Attribute inference attack defense method and device, electronic equipment, storage medium and computer program product

Abstract

This disclosure relates to a method, apparatus, electronic device, storage medium, and computer program product for defending against attribute inference attacks. The method includes: acquiring target text; inputting the target text into a fine-grained anonymization module to eliminate privacy cues in the target text, thereby obtaining anonymized text; and inputting the anonymized text into a privacy protection optimization module to add a target perturbation suffix to the anonymized text, thereby obtaining perturbed text. The target perturbation suffix is ​​used to prevent the attribute inference attack model from obtaining user privacy-related content from the target text. Thus, by combining the mechanisms of eliminating privacy cues and preventing privacy inference, the advantages of each mechanism can be fully utilized to defend against attribute inference attacks. Compared to a single defense method, the defense method provided by this disclosure can provide more comprehensive and stable defense against attribute inference attacks, thereby effectively reducing the risk of user privacy leakage and providing users with safer and more thorough privacy protection.

Description

Technical Field

[0001] This disclosure relates to the field of artificial intelligence technology, and more specifically, to methods, apparatuses, electronic devices, storage media, and computer program products for defending against attribute inference attacks. Background Technology

[0002] Artificial intelligence technologies, represented by Large Language Models (LLMs), are developing rapidly, and their powerful natural language understanding and reasoning capabilities have led to their widespread application across various industries. For example, users can share text and interact with LLMs on various online platforms. However, this interaction mode carries a certain risk of privacy leakage. This is because LLMs can use their powerful reasoning capabilities to infer users' personal privacy attributes from seemingly ordinary everyday text, such as age, gender, geographical location, income level, and educational background. Therefore, this type of attack is also known as "attribute inference attack." Unlike traditional malicious instructions with explicit intent (e.g., asking how to manufacture dangerous goods), attribute inference attacks are usually triggered by benign and harmless prompts, easily bypassing the security alignment mechanisms and filters of existing models, thereby achieving large-scale, automated, and highly accurate privacy theft.

[0003] In related technologies, there are two main approaches to address the privacy threats posed by attribute inference attacks: one is text anonymization-based defense methods, and the other is prompt optimization-based techniques. Text anonymization-based defense methods aim to obfuscate, generalize, or delete potentially personally identifiable information from user-submitted text by modifying its content. However, these methods are coarse-grained, lacking precise word-level identification and processing capabilities, making it difficult to accurately locate and modify text elements related to privacy breaches. Prompt optimization-based techniques aim to change the model's output distribution by optimizing and modifying prompts within the input model. However, these methods are mostly used in jailbreaking attacks, primarily for generating harmful or illegal content, making their application in privacy defense scenarios challenging. For example, the optimization process is computationally expensive and has coarse granularity. Therefore, these defense methods are insufficient to effectively defend against attribute inference attacks, and the risk of user privacy breaches remains high. Summary of the Invention

[0004] This disclosure provides methods, apparatus, electronic devices, storage media, and computer program products for defending against attribute inference attacks, in order to at least address the problem that the defense methods in the aforementioned related technologies are difficult to effectively defend against attribute inference attacks, and the risk of user privacy leakage remains high.

[0005] According to a first aspect of the present disclosure, a method for defending against attribute inference attacks is provided, applied to an active defense system. The active defense system includes a fine-grained anonymization module and a privacy protection optimization module. The defense method includes: acquiring target text; inputting the target text into the fine-grained anonymization module to eliminate privacy clues in the target text, thereby obtaining anonymized text; and inputting the anonymized text into the privacy protection optimization module to add a target perturbation suffix to the anonymized text, thereby obtaining perturbation text, wherein the target perturbation suffix is ​​used to prevent the attribute inference attack model from acquiring user privacy-related content in the target text.

[0006] Optionally, the step of inputting the anonymized text into the privacy protection optimization module to add a target perturbation suffix to the anonymized text to obtain perturbation text includes: using the privacy protection optimization module to add the target perturbation suffix to the anonymized text in an iterative manner to obtain the perturbation text; wherein, in each iteration, the following operations are performed: obtaining the perturbation suffix at the beginning of the current iteration; inputting the perturbation suffix at the beginning of the current iteration and the target text into the privacy protection optimization module to obtain an evaluation probability, wherein the evaluation probability is used to characterize the effectiveness of preventing the attribute inference attack model from obtaining user privacy-related content in the target text; in response to the evaluation probability being less than a preset threshold, updating the perturbation suffix at the beginning of the current iteration, and using the updated perturbation suffix as the perturbation suffix at the beginning of the next iteration; in response to the evaluation probability being greater than or equal to the preset threshold, and / or the number of iterations reaching a preset number, adding the perturbation suffix at the beginning of the current iteration as the target perturbation suffix to the anonymized text.

[0007] Optionally, the target perturbation suffix prevents the attribute inference attack model from obtaining user privacy-related content in the target text by guiding the attribute inference attack model to abandon inferring user privacy-related content in the target text.

[0008] Optionally, the target perturbation suffix prevents the attribute inference attack model from obtaining user privacy-related content in the target text by guiding the attribute inference attack model to infer and output preset error content.

