Cooperative reasoning privacy protection method based on information bottleneck and relevance constraint

Abstract

The invention discloses a collaborative reasoning privacy protection method based on information bottleneck and relevance constraint. The method comprises the following steps: firstly, dividing a complete model into an edge end model and a cloud end model; secondly, designing an edge model architecture into a funnel shape, and compressing feature information transmitted in the middle; secondly, adding attention modules between different layers of the edge model, and further extracting task-related features from the transfer features; adding a channel up-sampling supplement module to the front end of the cloud model, and compensating the availability of the model; and finally, improving a loss function through the relevance constraint term to train a complete model, and distributing the trained edge model to a demand user. According to the method, the availability of the model and the privacy of the data are effectively balanced; the privacy protection degree can be adjusted according to different application scenes; the calculation and storage pressure of the edge model is reduced, and the method is feasible under the requirement of limited edge device resources in actual cooperative reasoning application.

Description

Technical Field

[0001] The present invention belongs to the field of artificial intelligence security, and specifically relates to a collaborative reasoning privacy protection method based on information bottlenecks and relevance constraints. Background Art

[0002] With the rapid development of artificial intelligence (AI) technology, the demand for deploying AI models on edge devices has surged. However, due to the strict requirements of multi-tasking and high real-time performance often involved in actual application scenarios, coupled with the objective limitations of edge devices such as limited computing power and insufficient storage resources, the direct deployment and application of high-performance AI models on edge devices has been difficult to achieve.

[0003] To address the aforementioned resource constraints on edge devices, collaborative inference (CI) technology has become a research hotspot in recent years. Collaborative inference divides and deploys complex models between edge devices and the cloud to share computational burden, enabling efficient AI inference within resource-constrained environments. However, while this approach improves performance, it also carries serious privacy risks. Attackers can exploit model inversion attacks (MIA) to reverse-reconstruct the original input data using intermediate feature information transmitted from the edge, potentially leaking privacy.

[0004] In recent years, a variety of privacy protection methods have emerged to address privacy issues in collaborative reasoning. Existing solutions can be broadly categorized by technology type: perturbation-based defense, information bottleneck-based defense, and hybrid defense methods that combine information bottlenecks with network depth. However, these existing defense mechanisms generally suffer from the following drawbacks:

[0005] 1) It is difficult to effectively control the redundant information transmitted by edge devices to the cloud, which allows attackers to use this redundant information to reconstruct the input data to a certain extent, limiting the privacy protection effect;

[0006] 2) These methods often cause significant loss in the performance of the original model, reducing the usability of the model and affecting actual deployment;

[0007] 3) Some methods require additional computation and storage overhead on edge devices, increasing the burden on already limited resources and making them difficult to adopt in practical applications. Therefore, this paper proposes a collaborative reasoning privacy protection method based on information bottlenecks and associativity constraints. This method achieves efficient, lightweight, and reliable privacy protection while ensuring model reasoning performance. Summary of the Invention

[0008] In order to address the shortcomings of existing privacy protection methods in the collaborative reasoning mode, the present invention proposes a collaborative reasoning privacy protection method based on information bottlenecks and correlation constraints. On the premise of ensuring the availability of model performance, it strengthens the privacy protection capability against model reverse attacks, reduces the computing and storage pressure of edge devices, and realizes efficient, lightweight and reliable privacy protection.

[0009] Technical Solution: A collaborative reasoning privacy protection method based on information bottlenecks and associativity constraints is used to partition and deploy complex models between edge devices and the cloud to share computing pressure, thereby improving the efficiency of large AI model reasoning under limited resources. The privacy protection processing steps of this method in the collaborative reasoning process include:

[0010] S1. Considering the load and computing pressure of edge devices, the large model is divided into an edge model and a cloud model. The large model includes an AI large model for graphics processing.

