AI model inference method and apparatus

Abstract

The present invention discloses an AI model inference device and method. According to the present embodiment, an AI model inference device is provided comprising: a processor; and a memory connected to the processor, wherein the memory stores program instructions executed by the processor to determine whether the target model corresponds to a gray box environment or a black box environment using the output value of the target model, to obtain output values ​​by inputting data identical to the target model into a plurality of AI models included in a candidate model group, to obtain a first feature or a second feature by processing the output value of each of the plurality of AI models differently according to the environment of the target model, and to determine an AI model corresponding to the target model by inputting the output value of each of the plurality of AI models and the first feature or the second feature into a pre-trained model type classifier.

Description

Technology Field

[0001] The present invention relates to an AI model inference method and apparatus. Background Technology

[0002] Artificial intelligence is not only being introduced as a service in the fields of computer vision and natural language processing, but is also expanding its scope to include the military sector, where nationally important decision-making is required, and aircraft systems. Commercialized AI models are distributed to users in a black-box state that does not expose model information to protect intellectual property rights and information.

[0003] However, even if the deployed AI model is in a black box state, it faces the risk of being subjected to attacks by attackers that leak training data information, degrade the model's performance, or induce the model to operate incorrectly.

[0004] A representative attack that extracts target model information in a black-box environment is the model extraction attack, in which an attacker queries the model to create a replacement model similar to the target model.

[0005] If it becomes possible to infer the type of deep learning-based AI model, it becomes easier to create a replacement model with a structure more similar to the target model than to create a replacement model that mimics the functions of the target model through model extraction attacks. This makes it easier to determine the model's parameters, ultimately allowing a model in a black-box environment to be easily converted into a model in a white-box environment.

[0006] As a result, it becomes vulnerable to model inversion attacks, attacks requiring alternative models including adversarial examples, and various other attacks. Therefore, from an attacker's perspective, being able to infer the type of model and determine layer configuration information can serve as a significant hint for attacking the target model. Prior art literature

[0007] US Patent Publication 2021 / 0334403 The problem to be solved

[0008] To solve the problems of the aforementioned prior art, the present invention proposes an AI model inference method and apparatus that, when commercializing an AI model, allow the model distributor to distribute it in a state where only limited information is allowed, or induce the AI ​​model to be difficult to infer through ensemble learning of multiple models. means of solving the problem

[0009] To achieve the above-mentioned purpose, according to one embodiment of the present invention, an AI model inference device is provided comprising: a processor; and a memory connected to the processor, wherein the memory stores program instructions executed by the processor to determine whether the target model corresponds to a gray box environment or a black box environment using the output value of the target model, to obtain output values ​​by inputting data identical to the target model into a plurality of AI models included in a candidate model group, to obtain a first feature or a second feature by processing the output value of each of the plurality of AI models differently according to the environment of the target model, and to determine an AI model corresponding to the target model by inputting the output value of each of the plurality of AI models and the first feature or the second feature into a pre-trained model type classifier.

[0010] The above multiple AI models may include one of AlexNet, ResNet, VGGNet, and Simple ConvNet.

[0011] The above program commands can determine the environment of the target model as the gray box environment when the output value of the target model is a probability value by class and a probability ranking by class for the data input to the target model.

[0012] When the environment of the target model is determined to be the gray box environment, the above program commands calculate the average value of the probability values ​​of the remaining classes excluding the probability value of the correct class using the class-specific probability values ​​output by each of the plurality of AI models, and assign 0 to the class having a probability value smaller than the average value and 1 to the class having a probability value larger than the average value, thereby processing the class-specific probability values ​​output by each of the plurality of AI models into the first feature.

[0013] The above program commands can determine the environment of the target model as the black box environment when the output value of the target model is a probability ranking by class for the data input to the target model.

[0014] When the environment of the target model is determined to be the black box environment, the above program instructions determine the median class according to the class-specific probability ranking output by each of the plurality of AI models, and assign 1 to the median class from the highest class and 0 to the lowest class from the next class of the median class, thereby processing the class-specific probability ranking output by each of the plurality of AI models into a second feature.