[0009] Optionally, the step of inputting the target text into the fine-grained anonymization module to eliminate privacy clues in the target text and thereby obtain anonymized text includes: calculating the relevance of each word in the target text to user privacy; obtaining a preset number of privacy words in descending order of relevance to user privacy; inferring content related to user privacy based on the target text and obtaining the corresponding inference process, wherein the inference process is a step-by-step inference logic chain for inferring content related to user privacy based on the target text; and rewriting the target text based on the preset number of privacy words and the inference process to obtain the anonymized text.

[0010] According to a second aspect of the present disclosure, a defense device against attribute inference attacks is provided. The defense device includes an active defense system comprising a fine-grained anonymization module and a privacy protection optimization module. The defense device includes: a text acquisition module configured to acquire target text; an anonymization module configured to input the target text into the fine-grained anonymization module to eliminate privacy clues in the target text, thereby obtaining anonymized text; and a perturbation module configured to input the anonymized text into the privacy protection optimization module to add a target perturbation suffix to the anonymized text, thereby obtaining perturbated text, wherein the target perturbation suffix is ​​used to prevent the attribute inference attack model from acquiring user privacy-related content in the target text.

[0011] Optionally, the perturbation module is configured to: use the privacy protection optimization module to add the target perturbation suffix to the anonymized text in an iterative manner to obtain the perturbation text; wherein, in each iteration, the following operations are performed: obtain the perturbation suffix at the beginning of the current iteration; input the perturbation suffix at the beginning of the current iteration and the target text into the privacy protection optimization module to obtain an evaluation probability, wherein the evaluation probability is used to characterize the effectiveness of preventing the attribute inference attack model from obtaining user privacy-related content in the target text; in response to the evaluation probability being less than a preset threshold, update the perturbation suffix at the beginning of the current iteration, and use the updated perturbation suffix as the perturbation suffix at the beginning of the next iteration; in response to the evaluation probability being greater than or equal to the preset threshold, and / or the number of iterations reaching a preset number, add the perturbation suffix at the beginning of the current iteration as the target perturbation suffix to the anonymized text.

[0012] Optionally, the target perturbation suffix prevents the attribute inference attack model from obtaining user privacy-related content in the target text by guiding the attribute inference attack model to abandon inferring user privacy-related content in the target text.

[0013] Optionally, the target perturbation suffix prevents the attribute inference attack model from obtaining user privacy-related content in the target text by guiding the attribute inference attack model to infer and output preset error content.

[0014] Optionally, the anonymization module is configured to: calculate the relevance of each word in the target text to user privacy; obtain a preset number of privacy words in descending order of relevance to user privacy; infer content related to user privacy based on the target text and obtain the corresponding inference process, wherein the inference process is a step-by-step inference logic chain that infers content related to user privacy based on the target text; and rewrite the target text based on the preset number of privacy words and the inference process to obtain the anonymized text.

[0015] According to a third aspect of the present disclosure, an electronic device is provided, comprising: a processor; and a memory for storing processor-executable instructions; wherein the processor is configured to execute the instructions to implement a defense method against attribute inference attacks based on the present disclosure.

[0016] According to a fourth aspect of the present disclosure, a computer-readable storage medium is provided that, when instructions in the computer-readable storage medium are executed by a processor of an electronic device, enables the electronic device to perform a defense method against attacks inferred from attributes of the present disclosure.

[0017] According to a fifth aspect of the present disclosure, a computer program product is provided, including a computer program that, when executed by a processor, implements a defense method for inferring attacks based on attributes of the present disclosure.

[0018] The technical solutions provided by the embodiments of this disclosure bring at least the following beneficial effects: This disclosure combines two mechanisms—eliminating privacy clues and preventing privacy inference—to fully leverage the strengths of each mechanism in defending against attribute inference attacks. Compared to a single defense method, the defense approach provided in this disclosure offers a more comprehensive and stable defense against attribute inference attacks, thereby effectively reducing the risk of user privacy breaches and providing users with safer and more thorough privacy protection.

[0019] It should be understood that the above general description and the following detailed description are exemplary and explanatory only, and are not intended to limit this disclosure. Attached Figure Description

[0020] The accompanying drawings, which are incorporated in and form part of this specification, illustrate embodiments consistent with this disclosure and, together with the description, serve to explain the principles of this disclosure, and are not intended to unduly limit this disclosure.

[0021] Figure 1 This is a flowchart illustrating a method for defending against attribute inference attacks according to exemplary embodiments of the present disclosure; Figure 2 This is a schematic diagram illustrating how a fine-grained anonymization module removes easily inferred privacy clues from target text according to an exemplary embodiment of the present disclosure; Figure 3 This is a schematic diagram illustrating a cue word of a pre-trained large language model serving as a simulated adversary, according to an exemplary embodiment of the present disclosure; Figure 4 This is a schematic diagram illustrating another cue word of a pre-trained large language model as a simulated adversary, according to an exemplary embodiment of the present disclosure; Figure 5 This is a flowchart illustrating a specific implementation of an active defense system according to an exemplary embodiment of the present disclosure; Figure 6 This is a schematic diagram illustrating test results of an active defense system according to an exemplary embodiment of the present disclosure; Figure 7 This is a block diagram illustrating a defense device for inferring an attack based on an exemplary embodiment of the present disclosure; Figure 8 This is a block diagram illustrating an electronic device according to exemplary embodiments of the present disclosure. Detailed Implementation

[0022] To enable those skilled in the art to better understand the technical solutions of this disclosure, the technical solutions in the embodiments of this disclosure will be clearly and completely described below with reference to the accompanying drawings.

