Data privacy auditing method and system for power operation violation identification generalization test

Abstract

The invention discloses a data privacy auditing method and system for a power operation violation identification generalization test, and the method comprises the steps: drawing prediction bounding box distribution on a blank canvas, and inputting the prediction bounding box distribution to a classification network; according to the technology, a coverage type bounding box drawing method is adopted when bounding box distribution is drawn, and for a multi-scale target recognition model adopted in power field operation violation recognition, due to the fact that a large number of small target prediction box confidence information is covered, the method is poor in effect, and whether test data are trained by the model or not cannot be distinguished. A test sample is directly input into a model to output predicted bounding box distribution, the predicted bounding box distribution is reflected in'canvas', and a multi-scale feature fusion processing capability is added in a multi-scale target recognition model adopted in power field operation violation recognition, so that the difference between the predicted bounding box distribution of a trained test sample and the predicted bounding box distribution of an untrained test sample is small; and the accuracy of distinguishing whether the test data is trained by the model or not is reduced.

Description

Technical Field

[0001] The present invention belongs to the technical field of computer vision, and relates to a data privacy audit method and system for generalized testing of electric power operation violation identification. Background Art

[0002] The target recognition model is a computer vision technology used to identify and locate specific objects in images or videos. Identification of illegal operations at power site: Using the target recognition model, the operation video of the power construction site is analyzed to locate illegal operations such as not wearing a safety helmet, not wearing standard clothing, and using the safety belt high and low.

[0003] Training set, validation set and test set In the field of machine learning and artificial intelligence, the training set plays a vital role. It is the cornerstone of model learning and contains a large amount of labeled data. These data nourish the model so that it can gradually learn skills such as recognition, classification, and prediction. During the training process, the model will continuously traverse the training set and minimize the prediction error by adjusting internal parameters to achieve data fitting. In addition, the use of the training set is not isolated. It and other data sets such as validation set and test set constitute an important part of the machine learning process. The validation set is used to evaluate the performance of the model during the training process, help adjust the model parameters and prevent overfitting; the test set is used after the model training is completed to evaluate the final performance of the model and ensure the performance of the model in practical applications.

[0004] The generalization ability of an AI model refers to the ability of the model to make predictions on data that it has not seen. Generalization ability is one of the core goals of an AI model, and it involves how the model learns from data and is able to make judgments or predictions in new situations that it has not encountered. A model with good generalization ability can perform well on data outside the training set, rather than just fitting well on the training set. This ability is crucial to the practicality and reliability of the model because it determines how well the model performs in actual applications. In machine learning, generalization ability also involves the ability of the model to classify or predict new data. When a model performs well on the training data set and can provide accurate classification or prediction for new data that is missing from the training set, we say that the model has good generalization ability. This ability does not require the model to act on all data types, but on similar fields or data sets, thereby ensuring the generalizability and adaptability of the model. The generalization test of an AI model mainly evaluates the model's predictive ability on unseen data, that is, the model's adaptability to new data. Usually, by using data that is closer to the actual application scenario but different from the training set and validation set in the test set, the difference between the performance of the test set and the validation set can be regarded as the generalization performance error.

[0005] Overfitting is a phenomenon in which a machine learning model performs very well on training data but performs poorly on unknown or test data. This phenomenon usually occurs when the model is too complex and memorizes the noise and details in the training data instead of learning the general patterns of the data. Overfitting is a common problem in machine learning that causes the model to generalize poorly, that is, perform poorly on unseen data.

[0006] Membership Inference Attack is a data privacy theft technique for artificial intelligence models. Its goal is to perform privacy attacks by determining whether a data sample belongs to the model's training data set. This attack is essentially a binary classification of data from unknown sources, that is, determining whether the data sample is a member of the model training set (member data) or a non-member (non-member data). The attacker usually achieves this goal by building a binary classifier that takes the confidence score vector of the data sample predicted by the target classifier as input, and then predicts whether the data sample is a member data or non-member data of the target classifier's training data set. Membership inference attacks can also be used to perform privacy audits on models and sample sets.

[0007] NMS (Non-Maximum Suppression) is a necessary post-processing process in the target detection algorithm, which aims to eliminate redundant prediction boxes on the same object, thereby improving the accuracy of detection. In the target detection task, the algorithm may detect the same target multiple times, resulting in multiple overlapping detection boxes. The main idea of ​​the NMS algorithm is: first, sort all the bounding boxes predicted by the network from high to low according to the scores, then select the prediction box with the highest score as the target, and calculate the overlap between the target and the remaining prediction boxes (measured by IoU). If the overlap is greater than a pre-set threshold, it is considered that the prediction box and the target are responsible for predicting the same object at the same time, so the bounding box is deleted; otherwise, it is retained.

[0008] Privacy audit is the process of testing the relevant procedures, privacy policies and personal information processing processes to assess whether they comply with relevant laws and regulations, industry norms and user agreements. In generalization model testing, the privacy audit of the test set refers to measuring whether it has been leaked to the manufacturer for model training.

[0009] Safety production is the foundation, premise and guarantee of the daily work of power companies, but safety accidents are difficult to avoid. How to strictly formulate and effectively implement safety risk control measures at infrastructure construction sites is the key to ensuring safety production. Introducing artificial intelligence and digital technology in the process of infrastructure construction operations, deeply integrating "artificial intelligence" with "construction site safety risk control", strengthening construction site safety risk control, systematically analyzing the current problems in infrastructure construction site safety risk control, and putting forward specific measures to improve safety control in a targeted manner.

[0010] In recent years, the State Grid Corporation has made great progress in information management and on-site control in the infrastructure business field, and has carried out the construction of information management systems such as the "Infrastructure Control Platform" and "e-Infrastructure". It mainly focuses on the construction site, collects information data on the operation process and the working environment, and realizes functions such as electronic operation ticket management, on-site supervision of risk operations, daily safety and quality inspections on site, and daily safety closed-loop rectification on site. Based on information technology and communication technology, the remote mobile client can view the on-site video in real time, and through on-site sensing facilities and communication networks, the on-site collection and remote transmission of various data information such as wind speed, dust, temperature, cleanliness, noise, etc. for high-risk operations (such as crossing construction, tower crane operations, deep foundation pit excavation, etc.) can be realized, and over-limit alarms can be issued. However, in terms of video surveillance at infrastructure sites, there is still a lack of digital and intelligent overall solutions that can improve the safety control effect of infrastructure sites.

[0011] All work sites managed by State Grid Corporation of China have been fully covered by video equipment. However, due to the influence of network signals in remote areas such as mountainous areas, the real-time data transmission is difficult to be reliably guaranteed, and the terminal sensing equipment is difficult to play a role. With the increasingly complete perception capabilities of IoT terminals, violation identification is still at the stage of on-site inspections and monitoring video inspections. Although the remote transmission of video files has solved some of the problems of on-site safety monitoring, it is still necessary to arrange special personnel to use the monitoring system to conduct project inspections every day. During the entire construction process, when faced with massive amounts of data, monitoring personnel cannot directly analyze the collected data manually in an all-round, all-time, and all-process manner. Long-term monitoring operations are a great test of their energy and physical strength. When faced with irregular construction at infrastructure sites, they cannot respond in a timely manner, and video monitoring equipment cannot play its maximum value.

[0012] With the development of artificial intelligence technology, deep neural network models have achieved excellent performance in target detection tasks in computer vision tasks. To address the above problems, by using a power site operation violation recognition model based on deep neural networks to perform real-time analysis of the operation site video, the efficiency of remote safety operation management and control can be effectively improved. Before the power site operation violation recognition model is put into actual production application, the generalization test of the power site operation violation recognition model is one of the key steps to ensure that it can work accurately and stably in field applications. This is not only related to the effectiveness of the model, but also directly affects the safety level of the construction site. Constructing a high-quality data set for model training and testing, especially a data set for testing the generalization ability of the model, is crucial to ensure that the model can accurately identify violations in different scenarios.

[0013] However, in the process of building these data sets, not only a large amount of sensitive data from the work site is involved, such as facial features and identity information of on-site workers, but also the leakage of test data will lead to inaccurate model test results. Therefore, privacy auditing of data sets has become an indispensable part. The importance of privacy auditing methods is reflected in the following aspects:

[0014] Compliance requirements: With the increasingly stringent laws and regulations on personal data protection, it is particularly important to ensure that data processing activities comply with the requirements of relevant laws and regulations. Privacy audits help verify whether data collection, storage, processing and transmission comply with relevant regulations. Trust building: For power companies and third-party service providers, ensuring the security of data privacy can enhance the trust of employees and the public. By implementing strict privacy audits, the company's determination and ability to protect personal privacy can be demonstrated to stakeholders, thereby enhancing the brand image and social responsibility. Risk prevention and control: Privacy audits can help identify potential data leakage risk points, take timely measures to fill security loopholes, and prevent corporate reputation losses and legal risks caused by data leakage. Data quality assurance: Through privacy audits, data samples that contain sensitive information or do not meet the purpose of use can be eliminated, thereby improving the quality of the data set. High-quality data sets not only help improve the training effect of the model, but also avoid model bias and misjudgment caused by data quality issues.

