Data detection method and apparatus for deep learning model, and computer-readable storage medium and processor

Abstract

Disclosed in the present disclosure are a data detection method and apparatus for a deep learning model, and a computer-readable storage medium and a processor. The method comprises: in response to a deep learning model having completed a current training epoch in a target training environment, acquiring model parameters of the deep learning model; on the basis of the model parameters, determining a plurality of parameter features; on the basis of the plurality of parameter features and a plurality of parameter features respectively corresponding to training epochs before the current training epoch, constructing a target feature vector sequence; and detecting the target feature vector sequence to obtain a detection result, wherein the detection result is used for representing whether the deep learning model has executed a data attack behavior in the current training epoch, and the data attack behavior is used for representing that the deep learning model has acquired training data from the target training environment in the current training epoch.

Description

Data inspection methods, devices, computer-readable storage media, and processors for deep learning models

[0001] Cross-reference

[0002] This disclosure claims priority to Chinese Patent Publication No. 2024115447793, filed on October 31, 2024, entitled “Data Detection Method, Apparatus, Computer-Readable Storage Medium and Processor for Deep Learning Models”, the entire contents of which are incorporated herein by reference. Technical Field

[0003] This disclosure relates to the field of data security technology, and more specifically, to a data detection method, apparatus, computer-readable storage medium, and processor for a deep learning model. Background Technology

[0004] Currently, deep learning models can carry and reflect information from training data during training, and this information embedding capability poses a potential threat to data owners. For example, personnel with data mining privileges can modify machine learning algorithms or data processing procedures to exploit the information-carrying capability of deep learning models, specifying information encoded in model parameters and prediction results, thereby stealing the privacy data of data owners. These types of data theft attacks are typically highly covert, effectively bypassing traditional data access control and other security mechanisms, posing a significant threat to the security of data used for training deep learning models.

[0005] There is currently no effective solution to the aforementioned technical problem of being unable to deeply detect data attack behavior during the training process of deep learning models. Summary of the Invention

[0006] This disclosure provides a data detection method, apparatus, computer-readable storage medium, and processor for deep learning models, to at least address the technical problem of the inability to deeply detect data attack behavior of deep learning models during training.

[0007] According to one aspect of the present disclosure, a data detection method for a deep learning model is provided. The method may include: in response to the deep learning model completing a current training epoch in a target training environment, acquiring model parameters of the deep learning model, wherein the target training environment provides training data required for training the deep learning model; determining multiple parameter features based on the model parameters, wherein the multiple parameter features characterize the parameter distribution of the deep learning model's parameters after the current training epoch; constructing a target feature vector sequence based on the multiple parameter features and the multiple parameter features corresponding to previous training epochs, wherein the target feature vector sequence characterizes the parameter distribution characteristics of the deep learning model's parameters after the current training epoch, and the changing trend of the deep learning model's parameters with iterations of training epochs; and detecting the target feature vector sequence to obtain a detection result, wherein the detection result characterizes whether the deep learning model performed data attack behavior in the current training epoch, and the data attack behavior characterizes whether the deep learning model acquired training data from the target training environment in the current training epoch.

[0008] Optionally, based on the model parameters, multiple parameter features are determined, including: performing statistical analysis on the model parameters to obtain multiple parameter features, wherein the multiple parameter features include at least a first parameter feature, a second parameter feature, a third parameter feature, and a fourth parameter feature. The first parameter feature is used to characterize the concentration of the model parameter distribution, the second parameter feature is used to characterize the tailing of the model parameter distribution, the third parameter feature is used to characterize the distribution proportion of the model parameters within a specified interval, and the fourth parameter feature is used to characterize the steepness of the probability density curve corresponding to the model parameters. The specified interval is used to characterize the interval between two and three standard deviations to the left of the mean of the model parameters and the interval between two and three standard deviations to the right of the mean of the model parameters in the distribution of the model parameters.

[0009] Optionally, based on the multi-parameter features and the multi-parameter features corresponding to each training round before the current training round, a target feature vector sequence is constructed, including: aggregating the multi-parameter features into a feature vector, and aggregating the multi-parameter features corresponding to each training round before the current training round into a feature vector, to obtain multiple feature vectors; and aggregating the multiple feature vectors based on the order of the training rounds to obtain the target feature vector sequence.

