A membership inference method and training method, apparatus, device, and medium

Abstract

This invention discloses a membership inference method, training method, apparatus, device, and medium, comprising: receiving a sample to be tested; extracting temporal pattern features from the sample to be tested; the temporal pattern features characterize the multi-scale dynamic characteristics of the sample to be tested; generating a secret sample to be tested based on the temporal pattern features; inputting the secret sample to be tested into a pre-set mature prediction model in the inference model to obtain a first prediction result; obtaining a first prediction error sequence of the first prediction result based on the first prediction result and the label of the sample to be tested; calling a membership attribute attack classifier in the inference model to classify the first prediction error sequence to obtain the membership category of the sample to be tested. This invention amplifies the difference between whether a sample to be tested is a member and a non-member, enabling more accurate determination of whether a sample to be tested belongs to the training dataset.

Description

Technical Field

[0001] This invention relates to the technical field of network security, and in particular to a member identity reasoning method, training method, apparatus, device, and medium. Background Technology

[0002] Deep learning-based multivariate time series forecasting models have been widely applied in scenarios highly sensitive to data privacy, such as medical monitoring, financial risk control, and energy dispatch. In practical engineering, these models are often not implemented from scratch by developers, but rather directly reuse existing training scripts and model implementations from open-source communities, such as third-party code repositories hosted on platforms like GitHub. These code repositories are large in size, poorly maintained, and have contributors with varying technical levels, making code auditing difficult. In this context, even a very small amount of malicious code modification can be executed undetected along with real business data, thus embedding hidden privacy leakage channels during the model training phase, leading to the leakage of sensitive information such as the identities of training data participants.

[0003] Current attackers can slightly tamper with training data or training code to make the model export sensitive information during training. For example, some methods inject specific samples into the training dataset or modify the loss function to make the model output carry additional clues about the identity of the members; other methods embed backdoors or gradient hooks in the training framework to directly export sensitive information during training.

[0004] Current methods for inferring membership in samples typically use classifiers to identify the samples themselves. However, this method cannot detect subtle alterations made by attackers in the training data or training code, resulting in low accuracy in identifying membership in samples. Summary of the Invention

[0005] The purpose of this invention is to provide a membership identification reasoning method, training method, apparatus, device, and medium to solve the problem that existing technologies cannot identify slight modifications made by attackers in training data or training code, resulting in low accuracy in membership identification of samples.

[0006] In a first aspect, to achieve the above objective, the present invention provides a method for inferring membership in a sample, comprising: Receive a sample to be tested; the sample to be tested is a multivariate time series. Extract the temporal pattern features to be detected from the sample to be detected; the temporal pattern features to be detected characterize the multi-scale dynamic characteristics of the sample to be detected; Based on the time-series pattern features to be detected, a secret sample to be detected is generated for the sample to be detected; the secret sample to be detected refers to sample data whose time-series features and frequency domain features in the time-series pattern features are consistent with the time-series pattern features to be detected. The secret sample to be detected is entered into the mature prediction model in the preset inference model to obtain the first prediction result; the first prediction result is all features of each variable in multiple future time series predicted by the mature prediction model based on the secret sample to be detected. Based on the first prediction result and the label of the sample to be detected, a first prediction error sequence of the first prediction result is obtained. The membership attribute attack classifier in the inference model is called to classify the first prediction error sequence to obtain the membership category of the sample to be detected. The membership category includes: the sample to be detected belongs to the training dataset and the sample to be detected does not belong to the training dataset.

[0007] In a second aspect, to achieve the above objectives, the present invention also provides a method for training a reasoning model for training the aforementioned reasoning model; The training method includes: Load the training dataset; the training dataset contains multiple training samples; the training samples are multivariate time series. Training time-series pattern features are extracted from the training samples; these features characterize the multi-scale dynamic properties of the training samples. Based on the training time-series pattern features, training secret samples of the training samples are generated; the training secret samples refer to sample data in which the time-series features and frequency domain features are consistent with the training time-series pattern features, but all variables are inconsistent in each time series. A mature prediction model is obtained by training a pre-set initial prediction model using the training samples and their training secret samples. The preset target sample is entered into the mature prediction model to obtain the second prediction result; the second prediction result is all features of each variable in multiple future time series predicted by the mature prediction model based on the target sample. Based on the second prediction result and the label of the target sample, a second prediction error sequence of the second prediction result is obtained, and a second temporal pattern feature of the second prediction error sequence is extracted; An initial attack classifier is created, and the initial attack classifier is trained using the second temporal pattern features and the membership category of the target sample to obtain a membership attribute attack classifier; the membership category includes: the target sample belongs to the training dataset, and the target sample does not belong to the training dataset.

[0008] In the above scheme, extracting the training time sequence pattern features from the training samples includes: The training time-domain features are extracted from the training samples, and these features characterize the overall trend and fluctuation characteristics of all variables at each time series in the training samples. Extract training frequency domain features from the training samples; the training frequency domain features characterize the overall frequency trend and short-term fluctuation of all variables at each time series in the training samples; The training autocorrelation features are extracted from the training samples. These training autocorrelation features characterize the internal temporal dependencies and dynamic correlations of all variables at each time series in the frequency of the training samples. By concatenating the training time-domain features, the training frequency-domain features, and the training autocorrelation features, the training time-series pattern features of the training samples are obtained.

[0009] In the above scheme, generating training secret samples of the training samples based on the training time sequence pattern features includes: Based on the parameterized noise distribution of the training time-series pattern features, an autoregressive correlation noise sequence of the training time-series pattern features is generated; the autoregressive correlation noise sequence refers to sample data in which the time-series features and frequency domain features of the time-series pattern features are consistent with the training time-series pattern features, but all variables are inconsistent across different time series. The autoregressive correlation noise sequence is concatenated with the training samples to obtain the training secret samples.

[0010] In the above scheme, the extraction of the second temporal pattern features of the second prediction error sequence includes: The second time-domain feature is extracted from the second prediction error sequence. The second time-domain feature characterizes the overall trend and fluctuation characteristics of all variables at each time series in the second prediction error sequence. Extract the second frequency domain features from the second prediction error sequence; the second frequency domain features characterize the overall frequency trend and short-term fluctuation of all variables at each time series in the frequency of the second prediction error sequence; The second autocorrelation feature is extracted from the second prediction error sequence. The second autocorrelation feature characterizes the internal temporal dependence and dynamic correlation of all variables at each time series in the frequency of the second prediction error sequence. By concatenating the second time-domain feature, the second frequency-domain feature, and the second autocorrelation feature, the second time-series pattern feature of the second prediction error sequence is obtained.

[0011] In the above scheme, the initial attack classifier is trained using the second temporal pattern features and the membership category of the target sample to obtain a membership attribute attack classifier, including: Generate similar temporal pattern features that are similar to the second temporal pattern features; the similar temporal pattern features belong to the same category as the target sample; Using the second temporal pattern feature and the similar temporal pattern feature as input data for the initial attack classifier, and using the membership category of the second temporal pattern feature and the similar temporal pattern feature as output data, the initial attack classifier is trained to obtain a membership attribute attack classifier.

[0012] In a third aspect, to achieve the above objectives, the present invention also provides a sample membership reasoning apparatus, which runs the above-described sample membership reasoning method; The membership inference device includes: The input module is used to receive the sample to be detected; the sample to be detected is a multivariate time series. The first extraction module is used to extract the time-series pattern features to be detected from the sample to be detected; the time-series pattern features to be detected characterize the multi-scale dynamic characteristics of the sample to be detected. The first secret sample module is used to generate a secret sample to be detected based on the time-series pattern features to be detected; the secret sample to be detected refers to sample data whose time-series features and frequency domain features in the time-series pattern features are consistent with the time-series pattern features to be detected. The first prediction module is used to input the secret sample to be detected into the mature prediction model in the preset inference model to obtain the first prediction result; the first prediction result is all features of each variable in multiple future time series predicted by the mature prediction model based on the secret sample to be detected. The identity reasoning module is used to obtain a first prediction error sequence of the first prediction result based on the first prediction result and the label of the sample to be detected, and to call the membership attribute attack classifier in the reasoning model to classify the first prediction error sequence to obtain the membership category of the sample to be detected; the membership category includes: the sample to be detected belongs to the training dataset, and the sample to be detected does not belong to the training dataset.

[0013] In a fourth aspect, to achieve the above objectives, the present invention also provides a training apparatus for a reasoning model, which runs the training method for the above-described reasoning model. The training device includes: A loading module is used to load a training dataset; the training dataset contains multiple training samples; the training samples are multivariate time series. The second extraction module is used to extract training time-series pattern features from the training samples; the training time-series pattern features characterize the multi-scale dynamic characteristics of the training samples. The second secret sample module is used to generate training secret samples of the training samples based on the training time sequence pattern features; the training secret samples refer to sample data in which the time sequence features and frequency domain features in the time sequence pattern features are consistent with the training time sequence pattern features, but all variables in each time sequence are inconsistent. The model training module is used to train a pre-set initial prediction model using the training samples and their training secret samples to obtain a mature prediction model. The second prediction module is used to input the preset target sample into the mature prediction model to obtain the second prediction result; the second prediction result is all features of each variable in multiple future time series predicted by the mature prediction model based on the target sample. The result extraction module is used to obtain the second prediction error sequence of the second prediction result based on the second prediction result and the label of the target sample, and to extract the second temporal pattern feature of the second prediction error sequence. The classifier training module is used to create an initial attack classifier and train the initial attack classifier using the second temporal pattern features and the membership category of the target sample to obtain a membership attribute attack classifier; the membership category includes: the target sample belongs to the training dataset and the target sample does not belong to the training dataset.

[0014] In a fifth aspect, to achieve the above objectives, the present invention also provides a computer device including a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor of the computer device executes the computer program to implement the steps of the membership reasoning method and the training method of the reasoning model described above.

[0015] In a sixth aspect, to achieve the above objectives, the present invention also provides a computer-readable storage medium storing a computer program, wherein the computer program stored in the storage medium, when executed by a processor, implements the steps of the above-described sample membership reasoning method and the training method of the reasoning model.

[0016] This invention provides a membership inference method, training method, apparatus, device, and medium. By generating a secret sample to be detected based on the temporal pattern features of the sample to be detected, it helps the mature prediction model in the inference model to make its first prediction, amplifying the difference between whether the sample to be detected is a member and a non-member. For example, if the sample to be detected is a member of the training dataset, the mature prediction model has previously learned its temporal pattern, resulting in more accurate predictions and smaller errors for the secret sample, with a high degree of temporal feature matching. If the sample to be detected is not a member of the training dataset, the mature prediction model has not encountered this pattern, leading to larger prediction errors and disordered, mismatched temporal features for the secret sample.