[0011] S2. Design the edge model into a funnel-type architecture, including reducing the number of channel outputs of the last layer of edge output to [1 / 5, 1 / 2] of the original number, then adding a batch normalization layer and a ReLU activation layer, and adding a convolutional layer and a SiLU activation layer after the last layer of edge model output;

[0012] The funnel-shaped architecture also includes adding multiple layers of receptive fields to perceive features including single-point pixels, medium-scale local features, and structural contours through different convolution kernels;

[0013] S3. Add attention modules between different layers in the edge model, add an attention module consisting of SE attention mechanism and TA attention mechanism between non-output layers, and add an attention module consisting of SE attention mechanism and CBAM mechanism to the back end of the output layer;

[0014] S4. Add a channel upsampling compensation module to the front end of the cloud model. The number of input channels of the channel upsampling is set to the number of channels finally transmitted by the edge model, and the number of output channels is set to the number of channels before the initial edge model modification. This includes adding a TA attention mechanism to the back end of the cloud upsampling module.

[0015] S5. Improve the loss function by using the correlation constraint term to train the large model before splitting in step S1, and distribute the trained edge model to the client or user to achieve collaborative reasoning of complex models.

[0016] Furthermore, step S2 specifically includes:

[0017] Reduce the number of channel outputs of the last layer of edge output to 1 / 4 of the original number, and add a batch normalization layer and a ReLU activation layer;

[0018] The convolution kernel stride of the convolution layer added to the last layer of the edge model output is 1, and a SiLU activation layer is added afterwards. The number of output channels of the edge model is adaptively adjusted according to different tasks and feature dimensions.

[0019] The multi-layer receptive field is composed of convolution layers with convolution kernels of 1, 3, and 5, a stride of 1, and a ReLU activation layer.

[0020] Furthermore, the specific operations of step S3 are:

[0021] Non-output layer: An attention module consisting of the SE attention mechanism and the TA attention mechanism is added after the first two convolution groups: the number of input channels of the SE attention mechanism in the attention module is the number of output channels of the previous layer, and the squeezing factor is 1 / 4 of the number of channels, which is calculated as follows:

[0022] SE(z)=z·σ(W2ReLU(W1GAP(z)))

[0023]

[0024] Among them, z is the feature information, GAP is the global average pooling layer, W1 and W2 are the weight matrices of the SE fully connected layer, σ is the Sigmoid activation function, and f HW 、f CH 、f CW They are the attention convolution functions along the (height, width), (channel, height), and (channel, width) planes respectively;

[0025] Output layer: The number of input channels of SE and CBAM attention mechanisms is determined by the number of output channels of the last layer of the funnel structure. The squeeze factor is the same as the number of channels and is calculated as follows:

[0026] CBAM(SE(z))=SE(z)·σ(MLP(GAP(SE(z))‖GMP(SE(z))))·σ(Conv 7×7 (AvgPool(SE(z))‖MaxPool(SE(z))))

[0027] Among them, ‖ represents channel splicing, MLP is a two-layer perceptron for channel attention, Conv 7×7 The convolution layer with kernel 7 is used for spatial attention. GMP and MaxPool are the global maximum pooling and spatial dimension maximum pooling functions.

[0028] Furthermore, the architecture of the channel upsampling supplementation module in step S4 includes 2 convolutional layers, 1 batch normalization layer and 1 ReLU activation layer.

[0029] Furthermore, the step of improving the loss function by the associative constraint term in step S5 is:

[0030] S51. Calculate the nonlinear correlation dCor(x,z) between the input number x and the feature data z through distance correlation and use it as one of the loss constraints It is calculated as follows:

[0031]

[0032] S52. Calculate the linear correlation between different channels c of feature data z through Pearson correlation and use it as one of the loss constraints It is calculated as follows:

[0033]

[0034] S53, suppressing the output value of the feature by using the L1 norm of the feature data z, and using it as one of the loss constraints;

[0035] S54, processing the loss based on Kulback–Leibler divergence and label smoothing;

[0036] S55, through the control coefficient λ 1、2、3 , τ manages the corresponding loss terms, and the final loss function is:

[0037]

[0038] where θ is the complete model parameter, is the training set label.

