Member reasoning attack method based on clean label data poisoning

Abstract

The invention discloses a member reasoning attack method based on clean label data poisoning, which comprises the following steps of: firstly, acquiring a related data set of a target model and a shadow model, randomly initializing parameters of the shadow model, and training the shadow model by using a training set in the shadow data set; selecting a target class sample and other classes of samples; using a shadow model to optimize the target class sample to generate a poisoning sample, enabling the poisoning sample to be close to other class samples in a feature space, but to be similar to the target class sample in appearance, and using an L2 norm to carry out constraint; and injecting a poisoning sample into the training set of the target model, iteratively training the target model by using the training set of the target model, performing target class member reasoning on the target model, testing target class members by using a binary classifier, and measuring the privacy leakage degree of the target model by using an AUC score. The member inference attack method of clean label data poisoning based on adversarial training not only can reduce the performance of the model to the minimum extent, but also can realize relatively high member inference on target members.

Description

Technical Field

[0001] The present invention relates to image classification, data security, and artificial intelligence deep learning technology, and in particular to a member reasoning attack method based on clean label data poisoning. Background Art

[0002] With the advancement of modern technology, deep learning has achieved remarkable success in various fields, including image recognition, face recognition, medical image analysis, and natural language processing. High-quality, reliable real data is the cornerstone of these deep learning advances. Deep learning technology uses a large amount of data to train prediction models to remember the characteristics of training data, which provides favorable conditions for attacks of membership inference class. Membership inference attack (MIA) is a recently emerging technology that is defined as an attack to determine whether the target model uses a specific data sample to train the target model. Training machine learning models requires a large amount of user data or network data, which usually involves personal privacy content, such as bank asset information, medical data information, and other personal sensitive data. Previous studies have shown that machine learning often inadvertently remembers feature information from the training data set. This phenomenon may inadvertently expose sensitive or private information in the training data. The target model has significantly different output results for member and non-member data, which leads to the attacker being able to effectively distinguish whether the data sample is in the training set of the target model.

[0003] Membership inference attacks represent a recently emerging approach where an attacker can infer whether a particular data sample was used to train a given model. This approach can be viewed from two different perspectives: (a) as a means of measuring the degree of privacy leakage inherent in the target model, and (b) as a tool for data auditing to identify potential violations of data protection regulations. In this paper, we adopt a membership inference attack approach based on poisoning clean label data as a way to measure the privacy leakage inherent in the target model.

[0004] In recent years, in order to measure the privacy leakage of machine learning models, most existing membership inference attacks focus on improving the attack method through the design of shadow models or reducing the background knowledge required to conduct the attack. Specifically, most membership inference attack methods train the attack model to conduct inference attacks based on the posterior of the target model, and the target model has significantly different outputs for member data and non-member data. In addition, this feature provides the model with enough ability to memorize the data samples in the training set, resulting in the model performing differently on training set data and non-training set data.

[0005] Compared with traditional membership inference attack methods, data poisoning has received less attention. Existing membership inference based on data poisoning requires modifying the labels of training samples, which inevitably damages the utility of the model. Moreover, the most significant flaw is the inconsistency between the labels and the inclusion of poisoned samples, which makes them easy to be discovered by detectors and difficult to implement in real scenarios. Summary of the invention

[0006] Purpose of the invention: The purpose of the present invention is to solve the deficiencies in the prior art and provide a member reasoning attack method based on clean label data poisoning. The present invention alleviates the limitations of the existing data poisoning methods, and the poisoned samples presented are very similar to the original data, thereby improving the concealment of the poisoned samples. The present invention uses a clean label data poisoning method, which can improve the concealment of data samples and improve the accuracy of member reasoning as much as possible, while also keeping the utility of the poisoned model consistent with that of the clean model as much as possible.

