A model inversion defense method and device based on compression fine-tuning and a medium

Abstract

The application discloses a model inversion defense method and device based on compression fine-tuning and a medium, belongs to the technical field of model inversion defense, and is used for solving the technical problems that current model inversion defense has great influence on main task performance, high training cost and is difficult to resist advanced model inversion attacks. The method comprises the following steps: pre-training a to-be-trained model through a public data set to obtain a pre-trained model and corresponding first model weight parameters; constructing an external compression network for each network layer of the pre-trained model; wherein the network layer comprises a linear layer and / or a convolutional layer; performing parameter fine-tuning on the external compression network through a private data set to obtain second model weight parameters; mixing the first model weight parameters and the second model weight parameters corresponding to each network layer to obtain mixed model weight parameters, and applying the mixed model weight parameters to the pre-trained model to obtain an optimized model.

Description

Technical Field

[0001] This invention relates to the field of model inversion defense, and in particular to a model inversion defense method, device and medium based on compression fine-tuning. Background Technology

[0002] In recent years, deep learning technology has developed rapidly and has been widely applied in production and daily life. However, deep neural network models often require the use of large amounts of private data during application, making them vulnerable to privacy breach attacks. Even if the dataset used for training itself is not leaked, attackers can still use various privacy attack algorithms, such as membership inference attacks, attribute inference attacks, and model inversion attacks, to steal the private information used for model training by accessing the model. Among these, a major threat to privacy is model inversion attacks, which allow attackers to reconstruct the private data used to train the model using the output information of the artificial intelligence model during the inference phase.

[0003] The most prevalent model inversion attack method currently is generative model inversion attack. Attackers train an image generator using a public dataset with a distribution similar to the privacy data to capture structural features related to the privacy data. During the attack, the attacker first samples latent vectors in the generator's input space and generates corresponding images. These images are then used to access the model, obtaining its output and a classification loss. Simultaneously, the attacker adds their own prior knowledge of the privacy data to obtain a prior loss. These two losses jointly guide the optimization of the input latent vectors, ultimately resulting in the optimized latent vectors producing images with a large number of similar features to the privacy images.

[0004] Recent model inversion attacks have primarily optimized this framework, achieving extremely high success rates and posing a significant threat to privacy data. To defend against these privacy threats, several model inversion defense schemes have been proposed in recent years. However, current model inversion defense algorithms require significant compromises in the model's performance on the primary task and are no longer sufficient to defend against advanced model inversion attack algorithms. Existing model inversion defense research has three main shortcomings in resisting model inversion attacks:

[0005] (1) Significant compromises are required on the model's performance on the main task: In order to achieve better model inversion defense, existing defense methods will reduce the model's accuracy on the main task, affecting usability. For example, methods based on reducing mutual information and bilateral optimization will penalize the information carried in the model output, which conflicts with the model's main task and will reduce the model's accuracy on the main task. Based on the introduction of gradient vanishing, the training process itself will also suffer from the gradient vanishing problem, affecting the training of the model itself.

[0006] (2) Increased training cost: Most existing defense algorithms use the method of adding regularization loss to defend, which will increase the time complexity of model computation.

[0007] (3) Difficult to defend against the most advanced model inversion attack algorithms: At present, model inversion attack technology has been continuously improved and perfected, and the current defense algorithms are difficult to achieve good defense results.

[0008] In summary, current model inversion defenses suffer from significant impacts on primary task performance and high training costs, and are no longer sufficient to defend against advanced model inversion attacks. Therefore, a lightweight defense strategy is urgently needed to achieve good defensive results without excessively affecting model performance. Summary of the Invention

[0009] This invention provides a model inversion defense method, device, and medium based on compression fine-tuning to solve the following technical problems: current model inversion defenses have problems such as significant impact on the performance of the main task and high training costs, and are no longer able to resist advanced model inversion attacks.

