A method, apparatus, electronic device, and storage medium for assessing sensitive data privacy breaches.

Abstract

This invention relates to the field of artificial intelligence security and privacy protection technology, and discloses a method, device, electronic device, and storage medium for assessing sensitive data privacy leakage behavior. This invention constructs a shadow model through a transfer-inheritance approach, accurately replicating the reasoning characteristics of the target collaborative reasoning model. Model adaptation training is completed using the shadow dataset, effectively restoring the output features of different samples. An evaluation dataset is constructed using two types of output vectors, and a discriminant model is trained to form a complete risk detection system. The samples to be detected undergo two levels of model processing, quantifying the risk probability and combining it with a threshold to complete the judgment, achieving fully automated detection. This method does not require obtaining the complete structure of the target model, adapts to application scenarios with split deployment, has a simple and efficient detection process, and provides accurate and reliable identification results, effectively identifying potential risks of member information leakage in collaborative reasoning scenarios.

Description

Technical Field

[0001] This invention relates to the field of artificial intelligence security and privacy protection technology, specifically to a method, apparatus, electronic device, and storage medium for assessing sensitive data privacy leakage behavior. Background Technology

[0002] With the rapid development of Industrial Internet of Things (IIoT) technology, a large number of industrial devices are leveraging deep neural networks to achieve intelligent sensing and decision-making. However, terminal devices have limited computing power and are highly sensitive to data, making the traditional approach of deploying the complete model on the terminal or uploading raw data to the cloud significantly flawed. To address this, collaborative inference technology has emerged, dividing the deep neural network into a front-end part on the terminal side and a back-end part on the server side. The terminal only transmits intermediate feature vectors, improving system efficiency and enhancing privacy protection. However, deep neural networks suffer from overfitting and have a training sample memory characteristic; even without transmitting raw data, there is still a potential risk of training data being leaked through the model's output statistical features.

[0003] Existing methods for assessing the risk of member information leakage and for member inference largely rely on conditions such as the ability to query the target model interface, access to complete model parameters, or the availability of partial training data to construct a reference model. Methods such as those proposed by Shokri et al., ML-Leaks, and white-box member inference methods all require these prerequisites. However, in a collaborative inference architecture, the assessment subject typically only obtains the latter part of the model's parameters, lacking access to the complete model structure and parameters, and making it difficult to frequently query the model interface. This results in insufficient applicability of existing assessment and member inference methods. Summary of the Invention

[0004] This invention provides a method, apparatus, electronic device, and storage medium for assessing sensitive data privacy leakage behavior, in order to solve the problem that in current collaborative reasoning architectures, the assessment subject can usually only obtain the latter half of the model parameters, cannot access the complete model structure and parameters, and finds it difficult to frequently query the model interface, resulting in insufficient applicability of existing assessment methods and member inference methods.

[0005] In a first aspect, the present invention provides a method for assessing sensitive data privacy leakage behavior, the method comprising: Obtain the latter half of the target collaborative reasoning model and its corresponding model parameters, and then splice it with the preset pre-trained model to construct a shadow model; The training set from the shadow dataset is input into the shadow model for training; Input the training set and non-training set from the shadow dataset into the trained shadow model, and output the training set output vector and the non-training set output vector. By combining the output vectors of the training set and the output vectors of the non-training set, a risk assessment dataset is constructed, and the risk assessment training set in the risk assessment dataset is input into a preset member information risk discrimination model for training. Input the sample to be detected into the shadow model after training to generate a prediction vector, and input the prediction vector into the member information risk discrimination model after training to output the member risk probability. The member risk probability is compared with a preset probability threshold, and the member information is determined to be at risk of being leaked based on the comparison result.

[0006] This invention constructs a shadow model through transfer-inheritance, accurately replicating the reasoning characteristics of the target collaborative reasoning model. It utilizes the shadow dataset for model adaptation training, effectively restoring the output features of different samples. An evaluation dataset is constructed using two types of output vectors, and a discriminant model is trained, forming a complete risk detection system. The samples to be detected undergo two levels of model processing, quantifying the risk probability and combining it with a threshold to complete the judgment, achieving fully automated detection. This method does not require obtaining the complete structure of the target model, adapts to application scenarios requiring split deployment, has a simple and efficient detection process, and provides accurate and reliable identification results, effectively identifying potential risks of member information leakage in collaborative reasoning scenarios.

[0007] In one optional implementation, the step of obtaining the latter half of the target collaborative reasoning model and its corresponding model parameters, and then splicing it with a preset pre-trained model to construct a shadow model, includes: Obtain the target collaborative reasoning model; Extract the latter half of the target collaborative reasoning model and its corresponding model parameters; Select a pre-trained model with the same data distribution as the target collaborative reasoning model; Based on the pre-trained model, the shadow model is constructed by concatenating the latter half of the model and its corresponding parameters.

[0008] This invention selects a pre-trained model with matching data distribution and splices the latter half of the target model's structure and parameters to build a shadow model. Model replication can be completed by extracting only the backend network and parameters, without needing to obtain the complete target model, thus adapting to the characteristics of collaborative inference deployment. Relying on source data and native parameters ensures simulation effectiveness, reduces model behavior bias, and restores the target model's inference logic in a low-cost manner.

[0009] In one optional implementation, the step of inputting the training set from the shadow dataset into the shadow model for training includes: Construct a training set and a non-training set with the same data distribution as the target data, and combine the training set and the non-training set to generate a shadow dataset; The training set is input into the shadow model, and the pre-trained model of the shadow model is trained using the training set, while maintaining the model parameters of the latter half of the model, to obtain the shadow model after training.

[0010] This invention creates a corresponding sample set based on the target data distribution and integrates it into a shadow dataset, ensuring that the data features are consistent with the actual scenario. During training, only the front-end pre-trained model is fine-tuned, while the original back-end parameters are fixed, fully preserving the inference characteristics of the target model. This allows the shadow model to fully adapt to the data patterns while avoiding distortion of the original parameters, effectively improving simulation accuracy and making the model's output features closely resemble real-world performance.

[0011] In one optional implementation, the step of inputting the training set and non-training set from the shadow dataset into the trained shadow model, and outputting the training set output vector and the non-training set output vector, respectively, includes: Input the training set into the trained shadow model and output the training set output vector. The non-training set is input into the shadow model after training, and the non-training set output vector is output.