[0017] By extracting temporal pattern features from prediction errors using a well-trained membership attribute attack classifier, it is possible to more accurately determine whether a sample to be detected belongs to the training dataset, thus achieving stable and reliable membership identification. Attached Figure Description

[0018] Figure 1 Flowcharts for Embodiments 1 and 2 of the membership reasoning method for samples of the present invention; Figure 2 The flowcharts are for embodiments 3 and 4 of the training method for the inference model of the present invention; Figure 3 This is a schematic diagram of the program modules of Embodiment 5 of the predictive model selection device of the present invention; Figure 4 This is a schematic diagram of the program modules of Embodiment 6 of the training device for the model selector of the present invention; Figure 5 This is a schematic diagram of the hardware structure of the computer device in Embodiment 7 of the present invention; Figure 6 This is a schematic diagram of the specific structure of a member inference attack method for a multivariate time series prediction model based on time series patterns in Embodiment 9 of the present invention; Figure 7 This is a schematic diagram of the hidden member reasoning process in a member reasoning attack method for a multivariate time series prediction model based on time series patterns in Embodiment 9 of the present invention. Detailed Implementation

[0019] To make the objectives, technical solutions, and advantages of this invention clearer, the invention will be further described in detail below with reference to the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are merely illustrative and not intended to limit the invention. All other embodiments obtained by those skilled in the art based on the embodiments of this invention without inventive effort are within the scope of protection of this invention.

[0020] The technical terminology of this invention will be explained and described below: Member inference attack: refers to an attack method in which the attacker determines whether a certain sample is involved in model training.

[0021] Sliding window: This refers to a method of extracting local segments in a time series by progressively moving a fixed window of size W. Each window covers W consecutive time steps and can be used to calculate local statistics, thereby capturing local trends in the time domain.

[0022] Discrete wavelet transform is an analytical method that decomposes a time series into different frequency components. This invention uses Doceby wavelets as basis functions to decompose the sequence into approximation coefficients cA and detail coefficients cD, which respectively reflect low-frequency trends and high-frequency changes, and are used to construct frequency domain features.

[0023] Autocorrelation coefficient: Used to measure the similarity of time series at different lags k, reflecting the time dependence of the series.

[0024] Sigmoid is a non-linear function that maps inputs to the interval (0,1).

[0025] Autoregressive noise is a time-dependent stochastic process whose current value is determined by the noise and random disturbances of the previous moment.

[0026] Bi-LSTM: A bidirectional recurrent neural network structure composed of a forward LSTM and a backward LSTM, capable of simultaneously capturing both forward and backward dependencies of a sequence. Bi-LSTM can extract contextual information from time series and is the fundamental feature extraction module of the attack classifier in this invention.

[0027] Binary Cross-Entropy (BCE) loss is a loss function used in binary classification tasks to measure the difference between the predicted probability and the true label. Example 1: Please see Figure 1 This application provides a method for inferring membership in a sample, including: S101: Receive the sample to be tested; the sample to be tested is a multivariate time series.

[0028] S102: Extract the time-series pattern features to be detected from the sample to be detected; the time-series pattern features to be detected characterize the multi-scale dynamic characteristics of the sample to be detected.

[0029] S103: Generate a secret sample to be detected for the sample to be detected based on the time-series pattern features to be detected; the secret sample to be detected refers to sample data whose time-series features and frequency domain features in the time-series pattern features are consistent with the time-series pattern features to be detected.

[0030] S104: Input the secret sample to be detected into the mature prediction model in the preset inference model to obtain the first prediction result; the first prediction result is all features of each variable in multiple future time series predicted by the mature prediction model based on the secret sample to be detected.

[0031] S105: Based on the first prediction result and the label of the sample to be detected, obtain the first prediction error sequence of the first prediction result, call the membership attribute attack classifier in the inference model to classify the first prediction error sequence, and obtain the membership category of the sample to be detected; the membership category includes: the sample to be detected belongs to the training dataset, and the sample to be detected does not belong to the training dataset.

[0032] In this example, by generating a secret sample of the sample to be detected based on the temporal pattern features in the sample to be detected, the first prediction result of the mature prediction model in the inference model is amplified, highlighting the difference between whether the sample to be detected is a member or a non-member. For example, if the sample to be detected is a member of the training dataset, the mature prediction model has previously learned its temporal pattern, and its prediction of the secret sample will be more accurate and have smaller errors, with a high degree of matching between the error and temporal features. If the sample to be detected is not a member of the training dataset, the mature prediction model has not seen this pattern before, resulting in larger prediction errors and disordered and mismatched temporal features when predicting the secret sample.

[0033] By extracting temporal pattern features from prediction errors using a well-trained membership attribute attack classifier, it is possible to more accurately determine whether a sample to be detected belongs to the training dataset, thus achieving stable and reliable membership identification. Example 2:

[0034] Please see Figure 1 This application provides a method for inferring membership in a sample, including: S101: Receive the sample to be tested; the sample to be tested is a multivariate time series.

[0035] In this example, for the sample to be detected A multivariate time series is an observation sequence composed of multiple interrelated variables and sampled sequentially in chronological order. Each time point corresponds to a set of observations composed of multiple variables.

[0036] In this embodiment, the sample to be detected is used to retrain the mature prediction model in the inference model, or to train other initial prediction models similar to the mature prediction model.

[0037] S102: Extract the time-series pattern features to be detected from the sample to be detected; the time-series pattern features to be detected characterize the multi-scale dynamic characteristics of the sample to be detected.

[0038] In this example, the T-Pattern of the time series pattern to be detected is extracted from the sample to be detected. T-Pattern is a unified feature representation used to characterize the structure of multivariate time series. It describes multi-scale dynamic characteristics, which reflect the comprehensive performance of the trend, fluctuation and correlation of the sample to be detected at different time granularities. It includes time domain features, frequency domain features and autocorrelation features.

[0039] In a preferred embodiment, extracting the temporal pattern features to be detected from the sample to be detected includes: S1021: Extract the time-domain features to be detected from the sample to be detected. The time-domain features to be detected characterize the overall trend and fluctuation characteristics of all variables in each time series of the sample to be detected. In this example, the overall trend refers to the long-term direction of the sample under test, such as rise, fall, or stability; the fluctuation characteristics refer to the magnitude and stability of the fluctuations in the sample under test.

[0040] For example, for each sample to be tested Perform sliding window statistics, assuming the window size is... Then the number of windows is For each sliding window start time step Extract data from the sliding window And calculate the mean of the data. and standard deviation The specific formula is as follows: Next, the statistical properties of all windows are... Cascading and flattening (that is, the characteristic of summarizing all windows) (Concatenate them into a one-dimensional long vector) to obtain the temporal features. N is the number of variable categories in the sample to be tested; F represents the number of features of a variable at each time step in the sample to be tested. The mean is... It reflects the overall trend of all variables in the sample under test over different time periods, and the standard deviation It reflects the fluctuation characteristics of all variables in each time series of the sample to be tested.

[0041] S1022: Extract the frequency domain features to be detected from the sample to be detected; the frequency domain features to be detected characterize the overall frequency trend and short-term fluctuation of all variables in each time series of the sample to be detected.

[0042] In this example, the overall frequency trend refers to the common direction of change of each variable in the low-frequency components (long period, large scale), representing a long-term, stable frequency structure. The degree of short-term fluctuation refers to the intensity of fluctuation of each variable in the high-frequency components (short period, small scale), representing instantaneous, drastic frequency changes.

[0043] Samples to be tested Each variable and each feature dimension Take a one-dimensional time series First, regarding Perform discrete wavelet transform to obtain approximate coefficients. With detail coefficient : Where DWT represents Discrete Wavelet Transform, and the wavelet basis functions are... The Doceby wavelet was used.

[0044] Next, calculate the approximation coefficients. mean With detail coefficient Standard deviation The result calculated across all variables and feature dimensions. By splicing and flattening, frequency domain features are obtained. Among them, the approximation coefficient mean Represents the overall frequency trend of all variables at each time step in the frequency of the sample to be tested; detail coefficients Standard deviation It represents the short-term fluctuation of all variables at each time series in the frequency of the sample to be tested.

[0045] S1023: Extract the autocorrelation features to be detected from the sample to be detected. The autocorrelation features to be detected characterize the internal temporal dependencies and dynamic correlations of all variables at each time series in the frequency of the sample to be detected.

[0046] In this example, internal temporal dependency refers to the degree of correlation between current data and historical data, reflecting the temporal continuity of all variables in each temporal series; dynamic correlation refers to the strength of the correlation between all variables in different temporal series as time changes, reflecting the dynamic linkage characteristics of the temporal series.

[0047] Extract the autocorrelation features to be detected from the sample to be detected. Each variable and each feature dimension Take a one-dimensional time series The autocorrelation coefficient of this sequence in lag... The location is defined as: in Time series The mean.

[0048] This invention calculates the one-dimensional time series for each variable and each feature dimension. The autocorrelation coefficient of the lag order is obtained. The result calculated across all variables and feature dimensions. The autocorrelation features are obtained by splicing and flattening the data. .

[0049] in, These reflect the correlation between all variables in the current time series and all variables in the current time series (with a baseline that is always equal to 1, used to measure the correlation). and The strength of the correlation), the correlation with all variables at the previous time step 1, and the correlation with all variables at the previous time step 2. Therefore, These respectively reflect the internal temporal dependencies of all variables at each time step in the frequency of the sample to be detected; As a whole, data R reflects the dynamic correlation of all variables at each time series in the frequency of the sample to be tested.

[0050] S1024: Concatenate the time-domain features to be detected, the frequency-domain features to be detected, and the autocorrelation features to be detected to obtain the time-series pattern features to be detected of the sample to be detected.

[0051] In this example, a unified T-Pattern feature for the time series pattern to be detected is constructed. The three types of features mentioned above are then concatenated to obtain the time series pattern feature to be detected: .

[0052] In summary, this example overcomes the problems of single features failing to effectively characterize temporal differences, weak member identification signals, and insufficient discriminative power. It achieves multi-dimensional feature extraction and fusion, accurately capturing temporal patterns and improving the accuracy and stability of member identification.