[0023] It should be noted that the terms "first," "second," etc., used in the specification, claims, and accompanying drawings of this disclosure are used to distinguish similar objects and are not necessarily used to describe a specific order or sequence. It should be understood that such data can be interchanged where appropriate so that the embodiments of this disclosure described herein can be implemented in orders other than those illustrated or described herein. The embodiments described in the following examples do not represent all embodiments consistent with this disclosure. Rather, they are merely examples of apparatuses and methods consistent with some aspects of this disclosure as detailed in the appended claims.

[0024] It should be noted that the phrase "at least one of several items" in this disclosure refers to three parallel cases: "any one of the several items", "a combination of any number of the several items", and "all of the several items". For example, "including at least one of A and B" includes the following three parallel cases: (1) including A; (2) including B; (3) including A and B. Another example is "performing at least one of step one and step two", which means the following three parallel cases: (1) performing step one; (2) performing step two; (3) performing both step one and step two.

[0025] Figure 1 This is a flowchart illustrating a defense method against attribute inference attacks according to exemplary embodiments of the present disclosure, applied to a defense system. The defense system may include a fine-grained anonymization module and a privacy protection optimization module.

[0026] Reference Figure 1 In step 101, the target text can be obtained. For example, users can post comments on various online platforms, which may include, but are not limited to, short video platforms, music platforms, etc.

[0027] In step 102, the target text can be input into the fine-grained anonymization module to eliminate privacy cues in the target text, thereby obtaining anonymized text. That is, the fine-grained anonymization module can eliminate implicit and easily inferred privacy cues in the target text.

[0028] It should be noted that the fine-grained anonymization method (Tracing-based Data Anonymization for Fine-grained Privacy Protection, TRACE) provided in this disclosure aims to precisely disrupt the logical path upon which the attack model relies for attribute inference through a multi-step analysis and modification process. This fine-grained anonymization method can include three parts: "privacy vocabulary extraction", "inference chain generation", and "anonymized text generation".

[0029] The "privacy vocabulary extraction" part primarily utilizes the attention mechanism of a pre-trained large language model to analyze the original text, thereby extracting and aggregating lexical attention scores that are highly relevant to user attribute inference. Then, based on these lexical attention scores, the top K words most likely to leak user privacy are selected from the target text to form a privacy vocabulary.

[0030] Regarding the "inference chain generation" part, it is mainly used to simulate the attacker's reasoning process using adversarial models. For example, it can generate a step-by-step, interpretable attribute inference logic chain from the original text, which can explicitly indicate which specific content in the original text might be used to infer the user's sensitive attributes.

[0031] Regarding the "anonymous text generation" part, it is mainly used as a guide signal, taking the aforementioned privacy vocabulary and attribute inference logic chain as guidance signals, to rewrite or generalize the key parts of the original text that may reveal user privacy, and finally obtain anonymized text. In this way, the original semantics can be preserved to the greatest extent while disrupting the inference path of the attack model. That is, it can protect the original semantics of the original text from being destroyed to the greatest extent while effectively preventing the malicious inference of the user's personal privacy attributes. Figure 2 This is a schematic diagram illustrating how a fine-grained anonymization module removes easily inferred privacy clues from target text according to an exemplary embodiment of the present disclosure.

[0032] According to an exemplary embodiment of this disclosure, the relevance of each word in the target text to user privacy can be calculated. Then, a preset number of privacy-related words can be obtained in descending order of their relevance to user privacy. Next, content related to user privacy can be inferred from the target text, and the corresponding inference process can be obtained. This inference process can be a step-by-step inference logic chain for obtaining content related to user privacy based on the target text. Then, the target text can be rewritten based on the preset number of privacy-related words and the inference process to obtain anonymized text. Thus, the fine-grained anonymization method provided by this disclosure can modify only the most critical privacy-leaking points in the original text, thereby ensuring accurate removal of user privacy clues and effectively protecting user privacy.

[0033] The following sections will provide detailed introductions to the three parts: "privacy vocabulary extraction," "inference chain generation," and "anonymized text generation."

[0034] Regarding the "privacy term extraction" section, it can mainly include the following steps: For a specific privacy attribute to be defended, the user's original text can be... With corresponding attribute queries By piecing together the data, an attribute inference hint can be formed. For example, the privacy attributes to be defended can be set according to actual needs, such as, but not limited to: the user's gender, the user's economic status, the user's geographical location, etc.

[0035] Then, the above attributes can be used to infer hints. Input a pre-trained causal language model, which can be, but is not limited to, a Transformer architecture model with an attention mechanism, such as Llama2-7B-Chat.

[0036] Next, we can extract the attention vector corresponding to the last token of the prompt from the last layer of the causal language model. The values ​​of each dimension of this vector can reflect the degree of attention the attack model pays to each word in the original text when performing inference.