[0012] This invention utilizes training and non-training sets to infer two types of output vectors, respectively, which can intuitively distinguish the differences in the model's response to known and unknown samples. The vectors generated by the high-precision shadow model fully preserve data features, clearly reflecting the behavioral differences between member and non-member samples. This provides authentic and effective foundational data for subsequent dataset construction and risk feature extraction, ensuring the accuracy and effectiveness of subsequent privacy risk assessment.

[0013] In one optional implementation, the step of constructing a risk assessment dataset by combining the output vectors of the training set and the output vectors of the non-training set, and inputting the risk assessment training set from the risk assessment dataset into a preset member information risk discrimination model for training, includes: A risk assessment dataset is constructed by labeling member labels onto the output vector of the training set and non-member labels onto the output vector of the non-training set. The risk assessment dataset is divided into a risk assessment training set and a risk assessment test set according to a preset ratio; Construct an initial member information risk assessment model; Extract the statistical features of the risk assessment training set and input them into the initial member information risk discrimination model for training; Extract the statistical features of the risk assessment test set and input them into the trained member information risk discrimination model for testing to generate the target member information risk discrimination model.

[0014] This invention distinguishes sample attributes through labeling, constructs a standardized risk assessment dataset, and effectively prevents model overfitting by reasonably dividing training and testing samples. Model training and performance testing are completed based on sample statistical features, continuously optimizing the discriminative ability. The final discriminative model can accurately capture the feature differences between different samples, significantly improving the accuracy and generalization ability of identifying member information leakage risks, and ensuring stable and reliable detection results.

[0015] In one optional implementation, the step of inputting the sample to be detected into the trained shadow model, generating a prediction vector, inputting it into the trained member information risk discrimination model, and outputting the member risk probability includes: Obtain the sample to be tested; The sample to be detected is input into the shadow model after training to generate a prediction vector; The predicted vector is input into the trained member information risk discrimination model, which outputs the member risk probability.

[0016] This invention sequentially inputs the sample to be tested into a two-level model to complete inference. The shadow model extracts sample features to generate a prediction vector, which is then quantified by the discriminant model to obtain the risk probability. The entire process is seamless and highly automated, capable of accurately uncovering hidden features of samples and objectively quantifying the risk of information leakage. Relying on a previously optimized and mature model system, it effectively ensures stable and reliable output results, efficiently completing privacy risk assessments for single samples, and demonstrating strong practicality.

[0017] In one optional implementation, comparing the member risk probability with a preset probability threshold and determining that member information is at risk of leakage based on the comparison result includes: Determine whether the risk probability of the member is greater than a preset probability threshold; If so, it is determined that there is a risk of member information leakage.

[0018] This invention quantifies the risk of member information leakage by comparing the member risk probability with a preset probability threshold, resulting in a simple process and intuitive results. This threshold determination method can be flexibly adjusted according to scenario requirements, effectively improving the accuracy and stability of risk identification while ensuring a low false positive rate. It can quickly and reliably locate potential training data member leakage risks in collaborative inference models. The entire determination process does not require access to the first half of the target model's parameters or frequent queries to the model interface, adapting to the restricted access conditions in industrial scenarios and completing the final risk assessment in a lightweight manner.

[0019] Secondly, the present invention provides a sensitive data privacy leakage assessment device, the device comprising: The acquisition module is used to acquire the latter half of the target collaborative reasoning model and its corresponding model parameters, and to splice it with the preset pre-trained model to construct a shadow model. The training module is used to input the training set from the shadow dataset into the shadow model for training, and to input the training set and non-training set from the shadow dataset into the trained shadow model respectively, and output the training set output vector and the non-training set output vector. The module is used to combine the output vector of the training set and the output vector of the non-training set to construct a risk assessment dataset, and input the risk assessment training set in the risk assessment dataset into a preset member information risk discrimination model for training. The prediction module is used to input the sample to be detected into the shadow model after training, generate a prediction vector, input it into the member information risk discrimination model after training, and output the member risk probability. The comparison module is used to compare the member risk probability with a preset probability threshold, and determine the risk of member information leakage based on the comparison result.

[0020] Thirdly, the present invention provides an electronic device, comprising: a memory and a processor, wherein the memory and the processor are communicatively connected to each other, the memory stores computer instructions, and the processor executes the computer instructions to perform the sensitive data privacy leakage behavior assessment method of the first aspect or any corresponding embodiment described above.

[0021] Fourthly, the present invention provides a computer-readable storage medium storing computer instructions for causing a computer to execute the sensitive data privacy leakage assessment method of the first aspect or any corresponding embodiment described above. Attached Figure Description

[0022] To more clearly illustrate the specific embodiments of the present invention or the technical solutions in the prior art, the drawings used in the description of the specific embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are some embodiments of the present invention. For those skilled in the art, other drawings can be obtained from these drawings without creative effort.

[0023] Figure 1 This is a schematic diagram of the first process of the sensitive data privacy leakage behavior assessment method according to an embodiment of the present invention; Figure 2 This is a schematic diagram of the second process of the sensitive data privacy leakage behavior assessment method according to an embodiment of the present invention; Figure 3 This is a schematic diagram of the third process of the sensitive data privacy leakage behavior assessment method according to an embodiment of the present invention; Figure 4 This is a structural block diagram of a sensitive data privacy leakage behavior assessment device according to an embodiment of the present invention; Figure 5 This is a schematic diagram of the hardware structure of an electronic device according to an embodiment of the present invention. Detailed Implementation

[0024] To make the objectives, technical solutions, and advantages of the embodiments of the present invention clearer, the technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0025] It is understood that before using the technical solutions disclosed in the various embodiments of the present invention, users should be informed of the types, scope of use, and usage scenarios of the personal information involved in the present invention and their authorization should be obtained in accordance with relevant laws and regulations through appropriate means.

[0026] The terms "first" and "second" are used for descriptive purposes only and should not be construed as indicating or implying relative importance or implicitly specifying the number of technical features indicated. Thus, a feature defined as "first" or "second" may explicitly or implicitly include one or more of that feature. In the description of this invention, "a plurality of" means two or more, unless otherwise explicitly specified.

[0027] This invention provides a method for assessing sensitive data privacy leakage behavior. It constructs a shadow model through a transfer-inheritance approach to accurately replicate the reasoning characteristics of the target collaborative reasoning model. Model adaptation training is completed using the shadow dataset, effectively restoring the output features of different samples. An evaluation dataset is constructed using two types of output vectors, and a discriminant model is trained to form a complete risk detection system. The samples to be detected undergo two levels of model processing, quantifying the risk probability and combining it with a threshold to complete the judgment, achieving fully automated detection. This method does not require obtaining the complete structure of the target model, adapts to application scenarios with split deployment, has a simple and efficient detection process, and provides accurate and reliable identification results, effectively identifying potential risks of member information leakage in collaborative reasoning scenarios.