[0053] S103: Generate a secret sample to be detected for the sample to be detected based on the time-series pattern features to be detected; the secret sample to be detected refers to sample data whose time-series features and frequency domain features in the time-series pattern features are consistent with the time-series pattern features to be detected, but whose variables are inconsistent in each time series.

[0054] In this example, based on the T-Pattern feature of the time-series pattern to be detected, a secret sample with time-series correlation is generated, which is kept consistent with the sample to be detected in the time domain and frequency domain, so that it can be stably absorbed by the model and form a persistent time trajectory.

[0055] In a preferred embodiment, generating a secret sample to be detected for the sample to be detected based on the time-series pattern characteristics to be detected includes: S1031: Generate an autoregressive correlation noise sequence of the time series pattern features to be detected based on the parameterized noise distribution of the time series pattern features to be detected; the autoregressive correlation noise sequence refers to sample data in which the time series features and frequency domain features of the time series pattern features are consistent with the time series pattern features to be detected, but all variables are inconsistent in each time series.

[0056] In this example, the parameterized noise distribution consists of the noise's mean, variance, and other distribution parameters, which are calculated from the time-series pattern features (T-Pattern) to be detected. The noise is bound to the features of the sample to be detected, so that the autoregressive time-series pattern features of the generated autoregressive correlated noise sequence are consistent with the time-series pattern features to be detected.

[0057] Autoregressive correlation noise sequence refers to noise at the current moment that depends on the noise at the previous moment, forming noise with temporal correlation and not completely random. It conforms to the time series pattern. Therefore, all variables in each time series of the autoregressive correlation noise sequence generated according to the preset time correlation coefficient are inconsistent with all variables in each time series of the sample to be detected.

[0058] Based on the parameterized noise distribution of the time-series pattern features to be detected, the T-Pattern features for each sample to be detected are: The noise mean is obtained through linear projection. With covariance : , in, and It is a fixed projection matrix.

[0059] Define the time correlation coefficient , which serves as a coefficient to control the strength of the correlation between the current noise and the noise at the previous time step: in, For the sigmoid function, It is a learnable vector.

[0060] Generate an autoregressive correlation noise sequence. Construct a first-order autoregressive noise process, as shown in the following formula: in, , .

[0061] Noise at the current time t; Noise from the previous moment; : The temporal correlation coefficient calculated from the temporal feature z (the strength of the noise correlation before and after control); Random noise that follows a normal distribution.

[0062] S1032: The autoregressive correlation noise sequence is concatenated with the sample to be detected to obtain the secret sample to be detected.

[0063] In this example, by using the noise sequence Add to the sample to be tested Above, obtain the secret sample The labels of secret samples are consistent with those of the samples to be detected. This design makes secret samples similar to the samples to be detected in terms of temporal structure, but deviates from the samples to be detected in terms of distribution, making them easier for the model to remember. The labels of the samples to be detected are all the features of each variable across multiple future time series pre-defined for the samples to be detected.

[0064] In summary, this example addresses the problems of random noise being easily filtered by the model, damaging prediction performance, and failing to form stable member signals. It generates autoregressive noise consistent with the time-series pattern, and the secret samples better match the model's preferences, resulting in strong concealment and stable signal recognition.

[0065] S104: Input the secret sample to be detected into the mature prediction model in the preset inference model to obtain the first prediction result; the first prediction result is all features of each variable in multiple future time series predicted by the mature prediction model based on the secret sample to be detected.

[0066] In this example, the mature prediction model is trained by using the training multivariate time series data and its training secret samples to jointly train the initial prediction model. The obtained prediction results for the training samples are: The prediction result for the secret sample is The initial prediction model uses prediction loss based on training samples. and secret sample memory loss They are: , The total loss of the model is: ;in, is a weighting coefficient used to balance prediction performance with the strength of secret sample memory.

[0067] In this embodiment, by inputting the secret sample to be detected into a mature prediction model, the final first prediction result is: .

[0068] S105: Based on the first prediction result and the label of the sample to be detected, obtain the first prediction error sequence of the first prediction result, call the membership attribute attack classifier in the inference model to classify the first prediction error sequence, and obtain the membership category of the sample to be detected; the membership category includes: the sample to be detected belongs to the training dataset, and the sample to be detected does not belong to the training dataset.

[0069] In this example, the first prediction error sequence is the difference between the first prediction result and the label of the sample to be detected. Based on the mature prediction model described above, the first prediction error sequence is obtained based on the secret sample memory loss of the sample to be detected. : Simultaneously, the same T-Pattern transform is applied to the first prediction error sequence to extract its temporal pattern features, which are then matched with the structural features of the secret sample. This achieves covert membership inference without accessing model parameters, training data, or explicitly revealing channels. Furthermore, the structure is lightweight and highly covert, allowing direct embedding into existing time series prediction training processes, achieving efficient membership inference attacks while maintaining relatively unchanged prediction performance. Specifically, samples belonging to the training dataset indicate that the sample to be detected has not been tampered with, while samples not belonging to the training dataset indicate that the sample to be detected has been tampered with.

[0070] In a preferred embodiment, the membership attribute attack classifier in the inference model is invoked to classify the first prediction error and obtain the membership category of the sample to be detected, including: S1051: Extract the first time-domain feature from the first prediction error sequence. The first time-domain feature characterizes the overall change trend and fluctuation characteristics of all variables at each time series in the first prediction error sequence.

[0071] In this example, the overall trend refers to the long-term direction of the first prediction error sequence, such as rise, fall, or stability; the fluctuation characteristics refer to the magnitude and stability of the fluctuations in the first prediction error sequence.

[0072] For example, for each first prediction error sequence Perform sliding window statistics, assuming the window size is... Then the number of windows is For each sliding window start time step Extract data from the sliding window And calculate the mean of the data. and standard deviation The specific formula is as follows: Next, the statistical properties of all windows are... Cascading and flattening (that is, the characteristic of statistically analyzing all windows) (Concatenate them into a one-dimensional long vector) to obtain the temporal features. N is the number of variable categories in the first prediction error sequence; F represents the number of features of a variable at each time step in the test sample. The mean is... This reflects the overall trend of all variables across different time periods in the first prediction error sequence, and the standard deviation. It reflects the fluctuation characteristics of all variables at each time series in the first prediction error sequence.

[0073] S1052: Extract the first frequency domain feature from the first prediction error sequence; the first frequency domain feature characterizes the overall frequency trend and short-term fluctuation of all variables in each time series of the first prediction error sequence.

[0074] In this example, the overall frequency trend refers to the common direction of change of each variable in the low-frequency components (long period, large scale), representing a long-term, stable frequency structure. The degree of short-term fluctuation refers to the intensity of fluctuation of each variable in the high-frequency components (short period, small scale), representing instantaneous, drastic frequency changes.

[0075] For the first prediction error sequence Each variable and each feature dimension Take a one-dimensional time series First, regarding Perform discrete wavelet transform to obtain approximate coefficients. With detail coefficient : Where DWT represents Discrete Wavelet Transform, and the wavelet basis functions are... The Doceby wavelet was used.

[0076] Next, calculate the approximation coefficients. mean With detail coefficient Standard deviation The result calculated across all variables and feature dimensions. By splicing and flattening, frequency domain features are obtained. Among them, the approximation coefficient mean The detail coefficients represent the overall frequency trend of all variables across all time series in the first prediction error sequence. Standard deviation This represents the short-term volatility of all variables at each time step in the frequency of the first prediction error sequence.

[0077] S1053: Extract the first autocorrelation feature from the first prediction error sequence. The first autocorrelation feature characterizes the internal temporal dependencies and dynamic correlations of all variables at each time series in the frequency of the first prediction error sequence.

[0078] In this example, internal temporal dependency refers to the degree of correlation between current data and historical data, reflecting the temporal continuity of all variables in each temporal series; dynamic correlation refers to the strength of the correlation between all variables in different temporal series as time changes, reflecting the dynamic linkage characteristics of the temporal series.

[0079] Extract the first autocorrelation feature from the first prediction error sequence, and then analyze the first prediction error sequence. Each variable and each feature dimension Take a one-dimensional time series . The autocorrelation coefficient of the sequence is in lag. The definition of a location is: in One-dimensional time series The mean.

[0080] This invention calculates the one-dimensional time series for each variable and each feature dimension. The autocorrelation coefficient of the lag order is obtained. The result calculated across all variables and feature dimensions. The autocorrelation features are obtained by splicing and flattening the data. .

[0081] in, These reflect the correlation between all variables in the current time series and all variables in the current time series (with a baseline that is always equal to 1, used to measure the correlation). and The strength of the correlation), the correlation with all variables at the previous time step 1, and the correlation with all variables at the previous time step 2. Therefore, These respectively reflect the internal temporal dependencies of all variables at each time step in the frequency of the first prediction error sequence; As a whole, data R reflects the dynamic correlation of all variables at each time series in the frequency of the first prediction error sequence.

[0082] S1054: Concatenate the first time-domain feature, the first frequency-domain feature, and the first autocorrelation feature to obtain the first time-series pattern feature of the first prediction error sequence.

[0083] In this example, a unified first time-series pattern feature T-Pattern is constructed. The three types of features mentioned above are concatenated to obtain the first time-series pattern feature: .

[0084] S1055: Invoke the member attribute attack classifier to classify the first predicted time-series pattern features to obtain the member identity category of the sample to be detected.

[0085] The membership attribute attack classifier in this example is a dedicated attack classifier designed to perform classification tasks, determining whether a sample to be detected belongs to the training dataset. The members in the training dataset are training samples used to train mature prediction models, or initial prediction models that are similar to mature prediction models.

[0086] This membership attribute attack classifier consists of a Bi-LSTM model, a self-attention module, and a two-layer fully connected network. First, the Bi-LSTM model extracts the sequence features of the input samples to obtain the hidden states. Next, the self-attention module calculates... , , and attention coefficient ,in for The dimension. Finally, the two fully connected network outputs the probability that a sample belongs to the training samples of the multivariate time series prediction model. The calculation formula is as follows: Where σ(·) is the sigmoid activation function, which outputs a probability of 0 to 1; W2 is the weight of the fully connected layer and the bias of b1 and b2.