[0010] The embodiments of the present invention adopt the following technical solutions:

[0011] On one hand, embodiments of the present invention provide a model inversion defense method based on compression fine-tuning, the method comprising: pre-training a model to be trained using a public dataset to obtain a pre-trained model and corresponding first model weight parameters;

[0012] An external compressed network is constructed for each network layer of the pre-trained model; wherein the network layer includes linear layers and / or convolutional layers;

[0013] By using a privacy dataset, the parameters of the external compressed network are fine-tuned to obtain the weight parameters of the second model;

[0014] The first model weight parameters and the second model weight parameters corresponding to each network layer are mixed to obtain mixed model weight parameters, which are then applied to the pre-trained model to obtain the optimized model.

[0015] In one feasible implementation, the model to be trained is pre-trained using a public dataset to obtain a pre-trained model and corresponding first model weight parameters, specifically including:

[0016] Obtain the public dataset required by the model to be trained from the network, and perform adaptive preprocessing on the public dataset to make it meet the training requirements of the model to be trained.

[0017] The model to be trained is pre-trained using the pre-processed public dataset to obtain a pre-trained model;

[0018] Obtain the weight parameters of each network layer in the pre-trained model to form the first model weight parameters; wherein, the weight parameters encode public information related to the public dataset.

[0019] In one feasible implementation, an external compressed network is constructed for each network layer of the pre-trained model, specifically including:

[0020] A compression layer and a restoration layer are introduced into the bypass of each network layer of the pre-trained model to form the external compression network; wherein the output of the compression layer is connected to the output of the restoration layer.

[0021] In one feasible implementation, the external compressed network is fine-tuned using a privacy dataset to obtain the second model weight parameters, specifically including:

[0022] While keeping the first model weight parameters of the network layers in the pre-trained model unchanged, the external compressed network is trained using a privacy dataset;

[0023] During training, the input features are compressed and reduced in dimensionality by the compression layer before model parameter training is performed. The restored layer restores the trained parameter dimensions to the original output dimensions of the network layer to obtain the second model weight parameters. The number of parameters in the second model weight parameters is much smaller than the number of parameters in the first model weight parameters.

[0024] In one feasible implementation, the input features are compressed and reduced in dimensionality using the compression layer, and the compressed dimensions are restored to their initial dimensions using the restoration layer, in order to fine-tune the parameters of the external compression network. Specifically, this includes:

[0025] If the current network layer is a linear layer, then let the input dimension of the linear layer be... The output dimension is The linear layer weights of the pre-trained model can be obtained as follows: ,Include One weight parameter;

[0026] By using a compression layer in a compressed network connected to a linear layer, the input features during training are transformed from... Dimensional compression to r Dimension, the weights of the compression layer can be obtained as follows ,Include There are several weight parameters; among them, r much smaller and ;

[0027] The output features of the compressed layer are restored from r-dimensional to r-dimensional using the restoration layer. Dimension, the weights of the restoration layer can be obtained as follows ,Include One weight parameter;

[0028] The final fine-tuned linear layer external compression network has a total of The weight parameters are much smaller than those of the original linear layer. Each weight parameter.

[0029] In one feasible implementation, the input features are compressed and reduced in dimensionality using the compression layer, and the compressed dimensions are restored to their initial dimensions using the restoration layer, in order to fine-tune the parameters of the external compression network. Specifically, this also includes:

[0030] If the current network layer is a convolutional layer, then let the number of input channels of the convolutional layer in the pre-trained model be... The number of output channels is The kernel size is The convolutional layer weights of the pre-trained model can be obtained as follows: ,Include One weight parameter;

[0031] By connecting a compression layer in a compression network to the convolutional layer, the number of input channels during training is reduced from... Compress to t The weights of the compression layer can be obtained as follows: ,Include There are several weight parameters; among them, t much smaller and ;

[0032] The number of output channels of the compression layer is increased by the recovery layer. t Restore to The weights of the restoration layer can be obtained as follows: ,Include One weight parameter;

[0033] The final fine-tuned convolutional layer external compression network has a total of The weight parameters are much smaller than those of the original convolutional layer. Each weight parameter.