[0028] According to an embodiment of the present invention, an embodiment of a method for assessing sensitive data privacy leakage behavior is provided. It should be noted that the steps shown in the flowchart in the accompanying drawings can be executed in a computer system such as a set of computer-executable instructions. Furthermore, although a logical order is shown in the flowchart, in some cases, the steps shown or described may be executed in a different order than that shown here.

[0029] This embodiment provides a method for assessing sensitive data privacy leakage behavior. Figure 1 This is a flowchart of a sensitive data privacy leakage assessment method according to an embodiment of the present invention, such as... Figure 1 As shown, the process includes the following steps: Step S101: Obtain the latter half of the target collaborative reasoning model and its corresponding model parameters, and splice it with the preset pre-trained model to construct a shadow model.

[0030] It should be noted that the target collaborative reasoning model refers to a distributed artificial intelligence model that divides a complete deep neural network into a front-end part on the terminal side and a back-end part on the server side, and completes feature extraction and inference computation through collaboration between the terminal and the cloud. The back-end model refers to the sub-network of the model deployed on the cloud or edge server, which receives intermediate features output from the terminal and completes the final inference computation. Model parameters refer to the core parameters in the back-end model, such as the weight matrix, bias terms, and network layer configuration, which determine the model's inference behavior and output results. The pre-trained model refers to a basic neural network model that has been pre-trained and has general feature extraction capabilities. It is adapted to the data distribution of the target collaborative reasoning model and is used as the front-end feature extraction module of the shadow model. The shadow model refers to a simulation model constructed by splicing the pre-trained model and the back-end of the target model, which can approximately reproduce the inference behavior of the target collaborative reasoning model.

[0031] In this embodiment of the invention, the latter half of the model structure and its corresponding parameters, which are located only on the server side and can be legally obtained by the evaluation party, are extracted from the distributed collaborative inference architecture. Based on the successful acquisition of the latter half of the target collaborative inference model and its corresponding model parameters, a pre-configured pre-trained model is used as the main body for front-end feature extraction. The latter half of the model, which inherits the real parameters, is matched and spliced ​​to construct a complete shadow model. This makes up for the deficiency that only the latter half of the target model structure can be obtained and the front-end network cannot be obtained. The reasoning logic and output characteristics of the target collaborative inference model are highly replicated by means of structure splicing and parameter reuse. It is not necessary to obtain the complete target model structure and all parameters, which effectively adapts to the scenario characteristics of the split deployment of collaborative inference models.

[0032] Step S102: Input the training set from the shadow dataset into the shadow model for training.

[0033] It should be noted that the shadow dataset refers to a dedicated dataset whose data distribution is consistent with the original training data of the target collaborative reasoning model.

[0034] In this embodiment of the invention, the training set of the shadow dataset is input into the initial shadow model for targeted training. During the training process, the data distribution characteristics of the target model are adapted, and the parameters of the front-end pre-training structure of the shadow model are fine-tuned. At the same time, the inherent parameters and inference characteristics of the latter half of the model are stabilized, making up for the behavioral differences between the initial shadow model and the target collaborative inference model. This allows the shadow model to fully learn and adapt to the data inference rules of the target scenario, effectively improving the simulation accuracy of the shadow model for the behavior of the target collaborative inference model, so that the trained shadow model can closely resemble the output effect of the real target model.

[0035] Step S103: Input the training set and non-training set from the shadow dataset into the shadow model after training, and output the training set output vector and the non-training set output vector.

[0036] It should be noted that the training set output vector refers to the output data generated by the shadow model for inference on the training set samples; the non-training set output vector refers to the output data generated by the shadow model for inference on the non-training set samples.

[0037] In this embodiment of the invention, the training set and non-training set of the shadow dataset are respectively input into the fully trained shadow model. The training set samples are used to simulate the reasoning process of member data seen by the target model to output the training set output vector. The non-training set samples are used to simulate the reasoning process of non-member data not seen by the target model to output the non-training set output vector. By using partitioned reasoning, the model actively distinguishes the output differences between member samples and non-member samples, and accurately retains the prediction bias characteristics caused by overfitting of the model.

[0038] Step S104: Combine the output vectors of the training set and the output vectors of the non-training set to construct a risk assessment dataset, and input the risk assessment training set in the risk assessment dataset into the preset member information risk discrimination model for training.

[0039] It should be noted that the risk assessment dataset refers to a dedicated dataset constructed by integrating the output vectors of the training set and the output vectors of the non-training set.

[0040] In this embodiment of the invention, by mining the differences in probability distribution and confidence fluctuation of two types of output data, a standardized risk assessment dataset is constructed, and corresponding multidimensional statistical features are extracted to quantify and distinguish the differences in the model's reasoning behavior for member samples and non-member samples. Then, the feature data is integrated and input into the preset target member information risk discrimination model for feature learning and discrimination analysis, thereby obtaining the trained member information risk discrimination model.

[0041] Step S105: Input the sample to be detected into the shadow model after training, generate a prediction vector, input it into the member information risk discrimination model after training, and output the member risk probability.

[0042] It should be noted that the sample to be tested refers to the object to be tested for assessing the risk of member information leakage; the member information risk discrimination model after training refers to the discrimination network specifically used to identify the risk of member information leakage; and the member risk probability characterizes the quantitative probability value of the sample to be tested belonging to the model training member and having the risk of information leakage.

[0043] In this embodiment of the invention, after determining the sample to be tested, it is first fed into the shadow model after training to perform inference operations, generating a prediction vector that can reflect the characteristics of the sample. Then, the vector is imported into the optimized and finalized member information risk discrimination model for feature analysis, and finally outputs the corresponding member risk probability. This completes the feature extraction and risk quantification of the sample to be tested, providing an intuitive numerical basis for subsequent risk judgment.

[0044] Step S106: Compare the member risk probability with a preset probability threshold, and determine the risk of member information leakage based on the comparison result.

[0045] It should be noted that the probability threshold refers to a pre-set critical judgment value based on the actual assessment scenario, and is a standardized judgment criterion for distinguishing the existence or non-existence of risk. The risk of member information leakage refers to the security risk that the original training member information may be illegally inferred and leaked due to the characteristics of the training data exposed by the collaborative reasoning model.