[0087] In summary, this example addresses the problem of single prediction error features and unclear member differentiation signals, making it difficult to accurately determine member identities in continuous time series prediction. It extracts and fuses error time series features from multiple dimensions to enhance the differentiation between members and non-members, thereby improving the classifier's recognition accuracy and attack reliability. Example 3:

[0088] Existing methods for hidden member inference are mostly designed for classification tasks, relying on confidence or discrete labels, and cannot be adapted to multivariate time series prediction scenarios. Furthermore, the injected random noise is easily filtered out by the model, or the model performance degrades due to excessive noise amplitude. At the same time, there is a lack of signals that can effectively distinguish member identities, making it impossible to achieve hidden member inference for multivariate time series without affecting model performance or relying on explicit leakage channels.

[0089] Please see Figure 2 This application provides a method for training a reasoning model, including: S201: Load the training dataset; the training dataset contains multiple training samples; the training samples are multivariate time series.

[0090] S202: Extract the training time sequence pattern features from the training samples; the training time sequence pattern features characterize the multi-scale dynamic characteristics of the training samples.

[0091] S203: Generate training secret samples of the training samples based on the training time sequence pattern features; the training secret samples refer to sample data in which the time sequence features and frequency domain features in the time sequence pattern features are consistent with the training time sequence pattern features, but all variables in each time sequence are inconsistent.

[0092] S204: Train the preset initial prediction model using the training samples and their training secret samples to obtain a mature prediction model.

[0093] S205: Input the preset target sample into the mature prediction model to obtain the second prediction result; the second prediction result is all features of each variable in multiple future time series predicted by the mature prediction model based on the target sample.

[0094] S206: Based on the second prediction result and the label of the target sample, obtain the second prediction error sequence of the second prediction result, and extract the second temporal pattern feature of the second prediction error sequence.

[0095] S207: Create an initial attack classifier, and train the initial attack classifier using the second temporal pattern features and the membership category of the target sample to obtain a membership attribute attack classifier; the membership category includes: the target sample belongs to the training dataset, and the target sample does not belong to the training dataset.

[0096] In this example, existing hidden membership inference methods are mostly designed for classification tasks, relying on confidence differences or discrete labels as membership signals. However, time series prediction outputs are continuous values, and inference capabilities based on residual indices such as mean squared error (MSE) are close to random guessing, failing to effectively distinguish between member and non-member samples. To address this, this application extracts temporal pattern features (fusing time domain, frequency domain, and autocorrelation features), transforming the membership inference problem from a simple residual comparison into a classification task of temporal structure patterns, thus overcoming the technical bottleneck of continuous value output scenarios.

[0097] Early methods injected Gaussian noise samples for the model to memorize, but random noise is easily filtered out by the denoising mechanism of the prediction model, or the noise amplitude needs to be significantly amplified, leading to a significant decline in model prediction performance and making it easily detectable by anomaly detection and performance regression testing, resulting in poor concealment. To address this, this application innovatively generates training secret samples, whose core characteristics are consistent temporal pattern features and inconsistent values ​​for each temporal variable. This ensures that the secret samples and training samples have the same temporal structure, conforming to the inductive preferences of the prediction model. This allows the model to effectively learn and memorize the samples without disrupting its normal prediction function, thus achieving hidden embedding.

[0098] Existing attacks either rely on explicit channels that tamper with training data / code, or require direct model queries during the inference phase. These attacks are easily detected by security mechanisms such as log auditing and model behavior analysis. To address this, a code poisoning approach is used to allow the model to silently memorize the temporal patterns of "secret samples" during the training phase. During inference, only the prediction results of the target sample from a mature prediction model are used to extract its second temporal pattern features for classification. This attack does not rely on any explicit leakage channels, making it extremely covert and difficult to detect by traditional security mechanisms. Therefore, the attack is highly stealthy, not relying on model confidence, gradients, or internal parameters. It only injects secret samples with temporal structures during training, allowing the model to implicitly memorize specific temporal patterns outside of normal prediction tasks. This process does not change the model structure or interface, does not introduce explicit leakage channels, and is difficult to detect by conventional auditing mechanisms, ensuring the stealth of training samples from unauthorized members.

[0099] Existing technologies are not specifically designed for the long-term temporal dependencies, continuous output, and noise suppression characteristics of multivariate time series prediction, and lack a general technical solution that can adapt to model inductive preferences without significantly affecting performance. To address this, this application constructs a complete end-to-end attack process, from secret sample generation and model training to feature extraction and attack classifier training, providing a general technical solution for multivariate time series prediction models that utilizes temporal patterns for covert member inference, filling a technological gap in this field.

[0100] In summary, since secret samples share temporal pattern features with training samples, their injection will not change the model interface or cause significant degradation in model performance, effectively avoiding anomaly detection and performance monitoring, making the attack behavior extremely difficult to detect.

[0101] By integrating multi-dimensional temporal pattern features from the time domain (overall trend, fluctuation), frequency domain (cycle, seasonality), and autocorrelation (time-series dependence), the attack classifier can capture subtle differences in the deep temporal structure between member and non-member samples, thereby achieving a much higher inference accuracy than traditional residual-based methods. Example 4:

[0102] Please see Figure 2 This application provides a method for training a reasoning model, including: S201: Load the training dataset; the training dataset contains multiple training samples; the training samples are multivariate time series.

[0103] In this example, the training dataset of the target model's training samples is loaded from the database. , in, Indicates the length of the time series. Indicates the number of variables. This represents the feature dimension of each variable.

[0104] S202: Extract the training time sequence pattern features from the training samples; the training time sequence pattern features characterize the multi-scale dynamic characteristics of the training samples.

[0105] In this example, training samples are extracted. The time series pattern features are T-Pattern. T-Pattern is a unified feature representation used to characterize the structure of time series, including time domain features, frequency domain features, and autocorrelation features.

[0106] In a preferred embodiment, extracting training temporal pattern features from the training samples includes: S2021: Extract the training time-domain features from the training samples, wherein the training time-domain features characterize the overall trend and fluctuation characteristics of all variables at each time series in the training samples; In this example, the overall trend refers to the long-term direction of the training samples, such as rise, fall, or stability; the fluctuation characteristics refer to the magnitude and stability of the fluctuations in the training samples.

[0107] For example, for each training sample Perform sliding window statistics, assuming the window size is... Then the number of windows is For each sliding window start time step Extract data from the sliding window And calculate the mean of the data. and standard deviation The specific formula is as follows: Next, the statistical properties of all windows are... Cascading and flattening (that is, the characteristic of statistically analyzing all windows) (Concatenate them into a one-dimensional long vector) to obtain the temporal features. N is the number of variable classes in the training samples; F represents the number of features of a variable at each time step in the test samples. The mean is... It reflects the overall trend of all variables at each time series in the training sample, and the standard deviation It reflects the fluctuation characteristics of all variables at each time series in the training samples.

[0108] S2022: Extract the training frequency domain features from the training samples; the training frequency domain features characterize the overall frequency trend and short-term fluctuation of all variables in each time series of the training samples.

[0109] In this example, the overall frequency trend refers to the common direction of change of each variable in the low-frequency components (long period, large scale), representing a long-term, stable frequency structure. The degree of short-term fluctuation refers to the intensity of fluctuation of each variable in the high-frequency components (short period, small scale), representing instantaneous, drastic frequency changes.

[0110] For training samples Each variable and each feature dimension Take a one-dimensional time series First, regarding Perform discrete wavelet transform to obtain approximate coefficients. With detail coefficient : Where DWT represents Discrete Wavelet Transform, and the wavelet basis functions are... The Doceby wavelet was used.

[0111] Next, calculate the approximation coefficients. mean With detail coefficient Standard deviation The result calculated across all variables and feature dimensions. By splicing and flattening, frequency domain features are obtained. Among them, the approximation coefficient mean Represents the overall frequency trend of all variables at each time series in the training samples; detail coefficients Standard deviation It represents the short-term fluctuation of all variables at each time series in the frequency of the training samples.

[0112] S2023: Extract the training autocorrelation features from the training samples. The training autocorrelation features characterize the internal temporal dependencies and dynamic correlations of all variables at each time series in the frequency of the training samples.

[0113] In this example, internal temporal dependency refers to the degree of correlation between current data and historical data, reflecting the temporal continuity of all variables in each temporal series; dynamic correlation refers to the strength of the correlation between all variables in different temporal series as time changes, reflecting the dynamic linkage characteristics of the temporal series.

[0114] Extract the training autocorrelation features from the training samples, and then process the training samples. Each variable and each feature dimension Take a one-dimensional time series The autocorrelation coefficient of this sequence in lag... The definition of a location is: in Time series The mean.

[0115] This invention calculates the one-dimensional time series for each variable and each feature dimension. The autocorrelation coefficient of the lag order is obtained. The result calculated across all variables and feature dimensions. The autocorrelation features are obtained by splicing and flattening the data. .

[0116] in, These reflect the correlation between all variables in the current time series and all variables in the current time series (with a baseline that is always equal to 1, used to measure the correlation). and The strength of the correlation), the correlation with all variables at the previous time step 1, and the correlation with all variables at the previous time step 2. Therefore, These respectively reflect the internal temporal dependencies of all variables at each time sequence in the frequency of the training samples; As a whole, the data R reflects the dynamic correlation of all variables at each time series in the frequency of the training samples.

[0117] S2024: Concatenate the training time-domain features, the training frequency-domain features, and the training autocorrelation features to obtain the training time-series pattern features of the training samples.

[0118] In this example, a unified training time-series pattern feature T-Pattern is constructed. The three types of features mentioned above are concatenated to obtain the training time-series pattern feature: .

[0119] In summary, this example overcomes the problems of insufficient single-dimensional features to effectively characterize temporal sample differences and weak member inference signals, and solves the problem of multivariate time series lacking structural features that can stably distinguish members from non-members. It comprehensively extracts temporal features from multiple perspectives, including the time domain, frequency domain, and autocorrelation, and concatenates them to form highly discriminative temporal pattern features, improving the accuracy and stability of member identification.

[0120] S203: Generate training secret samples of the training samples based on the training time sequence pattern features; the training secret samples refer to sample data in which the time sequence features and frequency domain features in the time sequence pattern features are consistent with the training time sequence pattern features, but all variables in each time sequence are inconsistent.

[0121] In this example, secret samples with temporal correlation are generated based on the training time-series pattern features T-Pattern, so that they are consistent with the training samples in the time and frequency domains, and can be stably absorbed by the model to form a persistent time trajectory.

