step S30: construct a shadow model, and use the auxiliary privacy training data set to train multiple models with the same structure as the target model, namely, shadow models.

[0045] The number of users in the privacy training data and test data of each shadow model is the same, and the number of users in the privacy training data of the target model is the same. Each time, a shadow model is trained by randomly extracting the same number of user data from the privacy training data set of the auxiliary data set.

[0046] Step S40, construct a shadow model sample set, and use the trained shadow model and the corresponding privacy training data and test data to generate a shadow model sample set, specifically: obtain the time series data of the first K transactions of each user arranged in time, and the classified prediction data obtained after the time series data is classified and predicted by the shadow model constitutes a prediction sequence data, wherein, in the prediction sequence data, the classified prediction data and the true label data are used as features, and the member affiliation status is used as a label.

[0047] The member affiliation status is specifically: if the user belongs to the privacy training data set, the label is 1, otherwise it is 0. It should also be noted that the shadow model sample set includes both the prediction sequence data after the privacy training data is classified and predicted, and the prediction sequence data after the test data is classified and predicted. Therefore, in step S40, the shadow model is used to simulate the behavior of the target model to generate a shadow model sample set containing the classification prediction data and the real label data as features and the member affiliation status as a label.

[0048] Step S50, constructing a member inference attack model for simulation: inputting the prediction sequence data consisting of the classified prediction data into the multi-scale patch encoder module as training data to obtain multi-scale encoded data; using the self-attention mechanism to weighted aggregate the obtained multi-scale encoded data; splicing the weighted aggregated data and the original multi-scale encoded data without weighted aggregation, and then using a classifier to perform classification processing to infer the user's member affiliation status.

[0049] Among them, in the prediction sequence data, member records and non-member records will show different time pattern differences, and this difference is used to improve the detection performance. These patterns differ in the stability and volatility of the model prediction. Specifically:

[0050] Local volatility: In the stable interval of the predicted sequence data (the original true label sequence is stable and unchanged), the prediction results of member and non-member records may differ in volatility. For example, the prediction results of member records may be more stable with smaller fluctuations, while the prediction results of non-member records may be more volatile with larger fluctuations.

[0051] Response reliability: In the fluctuation range of the predicted sequence data (the original true label changes), the reliability of the prediction results of member and non-member records is different. Member records may change more timely because the model is more familiar with these data, while non-member records may not respond to the changes in the sequence in time because the model is unfamiliar with them, giving unreliable (low confidence) or even wrong prediction results.

[0052] Among them, the multi-scale patch encoder module includes: a patch division module, which is used to input the prediction sequence into patch modules of multiple scales for patch division, and the patch lengths obtained by dividing patch modules of different scales are different; multiple Transformer encoder modules, each patch module is input into a Transformer encoder module for processing; multiple aggregation flattening modules, each Transformer encoder module corresponds to an aggregation flattening module, and the data processed by the Transformer encoder module is aggregated and flattened by the aggregation flattening module to obtain aggregated multi-scale encoded data.

[0053] In the above step S50, according to the latest patch-based time representation method, multi-scale temporal dependencies are revealed in a data segmentation manner, which can capture rich and continuous time series transformation difference information. Therefore, by using a patch-based method to embed the prediction sequence data, the differences in temporal pattern changes at multiple time scales are captured, which helps to enrich temporal semantic information and improve detection efficiency. At the same time, the self-attention mechanism is used to perform weighted aggregation on the embedding representations of different scales, which can effectively capture the importance differences of multi-scale information.

[0054] Taking into account the integrity of information and the changes that may be brought about by weighting, skip connections are also added. That is, for the obtained multi-scale encoded data, the value of the data itself and the weighted aggregated sequence representation data obtained by the self-attention mechanism are spliced, which is equivalent to letting the data skip the weighted aggregation step of the self-attention mechanism, and then splicing it with the weighted aggregated sequence representation data obtained by the self-attention mechanism. This can retain both the original information of the multi-scale encoded data and the weight information after the self-attention mechanism. Through skip connections, the subsequent classifier can directly use this low-level feature without having to rely entirely on the high-level abstract representation output by the attention layer. Specifically, the classifier is used to process the aggregated sequence representation data and the unweighted original aggregated data through a linear layer to infer their membership status.

[0055] Therefore, the membership inference attack model constructed for simulation can infer the user's membership status, that is, whether the user belongs to the privacy training dataset. If the user belongs to the privacy training dataset, the label is 1, otherwise it is 0.

[0056] Step S60, construct a target model sample set, input the constructed target model sample set into the trained member reasoning attack model for simulation to perform member affiliation state reasoning, thereby obtaining the member affiliation state of each user in the target model sample set, and evaluating the risk of leakage of the privacy training data by the accuracy of the member membership reasoning of the privacy training data.