[0007] Technical solution: A member inference attack method based on clean label data poisoning of the present invention comprises the following steps:

[0008] Step (1), data preprocessing and data set segmentation, obtaining an image classification data set, preprocessing the data set, and dividing the data set into a training set and a test set, and randomly splitting them in a ratio of 1:1 to obtain a training set and a test set of the target model, and a training set and a test set of the shadow model; the shadow model here refers to a deep neural network model for the image classification task, including an input layer, a hidden layer, and an output layer;

[0009] Step (2), shadow model training phase, first randomly initialize the parameters of the image classification shadow model, and then use the shadow model training set to train the shadow model;

[0010] Step (3), select target class samples and other class samples, select target class samples with target class labels from the shadow data set, and uniformly randomly select other class samples from the data set;

[0011] Step (4), generating poisoned samples, first use the trained shadow model to optimize the target class samples to generate poisoned samples, so that the poisoned samples are close to the target class samples in the feature space, the poisoned samples are similar to other class samples in appearance, and the L2 norm is used to constrain the poisoned samples; the expression is as follows:

[0012]

[0013] ∥x p -x∥2≤ε

[0014] f(x p )≈f(xt )

[0015] Among them, D poison represents the dataset of generated poisoned samples, x represents other class samples, f represents the trained shadow model, and D target represents the dataset of target class samples used to generate poisoned samples, x p represents the optimized poisoned sample, and x p ∈D, D represents the dataset of other types of samples used to generate poisoned samples, x t represents the target class sample, and ε represents the constraint between samples;

[0016] Step (5), training the target model, first inject the poisoned samples generated in step (4) into the training set of the target model, and iteratively train the target model using the training set of the target model until the target model converges;

[0017] Step (6), training a binary classification attack model, setting the training set label of the shadow model to 1, setting the test set label of the shadow model to 0, and using the training set and test set of the shadow model to train a binary classifier;

[0018] Step (7) performs target class member inference on the target model, that is, uses the binary classifier trained in step (6) to test the target class members, and uses the AUC score to measure the privacy leakage degree of the target model. The larger the AUC score, the higher the attack accuracy of the member inference and the better the attack effect.

[0019] Furthermore, the training of the shadow model in step (2) specifically includes:

[0020]

[0021] Where f represents the shadow model for image classification based on deep neural network, x i Represents the feature corresponding to the i-th data sample, y i represents the label corresponding to the i-th data sample, i represents the i-th sample, θ represents the initialization parameter of the shadow model that has not been trained, and θ * are the parameters of the shadow model. The role of the shadow model is to optimize the poisoned samples so that the poisoned samples are close to the target class samples in the feature space, but similar to the samples of other classes in appearance. Training the shadow model specifically includes randomly initializing the parameters of the shadow model and using the shadow training data set to train the shadow model.

[0022] Furthermore, in the process of training the target model in step (5), the loss function loss is used to calculate the loss value of the current batch, and the training is performed according to the loss back propagation until the target model converges. The loss function adopts the cross entropy loss function or other loss functions. When the cross entropy loss function is adopted, the calculation formula of the loss function loss is as follows:

[0023]

[0024] Among them, y i represents the label value of the i-th training sample; p i Represents the predicted value of the image classification model for the i-th training sample; n represents the number of training samples in a batch.

[0025] Furthermore, in step (6), during the training of the binary classification attack model, the training set of the binary classification attack model is a binary classification data set denoted as D attack , D attack The expression of is as follows;

[0026] D attack ={(x1,y1),...(x i ,y i ),...(x N ,y N )},i=1,...,N;

[0027] Where N is the sum of the training and test data sets of the shadow model, x i is the feature vector of the input sample, y i ∈{0,1} is a label that identifies whether the data is used for model training. A label of 1 indicates that the data has been used in training, and a label of 0 indicates that the data has not been used in training.

[0028] In step (7), the AUC score is obtained by summing the areas of each part under the ROC curve. The ROC curve is used for binary classification tasks. In the binary classification task of the attack model, the horizontal axis of the ROC curve is the false positive rate FPR, and the vertical axis is the true positive rate TPR. The output of the attack model is a predicted value between [0, 1]. The predicted value is compared with a classification threshold: if it is greater than the threshold, it is classified as a positive class, otherwise it is a negative class. Generally, threshold = 0.5 is set. The calculation formula for the above AUC score is as follows:

[0029]

[0030] in, is the indicator function, M is the number of positive samples, N is the number of negative samples; p pos ,n negThey are the probability that a positive sample is predicted as a positive example and the probability that a negative sample is predicted as a positive example.