[0015] In summary, when developing and deploying models for identifying violations in power field operations, conducting privacy audits of data sets is not only a basic requirement for complying with laws and regulations, but also an important means to ensure data security, improve model performance, and win social trust. Summary of the invention

[0016] The purpose of the present invention is to solve the problem of low privacy audit accuracy when performing privacy audit of data sets in the prior art, and to provide a data privacy audit method and system for generalized testing of power operation violation identification.

[0017] In order to achieve the above object, the present invention adopts the following technical solutions:

[0018] The data privacy audit method for generalized testing of electric power operation violation identification proposed in the present invention includes:

[0019] Obtaining a sample image for a generalization test of work violation recognition, and adding adversarial noise to the sample image for a generalization test of work violation recognition to form a noise sample image;

[0020] Obtain a power site operation target recognition model and a member reasoning attack model, input the operation violation recognition generalization test sample image and the noise sample image into the power site operation target recognition model, and form a prediction bounding box distribution confidence heat map;

[0021] The confidence heat map of the predicted bounding box distribution is input into the member reasoning attack model to obtain the data privacy leakage results of the sample images of the generalization test of operation violation recognition, and realize the privacy audit of the power field dataset.

[0022] Preferably, the acquisition of the power field operation target recognition model is specifically:

[0023] Get the power field operation image sample set X = {(x i , O i )|i∈I}, the first training set X is obtained based on the power field operation image sample set train1 , the second training set X train2 , privacy-leaked dataset X valid and the dataset X that has not been leaked test ; where x i is the i-th image in the dataset, O i There are M real-life violation targets in the power field operation image set, and I is the number of images in the dataset;

[0024] Take the first training set X train1 and privacy-leaked dataset X valid For the target recognition model f target Train the target recognition model f target A total of N violation behavior recognition targets are output, and the target recognition model f target The output box is g n , target recognition model f target The output type is f Y is the probability distribution of the top-1 categories, so the target recognition model ftarget The output target is O n =(g n , f Y ), target recognition model f target Output the confidence s of the target n , that is (O n ,s n )=f target (x n ), and obtain the target recognition model for power field operations.

[0025] Preferably, the member reasoning attack model is specifically:

[0026] Get the power field operation image sample set X = {(x i , O i )|i∈I}, the first training set X is obtained based on the power field operation image sample set train1 , the second training set X train2 , privacy-leaked dataset X valid and the dataset X that has not been leaked test ; where x i is the i-th image in the dataset, O i There are M real-life violation targets in the power field operation image set, and I is the number of images in the dataset;

[0027] Take the second training set X train2 and privacy-leaked dataset X valid For the shadow model f shadow Train the shadow model f shadow Ability to identify violations of power site operations (O n ,s n )=f shadow (x n ), obtain the shadow model of power field operation;

[0028] For privacy-leaked dataset X valid and the dataset X that has not been leaked test Perform sample enhancement to obtain adversarial enhancement sample images, input the adversarial enhancement sample set into the power field operation shadow model, and combine the canvas method to form a confidence heat map;

[0029] The confidence heat map is annotated to form an attack model dataset, and the attack model is trained using the attack model dataset to obtain a member reasoning attack model.

[0030] Preferably, the privacy-disclosed dataset X valid and the dataset X that has not been leaked testPerform sample enhancement to obtain adversarial enhanced sample images, specifically as follows:

[0031] Assume the image x i is square with side length w pixels, the color channel of the image is C, the l2 radius of the adversarial noise is Φ, and the maximum number of algorithm iterations is T. For each image x i The calculation method of the objective function value is where 1 is the exponential function. If 1 a = 1, the condition a is true, otherwise the exponential function value is 0; the value of ζ is 0.5, and the value of λ is set to 0.5 * IOU(b n , g m ), f Y is the probability distribution of the top-1 category output by the target recognition model f target , n y is the category label y of the nth sample, is the probability of the category label of the nth sample, b n is the rectangular box of the job violation behavior output by the model, g m is the rectangular box of the true job violation behavior manually labeled;

[0032] Iteratively construct adversarial image enhanced samples The objective is The construction method includes the following steps:

[0033] Initialization l * ← L(f target (x i ), O i ), i ← 1; where l * is the correct value for judging the job violation behavior;

[0034] When i < T and l * ≠ 0, execute the following steps:

[0035] For O i , the range of the adversarial noise in the image is the range where the target box b m is located. Therefore, the length and width of the noise are where, is the abscissa value of the farthest endpoint of the rectangular box from the origin of the coordinate axis, is the abscissa value of the nearest endpoint of the rectangular box from the origin of the coordinate axis, is the ordinate value of the farthest endpoint of the rectangular box from the origin of the coordinate axis, is the ordinate value of the nearest endpoint of the rectangular box from the origin of the coordinate axis;

[0036] Through Sampling from the distribution of adversarial noise δ, constructing a probability distribution of noise δ;

[0037] Adjust the value of noise δ to between 0 and 1 and project it into box b m Within the range, the noise δ is then replicated horizontally and vertically;

[0038] The enhanced noise δ and x i Add together to get

[0039] By calculation Judgement * Compared with the previous round, if there is a decrease, save the result of this round for the next round of iteration. If there is no decrease, continue to use the previous round of l * and Among them, O n is the target recognition model f target Output target;

[0040] X valid and X test All original samples x in the two sample sets i , constructed by the above method Will Add to the sample set, that is Get a dataset of adversarially enhanced sample images including enhanced privacy leaks and enhanced datasets without privacy leakage

[0041] Preferably, the adversarial enhancement sample set is input into the power field operation shadow model, and a confidence heat map is formed in combination with the canvas method, specifically:

[0042] Datasets that will enhance privacy leakage and enhanced datasets without privacy leakage All images x in t and Input into the power field operation shadow model to obtain (O t ,s t )=f shadow (x t )and Among them, O t Process normal image x for the model t Output of the operation violation target, Processing adversarial augmented images for the model Output of the operation violation target, Processing adversarial augmented images for the model The confidence level of the outputted operation violation target, x t For a normal image, Enhance images for adversarial purposes;

[0043] The confidence level s in the recognition result t By s t-rescale = -log(1-s t ) is normalized, for f shadow (x t )and Output and complete each confidence normalization (O t ,s t-rescale ), frame b t Fill the range with brightness s t-rescale The matrix For the case where there are multiple frames in the same position, the brightness values ​​of the frames are superimposed in the overlapping area to form f shadow (x t ) confidence heat map d t ;

[0044] Among them, s t-rescale is the confidence value of the normalized operation violation recognition result, is the horizontal coordinate of the end point of the rectangular box of the operation violation recognition result farthest from the origin of the coordinate axis, z x The horizontal axis range of the brightness filling matrix, is the horizontal coordinate of the endpoint of the rectangular box of the operation violation recognition result closest to the origin of the coordinate axis, is the ordinate of the farthest point of the rectangular box of the operation violation recognition result from the origin of the coordinate axis, z y Fill the vertical coordinate range of the matrix for brightness, It is the vertical coordinate of the endpoint of the rectangular box of the operation violation identification result closest to the origin of the coordinate axis.

[0045] Preferably, the confidence heat map is annotated to form an attack model data set, specifically:

[0046] For each pair of samples Form prediction bounding box distribution confidence heat map samples in, is the indicator function, if x t ∈X valid If true, the function value is 1, otherwise it is 0; t ,s t )and Converted into prediction bounding box distribution confidence heat map samples to form an attack model dataset

[0047] Preferably, the acquiring of a sample set of power field operation images comprises:

[0048] Power field work image set for X image ={x i |i∈I}, I is the number of images in the dataset, x i is the i-th image in the dataset. There are M real-world violation behavior targets O in the power field operation image set. i ={o1,o2,...,o m}, each target o m By Box and the category of violation behavior y∈{1,2,...,Y}, where For frame b m The coordinates of the diagonal endpoint with the smallest value, For frame b m The coordinates of the diagonal endpoint with the largest value, Y is the number of target categories, that is, o m =(b m ,Y), mark each illegal operation behavior target in the image, and form the power field operation image sample set X = {(x i , O i )|i∈I}.

[0049] The data privacy audit system for generalized testing of electric power operation violation identification proposed in the present invention includes:

[0050] An image acquisition module, wherein the image acquisition module is used to acquire a sample image of a generalization test of operation violation recognition, and add adversarial noise to the sample image of the generalization test of operation violation recognition to form a noise sample image;

[0051] An image processing module, wherein the image processing module is used to obtain a power site operation target recognition model and a member reasoning attack model, input a generalization test sample image of operation violation recognition and a noise sample image into the power site operation target recognition model, and form a prediction bounding box distribution confidence heat map;

[0052] The privacy judgment module is used to input the prediction bounding box distribution confidence heat map into the member reasoning attack model, obtain the data privacy leakage results of the sample images of the operation violation recognition generalization test, and realize the privacy audit of the power field data set.

[0053] Preferably, the acquisition of the power field operation target recognition model is specifically:

[0054] Get the power field operation image sample set X = {(x i , O i )|i∈I}, the first training set X is obtained based on the power field operation image sample set train1 , the second training set X train2, privacy-leaked dataset X valid and the dataset X that has not been leaked test ; where x i is the i-th image in the dataset, O i There are M real-life violation targets in the power field operation image set, and I is the number of images in the dataset;

[0055] Take the first training set X train1 and privacy-leaked dataset X valid For the target recognition model f target Train the target recognition model f target A total of N violation behavior recognition targets are output, and the target recognition model f target The output box is g n , target recognition model f target The output type is f Y is the probability distribution of the top-1 categories, so the target recognition model f target The output target is O n =(g n , f Y ), target recognition model f target Output the confidence s of the target n , that is (O n ,s n )=f target (x n ), and obtain the target recognition model for power field operations.

