Privacy training data leakage risk detection method and device for time series classification model

Abstract

The present invention discloses a method and device for detecting the risk of privacy training data leakage for a time series classification model. The method comprises: dividing a time series abnormal transaction dataset into a target dataset and an auxiliary dataset, and constructing a shadow model using the auxiliary dataset; constructing a shadow model sample set containing classification prediction data, real label data as features, and member membership status as labels; constructing a simulated membership inference attack model using a multi-scale patch encoder module, a self-attention mechanism, and a classifier; inferring the simulated membership inference attack model obtained by training the constructed target model sample set to obtain the member membership status of each user in the target model sample set, and assessing the leakage risk of the privacy training data by the accuracy of the member membership inference of the privacy training data. The method and device can detect the risk of privacy training data leakage for a time series abnormal transaction classification model by simulating the membership inference attack process.

Description

Technical Field

[0001] The present invention relates to the fields of data security and machine learning. More specifically, the present invention relates to a method and device for detecting the risk of privacy training data leakage in a time series classification model. Background Art

[0002] With the development of big data and artificial intelligence technologies, time series data analysis has gained widespread application in the financial sector, such as credit card fraud detection models and stock market abnormal trading analysis models. These models learn from large amounts of historical transaction data to identify potential fraudulent or abnormal transactions, effectively protecting the security and stability of the financial system. However, these models pose the risk of privacy leakage during training. Membership inference attacks, in particular, analyze the model's predicted response to specific data and infer whether that data was used for model training. This can potentially leak sensitive user information, such as the affiliation status of the transacting user. This attack not only threatens individual privacy but can also be used to cause larger-scale data leaks. If a data leak occurs in the financial sector, it can result in severe financial and reputational losses. Therefore, a method for detecting the risk of privacy leakage in training data for time series anomaly classification models is urgently needed. Summary of the Invention

[0003] The present invention provides a method and device for detecting the risk of privacy training data leakage of a time series classification model. By simulating the process of member reasoning attacks, the method detects the risk of privacy training data leakage of a model used for the time series abnormal transaction classification task, thereby being able to evaluate the privacy risk level of the model and further provide defensive improvements to models with higher risk levels.

[0004] To achieve these objectives and other advantages of the present invention, in a first aspect, the present invention provides a method for detecting privacy training data leakage risks of a time series classification model, comprising:

[0005] Obtain a time series abnormal transaction classification model to be detected, as well as a privacy-preserving training dataset and a test dataset for the model; where the time series data generated by multiple transactions of the same user in the privacy training dataset corresponds to the user as a member, and the time series data generated by multiple transactions of the same user in the test dataset corresponds to the user as a non-member;

[0006] The privacy training dataset of the model is divided into a target model privacy training dataset and an auxiliary privacy training dataset, and the test set of the model is divided into a target model test dataset and an auxiliary test dataset, wherein the time series data of the same user are divided into the same dataset;

[0007] Build shadow models and use auxiliary privacy training datasets to train multiple models with the same structure as the target model, namely shadow models;

[0008] Construct a shadow model sample set using the trained shadow model and the corresponding private training and test data. Specifically, obtain the time series data of the first K transactions of each user in chronological order. After the time series data is classified and predicted by the shadow model, the classification prediction data obtained constitutes a prediction sequence data. In the prediction sequence data, the classification prediction data and the true label data are used as features, and the member affiliation status is used as the label.

[0009] Construct a membership inference attack model for simulation: input the predicted sequence data consisting of classified prediction data as training data into the multi-scale patch encoder module to obtain multi-scale encoded data; use the self-attention mechanism to weighted aggregate the obtained multi-scale encoded data; concatenate the weighted aggregated data with the original multi-scale encoded data without weighted aggregation, and then use a classifier to classify it to infer the user's membership status;

[0010] A target model sample set is constructed and input into the trained membership inference attack model for simulation to perform member membership state inference, thereby obtaining the member membership state of each user in the target model sample set. The leakage risk of the privacy training data is evaluated by the accuracy of the member membership inference of the privacy training data.