[0031] Beneficial effects: Compared with the prior art, the present invention has the following advantages:

[0032] (1) Aiming at the leakage of privacy data of the measurement model, the present invention proposes a membership inference attack method based on clean label data poisoning, which can ensure that the data sample and the label are consistent in appearance without changing them. By adopting this technology, the present invention overcomes the limitations of the existing membership inference method of dirty label data poisoning. The present invention improves the accuracy of membership inference by carefully designing poisoned samples that are very similar to clean data samples.

[0033] (2) The present invention is compared with the existing member inference attack technology using data poisoning. The present invention is always superior to the existing attack method and also minimizes the impact on the practicality of the model.

[0034] (3) The present invention uses a public data set to train the model, and uses clean label data poisoning technology to improve the concealment of poisoning. Compared with other solutions, the present invention has a higher AUC score and better model utility. BRIEF DESCRIPTION OF THE DRAWINGS

[0035] Figure 1 It is the flow chart of the existing member reasoning attack;

[0036] Figure 2 is a flow chart of member reasoning based on poisoning of clean label data of the present invention;

[0037] Figure 3 It is a comparison diagram of data samples based on dirty label and clean label data poisoning in the embodiment. DETAILED DESCRIPTION

[0038] The technical solution of the present invention is described in detail below, but the protection scope of the present invention is not limited to the embodiments.

[0039] like Figure 1 As shown in Figure 1, existing membership inference includes the following steps: first, use the shadow dataset to train the shadow model, then use the training set and test set of the shadow model to generate a binary dataset, and use the binary dataset to train the attack model. Secondly, use the dataset of the target model to train the target model. The adversary can choose white-box attack or black-box attack based on prior knowledge. Finally, input the sample to be tested into the target model, input the output of the target model into the attack model, and perform membership inference to infer whether the given data sample is a member of the training set or a non-member.

[0040] The present invention uses member inference attack technology to infer the membership of the target class data and measures the degree of privacy data leakage of the model. At the same time, in order to improve the concealment of poisoned samples, clean label data poisoning technology and the use of shadow models to optimize poisoned samples are used. The clean label data poisoning method is innovatively used to optimize poisoned samples in the shadow model, and the gradient information calculated by back propagation is fully utilized to update the model parameters, and the training is iterated until the model converges. The present invention effectively improves the accuracy of target class member inference and can minimize the loss of model utility.

[0041] like Figure 2 As shown, the member inference attack method based on clean label data poisoning in this embodiment includes the following steps:

[0042] Step (1), data preprocessing and data set segmentation, obtaining an image classification data set, preprocessing the data set, and dividing the data set into a training set and a test set, and randomly splitting them in a ratio of 1:1 to obtain a training set and a test set of the target model, and a training set and a test set of the shadow model; the shadow model here refers to a deep neural network model for the image classification task, including an input layer, a hidden layer, and an output layer;

[0043] Step (2), shadow model training phase, first randomly initialize the parameters of the image classification shadow model, and then use the shadow model training set to train the shadow model;

[0044] Step (3), select target class samples and other class samples, select target class samples with target class labels from the shadow data set, and uniformly randomly select other class samples from the data set;

[0045] Here, we first select a target category label, and then randomly select target category samples from the target class belonging to this label. The target category label is selected according to the attack requirements. For example, if we want to attack the cat category, then cat is the target category label. Other category samples specifically refer to data samples that do not belong to the target category but belong to other categories. For example, assuming a ten-category dataset, cat is the target category label, and other category samples refer to data samples that do not belong to cat but belong to one of the other nine categories.