[0056] Preferably, the member reasoning attack model is specifically:

[0057] Get the power field operation image sample set X = {(x i , O i )|i∈I}, the first training set X is obtained based on the power field operation image sample set train1 , the second training set X train2 , privacy-leaked dataset X valid and the dataset X that has not been leaked test ; where x i is the i-th image in the dataset, O i There are M real-life violation targets in the power field operation image set, and I is the number of images in the dataset;

[0058] Take the second training set X train2 and privacy-leaked dataset X valid For the shadow model f shadow Train the shadow model f shadow Ability to identify violations of power site operations (O n,s n )=f shadow (x n ), obtain the shadow model of power field operation;

[0059] For privacy-leaked dataset X valid and the dataset X that has not been leaked test Perform sample enhancement to obtain adversarial enhancement sample images, input the adversarial enhancement sample set into the power field operation shadow model, and combine the canvas method to form a confidence heat map;

[0060] The confidence heat map is annotated to form an attack model dataset, and the attack model is trained using the attack model dataset to obtain a member reasoning attack model.

[0061] Preferably, the privacy-disclosed dataset X valid and the dataset X that has not been leaked test Perform sample enhancement to obtain adversarial enhancement sample images, specifically:

[0062] Assume that image x i is a square with a side length of w pixels, the color channel of the image is C, the l2 radius of the anti-noise is Φ, the maximum number of algorithm iterations is T, for each image x i The objective function value is calculated as follows: Among them, 1 is an exponential function. If 1 a =1, condition a is true, otherwise the exponential function value is 0; the value of ζ is 0.5, and the value of λ is set to 0.5*IOU(b n ,g m ), f Y is the target recognition model f target Probability distribution of the top-1 categories of the output, n y is the category label y of the nth sample, is the probability of the class label of the nth sample, b n is the rectangular box of the operation violation behavior output by the model, g m It is a manually labeled rectangle frame of real work violation behavior;

[0063] Iteratively construct adversarial image enhancement samples The goal is The construction method includes the following steps:

[0064] initialization l * ←L(f target (x i ),O i ), i←1; where l *is the correct value for judging the violation behavior of this operation;

[0065] When i < T and l * ≠ 0, execute the following steps:

[0066] For O i , the range of the adversarial noise in the image is the range where the target box b m is located. Therefore, the length and width of the noise are where, is the abscissa value of the farthest endpoint of the rectangular box from the origin of the coordinate axis, is the abscissa value of the nearest endpoint of the rectangular box from the origin of the coordinate axis, is the ordinate value of the farthest endpoint of the rectangular box from the origin of the coordinate axis, is the ordinate value of the nearest endpoint of the rectangular box from the origin of the coordinate axis;

[0067] Through sample from the distribution of the adversarial noise δ to construct the probability distribution of the noise δ;

[0068] Adjust the value of the noise δ to between 0 and 1 and project it into the range of the box b m , and then horizontally and vertically copy the noise δ;

[0069] Add the enhanced noise δ to x i to get

[0070] By calculating judge whether l * has decreased compared with the previous round. If it has decreased, save the result of this round for the next round of iteration. If it has not decreased, continue to use the l of the previous round * and where, O n is the target output by the target recognition model f target ;

[0071] For all the original samples x valid in the two sample sets of X test and X i , construct by the above method Add to the sample set, that is Obtain the dataset of the adversarial enhanced sample images including enhanced privacy leakage and the dataset of enhanced non-privacy leakage

[0072] Preferably, inputting the adversarial enhanced sample set into the power field operation shadow model and forming a confidence heat map in combination with the canvas method is specifically:

[0073] Datasets that will enhance privacy leakage and enhanced datasets without privacy leakage All images x in t and Input into the power field operation shadow model to obtain (O t ,s t )=f shadow (x t )and Among them, O t Process normal image x for the model t Output of the operation violation target, Processing adversarial augmented images for the model Output of the operation violation target, Processing adversarial augmented images for the model The confidence level of the outputted operation violation target, x t For a normal image, Enhance images for adversarial purposes;

[0074] The confidence level s in the recognition result t By s t-rescale = -log(1-s t ) is normalized, for f shadow (x t )and Output and complete each confidence normalization (O t ,s t-rescale ), frame b t Fill the range with brightness s t-rescale The matrix For the case where there are multiple frames in the same position, the brightness values ​​of the frames are superimposed in the overlapping area to form f shadow (x t ) confidence heat map d t ;

[0075] Among them, s t-rescale is the confidence value of the normalized operation violation recognition result, is the horizontal coordinate of the end point of the rectangular box of the operation violation recognition result farthest from the origin of the coordinate axis, z x The horizontal axis range of the brightness filling matrix, is the horizontal coordinate of the endpoint of the rectangular box of the operation violation recognition result closest to the origin of the coordinate axis, is the ordinate of the farthest point of the rectangular box of the operation violation recognition result from the origin of the coordinate axis, z y Fill the vertical coordinate range of the matrix for brightness, It is the vertical coordinate of the endpoint of the rectangular box of the operation violation identification result closest to the origin of the coordinate axis.

[0076] Preferably, the confidence heat map is annotated to form an attack model data set, specifically:

[0077] For each pair of samples Form prediction bounding box distribution confidence heat map samples in, is the indicator function, if x t ∈X valid If true, the function value is 1, otherwise it is 0; t ,s t )and Converted into prediction bounding box distribution confidence heat map samples to form an attack model dataset

[0078] Preferably, the acquiring of a sample set of power field operation images comprises:

[0079] Power field work image set for X image ={x i |i∈I}, I is the number of images in the dataset, x i is the i-th image in the dataset. There are M real-world violation behavior targets O in the power field operation image set. i ={o1,o2,...,o M}, each target o m By Box and the category of violation behavior y∈{1,2,...,Y}, where For frame b m The coordinates of the diagonal endpoint with the smallest value, For frame b m The coordinates of the diagonal endpoint with the largest value, Y is the number of target categories, that is, o m =(b m ,Y), mark each illegal operation behavior target in the image, and form the power field operation image sample set X = {(x i , O i )|i∈I}.

[0080] A terminal device comprises a memory, a processor and a computer program stored in the memory and executable on the processor. When the processor executes the computer program, the steps of a data privacy audit method for generalized testing of electric power operation violation identification are implemented.

[0081] A computer-readable storage medium stores a computer program, which, when executed by a processor, implements the steps of a data privacy audit method for generalized testing of power operation violation identification.

[0082] Compared with the prior art, the present invention has the following beneficial effects:

[0083] The present invention proposes a data privacy audit method for generalization testing of power operation violation identification, which uses a "whiteboard" method to counter the object detection model. The method draws the predicted bounding box distribution on a blank canvas and then uses it as input to the classification network. This method performs better than the traditional machine learning regression method. In this technology, an overlay bounding box drawing method is used when drawing the bounding box distribution ("whiteboard"). For the multi-scale target recognition model used in power field operation violation identification, a large amount of small target prediction box confidence information is covered, resulting in a poor effect of this method, and it is impossible to distinguish whether the test data has been trained by the model. In this technology, the test sample is directly input into the model to output the predicted bounding box distribution and reflect it in the "canvas". The multi-scale feature fusion processing capability is added to the multi-scale target recognition model used in power field operation violation identification, so that the difference in predicted bounding box distribution between the trained test sample and the untrained test sample is small, which reduces the accuracy of distinguishing whether the test data has been trained by the model.

[0084] In view of the fact that the test data set of the power field operation violation recognition model has a complex source and the test data set is leaked to the tested party in advance, the present invention proposes a data set privacy audit method for the generalization test of the power field operation violation recognition model. The method uses a convolutional neural network to identify the "overfitting" characteristics of the power field operation violation recognition model (that is, the overlap area of ​​the target candidate box output by the trained sample during the test is relatively concentrated, while the overlap area of ​​the target candidate box output by the untrained test sample during the test is relatively scattered) to identify whether the test sample has been trained by the tested model. This method is also called privacy auditing of sample data. In order to amplify the "overfitting" characteristics, the present invention uses image anti-noise to further process the test sample, and uses a method of mapping the target reselection box to the "canvas" and "top view" the confidence value on the canvas to make the difference in the distribution of the trained and untrained sample target recognition candidate boxes more obvious, and easier to be recognized by the convolutional neural network, thereby better improving the accuracy of privacy auditing.

[0085] The present invention proposes a data privacy audit system for generalization test of power operation violation identification. By dividing the system into image acquisition module, image processing module and privacy judgment module, the data privacy leakage results of sample images of operation violation identification generalization test are obtained to realize privacy audit of power field data set. The modularization concept is adopted to make each module independent of each other, which is convenient for unified management of each module. BRIEF DESCRIPTION OF THE DRAWINGS

[0086] In order to more clearly illustrate the technical solutions of the embodiments of the present invention, the drawings required for use in the embodiments are briefly introduced below. It should be understood that the following drawings only show certain embodiments of the present invention and therefore should not be regarded as limiting the scope. For ordinary technicians in this field, other related drawings can be obtained based on these drawings without creative work.

