Model extraction attack defense apparatus and method

Abstract

A model hijacking attack defense device and method are disclosed. The model hijacking attack defense method is a model hijacking attack defense method performed by a model hijacking attack defense device, and may include the steps of: receiving encrypted input data from a terminal at an input unit of the model hijacking attack defense device; obtaining encrypted first inference data corresponding to the encrypted input data using a pre-trained target learning model at a data processing unit of the model hijacking attack defense device; obtaining encrypted second inference data corresponding to the encrypted input data using a pre-trained fake learning model at a data processing unit; determining whether the encrypted input data is aggressive by performing a function set for the encrypted input data at a detector of the model hijacking attack defense device; and selecting the encrypted first inference data or the encrypted second inference data according to whether the encrypted input data is aggressive at a processor of the model hijacking attack defense device, and providing the selected inference data to the terminal.

Description

Technology Field

[0001] The present invention relates to a model hijacking attack defense device and method that utilizes a set function to easily determine whether encrypted input data is offensive and provides different inference data corresponding to the input data according to the determination result. Background Technology

[0002] The server receives encrypted input data from the terminal and, through a machine learning inference model, obtains inference data regarding the input data and provides it to the terminal. In this case, if the server determines that the input data is not offensive, it provides the first inference data obtained through a target learning model to the terminal, and if the server determines that the input data is offensive, it provides the second inference data obtained through a fake learning model to the terminal.

[0003] The terminal can decrypt inference data received from the server using a private key already stored internally. The terminal can perform a model hijacking attack by deriving a model based on the input data and the decrypted inference data.

[0004] At this time, when determining whether there is an attack, the server performs operations in an encrypted state, and due to constraints on possible operations (operations other than polynomial functions require polynomial function approximation, multiplication and rotation operations are highly inefficient, etc.), it is difficult to perform efficient operations, and as inferred data is obtained from the input data in an encrypted state, it is difficult to determine whether the input data is malicious data. The problem to be solved

[0005] The present invention aims to provide a model hijacking attack defense device and method that can easily determine whether input data is aggressive by efficiently performing calculations on encrypted input data from a terminal using at least one of a softmax function, a max function, and a thresholding function.

[0006] In addition, an embodiment of the present invention provides a first inference data obtained through a target learning model to a terminal when the input data is determined to be non-aggressive, and provides a second inference data obtained through a fake learning model to a terminal when the input data is determined to be aggressive, wherein the distribution of the second inference data is made similar to the distribution of the first inference data, thereby not only making it impossible for the terminal to infer the target learning model using the second inference data, but also making it impossible to recognize at all whether the second inference data is inference data obtained through a fake learning model, thereby preventing a retry of a model hijacking attack.

[0008] The problems that the present invention aims to solve are not limited to those mentioned above, and other problems and advantages of the present invention not mentioned can be understood from the following description and will be more clearly understood by the embodiments of the present invention. Furthermore, it will be understood that the problems and advantages that the present invention aims to solve can be realized by the means and combinations thereof set forth in the claims. means of solving the problem

[0009] A model hijacking attack defense device according to an embodiment of the present invention is a device for defending against model hijacking attacks and may include an input unit that receives encrypted input data from a terminal; a data processing unit that obtains encrypted first inference data corresponding to the encrypted input data using a pre-trained target learning model and obtains encrypted second inference data corresponding to the encrypted input data using a pre-trained fake learning model; a detector that performs a function set on the encrypted input data to determine whether the encrypted input data is offensive; and a processor that selects the encrypted first inference data or the encrypted second inference data according to whether the encrypted input data is offensive and provides the selected inference data to the terminal.

[0010] A model hijacking attack defense method according to an embodiment of the present invention is a model hijacking attack defense method performed by a model hijacking attack defense device, and may include: a step of receiving encrypted input data from a terminal at an input unit of the model hijacking attack defense device; a step of obtaining encrypted first inference data corresponding to the encrypted input data using a pre-trained target learning model (used in a target network) at a data processing unit of the model hijacking attack defense device; a step of obtaining encrypted second inference data corresponding to the encrypted input data using a pre-trained fake learning model (used in a fake network) at a data processing unit; a step of determining whether the encrypted input data is aggressive by performing a function set for the encrypted input data at a detector of the model hijacking attack defense device; and a step of selecting the encrypted first inference data or the encrypted second inference data according to whether the encrypted input data is aggressive at a processor of the model hijacking attack defense device, and providing the selected inference data to the terminal.