[0010] Optionally, the target feature vector sequence is detected to obtain a detection result, including: inputting the target feature vector sequence into a feature detection model for detection to obtain a detection result, wherein the target feature vector sequence is used to enable the feature detection model to detect data attack behavior of the deep learning model in the current training round by learning a preset detection rule, and the preset detection rule is used to at least characterize the rate of change of the concentration of the model parameter distribution in multiple training rounds, the rate of change of the tail of the model parameter distribution in multiple training rounds, the rate of change of the distribution ratio of the model parameters in a specified interval, and the rate of change of the steepness of the probability density curve corresponding to the model parameters.

[0011] Optionally, the detection result is represented by a tuple, wherein the tuple includes a first probability and a second probability. The first probability is used to characterize the probability that the deep learning model does not perform a data attack behavior, and the second probability is used to characterize the probability that the deep learning model performs a data attack behavior. The method further includes: determining that the deep learning model did not perform a data attack behavior in the current training round in response to the first probability being greater than the second probability; and determining that the deep learning model performed a data attack behavior in the current training round in response to the first probability being less than or equal to the second probability.

[0012] Optionally, the feature detection model includes at least a long short-term memory network model and a multilayer perceptron model. The long short-term memory network model is configured to capture the temporal dependencies in the target feature vector sequence, and the multilayer perceptron model is configured to perform deep classification on the temporal dependencies output by the long short-term memory network model to determine whether the deep learning model performs data attack behavior in the current training round.

[0013] Optionally, the data detection method for the deep detection model further includes: in response to the deep learning model performing a data attack behavior in the current training round, controlling the target training environment to stop training the deep learning model.

[0014] According to another aspect of the embodiments of this disclosure, a data detection apparatus for a deep learning model is also provided. The apparatus may include: an acquisition component configured to acquire model parameters of the deep learning model in response to the deep learning model completing the current training epoch in a target training environment, wherein the target training environment is used to provide training data required for training the deep learning model; a determination component configured to determine multiple parameter features based on the model parameters, wherein the multiple parameter features are used to characterize the parameter distribution of the deep learning model's model parameters after the current training epoch; a construction component configured to construct a target feature vector sequence based on the multiple parameter features and the multiple parameter features corresponding to the training epochs prior to the current training epoch, wherein the target feature vector sequence is used to characterize the parameter distribution characteristics of the deep learning model's model parameters after the current training epoch, and the changing trend of the deep learning model's model parameters with the iteration of training epochs; and a detection component configured to detect the target feature vector sequence to obtain a detection result, wherein the detection result is used to characterize whether the deep learning model performed data attack behavior in the current training epoch, and the data attack behavior is used to characterize whether the deep learning model acquired training data in the target training environment in the current training epoch.

[0015] According to another aspect of the present disclosure, a computer-readable storage medium is also provided, the computer-readable storage medium including a stored program, wherein, when the program is run by a processor, it controls the device where the storage medium is located to execute the data detection method of the deep learning model in the present disclosure.

[0016] According to another aspect of the embodiments of this disclosure, a processor is also provided. The processor is used to run a program, wherein the program, when running, executes the data detection method for the deep learning model in the embodiments of this disclosure.

[0017] According to another aspect of the embodiments of this disclosure, a computer program product is also provided. The program product includes computer instructions that, when executed by a processor, implement the data detection method for the deep learning model in the embodiments of this disclosure.

[0018] According to another aspect of the embodiments of this disclosure, a computer program product is also provided. This computer program product includes a non-volatile storage medium that, when executed by a processor, implements the data detection method for the deep learning model in the embodiments of this disclosure.

[0019] According to another aspect of the present disclosure, a computer program is also provided, which, when executed by a processor, implements the data detection method of the deep learning model in the present disclosure.

[0020] In this embodiment of the disclosure, during the training process of the deep learning model, after each training epoch, key parameter features of the deep learning model are automatically extracted. Based on the key parameter features corresponding to each training epoch and the previous training epochs, a target feature vector sequence is generated. Since the target feature vector can not only characterize the parameter distribution characteristics of the deep learning model after each training epoch, but also characterize the changing trend of the model parameters of the deep learning model with the iteration of training epochs, by detecting the target feature vector, it is possible to determine in a timely manner whether the deep learning model has engaged in data attack behavior in the current training epoch. After a data attack behavior occurs, the training process of the deep learning model can be blocked in a timely manner, thereby achieving the technical effect of effectively protecting the data security of the training environment and solving the technical problem of being unable to deeply detect data attack behavior of the deep learning model during the training process.