[0039] Furthermore, label smoothing is calculated as follows:

[0040]

[0041] Where α is the smoothing factor and K is the total number of categories.

[0042] Compared to existing technologies, this invention protects against significant loss of model usability while effectively resisting existing model reversal attacks. Furthermore, it adaptively adjusts the privacy protection level of edge models based on different application scenarios. Furthermore, it reduces the computational and storage pressure of edge models, making it practical for practical collaborative reasoning applications with limited edge device resources. BRIEF DESCRIPTION OF THE DRAWINGS

[0043] Figure 1 A flow chart of the method of the present invention;

[0044] Figure 2Schematic diagram of the funnel-shaped structure of the edge model and the attention module in an example of the present invention;

[0045] Figure 3 Schematic diagram of the structure of the cloud channel sampling module in the embodiment of the present invention;

[0046] Figure 4 A schematic diagram of the process of training a complete model of the present invention;

[0047] Figure 5 The figure compares the results after protection and the unprotected results using the existing model reverse attack method. DETAILED DESCRIPTION

[0048] The above scheme will be further described below with reference to specific embodiments. It should be understood that these embodiments are intended to illustrate the present invention and are not intended to limit the scope of the present invention. All other embodiments obtained by those of ordinary skill in the art based on the embodiments of the present invention without creative work are intended to fall within the scope of protection of the present invention.

[0049] This embodiment provides a collaborative reasoning privacy-preserving method based on information bottlenecks and associativity constraints. Specifically, it targets medical image classification tasks. Images can be categorized as COVID-19 lung X-rays, standard lung X-rays, viral pneumonia lung X-rays, and bacterial pneumonia lung X-rays. In actual deployment scenarios, the cloud model is set up in a medical research center, while the edge model is deployed in a local hospital. The resulting edge model effectively assists medical personnel in disease diagnosis, improving the efficiency and accuracy of diagnosis and treatment.

[0050] For details, see the attached Figure 1 The method of the present invention includes: the medical research center divides the complete model into edge and cloud models; the medical research center designs the edge model architecture into a funnel-shaped model; adds attention modules between different layers of the edge model; adds a channel upsampling supplementary module to the front end of the cloud model; trains the complete model by improving the loss function through correlation constraints; and the medical research center distributes the trained edge model to local hospitals in need.

[0051] Specifically, the method of the present invention comprises the following steps:

[0052] S1: The Medical Research Center divides the complete model into edge and cloud models;

[0053] The complete model refers to an unstructured AI model trained according to specific application task requirements. The complete model involved in this embodiment is VGG16. The input of the edge model in this embodiment is a single-channel image of 128×128 pixels, and the output is the intermediate processing feature, which consists of the following two parts:

[0054] (1) An edge device model consisting of two convolution groups and one independent convolution layer is deployed on the edge device in this collaborative inference application. The first two convolution groups each include two convolution layers, two batch normalization layers, two ReLU activation layers, and one max pooling layer, with the number of channels being 64, 64, 128, and 128, respectively; the last convolution layer has 256 channels. The output of the edge device model is a 256×16×16 intermediate feature.

[0055] (2) A cloud device model consisting of three convolutional groups and one fully connected group is deployed in the cloud device in this collaborative inference application. The first convolutional group includes two convolutional layers, two batch normalization layers, two ReLU activation layers, and one maximum pooling layer, with the number of channels being 256 and 256, respectively. The next two convolutional groups each include three convolutional layers, three batch normalization layers, three ReLU activation layers, and one maximum pooling layer, with the number of channels being 512, 512, 512, 512, 512, 512, and 512, respectively. The last fully connected group includes three fully connected layers, two ReLU activation layers, two drop layers, and one softmax layer.