[0012] In addition to this, other methods for implementing the present invention, other systems, and computer-readable recording media storing a computer program for executing said methods may be further provided.

[0013] Other aspects, features, and advantages other than those described above will become clear from the following drawings, claims, and detailed description of the invention. Effects of the invention

[0014] According to the present invention, a model hijacking attack defense device and method can be provided that can easily determine whether the input data is aggressive by efficiently performing operations on encrypted input data from a terminal using at least one of a softmax function, a max function, and a threshold holding function.

[0015] In addition, according to the present invention, when input data is determined to be non-aggressive, first inference data obtained through a target learning model is provided to the terminal, and when input data is determined to be aggressive, second inference data obtained through a fake learning model is provided to the terminal, wherein the distribution of the second inference data is made similar to the distribution of the first inference data, thereby not only making it impossible for the terminal to infer the target learning model using the second inference data, but also making it impossible to recognize at all whether the second inference data is inference data obtained through a fake learning model, thereby preventing a retry of a model hijacking attack.

[0017] The effects of the present invention are not limited to those mentioned above, and other unmentioned effects will be clearly understood by those skilled in the art from the description below. Brief explanation of the drawing

[0018] FIG. 1 is a drawing illustrating an example of the configuration of a system including a model hijacking attack defense device according to an embodiment of the present invention. FIG. 2 is a drawing illustrating an example of the configuration of a model hijacking attack defense device according to an embodiment of the present invention. FIG. 3 is a diagram illustrating the processing process in a model hijacking attack defense device according to an embodiment of the present invention. Figure 4 is a diagram visualizing inference data provided by a model hijacking attack defense device according to an embodiment of the present invention based on t-sne (t-distribution probabilistic embedding). Figure 5 is a diagram showing the performance of the attacker and the performance of the target model according to the computational environment. FIG. 6 is a flowchart illustrating a method for defending against model hijacking attacks according to an embodiment of the present invention. Specific details for implementing the invention

[0019] The advantages and features of the present invention, and the methods for achieving them, will become clear by referring to the embodiments described in detail together with the accompanying drawings. However, the present invention is not limited to the embodiments presented below, but can be implemented in various different forms and should be understood to include all modifications, equivalents, and substitutions that fall within the spirit and scope of the present invention. The embodiments presented below are provided to ensure that the disclosure of the present invention is complete and to fully inform those skilled in the art of the scope of the invention. In describing the present invention, detailed descriptions of related known technologies are omitted if it is determined that such detailed descriptions may obscure the essence of the present invention.

[0020] The terms used in this application are used merely to describe specific embodiments and are not intended to limit the invention. Singular expressions include plural expressions unless the context clearly indicates otherwise. In this application, terms such as “comprising” or “having” are intended to indicate the presence of the features, numbers, steps, actions, components, parts, or combinations thereof described in the specification, and should be understood as not precluding the existence or addition of one or more other features, numbers, steps, actions, components, parts, or combinations thereof. Terms such as “first,” “second,” etc., may be used to describe various components, but the components should not be limited by these terms. These terms are used solely for the purpose of distinguishing one component from another.

[0021] Additionally, in this application, "part" may be a hardware component, such as a processor or circuit, and / or a software component executed by a hardware component, such as a processor.

[0022] Hereinafter, embodiments according to the present invention will be described in detail with reference to the attached drawings. In describing with reference to the attached drawings, identical or corresponding components are given the same reference numerals, and redundant descriptions thereof will be omitted.

[0024] FIG. 1 is a drawing illustrating an example of the configuration of a system including a model hijacking attack defense device according to an embodiment of the present invention.

[0025] Referring to FIG. 1, a system (100) including a model hijacking attack defense device according to an embodiment of the present invention may include a terminal (110) and a model hijacking attack defense device (120).

[0026] The terminal (110) can transmit input data to the model hijacking attack defense device (120) and receive inference data regarding the input data from the model hijacking attack defense device (120). Here, the terminal (110) may include a communication terminal capable of performing the function of a computing device, and may be a smartphone, PC, or tablet PC, but is not limited thereto.