[0021] Furthermore, in this embodiment of the disclosure, the data detection process is independent of the model training process and will not have a negative impact on the model training process. While ensuring the data security of the training environment, the training process of the deep learning model is also maintained. Attached Figure Description

[0022] The accompanying drawings, which are included to provide a further understanding of this disclosure and form part of this disclosure, illustrate exemplary embodiments of the present disclosure and are used to explain the disclosure, but do not constitute an undue limitation of the disclosure. In the drawings:

[0023] Figure 1 is a flowchart of a data detection method for a deep learning model according to an embodiment of the present disclosure;

[0024] Figure 2 is a schematic diagram of a data detection architecture for a deep learning model according to an embodiment of the present disclosure;

[0025] Figure 3 is a schematic diagram of an attack detection component according to an embodiment of the present disclosure;

[0026] Figure 4 is a schematic diagram of a data detection device for a deep learning model according to an embodiment of the present disclosure. Detailed Implementation

[0027] To enable those skilled in the art to better understand the present disclosure, the technical solutions of the present disclosure will be clearly and completely described below with reference to the accompanying drawings of the embodiments. Obviously, the described embodiments are only some embodiments of the present disclosure, and not all embodiments. Based on the embodiments of the present disclosure, all other embodiments obtained by those skilled in the art without creative effort should fall within the scope of protection of the present disclosure.

[0028] It should be noted that the terms "first," "second," etc., in the specification, claims, and accompanying drawings of this disclosure are used to distinguish similar objects and are not necessarily used to describe a specific order or sequence. It should be understood that such data can be interchanged where appropriate so that the embodiments of this disclosure described herein can be implemented in orders other than those illustrated or described herein. Furthermore, the terms "comprising" and "having," and any variations thereof, are intended to cover non-exclusive inclusion; for example, a process, method, system, functional component, or device that includes a series of steps or components is not necessarily limited to those explicitly listed, but may include other steps or components not explicitly listed or inherent to such processes, methods, functional components, or devices.

[0029] According to an embodiment of this disclosure, an embodiment of a data detection method for a deep learning model is provided. It should be noted that the steps shown in the flowchart in the accompanying drawings can be executed in a computer system such as a set of computer-executable instructions. Furthermore, although a logical order is shown in the flowchart, in some cases, the steps shown or described may be executed in a different order than that shown here.

[0030] Figure 1 is a flowchart of a data detection method for a deep learning model according to an embodiment of the present disclosure. As shown in Figure 1, the method may include the following steps:

[0031] Step S101: In response to the deep learning model completing the current training round in the target training environment, obtain the model parameters of the deep learning model.

[0032] In the technical solution provided by step S101 of this disclosure, the deep learning model is a type of artificial intelligence (AI) model. The target training environment provides massive training data and powerful computing support for the training process of the deep learning model. The deep learning model can complete multiple epochs of training in the target training environment. The current training epoch is the epoch corresponding to the current training process of the deep learning model.

[0033] In this embodiment, after the deep learning model begins training in the target training environment, the training process of the deep learning model can be monitored, and the model parameters of the deep learning model at the end of each training epoch can be extracted. Taking the current training epoch as an example, the timing of extracting the model parameters of the deep learning model is illustrated. For example, after the deep learning model finishes the current training epoch, the model parameters of the deep learning model are obtained. These model parameters may include the weight parameters, bias parameters, activation function parameters, regularization parameters, and loss function-related parameters of the deep learning model at the end of the current training epoch. This is merely an illustrative example and does not limit the specific parameter content included in the model parameters.

[0034] In this embodiment, as model training progresses, the model parameters change. These parameters are fundamental to model learning and data-driven operations. By automatically acquiring the model parameters after each epoch, the changing trends of the model parameters during training can be monitored in real time. This is crucial for detecting potential data attacks. Real-time monitoring reduces the time window for data breaches, helping to take timely measures to prevent further attacks.