[0087] Figure 1 This is a flow chart of the data privacy audit method for generalized testing of power operation violation identification according to the present invention.

[0088] Figure 2 The target output of the model is processed into a confidence heat map for the predicted bounding box distribution in the present invention.

[0089] Figure 3 This is a diagram of the data privacy audit system for generalized testing of power operation violation identification according to the present invention.

[0090] Figure 4 The figure is a schematic structural diagram of an electronic device of the present invention. DETAILED DESCRIPTION

[0091] In order to make the purpose, technical solutions and advantages of the embodiments of the present invention clearer, the technical solutions in the embodiments of the present invention will be clearly and completely described below in conjunction with the drawings in the embodiments of the present invention. Obviously, the described embodiments are part of the embodiments of the present invention, not all of the embodiments. Generally, the components of the embodiments of the present invention described and shown in the drawings here can be arranged and designed in various different configurations.

[0092] Therefore, the following detailed description of the embodiments of the present invention provided in the accompanying drawings is not intended to limit the scope of the invention claimed for protection, but merely represents selected embodiments of the present invention. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0093] It should be noted that similar reference numerals and letters denote similar items in the following drawings, and therefore, once an item is defined in one drawing, further definition and explanation thereof is not required in subsequent drawings.

[0094] The present invention is further described in detail below in conjunction with the accompanying drawings:

[0095] The present invention proposes a data privacy audit for generalized testing of power operation violation identification, such as Figure 1 As shown, the following steps are included:

[0096] S1. Obtain a sample image for a generalization test of work violation recognition, and add adversarial noise to the sample image for a generalization test of work violation recognition to form a noise sample image;

[0097] S2. Obtain a power site operation target recognition model and a member reasoning attack model, input the operation violation recognition generalization test sample image and the noise sample image into the power site operation target recognition model, and form a prediction bounding box distribution confidence heat map;

[0098] The acquisition of the power field operation target recognition model is specifically as follows:

[0099] Get the power field operation image sample set X = {(x i , O i )|i∈I}, the first training set X is obtained based on the power field operation image sample set train1 , the second training set X train2 , privacy-leaked dataset X valid and the dataset X that has not been leaked test ; where x i is the i-th image in the dataset, O i There are M real-life violation targets in the power field operation image set, and I is the number of images in the dataset;

[0100] Take the first training set X train1 and privacy-leaked dataset X valid For the target recognition model f target Train the target recognition model f target A total of N violation behavior recognition targets are output, and the target recognition model f target The output box is g n , target recognition model f target The output type is f Y is the probability distribution of the top-1 categories, so the target recognition model f target The output target is O n =(g n , f Y ), target recognition model f target Output the confidence s of the target n , that is (O n ,s n )=f target (x n ), and obtain the target recognition model for power field operations.

[0101] The member reasoning attack model is specifically:

[0102] Get the power field operation image sample set X = {(x i , Oi )|i∈I}, the first training set X is obtained based on the power field operation image sample set train1 , the second training set X train2 , privacy-leaked dataset X valid and the dataset X that has not been leaked test ; where x i is the i-th image in the dataset, O i There are M real-life violation targets in the power field operation image set, and I is the number of images in the dataset;

[0103] Take the second training set X trzin2 and privacy-leaked dataset X valid For the shadow model f shadow Train the shadow model f shadow Ability to identify violations of power site operations (O n ,s n )=f shadow (x n ), obtain the shadow model of power field operation;

[0104] For privacy-leaked dataset X valid and the dataset X that has not been leaked test Perform sample enhancement to obtain adversarial enhancement sample images, input the adversarial enhancement sample set into the power field operation shadow model, and combine the canvas method to form a confidence heat map;

[0105] The confidence heat map is annotated to form an attack model dataset, and the attack model is trained using the attack model dataset to obtain a member reasoning attack model.

[0106] The privacy-leaked dataset X valid and the dataset X that has not been leaked test Perform sample enhancement to obtain adversarial enhancement sample images, specifically:

[0107] Assume that image x i is a square with a side length of w pixels, the color channel of the image is C, the l2 radius of the anti-noise is Φ, the maximum number of algorithm iterations is T, for each image x i The objective function value is calculated as follows: Among them, 1 is an exponential function. If 1 a =1, condition a is true, otherwise the exponential function value is 0; the value of ζ is 0.5, and the value of λ is set to 0.5*IOU(b n ,g m ), f Y is the target recognition model f targetProbability distribution of the top-1 output category, n y is the class label y of the nth sample, is the probability of the class label of the nth sample, b n is the rectangular box of the job violation behavior output by the model, g m is the ground truth rectangular box of the job violation behavior manually annotated;

[0108] Iteratively construct adversarial image enhancement samples The goal is The construction method includes the following steps:

[0109] Initialization l * ←L(f target (x i ),O i ),i←1; where l * is the correct value for discriminating the job violation behavior. The lower the correct value, the more effective the adversarial image enhancement sample is.

[0110] When i < T and l * ≠0, execute the following steps:

[0111] For O i , the range of the adversarial noise in the image is the range where the target box b m is located. Therefore, the length and width of the noise are where, is the abscissa value of the farthest endpoint of the rectangular box from the origin of the coordinate axis, is the abscissa value of the closest endpoint of the rectangular box from the origin of the coordinate axis, is the ordinate value of the farthest endpoint of the rectangular box from the origin of the coordinate axis, is the ordinate value of the closest endpoint of the rectangular box from the origin of the coordinate axis;

[0112] Through sample from the distribution of the adversarial noise δ to construct the probability distribution of the noise δ;

[0113] Adjust the value of the noise δ to between 0 and 1 and project it into the range of the box b m , and then horizontally and vertically replicate the noise δ;

[0114] Add the enhanced noise δ to x i to get

[0115] By calculating judge whether l * has decreased compared to the previous round. If it has decreased, save the results of this round for the next round of iteration. If it has not decreased, continue to use the l of the previous round *and Among them, O n is the target recognition model f target Output target;

[0116] X valid and X test All original samples x in the two sample sets i , constructed by the above method Will Add to the sample set, that is Get a dataset of adversarially enhanced sample images including enhanced privacy leaks and enhanced datasets without privacy leakage

[0117] The adversarial enhancement sample set is input into the power field operation shadow model, and the confidence heat map is formed in combination with the canvas method, specifically:

[0118] Datasets that will enhance privacy leakage and enhanced datasets without privacy leakage All images x in t and Input into the power field operation shadow model to obtain (O t ,s t )=f shadow (x t )and Among them, O t Process normal image x for the model t Output of the operation violation target, Processing adversarial augmented images for the model Output of the operation violation target, Processing adversarial augmented images for the model The confidence level of the outputted operation violation target, x t For a normal image, Enhance images for adversarial purposes;

[0119] The confidence level s in the recognition result t By s t-rescale = -log(1-s t ) is normalized, for f shadow (x t )and Output and complete each confidence normalization (O t ,s t-rescale ), frame b t Fill the range with brightness s t-rescale The matrix For the case where there are multiple frames in the same position, the brightness values ​​of the frames are superimposed in the overlapping area to form f shadow (x t ) confidence heat map d t ;

[0120] Among them, s t-rescale is the confidence value of the normalized operation violation recognition result, is the horizontal coordinate of the end point of the rectangular box of the operation violation recognition result farthest from the origin of the coordinate axis, z x The horizontal axis range of the brightness filling matrix, is the horizontal coordinate of the endpoint of the rectangular box of the operation violation recognition result closest to the origin of the coordinate axis, is the ordinate of the farthest point of the rectangular box of the operation violation recognition result from the origin of the coordinate axis, z y Fill the vertical coordinate range of the matrix for brightness, It is the vertical coordinate of the endpoint of the rectangular box of the operation violation identification result closest to the origin of the coordinate axis.

[0121] The confidence heat map is annotated to form an attack model dataset, specifically:

[0122] For each pair of samples Form prediction bounding box distribution confidence heat map samples in, is the indicator function, if x t ∈X valid If true, the function value is 1, otherwise it is 0; t ,s t )and Converted into prediction bounding box distribution confidence heat map samples to form an attack model dataset

[0123] The obtaining of a sample set of power field operation images is specifically as follows:

[0124] Power field work image set for X image ={x i |i∈I}, I is the number of images in the dataset, x i is the i-th image in the dataset. There are M real-world violation behavior targets O in the power field operation image set. i ={o1,o2,...,o M}, each target o m By Box and the category of violation behavior y∈{1,2,...,Y}, where For frame b m The coordinates of the diagonal endpoint with the smallest value, For frame b m The coordinates of the diagonal endpoint with the largest value, Y is the number of target categories, that is, o m =(b m ,Y), mark each illegal operation behavior target in the image, and form the power field operation image sample set X = {(x i , O i )|i∈I}.

[0125] S3. Input the predicted bounding box distribution confidence heat map into the member reasoning attack model to obtain the data privacy leakage results of the sample images of the generalization test of operation violation recognition, and realize the privacy audit of the power field data set.

[0126] The following are the detailed steps of this method:

[0127] Step 1: Select some test samples and add them to the model training set, and use the model training set to train the target recognition model and the shadow model.