[0037] Then, the attention scores (attention vectors) of each word belonging to the same word can be calculated. The contribution score of each word to attribute inference is calculated by summing and aggregating the attention levels corresponding to each word element. ,in, Indicates the position of a word element. This indicates the attention score corresponding to the word at the corresponding position.

[0038] For example, suppose the original text is "I study in university," which contains four words: "I," "study," "in," and "university." The word "I" contains only one lexical unit, "I," and this unit is in the first position of the original text; the word "study" contains only one lexical unit, "study," and this unit is in the second position; the word "in" contains only one lexical unit, "in," and this unit is in the third position; the word "university" can contain two lexical units, "uni" and "versity," with "uni" in the fourth position and "versity" in the fifth position. In this case, the contribution score of the first word "I" to attribute inference can be: the attention score corresponding to the lexical unit "I" in the first position, i.e., the aforementioned attention vector. The attention level corresponding to the word "I" is considered; for the fourth word "university", its contribution score to attribute inference can be the sum of the attention score corresponding to the word "uni" in the fourth position and the attention score corresponding to the word "versity" in the fifth position, i.e., the aforementioned attention vector. The sum of the attention levels corresponding to the word "uni" and the attention levels corresponding to the word "versity".

[0039] Next, all words can be sorted in descending order based on their contribution score to attribute inference, and the top K words can be selected to form a "privacy vocabulary set". Here, K is a hyperparameter that can be adjusted according to the actual application scenario. For example, it can be, but is not limited to, 10 or 30.

[0040] The "inference chain generation" part mainly includes the following steps: First, the user's original text can be input into a pre-trained large language model that acts as a simulated adversary, such as, but not limited to, GPT-3.5-Turbo or GPT-4o. Figure 3 This is a schematic diagram illustrating a prompt word of a pre-trained large language model simulating an adversary, according to an exemplary embodiment of the present disclosure.

[0041] Then, through specially designed instructions, the adversary model can be required not only to output predictions of user privacy attributes, but also to provide a step-by-step reasoning process. This process should detail how specific words and phrases in the original text are used as evidence to deduce the final conclusion step by step. Figure 4 This is a schematic diagram illustrating another cue word of a pre-trained large language model as a simulated adversary, according to an exemplary embodiment of the present disclosure.

[0042] Regarding the "anonymous text generation" part, it mainly integrates the user-submitted original text, the aforementioned "privacy vocabulary set," and the "inference chain," and provides the integrated result to an anonymized large language model specifically designed to perform text modification. For example, it could be, but is not limited to, GPT-4o.

[0043] It should be noted that this anonymized large language model can be guided by commands. Its core task is to modify the text while preserving as much semantic coherence and naturalness as possible. Thus, the anonymized large language model... It can output precisely modified anonymized text. ,in, This refers to the "Privacy Vocabulary Extraction" section. This refers to the "inference chain generation" part.

[0044] In step 103, the aforementioned anonymized text can be input into the privacy protection optimization module to add a target perturbation suffix to the anonymized text, thereby obtaining perturbation text. The target perturbation suffix can be used to prevent attribute inference attack models from obtaining content related to user privacy in the target text.

[0045] In this disclosure, by attaching an optimized, lightweight text perturbation, the attack model is made to tend to abandon inference or make incorrect inferences when it receives an attribute inference request. Thus, by adding a lightweight suffix, the behavior of the attack model can be fundamentally guided while preserving the semantics and usability of the original text to the greatest extent possible, causing the attack model to abandon inference or make incorrect inferences, thereby effectively reducing the risk of user privacy leakage.

[0046] It should be noted that the perturbation suffixes provided in this disclosure can be divided into two types: Rejection-based Proactive Search (RPS) and Error Attribution-based Perturbation Search (MPS). These two types of perturbation suffixes will be described in detail below.

[0047] According to an exemplary embodiment of this disclosure, the target perturbation suffix can prevent the attribute inference attack model from obtaining user privacy-related content in the target text by guiding the attribute inference attack model to abandon inferring user privacy-related content in the target text.

[0048] According to an exemplary embodiment of this disclosure, a privacy-preserving optimization module can be used to add a target perturbation suffix to anonymized text in an iterative manner to obtain perturbation text.

[0049] During each iteration, the following operations can be performed: First, we can obtain the perturbation suffix at the start of the current iteration.

[0050] Then, the perturbation suffix at the start of the current iteration and the target text can be input into the privacy protection optimization module to obtain the evaluation probability. This evaluation probability can be used to characterize the effectiveness of preventing attribute inference attack models from obtaining user privacy-related content in the target text.

[0051] Next, in response to the above-mentioned evaluation probability being less than a preset threshold, the perturbation suffix at the beginning of the current iteration can be updated, and the updated perturbation suffix can be used as the perturbation suffix at the beginning of the next iteration of the current iteration; in response to the above-mentioned evaluation probability being greater than or equal to the preset threshold, and / or the number of iterations reaching a preset number, the perturbation suffix at the beginning of the current iteration can be added to the anonymized text as the target perturbation suffix.