[0035] Furthermore, the monitoring of the training process of the aforementioned deep training model and the extraction of model parameters do not require parameter retrieval, which reduces operational costs and avoids human error, ensuring the accuracy and reliability of the extracted model parameters.

[0036] Step S102: Based on the model parameters, determine multiple parameter features.

[0037] In the technical solution provided in step S102 of this disclosure, multiple parameter features are used to characterize the parameter distribution of the deep learning model after the current training round. The multiple parameter features may include a first parameter feature, a second parameter feature, a third parameter feature, and a fourth parameter feature. The first parameter feature is used to characterize the concentration of the model parameter distribution, the second parameter feature is used to characterize the tailing of the model parameter distribution, the third parameter feature is used to characterize the distribution ratio of the model parameters within a specified interval. The specified interval may be the interval between two to three standard deviations to the left of the mean of the model parameters (e.g., the (μ-3σ, μ-2σ) interval) and the interval between two to three standard deviations to the right of the mean of the model parameters (e.g., the (μ+2σ, μ+3σ) interval). The fourth parameter feature is used to characterize the steepness of the probability density curve corresponding to the model parameters.

[0038] In this embodiment, statistical analysis can be performed on the model parameters of the deep learning model obtained after the current training round to obtain the parameter distribution results. Then, multiple parameter features can be determined from these distribution results. The first parameter feature may include the interquartile range, standard deviation, and mean deviation of the model parameters. The second parameter feature may include the proportion of parameters outside the μ-3σ point, the proportion of parameters outside the μ+3σ point, the distance between μ-3σ and the 0.15% quantile, and the distance between μ+3σ and the 99.85% quantile. The third parameter feature may include the proportion of model parameters within the (μ-3σ, μ-2σ) interval and the proportion of model parameters within the (μ+3σ, μ+2σ) interval. The fourth parameter feature may include the distance between the 2% and 16% quantiles, the distance between the 84% and 98% quantiles, and so on. as well as

[0039] In this step, statistical analysis of the model parameters of the deep learning model is performed to obtain multiple parameter features. These multiple parameter features cover multiple aspects of the model parameter distribution, including concentration, tailing phenomenon, distribution ratio in specific intervals, and steepness of probability density curves. This allows for a comprehensive characterization of the model's state from multiple dimensions, improving the comprehensiveness and accuracy of attack detection.

[0040] Step S103: Based on the multi-parameter features and the multi-parameter features corresponding to the training rounds before the current training round, construct the target feature vector sequence.

[0041] In the technical solution provided by step S103 of this disclosure, the target feature vector is used to characterize the parameter distribution characteristics of the deep learning model after the current training round ends, as well as the changing trend of the deep learning model parameters with the iteration of the training rounds.

[0042] In this embodiment, as described above, the deep learning model undergoes multiple training rounds in the target training environment. Based on this, after obtaining the multiple parameter features of the deep learning model after the current training round, the multiple parameter features of the deep learning model after each training round before the current training round can be combined to obtain the multiple model parameters corresponding to the current training round and each training round before the current training round.

[0043] Optionally, after obtaining the multinomial model parameters corresponding to the current training round and each training round before the current training round, the multinomial parameter features corresponding to the current training round can be combined into a feature vector, and the multinomial model parameters corresponding to each training round before the current training round can be combined into feature vectors, thereby obtaining the feature vectors corresponding to the current training round and each training round before the current training round.

[0044] Optionally, after obtaining multiple feature vectors, the feature vectors corresponding to the multiple training rounds can be arranged according to the order of the training rounds to obtain a target feature vector sequence. This target feature vector sequence can not only characterize the parameter distribution characteristics of the deep learning model after the current training round, but also characterize the changing trend of the deep learning model parameters with the iteration of the training rounds.

[0045] In this step, the training of the deep learning model is an iterative process, and the distribution and statistical characteristics of the model parameters will differ at the end of each epoch. By arranging these characteristics into a time sequence, time series analysis methods can be used to understand the changing trends of the model's parameter features over time, which is very helpful in identifying data attack behaviors against deep learning models.

[0046] Furthermore, data theft attacks may not manifest immediately in the early stages of training, but rather accumulate and become apparent gradually over time. The strategies employed in data theft attacks may also change over time; for example, attackers may adjust the intensity or method of their attacks at certain stages of training. Feature vector sequences can reflect these changes, helping detection mechanisms adapt to various attack strategies and improving the flexibility and effectiveness of defense.