[0056] Furthermore, considering the load and computing pressure on edge devices, it is recommended that the division between edge and cloud models be within the first 50% of the complete model layers. The later the division point, the more the transmitted feature information becomes task decision information, the less raw input information is included, and the better the defense effect.

[0057] In this embodiment, the complete model is trained with 66.6% of the image samples in the dataset, 16.7% of the image samples are used for testing, and 16.7% of the image samples are used for the model reverse attack auxiliary dataset to test the defense capability.

[0058] S2: The Medical Research Center designed the edge model architecture as a funnel shape. Figure 2 The specific improvement steps are as follows:

[0059] S21: The architecture of the first two convolution groups remains unchanged. The number of output channels of the last independent convolution layer is first changed to 32, and a batch normalization layer and a ReLU activation layer are added at the end.

[0060] The recommended compression range for the number of output channels is [1 / 5, 1 / 2] of the original number of channels. This range can be selected based on specific task requirements. A greater compression strength will alleviate the load and computational pressure on the edge, but will also result in a greater loss of feature information. A smaller compression strength will have the opposite effect.

[0061] S22: The last layer of edge output adds one convolution layer with a kernel size of 1 and a convolution layer with a kernel size of 3 and a stride of 1. The number of output channels is 4, and a SiLU activation layer is added after it.

[0062] S23: Add a multi-layer perception field module. Specifically, the convolution kernels are 1, 3, and 5, the convolution layer with a stride of 1, and a ReLU activation layer are combined. Without changing the final output channel, the output features are deeply de-redundant and the nonlinear complexity operation is increased. This design first uses a convolution layer with a convolution kernel of 1 to perceive single-point pixel features, and then uses 3 and 5 to perceive medium-local (texture, pattern) and larger-scale features (structural contours). If the convolution kernel is too large, it will increase the computational burden on edge devices, such as 7.

[0063] S3: The Medical Research Center adds attention modules between different layers of the edge model;

[0064] The attention module design of the edge model in this embodiment is also as follows Figure 2 The specific improvement steps are as follows:

[0065] S31: Add an attention module consisting of a Squeeze-and-Excitation Module (SE) and a Triplet Attention (TA) mechanism after the first two convolution groups. The number of input channels of the SE attention mechanism in the first attention module is 64, and the squeeze factor is 16. The number of input channels of the SE attention mechanism in the second attention module is 128, and the squeeze factor is 32. The calculation is as follows;

[0066] SE(z)=z·σ(W2ReLU(W1GAP(z)))

[0067]

[0068] Among them, z is the feature information, GAP is the global average pooling layer, W1 and W2 are the weight matrices of the SE fully connected layer, and σ is the Sigmoid activation function. HW 、f CH 、f CW They are the attention convolution functions along the (height, width), (channel, height), and (channel, width) planes respectively.

[0069] Among them, the SE attention mechanism can first screen the important channels of relatively rich and redundant feature information, suppress irrelevant information, and reduce the burden of subsequent attention mechanisms.

[0070] Compared to existing spatial attention mechanisms, the TA attention mechanism is computationally more lightweight, with fewer parameters and less computation. It also outputs smoother feature information without extreme zero-settings. Combined with SE, it can extract important channel features and local structural features with minimal computational overhead. Due to the relatively large number of channels before the final output, the TA attention mechanism ensures a lightweight deployment.

[0071] S32: Add an attention module consisting of the SE attention mechanism and the CBAM attention mechanism (Convolutional Block Attention Module, CBAM) to the back end of the output layer. The SE attention mechanism has 4 input channels and a squeeze factor of 4. The CBAM attention mechanism has 4 input channels and a squeeze factor of 4, which is calculated as follows;

[0072] CBAM(SE(z))=SE(z)·σ(MLP(GAP(SE(z))‖GMP(SE(z))))·σ(Conv 7×7 (AvgPool(SE(z))‖MaxPool(SE(z))))

[0073] Among them, ‖ represents channel splicing, MLP is a two-layer perceptron for channel attention, Conv 7×7 The convolution layer with kernel 7 is used for spatial attention. GMP and MaxPool are the global maximum pooling and spatial dimension maximum pooling functions.