[0011] Preferably, in the privacy training data leakage risk detection method of the time series classification model, the process of obtaining the time series data in the privacy training dataset and the time series data in the test dataset is as follows: if the number of records of historical data is set to X, then the data of the user of each transaction in the privacy training dataset and the test dataset in the past X transactions are backtracked to form the time series data for classification prediction of the user.

[0012] Preferably, in the privacy training data leakage risk detection method of the time series classification model, the member affiliation status is specifically: if the user belongs to the privacy training data set, the label is 1, otherwise it is 0.

[0013] Preferably, in the privacy training data leakage risk detection method for the time series classification model, the multi-scale patch encoder module includes:

[0014] The patch partitioning module is used to input the predicted sequence into patch modules of various scales for patch partitioning. The patch lengths obtained by patch modules of different scales are different.

[0015] Multiple Transformer encoder modules, each patch module is input into a Transformer encoder module for processing;

[0016] Multiple aggregation and flattening modules, each Transformer encoder module corresponds to an aggregation and flattening module, and the data processed by the Transformer encoder module is aggregated and flattened by the aggregation and flattening module to obtain aggregated multi-scale encoded data.

[0017] Preferably, in the privacy training data leakage risk detection method of the time series classification model, in the predicted sequence data, member records and non-member records show different time pattern differences, in the stable interval of the predicted sequence data, the prediction results of member records and non-member records are different in local volatility, and in the fluctuation interval of the predicted sequence data, the response reliability of changes in the prediction results of member records and non-member records is different.

[0018] Preferably, in the privacy training data leakage risk detection method for the time series classification model, the number of users in the privacy training data and test data of each shadow model is the same, and the number of users in the privacy training data of the target model is the same.

[0019] Preferably, in the privacy training data leakage risk detection method for the time series classification model, the method used to construct the target model sample set is the same as the method used to construct the shadow model sample set.

[0020] In a second aspect, the present invention further provides a device for detecting the risk of privacy training data leakage of a time series classification model, and a method for detecting the risk of privacy training data leakage of a time series classification model, comprising:

[0021] An acquisition module is used to obtain a time series abnormal transaction classification model to be detected, as well as a privacy-preserving training dataset and a test dataset for the model; wherein the time series data generated by multiple transactions of the same user in the privacy training dataset corresponds to the user as a member, and the time series data generated by multiple transactions of the same user in the test dataset corresponds to the user as a non-member;

[0022] A data partitioning module is used to divide the privacy training dataset of the model into a target model privacy training dataset and an auxiliary privacy training dataset, and to divide the test set of the model into a target model test dataset and an auxiliary test dataset, wherein the time series data of the same user are divided into the same dataset;

[0023] The shadow model construction module is used to build shadow models and use the auxiliary privacy training dataset to train multiple models with the same structure as the target model, namely shadow models;

[0024] The shadow model sample set construction module is used to construct a shadow model sample set. This module uses the trained shadow model and the corresponding private training and test data to generate the shadow model sample set. Specifically, the module obtains the time series data of the first K transactions of each user in chronological order. The time series data is classified and predicted by the shadow model to form a prediction sequence data. In the prediction sequence data, the classification prediction data and the true label data are used as features, and the member affiliation status is used as the label.

[0025] The membership inference attack model construction module is used to construct a membership inference attack model for simulation. The prediction sequence data composed of the classified prediction data is input into the multi-scale patch encoder module as training data to obtain multi-scale encoded data. The obtained multi-scale encoded data is weighted and aggregated using the self-attention mechanism. The weighted aggregated data and the original multi-scale encoded data without weighted aggregation are concatenated and then classified using a classifier to infer the user's membership status.

[0026] The target model sample set construction module uses the trained target model and the corresponding private training data and test data to generate the target model sample set;

[0027] The member membership state inference module inputs the constructed target model sample set into the trained member inference attack model for simulation to perform member membership state inference, thereby obtaining the member membership state of each user in the target model sample set, and evaluating the leakage risk of privacy training data through the accuracy of member membership inference of privacy training data.