[0027] The model hijacking attack defense device (120) may be included, for example, in a server (not shown) communicating with a terminal (110), and when encrypted input data is received from the terminal (110), it may obtain encrypted inference data corresponding to the encrypted input data through a machine learning model (model) and provide it to the terminal (110). At this time, the model hijacking attack defense device (120) determines whether the encrypted input data is offensive and may provide the encrypted inference data corresponding to the encrypted input data differently depending on whether the encrypted input data is offensive.

[0028] A network (130) can connect a terminal (110) and a model hijacking attack defense device (120). Such a network (130) may include wired networks such as a LAN (local area network), WAN (wide area network), MAN (metropolitan area network), ISDN (integrated service digital network), or wireless networks such as WLAN (wireless LAN), CDMA (code-division multiple access), and satellite communication, but the scope of the present invention is not limited thereto. Additionally, the network (130) can transmit and receive information using short-range communication and / or long-range communication. Here, short-range communication may include Bluetooth, RFID (radio frequency identification), IrDA (infrared data association), UWB (ultra-wideband), ZigBee, and Wi-Fi technologies, and long-range communication may include CDMA (code-division multiple access), FDMA (frequency-division multiple access), TDMA (time-division multiple access), OFDMA (orthogonal frequency-division multiple access), and SC-FDMA (single carrier frequency-division multiple access) technologies.

[0029] The network (130) may include connections of network elements such as hubs, bridges, routers, and switches. The network (130) may include one or more connected networks, such as a multi-network environment, including a public network such as the Internet and a private network such as a secure corporate private network. Access to the network may be provided through one or more wired or wireless access networks.

[0030] Furthermore, the network (130) can support CAN (controller area network) communication, V2I (vehicle to infrastructure) communication, V2X (vehicle to everything) communication, WAVE (wireless access in vehicular environment) communication technology, and IoT (Internet of Things) network and / or 5G communication that exchanges and processes information between distributed components such as objects.

[0032] FIG. 2 is a drawing illustrating an example of the configuration of a model hijacking attack defense device according to an embodiment of the present invention.

[0033] Referring to FIG. 2, a model theft attack defense device (200) according to an embodiment of the present invention may include an input unit (210), a data processing unit (220), a detector (230), a processor (240), and a memory (250).

[0034] The input unit (210) can receive encrypted input data from the terminal.

[0035] The data processing unit (220) may include a first data processing unit (221) and a second data processing unit (222).

[0036] The first data processing unit (221) can obtain encrypted first inference data corresponding to encrypted input data by using a pre-trained target learning model (e.g., a privacy protection machine learning inference model). The target learning model (model) can be trained by supervised learning using training data that takes encrypted data as input and encrypted real inference data as labels, for example, but is not limited thereto.

[0037] The second data processing unit (222) can obtain encrypted second inference data corresponding to encrypted input data by using a pre-trained fake learning model. The fake learning model (model) may be trained in a supervised learning manner using training data that takes encrypted data as input and has encrypted fake inference data as label, for example, but is not limited thereto. In an embodiment, the fake learning model may be trained such that the similarity between the distribution of inference data output from the target learning model and the distribution of inference data output from the fake learning model is less than a set value. Accordingly, the similarity between the distribution of the second inference data and the distribution of the first inference data may be less than a set value.

[0038] The detector (230) may be, for example, an OOD (Out Of Distribution) detector and can determine whether the encrypted input data is offensive by performing a set function on the encrypted input data. At this time, the detector (230) may perform a function that approximates at least one of the transcendental function and comparison operation included in the encrypted input data as a homomorphic encryption and reduces the number of operations. In an embodiment, the detector (230) may perform at least one of a softmax function, a max function, and a thresholding function as a function on the encrypted input data.

[0039] If the detector (230) determines that the encrypted input data is not offensive when '1' is derived as a result of performing the set function, the detector (230) may determine that the encrypted input data is offensive when '0' is derived as a result of performing the set function.