[0034] In one feasible implementation, the first model weight parameters and the second model weight parameters of each network layer are mixed to obtain mixed model weight parameters, specifically including:

[0035] In the case that the network layer is a linear layer, according to The weight parameters of the first model and the weight parameters of the second model in the linear layer are mixed to obtain the weight parameters of the mixed model. ;

[0036] in, These are the first model weight parameters for the linear layer. The weights of the restoration layer are the weight parameters in the second model. These are the weights of the compressed layer in the weight parameters of the second model.

[0037] In one feasible implementation, the first model weight parameters and the second model weight parameters of each network layer are mixed to obtain mixed model weight parameters, specifically including:

[0038] In the case that the network layer is a convolutional layer, according to The weight parameters of the first model and the weight parameters of the second model in the convolutional layer are mixed to obtain the mixed model weight parameters. ;

[0039] Wherein, the kernel size of the convolutional layer is , ; These are the first model weight parameters of the convolutional layer. The weights of the restoration layer are the weight parameters in the second model. These are the weights of the compressed layer in the weight parameters of the second model.

[0040] On the other hand, embodiments of the present invention also provide a model inversion defense device based on compression fine-tuning, the device comprising: at least one processor; and a memory communicatively connected to the at least one processor; wherein the memory stores instructions executable by the at least one processor to enable the at least one processor to execute the model inversion defense method based on compression fine-tuning.

[0041] Finally, this embodiment of the invention also provides a storage medium, which is a non-volatile computer-readable storage medium storing at least one program, each program including instructions, which, when executed by a terminal, cause the terminal to execute the aforementioned model inversion defense method based on compression fine-tuning.

[0042] Compared with the prior art, the model inversion defense method, device and medium based on compression fine-tuning provided by the embodiments of the present invention have the following beneficial effects:

[0043] This invention employs lightweight compression fine-tuning operations for model inversion defense. By pre-training the model on a large-scale public dataset and introducing an external compression network, only a small number of parameters after dimensionality compression are fine-tuned using private data. This obfuscates a small amount of private information with a large amount of public information, preventing attackers from stealing the private data used for training and thus protecting the security of the private data.

[0044] In this invention, the model compresses the input features of privacy data to a lower dimension. This means the model can only capture a small number of features that are crucial to the main task, while discarding the rest of redundant information, thereby reducing the model information that attackers can obtain. As the above analysis shows, the number of parameters fine-tuned using privacy data is far less than the number of parameters in the original model. This results in a smaller proportion of privacy data encoded in the model parameters, implicitly embedded in a large number of parameters encoding public data, thus reducing the risk of privacy leakage. Furthermore, the number of parameters in the model after merging the two parts is the same as the number of parameters in the original model; therefore, this invention does not introduce additional model inference overhead.

[0045] The technical solution provided by this invention can be applied to privacy protection in various identification systems, such as face recognition, voice recognition, and palmprint recognition. Attackers using model inversion attacks can reconstruct an individual's face, voice, palmprint, and other private information by continuously accessing the model, posing a significant privacy and security risk. Applying the model inversion defense technology of this invention can effectively reduce this risk of privacy leakage, improve the security of privacy data, and has high practical value. Attached Figure Description

[0046] To more clearly illustrate the technical solutions in the embodiments of the present invention or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments recorded in the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort. In the drawings:

[0047] Figure 1 A flowchart of a model inversion defense method based on compression fine-tuning provided in an embodiment of the present invention;

[0048] Figure 2 A schematic diagram of a model inversion defense architecture based on compression fine-tuning provided for an embodiment of the present invention;

[0049] Figure 3 This is a schematic diagram of the structure of an external compression network provided in an embodiment of the present invention;

[0050] Figure 4 This is a schematic diagram of a model inversion defense device based on compression fine-tuning, provided as an embodiment of the present invention. Detailed Implementation

[0051] To enable those skilled in the art to better understand the technical solutions of this invention, the technical solutions of the embodiments of this invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of this invention, and not all embodiments. Based on the embodiments of this specification, all other embodiments obtained by those skilled in the art without creative effort should fall within the scope of protection of this invention.