[0046] In this embodiment of the invention, the member risk probability value is accurately compared with the system's preset probability threshold. The standardized risk judgment is completed by relying on the quantitative comparison mechanism, abandoning the traditional subjective judgment method. If the member risk probability exceeds the preset probability threshold, it means that the sample to be tested has significant model training member characteristics, and it can be determined that the member information has a risk of leakage. Otherwise, it is determined that there is no risk of leakage. Through this accurate and efficient quantitative comparison logic, the final judgment of the privacy leakage risk of collaborative reasoning model member information is completed, realizing the standardization, automation and accuracy of risk identification, and ensuring the integrity and reliability of the overall privacy risk assessment process.

[0047] This embodiment provides a method for assessing sensitive data privacy leakage behavior. Figure 2 This is a flowchart of a sensitive data privacy leakage assessment method according to an embodiment of the present invention, such as... Figure 2 As shown, the process includes the following steps: Step S201: Obtain the latter half of the target collaborative reasoning model and its corresponding model parameters, and splice it with the preset pre-trained model to construct a shadow model.

[0048] In some optional implementations, step S201 above includes: Step S2011: Obtain the target collaborative reasoning model.

[0049] In embodiments of the present invention, such as Figure 3 As shown, the collaborative reasoning model structure is obtained. Specifically, in the collaborative reasoning architecture, the target model is denoted as:

[0050] In the formula, This is the first half of the model (terminal side). This is the second half of the model (server side). Specifically, the target model is also denoted as:

[0051] in, For the input sample, These are the model parameters.

[0052] To obtain usable target model information and provide a structural foundation for shadow model construction, in this scenario, the usable target model information includes the latter half of its model deployed on the server, providing a directly usable source of structural information for subsequent shadow model construction.

[0053] Step S2012: Extract the latter half of the target collaborative reasoning model and its corresponding model parameters.

[0054] It should be noted that attackers can obtain: the latter half of the network structure. And the parameters in the latter half. But the structure in the first half is unavailable. and the first half of the parameters .

[0055] In this embodiment of the invention, the latter half of the model is extracted: the attacker obtains the network layer type (fully connected layer, convolutional layer, etc.), parameter weight matrix, bias term, and activation function from the server, and constructs the latter half of the model function:

[0056] In the formula, h This represents intermediate features; z This outputs a logits vector.

[0057] This step achieves equivalent reconstruction of the latter half of the target model, obtaining a computational module that is completely identical to the latter half of the target model. This ensures that the shadow model has the same discriminative characteristics in the output layer, providing a key foundation for the subsequent "simulation of the target model's behavior" and significantly reducing the training difficulty of the shadow model (no need to relearn the latter half).

[0058] Step S2013: Select a pre-trained model with the same data distribution as the target collaborative reasoning model.

[0059] It should be noted that data distribution refers to the feature patterns, sample distribution, and semantic attributes of the original training data of the target model.

[0060] In this embodiment of the invention, a pre-trained model is selected: a model pre-trained on the same data distribution is chosen. For example, CNN, AlexNet, and ResNet.

[0061] Let the first few layers of the pre-trained model be:

[0062] This step introduces a pre-trained model, leveraging the general feature extraction capabilities of existing models to avoid the problem of excessively high data requirements caused by training from scratch, thereby improving the initial performance of the shadow model. Its essential function is to provide a reasonable approximation for the first half of the unknown target model.

[0063] Step S2014: Based on the pre-trained model, the second half of the model and its corresponding model parameters are spliced ​​together to construct the shadow model.

[0064] In this embodiment of the invention, under the collaborative reasoning architecture, the target model is divided into two parts:

[0065] In the formula, This is the first half of the model (deployed on terminal devices); This is the second half of the model (deployed on an edge server). , These are the corresponding parameters.

[0066] The assessment entity can only obtain and its parameters Unable to access Therefore, traditional attacks rely on queries. The previous method is not feasible. To overcome the above limitations, this invention constructs a shadow model: ,Right now .

[0067] In the formula, This is inherited from the latter half of the target model; This is to transfer the first half of the pre-trained model; For freezing parameters; These are trainable parameters.

[0068] The construction conditions must meet the following: the parameters in the second half are fixed, and the parameters in the first half are trainable.

[0069] This step achieves the structural splicing of the shadow model, enabling the model to possess a complete reasoning path. Its key effect is to unify the unknown part (first half) with the known part (second half), constructing a complete model that can be used for training and reasoning.

[0070] Specifically, this step completes the shadow model structure, enabling it to simulate the overall reasoning process of the target model and build a framework for training the model later. At this point, the transfer model does not yet have the ability to imitate the target model and needs to be trained in the next step.

[0071] Specifically, during the training process, only optimization The loss function is:

[0072] In the formula, The dataset is distributed in the same way as the target training data but does not overlap with it; C This represents the number of categories in the classification task.

[0073] The latter part of the parameters is fixed, specifically the parameters of the frozen inheritance layer, and is set as follows:

[0074] That is, the parameters in the latter half do not participate in gradient updates, to prevent the parameters in the latter half from being changed, to keep them consistent with the target model, and to force the first half to learn and adapt to the feature distribution of the target model.

[0075] Step S202: Input the training set from the shadow dataset into the shadow model for training.

[0076] In some optional implementations, step S202 above includes: Step S2021: Construct a training set and a non-training set with the same data distribution as the target data, and combine the training set and the non-training set to generate a shadow dataset.

[0077] It should be noted that the training set is denoted as:

[0078] The non-training set is denoted as:

[0079] In this embodiment of the invention, a shadow dataset is prepared that is distributed in the same way as the target data but does not overlap with it:

[0080] In the formula, This is the training set, used for training the shadow model; This is a non-training set used for attack model construction.

[0081] Specifically, this step provides the data required for model training and the non-training data that does not require training, ensuring that the data distribution is consistent with the target model, thereby improving simulation accuracy. By ensuring that the data does not overlap, it avoids the leakage of real member information from interfering with the evaluation, and provides a labeling basis for the subsequent member discrimination model.

[0082] Step S2022: Input the training set into the shadow model, train the pre-trained model of the shadow model using the training set, and maintain the model parameters of the second half of the model to obtain the shadow model after training.