[0028] In a third aspect, the present invention also provides an electronic device comprising: one or more processors; and a memory communicatively connected to the at least one processor, wherein the memory stores instructions executable by the at least one processor, and the instructions are executed by the at least one processor to enable the at least one processor to execute the privacy training data leakage risk detection method of the time series classification model.

[0029] In a fourth aspect, the present invention also provides a computer-readable storage medium having a computer program stored thereon. When the program is executed by a processor, the method for detecting the risk of privacy training data leakage of the time series classification model is implemented.

[0030] The present invention has at least the following beneficial effects:

[0031] The present invention obtains a time series abnormal transaction classification model to be detected, as well as a privacy-preserving training dataset and a test dataset for the model. The privacy-preserving training dataset is then divided into a target model privacy training dataset and an auxiliary privacy training dataset, and the test dataset is divided into a target model test dataset and an auxiliary test dataset. The auxiliary privacy training dataset is then used to train multiple shadow models with the same structure as the target model, allowing the shadow models to mimic the target model's behavior. The obtained shadow model sample sets use model prediction data and true label data as features, and member membership status as labels. The obtained shadow model sample sets are used to train a membership inference attack model for simulation. This membership inference attack model utilizes a multi-scale patch encoder module to capture multi-level temporal dependencies and weights them through a cross-scale self-attention aggregation mechanism, thereby extracting rich temporal semantic features. By accurately identifying the differences in the temporal patterns of predicted sequences between member and non-member records, the model significantly improves detection performance. Finally, a classifier is used to accurately determine the user's membership status and effectively assess the potential risk of privacy data leakage. This invention effectively enhances the accuracy of the time series abnormal transaction classification model in identifying privacy leakage risks, thereby enhancing the security of privacy-preserving training data.

[0032] Other advantages, objectives and features of the present invention will be reflected in part through the following description, and in part will be understood by those skilled in the art through study and practice of the present invention. BRIEF DESCRIPTION OF THE DRAWINGS

[0033] Figure 1 Schematic diagram of the process of the privacy training data leakage risk detection method of the time series classification model of the present invention;

[0034] Figure 2 This is an overall framework diagram of the processing process of the privacy training data leakage risk detection method of the time series classification model of the present invention;

[0035] Figure 3 This is a schematic diagram of a framework for constructing a member reasoning attack model in the privacy training data leakage risk detection method of the time series classification model of the present invention. DETAILED DESCRIPTION

[0036] The present invention will be described in further detail below in conjunction with the accompanying drawings so that those skilled in the art can implement the invention with reference to the description.

[0037] It should be understood that terms such as “having”, “including” and “comprising” used herein do not preclude the existence or addition of one or more other elements or combinations thereof.

[0038] like Figures 1 to 3As shown, an embodiment of the present invention provides a method for detecting privacy training data leakage risks of a time series classification model, comprising:

[0039] Step S10: Obtain a time series abnormal transaction classification model to be detected, as well as a privacy training dataset and a test dataset for the model; wherein, the user corresponding to the time series data formed by multiple transactions of the same user in the privacy training dataset is a member, and the user corresponding to the time series data formed by multiple transactions of the same user in the test dataset is a non-member.

[0040] Time series data refers to time series data, which is a data column recorded in chronological order using a unified indicator. Examples include user credit card swipe records and stock transaction records. Abnormal time series transactions refer to behavior in the time series that does not conform to typical trading patterns, such as large transactions within a short period of time or frequent, instantaneous order cancellations. The abnormal time series transaction classification model performs classification and prediction on abnormal time series transaction data. For example, in the financial field, this model can be a credit card fraud detection model, a stock market abnormal transaction analysis model, or other models for abnormal time series transactions. In the abnormal time series transaction classification model, users in the private training dataset are members, and users in the test dataset are non-members.