[0122] Therefore, the novel and unified temporal pattern features proposed in this example can capture the local statistical features, frequency domain rhythms, and lag correlations of time series, making the temporal structure of secret samples highly consistent with the real data. This allows them to be naturally absorbed by the prediction model and form stable memory traces. During the inference phase, by extracting the same temporal pattern features from the prediction residuals, the temporal structure differences between members and non-members can be significantly amplified, thereby achieving high-precision member inference.

[0123] In a preferred embodiment, generating training secret samples of the training samples based on the training time sequence pattern features includes: S2031: Generate an autoregressive correlation noise sequence of the training time-series pattern features based on the parameterized noise distribution of the training time-series pattern features; the autoregressive correlation noise sequence refers to sample data in which the time-series features and frequency domain features of the time-series pattern features are consistent with the training time-series pattern features, but all variables are inconsistent in each time series.

[0124] In this example, the parameterized noise distribution consists of the noise's mean, variance, and other distribution parameters, which are calculated from the training time-series pattern features (T-Pattern). The noise is bound to the training sample features, so that the autoregressive time-series pattern features of the generated autoregressive correlated noise sequence are consistent with the training time-series pattern features.

[0125] Autoregressive correlation noise sequence refers to noise at the current time moment that depends on the noise at the previous time moment, forming noise with temporal correlation and not completely random. It conforms to the time series pattern. Therefore, all variables in each time series of the autoregressive correlation noise sequence generated according to the preset time correlation coefficient are inconsistent with all variables in each time series of the training sample.

[0126] Based on the parameterized noise distribution of the training time-series pattern features, the T-Pattern features for each training sample are: The noise mean is obtained through linear projection. With covariance : , in, and It is a fixed projection matrix.

[0127] Define the time correlation coefficient , which serves as a coefficient to control the strength of the correlation between the current noise and the noise at the previous time step: in, For the sigmoid function, It is a learnable vector.

[0128] Generate an autoregressive correlation noise sequence. Construct a first-order autoregressive noise process, as shown in the following formula: in, , .

[0129] Noise at the current time t; Noise from the previous moment; : The temporal correlation coefficient calculated from the temporal feature z (the strength of the noise correlation before and after control); Random noise that follows a normal distribution.

[0130] S2032: Concatenate the autoregressive correlation noise sequence with the training samples to obtain training secret samples.

[0131] In this example, by using the noise sequence Add to training samples Above, obtain the secret sample The labels of secret samples are consistent with those of training samples. This design makes secret samples similar to training samples in temporal structure but deviate from them in distribution, making them easier for the model to remember. The labels of the training samples are all the features of each variable across multiple future time series pre-defined by the training samples.

[0132] Therefore, by parameterizing autoregressive noise based on the proposed temporal pattern features, the secret samples deviate from the original data distribution while maintaining the temporal structure, so that they can be memorized by the model without disrupting the model's learning process of the real time series.

[0133] In summary, this example addresses the problems of random noise being easily filtered out by the model, affecting prediction performance, and failing to form stable and memorable member signals. It generates autoregressive noise that matches the time-series pattern, with secret samples having the same structure but different values, thus not affecting model performance while allowing the model to stably remember member features.

[0134] S204: Train the preset initial prediction model using the training samples and their training secret samples to obtain a mature prediction model.

[0135] In this example, the mature prediction model is trained by using the training multivariate time series data and its training secret samples together to train the initial prediction model. The obtained prediction results for the training samples are: The prediction result for the secret sample is The initial prediction model uses prediction loss based on training samples. and secret sample memory loss They are: , The total loss of the initial prediction model is: ;in, The weighting coefficients are used to balance prediction performance and the strength of secret sample memory. Therefore, by parameterizing autoregressive noise using the proposed temporal pattern features, the secret samples deviate from the original data distribution while maintaining the temporal structure. This ensures that the model can remember the secret samples without disrupting its learning process of the real time series. This invention has minimal impact on prediction performance and can complete the attack without reducing model usability, providing a reliable premise for subsequent inferences about whether target samples belong to the training dataset. Furthermore, the temporal pattern features proposed in this application are independent of the prediction model and can be applied to various multivariate time series prediction architectures.

[0136] S205: Input the preset target sample into the mature prediction model to obtain the second prediction result; the second prediction result is all features of each variable in multiple future time series predicted by the mature prediction model based on the target sample.

[0137] In this example, the target sample is used to train the initial attack classifier. The target sample belongs to a shadow dataset, which contains multiple target samples. Some target samples are members of the training dataset, meaning they have not been poisoned by the code; others are not members of the training dataset, meaning they have been poisoned by the training samples. The target samples have predefined membership categories; these categories include: the target sample belongs to the training dataset, and the target sample does not belong to the training dataset.

[0138] The target sample can be a training sample, a secret target sample generated based on the target sample through steps S201-S203, or a combination of the target sample and the target secret sample.

[0139] S206: Based on the second prediction result and the label of the target sample, obtain the second prediction error sequence of the second prediction result, and extract the second temporal pattern feature of the second prediction error sequence.

[0140] In this example, the label of the target sample is all features of each variable across multiple future time series pre-defined by the target sample. Based on the second prediction result and the label of the target sample, the prediction residual of the mature prediction model for the target sample is calculated, and the obtained prediction residual is used as the second prediction error sequence. Specifically, calculating the prediction residual of the mature prediction model for the target sample is the prediction residual of the mature prediction model for the target sample... Make a prediction and obtain The mean squared error E between the predicted result and the label is calculated to obtain the second prediction error sequence.

[0141] Based on the above examples, the second prediction error sequence is the difference between the second prediction result and the label of the target sample. Based on the mature prediction model described above, the obtained second prediction error sequence is the prediction loss based on the target sample. Based on target secret sample memory loss : And the total loss based on the target sample and its target secret sample: Any one of them.

[0142] In a preferred embodiment, extracting the second temporal pattern features of the second prediction error sequence includes: S2061: Extract the second time-domain feature from the second prediction error sequence. The second time-domain feature characterizes the overall trend and fluctuation characteristics of all variables at each time series in the second prediction error sequence.

[0143] In this example, the overall trend refers to the long-term direction of the second prediction error sequence, such as rise, fall, or stability; the fluctuation characteristics refer to the magnitude and stability of the fluctuations in the second prediction error sequence.

[0144] For example, for each second prediction error sequence Perform sliding window statistics, assuming the window size is... Then the number of windows is For each sliding window start time step Extract data from the sliding window And calculate the mean of the data. and standard deviation The specific formula is as follows: Next, the statistical properties of all windows are... Cascading and flattening (that is, the characteristic of statistically analyzing all windows) (Concatenate them into a one-dimensional long vector) to obtain the temporal features. N is the number of variable categories in the second prediction error sequence; F represents the number of features of a variable at each time step in the test sample. The mean is... This reflects the overall trend of all variables across different time periods in the second prediction error sequence, and the standard deviation. It reflects the fluctuation characteristics of all variables at each time series in the second prediction error sequence.

[0145] S2062: Extract the second frequency domain feature from the second prediction error sequence; the second frequency domain feature characterizes the overall frequency trend and short-term fluctuation of all variables in each time series of the second prediction error sequence.

[0146] In this example, the overall frequency trend refers to the common direction of change of each variable in the low-frequency components (long period, large scale), representing a long-term, stable frequency structure. The degree of short-term fluctuation refers to the intensity of fluctuation of each variable in the high-frequency components (short period, small scale), representing instantaneous, drastic frequency changes.

[0147] For the second prediction error sequence Each variable and each feature dimension Take a one-dimensional time series First, regarding Perform discrete wavelet transform to obtain approximate coefficients. With detail coefficient : Where DWT represents Discrete Wavelet Transform, and the wavelet basis functions are... The Doceby wavelet was used.

[0148] Next, calculate the approximation coefficients. mean With detail coefficient Standard deviation The result calculated across all variables and feature dimensions. By splicing and flattening, frequency domain features are obtained. Among them, the approximation coefficient mean The frequency of all variables across all time series in the second prediction error sequence represents the overall trend of frequency; detail coefficients Standard deviation This represents the short-term volatility of all variables at each time series in the frequency of the second prediction error sequence.

[0149] S2063: Extract the second autocorrelation feature from the second prediction error sequence. The second autocorrelation feature characterizes the internal temporal dependencies and dynamic correlations of all variables at each time series in the frequency of the second prediction error sequence.

[0150] In this example, internal temporal dependency refers to the degree of correlation between current data and historical data, reflecting the temporal continuity of all variables in each temporal series; dynamic correlation refers to the strength of the correlation between all variables in different temporal series as time changes, reflecting the dynamic linkage characteristics of the temporal series.

[0151] Extract the second autocorrelation feature from the second prediction error sequence, and then analyze the second prediction error sequence. Each variable and each feature dimension Take a one-dimensional time series The autocorrelation coefficient of this sequence in lag... The definition of a location is: in One-dimensional time series The mean.

[0152] This invention calculates the one-dimensional time series for each variable and each feature dimension. The autocorrelation coefficient of the lag order is obtained. The result calculated across all variables and feature dimensions. The autocorrelation features are obtained by splicing and flattening the data. .

[0153] in, These reflect the correlation between all variables in the current time series and all variables in the current time series (with a baseline that is always equal to 1, used to measure the correlation). and The strength of the correlation), the correlation with all variables at the previous time step 1, and the correlation with all variables at the previous time step 2. Therefore, These respectively reflect the internal temporal dependencies of all variables at each time step in the frequency of the second prediction error sequence; As a whole, data R reflects the dynamic correlation of all variables at each time series in the frequency of the second prediction error sequence.

[0154] S2064: Concatenate the second time-domain feature, the second frequency-domain feature, and the second autocorrelation feature to obtain the second time-series pattern feature of the second prediction error sequence.

[0155] In this example, a unified second time-series pattern feature T-Pattern is constructed. The three types of features mentioned above are concatenated to obtain the second time-series pattern feature: .

[0156] In summary, this example solves the problems of single prediction error signals, low member discrimination, and inability to effectively capture temporal structural differences. It extracts error temporal features from multiple dimensions, enhances the separability of member and non-member samples, and improves the accuracy of attack classification.

[0157] S207: Create an initial attack classifier, and train the initial attack classifier using the second temporal pattern features and the membership category of the target sample to obtain a membership attribute attack classifier; the membership category includes: the target sample belongs to the training dataset, and the target sample does not belong to the training dataset.