[0057] In the above steps, the method used to construct the target model sample set is the same as the method used to construct the shadow model sample set. That is, the trained target model and the corresponding privacy training data and test data are used to generate the target model sample set, specifically: the time series data of the first K transactions of each user arranged in time are obtained, and the classified prediction data obtained after the time series data is classified and predicted by the shadow model constitute a prediction sequence data, wherein in the prediction sequence data, the classified prediction data and the real label data are used as features, and the member affiliation status is used as a label.

[0058] In the above steps, the constructed target model sample set is input into the trained member inference attack model for simulation to perform member affiliation state inference, so as to obtain the member affiliation state of each user in the target model sample set. Then, the risk level is evaluated by the accuracy of the member affiliation inference of the user in the privacy training data. The higher the accuracy, the higher the leakage risk.

[0059] The privacy training data leakage risk detection method of the time series classification model is described below through a specific embodiment.

[0060] Step 1: Obtain the time series abnormal transaction classification model to be detected, as well as the privacy training data set and test data set used for the model. The process of obtaining the time series data in the privacy training data set and the time series data in the test data set is as follows: set the number of records of historical data to 5, then trace back the data of the user of each transaction in the privacy training data set and the test data set in the past 5 transactions to form the time series data for classification prediction of the user.

[0061] Step 2: Divide the privacy training data set of the model into a target model privacy training data set and an auxiliary privacy training data set in a ratio of 2:8, and divide the test set of the model into a target model test data set and an auxiliary test data set in the same ratio of 2:8, where the time series data of the same user is divided into the same data set.

[0062] Step 3: Build a shadow model and use the auxiliary privacy training data set to train 10 shadow models with the same structure as the target model. The number of users in the privacy training data and test data of each shadow model is equal, and the number of users in the privacy training data of the target data set is equal. Each time, a shadow model is obtained by randomly extracting the same number of user data from the privacy training data of the auxiliary data set.

[0063] Step 4: Construct a shadow model sample set. Use the trained shadow model and the corresponding privacy training data and test data to generate a shadow model sample set. Specifically, obtain the time series data of the first 20 transactions of each user arranged in time. The classified prediction data obtained after the time series data is classified and predicted by the shadow model constitutes a prediction sequence data. In the prediction sequence data, the classified prediction data and the true label data are used as features, and the member affiliation status is used as a label. If the user belongs to the privacy training data set, the label is 1, otherwise it is 0.

[0064] Step 5. Construct a member inference attack model for simulation: input the prediction sequence data composed of the classified prediction data as training data into the multi-scale patch encoder module to obtain multi-scale encoded data; use the self-attention mechanism to weighted aggregate the obtained multi-scale encoded data; concatenate the weighted aggregated data and the original multi-scale encoded data without weighted aggregation, and then use the classifier for classification processing to infer the user's membership status. Specifically, set the time scale to two, use two encoders with patch lengths of 2 and 4, and the corresponding encoder hidden layer sizes are 16 and 64 respectively. Through the cross-scale self-attention aggregation layer, the obtained multi-scale encoded data is weighted aggregated using a self-attention mechanism with 4 attention heads.

[0065] Step 6: Construct a target model sample set, and input the constructed target model sample set into the trained member inference attack model for simulation to perform member membership state inference, so as to obtain the member membership state of each user in the target model sample set, and evaluate the leakage risk of the privacy training data through the accuracy of the member membership inference of the privacy training data. The specific risk rating standards are shown in the following table. The higher the accuracy, the higher the leakage risk:

[0066] Table 1. Risk leakage rating criteria for privacy training data of time series abnormal transaction classification model

[0067]

[0068] Another embodiment of the present invention further provides a device for detecting risk of privacy training data leakage of a time series classification model, which is applied to the method for detecting risk of privacy training data leakage of a time series classification model, comprising:

[0069] An acquisition module, which is used to acquire a time series abnormal transaction classification model to be detected, and a privacy training data set and a test data set for the model; wherein the user corresponding to the time series data formed by multiple transactions of the same user in the privacy training data set is a member, and the user corresponding to the time series data formed by multiple transactions of the same user in the test data set is a non-member;

[0070] A data partitioning module, which is used to divide the privacy training data set of the model into a target model privacy training data set and an auxiliary privacy training data set, and divide the test set of the model into a target model test data set and an auxiliary test data set, wherein the time series data of the same user are divided into the same data set;

[0071] A shadow model building module is used to build a shadow model, which uses an auxiliary privacy training dataset to train multiple models with the same structure as the target model, namely, shadow models;

[0072] The shadow model sample set construction module is used to construct the shadow model sample set. The shadow model and the corresponding privacy training data and test data are used to generate the shadow model sample set. Specifically, the time series data of the first K transactions of each user are obtained in time order. The classified prediction data obtained after the time series data is classified and predicted by the shadow model constitute a prediction sequence data. In the prediction sequence data, the classified prediction data and the real label data are used as features, and the member affiliation status is used as a label.