[0083] In this embodiment of the invention, the training set of the shadow dataset is input into the initial shadow model for targeted training. The parameters of the pre-trained model part in the shadow model are iterated and fine-tuned to adapt to the data characteristics and inference habits of the target model. At the same time, the model parameters of the latter half of the model are kept constant throughout the process, and the real inference logic and weight characteristics of the target collaborative inference model are fully preserved. This effectively avoids the simulation distortion problem caused by changes in the back-end parameters, so that the front-end and back-end inference logic of the overall shadow model closely matches the real target model. Finally, a shadow model with high fitting accuracy and realistic simulation effect is obtained after training.

[0084] Specifically, the loss function is defined, where the cross-entropy loss function is used:

[0085] It is used to measure the difference between the predicted result and the true label. Its effect is to guide the model to learn the correct classification ability, so that the output distribution of the shadow model gradually approaches the target model, and to provide stable probability distribution features for subsequent member inference.

[0086] Parameter optimization, including updates using the Adam optimizer:

[0087] In the formula, The learning rate; k This represents the number of iterations.

[0088] Continue until the loss converges or the set number of rounds is reached.

[0089] This step iteratively updates the parameters, causing the model to gradually converge. Ultimately, the shadow model can exhibit statistical characteristics similar to the target model at the output layer, resulting in the trained shadow model.

[0090] In specific implementations, deep neural networks are typically trained by minimizing the cross-entropy loss function:

[0091] In the formula, One-hot encoding for the real label; Predict probabilities for the model.

[0092] In cases of overfitting, the model's loss value for the training samples is typically lower than its loss value for unseen samples, i.e.:

[0093] Equivalent land, in terms of prediction confidence, is reflected as follows:

[0094] That is, training samples often have a higher maximum prediction probability.

[0095] Therefore, a member discrimination function can be constructed:

[0096] The problem is transformed into a binary classification task: .

[0097] Since the parameters of the latter half are directly inherited from the target model and remain frozen, the classification decision boundary of the model is fixed. Therefore, during training, the parameters of the first half (feature extractor) are forced to be adjusted so that the intermediate representation of its output falls as close as possible to the feature space expected by the latter half of the target model, thereby making the overall output distribution approximate the target model. This mechanism ensures that the shadow model can still simulate the output behavior of the target model without accessing the first half of the target model, providing reliable input for subsequent membership inference attacks based on prediction vectors.

[0098] Step S203: Input the training set and non-training set from the shadow dataset into the shadow model after training, and output the training set output vector and the non-training set output vector.

[0099] In some optional implementations, step S203 above includes: Step S2031: Input the training set into the shadow model after training and output the training set output vector.

[0100] It should be noted that the shadow model outputs a class probability vector (i.e., the training set output vector):

[0101] In the formula, C For the number of categories, Indicates that the sample belongs to the first i The predicted probability of a class.

[0102] In this embodiment of the invention, to obtain the prediction output of the shadow model, the training set in the shadow dataset is input into the trained shadow model: .

[0103] In the formula, The shadow model after training; This is the training set.

[0104] Step S2032: Input the non-training set into the shadow model after training, and output the non-training set output vector.

[0105] In this embodiment of the invention, to obtain the prediction output of the shadow model, the non-training set in the shadow dataset is input into the trained shadow model: .

[0106] In the formula, The shadow model after training; This is not part of the training set.

[0107] Wherein, the output class probability vector (i.e., the non-training set output vector) is ;

[0108] Indicates that the sample belongs to the first i The predicted probability of a class.

[0109] This step extracts the model's output behavior on different data, transforms the model behavior into an analyzable probability vector, and captures the differences between training samples and non-training samples.

[0110] In a specific embodiment, the training data and non-training data of the shadow model are respectively input into the shadow model to obtain the prediction probability vector:

[0111] In the formula, For input samples; This is the class probability vector output by the model.

[0112] Step S204: Combine the output vectors of the training set and the output vectors of the non-training set to construct a risk assessment dataset, and input the risk assessment training set in the risk assessment dataset into the preset member information risk discrimination model for training.

[0113] In some optional implementations, step S204 above includes: Step S2041: Label member labels on the output vector of the training set and label non-member labels on the output vector of the non-training set to construct a risk assessment dataset.

[0114] It should be noted that member labels are used to identify the classification labels of samples that belong to the model training set, and are the core identifier for distinguishing samples with privacy risks; non-member labels are used to identify the classification labels of samples that do not belong to the model training set, and are used to distinguish them from ordinary samples without risk.

[0115] In this embodiment of the invention, the sample is labeled based on whether it belongs to the shadow model training set:

[0116] In the formula, Indicates member sample; This indicates a non-member sample.

[0117] Member labels are annotated in the training set output vector as follows:

[0118] Non-member labels are annotated on the output vector outside the training set as follows:

[0119] In the formula, label 1 represents a member and label 0 represents a non-member.

[0120] This leads to the construction of a risk assessment dataset of member information.

[0121] This step combines the prediction results with member labels, transforming the problem into a binary classification problem. This provides a learnable data foundation for the risk assessment model and clarifies the target for distinguishing between members and non-members.

[0122] A dataset is constructed to train a risk assessment model for member information leakage. This dataset is built by combining the category probability vectors of the corresponding outputs of the shadow model's training set and the non-training set. With this dataset, the privacy leakage risk assessment model can be trained to distinguish between member information and non-member information. This will enable the privacy leakage risk assessment model to determine whether leakage exists in the future by analyzing the output distribution of samples on the shadow model.

[0123] Step S2042: Divide the risk assessment dataset into a risk assessment training set and a risk assessment test set according to a preset ratio.

[0124] It should be noted that the preset ratio is 8:2 or 7:3.

[0125] In this embodiment of the invention, the risk assessment dataset is divided into a risk assessment training set according to an 8:2 or 7:3 ratio. and risk assessment test set It is used to train a member information risk discrimination model and evaluate its generalization ability.

[0126] The risk discrimination model uses the risk assessment dataset to learn the mapping relationship between the shadow model output and membership. The risk assessment dataset is divided into two parts: a training set for the risk assessment model, used to train the privacy leakage risk assessment model, and a test set for the risk assessment model, used to test the performance of the privacy leakage risk assessment model on the test machine, i.e. whether it can correctly determine whether a certain data belongs to membership information. It should be noted that the training set and the test set are divided proportionally and both contain membership information and non-member information.

[0127] Step S2043: Construct an initial member information risk discrimination model.

[0128] In this embodiment of the invention, a member information risk discrimination model is constructed:

[0129] In the formula, For feature vectors; r The risk probability for each member.

[0130] The model can be: LightGBM, Logistic Regression, or a binary classification neural network.