[0041] The process of obtaining the time series data of the privacy training dataset and the time series data in the test dataset is as follows: if the number of historical data records is set to X, then the data of the past X transactions of each transaction user in the privacy training dataset and the test dataset are backtracked to form the time series data for classification prediction of the user.

[0042] Step S20: Divide the privacy training dataset of the model into a target model privacy training dataset and an auxiliary privacy training dataset, and divide the test set of the model into a target model test dataset and an auxiliary test dataset, wherein the time series data of the same user are divided into the same dataset.

[0043] Among them, the acquired time series abnormal transaction data set is divided into a target data set and an auxiliary data set. The target data set includes a target model privacy training data set and a target model test data set, and the auxiliary data set includes an auxiliary privacy training data set and an auxiliary test data set. Therefore, the privacy training data set used for the time series abnormal transaction classification model is divided into a target model privacy training data set and an auxiliary privacy training data set, and the test set of the model is divided into a target model test data set and an auxiliary test data set. When dividing the data set, it must be based on the user level, that is, the time series data of the same user are divided into the same data set. The embodiment of the present invention does not make any specific restrictions on the ratio when dividing the privacy training data set of the model into the target model privacy training data set and the auxiliary privacy training data set. Preferably, 2:8 can be used. The ratio when dividing the test set of the model into the target model test data set and the auxiliary test data set is also preferably 2:8.

[0044] Step S30: Build a shadow model, and use the auxiliary privacy training dataset to train multiple models with the same structure as the target model, namely shadow models.

[0045] Each shadow model's private training data and test data have the same number of users, and the same number of users as the target model's private training data. Each shadow model is trained by randomly sampling that number of users from the private training dataset of the auxiliary dataset.

[0046] Step S40: Construct a shadow model sample set. Use the trained shadow model and the corresponding private training data and test data to generate the shadow model sample set. Specifically, obtain the time series data of the first K transactions of each user arranged in time. The classification prediction data obtained after the time series data is classified and predicted by the shadow model constitutes a prediction sequence data. In the prediction sequence data, the classification prediction data and the true label data are used as features, and the member affiliation status is used as the label.

[0047] Specifically, the member membership status is: if the user belongs to the private training dataset, the label is 1; otherwise, it is 0. It should also be noted that the shadow model sample set includes both the predicted sequence data after classification prediction of the private training data and the predicted sequence data after classification prediction of the test data. Therefore, in step S40, the shadow model is used to simulate the behavior of the target model, generating a shadow model sample set containing the classified prediction data and the real label data as features, and the member membership status as a label.

[0048] Step S50: Construct a membership inference attack model for simulation: input the prediction sequence data consisting of the classified prediction data into the multi-scale patch encoder module as training data to obtain multi-scale encoded data; use the self-attention mechanism to weighted aggregate the obtained multi-scale encoded data; splice the weighted aggregated data and the original multi-scale encoded data without weighted aggregation, and then use a classifier to perform classification processing to infer the user's membership status.

[0049] In the prediction sequence data, member records and non-member records will show different temporal pattern differences, which can be used to improve detection performance. These patterns differ in the stability and volatility of model predictions. Specifically:

[0050] Local volatility: Within the stable range of the predicted sequence data (where the true label sequence remains stable), the prediction results for member and non-member records may differ in volatility. For example, the prediction results for member records may be more stable with smaller fluctuations, while the prediction results for non-member records may be more volatile with larger fluctuations.

[0051] Response reliability: When predicting fluctuations in sequence data (when the true labels change), the reliability of predictions for member and non-member records varies. Member records may change more promptly because the model is more familiar with them, while non-member records may not respond to sequence changes promptly due to the model's unfamiliarity, resulting in unreliable (low confidence) or even erroneous predictions.

[0052] Among them, the multi-scale patch encoder module includes: a patch division module, which is used to input the prediction sequence into patch modules of multiple scales for patch division, and the patch lengths obtained by dividing patch modules of different scales are different; multiple Transformer encoder modules, each patch module is input into a Transformer encoder module for processing; multiple aggregation and flattening modules, each Transformer encoder module corresponds to an aggregation and flattening module, and the data processed by the Transformer encoder module is aggregated and flattened by the aggregation and flattening module to obtain aggregated multi-scale encoded data.