[0040] In an embodiment, the detector (230) may determine that the encrypted input data is not offensive if the result of performing the set function falls within the set first range (a range corresponding to '1', e.g., 0.7 to 1). Additionally, the detector (230) may determine that the encrypted input data is offensive if the result of performing the set function falls within the set second range (a range corresponding to '0', e.g., 0 to 0.3).

[0041] The processor (240) can select encrypted first inference data or encrypted second inference data depending on whether there is an attack on the encrypted input data, and provide the selected inference data to the terminal.

[0042] The processor (240) controls the overall operation of the model hijacking attack defense device (200). For example, the processor (240) can control the input unit (210), data processing unit (220), detector (230), etc., by executing programs stored in memory (250), and thereby control the operation of the model hijacking attack defense device (200).

[0043] The processor (240) may be implemented using at least one of ASICs (application specific integrated circuits), DSPs (digital signal processors), DSPDs (digital signal processing devices), PLDs (programmable logic devices), FPGAs (field programmable gate arrays), controllers, microcontrollers, microprocessors, and other electrical units for performing functions.

[0044] The memory (250) is hardware that stores various data processed within the model hijacking attack defense device (200), is operably connected to the processor (240), and can store a program for processing and controlling the processor (240).

[0045] Additionally, the memory (250) may further store at least one of the target learning model and the fake learning model. Here, the target learning model and the fake learning model may be generated by the processor (240) or received from an external server and stored.

[0046] The memory (250) may include RAM (random access memory), such as DRAM (dynamic random access memory) and SRAM (static random access memory), ROM (read-only memory), EEPROM (electrically erasable programmable read-only memory), CD-ROM, Blu-ray or other optical disc storage, HDD (hard disk drive), SSD (solid state drive), or flash memory.

[0047] In addition, embodiments according to the present invention may be implemented in the form of a computer program that can be executed through various components on a computer, and such a computer program may be recorded on a computer-readable medium. In this case, the medium may include a magnetic medium such as a hard disk, a floppy disk, and a magnetic tape, an optical recording medium such as a CD-ROM and a DVD, a magneto-optical medium such as a floptical disk, and a hardware device specifically configured to store and execute program instructions, such as a ROM, RAM, or flash memory.

[0048] Meanwhile, the above-mentioned computer program may be one specifically designed and configured for the present invention, or one known and available to those skilled in the art of computer software. Examples of computer programs may include machine code, such as that generated by a compiler, as well as high-level language code that can be executed by a computer using an interpreter, etc.

[0050] FIG. 3 is a diagram illustrating the processing process in a model hijacking attack defense device according to an embodiment of the present invention.

[0051] Referring to FIG. 3, the model hijacking attack defense device (300) can obtain encrypted first inference data (f(x)) corresponding to the encrypted input data (x) by using a pre-trained target learning model (f) of a target network as encrypted input data (x) is received from a terminal.

[0052] Additionally, the model hijacking attack defense device (300) can obtain encrypted second inference data (g(x)) corresponding to encrypted input data by using a pre-trained fake learning model (g) of a fake network. The target network may be relatively larger than the fake network.

[0053] The model hijacking attack defense device (300) can determine whether the encrypted input data (x) is aggressive by performing a function set on the encrypted input data (x) through the OOD Detector (310).

[0054] The OOD Detector (310) can determine that the encrypted input data is not offensive if, as a result of performing a set function on the encrypted input data (x), '1' is produced (α=1). Additionally, the OOD Detector (310) can determine that the encrypted input data is offensive if, as a result of performing a set function on the encrypted input data (x), '0' is produced (α=0). At this time, the OOD Detector (310) can perform at least one of a softmax function, a max function, and a thresholding function as a function.

[0055] In an embodiment, the OOD Detector (310) can determine whether the input data (x) encrypted by a hard method or a soft method is offensive. The hard method and the soft method can be represented, for example, by [Equation 1].

[0056]

[0057] Here, And, f(x) represents the output value for the input data (x) in the target learning model (f). σ is the sigmoid function, and τ is the decision threshold, and means a simple decision based on τ.

[0058] The softmax function can be utilized as a function of q(z) > 0 for all z through the second Taylor approximation as shown in [Equation 2].