[0015] The above model type classifier can learn using the output value of each of the plurality of AI models and the first feature or the second feature in each of the gray box environment and the black box environment.

[0016] According to another aspect of the present invention, a method for inferring an AI model is provided in a device comprising a processor and a memory, comprising: a step of determining whether the target model corresponds to a gray box environment or a black box environment using the output value of the target model; a step of obtaining output values ​​by inputting data identical to that of the target model into a plurality of AI models included in a candidate model group; a step of obtaining a first feature or a second feature by processing the output value of each of the plurality of AI models differently according to the environment of the target model; and a step of determining an AI model corresponding to the target model by inputting the output value of each of the plurality of AI models and the first feature or the second feature into a pre-trained model type classifier.

[0017] According to another aspect of the present invention, a computer-readable storage medium is provided that stores a program for performing the above-described method. Effects of the invention

[0018] According to the present invention, there is an advantage in that it can induce the model distributor to enhance the security of the AI ​​model by determining whether the target model is in a gray box environment or a black box environment, processing output values ​​in different ways depending on the determined environment, and accurately inferring a model close to the target model by using the processed information together. Brief explanation of the drawing

[0019] FIG. 1 is a diagram illustrating the configuration of an AI model inference device according to a preferred embodiment of the present invention. FIG. 2 is a diagram illustrating the AI ​​model inference process in a gray box environment according to the present embodiment. Figure 3 is a diagram illustrating the AI ​​model inference process in a black box environment. FIG. 4 is a drawing for explaining the feature processing process according to the present embodiment. Figure 5 shows the performance of a model type classifier trained using data with a first feature added based on the AUC and precision-recall graphs in a gray box environment. Figure 6 shows the performance of a model type classifier trained using data with a second feature added based on the AUC and precision-recall graphs in a black box environment. Specific details for implementing the invention

[0020] The present invention is capable of various modifications and may have various embodiments, and specific embodiments are illustrated in the drawings and described in detail. However, this is not intended to limit the invention to specific embodiments, and it should be understood that the invention includes all modifications, equivalents, and substitutions that fall within the spirit and scope of the invention.

[0021] The terms used herein are merely for describing specific embodiments and are not intended to limit the invention. Singular expressions include plural expressions unless the context clearly indicates otherwise. In this specification, terms such as “comprising” or “having” are intended to indicate the presence of the features, numbers, steps, actions, components, parts, or combinations thereof described in the specification, and should be understood as not precluding the existence or addition of one or more other features, numbers, steps, actions, components, parts, or combinations thereof.

[0022] Furthermore, the components of the embodiments described with reference to each drawing are not limited to the respective embodiments and may be implemented to be included in other embodiments within the scope of maintaining the technical spirit of the present invention. It is also obvious that multiple embodiments may be re-implemented as a single embodiment that integrates multiple embodiments, even if a separate description is omitted.

[0023] Furthermore, in the description referring to the attached drawings, identical components are assigned the same or related reference numerals regardless of drawing symbols, and redundant descriptions thereof are omitted. In describing the present invention, if it is determined that a detailed description of related prior art could unnecessarily obscure the essence of the present invention, such detailed description is omitted.

[0025] FIG. 1 is a diagram illustrating the configuration of an AI model inference device according to a preferred embodiment of the present invention.

[0026] As illustrated in FIG. 1, the device according to the present embodiment may include a processor (100) and a memory (102).

[0027] The processor (100) may include a CPU (central processing unit) capable of executing computer programs or other virtual machines.

[0028] The memory (102) may include a non-volatile storage device such as a fixed hard drive or a removable storage device. The removable storage device may include a compact flash unit, a USB memory stick, etc. The memory (102) may also include volatile memory such as various random access memory.

[0029] The memory (102) stores program instructions for inferring an AI model that is close to the target model.

[0030] The program instructions according to the present embodiment determine whether the target model corresponds to a gray box environment or a black box environment using the output value of the target model, obtain output values ​​by inputting the same data as the target model into a plurality of AI models included in a candidate model group, obtain a first feature or a second feature by processing the output values ​​of each of the plurality of AI models differently according to the environment of the target model, and determine the AI ​​model corresponding to the target model by inputting the output values ​​of each of the plurality of AI models and the first feature or the second feature into a pre-trained model type classifier.