[0052] This invention provides a model inversion defense method based on compression fine-tuning, such as... Figure 1 As shown, the model inversion defense method based on compression fine-tuning specifically includes steps S101-S104:

[0053] S101. Using a public dataset, pre-train the model to be trained to obtain the pre-trained model and the corresponding first model weight parameters.

[0054] Specifically, the first step is to obtain the public dataset required by the model to be trained from the internet, and then perform adaptive preprocessing on the public dataset to make it meet the training requirements of the model to be trained.

[0055] Furthermore, the entire model training process is divided into three stages. Figure 2 A schematic diagram of a model inversion defense architecture based on compression fine-tuning is provided as an embodiment of the present invention, such as... Figure 2 As shown, the first stage process is as follows: using the preprocessed public dataset, the model to be trained is pre-trained to obtain a pre-trained model. Then, the weight parameters of each network layer in the pre-trained model are obtained to form the first model weight parameters.

[0056] During model training, the data used to train the model is implicitly embedded into the model's parameters. Attackers in model inversion attacks exploit this characteristic to reconstruct the training data. Therefore, to defend against model inversion attacks, this invention aims to reduce the number of parameters encoding privacy-related data in the model. To ensure the model still achieves high performance, this invention first uses a large-scale public dataset for pre-training, giving the model good feature extraction capabilities. Furthermore, because a public dataset is used for training, the pre-trained model parameters encode publicly available information. Attackers can only extract information from publicly available data, preventing any threat to the security of privacy-related data.

[0057] S102. Construct an external compressed network for each network layer of the pre-trained model; wherein the network layer includes linear layers and / or convolutional layers.

[0058] Specifically, a compression layer and a restoration layer are introduced into the bypass of each network layer of the pre-trained model to form an external compression network.

[0059] As a feasible implementation method, Figure 3 This is a schematic diagram of an external compression network provided in an embodiment of the present invention, as shown below. Figure 3 As shown, fine-tuning is performed on each linear layer and / or convolutional layer using extrinsic components. During fine-tuning, the weights from the first-stage pre-training remain unchanged. A compression layer and a restoration layer are introduced as bypasses to the linear or convolutional layers, with the output of the compression layer connected to the output of the restoration layer. The compression layer reduces the input features to a smaller dimension, and the restoration layer restores the compressed dimension to the desired output dimension. In the second-stage fine-tuning using privacy data, only these compression and restoration layers are fine-tuned.

[0060] S103. Using the privacy dataset, fine-tune the parameters of the external compressed network to obtain the weight parameters of the second model.

[0061] Specifically, while keeping the first model weight parameters of the network layers in the pre-trained model unchanged, the external compressed network is trained using a privacy dataset.

[0062] During training, the input features are compressed and reduced in dimensionality by a compression layer before the model parameters are trained. The training parameters are then restored to their original output dimensions by a restoration layer to obtain the second model weight parameters. The number of parameters in the second model weight parameters is much smaller than that in the first model weight parameters.

[0063] As a feasible implementation method, if the current network layer is a linear layer, then let the input dimension of the linear layer be... The output dimension is The linear layer weights of the pre-trained model can be obtained as follows: ,Include Each weight parameter.

[0064] By using a compression layer in a compressed network connected to a linear layer, the input features during training are transformed from... Dimensional compression to r Dimension, the weights of the compression layer can be obtained as follows ,Include There are several weight parameters; among them, r much smaller and ,and and All are greater than 2.