[0073] A member inference attack model construction module is used to construct a member inference attack model for simulation, input the prediction sequence data composed of the classification prediction data into the multi-scale patch encoder module as training data to obtain multi-scale encoded data; use the self-attention mechanism to weighted aggregate the obtained multi-scale encoded data; splice the weighted aggregated data and the original multi-scale encoded data without weighted aggregation, and then use the classifier to perform classification processing to infer the user's membership status;

[0074] A target model sample set construction module, which generates a target model sample set using the trained target model and the corresponding privacy training data and test data;

[0075] The member affiliation state reasoning module inputs the constructed target model sample set into the trained member affiliation attack model for simulation to perform member affiliation state reasoning, thereby obtaining the member affiliation state of each user in the target model sample set, and evaluating the leakage risk of the privacy training data through the accuracy of the member affiliation reasoning of the privacy training data.

[0076] Another embodiment of the present invention further provides an electronic device, comprising: one or more processors; and a memory in communication with the at least one processor, wherein the memory stores instructions executable by the at least one processor, and the instructions are executed by the at least one processor so that the at least one processor executes the privacy training data leakage risk detection method of the time series classification model. The electronic device can be any terminal device including a mobile phone, a laptop computer, a desktop computer, a tablet computer, a PDA (Personal Digital Assistant), a POS (Point of Sales), a car computer, etc.

[0077] Another embodiment of the present invention further provides a computer-readable storage medium, on which a computer program is stored. When the program is executed by a processor, the privacy training data leakage risk detection method of the time series classification model is implemented.

[0078] Through the description of the above implementation mode, the technicians in the relevant field can clearly understand that the present invention can be implemented by means of software plus necessary general hardware, and of course, it can also be implemented by special hardware including special integrated circuits, special CPUs, special memories, special components, etc. In general, all functions completed by computer programs can be easily implemented by corresponding hardware, and the specific hardware structure used to implement the same function can also be various, such as analog circuits, digital circuits or special circuits. However, for the present invention, software program implementation is a better implementation mode in more cases. Based on such an understanding, the technical solution of the present invention is essentially or the part that contributes to the prior art can be embodied in the form of a software product, which is stored in a readable storage medium, such as a computer floppy disk, a U disk, a mobile hard disk, a read-only memory (ROM, Read-Only Memory), a random access memory (RAM, Random Access Memory), a disk or an optical disk, etc., including a number of instructions to enable a computer device (which can be a personal computer, a server, or a network device, etc.) to execute the methods described in each embodiment of the present invention.

[0079] The number of devices and processing scales described here are used to simplify the description of the present invention. Applications, modifications and variations of the present invention will be obvious to those skilled in the art.

[0080] Although the embodiments of the present invention have been disclosed as above, they are not limited to the applications listed in the specification and the implementation modes, and they can be fully applied to various fields suitable for the present invention. For those familiar with the art, additional modifications can be easily implemented. Therefore, without departing from the general concept defined by the claims and the scope of equivalents, the present invention is not limited to the specific details and the illustrations shown and described herein.

Claims

1. A privacy training data leakage risk detection method for a time series classification model, characterized in that: include: Obtain a time series abnormal transaction classification model to be detected, as well as a privacy training data set and a test data set used for the model; wherein the user corresponding to the time series data formed by multiple transactions of the same user in the privacy training data set is a member, and the user corresponding to the time series data formed by multiple transactions of the same user in the test data set is a non-member; The privacy training data set of the model is divided into a target model privacy training data set and an auxiliary privacy training data set, and the test set of the model is divided into a target model test data set and an auxiliary test data set, wherein the time series data of the same user are divided into the same data set; Build a shadow model and use the auxiliary privacy training dataset to train multiple models with the same structure as the target model, namely the shadow model; Construct a shadow model sample set. Use the trained shadow model and the corresponding privacy training data and test data to generate a shadow model sample set. Specifically, obtain the time series data of the first K transactions of each user arranged in time. The classified prediction data obtained after the time series data is classified and predicted by the shadow model constitute a prediction sequence data. In the prediction sequence data, the classified prediction data and the true label data are used as features, and the member affiliation status is used as a label. Construct a membership inference attack model for simulation: input the prediction sequence data composed of the classified prediction data into the multi-scale patch encoder module as training data to obtain multi-scale encoded data; use the self-attention mechanism to weighted aggregate the obtained multi-scale encoded data; concatenate the weighted aggregated data and the original multi-scale encoded data without weighted aggregation, and then use the classifier to perform classification processing to infer the user's membership status; A target model sample set is constructed, and the constructed target model sample set is input into the trained member inference attack model for simulation to perform member membership state inference, so as to obtain the member membership state of each user in the target model sample set, and the leakage risk of privacy training data is evaluated by the accuracy of member membership degree inference of privacy training data.