[0131] Step S2044: Extract the statistical features of the risk assessment training set and input them into the initial member information risk discrimination model for training.

[0132] In this embodiment of the invention, in order to improve the risk discrimination capability of members, statistical features are extracted from the model output probability vector, including: Maximum prediction probability:

[0133] Predictive probability entropy:

[0134] True category confidence:

[0135] Top-k probability difference:

[0136] In the formula, , These are the maximum and second-largest prediction probabilities, respectively.

[0137] Statistical features are input into the initial membership information risk discrimination model for training. The training optimization objective function is binary classification cross-entropy loss.

[0138] Hyperparameter settings:

[0139] This step enhances the expressive power of input features, amplifies the differences between members and non-members, improves the classifier's discriminative ability, and reduces model complexity.

[0140] Step S2045: Extract the statistical features of the risk assessment test set and input them into the trained member information risk discrimination model for testing, thereby generating the target member information risk discrimination model.

[0141] In this embodiment of the invention, statistical features such as the maximum predicted probability, predicted probability entropy, true category confidence, and Top-k probability difference of the risk assessment test set are extracted and input into the trained member information risk discrimination model for testing to determine the target member information risk discrimination model.

[0142] Step S205: Input the sample to be detected into the shadow model after training, generate a prediction vector, input it into the member information risk discrimination model after training, and output the member risk probability.

[0143] In some optional implementations, step S205 above includes: Step S2051: Obtain the sample to be tested.

[0144] In this embodiment of the invention, the sample to be tested is obtained. .

[0145] Step S2052: Input the sample to be detected into the shadow model after training to generate a prediction vector.

[0146] It should be noted that the prediction vector refers to the multi-dimensional numerical sequence output by the shadow model after completing the inference calculation on the sample to be detected.

[0147] In this embodiment of the invention, the sample to be tested is Input the shadow model and calculate the prediction vector:

[0148] In the formula, This represents the predicted probability vector of the shadow model for the input sample.

[0149] Step S2053: Input the prediction vector into the target member information risk discrimination model and output the member risk probability.

[0150] It should be noted that the member risk probability refers to the quantitative value output by the model, which is used to characterize the likelihood that the sample under test belongs to the model training members and has the potential for information leakage.

[0151] In this embodiment of the invention, after training and performance verification of the member information risk discrimination model are completed, the predicted probability vector of the shadow model for the input sample is input into the trained target member information risk discrimination model. The model performs analysis and calculation based on the learned feature rules and outputs the member risk probability. This value intuitively reflects the possibility of member information leakage in the sample to be tested.

[0152] Specifically, the predicted probability vector of the input sample from the shadow model is input into the risk discrimination model (input attack classifier):

[0153] In the formula, Represents a classifier. The result of the member determination.

[0154] Judgment rules: like:

[0155] If the sample is deemed to have a risk of exposing member information in the target model, it is determined that the sample does not exhibit obvious member characteristics. The threshold is... τ It can be determined through ROC curve optimization.

[0156] Step S206: Compare the member risk probability with a preset probability threshold, and determine the risk of member information leakage based on the comparison result.

[0157] In some optional implementations, step S206 above includes: Step S2061: Determine whether the member's risk probability is greater than a preset probability threshold.

[0158] In this embodiment of the invention, the probability threshold τ can be determined in the following way: ROC curve optimization: The choice makes TPR The maximum threshold of FPR; Cross-validation: Choose the threshold that optimizes the overall accuracy or F1-score on the validation set.

[0159] To quantify the ability to assess privacy breach risks, the following metrics are used for risk assessment performance: To quantify the ability to assess privacy breach risks, the following metrics are used: Accuracy:

[0160] True positive rate:

[0161] False positive rate:

[0162] TPR under low FPR conditions, i.e.: True positive rate (TPR) under the condition that the false positive rate (FPR) does not exceed 0.01.

[0163] This metric is used to measure the member identification capability under conditions of low false alarms.

[0164] The risk probability value of each member is compared with a pre-set probability threshold to determine whether there is a risk of leakage of member information.

[0165] Step S2062: If yes, then it is determined that there is a risk of leakage of member information.

[0166] In this embodiment of the invention, member information risk determination is achieved through a probability threshold τ:

[0167] This suggests that the sample exhibits a risk of member information leakage.

[0168] Here is an example application: (1) The dataset can be MNIST, CIFAR10 or CIFAR100; (2) The target model can adopt CNN, LeNet or AlexNet structure; (3) The shadow model adopts a transfer convolutional layer structure and freezes the inheritance layer; (4) The optimization algorithm uses the Adam optimizer; (5) The member information risk discrimination model is trained using the LightGBM classifier.

[0169] Specific experimental setup: (1) Dataset MNIST, CIFAR10 and CIFAR100 (2) Training data size Training data: 25000 Test data: 5000 (3) Experimental results show that: On the CIFAR-10 dataset, the member information recognition accuracy reaches 71.85%; on the CIFAR-100 dataset, the recognition accuracy reaches 76.56%; when the shadow model training data increases to 25,000, the recognition accuracy can reach a maximum of 80.36% on CIFAR-10 and 81.55% on CIFAR-100.

[0170] In comparison with a random baseline, the probability of randomly determining a member is 50%, while the present invention significantly outperforms this baseline on multiple datasets, indicating that the collaborative reasoning model does indeed possess identifiable member information features.

[0171]

[0172] When the model interface cannot be queried, the evaluation effect of traditional methods is significantly reduced in this scenario, while the present invention can still effectively identify the risk of privacy leakage.

[0173] This invention is based on the theoretical foundation of overfitting characteristics and probability distribution differences in deep neural networks. By constructing a transfer-inheritance shadow model and a member information risk discrimination model, it identifies and evaluates whether the target model has features that expose member information from the training data. This invention is used to assess whether model training data might be inferred during the inference phase, thereby revealing potential risks to training data privacy in collaborative inference systems. Existing research mainly focuses on data privacy or model parameter security during the inference phase, while paying less attention to the privacy leakage of training data in collaborative inference scenarios. This invention, from a system architecture perspective, constructs a risk assessment process and quantitatively assesses the degree of privacy exposure of training data in collaborative inference systems by analyzing the differences in model behavior towards training samples and non-training samples. Experimental results show that when some deep models exhibit overfitting, the system output may contain distinguishable statistical features, leading to the risk of training samples being identified. This research provides a systematic method for privacy risk assessment of collaborative inference systems and offers important reference for the design of subsequent privacy protection mechanisms.