[0053] In step S50, the latest patch-based temporal representation method uses data segmentation to reveal multi-scale temporal dependencies, capturing rich and continuous temporal transformation differences. Therefore, using a patch-based embedding representation for the predicted sequence data captures temporal pattern variations at multiple time scales, enriching temporal semantic information and improving detection efficiency. Furthermore, using a self-attention mechanism to weightedly aggregate embeddings at different scales effectively captures the importance differences of multi-scale information.

[0054] Taking into account the integrity of the information and the changes that may be caused by weighting, skip connections are also added. That is, for the obtained multi-scale encoded data, the value of the data itself is spliced ​​with the weighted aggregated sequence representation data obtained by the self-attention mechanism. This is equivalent to allowing the data to skip the weighted aggregation step of the self-attention mechanism and then splice it with the weighted aggregated sequence representation data obtained by the self-attention mechanism. This preserves both the original information of the multi-scale encoded data and the weight information obtained by the self-attention mechanism. Through skip connections, the subsequent classifier can directly utilize this low-level feature without having to rely entirely on the high-level abstract representation output by the attention layer. Specifically, the classifier processes the aggregated sequence representation data and the original unweighted aggregated data through a linear layer to infer their membership status.

[0055] Therefore, the membership inference attack model constructed for simulation can infer the user's membership status, that is, infer whether the user belongs to the privacy training dataset. If the user belongs to the privacy training dataset, the label is 1, otherwise it is 0.

[0056] Step S60: Construct a target model sample set, and input the constructed target model sample set into the trained member inference attack model for simulation to perform member membership state inference, thereby obtaining the member membership state of each user in the target model sample set, and evaluating the leakage risk of the privacy training data by the accuracy of the member membership inference of the privacy training data.

[0057] In the above steps, the target model sample set is constructed in the same manner as the shadow model sample set. Specifically, the target model sample set is generated using the trained target model and the corresponding private training and test data. Specifically, the time series data for each user's first K transactions, arranged in chronological order, is obtained. The time series data is then classified and predicted using the shadow model to generate the predicted data, forming a predicted sequence data. The predicted data and true label data serve as features, and the member's affiliation status serves as the label.

[0058] In the above steps, the constructed target model sample set is input into the trained membership inference attack model for simulation to perform member membership state inference, so that the member membership state of each user in the target model sample set can be obtained. Then, the risk level is evaluated by the accuracy of the user's member membership inference in the privacy training data. The higher the accuracy, the higher the leakage risk.

[0059] The following describes a specific embodiment of the privacy training data leakage risk detection method for the time series classification model.

[0060] Step 1: Obtain a time series anomalous transaction classification model to be detected, as well as a privacy-preserving training dataset and a test dataset for the model. The process for acquiring the time series data in the privacy-preserving training dataset and the test dataset is as follows: Set the number of historical data records to 5, and then backtrack the data of the past five transactions of each user in the privacy-preserving training dataset and the test dataset to generate the time series data for classification prediction.

[0061] Step 2: Divide the privacy training dataset of the model into a target model privacy training dataset and an auxiliary privacy training dataset in a ratio of 2:8, and divide the test set of the model into a target model test dataset and an auxiliary test dataset in the same ratio of 2:8. The time series data of the same user are divided into the same dataset.

[0062] Step 3: Build shadow models. Use the auxiliary privacy training dataset to train 10 shadow models with the same structure as the target model. Each shadow model has an equal number of users in the privacy training and test data, and the same number of users in the privacy training data of the target dataset. Each shadow model is trained by randomly sampling the same number of users from the privacy training data of the auxiliary dataset.

[0063] Step 4: Construct a shadow model sample set. Use the trained shadow model and the corresponding private training data and test data to generate a shadow model sample set. Specifically, obtain the time series data of each user's first 20 transactions arranged in time. After the time series data is classified and predicted by the shadow model, the classified prediction data obtained constitutes a prediction sequence data. In the prediction sequence data, the classification prediction data and the true label data are used as features, and the member affiliation status is used as the label. If the user belongs to the private training data set, the label is 1, otherwise it is 0.