[0052] For RPS, the aforementioned anonymized text can be used as the base text, and a perturbation suffix s can be initialized. Then, using the base text and the initialized perturbation suffix s, RPS can be implemented through a two-stage perturbation search method. Furthermore, the first stage of the two stages can be the "first-word anchoring stage," and the second stage can be the "rejection word shaping stage."

[0053] For the "first-word anchoring stage," it can be optimized through random search by appending a perturbation suffix to the aforementioned anonymized text. This perturbation suffix is ​​designed to guide the first word in the output of the attack model. For example, this perturbation suffix can make the attack model anchor the first word in the output with a very high probability to the preset starting word: "I".

[0054] For example, in the "first word anchoring stage", candidate perturbation suffixes can be generated through a random search strategy. The perturbation suffixes can be continuously updated iteratively with the goal of maximizing the log probability of the model generating a specific anchor first word after processing "basic text + perturbation suffix". ,in, Indicates a specific anchor word, For the original text, This is a perturbation suffix added to the original text. This represents the log probability of the model generating a specific anchored first word after processing "base text + perturbation suffix". This indicates the perturbation suffix used to characterize the privacy attribute to be defended. With the original text The attribute inference hints obtained from the splicing process. For example, as mentioned earlier, the privacy attributes to be defended can be set according to actual needs, such as, but not limited to, the user's gender, economic status, geographical location, etc. Thus, multiple iterations can be performed until the logarithmic probability reaches a preset probability threshold or the number of iterations reaches a preset number of iterations.

[0055] The "rejection word shaping stage" is mainly used to further optimize and adjust the perturbation suffix based on the aforementioned "first word anchoring stage". The aim is to guide the attack model to select from a preset set of rejection words (e.g., "cannot", "unable") with a very high probability when generating the second word, thereby shaping a complete rejection response.

[0056] For example, regarding the "rejection word shaping stage," based on the optimal suffix obtained in the previous stage, namely the "first word anchoring stage," the perturbation suffix can be iteratively updated with the goal of maximizing a weighted scoring function until the weighted score meets a preset comprehensive scoring threshold or the number of iterations reaches a preset number of iterations. In this way, the final perturbation suffix can be obtained. That is, RPS perturbation.

[0057] It should be noted that the above weighted scoring function can comprehensively evaluate a specific anchor word and the subsequent rejection word shaping. For example, this weighted scoring function can be expressed by the following formula:

[0058] in, This represents a predefined set of words related to refusing to answer. It is a hyperparameter used to balance the weight of the second word. Indicates a specific anchor word, For the original text, This is a perturbation suffix added to the original text. This indicates the perturbation suffix used to characterize the privacy attribute to be defended. With the original text The attribute inference hints obtained from the splicing process. This represents the log probability of the model generating a specific anchored first word after processing "base text + perturbation suffix". This represents the log probability that the model selects a second lexical from a predefined set of rejection words (e.g., "cannot", "unable") after processing "base text + perturbation suffix".

[0059] According to an exemplary embodiment of this disclosure, the aforementioned target perturbation suffix can also prevent the attribute inference attack model from obtaining user privacy-related content in the target text by guiding the attribute inference attack model to infer and output preset erroneous content. Specifically, for attack models with strong instruction-following capabilities, a misleading attribute perturbation search strategy can be employed. This strategy primarily optimizes and adjusts the perturbation suffix, causing the attack model's prediction of user attributes to be biased towards a preset erroneous target, thereby effectively masking the true attributes.

[0060] It should be noted that MPS can be an alternative to the RPS method and can be enabled when the attack model exhibits extremely strong instruction compliance characteristics. MPS can specifically include the following steps: First, a false target attribute that differs from the user's actual attribute value can be pre-defined.

[0061] Then, a perturbation suffix can be optimized and adjusted through an iterative random search process similar to RPS. The optimization goal is to maximize the log probability that the model can directly predict and output the preset erroneous target attribute after processing "base text + perturbation suffix".

[0062] Figure 5This is a flowchart illustrating a specific implementation of an active defense system according to an exemplary embodiment of the present disclosure. Thus, after obtaining the final text by adding a perturbation suffix to the original text using RPS or MPS, when this final text is submitted to the attack model, even if the attack model receives an attribute inference instruction, it will most likely directly reply with a rejection statement such as "I cannot answer that," or directly give an incorrect attribute judgment, thereby rendering the attack ineffective. That is, in this disclosure, by inducing the attack model to refuse to answer or give an incorrect answer, the occurrence of attribute inference attacks can be fundamentally blocked, rather than merely increasing the difficulty of the attack. This effectively reduces the risk of user privacy leakage and thus effectively protects user privacy.

[0063] It should be noted that this disclosure also provides an active defense system, which may include an input interface, a processing core, and an output interface. The processing core is the key to the active defense system and may consist of the aforementioned fine-grained anonymization module and privacy protection optimization module. As mentioned earlier, the fine-grained anonymization module may include three parts: "privacy vocabulary extraction," "inference chain generation," and "anonymous text generation," which will not be elaborated further here. The privacy protection optimization module may include a perturbation suffix generator, a logarithmic probability estimator, and a decision module. The decision module can be used to update the perturbation suffix based on the evaluation results of the logarithmic probability estimator and can switch between RPS and MPS strategies when necessary.