[0047] Step S104: Detect the target feature vector sequence to obtain the detection result.

[0048] In the technical solution provided by step S104 of this disclosure, the detection result is used to characterize whether the deep learning model performs data attack behavior in the current training round. The data attack behavior is used to characterize whether the deep learning model has obtained training data in the target training environment in the current training round. The data attack behavior can also be called data theft behavior.

[0049] In this embodiment, after obtaining the target feature vector sequence, the target feature vector sequence can be input into the feature detection component for detection to determine whether the deep learning model performs data attack behavior in the current training round. The feature detection component includes at least a Bidirectional Long Short-Term Memory (BLSTM) network model and a Multi-Layer Perceptron (MLP) model. The BLSTM model is set to detect the target feature vector sequence and output a detection vector. The detection vector integrates multiple parameter features from different training rounds in the original input and contains information on the changes in parameter features during training.

[0050] Optionally, the detection vector output by the BLSTM model is input into the MLP model, which contains three hidden layers. To prevent overfitting and enhance the generalization ability of the deep learning model, a batch normalization layer is added before each hidden layer for normalization processing. After normalization, the data is randomly dropped out. The ReLU function is used as the activation function for all hidden layers. After detecting the vector output by the BLSTM model, the MLP outputs a tuple (P1, P2), where P1 represents the probability that the deep learning model did not perform a data attack in the current training epoch, and P2 represents the probability that the deep learning model performed a data attack in the current training epoch.

[0051] Optionally, based on the binary tuples output by the MLP model, the detection result of the target feature vector sequence can be determined. Specifically, if the probability that the deep learning model did not perform data attack behavior in the current training epoch is greater than the probability that it did, it is determined that the deep learning model did not engage in data theft during the training process corresponding to the current epoch, and in this case, training can continue to the next epoch. Conversely, if the probability that the deep learning model did not perform data attack behavior in the current training epoch is smaller than the probability that it did, it is determined that data theft occurred during the training process corresponding to the current epoch, and in this case, to prevent further data theft, the training process of the deep learning model in the target training environment can be interrupted promptly.

[0052] In this step, the BLSTM model processes sequential data while taking into account past and future contextual information. During the parameter changes of a deep learning model, the parameter features of each training epoch may be influenced by previous and subsequent training states. Because data attacks may exhibit different characteristics at different points in the training sequence, the BLSTM model can capture this temporal dependency and analyze the trends and patterns of parameter feature changes over time, which is crucial for the timely detection of data attack behaviors.

[0053] Furthermore, the BLSTM model can fuse feature information from multiple epochs to generate a feature representation that includes temporal information. In this way, it is possible to effectively process and analyze the multi-parameter features corresponding to each training epoch. These features may independently indicate the difference between normal training and malicious attacks, while the BLSTM model can combine the multi-parameter features corresponding to multiple training epochs to form a more comprehensive view of the model training state.

[0054] Furthermore, MLP models excel at learning complex nonlinear mappings, mapping feature vectors output by BLSTM models to a low-dimensional space where points reflect the complex features of the deep learning model's training state. This mapping process helps convert feature vectors into outputs that can be directly used for attack detection, such as tuples (P1, P2), where P1 and P2 represent the probabilities of the deep learning model being trained normally and the probabilities of performing data attacks, respectively.

[0055] In steps S101 to S104 above, during the training process of the deep learning model, after each training round, the key parameter features of the deep learning model are automatically extracted, and a target feature vector sequence is generated based on the key parameter features corresponding to each training round and the previous training rounds. Since the target feature vector can not only represent the parameter distribution characteristics of the deep learning model after each training round, but also represent the trend of the model parameters of the deep learning model as the training rounds iterate, by detecting the target feature vector, it is possible to determine in a timely manner whether the deep learning model has engaged in data attack behavior in the current training round, and after data attack behavior occurs, the training process of the deep learning model can be blocked in a timely manner, thereby achieving the technical effect of effectively protecting the data security of the training environment, and thus solving the technical problem of not being able to deeply detect data attack behavior of the deep learning model during the training process.

[0056] The method described in this embodiment will be further described below.