2. The privacy training data leakage risk detection method of the time series classification model according to claim 1 is characterized in that: The process of acquiring the time series data of the privacy training data set and the time series data in the test data set is as follows: if the number of records of historical data is set to X, then the data of the user of each transaction in the privacy training data set and the test data set in the past X transactions are traced back to form the time series data for classification prediction of the user.

3. The privacy training data leakage risk detection method of the time series classification model according to claim 1, characterized in that: The member affiliation status is specifically: if the user belongs to the privacy training data set, the label is 1, otherwise it is 0.

4. The privacy training data leakage risk detection method of the time series classification model according to claim 1, characterized in that: The multi-scale patch encoder module comprises: A patch partitioning module is used to input the predicted sequence into patch modules of various scales for patch partitioning. The lengths of patches obtained by partitioning patch modules of various scales are different. Multiple Transformer encoder modules, each patch module is input to a Transformer encoder module for processing; Multiple aggregation and flattening modules, each Transformer encoder module corresponds to an aggregation and flattening module, and the data processed by the Transformer encoder module is aggregated and flattened by the aggregation and flattening module to obtain aggregated multi-scale encoded data.

5. The privacy training data leakage risk detection method of the time series classification model according to claim 1, characterized in that: In the prediction sequence data, member records and non-member records show different temporal pattern differences. In the stable interval of the prediction sequence data, the prediction results of member records and non-member records differ in local volatility. In the fluctuating interval of the prediction sequence data, the response reliability of changes in the prediction results of member records and non-member records is different.

6. The privacy training data leakage risk detection method of the time series classification model according to claim 1, characterized in that: The number of users in the private training data and test data of each shadow model is the same, and the number of users in the private training data of the target model is the same.

7. The privacy training data leakage risk detection method of the time series classification model according to claim 1, characterized in that: The method used for constructing the target model sample set is the same as the method used for constructing the shadow model sample set.

8. A device for detecting the risk of privacy training data leakage of a time series classification model, applied to the method for detecting the risk of privacy training data leakage of a time series classification model as claimed in any one of claims 1 to 7, characterized in that: include: An acquisition module, which is used to acquire a time series abnormal transaction classification model to be detected, and a privacy training data set and a test data set for the model; wherein the user corresponding to the time series data formed by multiple transactions of the same user in the privacy training data set is a member, and the user corresponding to the time series data formed by multiple transactions of the same user in the test data set is a non-member; A data partitioning module, which is used to divide the privacy training data set of the model into a target model privacy training data set and an auxiliary privacy training data set, and divide the test set of the model into a target model test data set and an auxiliary test data set, wherein the time series data of the same user are divided into the same data set; A shadow model building module is used to build a shadow model, which uses an auxiliary privacy training dataset to train multiple models with the same structure as the target model, namely, shadow models; The shadow model sample set construction module is used to construct the shadow model sample set. The shadow model and the corresponding privacy training data and test data are used to generate the shadow model sample set. Specifically, the time series data of the first K transactions of each user are obtained in time order. The classified prediction data obtained after the time series data is classified and predicted by the shadow model constitute a prediction sequence data. In the prediction sequence data, the classified prediction data and the real label data are used as features, and the member affiliation status is used as a label. A member inference attack model construction module is used to construct a member inference attack model for simulation, input the prediction sequence data composed of the classification prediction data into the multi-scale patch encoder module as training data to obtain multi-scale encoded data; use the self-attention mechanism to weighted aggregate the obtained multi-scale encoded data; splice the weighted aggregated data and the original multi-scale encoded data without weighted aggregation, and then use the classifier to perform classification processing to infer the user's membership status; A target model sample set construction module, which generates a target model sample set using the trained target model and the corresponding privacy training data and test data; The member affiliation state reasoning module inputs the constructed target model sample set into the trained member affiliation attack model for simulation to perform member affiliation state reasoning, thereby obtaining the member affiliation state of each user in the target model sample set, and evaluating the leakage risk of the privacy training data through the accuracy of the member affiliation reasoning of the privacy training data.

9. An electronic device, characterized in that include: one or more processors; And a memory communicatively connected to the at least one processor, wherein the memory stores instructions executable by the at least one processor, and the instructions are executed by the at least one processor so that the at least one processor executes the privacy training data leakage risk detection method of the time series classification model described in any one of claims 1 to 7.

10. A computer-readable storage medium, characterized in that A computer program is stored on the storage medium, and when the program is executed by the processor, the privacy training data leakage risk detection method of the time series classification model described in any one of claims 1 to 7 is implemented.

Images