[0064] To verify the defensive effectiveness of the proactive defense system provided in this disclosure, tests were conducted on a public dataset using various mainstream large language models as attack models. Figure 6 This is a schematic diagram illustrating test results of an active defense system according to an exemplary embodiment of the present disclosure. (Refer to...) Figure 6 Test results show that the proactive defense system provided in this disclosure has a significant defensive effect. Taking the Llama2-7B-Chat model on the Synthetic dataset as an example: the attribute inference accuracy of text without the proactive defense system of this disclosure is as high as 53.71%; if the TRACE method provided in this disclosure is used alone, the attribute inference accuracy of the attack model drops to 20.19%; if the TRACE method provided in this disclosure is combined with RPS, the attribute inference accuracy of the attack model can be effectively suppressed to 1.52%.

[0065] The proactive defense system disclosed herein can not only accurately identify and anonymize text elements that leak privacy in the original text, but also fundamentally prevent the inference behavior of attack models, thereby providing users with strong privacy protection. Thus, whenever a user wants to publish original text on an online platform, they can use the proactive defense system provided herein to generate a perturbation suffix for the original text and add the perturbation suffix to it. Then, the text with the perturbation suffix can be published to the online platform. At this point, even if the attack model receives an attribute inference instruction, it will likely only directly respond with a rejection statement such as "I cannot answer that," or directly give an incorrect attribute judgment, thereby rendering the attack ineffective.

[0066] Figure 7 This is a block diagram illustrating a defense device 700 against attribute inference attacks according to an exemplary embodiment of the present disclosure. The defense device 700 may include an active defense system, which may include a fine-grained anonymization module and a privacy protection optimization module.

[0067] Reference Figure 7 The defense device 700 may include a text acquisition module 701, an anonymization module 702, and a disturbance module 703.

[0068] The text acquisition module 701 can acquire target text. For example, users can post comments on various online platforms, which may include, but are not limited to, short video platforms, music platforms, etc.

[0069] The anonymization module 702 can input the target text into the fine-grained anonymization module to eliminate privacy clues in the target text, thereby obtaining anonymized text. In other words, the fine-grained anonymization module can eliminate implicit and easily inferred privacy clues in the target text.

[0070] According to an exemplary embodiment of this disclosure, the anonymization module 702 can calculate the relevance of each word in the target text to user privacy. Then, the anonymization module 702 can obtain a preset number of privacy words in descending order of relevance to user privacy. Next, the anonymization module 702 can infer content related to user privacy based on the target text and obtain the corresponding inference process, wherein the inference process can be a step-by-step inference logic chain for obtaining content related to user privacy based on the target text. Then, the anonymization module 702 can rewrite the target text based on the preset number of privacy words and the inference process to obtain anonymized text. In this way, the fine-grained anonymization method provided by this disclosure can modify only the most critical privacy leakage points in the original text, thereby ensuring accurate removal of user privacy clues and effectively protecting user privacy.

[0071] The perturbation module 703 can input the aforementioned anonymized text into the privacy protection optimization module to add a target perturbation suffix to the anonymized text, thereby obtaining perturbation text. The target perturbation suffix can be used to prevent attribute inference attack models from obtaining content related to user privacy in the target text.

[0072] According to an exemplary embodiment of this disclosure, the target perturbation suffix can prevent the attribute inference attack model from obtaining user privacy-related content in the target text by guiding the attribute inference attack model to abandon inferring user privacy-related content in the target text.

[0073] According to an exemplary embodiment of this disclosure, the perturbation module 703 can use the privacy protection optimization module to add a target perturbation suffix to the anonymized text in an iterative manner, thereby obtaining perturbation text.

[0074] During each iteration, the following operations can be performed: First, we can obtain the perturbation suffix at the start of the current iteration.

[0075] Then, the perturbation suffix at the start of the current iteration and the target text can be input into the privacy protection optimization module to obtain the evaluation probability. This evaluation probability can be used to characterize the effectiveness of preventing attribute inference attack models from obtaining user privacy-related content in the target text.

[0076] Next, in response to the above-mentioned evaluation probability being less than a preset threshold, the perturbation suffix at the beginning of the current iteration can be updated, and the updated perturbation suffix can be used as the perturbation suffix at the beginning of the next iteration of the current iteration; in response to the above-mentioned evaluation probability being greater than or equal to the preset threshold, and / or the number of iterations reaching a preset number, the perturbation suffix at the beginning of the current iteration can be added to the anonymized text as the target perturbation suffix.

[0077] According to an exemplary embodiment of this disclosure, the aforementioned target perturbation suffix can also prevent the attribute inference attack model from obtaining user privacy-related content in the target text by guiding the attribute inference attack model to infer and output preset erroneous content. Specifically, for attack models with strong instruction-following capabilities, a misleading attribute perturbation search strategy can be employed. This strategy primarily optimizes and adjusts the perturbation suffix, causing the attack model's prediction of user attributes to be biased towards a preset erroneous target, thereby effectively masking the true attributes.

[0078] Figure 8 This is a block diagram illustrating an electronic device 800 according to an exemplary embodiment of the present disclosure.