[0065] Furthermore, the output features of the compressed layer are restored from r dimensions to r-dimensional features through the restoration layer. Dimension, the weights of the restoration layer can be obtained as follows ,Include There are [number] weight parameters. The final fine-tuned linear layer external compression network has [number] weight parameters. The weight parameters are much smaller than those of the original linear layer. Each weight parameter.

[0066] As another feasible implementation, if the current network layer is a convolutional layer, then let the number of input channels of the convolutional layer in the pre-trained model be... The number of output channels is The kernel size is The convolutional layer weights of the pre-trained model can be obtained as follows: ,Include Each weight parameter.

[0067] By connecting a compression layer in a compression network to the convolutional layer, the number of input channels during training is reduced from... Compress to t The weights of the compression layer can be obtained as follows: ,Include There are several weight parameters; among them, t much smaller and ,and and All are greater than 2.

[0068] Furthermore, the number of output channels of the compression layer is increased from [previous number] by using a recovery layer. t Restore to The weights of the restoration layer can be obtained as follows: ,Include There are [number] weight parameters. The final fine-tuned convolutional layer outer compressed network has [number] parameters. The weight parameters are much smaller than those of the original convolutional layer. Each weight parameter.

[0069] The above operations can effectively reduce the amount of private information that the model can leak, for the following reasons:

[0070] 1. The model compresses the input features of privacy data to a lower dimension, which means that the model can only capture a small number of features that are key to the main task, while discarding the rest of redundant information, thereby reducing the model information that attackers can obtain.

[0071] 2. The number of parameters fine-tuned using privacy data is far less than the number of parameters in the original model. This results in a smaller proportion of privacy data encoded in the model parameters, which are implicitly included in a large number of parameters encoding public data, thereby reducing the risk of privacy leakage.

[0072] S104. Mix the first model weight parameters and the second model weight parameters corresponding to each network layer to obtain the mixed model weight parameters, and apply them to the pre-trained model to obtain the optimized model.

[0073] Specifically, such as Figure 2 As shown, in the third stage of model training, the weight parameters of the compression layer and the weight parameters of the restoration layer are merged into the pre-trained weight parameters. This allows the pre-trained weight parameters encoding public information to mix and obfuscate the model fine-tuning parameters encoding privacy information, without affecting the model's inference results and maintaining the inference speed. The specific mixing principle formula is: Mixed weight parameter = First model weight parameter value + Compression layer weight parameter value × Restoration layer weight parameter value. The number of model parameters after mixing using this method is the same as the number of parameters in the original model; therefore, this invention does not introduce additional inference overhead.

[0074] As a feasible implementation method, when the network layer is a linear layer, according to The weight parameters of the first model and the weight parameters of the second model in the linear layer are mixed to obtain the weight parameters of the mixed model. .in, These are the first model weight parameters for the linear layer. The weights of the restoration layer are the weight parameters in the second model. These are the weights of the compressed layer in the weight parameters of the second model.

[0075] As a feasible implementation method, when the network layer is a convolutional layer, according to The weight parameters of the first model and the weight parameters of the second model in the convolutional layer are mixed to obtain the mixed model weight parameters. The kernel size of the convolutional layer is... , ; These are the first model weight parameters of the convolutional layer. The weights of the restoration layer are the weight parameters in the second model. These are the weights of the compressed layer in the weight parameters of the second model. The colon ":" represents a custom weight value; it is merely a symbol and its specific meaning has no impact on this scheme, so it will not be elaborated here.

[0076] In addition, embodiments of the present invention also provide a model inversion defense device based on compression fine-tuning, such as... Figure 4 As shown, the model inversion defense equipment based on compression fine-tuning specifically includes:

[0077] At least one processor; and a memory communicatively connected to the at least one processor; wherein,

[0078] The memory stores instructions that can be executed by at least one processor, so that at least one processor can perform the following:

[0079] By using a public dataset, the model to be trained is pre-trained to obtain the pre-trained model and the corresponding first model weight parameters.