[0031] FIG. 2 is a diagram showing the AI ​​model inference process in a gray box environment according to the present embodiment, and FIG. 3 is a diagram showing the AI ​​model inference process in a black box environment.

[0032] This embodiment infers the type of target model from the output values ​​that an attacker can obtain in gray-box and black-box environments.

[0033] The device according to the present embodiment determines the environment of the target model as a Gray Box environment when, after the target model is deployed, the output value of the data input to the target model that the attacker can possess is a probability value by class and a probability ranking by class, and determines the environment of the target model as a Black Box environment when only the probability ranking information by class can be obtained.

[0034] According to the present embodiment, the output value of each of a plurality of AI models is input into a pre-trained Model Type Classifier based on a Multi-Layer Perceptron (MLP) to determine the AI ​​model corresponding to the target model.

[0035] The model type classifier according to the present embodiment may be an MLP model composed of two layers: an input layer, an output layer, and a fully connected layer, wherein the activation function of the hidden layer is ReLU and the activation function of the output layer is softmax.

[0036] The AI ​​model corresponding to the target model can be determined as one of a plurality of AI modules belonging to a candidate model group, and the plurality of AI models may include one of AlexNet, ResNet, VGGNet, and Simple ConvNet.

[0037] AlexNet is a model with a structure of 5 convolutional layers and 3 fully-connected layers. It uses the ReLu function as the activation function. Additionally, it is characterized by improved accuracy achieved through the use of Overlapping Pooling and Local Response Normalization (LRN).

[0038] VGGNet is classified into A, A-LRN, B, C, D, and E based on model depth, among which VGG16 (D) and VGG19 (E) are widely used for image recognition. It is a network that focuses on the impact of model depth on the error rate of object recognition. Since performance improves with greater depth, VGGNet utilizes the smallest 3×3 convolution filters in all layers to apply as many ReLU activation functions as possible. This results in stronger non-linearity, enabling superior performance, and subsequent CNN models have adopted deeper structures than their predecessors.

[0039] ResNet is a network that solves the vanishing gradient and gradient explosion problems, where small derivatives converge to zero or large derivatives diverge to excessively large values ​​as the neural network model deepens, through skip connections (shortcuts) and residual learning, and enables high performance in sufficiently deep structures.

[0040] Simple ConvNet is a simple convolutional network with two convolutional layers and two max pooling and dropout layers (0.5).

[0041] According to the present embodiment, processed features that make the data more intuitive and less noisy are used to improve the model type classifier compared to when only the output values ​​of each AI model belonging to the candidate model group are used.

[0042] As described above, the device according to the present embodiment determines whether the target model corresponds to a gray box environment or a black box environment using the output value of the target model, and obtains output values ​​by inputting the same data as the target model into a plurality of AI models included in a candidate model group.

[0043] Subsequently, depending on the environment of the target model, the output values ​​of each of the aforementioned multiple AI models are processed differently to obtain a first feature or a second feature.

[0044] Finally, the data combining the model's output values ​​and the features processed using those output values ​​is input into a model type classifier to infer the type of AI model.

[0045] The feature processing process is explained in more detail below.

[0046] As mentioned above, if the output of the target model is the probability value and probability ranking by class for the data input to the target model, the environment of the target model is defined as a gray box environment.

[0047] In a gray-box environment, class-specific probability values ​​(probability vectors), which are information obtainable, are output from a high-accuracy model. However, due to the influence of the softmax function, large probability values ​​exist only for the correct class, while the absolute values ​​of the remaining probability values ​​for other classes become very small; consequently, the intuitive manifestation of these characteristics is suppressed, and the amount of information that can be conveyed becomes scarce.

[0048] In this embodiment, the output value in a gray box environment that reveals the relative magnitude relationship between elements by correcting the influence of the softmax function is processed into the first feature (Feature 1).

[0049] FIG. 4 is a drawing for explaining the feature processing process according to the present embodiment.

[0050] The process of processing the output value of the AI ​​model into the first feature is as shown in lines 7 to 14 of FIG. 4.