[0079] Reference Figure 8The electronic device 800 includes at least one memory 801 and at least one processor 802. The at least one memory 801 stores instructions that, when executed by the at least one processor 802, execute a defense method against attribute inference attacks according to exemplary embodiments of the present disclosure.

[0080] As an example, electronic device 800 may be a PC, tablet, personal digital assistant, smartphone, or other device capable of executing the aforementioned instructions. Here, electronic device 800 is not necessarily a single electronic device, but may be a collection of any devices or circuits capable of executing the aforementioned instructions (or instruction sets) individually or in combination. Electronic device 800 may also be part of an integrated control system or system manager, or may be configured to interconnect with a portable electronic device locally or remotely (e.g., via wireless transmission) through an interface.

[0081] In electronic device 800, processor 802 may include a central processing unit (CPU), a graphics processing unit (GPU), a programmable logic device, a dedicated processor system, a microcontroller, or a microprocessor. By way of example and not limitation, processor may also include analog processors, digital processors, microprocessors, multi-core processors, processor arrays, network processors, etc.

[0082] The processor 802 can execute instructions or code stored in the memory 801, which can also store data. Instructions and data can also be sent and received over a network via a network interface device, which can employ any known transmission protocol.

[0083] The memory 801 may be integrated with the processor 802, for example, by placing RAM or flash memory within an integrated circuit microprocessor. Alternatively, the memory 801 may include a separate device, such as an external disk drive, a storage array, or other storage device that can be used by any database system. The memory 801 and the processor 802 may be operatively coupled, or may communicate with each other, for example, via I / O ports, network connections, etc., enabling the processor 802 to read files stored in the memory.

[0084] In addition, the electronic device 800 may also include a video display (such as a liquid crystal display) and a user interaction interface (such as a keyboard, mouse, touch input device, etc.). All components of the electronic device 800 can be interconnected via a bus and / or network.

[0085] According to exemplary embodiments of this disclosure, a computer-readable storage medium may also be provided, which, when executed by a processor of an electronic device, enables the electronic device to perform the aforementioned defense method against attribute inference attacks. Examples of computer-readable storage media include: read-only memory (ROM), random access programmable read-only memory (PROM), electrically erasable programmable read-only memory (EEPROM), random access memory (RAM), dynamic random access memory (DRAM), static random access memory (SRAM), flash memory, non-volatile memory, CD-ROM, CD-R, CD+R, CD-RW, CD+RW, DVD-ROM, DVD-R, DVD+R, DVD-RW, DVD+RW, DVD-RAM, BD-ROM, BD-R, BD-R, BD-R The computer program in the aforementioned computer-readable storage medium can run in an environment deployed in computer devices such as clients, hosts, agents, and servers. Furthermore, in one example, the computer program and any associated data, data files, and data structures are distributed across a networked computer system, allowing the computer program and any associated data, data files, and data structures to be stored, accessed, and executed in a distributed manner through one or more processors or computers.

[0086] According to exemplary embodiments of the present disclosure, a computer program product may also be provided, including a computer program that, when executed by a processor, implements a defense method for inferring attacks based on attributes of the present disclosure.

[0087] The methods, apparatuses, electronic devices, storage media, and computer program products for defending against attribute inference attacks disclosed herein combine two mechanisms—eliminating privacy clues and preventing privacy inference—to fully leverage the advantages of each mechanism in defending against attribute inference attacks. Compared to single defense methods, the defense methods provided by this disclosure offer more comprehensive and stable protection against attribute inference attacks, thereby effectively reducing the risk of user privacy leakage and providing users with safer and more thorough privacy protection.

[0088] According to exemplary embodiments of this disclosure, the original semantics can be preserved to the greatest extent while disrupting the inference path of the attack model. That is, the original semantics of the original text can be protected to the greatest extent while effectively preventing the malicious inference of the user's personal privacy attributes.

[0089] According to exemplary embodiments of this disclosure, it is possible to modify only the most critical privacy-leaking points in the original text, thereby ensuring the accurate removal of user privacy clues and effectively protecting user privacy.

[0090] According to exemplary embodiments of this disclosure, by adding a lightweight suffix, the behavior of the attack model can be fundamentally guided while preserving the semantics and usability of the original text to the greatest extent, causing the attack model to abandon inference or produce incorrect inference, thereby effectively reducing the risk of user privacy leakage.

[0091] According to exemplary embodiments of this disclosure, by inducing the attack model to refuse to answer or to give an incorrect answer, the occurrence of attribute inference attacks can be fundamentally blocked, rather than merely increasing the difficulty of the attack. This can effectively reduce the risk of user privacy leakage and thus effectively protect user privacy.

[0092] Other embodiments of this disclosure will readily occur to those skilled in the art upon consideration of the specification and practice of the invention disclosed herein. This disclosure is intended to cover any variations, uses, or adaptations of this disclosure that follow the general principles of this disclosure and include common knowledge or customary techniques in the art not disclosed herein. The specification and examples are to be considered exemplary only, and the true scope and spirit of this disclosure are indicated by the following claims.

[0093] It should be understood that this disclosure is not limited to the precise structures described above and shown in the accompanying drawings, and various modifications and changes can be made without departing from its scope. The scope of this disclosure is limited only by the appended claims.