[0174] This invention proposes a shadow model construction method based on a transfer-inheritance mechanism to simulate the behavior of a target model and assess member leakage risk. This invention constructs a shadow model with behavior similar to the target model by transferring the feature extraction layer from an existing pre-trained model and inheriting the known backend network structure from a collaborative inference system. During model training, only the transferred front-end feature extraction part is retrained, while the inherited backend network structure parameters remain unchanged, enabling the shadow model to more effectively approximate the output behavior of the target model. Compared to training the shadow model from scratch, this invention can achieve higher behavioral similarity with limited data, thereby improving the accuracy of member leakage risk assessment.

[0175] This invention further proposes a method for assessing member leakage risk without accessing the target model's interface. Unlike traditional methods that typically rely on multiple queries to the target model, this invention utilizes only the model structure information available within the collaborative inference system during the assessment process. It generates prediction vectors through a shadow model and combines this with a binary classification assessment model to determine the member attributes of samples. This mechanism significantly reduces the prior information required for risk assessment, making it more suitable for practical deployment conditions in industrial IoT environments. Experimental results on multiple datasets demonstrate that even without access to the complete model and training data, this invention can effectively identify potential training data leakage risks, thus proving that collaborative inference systems still have a certain degree of training data privacy exposure issues in practical applications.

[0176] This embodiment also provides a sensitive data privacy leakage behavior assessment device, which is used to implement the above embodiments and preferred embodiments, and will not be repeated for details already described. As used below, the term "module" can be a combination of software and / or hardware that implements a predetermined function. Although the device described in the following embodiments is preferably implemented in software, hardware implementation, or a combination of software and hardware, is also possible and contemplated.

[0177] This embodiment provides a device for assessing sensitive data privacy leakage behavior, such as... Figure 4 As shown, it includes: The acquisition module 301 is used to acquire the latter half of the target collaborative reasoning model and its corresponding model parameters, and to splice it with the preset pre-trained model to construct a shadow model. Training module 302 is used to input the training set from the shadow dataset into the shadow model for training; The input module 303 is used to input the training set and non-training set from the shadow dataset into the shadow model after training, and output the training set output vector and the non-training set output vector. Module 304 is used to combine the output vectors of the training set and the output vectors of the non-training set to construct a risk assessment dataset, and input the risk assessment training set in the risk assessment dataset into the preset member information risk discrimination model for training; Prediction module 305 is used to input the sample to be detected into the shadow model after training, generate a prediction vector, input it into the member information risk discrimination model after training, and output the member risk probability. The comparison module 306 is used to compare the member risk probability with a preset probability threshold, and determine the risk of member information leakage based on the comparison result.

[0178] In some optional implementations, the acquisition module 301 includes: Acquisition unit, used to acquire the target collaborative reasoning model; The first extraction unit is used to extract the latter half of the target collaborative reasoning model and its corresponding model parameters. The selection unit is used to select a pre-trained model with the same data distribution as the target collaborative reasoning model; The building unit is used to construct a shadow model by splicing together the second half of the model and its corresponding model parameters based on the pre-trained model.

[0179] In some alternative implementations, training module 302 includes: A dataset unit is constructed to create a training set and a non-training set with the same data distribution as the target data, and the training set and the non-training set are combined to generate a shadow dataset; The training unit is used to input the training set into the shadow model, train the pre-trained model of the shadow model using the training set, and maintain the model parameters of the second half of the model to obtain the shadow model after training.

[0180] In some alternative implementations, the input module 303 includes: The first input unit is used to input the training set into the shadow model after training and output the training set output vector. The second input unit is used to input the non-training set into the shadow model after training and output the non-training set output vector.

[0181] In some alternative implementations, the incorporation module 304 includes: The annotation unit is used to annotate member labels on the output vector of the training set and non-member labels on the output vector of the non-training set to construct a risk assessment dataset. The partitioning unit is used to divide the risk assessment dataset into a risk assessment training set and a risk assessment test set according to a preset ratio; The model building unit is used to build an initial member information risk assessment model. The second extraction unit is used to extract the statistical features of the risk assessment training set and input them into the initial member information risk discrimination model for training. The third extraction unit is used to extract the statistical features of the risk assessment test set and input them into the trained member information risk discrimination model for testing, thereby generating the target member information risk discrimination model.

[0182] In some alternative implementations, the prediction module 305 includes: The sample acquisition unit is used to acquire the sample to be tested. The prediction unit is used to input the sample to be detected into the shadow model after training and generate a prediction vector. The output unit is used to input the prediction vector into the target member information risk discrimination model and output the member risk probability.

[0183] In some alternative implementations, the comparison module 306 includes: The judgment unit is used to determine whether the risk probability of a member is greater than a preset probability threshold. The determination unit is used to determine if there is a risk of leakage of member information if so.

[0184] The sensitive data privacy leakage behavior assessment device provided in this embodiment of the invention can execute the sensitive data privacy leakage behavior assessment method provided in any embodiment of the invention, and has the corresponding functional modules and beneficial effects for executing the method. Further functional descriptions of the various modules and units described above are the same as in the corresponding embodiments described above, and will not be repeated here.

[0185] Figure 5 This is a schematic diagram of the structure of an electronic device provided in an embodiment of the present invention.

[0186] The following is a detailed reference. Figure 5 This diagram illustrates a structural schematic suitable for implementing an electronic device according to embodiments of the present invention. The electronic device may include a processor (e.g., a central processing unit, graphics processor, etc.) 401, which can perform various appropriate actions and processes according to a program stored in read-only memory (ROM) 402 or a program loaded from memory 408 into random access memory (RAM) 403. The RAM 403 also stores various programs and data required for the operation of the electronic device. The processor 401, ROM 402, and RAM 403 are interconnected via a bus 404. An input / output (I / O) interface 405 is also connected to the bus 404.

[0187] Typically, the following devices can be connected to I / O interface 405: input devices 406 including, for example, touchscreens, touchpads, keyboards, mice, cameras, microphones, accelerometers, gyroscopes, etc.; output devices 407 including, for example, liquid crystal displays (LCDs), speakers, vibrators, etc.; memory devices 408 including, for example, magnetic tapes, hard disks, etc.; and communication devices 409. Communication device 409 allows electronic devices to communicate wirelessly or wiredly with other devices to exchange data. Although Figure 5 Electronic devices with various devices are shown, but it should be understood that it is not required to implement or have all of the devices shown, and more or fewer devices may be implemented or have instead.