[0074] CBAM, due to its independent design of first paying attention to channels and then paying attention to spaces, can achieve enhanced suppression of feature outputs, resulting in a more sparse output and reducing the information that could be used by potential adversaries to reverse attack the model. Secondly, since the final number of output channels is adjusted to 4, the computational complexity is significantly reduced, allowing the CBAM attention mechanism to still ensure lightweight deployment.

[0075] S4: The Medical Research Center added a channel upsampling compensation module to the cloud model front-end;

[0076] The structure design of the cloud model in this embodiment is as follows Figure 3 The specific improvement steps are as follows:

[0077] S41: Since the edge compresses the channel information, directly using this information for subsequent cloud model transmission will result in an error in the number of input channels. Therefore, channel upsampling compensation is added before the cloud model. The cloud channel upsampling module architecture is set to consist of 2 convolutional layers, 1 batch normalization layer, and 1 ReLU activation layer.

[0078] S42: The number of input channels for cloud channel upsampling is set to 4, and the number of output channels is set to 256;

[0079] S43: Add TA attention mechanism to the backend of the cloud upsampling module to further enhance the extraction of task-related features.

[0080] Among them, compared with other spatial attention mechanisms, the TA attention mechanism can ensure that the compensation information is not overly suppressed, ensure that the calculation delay is not too high, and enhance attention to decision information, which is helpful for the subsequent extraction of classification information.

[0081] S5: The Medical Research Center trains the complete model by improving the loss function with the correlation constraint term;

[0082] The process of training the complete model in this embodiment is as follows Figure 4 The specific improvement steps are as follows:

[0083] S51: Calculate the nonlinear correlation dCor(x,z) between the input data x and the feature data z through distance correlation and use it as one of the loss constraints It is calculated as follows:

[0084]

[0085] Compared with the correlation calculation based on kernel function, this loss constraint calculation is more flexible and has no sigma hyperparameter constraint. It can be flexibly used for correlation calculation in various scenarios and models. Estimating correlation based on mutual information definition requires a sufficient sample size, which will increase training time and cost. However, distance correlation indirectly affects the mutual information between x and z, that is, The decrease in decreases the nonlinear correlation, resulting in an increase in the conditional entropy H(x|z) of x based on z and a decrease in the mutual information I(x,z)=H(x)-H(x|z).

[0086] S52: Calculate the linear correlation between different channels c of feature data z through Pearson correlation and use it as one of the loss constraints It is calculated as follows:

[0087]

[0088] The original Pearson coefficient is squared and averaged, bringing the loss range to [0, 1]. The root cause is that the original Pearson coefficient range is [-1, 1]. To avoid gradient descent, the loss function approaches -1 at negative values, resulting in a negative Pearson linear correlation between channel features.

[0089] S53: Suppress the output value of the feature through the L1 norm of z and use it as one of the loss constraints;

[0090] S54: Improve the loss through Kullback–Leibler (KL) divergence and label smoothing (LS) technology:

[0091] Among them, the combination of KL divergence and LS can make the intermediate layer features pay more attention to the common features within the class, reduce the maximum separability of feature information, improve the versatility of the model, and increase the difficulty of reverse attack on the model.

[0092] S55: By controlling the coefficient λ 1、2、3 , τ manages the corresponding loss terms, and the final loss function is improved to:

[0093]

[0094] where θ is the complete model parameter, is the training set label.

[0095] Furthermore, in this embodiment, λ1 is set to 3.5, λ2 is set to 1.2, λ3 is set to 0.8, and τ is set to 2e-4.