[0059]

[0060] The max function may be an approximation function that finds the maximum value by utilizing the maxInd_k function (a polynomial of 2^k dimensions that can be operated by a total of k multiplications), such that for a given vector, the index having the maximum value is close to 1 and the rest are close to 0, as in [Equation 3].

[0061]

[0062] Here, Is It means the maximum of. c can refer to the number of labels used when training the learning model (e.g., the target learning model). Also, k is It is the number of times that can be sufficiently derived, and it may be a preset value or, for example, a hyperparameter.

[0063] The thresholding function is as shown in [Equation 4], The comparison operation between (tau) and the max value obtained through [Equation 3] By representing it as an operation to find the maximum value of a vector containing (tau), the operations of maxInd and maxVal can be improved into a single maxInd operation. Here, maxInd is an operation to find the index of the largest value in the data set, and maxVal is an operation to find the largest value in the data set.

[0064]

[0065] The model hijacking attack defense device (300) can select either the encrypted first inference data (f(x)) or the encrypted second inference data (g(x)) depending on whether there is an attack on the encrypted input data (x), and provide the selected inference data (h(x)) to the terminal.

[0066] The inference data provided to the terminal can be represented by [Equation 5].

[0067]

[0068] That is, when α output from the OOD Detector (310) is 1, the first inference data (f(x)) output from the target learning model (f) is selected, and when α is 0, the second inference data (g(x)) output from the fake learning model (g) can be selected.

[0069] In the embodiment, the fake learning model is trained such that the similarity between the distribution of inference data output from the target learning model and the distribution of inference data output from the fake learning model is less than a set value, thereby making it difficult for an attacker of the terminal to bypass the model hijacking attack defense method of the present invention even if the attacker is aware of the model hijacking attack defense method of the present invention. At this time, the fake learning model may be trained based on Wasserstein regularization, such as [Equation 6], for example, in order to ensure that the similarity between the distributions is less than a set value.

[0070]

[0071] The method of approximating the operation of the OOD Detector (310) by theoretically approximating the hard operation with a polynomial can be equivalent to the method of defending in a soft manner as in [Equation 7].

[0072]

[0073] Figure 4 is a diagram visualizing inference data provided by a model hijacking attack defense device according to an embodiment of the present invention based on t-sne (t-distribution probabilistic embedding).

[0074] Referring to FIG. 4, FIG. 4(a) is a diagram visualizing, based on t-sne, first inference data obtained through a target learning model (f) when the input data is determined to be non-aggressive and second inference data obtained through a fake learning model (g_AM) when the input data is determined to be aggressive, in a conventional model hijacking attack defense method. At this time, as the first inference data obtained through the target learning model and the second inference data obtained through the fake learning model are clearly distinguished, the user of the terminal receiving the inference data (e.g., general user, attacker) can identify whether the provided inference data is inference data output from the target learning model that they intend to access or inference data output from the fake learning model. Accordingly, the conventional model hijacking attack defense method can provide an environment that allows for bypassing and attacking again by making it easy to know that the attack defense method is being applied.

[0075] FIG. 4(b) is a diagram visualizing, based on t-sne, the first inference data obtained using a target learning model (f) when the input data is determined to be non-aggressive and the second inference data obtained using a fake learning model (g_IAM) when the input data is determined to be aggressive in the model hijacking attack defense method of the present invention. At this time, by ensuring that the first inference data obtained through the target learning model and the second inference data obtained through the fake learning model are not clearly distinguishable, the user of the terminal receiving the inference data is unable to identify whether the provided inference data is inference data output from the target learning model that is actually intended to be accessed or inference data output from the fake learning model. Accordingly, the model hijacking attack defense method of the present invention can prevent the attacker from bypassing and attacking again by making it impossible to recognize that the attack defense method is being applied.

[0076] The model hijacking attack defense method of the present invention (e.g., IAM) can maintain the performance of the target model (Target accuracy) while lowering the performance of the attacker (Surrogate accuracy) compared to the defense method (Deceptive Perturbation:DP) in existing secret operation environments (using MPC, HE) (see Fig. 5). In addition, it can be confirmed that IAM (Indistinguishable Adversarial Manipulation) exhibits better performance than AM (Adversarial Manipulation) as a result of applying Wasserstein Regularization, which ensures that the output distribution of the fake network (or target learning model) is indistinguishable from the output distribution of the real network (or target learning model).

