Member reasoning attack defense method based on global loss constraint

Abstract

The invention designs a member reasoning attack defense method based on global loss constraint. According to the method, in order to further reduce the difference between members and non-members on model output, an indicator function is used for further adjusting the model output. The prediction finally output by the neural network has a certain difference (namely loss) with the original label, a threshold value is set for the loss, and when the loss is greater than the threshold value, the loss is used as a penalty term to be added into a total loss function to perform model updating, namely a normal gradient descent process is performed. Otherwise, the negative value of the loss serves as a penalty term to be added into the loss function, and gradient rise to a certain degree is carried out. Through the global loss constraint, the difference between members and non-members in model output can be reduced, the accuracy of member reasoning attack is further reduced, and privacy leakage is effectively reduced.

Description

Technical Field

[0001] The present invention relates to the fields of machine learning and cryptography, and more specifically to a method for defending against membership inference attacks based on global loss constraints in machine learning, which effectively reduces privacy leakage in the process of machine learning. Background Art

[0002] Machine learning has been widely used in image processing, speech recognition, and natural language processing. The training of machine learning models relies on a large amount of data, which is usually personal sensitive data. If leaked, it will bring certain privacy threats. Membership inference attacks can infer whether data participates in model training by analyzing model output. Once the attacker determines that a certain data participates in model training, it can violate the privacy of the data owner. It is particularly important to defend against membership inference attacks. Summary of the invention

[0003] The present invention designs a member reasoning attack defense method based on global loss constraints. The method adds a global loss constraint to the output layer of the model to further reduce the difference between members and non-members in the output, and reduce the accuracy of member reasoning attacks. There is a certain difference (i.e., loss) between the prediction of the final output of the neural network and the original label. We set a threshold for the loss. When the loss is greater than the threshold, the loss is added as a penalty term to the total loss function to update the model, that is, a normal gradient descent process is performed. Conversely, we add the negative value of the loss as a penalty term to the loss function and perform a certain degree of gradient ascent. Through this global loss constraint, the difference between members and non-members in the model output can be reduced, further reducing the accuracy of member reasoning attacks. In addition, this operation does not require an additional adversarial model or complex random perturbations, and is a lightweight processing method.

[0004] The present invention adjusts the model output through an indicator function, and compares the difference (loss) between the predicted result and the original label with a set threshold. When the loss is greater than the threshold, it is added as a penalty term to the total loss function, and gradient descent is performed to update the model; when the loss is less than or equal to the threshold, its negative value is added as a penalty term to the loss function, and gradient ascent is performed to adjust the model. This reduces the overfitting of the model to the training samples, reduces the output difference of the model on the training data and non-training data, and improves the defense capability against member reasoning attacks.

[0005] The member reasoning attack defense method designed in this paper has made some progress in privacy protection and utility balance. We have effectively improved the defense performance through fine-grained global loss constraints while avoiding some limitations of existing methods.

[0006] A membership inference attack defense method based on global loss constraint includes two parts: (1) threshold-based global loss constraint calculation and loss function design based on global loss constraint. (1) Threshold-based global loss constraint calculation In the neural network, the output of the convolution layer is the feature matrix. Adding a global loss constraint to the output layer of the model further reduces the difference between members and non-members in the output and reduces the accuracy of member reasoning attacks. The model output is adjusted through the indicator function, and the difference (loss) between the predicted result and the original label is compared with the set threshold. When the loss is greater than the threshold, it is added as a penalty term to the total loss function, and gradient descent is performed to update the model; when the loss is less than or equal to the threshold, its negative value is added as a penalty term to the loss function, and gradient ascent is performed to adjust the model. (2) Loss function design based on global loss constraints The threshold-based global loss constraint method uses a threshold control strategy to reduce the overfitting of the model to the training samples, making the output difference between the model on the training data and the non-training data smaller. The present invention constructs the final total loss function through weighted combination, so that the model can more effectively balance the impact of the loss term during the training process.

[0007] The effectiveness of the member reasoning attack defense method based on global loss constraints is verified on CIFAR10 and MNIST-FASHION datasets. The results show that the method can reduce the member reasoning accuracy to about 50% while maintaining the classification accuracy of the target model. At the same time, we compared the method of the present invention with other defense methods. The experimental results show that the method of the present invention is superior to other defense methods in terms of defense performance and overhead. BRIEF DESCRIPTION OF THE DRAWINGS Figure 1 The impact of the present invention on the accuracy of member reasoning attacks in different rounds; Figure 2 The impact of the global loss-constrained defense method and other defense methods on the accuracy of member inference attacks. DETAILED DESCRIPTION

[0008] A member reasoning attack defense method based on global loss constraints, characterized by: (1) Threshold-based global loss constraint calculation (1.1) Cross entropy loss of the model is defined as: (1) Among them, the batch size is N, the total number of categories is C, The true label, is the predicted label. (1.2) In order to implement global loss constraints in the output layer of the model, an indicator function I is introduced to measure the global loss. The indicator function I is defined as: when p is true, I[p]=1; otherwise it is -1. (1.3) Global loss The definition is as follows: (2) In the indicator function In, if , the output is 1, otherwise the output is -1. When the loss value of the model is higher than the preset threshold When , the model performs normal gradient descent to minimize the loss; otherwise, the loss is appropriately increased along the direction of the gradient. (2) Loss function design based on global loss constraints The total loss of the model is defined as follows: (3) Among them: α is the weight coefficient of the loss term, balancing the contribution ratio of the loss term to the final total loss. Validity Verification

[0009] The validity verification experiment of the present invention is as follows: (1) Experimental setup The present invention selects the standard dataset MNIST-FASHION which is widely used in the field of membership inference attack. The method of the present invention is implemented in pytorch and runs on a Windows PC with 32G RAM, Intel(R) Core(TM) i5-9300H CPU @ 2.40GHz and NVIDIA GeForce GTX 1650; (2) Experimental results and analysis Combination Figure 1 and Figure 2 It can be seen that with the increase of training rounds on both data sets, the classification accuracy continues to improve, while the member reasoning accuracy gradually decreases and approaches the random guessing level (about 50%). Moreover, the member reasoning accuracy on the MNIST-FASHION data set decreases very quickly, and is close to the random guessing level at 30 rounds. This difference reflects that LC-MID performs more efficiently on simple data sets, while complex data sets require longer training to show results. Whether it is a shadow model attack or a threshold attack, the present invention makes the accuracy of the member reasoning attack close to 50%, further proving that the method of the present invention can effectively resist different member reasoning attacks while maintaining the stability of the model utility.

Claims

1. A member reasoning attack defense method based on global loss constraints, characterized by: (1) Threshold-based global loss constraint calculation (1.1) Cross entropy loss of the model is defined as: （1） in, The batch size is N, the total number of categories is C, The true label, is the predicted label; (1.2) In order to implement global loss constraints in the output layer of the model, an indicator function I is introduced to measure the global loss; The indicator function I is defined as: when p is true, I[p]=1; otherwise, it is -1; (1.3) Global loss The definition is as follows: (2) In the indicator function In, if , the output is 1, otherwise the output is -1; when the loss value of the model is higher than the preset threshold When , the model performs normal gradient descent to minimize the loss; otherwise, the loss is appropriately increased along the direction of the gradient; (2) Loss function design based on global loss constraints The total loss function of the model is defined as follows: (3) Among them: α is the weight coefficient of the loss term, balancing the contribution ratio of the loss term to the final total loss.

Images