[0096] Furthermore, the label smoothing calculation in this embodiment is as follows:

[0097]

[0098] Wherein α is a smoothing factor, K is the total number of categories, and in this embodiment, the smoothing factor is 0.35 and the total number of categories is 4.

[0099] Furthermore, the optimizer in this embodiment uses the Adam algorithm, with a learning rate of 2e-4 and a β of (0.5, 0.99). The scheduler manager uses ReduceLROnPlateaud, with a reduction factor of 0.5 and a patience of 25. The total number of training rounds is 300, and when the number of rounds exceeds 250, only the model with the best accuracy is saved.

[0100] S6: The Medical Research Center distributes the trained edge model to local hospitals in need.

[0101] The following are the experimental results of the collaborative reasoning privacy protection method based on information bottleneck and association constraints. The results are shown in Table 1, where the classification accuracy represents the reasoning ability of the complete model; the attack used for testing adopts the generator-based model inversion attack method; MSE represents the pixel difference between the reconstructed input image and the original input image, and the higher the index, the better the protection ability; PSNR represents the peak signal-to-noise ratio between the input data and the reconstructed data, and the lower the index, the better the protection ability; SSIM represents the structural similarity between the input data and the reconstructed data, and the lower the index, the better the protection ability; |θ|edge represents the number of parameters of the edge model, and the lower the index, the better. The visualization results are as follows Figure 5 shown.

[0102] Table 1. Quantitative evaluation table of privacy protection capabilities

[0103]

[0104] To verify the feasibility of each module in this solution, we conducted ablation experiments on a ResNet-18 edge model, removing each module. To highlight the role of each module, the edge model was simplified, consisting of only a single residual block. The specific performance is shown in Table 2.

[0105] Table 2. Ablation experiments

[0106]

[0107]

[0108] To verify the impact of this solution on latency, we performed statistics on CPU and GPU single-sample computation latency based on the above conditions, as shown in Table 3. Although GPU latency increased by 3ms, the saved video memory and memory space allowed the edge model to process more samples in parallel.

[0109] Table 3. Calculation delay

[0110] method CPU calculation delay GPU calculation delay Unprotected 1.204ms 3.9ms The present invention 2.192ms 6.9ms

[0111] In summary, the embodiment of the present invention provides a collaborative reasoning privacy protection method based on information bottlenecks and correlation constraints, which ensures that the model availability is not seriously damaged while effectively resisting the reverse attack of the existing model; it can adaptively adjust the privacy protection level of the edge model according to different application scenarios; it reduces the computing and storage pressure of the edge model, and is feasible under the requirements of limited edge device resources in actual collaborative reasoning applications.

[0112] The embodiments of the present invention are described in detail above with reference to the accompanying drawings, but the present invention is not limited to the described embodiments. It will be apparent to those skilled in the art that various changes, modifications, substitutions, and variations of these embodiments, including components, without departing from the principles and spirit of the present invention are still within the scope of protection of the present invention.

Claims

1. A collaborative reasoning privacy protection method based on information bottlenecks and associativity constraints, which is used to divide and deploy complex models between edge devices and the cloud to share computing pressure, thereby improving the reasoning efficiency of large AI models under limited resources. It is characterized by: The privacy protection processing steps of the method in the collaborative reasoning process include: S1. Considering the load and computing pressure of edge devices, the large model is divided into an edge model and a cloud model. The large model includes an AI large model for graphics processing. S2. Design the edge model into a funnel-type architecture, including reducing the number of channel outputs of the last layer of edge output to [1 / 5, 1 / 2] of the original number, then adding a batch normalization layer and a ReLU activation layer, and adding a convolutional layer and a SiLU activation layer after the last layer of edge model output; The funnel-shaped architecture also includes adding multiple layers of receptive fields to perceive features including single-point pixels, medium-scale local features, and structural contours through different convolution kernels; S3. Add attention modules between different layers in the edge model, add an attention module consisting of SE attention mechanism and TA attention mechanism between non-output layers, and add an attention module consisting of SE attention mechanism and CBAM mechanism to the back end of the output layer; S4. Add a channel upsampling compensation module to the front end of the cloud model. The number of input channels of the channel upsampling is set to the number of channels finally transmitted by the edge model, and the number of output channels is set to the number of channels before the initial edge model modification. This includes adding a TA attention mechanism to the back end of the cloud upsampling module. S5. Improve the loss function by using the correlation constraint term to train the large model before splitting in step S1, and distribute the trained edge model to the client or user to achieve collaborative reasoning of complex models.