[0078] FIG. 6 is a flowchart illustrating a method for defending against a model hijacking attack according to an embodiment of the present invention. Here, the method for defending against a model hijacking attack can be performed by a model hijacking attack defense device.

[0079] Referring to FIG. 6, in step S610, the input section of the model hijacking attack defense device can receive encrypted input data from the terminal.

[0080] In step S620, the data processing unit of the model hijacking attack defense device can obtain encrypted first inference data corresponding to encrypted input data by using a pre-trained target learning model.

[0081] In step S630, the data processing unit of the model hijacking attack defense device can obtain encrypted second inference data corresponding to encrypted input data by using a pre-trained fake learning model. The fake learning model can be trained such that the similarity between the distribution of inference data output from the target learning model and the distribution of inference data output from the fake learning model is less than a set value.

[0082] In step S640, the detector of the model hijacking attack defense device can determine whether the encrypted input data is offensive by performing a set function on the encrypted input data. At this time, the detector can perform a function that approximates at least one of the transcendental function and comparison operation included in the encrypted input data as a homomorphic encryption and reduces the number of operations. For example, the detector can perform at least one of a softmax function, a max function, and a thresholding function as the said function on the encrypted input data.

[0083] The detector can determine that the encrypted input data is not malicious if '1' is produced as a result of executing the configured function. Additionally, the detector can determine that the encrypted input data is malicious if '0' is produced as a result of executing the configured function.

[0084] In an embodiment, the detector may determine that the encrypted input data is not malicious if the result of performing the set function falls within the set first range (a range corresponding to '1', e.g., 0.7 to 1). Additionally, the detector may determine that the encrypted input data is malicious if the result of performing the set function falls within the set second range (a range corresponding to '0', e.g., 0 to 0.3).

[0085] In step S650, the processor of the model hijacking attack defense device may select encrypted first inference data or encrypted second inference data depending on whether there is an attack on the encrypted input data, and provide the selected inference data to the terminal.

[0087] A model hijacking attack defense device according to an embodiment of the present invention can easily determine whether the input data is offensive by efficiently performing calculations on encrypted input data from a terminal using at least one of a softmax function, a max function, and a thresholding function.

[0088] In addition, the model hijacking attack defense device according to an embodiment of the present invention provides a first inference data obtained through a target learning model to a terminal when it is determined that the input data is not aggressive, and provides a second inference data obtained through a fake learning model to a terminal when it is determined that the input data is aggressive, by making the distribution of the second inference data similar to the distribution of the first inference data, not only prevents the terminal from inferring the target learning model using the second inference data, but also prevents the terminal from recognizing at all whether the second inference data is inference data obtained through a fake learning model, thereby preventing a retry of the model hijacking attack.

[0090] The embodiments according to the present invention described above may be implemented in the form of a computer program that can be executed through various components on a computer, and such a computer program may be recorded on a computer-readable medium. In this case, the medium may include a magnetic medium such as a hard disk, a floppy disk, and a magnetic tape, an optical recording medium such as a CD-ROM and a DVD, a magneto-optical medium such as a floptical disk, and a hardware device specifically configured to store and execute program instructions, such as a ROM, RAM, or flash memory.

[0091] Meanwhile, the above-mentioned computer program may be one specifically designed and configured for the present invention, or one known and available to those skilled in the art of computer software. Examples of computer programs may include machine code, such as that generated by a compiler, as well as high-level language code that can be executed by a computer using an interpreter, etc.

[0092] In the specification of the present invention (particularly in the claims), the use of the term "above" and similar descriptive terms may be in both singular and plural. Furthermore, where a range is described in the present invention, it is to include an invention to which individual values ​​belonging to said range are applied (unless otherwise stated), and this is equivalent to describing each individual value constituting said range in the detailed description of the invention.

[0093] Unless explicitly stated or contrary to the order of the steps constituting the method according to the present invention, said steps may be performed in a suitable order. The present invention is not necessarily limited by the order in which said steps are described. The use of all examples or exemplary terms (e.g., etc.) in the present invention is merely for the purpose of describing the present invention in detail, and the scope of the present invention is not limited by said examples or exemplary terms unless limited by the claims. Furthermore, those skilled in the art will understand that various modifications, combinations, and changes may be made according to design conditions and factors within the scope of the claims or equivalents to which they are added.