[0128] Step 1.1: Assume that the power field operation image set is X image ={x i |i∈I}, I is the number of images in the dataset, x i is the i-th image in the dataset. Assume that there are M real-world violation targets O in the image. i ={o1,o2,...,o M}, each target o m By Box and the category of violation behavior y∈{1,2,...,Y}, where is the coordinate of the diagonal endpoint with the smallest value of the rectangular box, is the coordinate of the diagonal endpoint with the largest value in the rectangular box, and Y is the number of target categories, that is, o m =(b m ,Y), mark each illegal operation behavior target in the image, and form the power field operation image sample set X = {(x i , O i )|i∈I}, and divide it into X according to the ratio of 4:3:1.5:1.5 train1 and X train2 and X valid and X test Four non-intersecting sample sets, where X valid is a privacy-leaked dataset, X test It is a data set whose privacy has not been leaked.

[0129] Step 1.2: Use X train1 and X valid For the target recognition model f targetTrain it to automatically detect any power field operation image x n The model outputs N illegal behavior recognition targets in total, and the box output by the model is g n , the model output type is f Y is the probability distribution of the top-1 category, so the target of the model output is O n =(g n , f Y ), and the model also outputs the confidence s of the target n , that is (O n ,s n )=f target (x n ), using X train2 and X valid For the shadow model f shadow Training is carried out to enable them to have the ability to identify violations of power field operations (O n ,s n )=f shadow (x n ), and the non-maximum suppression (NMS) function is removed in the target recognition model of power field operations; where f target (x n ) means to transform the image x n Input to f target In, f s h adow (x n ) means to transform the image x n Input to f shadow middle.

[0130] Among them, the target recognition model f target and the shadow model f shadow It is a target recognition model with a known architecture, and can adopt architectures such as ViT and DETR.

[0131] Step 1.3: The goal of the operation violation recognition model and the shadow model is to have an IoU value greater than the threshold ζ between the output recognition target and the manually labeled target, and the category output by the model is consistent with the category manually labeled, that is, For any target n in the N traffic violation identification target set output by the model and any target m in the M traffic violation targets that actually exist in the manually annotated image, the box b of target n n and the box g of the target m m The intersection over union (IoU) of the target n is greater than the threshold ζ and the category label c of the box n and the category label y of the target m mConsistent; among them, the calculation method of the intersection over union is IoU(a, b) = (a ∩ b) / (a ∪ b), the threshold ζ is usually set to 0.5, both a and b are rectangular boxes, and the intersection over union is the ratio of the area where the two rectangular boxes intersect to the combined area.

[0132] Step 2. Based on object recognition, enhance the test samples against noise to form adversarial enhanced test samples and add them to the test sample set X valid and X test .

[0133] Step 2.1. To more clearly show the generalization gap between different job violation recognition models, it is necessary to enhance the samples, and enhance the samples where x is the original sample and δ is the adversarial noise used for enhancement.

[0134] Step 2.2. The construction of enhanced samples needs to adopt an iterative construction method. Assume that the image x i is a square with a side length of w pixels, the color channel of the image is C, the l2 radius of the adversarial noise is Φ, and the maximum number of algorithm iterations is T. For each image x i The calculation method of the objective function value is where 1 is the exponential function, that is, if 1 a = 1, if the condition a is true, otherwise the exponential function value is 0; the value of ζ is 0.5, and the value of λ is usually set to 0.5 * IOU(b n , g m ), f Y is the probability distribution of the top-1 category output by the model f target , n y is the category label y of the nth sample, is the probability of the category label of the nth sample.

[0135] Iterative construction The objective is T is set to 20.

[0136] The construction method is the following steps:

[0137] Initialization l * ← L(f target (x i ), O i ),i ← 1

[0138] Judge i < T and l * ≠ 0. If so (l * has been assigned in one step), iteratively execute the following steps:

[0139] For Oi , the range of the adversarial noise in the image is the target box b n The range of the noise is, therefore, the length and width are That is b m Subtracting the two coordinate values ​​of the opposite corners of a rectangle can give the length and width of the rectangle.

[0140] By formula Sampling from the distribution of adversarial noise δ, constructing noise δ Probability distribution, the construction method is detailed in Square Attack: a query-efficient black-box: Algorithm 3: Sampling distribution P for l2-norm); where P is the probability distribution,

[0141] In order to adapt the anchor detection mechanism of the target detection model and make the adversarial noise suitable for horizontal and vertical flipping, the value of δ is adjusted to between 0 and 1 and projected onto the rectangular box b. m Within the range, ∈ is then copied horizontally and vertically.

[0142] The enhanced noise δ and x i Add together to get

[0143] By calculation Judgement * Compared with the previous round, if there is a decrease, save the result of this round for the next round of iteration. If there is no decrease, continue to use the previous round of l * and

[0144] X valid and X test All original samples x in the two sample sets i , constructed by the above method Will Add to the sample set, that is form and

[0145] Step 3: Identification of power site operation violations based on the shadow model For the inference results of the test samples and enhanced test samples, combined with the "canvas" method, a confidence heat map of the predicted bounding box distribution of the test samples and the adversarial enhanced test samples is formed.

[0146] Step 3.1: and All images x in t and Input to model f shadowGet (O t ,s t )=f shadow (x t )and

[0147] Step 3.2: Set the confidence level s in the recognition result t By s t-rescale = -log(1-s t ) is normalized, for f shadow (x t )and Output and complete each confidence normalization (O t ,s t-rescale ), frame b t Fill the range with brightness s t-rescale The matrix This means that in the rectangular frame b t Within the range of two anchor points, if there are multiple boxes at the same position, the brightness values ​​of the boxes are superimposed in the overlapping area to form f shadow (x t ) confidence distribution heat map d t ,but The confidence distribution heat map is d t , this method is called the "canvas" method, such as Figure 2 As shown in Figure 1, the target output by the model is processed into a confidence heat map of the predicted bounding box distribution, which is the "canvas method".

[0148] Step 4: The predicted bounding boxes of the test samples and the adversarial enhanced test samples are distributed and labeled according to whether they belong to the test samples, forming the member reasoning attack training and test sets.

[0149] Step 4.1: For each pair of samples Form prediction bounding box distribution confidence heat map samples in, After processing in step 3.2 Heat map results, is the indicator function, if x t ∈X valid If true, the function value is 1, otherwise it is 0. t ,s t )and Transformed into prediction bounding box distribution confidence heat map samples (also called member reasoning attack model samples) to form a member reasoning attack model dataset

[0150] Step 4.2: Divide the attack model dataset D into D according to the ratio of 7:3. train and D test Two disjoint sample sets, D train The training set for the member reasoning attack model, D test Test set for member reasoning attack model.

[0151] Step 5: Attack sample set D through membership inference train Train member reasoning attack model f attack , so that the model can learn to judge whether the test sample is a member of the training set, and the judgment result is y mi ,y mi is a value of 0 or 1, 0 or 1 is determined by the model f attack Determine the image pair Whether it is a model member is determined by the result, that is,

[0152] Among them, f attack is an image classification model.

[0153] Step 6: In the actual use stage of the model, for any operation violation recognition generalization test sample image x ood , firstly, by constructing a targeted approach to combat noise δ odd ,form

[0154] Step 7: x ood and Input the power field operation safety violation identification model f target (x), forming (O ood ,s ood )and And through the "canvas" method, a confidence heat map of the predicted bounding box distribution is formed

[0155] Step 8: Distribute the predicted bounding boxes into confidence heatmaps Input to the trained member reasoning attack model f attack In the example, we attack the model f through membership inference attack Identify whether it is f target (x) training set, if the model judges it as yes, it means that the generalization test sample image x of the operation violation recognition ood The privacy of data has been compromised.

[0156] advantage:

[0157] 1) In order to solve the problem that the distribution difference of predicted bounding boxes between trained test samples and untrained test samples is small, the multi-scale feature fusion processing capability is added to the multi-scale target recognition model used in the identification of violations in power field operations, the present invention amplifies the distribution difference between the predicted bounding boxes of trained test samples and untrained test samples by adding adversarial noise to the original test samples, making it easier to classify the two types of samples, thereby improving the accuracy of privacy audit of generalized test samples for the identification of violations in power field operations.

[0158] 2) The predicted bounding boxes of trained test samples are usually more concentrated, while the predicted bounding boxes of untrained test samples are usually more scattered. In order to better enable us to identify this feature, the present invention upgrades the "whiteboard" method to a "canvas" method. By superimposing the confidence values ​​of overlapping areas, the characteristic that the predicted bounding boxes of trained test samples are usually more concentrated is highlighted, thereby improving the accuracy of privacy audit of generalized test samples for identifying violations in power field operations.

[0159] Key Points:

[0160] 1) The present invention provides a data set privacy audit method for generalization testing of a power site operation violation recognition model. By identifying the difference in the confidence distribution of the prediction box in the power site operation violation image recognition results, it is determined whether the test sample has been trained by the power site operation violation recognition model, thereby being used to "cheat" in the model generalization test.

[0161] 2) The present invention amplifies the distribution difference between the predicted bounding boxes of trained test samples and untrained test samples by adding adversarial noise to the original samples, thereby improving the accuracy of "cheating" detection.