[0051] Referring to Figure 4, the average value of the probability values ​​of the remaining classes, excluding the probability value of the correct class, is calculated (rows 9-10), and 0 is assigned to classes with values ​​smaller than the average value and 1 to classes with values ​​larger than the average value, thereby processing the output values ​​(probability values ​​by class) output by multiple AI models belonging to the candidate model group into the first feature.

[0052] In a gray box environment, as shown in row 15 of FIG. 4, data combining the probability value of each AI model by class, the ascending rank of the probability of each class (probability ranking), and the first feature processed from the probability value of each AI model by class is input into a model type classifier to determine the AI ​​model corresponding to the target model.

[0053] The model type classifier according to the present embodiment can be pre-trained using a probability value by class, a probability ranking by class, and a first feature, and after training is completed, performs a process of determining an AI model corresponding to a target model.

[0054] The device according to the present embodiment defines an environment in which only ranking information of the probability of each class of the target model can be obtained as a black box environment.

[0055] In a black box environment where only probability ranking information by class can be obtained, the probability values ​​by class are unknown. Therefore, according to the present embodiment, the median class is determined based on the probability ranking by class, and 1 is assigned to the median class from the highest class and 0 to the lowest class from the next class, thereby processing the probability ranking by class output by each AI model into a second feature.

[0056] The processing method for the second feature is the same as lines 20 to 26 of FIG. 4.

[0057] In a black box environment, the second feature processed as described above is used as training data along with class-specific ranking information output by each AI model belonging to the candidate model group to train a model type classifier, and an AI model corresponding to the target model is determined.

[0058] The model type classifier is trained using the output values ​​from the gray-box and black-box environments, respectively, and the processed first or second feature, and after training is complete, it infers the AI ​​model closest to the target model among multiple AI models belonging to the candidate model group.

[0059] In the following, we describe an experiment on the process of inferring an AI model using 30,000 handwritten images from the MNIST dataset, with the candidate models for the target model being CNN models AlexNet, ResNet, VGGNet, and Simple ConvNet.

[0060] The output probability vectors obtained by inputting 30,000 data points from the MNIST training dataset that were not used to train the target model into the target model are used as training data for the model type classifier. The model type classifier is trained using a total of 120,000 output probability vectors, with 30,000 for each model.

[0061] Four model ground truth labels are used as the ground truths. When training the model type classifier, the learning rate is set to 0.001, the optimizer to RMSprop, the batch size to 256, and the epochs to 100. The performance of MTC is compared across experimental conditions using test accuracy and training accuracy. All experiments were conducted using the same model with the same fixed parameters.

[0062] Through a model type classifier trained using the class-specific probability values ​​and class-specific probability ranking information of each AI model, one of the AlexNet, ResNet, VGGNet, and Simpe ConvNet models is classified as corresponding to the target model with a classification accuracy of 95% or higher as shown in Table 1 below.

[0063]

[0064] Table 2 below shows the results of model type classification in gray box and black box environments, respectively.

[0065]

[0066] Referring to Table 2, the accuracy of the model type classifier trained using only the class-specific probability values ​​of each AI model in a graybox environment (GrayBox Attack column of Table 2) is about 0.8, while the accuracy of the model type classifier trained using the first feature along with the class-specific probability values ​​is about 0.88, confirming that the model type is inferred more efficiently when using the processed first feature.

[0067] In addition, as shown in Fig. 5, when a model type classifier is trained using data with the first feature added based on the AUC and precision-recall graphs, it can be seen that the model classification performance is improved.

[0068] In a black-box environment, where an attacker only knows the probability ranking information by class output from the target model, it can be a significant vulnerability if the model type classifier can accurately infer the model type. This is because, in reality, the attacker is highly likely to be provided with the model they intend to attack in a black-box environment. The results of model type classification in a black-box environment are as shown in the BlackBox Attack column of Table 2 above.

[0069] The accuracy of the model type classifier trained only on class-specific ranking information is about 0.66, and since it is provided with relatively limited information compared to a gray box environment, the performance of model type inference is slightly lower.

[0070] However, as in this embodiment, when a second feature is added, it can be seen that the accuracy of the model type classifier is significantly improved to about 0.83.