[0064] Step 5: Construct a membership inference attack model for simulation: The predicted sequence data consisting of the classified prediction data is input into the multi-scale patch encoder module as training data to generate multi-scale encoded data. The resulting multi-scale encoded data is weighted and aggregated using a self-attention mechanism. The weighted aggregated data is concatenated with the original multi-scale encoded data, and then classified using a classifier to infer the user's membership status. Specifically, two time scales are set, with two encoders of patch lengths of 2 and 4, corresponding to encoder hidden layer sizes of 16 and 64, respectively. The resulting multi-scale encoded data is weighted and aggregated using a self-attention mechanism with 4 attention heads via a cross-scale self-attention aggregation layer.

[0065] Step 6: Construct a target model sample set and input it into the trained membership inference attack model for simulation to perform membership inference. This will determine the membership status of each user in the target model sample set and assess the risk of privacy training data leakage based on the accuracy of membership inference. The specific risk rating criteria are shown in the table below. The higher the accuracy, the higher the risk of leakage:

[0066] Table 1. Risk leakage rating criteria for privacy training data of time series abnormal transaction classification model

[0067]

[0068] Another embodiment of the present invention further provides a device for detecting the risk of privacy training data leakage of a time series classification model, which is applied to the method for detecting the risk of privacy training data leakage of the time series classification model, comprising:

[0069] An acquisition module is used to obtain a time series abnormal transaction classification model to be detected, as well as a privacy-preserving training dataset and a test dataset for the model; wherein the time series data generated by multiple transactions of the same user in the privacy training dataset corresponds to the user as a member, and the time series data generated by multiple transactions of the same user in the test dataset corresponds to the user as a non-member;

[0070] A data partitioning module is used to divide the privacy training dataset of the model into a target model privacy training dataset and an auxiliary privacy training dataset, and to divide the test set of the model into a target model test dataset and an auxiliary test dataset, wherein the time series data of the same user are divided into the same dataset;

[0071] The shadow model construction module is used to build shadow models and use the auxiliary privacy training dataset to train multiple models with the same structure as the target model, namely shadow models;

[0072] The shadow model sample set construction module is used to construct a shadow model sample set. This module uses the trained shadow model and the corresponding private training and test data to generate the shadow model sample set. Specifically, the module obtains the time series data of the first K transactions of each user in chronological order. The time series data is classified and predicted by the shadow model to form a prediction sequence data. In the prediction sequence data, the classification prediction data and the true label data are used as features, and the member affiliation status is used as the label.

[0073] The membership inference attack model construction module is used to construct a membership inference attack model for simulation. The prediction sequence data composed of the classified prediction data is input into the multi-scale patch encoder module as training data to obtain multi-scale encoded data. The obtained multi-scale encoded data is weighted and aggregated using the self-attention mechanism. The weighted aggregated data and the original multi-scale encoded data without weighted aggregation are concatenated and then classified using a classifier to infer the user's membership status.

[0074] The target model sample set construction module uses the trained target model and the corresponding private training data and test data to generate the target model sample set;

[0075] The member membership state inference module inputs the constructed target model sample set into the trained member inference attack model for simulation to perform member membership state inference, thereby obtaining the member membership state of each user in the target model sample set, and evaluating the leakage risk of privacy training data through the accuracy of member membership inference of privacy training data.

[0076] Another embodiment of the present invention further provides an electronic device comprising: one or more processors; and a memory communicatively connected to the at least one processor, wherein the memory stores instructions executable by the at least one processor, and the instructions are executed by the at least one processor to cause the at least one processor to perform the method for detecting the risk of privacy training data leakage for a time series classification model. The electronic device may be any terminal device including a mobile phone, a laptop computer, a desktop computer, a tablet computer, a PDA (Personal Digital Assistant), a POS (Point of Sales), an in-vehicle computer, or the like.