[0162] 3) The present invention upgrades the "blank slate" method to the canvas method and superimposes confidence values, so that the usually concentrated characteristics of the predicted bounding boxes of trained test samples are amplified, thereby improving the accuracy of "cheating" detection.

[0163] Example 2

[0164] The present invention proposes a data privacy audit system for generalized testing of power operation violation identification. Figure 3 As shown, including:

[0165] An image acquisition module, wherein the image acquisition module is used to acquire a sample image of a generalization test of operation violation recognition, and add adversarial noise to the sample image of the generalization test of operation violation recognition to form a noise sample image;

[0166] An image processing module, wherein the image processing module is used to obtain a power site operation target recognition model and a member reasoning attack model, input a generalization test sample image of operation violation recognition and a noise sample image into the power site operation target recognition model, and form a prediction bounding box distribution confidence heat map;

[0167] The acquisition of the power field operation target recognition model is specifically as follows:

[0168] Get the power field operation image sample set X = {(x i , O i )|i∈I}, the first training set X is obtained based on the power field operation image sample set train1 , the second training set X train2 , privacy-leaked dataset X valid and the dataset X that has not been leaked test ; where x i is the i-th image in the dataset, O i There are M real-life violation targets in the power field operation image set, and I is the number of images in the dataset;

[0169] Take the first training set X train1 and privacy-leaked dataset X valid For the target recognition model f target Train the target recognition model f target A total of N violation behavior recognition targets are output, and the target recognition model f target The output box is g n , target recognition model f target The output type is f Y is the probability distribution of the top-1 categories, so the target recognition model f target The output target is O n =(g n , f Y ), target recognition model f target Output the confidence s of the target n , that is (O n ,s n )=f target (x n ), and obtain the target recognition model for power field operations.

[0170] The member reasoning attack model is specifically:

[0171] Get the power field operation image sample set X = {(x i , O i )|i∈I}, the first training set X is obtained based on the power field operation image sample set train1 , the second training set X train2, privacy-leaked dataset X valid and the dataset X that has not been leaked test ; where x i is the i-th image in the dataset, O i There are M real-life violation targets in the power field operation image set, and I is the number of images in the dataset;

[0172] Take the second training set X train2 and privacy-leaked dataset X valid For the shadow model f shadow Train the shadow model f shadow Ability to identify violations of power site operations (O n ,s n )=f shadow (x n ), obtain the shadow model of power field operation;

[0173] For privacy-leaked dataset X valid and the dataset X that has not been leaked test Perform sample enhancement to obtain adversarial enhancement sample images, input the adversarial enhancement sample set into the power field operation shadow model, and combine the canvas method to form a confidence heat map;

[0174] The confidence heat map is annotated to form an attack model dataset, and the attack model is trained using the attack model dataset to obtain a member reasoning attack model.

[0175] The privacy-leaked dataset X valid and the dataset X that has not been leaked test Perform sample enhancement to obtain adversarial enhancement sample images, specifically:

[0176] Assume that image x i is a square with a side length of w pixels, the color channel of the image is C, the l2 radius of the anti-noise is Φ, the maximum number of algorithm iterations is T, for each image x i The objective function value is calculated as follows: Among them, 1 is an exponential function. If 1 a =1, condition a is true, otherwise the exponential function value is 0; the value of ζ is 0.5, and the value of λ is set to 0.5*IOU(b n ,g m ), f Y is the target recognition model f target Probability distribution of the top-1 categories of the output, n y is the category label y of the nth sample, is the probability of the class label of the nth sample, b nThe rectangular box of the job violation behavior output by the model, g m is the rectangular box of the true job violation behavior manually marked;

[0177] Iteratively construct adversarial image enhancement samples The goal is The construction method includes the following steps:

[0178] Initialization l * ←L(f target (x i ),O i ), i ← 1; where l * is the correct value for judging this job violation behavior. The lower the correct value, the more effective the adversarial image enhancement sample is proved to be.

[0179] When i < T and l * ≠ 0, execute the following steps:

[0180] For O i , the range of the adversarial noise in the image is the range where the target box b m is located. Therefore, the length and width of the noise are where, is the abscissa value of the farthest endpoint of the rectangular box from the origin of the coordinate axis, is the abscissa value of the nearest endpoint of the rectangular box from the origin of the coordinate axis, is the ordinate value of the farthest endpoint of the rectangular box from the origin of the coordinate axis, is the ordinate value of the nearest endpoint of the rectangular box from the origin of the coordinate axis;

[0181] Through sample from the distribution of the adversarial noise ∈ to construct the probability distribution of the noise δ;

[0182] Adjust the value of the noise δ to between 0 and 1, and project it into the range of the box b m , and then horizontally and vertically copy the noise δ;

[0183] Add the enhanced noise ∈ to x i to get

[0184] Judge by calculating ; compared with the previous round, if there is a decrease, save the result of this round for the next round of iteration. If there is no decrease, continue to use the l of the previous round * and where, O n is the target output by the target recognition model f target ;

[0185] For X validand X test All original samples x in the two sample sets i , constructed by the above method Will Add to the sample set, that is Get a dataset of adversarially enhanced sample images including enhanced privacy leaks and enhanced datasets without privacy leakage

[0186] The adversarial enhancement sample set is input into the power field operation shadow model, and the confidence heat map is formed in combination with the canvas method, specifically:

[0187] Datasets that will enhance privacy leakage and enhanced datasets without privacy leakage All images x in t and Input into the power field operation shadow model to obtain (O t ,s t )=f shadow (x t )and Among them, O t Process normal image x for the model t Output of the operation violation target, Processing adversarial augmented images for the model Output of the operation violation target, Processing adversarial augmented images for the model The confidence level of the outputted operation violation target, x t For a normal image, Enhance images for adversarial purposes;

[0188] The confidence level s in the recognition result t By s t-rescale = -log(1-s t ) is normalized, for f shadow (x t )and Output and complete each confidence normalization (O t ,s t-rescale ), frame b t Fill the range with brightness s t-rescale The matrix For the case where there are multiple frames in the same position, the brightness values ​​of the frames are superimposed in the overlapping area to form f shadow (x t ) confidence heat map d t ;

[0189] Among them, s t-rescaleis the confidence value of the normalized operation violation recognition result, is the horizontal coordinate of the end point of the rectangular box of the operation violation recognition result farthest from the origin of the coordinate axis, z x The horizontal axis range of the brightness filling matrix, is the horizontal coordinate of the endpoint of the rectangular box of the operation violation recognition result closest to the origin of the coordinate axis, is the ordinate of the farthest point of the rectangular box of the operation violation recognition result from the origin of the coordinate axis, z y Fill the vertical coordinate range of the matrix for brightness, It is the vertical coordinate of the endpoint of the rectangular box of the operation violation identification result closest to the origin of the coordinate axis.

[0190] The confidence heat map is annotated to form an attack model dataset, specifically:

[0191] For each pair of samples Form prediction bounding box distribution confidence heat map samples in, is the indicator function, if x t ∈X valid If true, the function value is 1, otherwise it is 0; t ,s t )and Converted into prediction bounding box distribution confidence heat map samples to form an attack model dataset

[0192] The obtaining of a sample set of power field operation images is specifically as follows:

[0193] Power field work image set for X image ={x i |i∈I}, I is the number of images in the dataset, x i is the i-th image in the dataset. There are M real-world violation behavior targets O in the power field operation image set. i ={o1,o2,...,o M}, each target o m By Box and the category of violation behavior y∈{1,2,...,Y}, where For frame b m The coordinates of the diagonal endpoint with the smallest value, For frame b m The coordinates of the diagonal endpoint with the largest value, Y is the number of target categories, that is, o m =(b m ,Y), mark each illegal operation behavior target in the image, and form the power field operation image sample set X = {(xi , O i )|i∈I}.

[0194] The privacy judgment module is used to input the prediction bounding box distribution confidence heat map into the member reasoning attack model, obtain the data privacy leakage results of the sample images of the operation violation recognition generalization test, and realize the privacy audit of the power field data set.

[0195] Example 3

[0196] See also Figure 4 As shown, the present invention also provides an electronic device 100 for a data privacy audit method for generalized testing of power operation violation identification; the electronic device 100 includes a memory 101, at least one processor 102, a computer program 103 stored in the memory 101 and executable on the at least one processor 102, and at least one communication bus 104.

[0197] The memory 101 can be used to store the computer program 103. The processor 102 implements the steps of the data privacy audit method for generalized testing of power operation violation identification described in Example 1 by running or executing the computer program stored in the memory 101 and calling the data stored in the memory 101. The memory 101 can mainly include a program storage area and a data storage area, wherein the program storage area can store an operating system, an application required for at least one function (such as a sound playback function, an image playback function, etc.), etc.; the data storage area can store data (such as audio data) created according to the use of the electronic device 100, etc. In addition, the memory 101 can include a non-volatile memory, such as a hard disk, a memory, a plug-in hard disk, a smart memory card (Smart Media Card, SMC), a secure digital (Secure Digital, SD) card, a flash card (Flash Card), at least one disk storage device, a flash memory device, or other non-volatile solid-state storage devices.

[0198] The at least one processor 102 may be a central processing unit (CPU), or other general-purpose processors, digital signal processors (DSP), application-specific integrated circuits (ASIC), field-programmable gate arrays (FPGA) or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, etc. The processor 102 may be a microprocessor or any conventional processor, etc. The processor 102 is the control center of the electronic device 100, and uses various interfaces and lines to connect various parts of the entire electronic device 100.