[0046] Step (4), generating poisoned samples, first use the trained shadow model to optimize the target class samples to generate poisoned samples, so that the poisoned samples are close to the target class samples in the feature space, the poisoned samples are similar to other class samples in appearance, and the L2 norm is used to constrain the poisoned samples; the expression is as follows:

[0047]

[0048] ∥x p -x∥2≤ε

[0049] f(x p )≈f(x t )

[0050] Among them, D poison represents the dataset of generated poisoned samples, x represents other class samples, f represents the trained shadow model, and D target represents the dataset of target class samples used to generate poisoned samples, x p represents the optimized poisoned sample, and x p ∈D, D represents the dataset of other types of samples used to generate poisoned samples, x t represents the target class sample, and ε represents the constraint between samples. In this embodiment, it is assumed that the constraint size is set to 16 / 255. Under the premise of this constraint, the poisoned sample is similar to the original sample.

[0051] Step (5), training the target model, first inject the poisoned samples generated in step (4) into the training set of the target model, and iteratively train the target model using the training set of the target model until the target model converges;

[0052] Step (6), training a binary classification attack model, setting the training set label of the shadow model to 1, setting the test set label of the shadow model to 0, and using the training set and test set of the shadow model to train a binary classifier;

[0053] Step (7) performs target class member inference on the target model, that is, uses the binary classifier trained in step (6) to test the target class members, and uses the AUC score to measure the privacy leakage degree of the target model. The larger the AUC score, the higher the attack accuracy of the member inference and the better the attack effect.

[0054] The training of the shadow model in step (2) of this embodiment specifically includes:

[0055]

[0056] Where f represents the shadow model for image classification based on deep neural network, x i Represents the feature corresponding to the i-th data sample, y i represents the label corresponding to the i-th data sample, i represents the i-th sample, and θ represents the initialization parameters of the shadow model that has not been trained. * are the parameters of the shadow model. The role of the shadow model is to optimize the poisoned samples so that the poisoned samples are close to the target class samples in the feature space, but similar to the samples of other classes in appearance. Training the shadow model specifically includes randomly initializing the parameters of the shadow model and using the shadow training data set to train the shadow model.

[0057] In the process of training the target model in step (5) of this embodiment, the loss function loss is used to calculate the loss value of the current batch, and the training is performed according to the loss back propagation until the target model converges. The loss function adopts the cross entropy loss function or other loss functions. When the cross entropy loss function is adopted, the calculation formula of the loss function loss is as follows:

[0058]

[0059] Among them, y i represents the label value of the i-th training sample; p i Represents the predicted value of the image classification model for the i-th training sample; n represents the number of training samples in a batch.

[0060] In the process of training the binary classification attack model in step (6) of this embodiment, the training set of the binary classification attack model is a binary classification data set denoted as D attack ;

[0061] D attack ={(x1,y1),...(x i ,y i ),...(x N ,y N )},i=1,...,N;

[0062] Where N is the sum of the training and test data sets of the shadow model, x i is the feature vector of the input sample, y i ∈{0,1} is a label that identifies whether the data is used for model training. A label of 1 indicates that the data has been used in training, and a label of 0 indicates that the data has not been used in training.

[0063] In step (7) of this embodiment, the AUC score is obtained by summing the areas of each part under the ROC curve. The ROC curve is used for binary classification tasks. In the binary classification task of the attack model, the horizontal axis of the ROC curve is the false positive rate FPR, and the vertical axis is the true positive rate TPR. The output of the attack model is a predicted value between [0, 1]. The predicted value is compared with a classification threshold: if it is greater than the threshold, it is classified as a positive class, otherwise it is a negative class. Generally, threshold = 0.5 is set. The calculation formula for the above AUC score is as follows:

[0064]

[0065] in, is the indicator function, M is the number of positive samples, N is the number of negative samples; p pos ,n neg They are the probability that a positive sample is predicted as a positive example and the probability that a negative sample is predicted as a positive example.

[0066] In order to verify the technical effect of the present invention, this embodiment compares the technical solution of the present invention with other existing solutions. The experimental results are shown in Table 1. The data displayed in bold in Table 1 are the AUC scores with the highest member reasoning accuracy.