2. The collaborative reasoning privacy protection method based on information bottleneck and correlation constraints according to claim 1 is characterized in that: Step S2 specifically includes: Reduce the number of channel outputs of the last layer of edge output to 1 / 4 of the original number, and add a batch normalization layer and a ReLU activation layer; The convolution kernel stride of the convolution layer added to the last layer of the edge model output is 1, and a SiLU activation layer is added afterwards. The number of output channels of the edge model is adaptively adjusted according to different tasks and feature dimensions. The multi-layer receptive field is composed of convolution layers with convolution kernels of 1, 3, and 5, a stride of 1, and a ReLU activation layer.

3. The collaborative reasoning privacy protection method based on information bottleneck and correlation constraints according to claim 1 is characterized in that: The specific operations of step S3 are: Non-output layer: An attention module consisting of the SE attention mechanism and the TA attention mechanism is added after the first two convolution groups: the number of input channels of the SE attention mechanism in the attention module is the number of output channels of the previous layer, and the squeezing factor is 1 / 4 of the number of channels, which is calculated as follows: SE(z)=z·σ(W2ReLU(W1GAP(z))) Among them, z is the feature information, GAP is the global average pooling layer, W1 and W2 are the weight matrices of the SE fully connected layer, σ is the Sigmoid activation function, and f HW 、f CH 、f CW They are the attention convolution functions along the (height, width), (channel, height), and (channel, width) planes respectively; Output layer: The number of input channels of the SE attention mechanism and the CBAM attention mechanism is determined by the number of output channels of the last layer of the funnel structure. The squeeze factor is the same as the number of channels, which is calculated as follows: CBAM(SE(z))=SE(z)·σ(MLP(GAP(SE(z))‖GMP(SE(z)))) ·σ(Conv 7×7 (AvgPool(SE(z))‖MaxPool(SE(z)))) Among them, ‖ represents channel splicing, MLP is a two-layer perceptron for channel attention, Conv 7×7 The convolution layer with convolution kernel 7 is used for spatial attention, GMP and MaxPool are the global maximum pooling and spatial dimension maximum pooling functions.

4. The collaborative reasoning privacy protection method based on information bottleneck and correlation constraints according to claim 1 is characterized in that: The architecture of the channel upsampling supplementation module in step S4 includes 2 convolutional layers, 1 batch normalization layer and 1 ReLU activation layer.

5. The collaborative reasoning privacy protection method based on information bottleneck and correlation constraints according to claim 1 is characterized in that: The steps of improving the loss function by the associativity constraint term in step S5 are: S51. Calculate the nonlinear correlation dCor(x,z) between the input number x and the feature data z through distance correlation and use it as one of the loss constraints It is calculated as follows: S52. Calculate the linear correlation between different channels c of feature data z through Pearson correlation and use it as one of the loss constraints It is calculated as follows: S53, suppressing the output value of the feature by using the L1 norm of the feature data z, and using it as one of the loss constraints; S54, processing the loss based on Kulback–Leibler divergence and label smoothing; S55, through the control coefficient λ 1、2、3 , τ manages the corresponding loss terms, and the final loss function is: where θ is the complete model parameter, is the training set label.

6. The collaborative reasoning privacy protection method based on information bottleneck and correlation constraints according to claim 5 is characterized in that: Label smoothing is calculated as follows: Where α is the smoothing factor and K is the total number of categories.

Images