[0188] In particular, according to embodiments of the present invention, the processes described above with reference to the flowcharts can be implemented as computer software programs. For example, embodiments of the present invention include a computer program product comprising a computer program carried on a non-transitory computer-readable medium, the computer program containing program code for performing the methods shown in the flowcharts. In such embodiments, the computer program can be downloaded and installed from a network via a communication device 409, or installed from a memory 408, or installed from a ROM 402. When the computer program is executed by the processor 401, it performs the functions defined in the sensitive data privacy leakage behavior assessment method of the embodiments of the present invention.

[0189] Figure 5 The electronic device shown is merely an example and should not be construed as limiting the functionality and scope of the embodiments of the present invention.

[0190] This invention also provides a computer-readable storage medium. The methods described above according to embodiments of the invention can be implemented in hardware or firmware, or implemented as computer code that can be recorded on a storage medium, or implemented as computer code downloaded via a network and originally stored on a remote storage medium or a non-transitory machine-readable storage medium and then stored on a local storage medium. Thus, the methods described herein can be processed by software stored on a storage medium using a general-purpose computer, a dedicated processor, or programmable or dedicated hardware. The storage medium can be a magnetic disk, optical disk, read-only memory, random access memory, flash memory, hard disk, or solid-state drive, etc.; further, the storage medium can also include combinations of the above types of memory. It is understood that computers, processors, microprocessor controllers, or programmable hardware include storage components capable of storing or receiving software or computer code. When the software or computer code is accessed and executed by the computer, processor, or hardware, the sensitive data privacy leakage assessment method shown in the above embodiments is implemented.

[0191] Although embodiments of the invention have been described in conjunction with the accompanying drawings, those skilled in the art can make various modifications and variations without departing from the spirit and scope of the invention, and such modifications and variations all fall within the scope defined by the appended claims.

Claims

1. A method for assessing sensitive data privacy leakage behavior, characterized in that, The method includes: Obtain the latter half of the target collaborative reasoning model and its corresponding model parameters, and then splice it with the preset pre-trained model to construct a shadow model; The training set from the shadow dataset is input into the shadow model for training; Input the training set and non-training set from the shadow dataset into the trained shadow model, and output the training set output vector and the non-training set output vector. By combining the output vectors of the training set and the output vectors of the non-training set, a risk assessment dataset is constructed, and the risk assessment training set in the risk assessment dataset is input into a preset member information risk discrimination model for training. Input the sample to be detected into the trained shadow model to generate a prediction vector, and input the prediction vector into the trained member information risk discrimination model to output the member risk probability. The member risk probability is compared with a preset probability threshold, and the member information is determined to be at risk of being leaked based on the comparison result.

2. The method according to claim 1, characterized in that, The process of obtaining the latter half of the target collaborative reasoning model and its corresponding model parameters, and then splicing it with a pre-trained model to construct a shadow model, includes: Obtain the target collaborative reasoning model; Extract the latter half of the target collaborative reasoning model and its corresponding model parameters; Select a pre-trained model with the same data distribution as the target collaborative reasoning model; Based on the pre-trained model, the shadow model is constructed by concatenating the latter half of the model and its corresponding parameters.

3. The method according to claim 1, characterized in that, The step of inputting the training set from the shadow dataset into the shadow model for training includes: Construct a training set and a non-training set with the same data distribution as the target data, and combine the training set and the non-training set to generate a shadow dataset; The training set is input into the shadow model, and the pre-trained model of the shadow model is trained using the training set, while maintaining the model parameters of the latter half of the model, to obtain the shadow model after training.

4. The method according to claim 3, characterized in that, The step of inputting the training set and non-training set from the shadow dataset into the trained shadow model, and outputting the training set output vector and the non-training set output vector, includes: Input the training set into the trained shadow model and output the training set output vector. The non-training set is input into the shadow model after training, and the non-training set output vector is output.

5. The method according to claim 1, characterized in that, The step of constructing a risk assessment dataset by combining the output vectors of the training set and the output vectors of the non-training set, and then inputting the risk assessment training set from the risk assessment dataset into a preset member information risk discrimination model for training, includes: A risk assessment dataset is constructed by labeling member labels onto the output vector of the training set and non-member labels onto the output vector of the non-training set. The risk assessment dataset is divided into a risk assessment training set and a risk assessment test set according to a preset ratio; Construct an initial member information risk assessment model; Extract the statistical features of the risk assessment training set and input them into the initial member information risk discrimination model for training; Extract the statistical features of the risk assessment test set and input them into the trained member information risk discrimination model for testing to generate the target member information risk discrimination model.

6. The method according to claim 5, characterized in that, The step of inputting the sample to be detected into the trained shadow model, generating a prediction vector, inputting it into the trained member information risk discrimination model, and outputting the member risk probability includes: Obtain the sample to be tested; The sample to be detected is input into the shadow model after training to generate a prediction vector; The predicted vector is input into the target member information risk discrimination model, and the member risk probability is output.

7. The method according to claim 1, characterized in that, The step of comparing the member risk probability with a preset probability threshold and determining that member information is at risk of leakage based on the comparison result includes: Determine whether the risk probability of the member is greater than a preset probability threshold; If so, it is determined that there is a risk of member information leakage.

8. A device for assessing sensitive data privacy leakage behavior, characterized in that, The device includes: The acquisition module is used to acquire the latter half of the target collaborative reasoning model and its corresponding model parameters, and to splice it with the preset pre-trained model to construct a shadow model. The training module is used to input the training set from the shadow dataset into the shadow model for training; The input module is used to input the training set and non-training set from the shadow dataset into the shadow model after training, and output the training set output vector and the non-training set output vector. The module is used to combine the output vector of the training set and the output vector of the non-training set to construct a risk assessment dataset, and input the risk assessment training set in the risk assessment dataset into a preset member information risk discrimination model for training. The prediction module is used to input the sample to be detected into the shadow model after training, generate a prediction vector, input it into the member information risk discrimination model after training, and output the member risk probability. The comparison module is used to compare the member risk probability with a preset probability threshold, and determine the risk of member information leakage based on the comparison result.

9. An electronic device, characterized in that, include: A memory and a processor are communicatively connected, the memory stores computer instructions, and the processor executes the computer instructions to perform the sensitive data privacy leakage assessment method according to any one of claims 1 to 7.

10. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores computer instructions for causing the computer to execute the sensitive data privacy leakage assessment method according to any one of claims 1 to 7.

Images