Claims

1. A method for defending against attribute inference attacks, applied to an active defense system, characterized in that, The proactive defense system includes a fine-grained anonymization module and a privacy protection optimization module, and the defense method includes: Obtain the target text; The target text is input into the fine-grained anonymization module to eliminate privacy clues in the target text, thereby obtaining anonymized text; The anonymized text is input into the privacy protection optimization module to add a target perturbation suffix to the anonymized text, thereby obtaining perturbation text. The target perturbation suffix is ​​used to prevent the attribute inference attack model from obtaining content related to user privacy in the target text. The step of inputting the target text into the fine-grained anonymization module to eliminate privacy clues in the target text, thereby obtaining anonymized text, includes: Calculate the relevance of each word in the target text to user privacy; Obtain a preset number of privacy keywords in descending order of their relevance to user privacy; Based on the target text, reason about content related to user privacy and obtain the corresponding reasoning process, wherein the reasoning process is a step-by-step inference logic chain that obtains content related to user privacy based on the target text; The target text is rewritten based on the preset number of privacy words and the reasoning process to obtain the anonymized text; The step of inputting the anonymized text into the privacy protection optimization module to add a target perturbation suffix to the anonymized text, thereby obtaining perturbation text, includes: The privacy protection optimization module adds the target perturbation suffix to the anonymized text using either a rejection-oriented perturbation search iteration method or a misattribution-oriented perturbation search iteration method, thereby obtaining the perturbation text; In each iteration, the following operations are performed: Get the perturbation suffix at the start of the current iteration; The perturbation suffix at the start of the current iteration and the anonymized text are input into the privacy protection optimization module to obtain the evaluation probability, wherein the evaluation probability is used to characterize the effectiveness of preventing the attribute inference attack model from obtaining user privacy-related content in the target text; In response to the evaluation probability being less than a preset threshold, the perturbation suffix at the start of the current iteration is updated, and the updated perturbation suffix is ​​used as the perturbation suffix at the start of the next iteration. In response to the evaluation probability being greater than or equal to the preset threshold, and / or the number of iterations reaching the preset number, the perturbation suffix at the start of the current iteration is added to the anonymized text as the target perturbation suffix.

2. The defense method as described in claim 1, characterized in that, The target perturbation suffix prevents the attribute inference attack model from obtaining user privacy-related content in the target text by guiding the attribute inference attack model to abandon inferring user privacy-related content in the target text.

3. The defense method as described in claim 1, characterized in that, The target perturbation suffix guides the attribute inference attack model to infer and output preset error content, thereby preventing the attribute inference attack model from obtaining user privacy-related content in the target text.

4. A defense device against attribute inference attacks, the defense device comprising an active defense system, characterized in that, The proactive defense system includes a fine-grained anonymization module and a privacy protection optimization module, and the defense device includes: The text acquisition module is configured to acquire the target text. An anonymization module is configured to input the target text into the fine-grained anonymization module to remove privacy clues in the target text, thereby obtaining anonymized text; The perturbation module is configured to input the anonymized text into the privacy protection optimization module to add a target perturbation suffix to the anonymized text, thereby obtaining perturbation text, wherein the target perturbation suffix is ​​used to prevent the attribute inference attack model from obtaining user privacy-related content in the target text; The anonymization module is configured as follows: Calculate the relevance of each word in the target text to user privacy; Obtain a preset number of privacy keywords in descending order of their relevance to user privacy; Based on the target text, reason about content related to user privacy and obtain the corresponding reasoning process, wherein the reasoning process is a step-by-step inference logic chain that obtains content related to user privacy based on the target text; The target text is rewritten based on the preset number of privacy words and the reasoning process to obtain the anonymized text; The disturbance module is configured as follows: The privacy protection optimization module adds the target perturbation suffix to the anonymized text using either a rejection-oriented perturbation search iteration method or a misattribution-oriented perturbation search iteration method, thereby obtaining the perturbation text; In each iteration, the following operations are performed: Get the perturbation suffix at the start of the current iteration; The perturbation suffix at the start of the current iteration and the anonymized text are input into the privacy protection optimization module to obtain the evaluation probability, wherein the evaluation probability is used to characterize the effectiveness of preventing the attribute inference attack model from obtaining user privacy-related content in the target text; In response to the evaluation probability being less than a preset threshold, the perturbation suffix at the start of the current iteration is updated, and the updated perturbation suffix is ​​used as the perturbation suffix at the start of the next iteration. In response to the evaluation probability being greater than or equal to the preset threshold, and / or the number of iterations reaching the preset number, the perturbation suffix at the start of the current iteration is added to the anonymized text as the target perturbation suffix.

5. An electronic device, characterized in that, include: processor; Memory used to store the processor's executable instructions; The processor is configured to execute the instructions to implement the defense method against attribute inference attacks as described in any one of claims 1 to 3.

6. A computer-readable storage medium, characterized in that, When the instructions in the computer-readable storage medium are executed by the processor of the electronic device, the electronic device is able to perform the defense method against attribute inference attacks as described in any one of claims 1 to 3.

7. A computer program product, comprising a computer program, characterized in that, When the computer program is executed by a processor, it implements a defense method against attribute inference attacks as described in any one of claims 1 to 3.

Images