[0077] Another embodiment of the present invention further provides a computer-readable storage medium, which stores a computer program. When the program is executed by a processor, it implements the privacy training data leakage risk detection method of the time series classification model.

[0078] Through the description of the above embodiments, those skilled in the art can clearly understand that the present invention can be implemented by means of software plus necessary general-purpose hardware, and of course can also be implemented by means of dedicated hardware including application-specific integrated circuits, dedicated CPUs, dedicated memories, dedicated components, etc. In general, all functions performed by computer programs can be easily implemented by corresponding hardware, and the specific hardware structures used to implement the same function can also be diverse, such as analog circuits, digital circuits, or dedicated circuits. However, for the present invention, software program implementation is a better implementation method in most cases. Based on this understanding, the technical solution of the present invention is essentially or the part that contributes to the prior art can be embodied in the form of a software product, which is stored in a readable storage medium, such as a computer floppy disk, USB flash drive, mobile hard disk, read-only memory (ROM), random access memory (RAM), magnetic disk or optical disk, etc., and includes a number of instructions for causing a computer device (which can be a personal computer, server, or network device, etc.) to execute the methods described in each embodiment of the present invention.

[0079] The number of devices and processing scales described herein are intended to simplify the description of the present invention. Applications, modifications, and variations of the present invention will be readily apparent to those skilled in the art.

[0080] Although the embodiments of the present invention have been disclosed above, they are not limited to the applications listed in the description and implementation methods. They can be fully applied to various fields suitable for the present invention. For those familiar with the art, additional modifications can be easily implemented. Therefore, without departing from the general concept defined by the claims and the scope of equivalents, the present invention is not limited to the specific details and illustrations shown and described herein.

Claims

1. A privacy training data leakage risk detection method for a time series classification model, characterized by: include: Obtain a time series abnormal transaction classification model to be detected, as well as a privacy-preserving training dataset and a test dataset for the model; where the time series data generated by multiple transactions of the same user in the privacy training dataset corresponds to the user as a member, and the time series data generated by multiple transactions of the same user in the test dataset corresponds to the user as a non-member; The privacy training dataset of the model is divided into a target model privacy training dataset and an auxiliary privacy training dataset, and the test set of the model is divided into a target model test dataset and an auxiliary test dataset, wherein the time series data of the same user are divided into the same dataset; Build shadow models and use auxiliary privacy training datasets to train multiple models with the same structure as the target model, namely shadow models; Construct a shadow model sample set using the trained shadow model and the corresponding private training and test data. Specifically, obtain the time series data of the first K transactions of each user in chronological order. After the time series data is classified and predicted by the shadow model, the classification prediction data obtained constitutes a prediction sequence data. In the prediction sequence data, the classification prediction data and the true label data are used as features, and the member affiliation status is used as the label. Construct a membership inference attack model for simulation: input the predicted sequence data consisting of classified prediction data as training data into the multi-scale patch encoder module to obtain multi-scale encoded data; use the self-attention mechanism to weighted aggregate the obtained multi-scale encoded data; concatenate the weighted aggregated data with the original multi-scale encoded data without weighted aggregation, and then use a classifier to classify it to infer the user's membership status; A target model sample set is constructed and input into the trained membership inference attack model for simulation to perform member membership state inference, thereby obtaining the member membership state of each user in the target model sample set. The leakage risk of the privacy training data is evaluated by the accuracy of the member membership inference of the privacy training data.

2. The privacy training data leakage risk detection method of the time series classification model according to claim 1 is characterized in that: The process of obtaining the time series data of the privacy training dataset and the time series data in the test dataset is as follows: if the number of historical data records is set to X, then the data of the past X transactions of each user in the privacy training dataset and the test dataset are backtracked to form the time series data for classification prediction of the user.

3. The privacy training data leakage risk detection method of the time series classification model according to claim 1 is characterized in that: The member affiliation status is specifically: if the user belongs to the privacy training dataset, the label is 1, otherwise it is 0.