[0080] An external compressed network is constructed for each network layer of the pre-trained model; wherein the network layer includes linear layers and / or convolutional layers;

[0081] By using a privacy dataset, the parameters of the external compressed network are fine-tuned to obtain the weight parameters of the second model;

[0082] The first model weight parameters and the second model weight parameters corresponding to each network layer are mixed to obtain mixed model weight parameters, which are then applied to the pre-trained model to obtain the optimized model.

[0083] Finally, the present invention also provides a storage medium, which is a non-volatile computer-readable storage medium storing at least one program, each program including instructions that, when executed by a terminal, cause the terminal to perform:

[0084] By using a public dataset, the model to be trained is pre-trained to obtain the pre-trained model and the corresponding first model weight parameters.

[0085] An external compressed network is constructed for each network layer of the pre-trained model; wherein the network layer includes linear layers and / or convolutional layers;

[0086] By using a privacy dataset, the parameters of the external compressed network are fine-tuned to obtain the weight parameters of the second model;

[0087] The first model weight parameters and the second model weight parameters corresponding to each network layer are mixed to obtain mixed model weight parameters, which are then applied to the pre-trained model to obtain the optimized model.

[0088] The various embodiments in this invention are described in a progressive manner. Similar or identical parts between embodiments can be referred to mutually. Each embodiment focuses on describing the differences from other embodiments. In particular, the embodiments of apparatus, devices, and non-volatile computer storage media are basically similar to the method embodiments, so the descriptions are relatively simple; relevant parts can be referred to the descriptions of the method embodiments.

[0089] The foregoing has described specific embodiments of the present invention. Furthermore, the processes depicted in the drawings do not necessarily require a specific or sequential order to achieve the desired results. In some embodiments, multitasking and parallel processing are possible or may be advantageous.

[0090] The above description is merely an embodiment of the present invention and is not intended to limit the present invention. For those skilled in the art, various modifications and variations can be made to the embodiments of the present invention. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principle of the embodiments of the present invention should be included within the protection scope of the present invention.

Claims

1. A model inversion defense method based on compression fine-tuning, characterized in that, The method includes: By using a public dataset, the model to be trained is pre-trained to obtain the pre-trained model and the corresponding first model weight parameters. An external compressed network is constructed for each network layer of the pre-trained model; wherein the network layer includes linear layers and / or convolutional layers; specifically including: A compression layer and a restoration layer are introduced into the bypass of each network layer of the pre-trained model to form the external compression network; wherein the output of the compression layer is connected to the output of the restoration layer. By fine-tuning the parameters of the external compressed network using a privacy dataset, the weight parameters of the second model are obtained, specifically including: While keeping the first model weight parameters of the network layers in the pre-trained model unchanged, the external compressed network is trained using a privacy dataset. During training, the input features are compressed and dimensionality reduced by the compression layer before model parameter training, and the training parameter dimensions are restored to the original output dimensions of the network layers by the restoration layer to obtain the second model weight parameters. The number of parameters in the second model weight parameters is much smaller than the number of parameters in the first model weight parameters. The first model weight parameters and the second model weight parameters corresponding to each network layer are mixed to obtain mixed model weight parameters, which are then applied to the pre-trained model to obtain the optimized model.

2. The model inversion defense method based on compression fine-tuning according to claim 1, characterized in that, By using a public dataset, the model to be trained is pre-trained to obtain the pre-trained model and the corresponding first model weight parameters, specifically including: Obtain the public dataset required by the model to be trained from the network, and perform adaptive preprocessing on the public dataset to make it meet the training requirements of the model to be trained. The model to be trained is pre-trained using the pre-processed public dataset to obtain a pre-trained model; Obtain the weight parameters of each network layer in the pre-trained model to form the first model weight parameters; wherein, the weight parameters encode public information related to the public dataset.