[0199] The memory 101 in the electronic device 100 stores a plurality of instructions to implement a data privacy audit method for generalized testing of electric power operation violation identification, and the processor 102 can execute the plurality of instructions to implement:

[0200] Obtaining a sample image for a generalization test of work violation recognition, and adding adversarial noise to the sample image for a generalization test of work violation recognition to form a noise sample image;

[0201] Obtain a power site operation target recognition model and a member reasoning attack model, input the operation violation recognition generalization test sample image and the noise sample image into the power site operation target recognition model, and form a prediction bounding box distribution confidence heat map;

[0202] The confidence heat map of the predicted bounding box distribution is input into the member reasoning attack model to obtain the data privacy leakage results of the sample images of the generalization test of operation violation recognition, and realize the privacy audit of the power field dataset.

[0203] Example 4

[0204] If the module / unit integrated in the electronic device 100 is implemented in the form of a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the present invention implements all or part of the process in the above-mentioned embodiment method, and can also be completed by instructing the relevant hardware through a computer program. The computer program can be stored in a computer-readable storage medium, and the computer program can implement the steps of the above-mentioned method embodiments when executed by the processor. Among them, the computer program includes computer program code, and the computer program code can be in source code form, object code form, executable file or some intermediate form. The computer-readable medium may include: any entity or device that can carry the computer program code, recording medium, U disk, mobile hard disk, disk, optical disk, computer memory and read-only memory (ROM, Read-Only Memory).

[0205] Those skilled in the art will appreciate that embodiments of the present invention may be provided as methods, systems, or computer program products. Therefore, the present invention may take the form of a complete hardware embodiment, a complete software embodiment, or an embodiment combining software and hardware. Moreover, the present invention may take the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0206] The present invention is described with reference to flowcharts and / or block diagrams of methods, devices (systems), and computer program products according to embodiments of the present invention. It should be understood that each process and / or block in the flowchart and / or block diagram, as well as the combination of processes and / or blocks in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing device to produce a machine, so that the instructions executed by the processor of the computer or other programmable data processing device generate instructions for implementing the processes in the flowchart and / or block diagram. Figure 1 A process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.

[0207] These computer program instructions may also be stored in a computer-readable memory capable of directing a computer or other programmable data processing device to operate in a specific manner, so that the instructions stored in the computer-readable memory produce an article of manufacture comprising an instruction device, which implements the process Figure 1 A process or multiple processes and / or boxes Figure 1 A function specified in one or more boxes.

[0208] These computer program instructions can also be loaded onto a computer or other programmable data processing device so that a series of operating steps are executed on the computer or other programmable device to produce a computer-implemented process, thereby providing instructions for implementing the process. Figure 1 A process or multiple processes and / or boxes Figure 1 The steps for the functions specified in one or more boxes.

[0209] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention rather than to limit it. Although the present invention has been described in detail with reference to the above embodiments, ordinary technicians in the relevant field should understand that the specific implementation methods of the present invention can still be modified or replaced by equivalents. Any modification or equivalent replacement that does not depart from the spirit and scope of the present invention should be covered within the scope of protection of the claims of the present invention.

Claims

1. A data privacy audit method for generalized testing of power operation violation identification, characterized by: include: Obtaining a sample image for a generalization test of work violation recognition, and adding adversarial noise to the sample image for a generalization test of work violation recognition to form a noise sample image; Obtain a power site operation target recognition model and a member reasoning attack model, input the operation violation recognition generalization test sample image and the noise sample image into the power site operation target recognition model, and form a prediction bounding box distribution confidence heat map; The confidence heat map of the predicted bounding box distribution is input into the member reasoning attack model to obtain the data privacy leakage results of the sample images of the generalization test of operation violation recognition, and realize the privacy audit of the power field dataset.

2. According to claim 1, the data privacy audit method for generalized testing of power operation violation identification is characterized in that: The acquisition of the power field operation target recognition model is specifically as follows: Get the power field operation image sample set X = {(x i , O i )|i∈I}, the first training set X is obtained based on the power field operation image sample set train1 , the second training set X train2 , privacy-leaked dataset X valid and the dataset X that has not been leaked test ; where x i is the i-th image in the dataset, O i There are M real-life violation targets in the power field operation image set, and I is the number of images in the dataset; Take the first training set X train1 and privacy-leaked dataset X valid For the target recognition model f target Train the target recognition model f target A total of N violation behavior recognition targets are output, and the target recognition model f target The output box is g n , target recognition model f target The output type is f Y is the probability distribution of the top-1 categories, so the target recognition model f target The output target is O n =(g n , f Y ), target recognition model f target Output the confidence s of the target n , that is (O n ,s n ) = f target (x n ), and obtain the target recognition model for power field operations.

3. The data privacy audit method for generalized testing of power operation violation identification according to claim 1 is characterized in that: The member reasoning attack model is specifically: Get the power field operation image sample set X = {(x i , O i )|i∈I}, the first training set X is obtained based on the power field operation image sample set train1 , the second training set X train2 , privacy-leaked dataset X valid and the dataset X that has not been leaked test ; where x i is the i-th image in the dataset, O i There are M real-life violation targets in the power field operation image set, and I is the number of images in the dataset; Take the second training set X train2 and privacy-leaked dataset X valid For the shadow model f shadow Train the shadow model f shadow Ability to identify violations of power site operations (O n ,s n ) = f shadow (x n ), obtain the shadow model of power field operation; For privacy-leaked dataset X valid and the dataset X that has not been leaked test Perform sample enhancement to obtain adversarial enhancement sample images, input the adversarial enhancement sample set into the power field operation shadow model, and combine the canvas method to form a confidence heat map; The confidence heat map is annotated to form an attack model dataset, and the attack model is trained using the attack model dataset to obtain a member reasoning attack model.

4. The data privacy audit method for generalized testing of electric power operation violation identification according to claim 3 is characterized in that: The privacy-leaked dataset X valid and the dataset X that has not been leaked test Perform sample enhancement to obtain adversarial enhancement sample images, specifically: Assume that image x i is a square with a side length of w pixels, the color channel of the image is C, the l2 radius of the anti-noise is Φ, the maximum number of algorithm iterations is T, for each image x i The objective function value is calculated as follows: Among them, 1 is an exponential function. If 1 a =1, condition a is true, otherwise the exponential function value is 0; the value of ζ is 0.5, and the value of λ is set to 0.5*IOU(b n ,g m ), f Y is the target recognition model f target Probability distribution of the top-1 categories of the output, n y is the category label y of the nth sample, is the probability of the class label of the nth sample, b n is the rectangular box of the operation violation behavior output by the model, g m It is a manually labeled rectangle frame of real work violation behavior; Iteratively construct adversarial image enhancement samples The goal is The construction method includes the following steps: initialization l * ←L(f target (x i ),O i ), i←1; where l * Determine the correct value for the violation behavior of the operation; When i < T and l * ≠ 0, perform the following steps: For O i , the range of the adversarial noise in the image is the target box b m The range of the noise is, therefore, the length and width are in, is the horizontal coordinate value of the point farthest from the origin of the coordinate axis of the rectangular box. is the horizontal coordinate value of the endpoint of the rectangular box closest to the origin of the coordinate axis, is the ordinate value of the point farthest from the origin of the coordinate axis of the rectangle. The ordinate value of the endpoint of the rectangular box closest to the origin of the coordinate axis; pass Sampling from the distribution of adversarial noise δ, constructing a probability distribution of noise δ; Adjust the value of noise δ to between 0 and 1 and project it into box b m Within the range, the noise δ is then replicated horizontally and vertically; The enhanced noise δ and x i Add together to get By calculation Judgement * Compared with the previous round, if there is a decrease, save the result of this round for the next round of iteration. If there is no decrease, continue to use the previous round of l * and Among them, O n is the target recognition model f target Output target; X valid and X test All original samples x in the two sample sets i , constructed by the above method Will Add to the sample set, that is Get a dataset of adversarially enhanced sample images including enhanced privacy leaks and enhanced datasets without privacy leakage 5. The data privacy audit method for generalized testing of electric power operation violation identification according to claim 3 is characterized in that: The adversarial enhancement sample set is input into the power field operation shadow model, and the confidence heat map is formed in combination with the canvas method, specifically: Datasets that will enhance privacy leakage and enhanced datasets without privacy leakage All images x in t and Input into the power field operation shadow model to obtain (O t ,s t ) = f shadow (x t )and Among them, O t Process normal image x for the model t Output of the operation violation target, Processing adversarial augmented images for the model Output of the operation violation target, Processing adversarial augmented images for the model The confidence level of the outputted operation violation target, x t For a normal image, Enhance images for adversarial purposes; The confidence level s in the recognition result t By s t-rescale = -log(1-s t ) is normalized, for f shadow (x t )and Output and complete each confidence normalization (O t ,s t-rescale ), frame b t Fill the range with brightness s t-rescale The matrix For the case where there are multiple frames in the same position, the brightness values ​​of the frames are superimposed in the overlapping area to form f shadow (x t ) confidence heat map d t ; Among them, s t-rescale is the confidence value of the normalized operation violation recognition result, is the horizontal coordinate of the end point of the rectangular box of the operation violation recognition result farthest from the origin of the coordinate axis, z x The horizontal axis range of the brightness filling matrix, is the horizontal coordinate of the endpoint of the rectangular box of the operation violation recognition result closest to the origin of the coordinate axis, is the ordinate of the farthest point of the rectangular box of the operation violation recognition result from the origin of the coordinate axis, z y The vertical coordinate range of the brightness filling matrix, It is the vertical coordinate of the endpoint of the rectangular box of the operation violation identification result closest to the origin of the coordinate axis.