4. The privacy training data leakage risk detection method of the time series classification model according to claim 1 is characterized in that: The multi-scale patch encoder module includes: The patch partitioning module is used to input the predicted sequence into patch modules of various scales for patch partitioning. The patch lengths obtained by patch modules of different scales are different. Multiple Transformer encoder modules, each patch module is input into a Transformer encoder module for processing; Multiple aggregation and flattening modules, each Transformer encoder module corresponds to an aggregation and flattening module, and the data processed by the Transformer encoder module is aggregated and flattened by the aggregation and flattening module to obtain aggregated multi-scale encoded data.

5. The privacy training data leakage risk detection method of the time series classification model according to claim 1 is characterized in that: In the prediction sequence data, member records and non-member records show different temporal pattern differences. In the stable interval of the prediction sequence data, the prediction results of member records and non-member records differ in local volatility. In the fluctuating interval of the prediction sequence data, the response reliability of changes in the prediction results of member records and non-member records is different.

6. The privacy training data leakage risk detection method of the time series classification model according to claim 1, characterized in that: The number of users in the private training data and test data of each shadow model is the same, and the number of users in the private training data of the target model is the same.

7. The privacy training data leakage risk detection method of the time series classification model according to claim 1 is characterized in that: The method used to construct the target model sample set is the same as the method used to construct the shadow model sample set.

8. A device for detecting the risk of privacy training data leakage of a time series classification model, applied to the method for detecting the risk of privacy training data leakage of a time series classification model as claimed in any one of claims 1 to 7, characterized in that: include: An acquisition module is used to obtain a time series abnormal transaction classification model to be detected, as well as a privacy-preserving training dataset and a test dataset for the model; wherein the time series data generated by multiple transactions of the same user in the privacy training dataset corresponds to the user as a member, and the time series data generated by multiple transactions of the same user in the test dataset corresponds to the user as a non-member; A data partitioning module is used to divide the privacy training dataset of the model into a target model privacy training dataset and an auxiliary privacy training dataset, and to divide the test set of the model into a target model test dataset and an auxiliary test dataset, wherein the time series data of the same user are divided into the same dataset; The shadow model construction module is used to build shadow models and use the auxiliary privacy training dataset to train multiple models with the same structure as the target model, namely shadow models; The shadow model sample set construction module is used to construct a shadow model sample set. This module uses the trained shadow model and the corresponding private training and test data to generate the shadow model sample set. Specifically, the module obtains the time series data of the first K transactions of each user in chronological order. The time series data is classified and predicted by the shadow model to form a prediction sequence data. In the prediction sequence data, the classification prediction data and the true label data are used as features, and the member affiliation status is used as the label. The membership inference attack model construction module is used to construct a membership inference attack model for simulation. The prediction sequence data composed of the classified prediction data is input into the multi-scale patch encoder module as training data to obtain multi-scale encoded data. The obtained multi-scale encoded data is weighted and aggregated using the self-attention mechanism. The weighted aggregated data and the original multi-scale encoded data without weighted aggregation are concatenated and then classified using a classifier to infer the user's membership status. The target model sample set construction module uses the trained target model and the corresponding private training data and test data to generate the target model sample set; The member membership state inference module inputs the constructed target model sample set into the trained member inference attack model for simulation to perform member membership state inference, thereby obtaining the member membership state of each user in the target model sample set, and evaluating the leakage risk of privacy training data through the accuracy of member membership inference of privacy training data.

9. An electronic device, characterized in that include: one or more processors; and a memory communicatively connected to the at least one processor, wherein the memory stores instructions executable by the at least one processor, and the instructions are executed by the at least one processor to enable the at least one processor to execute the privacy training data leakage risk detection method for the time series classification model according to any one of claims 1 to 7.

10. A computer-readable storage medium, characterized in that A computer program is stored on the storage medium, and when the program is executed by the processor, the privacy training data leakage risk detection method of the time series classification model described in any one of claims 1 to 7 is implemented.

Images