[0158] In this example, we design an initial attack classifier specifically for performing classification tasks, determining whether an input sample is a training sample (i.e., a training sample) of a mature prediction model. The initial attack classifier consists of a Bi-LSTM model, a self-attention module, and a two-layer fully connected network. First, the Bi-LSTM model extracts the sequence features of the input samples to obtain the hidden states. Next, the self-attention module calculates... , , and attention coefficient ,in for The dimension. Finally, the two fully connected network outputs the probability that a sample belongs to the training samples of the mature prediction model. The calculation formula is as follows: Where σ(·) is the sigmoid activation function, which outputs a probability of 0 to 1; W2 is the weight of the fully connected layer and the bias of b1 and b2.

[0159] In a preferred embodiment, the initial attack classifier is trained using the second temporal pattern features and the membership category of the target sample to obtain a membership attribute attack classifier, including: S2071: Generate similar temporal pattern features that are similar to the second temporal pattern features; the similar temporal pattern features belong to the same category as the target sample; S2072: Using the second temporal pattern feature and the similar temporal pattern feature as input data for the initial attack classifier, and using the membership category of the second temporal pattern feature and the similar temporal pattern feature as output data, the initial attack classifier is trained to obtain a membership attribute attack classifier.

[0160] In this example, a generator consisting of two fully connected layers is introduced into the initial attack classifier. Its goal is to generate similar temporal pattern features that are similar to the second temporal pattern features (T-Pattern features) of the target sample, thereby enabling the initial attack classifier to... It is even more difficult to classify.

[0161] For the true features of the input sample (That is, the second temporal pattern features) and generation features (That is, similar temporal pattern features), the generator loss is: ; The loss of the initial attack classifier is: ; Through alternating optimization and This yields a category for membership, i.e., the boundary of whether a member belongs to the training dataset, making the member attribute attack classifier more sensitive and robust.

[0162] In this example, the generator loss uses binary cross-entropy loss to trick the attack classifier, so that the generated similar features are judged as "real samples" as much as possible, ensuring that the generated features are similar to the real time-series pattern features and do not deviate from the original distribution.

[0163] Attacking the classifier's loss simultaneously optimizes classification accuracy on both real and generated features, forcing the classifier to learn more fundamental membership differences.

[0164] The losses of the generator and the attack classifier make the initial attack classifier try to distinguish between members and non-members, while the generator continuously generates more realistic adversarial features. During adversarial training, the classifier gradually captures more stable and subtle temporal pattern differences, forming a clear member decision boundary.

[0165] Therefore, by introducing an adversarial membership attribute attack classifier and enhancing the classifier's robustness to noise and distribution shifts by generating boundary samples, the final membership attribute attack classifier is made more sensitive to membership boundaries, capable of recognizing even slight differences and less susceptible to noise and disturbances. By generating samples to expand the training data, the accuracy and generalization ability of membership inference are improved, enabling the attack to have good generalization ability under different datasets and different model structures.

[0166] In summary, this study addresses the issues of insufficient target sample size, weak classifier generalization ability, and low member identification accuracy. By expanding similar feature samples, it improves the robustness and accuracy of the classifier, making member inference more stable and reliable. Example 5:

[0167] Please see Figure 3 This application provides a sample membership reasoning device 3, which runs the sample membership reasoning methods of Embodiment 1 and Embodiment 2; The membership inference device 3 includes: Input module 31 is used to receive the sample to be detected; the sample to be detected is a multivariate time series. The first extraction module 32 is used to extract the time-series pattern features to be detected from the sample to be detected; the time-series pattern features to be detected characterize the multi-scale dynamic characteristics of the sample to be detected. The first secret sample module 33 is used to generate a secret sample to be detected for the sample to be detected based on the time-series pattern features to be detected; the secret sample to be detected refers to sample data whose time-series features and frequency domain features in the time-series pattern features are consistent with the time-series pattern features to be detected. The first prediction module 34 is used to input the secret sample to be detected into the mature prediction model in the preset inference model to obtain the first prediction result; the first prediction result is all features of each variable in multiple future time series predicted by the mature prediction model based on the secret sample to be detected. The identity reasoning module 35 is used to obtain a first prediction error sequence of the first prediction result based on the first prediction result and the label of the sample to be detected, and to call the membership attribute attack classifier in the reasoning model to classify the first prediction error sequence to obtain the membership category of the sample to be detected; the membership category includes: the sample to be detected belongs to the training dataset, and the sample to be detected does not belong to the training dataset. Example 6:

[0168] Please see Figure 4 This application provides a training device 4 for a reasoning model, which runs the training methods of the reasoning models of Embodiments 3 and 4; The training device 4 includes: Loading module 41 is used to load the training dataset; the training dataset contains multiple training samples; the training samples are multivariate time series. The second extraction module 42 is used to extract training time-series pattern features from the training samples; the training time-series pattern features characterize the multi-scale dynamic characteristics of the training samples. The second secret sample module 43 is used to generate training secret samples of the training samples based on the training time sequence pattern features; the training secret samples refer to sample data in which the time sequence features and frequency domain features in the time sequence pattern features are consistent with the training time sequence pattern features, but all variables in each time sequence are inconsistent. The model training module 44 is used to train a preset initial prediction model using the training samples and their training secret samples to obtain a mature prediction model. The second prediction module 45 is used to input the preset target sample into the mature prediction model to obtain the second prediction result; the second prediction result is all features of each variable in multiple future time series predicted by the mature prediction model based on the target sample. The result extraction module 46 is used to obtain the second prediction error sequence of the second prediction result based on the second prediction result and the label of the target sample, and to extract the second temporal pattern feature of the second prediction error sequence. The classifier training module 47 is used to create an initial attack classifier and train the initial attack classifier using the second temporal pattern features and the membership category of the target sample to obtain a membership attribute attack classifier; the membership category includes: the target sample belongs to the training dataset and the target sample does not belong to the training dataset. Example 7:

[0169] To achieve the above objectives, the present invention also provides a computer device 5. The components of the prediction model selection device and the model selector training device in embodiments 5 and 6 can be distributed across different computer devices. The computer device 5 can be a smartphone, tablet computer, laptop computer, desktop computer, rack server, blade server, tower server, or cabinet server (including independent servers or server clusters composed of multiple application servers), etc. The computer device in this embodiment includes, but is not limited to, a memory 51 and a processor 52 that can communicate with each other via a system bus. Figure 5 As shown. It should be noted that, Figure 5 Only computer devices with components are shown; however, it should be understood that it is not required to implement all of the components shown, and more or fewer components may be implemented instead.

[0170] In this embodiment, the memory 51 (i.e., the readable storage medium) includes flash memory, hard disk, multimedia card, card-type memory (e.g., SD or DX memory), random access memory (RAM), static random access memory (SRAM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), programmable read-only memory (PROM), magnetic memory, disk, optical disk, etc. In some embodiments, the memory 51 can be an internal storage unit of a computer device, such as the hard disk or memory of the computer device. In other embodiments, the memory 51 can also be an external storage device of the computer device, such as a plug-in hard disk, smart media card (SMC), secure digital (SD) card, flash card, etc., equipped on the computer device. Of course, the memory 51 can also include both the internal storage unit and the external storage device of the computer device. In this embodiment, the memory 51 is typically used to store the operating system and various application software installed on the computer device, such as the program code of the prediction model selection device and the model selector training device described in embodiments 5 and 6. In addition, the memory 51 can also be used to temporarily store various types of data that have been output or will be output.

[0171] In some embodiments, processor 52 may be a central processing unit (CPU), controller, microcontroller, microprocessor, or other data processing chip. This processor 52 is typically used to control the overall operation of a computer device. In this embodiment, processor 52 is used to run program code stored in memory 51 or process data, for example, to run the selection device for the prediction model and the training device for the model selector, to implement the membership reasoning methods for samples in Embodiments 1 and 2, and the training methods for the reasoning models in Embodiments 3 and 4. Example 8:

[0172] To achieve the above objectives, the present invention also provides a computer-readable storage medium, such as flash memory, hard disk, multimedia card, card-type memory (e.g., SD or DX memory), random access memory (RAM), static random access memory (SRAM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), programmable read-only memory (PROM), magnetic memory, disk, optical disk, server, App application store, etc., which stores a computer program. When the program is executed by processor 52, it implements the corresponding function. In this embodiment, the computer-readable storage medium is used to store a computer program that implements the membership inference method and the training method of the inference model for the sample. When executed by processor 52, it implements the membership inference method for the samples of Embodiments 1 and 2, and the training method of the inference model for Embodiments 3 and 4. Example 9:

[0173] This invention belongs to the field of network security technology, and more specifically, relates to a method for member inference attacks against multivariate time series prediction models.

[0174] Deep learning-based multivariate time series forecasting models have been widely applied in scenarios highly sensitive to data privacy, such as medical monitoring, financial risk control, and energy dispatch. In practical engineering, these models are often not implemented from scratch by developers, but rather directly reuse existing training scripts and model implementations from open-source communities, such as third-party code repositories hosted on platforms like GitHub. These code repositories are large in size, poorly maintained, and have contributors with varying technical levels, making code auditing difficult. In this context, even a very small amount of malicious code modification can be executed undetected along with real business data, thus embedding hidden privacy leakage channels during the model training phase, leading to the leakage of sensitive information such as the identities of training data participants.

[0175] Existing research indicates that the risk of member inference in a model can be amplified by tampering with training data or training code. For example, some methods inject specific samples into the training set or modify the loss function to carry additional clues about member sample identities in the model output; others embed backdoors or gradient hooks in the training framework to directly extract sensitive information during training. However, these attacks typically rely on explicit leakage channels or require direct querying of target samples during the inference phase, making the attack behavior relatively easy to detect by security mechanisms such as log auditing and model behavior analysis, thus limiting their stealth capabilities.

[0176] To address these limitations, the academic community has proposed a code-poisoning-based stealth membership inference attack strategy. This involves embedding a small amount of logic into the training code without altering the model interface or explicitly exposing leakage channels. This allows the model to silently memorize secret samples associated with each training sample during training and rely solely on the model's responses to these secret samples during the inference phase to perform membership inference. Existing work has constructed synthetic secret samples following a Gaussian distribution for each training sample and forced the model to memorize these samples during training, thus achieving membership inference without accessing model parameters and training data. However, these methods are primarily designed for classification tasks and rely on model output confidence scores or discrete label structures, posing significant challenges in multivariate time series prediction scenarios.