3. The model inversion defense method based on compression fine-tuning according to claim 1, characterized in that, The input features are compressed and reduced in dimensionality using the compression layer, and the compressed dimensions are restored to their initial dimensions using the restoration layer, in order to fine-tune the parameters of the external compression network. Specifically, this includes: If the current network layer is a linear layer, then let the input dimension of the linear layer be... The output dimension is The linear layer weights of the pre-trained model can be obtained as follows: ,Include One weight parameter; W refers to the weight parameter matrix for the linear layer weights; By using a compression layer in a compressed network connected to a linear layer, the input features during training are transformed from... Dimensional compression to r Dimension, the weights of the compression layer can be obtained as follows ,Include There are several weight parameters; among them, r much smaller and Among them, W A The weight parameter matrix used to refer to the weights of the compression layer; The output features of the compressed layer are restored from r-dimensional to r-dimensional using the restoration layer. Dimension, the weights of the restoration layer can be obtained as follows ,Include There are several weight parameters; among them, W B The weight parameter matrix used to refer to the weights of the restoration layer; The final fine-tuned linear layer external compression network has a total of The weight parameters are much smaller than those of the original linear layer. One weight parameter.

4. The model inversion defense method based on compression fine-tuning according to claim 3, characterized in that, The input features are compressed and reduced in dimensionality using the compression layer, and the compressed dimensions are restored to their initial dimensions using the restoration layer, in order to fine-tune the parameters of the external compression network. Specifically, this also includes: If the current network layer is a convolutional layer, then let the number of input channels of the convolutional layer in the pre-trained model be... The number of output channels is The kernel size is The convolutional layer weights of the pre-trained model can be obtained as follows: ,Include One weight parameter; By connecting a compression layer in a compression network to the convolutional layer, the number of input channels during training is reduced from... Compress to t The weights of the compression layer can be obtained as follows: ,Include There are several weight parameters; among them, t much smaller and ; The number of output channels of the compression layer is increased by the recovery layer. t Restore to The weights of the restoration layer can be obtained as follows: ,Include One weight parameter; The final fine-tuned convolutional layer external compression network has a total of The weight parameters are much smaller than those of the original convolutional layer. One weight parameter.

5. The model inversion defense method based on compression fine-tuning according to claim 3, characterized in that, The first model weight parameters and the second model weight parameters of each network layer are mixed to obtain the hybrid model weight parameters, which specifically include: In the case that the network layer is a linear layer, according to The weight parameters of the first model and the weight parameters of the second model in the linear layer are mixed to obtain the weight parameters of the mixed model. Wh is used to refer to the weight parameter matrix of a mixture model. in, These are the first model weight parameters for the linear layer. The weights of the restoration layer are the weight parameters in the second model. These are the weights of the compressed layer in the weight parameters of the second model.

6. The model inversion defense method based on compression fine-tuning according to claim 5, characterized in that, The first model weight parameters and the second model weight parameters of each network layer are mixed to obtain the hybrid model weight parameters, which specifically include: In the case where the network layer is a convolutional layer, according to The weight parameters of the first model and the weight parameters of the second model in the convolutional layer are mixed to obtain the mixed model weight parameters. ; Wherein, the kernel size of the convolutional layer is , k represents the size of the convolution kernel, and i and j are both counting parameters; These are the first model weight parameters of the convolutional layer. The weights of the restoration layer are the weight parameters in the second model. These are the weights of the compressed layer in the weight parameters of the second model.

7. A model inversion defense device based on compression fine-tuning, characterized in that, The device includes: At least one processor; and, A memory communicatively connected to the at least one processor; wherein, The memory stores instructions executable by the at least one processor to enable the at least one processor to execute a model inversion defense method based on compression fine-tuning according to any one of claims 1-6.

8. A storage medium, characterized in that, The storage medium is a non-volatile computer-readable storage medium that stores at least one program, each program including instructions that, when executed by a terminal, cause the terminal to perform a model inversion defense method based on compression fine-tuning according to any one of claims 1-6.

Images