[0071] The effectiveness of feature processing can also be confirmed through the ROC curve of Fig. 6 and the precision-recall graph.

[0072] An attacker has the potential to infer the type of model even in a black-box environment by manipulating the model's output values ​​and simple features, without needing the model's class-specific probability values.

[0073] According to the present embodiment, a gray box environment and a black box environment are determined based on information obtainable from a target model, a model type classifier is trained using features processed in each environment, and by determining the type of target model, a model distributor can check the security level of the model they distribute in advance and thereby be encouraged to strengthen security.

[0074] The embodiments of the present invention described above are disclosed for illustrative purposes only, and those skilled in the art with ordinary knowledge of the present invention may make various modifications, changes, and additions within the spirit and scope of the present invention, and such modifications, changes, and additions should be considered to fall within the scope of the following claims.

Claims

Claim 1 processor; and includes a memory connected to the processor, wherein the memory stores program instructions executed by the processor to determine whether the target model corresponds to a gray box environment or a black box environment using the output value of the target model, to obtain output values ​​by inputting the same data as the target model into a plurality of AI models included in a candidate model group, to obtain a first feature or a second feature by processing the output values ​​of each of the plurality of AI models differently according to the environment of the target model, and to determine an AI model corresponding to the target model by inputting the output values ​​of each of the plurality of AI models and the first feature or the second feature into a pre-trained model type classifier, wherein the program instructions determine the environment of the target model as the gray box environment if the output value of the target model is a class-specific probability value and a class-specific probability ranking for the data input to the target model, and when the environment of the target model is determined as the gray box environment, to calculate the average value of the probability values ​​of the remaining classes excluding the probability value of the correct class using the class-specific probability values ​​output by each of the plurality of AI models, and to assign 0 to a class having a probability value smaller than the average value, and to a class having a probability value larger than the average value An AI model inference device that assigns 1 to a class and processes the class-specific probability values ​​output by each of the plurality of AI models into a first feature. Claim 2 In claim 1, the plurality of AI models is an AI model inference device comprising one of AlexNet, ResNet, VGGNet and Simple ConvNet. Claim 3 delete Claim 4 delete Claim 5 In claim 1, the program instructions are an AI model inference device that determines the environment of the target model as the black box environment when the output value of the target model is a class-specific probability ranking for data input to the target model. Claim 6 In claim 5, the program instructions determine a median class according to the class-specific probability ranking output by each of the plurality of AI models when the environment of the target model is determined to be the black box environment, and assign 1 to the median class from the highest class and 0 to the lowest class from the class following the median class, thereby processing the class-specific probability ranking output by each of the plurality of AI models into a second feature. Claim 7 In claim 1, the model type classifier is an AI model inference device that is learned using the output value of each of the plurality of AI models and the first feature or the second feature in each of the gray box environment and the black box environment. Claim 8 A method for inferring an AI model in a device including a processor and memory, comprising: a step of determining whether the target model corresponds to a gray box environment or a black box environment using the output value of the target model; a step of obtaining output values ​​by inputting data identical to that of the target model into a plurality of AI models included in a candidate model group; and a step of obtaining a first feature or a second feature by processing the output values ​​of each of the plurality of AI models differently according to the environment of the target model. A method for AI model inference comprising the step of determining an AI model corresponding to a target model by inputting the output value of each of the plurality of AI models and the first feature or second feature into a pre-trained model type classifier, wherein the determining step determines the environment of the target model as a gray box environment or a black box environment based on whether the output value of the target model includes both the class-specific probability value and the class-specific probability ranking for the data input to the target model, or whether it includes only the class-specific probability ranking; and the acquiring step, when the environment of the target model is determined to be a gray box environment, calculates the average value of the probability values ​​of the remaining classes excluding the probability value of the correct class using the class-specific probability values ​​output by each of the plurality of AI models, assigns 0 to a class having a probability value smaller than the average value, and 1 to a class having a probability value larger than the average value, thereby processing the class-specific probability values ​​output by each of the plurality of AI models into a first feature. Claim 9 delete Claim 10 A computer-readable storage medium storing a program that performs the method according to paragraph 8.

Images