[0067] Table 1

[0068]

[0069]

[0070] By comparing the data in Table 1, it can be seen that the member reasoning of the present invention has high attack accuracy and good attack effect.

[0071] like Figure 1 and Figure 3 The results show that the present invention can improve the concealment of poisoned samples and measure the degree of privacy leakage of the model by amplifying the exposure of members of the target class. The present invention proves that the member inference attack method of poisoning clean label data based on adversarial training can not only minimize the performance of the model, but also achieve higher member inference for the target class members.

Claims

1. A membership inference attack method based on clean label data poisoning, characterized in that: The following steps are involved: Step (1), data preprocessing and data set segmentation, obtaining an image classification data set, preprocessing the data set, and dividing the data set into a training set and a test set, and randomly splitting them in a ratio of 1:1 to obtain a training set and a test set of the target model, and a training set and a test set of the shadow model; the shadow model here refers to a deep neural network model for the image classification task, including an input layer, a hidden layer, and an output layer; Step (2), shadow model training phase, first randomly initialize the parameters of the image classification shadow model, and then use the shadow model training set to train the shadow model; Step (3), select target class samples and other class samples, select target class samples with target class labels from the shadow data set, and uniformly randomly select other class samples from the shadow data set; Step (4), generating poisoned samples, first use the trained shadow model to optimize the target class samples to generate poisoned samples, so that the poisoned samples are close to the target class samples in the feature space, the poisoned samples are similar to other class samples in appearance, and the L2 norm is used to constrain the poisoned samples; the expression is as follows: ∥x p -x∥2≤ε f(x p )≈f(x t ) Among them, D poison represents the dataset of generated poisoned samples, x represents other class samples, f represents the trained shadow model, and D target represents the dataset of target class samples used to generate poisoned samples, x p represents the optimized poisoned sample, and x p ∈D, D represents the dataset of other types of samples used to generate poisoned samples, x t represents the target class sample, and ε represents the constraint between samples; Step (5), training the target model, first inject the poisoned samples generated in step (4) into the training set of the target model, and iteratively train the target model using the training set of the target model until the target model converges; Step (6), training a binary classification attack model, setting the training set label of the shadow model to 1, setting the test set label of the shadow model to 0, and using the training set and test set of the shadow model to train a binary classifier; Step (7) performs target class membership inference on the target model, that is, uses the binary classifier trained in step (6) to test the target class members, and uses the AUC score to measure the privacy leakage degree of the target model.

2. The member inference attack method based on clean label data poisoning according to claim 1 is characterized in that: The step (2) of training the shadow model specifically includes: Where f represents the shadow model for image classification based on deep neural network, x i Represents the feature corresponding to the i-th data sample, y i represents the label corresponding to the i-th data sample, i represents the i-th sample, θ represents the initialization parameter of the shadow model that has not been trained, and θ * are the parameters of the shadow model.

3. The member inference attack method based on clean label data poisoning according to claim 1 is characterized in that: In the process of training the target model in step (5), the loss function loss is used to calculate the loss value of the current batch, and the training is performed according to the loss back propagation until the target model converges. The loss function adopts the cross entropy loss function or other loss functions. When the cross entropy loss function is adopted, the calculation formula of the loss function loss is as follows: Among them, y i represents the label value of the i-th training sample; p i Represents the predicted value of the image classification model for the i-th training sample; n represents the number of training samples in a batch.

4. The member inference attack method based on clean label data poisoning according to claim 1 is characterized in that: In step (6), during the training of the binary classification attack model, the training set of the binary classification attack model is a binary classification data set denoted as D attack , D attack The expression of is as follows; D attack ={(x1,y1),...(x i ,y i ),...(x N ,y N )},i=1,...,N; Where N is the sum of the training and test data sets of the shadow model, x i is the feature vector of the input sample, y i ∈{0,1} is a label that identifies whether the data is used for model training. A label of 1 indicates that the data has been used in training, and a label of 0 indicates that the data has not been used in training.

Images