[0094] Accordingly, the scope of the present invention should not be limited to the embodiments described above, and all scopes equivalent to or equivalently modified from the claims set forth below, as well as the claims set forth below, shall be considered to fall within the scope of the concept of the present invention. Explanation of the symbols

[0095] 200: Model Hijacking Attack Defense Device 210: Input section 220: Data processing unit 230: Detector 240: Processor 250: Memory

Claims

Claim 1 A method for defending against a model hijacking attack performed by a model hijacking attack defense device, comprising: receiving encrypted input data from a terminal at an input unit of the model hijacking attack defense device; obtaining encrypted first inference data corresponding to the encrypted input data using a pre-trained target learning model at a data processing unit of the model hijacking attack defense device; obtaining encrypted second inference data corresponding to the encrypted input data using a pre-trained fake learning model separate from the target learning model at the data processing unit; determining whether the encrypted input data is aggressive by performing a function set for the encrypted input data at a detector of the model hijacking attack defense device; and selecting the encrypted first inference data or the encrypted second inference data according to whether the encrypted input data is aggressive at a processor of the model hijacking attack defense device, and providing the selected inference data to the terminal. Claim 2 A method for defending against model hijacking attacks according to claim 1, wherein the step of determining whether the encrypted input data is offensive includes the step of approximating at least one of the transcendental function and comparison operation included in the encrypted input data with a homomorphic encryption. Claim 3 A method for defending against model hijacking attacks according to claim 1, wherein the step of determining whether the encrypted input data is offensive includes the step of performing at least one of a softmax function, a max function, and a thresholding function as the function on the encrypted input data. Claim 4 A method for defending against model hijacking attacks according to claim 1, wherein the step of determining whether the encrypted input data is offensive comprises: a step of determining that the encrypted input data is not offensive if '1' is derived as a result of performing the set function; and a step of determining that the encrypted input data is offensive if '0' is derived as a result of performing the set function. Claim 5 A method for defending against model hijacking attacks according to claim 1, wherein the step of determining whether the encrypted input data is offensive includes: a step of determining that the encrypted input data is not offensive if the result of performing the set function falls within a set first range; and a step of determining that the encrypted input data is offensive if the result of performing the set function falls within a set second range. Claim 6 A method for defending against model hijacking attacks according to claim 1, wherein the fake learning model is trained such that the similarity between the distribution of inference data output from the target learning model and the distribution of inference data output from the fake learning model is less than a set value. Claim 7 A model hijacking attack defense device comprising: an input unit receiving encrypted input data from a terminal; a data processing unit acquiring encrypted first inference data corresponding to said encrypted input data using a pre-trained target learning model and acquiring encrypted second inference data corresponding to said encrypted input data using a pre-trained fake learning model separate from said target learning model; a detector that performs a function set for said encrypted input data to determine whether said encrypted input data is offensive; and a processor that selects said encrypted first inference data or said encrypted second inference data according to said whether said encrypted input data is offensive and provides said selected inference data to said terminal. Claim 8 In claim 7, the detector is a model hijacking attack defense device that approximates at least one of the transcendental function and comparison operation included in the encrypted input data as a homomorphic encryption. Claim 9 In claim 7, the detector performs at least one of a softmax function, a max function, and a thresholding function as the function on the encrypted input data, a model hijacking attack defense device. Claim 10 A model hijacking attack defense device according to claim 7, wherein the detector determines that the encrypted input data is not offensive if '1' is derived as a result of performing the set function, and determines that the encrypted input data is offensive if '0' is derived as a result of performing the set function. Claim 11 A model hijacking attack defense device according to claim 7, wherein the detector determines that the encrypted input data is not offensive if the result of performing the set function falls within a set first range, and determines that the encrypted input data is offensive if the result of performing the set function falls within a set second range. Claim 12 In claim 7, the fake learning model is a model hijacking attack defense device that is trained such that the similarity between the distribution of inference data output from the target learning model and the distribution of inference data output from the fake learning model is less than a set value.

Images