6. The data privacy audit method for generalized testing of electric power operation violation identification according to claim 3 is characterized in that: The confidence heat map is annotated to form an attack model dataset, specifically: For each pair of samples Form prediction bounding box distribution confidence heat map samples in, is the indicator function, if x t ∈X valid If true, the function value is 1, otherwise it is 0; t ,s t )and Converted into prediction bounding box distribution confidence heat map samples to form an attack model dataset 7. The data privacy audit method for generalized testing of power operation violation identification according to claim 2 or 3 is characterized in that: The obtaining of a sample set of power field operation images is specifically as follows: Power field work image set for X image ={x i |i∈I}, I is the number of images in the dataset, x i is the i-th image in the dataset. There are M real-world violation behavior targets O in the power field operation image set. i ={o1,o2,...,o M }, each target o m By box and the category of violation behavior y∈{1,2,...,Y}, where For frame b m The coordinates of the diagonal endpoint with the smallest value, For frame b m The coordinates of the diagonal endpoint with the largest value, Y is the number of target categories, that is, o m =(b m ,Y), mark each illegal operation behavior target in the image, and form the power field operation image sample set X = {(x i , O i )|i∈I}.

8. A data privacy audit system for generalized testing of power operation violation identification, characterized by: include: An image acquisition module, wherein the image acquisition module is used to acquire a sample image of a generalization test of operation violation recognition, and add adversarial noise to the sample image of the generalization test of operation violation recognition to form a noise sample image; An image processing module, wherein the image processing module is used to obtain a power site operation target recognition model and a member reasoning attack model, input a generalization test sample image of operation violation recognition and a noise sample image into the power site operation target recognition model, and form a prediction bounding box distribution confidence heat map; The privacy judgment module is used to input the prediction bounding box distribution confidence heat map into the member reasoning attack model, obtain the data privacy leakage results of the sample images of the operation violation recognition generalization test, and realize the privacy audit of the power field data set.

9. The data privacy audit system for generalized testing of electric power operation violation identification according to claim 8 is characterized in that: The acquisition of the power field operation target recognition model is specifically as follows: Get the power field operation image sample set X = {(x i , O i )|i∈I}, the first training set X is obtained based on the power field operation image sample set train1 , the second training set X train2 , privacy-leaked dataset X valid and the dataset X that has not been leaked test ; where x i is the i-th image in the dataset, O i There are M real-life violation targets in the power field operation image set, and I is the number of images in the dataset; Take the first training set X train1 and privacy-leaked dataset X valid For the target recognition model f target Train the target recognition model f target A total of N violation behavior recognition targets are output, and the target recognition model f target The output box is g n , target recognition model f target The output type is f Y is the probability distribution of the top-1 categories, so the target recognition model f target The output target is O n =(g n , f Y ), target recognition model f target Output the confidence s of the target n , that is (O n ,s n ) = f target (x n ), and obtain the target recognition model for power field operations.

10. The data privacy audit system for generalized testing of electric power operation violation identification according to claim 8 is characterized in that: The member reasoning attack model is specifically: Get the power field operation image sample set X = {(x i , O i )|i∈I}, the first training set X is obtained based on the power field operation image sample set train1 , the second training set X train2 , privacy-leaked dataset X valid and the dataset X that has not been leaked test ; where x i is the i-th image in the dataset, O i There are M real-life violation targets in the power field operation image set, and I is the number of images in the dataset; Take the second training set X train2 and privacy-leaked dataset X valid For the shadow model f shadow Train the shadow model f shadow Ability to identify violations of power site operations (O n ,s n ) = f shadow (x n ), obtain the shadow model of power field operation; For privacy-leaked dataset X valid and the dataset X that has not been leaked test Perform sample enhancement to obtain adversarial enhancement sample images, input the adversarial enhancement sample set into the power field operation shadow model, and combine the canvas method to form a confidence heat map; The confidence heat map is annotated to form an attack model dataset, and the attack model is trained using the attack model dataset to obtain a member reasoning attack model.

11. The data privacy audit system for generalized testing of electric power operation violation identification according to claim 10 is characterized in that: The privacy-leaked dataset X valid and the dataset X that has not been leaked test Perform sample enhancement to obtain adversarial enhancement sample images, specifically: Assume that image x i is a square with a side length of w pixels, the color channel of the image is C, the l2 radius of the anti-noise is Φ, the maximum number of algorithm iterations is T, for each image x i The objective function value is calculated as follows: Among them, 1 is an exponential function. If 1 a =1, condition a is true, otherwise the exponential function value is 0; the value of ζ is 0.5, and the value of λ is set to 0.5*IOU(b n ,g m ), f Y is the target recognition model f target Probability distribution of the top-1 categories of the output, n y is the category label y of the nth sample, is the probability of the class label of the nth sample, b n is the rectangular box of the operation violation behavior output by the model, g m It is a manually labeled rectangle frame of real work violation behavior; Iteratively construct adversarial image enhancement samples The goal is The construction method includes the following steps: initialization l * ←L(f target (x i ),O i ), i←1; where l * Determine the correct value for the violation behavior of the operation; When i < T and l * ≠ 0, perform the following steps: For O i , the range of the adversarial noise in the image is the target box b m The range of the noise is, therefore, the length and width are is the horizontal coordinate value of the point farthest from the origin of the coordinate axis of the rectangular box. is the horizontal coordinate value of the endpoint of the rectangular box closest to the origin of the coordinate axis, is the ordinate value of the point farthest from the origin of the coordinate axis of the rectangle. The ordinate value of the endpoint of the rectangular box closest to the origin of the coordinate axis; pass Sampling from the distribution of adversarial noise δ, constructing a probability distribution of noise δ; Adjust the value of noise δ to between 0 and 1 and project it into box b m Within the range, the noise δ is then replicated horizontally and vertically; The enhanced noise δ and x i Add together to get By calculation Judgement * Compared with the previous round, if there is a decrease, save the result of this round for the next round of iteration. If there is no decrease, continue to use the previous round of l * and Among them, O n is the target recognition model f target Output target; X valid and X test All original samples x in the two sample sets i , constructed by the above method Will Add to the sample set, that is Get a dataset of adversarially enhanced sample images including enhanced privacy leaks and enhanced datasets without privacy leakage 12. The data privacy audit system for generalized testing of electric power operation violation identification according to claim 10 is characterized in that: The adversarial enhancement sample set is input into the power field operation shadow model, and the confidence heat map is formed in combination with the canvas method, specifically: Datasets that will enhance privacy leakage and enhanced datasets without privacy leakage All images x in t and Input into the power field operation shadow model to obtain (O t ,s t ) = f shadow (x t )and Among them, O t Process normal image x for the model t Output of the operation violation target, Processing adversarial augmented images for the model Output of the operation violation target, Processing adversarial augmented images for the model The confidence level of the outputted operation violation target, x t For a normal image, Enhance images for adversarial purposes; The confidence level s in the recognition result t By s t-rescale = -log(1-s t ) is normalized, for f shadow (x t )and Output and complete each confidence normalization (O t ,s t-rescale ), frame b t Fill the range with brightness s t-rescale The matrix For the case where there are multiple frames in the same position, the brightness values ​​of the frames are superimposed in the overlapping area to form f shadow (x t ) confidence heat map d t ; Among them, s t-rescale is the confidence value of the normalized operation violation recognition result, is the horizontal coordinate of the end point of the rectangular box of the operation violation recognition result farthest from the origin of the coordinate axis, z x The horizontal axis range of the brightness filling matrix, is the horizontal coordinate of the endpoint of the rectangular box of the operation violation recognition result closest to the origin of the coordinate axis, is the ordinate of the farthest point of the rectangular box of the operation violation recognition result from the origin of the coordinate axis, z y The vertical coordinate range of the brightness filling matrix, It is the vertical coordinate of the endpoint of the rectangular box of the operation violation identification result closest to the origin of the coordinate axis.

13. The data privacy audit system for generalized testing of electric power operation violation identification according to claim 10 is characterized in that: The confidence heat map is annotated to form an attack model dataset, specifically: For each pair of samples Form prediction bounding box distribution confidence heat map samples in, is the indicator function, if x t ∈X valid If true, the function value is 1, otherwise it is 0; t ,s t )and Converted into prediction bounding box distribution confidence heat map samples to form an attack model dataset 14. A terminal device, comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, characterized in that: When the processor executes the computer program, the steps of the data privacy audit method for generalized testing of power operation violation identification as described in any one of claims 1 to 7 are implemented.

15. A computer-readable storage medium storing a computer program, characterized in that: When the computer program is executed by a processor, the steps of the data privacy audit method for generalized testing of power operation violation identification as described in any one of claims 1 to 7 are implemented.

Images