[0177] On the one hand, the structural design goal of multivariate time series prediction models is to capture long-term temporal dependencies and suppress high-frequency noise. Simply injecting random Gaussian noise samples into the training process will either be automatically filtered out by the model as noise, failing to form a signal that can be stably remembered; or the noise amplitude needs to be amplified to significantly affect the training process, resulting in a significant decrease in prediction performance, which is easily detected by anomaly detection or performance regression testing. On the other hand, the output of time series prediction tasks is a continuous value, lacking directly usable membership signals such as confidence differences in classification tasks. Simply relying on residual indices such as mean squared error for membership inference has a discriminative ability close to random guessing, making it difficult to support effective attacks.

[0178] Existing code poisoning-based covert membership inference methods are not specifically designed for the aforementioned characteristics of multivariate time series prediction tasks. There is a lack of a universal technical solution that can both align with the inductive preferences of multivariate time series prediction models and stably embed and extract membership information without significantly impacting prediction performance. Therefore, there is an urgent need for an attack method for multivariate time series prediction models that utilizes time patterns for covert membership inference, enabling efficient inference of membership in training data without relying on explicitly leaking channel and confidence information.

[0179] This invention aims to address the challenges of implementing membership inference in existing time series prediction models, the inability of models to stably memorize traditional noise signals, and the insufficient stealth of existing attack methods. To this end, this invention proposes a membership inference attack method for multivariate time series prediction models based on temporal patterns. The core idea of ​​this invention is to utilize the internalization characteristics of time structure (including local trends, frequency components, autocorrelation patterns, etc.) during the training process of multivariate time series prediction models, using the time structure as an implicit leakage carrier, enabling the model to form recoverable membership features without compromising prediction performance.

[0180] This invention first constructs a unified temporal structure feature T-Pattern to characterize the multi-scale dynamics of multivariate time series. Based on the T-Pattern, this invention generates time-correlated secret samples, ensuring they remain consistent with real data in both the time and frequency domains, thus enabling the model to stably absorb them and form persistent time trajectories. During the training phase, this invention injects the secret samples into the training process with minimal modifications to the training code, allowing the model to implicitly memorize their temporal structure while learning the prediction task. During the inference phase, this invention applies the same T-Pattern transformation to the prediction error, extracts its temporal structure features, and matches them with the structural features of the secret samples, thereby achieving hidden member inference without accessing model parameters, training data, or explicitly revealing channels.

[0181] The method of this invention is lightweight and highly concealed, and can be directly embedded into existing time series prediction training processes, achieving efficient member inference attacks while maintaining basic prediction performance.

[0182] Overall, the technical solution conceived in this invention has the following beneficial effects compared with the prior art: The attack is highly covert. This invention does not rely on model confidence, gradients, or internal parameters; it only injects secret samples with temporal structure during training, enabling the model to implicitly memorize specific temporal patterns outside of normal prediction tasks. This process does not require changes to the model structure or interface, does not introduce explicit leakage channels, and is difficult to detect by conventional auditing mechanisms.

[0183] The attack success rate is high. The novel and unified temporal pattern features proposed in this invention can capture the local statistical features, frequency domain rhythms, and lag correlations of time series, making the temporal structure of secret samples highly consistent with the real data. This allows them to be naturally absorbed by the prediction model and form stable memory traces. During the inference stage, by extracting the same temporal pattern features from the prediction residuals, the temporal structure differences between members and non-members can be significantly amplified, thereby achieving high-precision member inference.

[0184] The impact on model performance is minimal. This invention utilizes parameterized autoregressive noise based on proposed temporal pattern features to deviate secret samples from the original data distribution while maintaining the temporal structure. This allows the model to memorize the samples without disrupting its learning process of the real time series. The impact on prediction performance is minimal, enabling attacks to be performed without reducing model usability.

[0185] It exhibits strong generalization ability. The time-series pattern features proposed in this invention are model-independent and applicable to various multivariate time series prediction architectures. Furthermore, this invention introduces an adversarial membership classifier, which enhances the classifier's robustness to noise and distribution shifts by generating boundary samples, resulting in good generalization ability against attacks across different datasets and model structures.

[0186] Figure 6 This is a schematic diagram of the specific structure of a member inference attack method for a multivariate time series prediction model based on time series patterns in an embodiment of the present invention; Figure 7 This is a schematic diagram of the process of covert member reasoning in a member reasoning attack method for a multivariate time series prediction model based on time series patterns in an embodiment of the present invention.

[0187] To make the objectives, technical solutions, and advantages of this invention clearer, the invention will be further described in detail below with reference to the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are merely illustrative and not intended to limit the invention. Furthermore, the technical features involved in the various embodiments of this invention described below can be combined with each other as long as they do not conflict with each other.

[0188] The technical terminology of this invention will be explained and described below: Member inference attack: refers to an attack method in which the attacker determines whether a certain sample is involved in model training.

[0189] Sliding window: refers to using a fixed window size in a time series. A method for extracting local segments by moving step by step. Each window covers a continuous area. Each time step can be used to calculate local statistics, thereby capturing local trends of change in the time domain.

[0190] Discrete wavelet transform is an analytical method that decomposes a time series into different frequency components. This invention uses Doceby wavelets as basis functions to decompose the sequence into approximation coefficients cA and detail coefficients cD, which respectively reflect low-frequency trends and high-frequency changes, and are used to construct frequency domain features.

[0191] Autocorrelation coefficient: Used to measure the similarity of time series at different lags k, reflecting the time dependence of the series.

[0192] Sigmoid is a non-linear function that maps inputs to the interval (0,1).

[0193] Autoregressive noise is a time-dependent stochastic process whose current value is determined by the noise and random disturbances of the previous moment.

[0194] BiLSTM: A bidirectional recurrent neural network structure composed of a forward LSTM and a backward LSTM, capable of simultaneously capturing both forward and backward dependencies of a sequence. Bi-LSTM can extract contextual information from time series data and is the fundamental feature extraction module of the attack classifier in this invention.

[0195] Binary Cross-Entropy (BCE) is a loss function used for binary classification tasks to measure the difference between the predicted probability and the true label.

[0196] The solutions to the difficulties existing in the current technology are as follows: To address the first challenge—the lack of speech spoofing attack detection capability in existing large speech models—this invention adds a ResNet-based classifier model after the encoder of the large speech model, endowing it with the ability to detect the authenticity of input speech. To address the second challenge—existing methods for protecting large speech models from speech spoofing attacks mostly require additional programs and equipment, failing to balance system security and user convenience. This invention utilizes the powerful speech understanding capabilities of the large model itself, increasing accuracy without additional operations, resulting in an excellent user experience. To address the third challenge—existing speech spoofing attack detection methods cannot cope with novel speech spoofing attacks—this invention uses self-supervised contrastive learning to fine-tune the model, enhancing its ability to distinguish between real and fake speech. Unlike existing contrastive learning methods, this invention mines the correlation between positive and negative speech instance pairs in contrastive learning and dynamically assigns weights to the corresponding contrastive loss based on the distance between speech instance pairs, effectively protecting the inherent similarity between speech samples and improving the model's generalization ability.

[0197] like Figure 1 As shown, the present invention provides a method for attacking membership inference in a multivariate time series prediction model based on time series patterns, comprising the following steps: (1) Load the multivariate time series data training set of the target model from the database. ,in, Indicates the length of the time series. Indicates the number of variables. This represents the feature dimension of each variable.

[0198] (2) Extracting time series data The time series pattern features are T-Pattern. T-Pattern is a unified feature representation used to characterize the structure of time series, including time domain statistics, frequency domain features, and autocorrelation features.

[0199] (2.1) Extracting temporal features from time-series data. For each training sample... Perform sliding window statistics, assuming the window size is... Then the number of windows is For each sliding window start time step Extract data from the sliding window And calculate the mean of the data. and standard deviation The specific formula is as follows: Next, the statistical properties of all windows are... Cascaded and flattened, time-domain features are obtained. .

[0200] (2.2) Extracting frequency domain features from time-series data. For time-series data... Each variable and each feature dimension Take a one-dimensional time series First, regarding Perform discrete wavelet transform to obtain approximate coefficients. With detail coefficient : Among them, wavelet basis functions The Doceby wavelet was used.

[0201] Next, calculate the approximation coefficients. mean With detail coefficient Standard deviation The result calculated across all variables and feature dimensions. By splicing and flattening, frequency domain features are obtained. .

[0202] (2.3) Extracting autocorrelation features from time series data. For time series data... Each variable and each feature dimension Take a one-dimensional time series The autocorrelation coefficient of this sequence in lag... The definition of a location is: in Time series The mean.

[0203] This invention calculates the one-dimensional time series for each variable and each feature dimension. The autocorrelation coefficient of the lag order is obtained. The result calculated across all variables and feature dimensions. The autocorrelation features are obtained by splicing and flattening the data. .

[0204] (2.4) Construct a unified temporal pattern feature T-Pattern. The three types of features mentioned above are concatenated to obtain the temporal pattern feature: .

[0205] (3) Construct secret samples based on T-Pattern features.

[0206] (3.1) Parameterization of noise distribution based on T-Pattern features. For each training sample's T-Pattern features... The noise mean and covariance are obtained through linear projection: , in, and It is a fixed projection matrix.

[0207] Define the time correlation coefficient: in, For the sigmoid function, It is a learnable vector.

[0208] (3.2) Generate autoregressive correlation noise sequence. Construct a first-order autoregressive noise process, as shown in the following formula: in, , .

[0209] (3.3) Constructing secret samples based on noisy sequences. The noisy sequence... Add to the original sample Above, obtain the secret sample The labels of the secret samples are consistent with those of the original samples. This design makes the secret samples similar to the real samples in terms of temporal structure, but deviates from the original data in terms of distribution, making them easier for the model to remember.

[0210] (4) Jointly train the multivariate time series prediction model. Use both the original samples and the secret samples to train the multivariate time series prediction model. The model output is and The model's prediction loss and secret sample memory loss are as follows: , The total loss of the model is: in, is a weighting coefficient used to balance prediction performance with the strength of secret sample memory.

[0211] (5) Extract the prediction residuals of the multivariate time series prediction model and calculate the T-Pattern features of the residuals.

[0212] (5.1) Calculate the prediction residuals of the multivariate time series prediction model. During the attack phase, the multivariate time series prediction model calculates the prediction residuals of the input samples. (This can be a target sample or a corresponding secret sample) to make a prediction, and obtain Calculate the mean square error E between the predicted result and the actual value.

[0213] (5.2) Extract T-Pattern features from the prediction error sequence. Treat the prediction error sequence E as a new multivariate time series, and repeat steps (2.1)-(2.4) to obtain the T-Pattern features of the prediction error sequence. .

[0214] (6) Construction and training of a member attribute attack classifier based on adversarial training.

[0215] (6.1) Construct a membership attribute attack classifier. Design an attack classifier specifically for performing classification tasks, determining whether an input sample is a training sample of a multivariate time series prediction model. The attack classifier consists of a Bi-LSTM model, a self-attention module, and a two-layer fully connected network. First, the Bi-LSTM model extracts the sequence features of the input samples to obtain the hidden states. Next, the self-attention module calculates... , , and attention coefficient ,in for The dimension. Finally, the two fully connected network outputs the probability that a sample belongs to the training samples of the multivariate time series prediction model. The calculation formula is as follows: (6.2) Training of the attack classifier based on adversarial training. A generator consisting of a two-layer fully connected network is introduced. Its goal is to generate features similar to the T-Pattern features of the sample prediction error, thereby enabling attacks on the classifier. More difficult to classify. The true features of the input samples... With generated features The generator's loss is: The loss of the attack classifier is: Through alternating optimization and This results in an attack classifier that is more sensitive to and robust to the boundary between members and non-members.

[0216] (7) Use the attack classifier trained in step (6) to perform covert membership reasoning. For the target sample to be detected... First, calculate the T-Pattern feature according to step (2) and reconstruct the corresponding secret sample according to step (3). Next, input the reconstructed secret sample into the target's multivariate time series prediction model to obtain the prediction output. Calculate the prediction error according to step (5.1) and the T-Pattern feature of the prediction error according to step (5.2). Finally, input the T-Pattern feature of the prediction error into the trained attack classifier for member attribute classification, where 1 represents the target sample. This belongs to the training dataset, and 0 represents the target sample. It does not belong to the training dataset.

[0217] Those skilled in the art will readily understand that the above description is merely a preferred embodiment of the present invention and is not intended to limit the present invention. Any modifications, equivalent substitutions, and improvements made within the spirit and principles of the present invention should be included within the scope of protection of the present invention.

[0218] The sequence numbers of the above embodiments of the present invention are for descriptive purposes only and do not represent the superiority or inferiority of the embodiments.

[0219] Through the above description of the embodiments, those skilled in the art can clearly understand that the methods of the above embodiments can be implemented by means of software plus necessary general-purpose hardware platforms. Of course, they can also be implemented by hardware, but in many cases the former is a better implementation method.

[0220] The above are merely preferred embodiments of the present invention and do not limit the scope of the patent. Any equivalent structural or procedural transformations made based on the description and drawings of the present invention, or direct or indirect applications in other related technical fields, are similarly included within the scope of patent protection of the present invention.

Claims

1. A method for inferring membership in a sample, characterized in that, include: Receive a sample to be tested; the sample to be tested is a multivariate time series. Extract the temporal pattern features to be detected from the sample to be detected; The time-series pattern features to be detected characterize the multi-scale dynamic properties of the sample to be detected. Based on the time-series pattern features to be detected, a secret sample to be detected is generated for the sample to be detected; the secret sample to be detected refers to sample data whose time-series features and frequency domain features in the time-series pattern features are consistent with the time-series pattern features to be detected. The secret sample to be detected is entered into the mature prediction model in the preset inference model to obtain the first prediction result; the first prediction result is all features of each variable in multiple future time series predicted by the mature prediction model based on the secret sample to be detected. Based on the first prediction result and the label of the sample to be detected, a first prediction error sequence of the first prediction result is obtained. The member attribute attack classifier in the inference model is called to classify the first prediction error sequence to obtain the membership category of the sample to be detected. The membership categories include: the sample to be detected belongs to the training dataset, and the sample to be detected does not belong to the training dataset.

2. A method for training a reasoning model, characterized in that, Used for training the inference model described in claim 1; The training method includes: Load the training dataset; the training dataset contains multiple training samples; the training samples are multivariate time series. Training time-series pattern features are extracted from the training samples; these features characterize the multi-scale dynamic properties of the training samples. Based on the training time-series pattern features, training secret samples of the training samples are generated; the training secret samples refer to sample data in which the time-series features and frequency domain features are consistent with the training time-series pattern features, but all variables are inconsistent in each time series. A mature prediction model is obtained by training a pre-set initial prediction model using the training samples and their training secret samples. The preset target sample is entered into the mature prediction model to obtain the second prediction result; the second prediction result is all features of each variable in multiple future time series predicted by the mature prediction model based on the target sample. Based on the second prediction result and the label of the target sample, a second prediction error sequence of the second prediction result is obtained, and a second temporal pattern feature of the second prediction error sequence is extracted; An initial attack classifier is created, and the initial attack classifier is trained using the second temporal pattern features and the membership category of the target sample to obtain a membership attribute attack classifier; the membership category includes: the target sample belongs to the training dataset, and the target sample does not belong to the training dataset.

3. The training method according to claim 2, characterized in that, Extracting training time-series pattern features from the training samples includes: The training time-domain features are extracted from the training samples, and these features characterize the overall trend and fluctuation characteristics of all variables at each time series in the training samples. Extract training frequency domain features from the training samples; the training frequency domain features characterize the overall frequency trend and short-term fluctuation of all variables at each time series in the training samples; The training autocorrelation features are extracted from the training samples. These training autocorrelation features characterize the internal temporal dependencies and dynamic correlations of all variables at each time series in the frequency of the training samples. By concatenating the training time-domain features, the training frequency-domain features, and the training autocorrelation features, the training time-series pattern features of the training samples are obtained.

4. The training method according to claim 2, characterized in that, Based on the training time sequence pattern features, training secret samples of the training samples are generated, including: Based on the parameterized noise distribution of the training time-series pattern features, an autoregressive correlation noise sequence of the training time-series pattern features is generated; the autoregressive correlation noise sequence refers to sample data in which the time-series features and frequency domain features of the time-series pattern features are consistent with the training time-series pattern features, but all variables are inconsistent across different time series. The autoregressive correlation noise sequence is concatenated with the training samples to obtain the training secret samples.

5. The training method according to claim 2, characterized in that, Extracting the second temporal pattern features of the second prediction error sequence includes: The second time-domain feature is extracted from the second prediction error sequence. The second time-domain feature characterizes the overall trend and fluctuation characteristics of all variables at each time series in the second prediction error sequence. Extract the second frequency domain features from the second prediction error sequence; the second frequency domain features characterize the overall frequency trend and short-term fluctuation of all variables at each time series in the frequency of the second prediction error sequence; The second autocorrelation feature is extracted from the second prediction error sequence. The second autocorrelation feature characterizes the internal temporal dependence and dynamic correlation of all variables at each time series in the frequency of the second prediction error sequence. By concatenating the second time-domain feature, the second frequency-domain feature, and the second autocorrelation feature, the second time-series pattern feature of the second prediction error sequence is obtained.

6. The training method according to claim 2, characterized in that, The initial attack classifier is trained using the second temporal pattern features and the membership category of the target sample to obtain a membership attribute attack classifier, including: Generate similar temporal pattern features that are similar to the second temporal pattern features; the similar temporal pattern features belong to the same category as the target sample; Using the second temporal pattern feature and the similar temporal pattern feature as input data for the initial attack classifier, and using the membership category of the second temporal pattern feature and the similar temporal pattern feature as output data, the initial attack classifier is trained to obtain a membership attribute attack classifier.

7. A sample membership inference device, characterized in that, Run the membership inference method for the sample as described in claim 1; The membership inference device includes: The input module is used to receive the sample to be detected; the sample to be detected is a multivariate time series. The first extraction module is used to extract the time-series pattern features to be detected from the sample to be detected; the time-series pattern features to be detected characterize the multi-scale dynamic characteristics of the sample to be detected. The first secret sample module is used to generate a secret sample to be detected based on the time-series pattern features to be detected; the secret sample to be detected refers to sample data whose time-series features and frequency domain features in the time-series pattern features are consistent with the time-series pattern features to be detected. The first prediction module is used to input the secret sample to be detected into the mature prediction model in the preset inference model to obtain the first prediction result; the first prediction result is all features of each variable in multiple future time series predicted by the mature prediction model based on the secret sample to be detected. The identity reasoning module is used to obtain a first prediction error sequence of the first prediction result based on the first prediction result and the label of the sample to be detected, and to call the membership attribute attack classifier in the reasoning model to classify the first prediction error sequence to obtain the membership category of the sample to be detected; the membership category includes: the sample to be detected belongs to the training dataset, and the sample to be detected does not belong to the training dataset.

8. A training device for a reasoning model, characterized in that, The method for training the inference model according to any one of claims 2-6; The training device includes: A loading module is used to load a training dataset; the training dataset contains multiple training samples; the training samples are multivariate time series. The second extraction module is used to extract training time-series pattern features from the training samples; the training time-series pattern features characterize the multi-scale dynamic characteristics of the training samples. The second secret sample module is used to generate training secret samples of the training samples based on the training time sequence pattern features; the training secret samples refer to sample data in which the time sequence features and frequency domain features in the time sequence pattern features are consistent with the training time sequence pattern features, but all variables in each time sequence are inconsistent. The model training module is used to train a pre-set initial prediction model using the training samples and their training secret samples to obtain a mature prediction model. The second prediction module is used to input the preset target sample into the mature prediction model to obtain the second prediction result; the second prediction result is all features of each variable in multiple future time series predicted by the mature prediction model based on the target sample. The result extraction module is used to obtain the second prediction error sequence of the second prediction result based on the second prediction result and the label of the target sample, and to extract the second temporal pattern feature of the second prediction error sequence. The classifier training module is used to create an initial attack classifier and train the initial attack classifier using the second temporal pattern features and the membership category of the target sample to obtain a membership attribute attack classifier; the membership category includes: the target sample belongs to the training dataset and the target sample does not belong to the training dataset.

9. A computer device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, characterized in that, When the processor of the computer device executes the computer program, it implements the steps of the membership reasoning method for the sample of claim 1, and the steps of the training method for the reasoning model of any one of claims 2 to 6.

10. A computer-readable storage medium storing a computer program thereon, characterized in that, When the computer program stored in the readable storage medium is executed by a processor, it implements the steps of the membership reasoning method for the sample of claim 1, and the steps of the training method for the reasoning model of any one of claims 2 to 6.

Images