[0057] As an optional embodiment, step S102, based on the model parameters, determines multiple parameter features, including: performing statistical analysis on the model parameters to obtain multiple parameter features, wherein the multiple parameter features include at least a first parameter feature, a second parameter feature, a third parameter feature, and a fourth parameter feature. The first parameter feature is used to characterize the concentration of the model parameter distribution, the second parameter feature is used to characterize the tailing of the model parameter distribution, the third parameter feature is used to characterize the distribution ratio of the model parameters within a specified interval, and the fourth parameter feature is used to characterize the steepness of the probability density curve corresponding to the model parameters. The specified interval is used to characterize the interval between two to three standard deviations to the left of the mean of the model parameters and the interval between two to three standard deviations to the right of the mean of the model parameters in the distribution of the model parameters.

[0058] In this embodiment, taking the current training round as an example, after obtaining the model parameters of the deep learning model after the current training round ends, different statistical indicators for the model parameters can be calculated to obtain multiple parameter features.

[0059] For example, based on the distribution of model parameters, the interquartile range, standard deviation σ, and mean deviation of the model parameters are calculated to obtain the first parameter characteristic. The interquartile range is the distance between the 25th and 75th quantiles of the model parameters, reflecting the dispersion of the parameter distribution. A larger interquartile range indicates a more dispersed distribution of model parameters, while a smaller range indicates a more concentrated distribution. The standard deviation is the square root of the variance, which is the arithmetic mean of the squares of the differences between each value and its mean. The standard deviation reflects the dispersion of the model parameter distribution. A large standard deviation indicates that most model parameters are far from the mean, and the distribution is more dispersed; conversely, a small standard deviation indicates that most data are closer to the mean, and the distribution is more concentrated. The mean deviation is the arithmetic mean of the absolute values ​​of the differences between each value and its mean, representing the degree of difference between the data and the mean. A larger mean deviation indicates a greater difference between the model parameters and their mean, and a more dispersed distribution; conversely, a smaller mean deviation indicates a smaller difference between the model parameters and their mean, and a more concentrated distribution.

[0060] Optionally, based on the distribution of model parameters, the proportion of model parameters outside three standard deviations σ of the mean μ is calculated, along with the distances between these extreme values ​​(μ-3σ) and the 1.15th percentile, and the distances between the extreme values ​​(μ+3σ) and the 99.85th percentile, to obtain the second parameter characteristics. Taking a Gaussian distribution as an example, data outside the (μ-3σ) and (μ+3σ) points can be understood as tailing. The degree of tailing in the model parameter distribution can be reflected by calculating the distances between the (μ-3σ) and (μ+3σ) points and the 0.15th and 99.85th percentiles, respectively. When the proportion of data outside the (μ-3σ) and (μ+3σ) points is small, the tailing phenomenon is not obvious; conversely, when the proportion of data outside the (μ-3σ) and (μ+3σ) points is large, the distribution exhibits a significant tailing phenomenon.

[0061] Optionally, based on the distribution of model parameters, the proportion of model parameters in the relatively distant intervals (μ-3σ, μ-2σ) and (μ+2σ, μ+3σ) is calculated as a third parameter feature. The proportion of model parameters in the (μ-3σ, μ-2σ) and (μ+2σ, μ+3σ) intervals within the total model parameter distribution reflects the distribution characteristics of the model parameters. Due to the symbolic encoding regularization term, the amount of model parameter data in the (μ-3σ, μ-2σ) and (μ+2σ, μ+3σ) intervals will be larger than that of Laplace and Gaussian distributions. If the amount of model parameter data increases rapidly in the (μ-3σ, μ-2σ) and (μ+2σ, μ+3σ) intervals, it is more likely that a data attack has occurred; conversely, the model parameter distribution is likely close to a Laplace or Gaussian distribution, indicating that the deep learning model is in a normal training state.

[0062] Optionally, based on the distribution of model parameters, the distances between key quantiles are calculated, such as the distance between the 2% and 16% quantiles, the distance between the 84% and 98% quantiles, etc. as well as The fourth parameter feature is obtained. The distance between the 2nd and 16th quantiles to the left of the mean, and the distance between the 84th and 98th quantiles to the right of the mean, reflect the degree of local variation in the model parameter distribution within this range. Compared to Laplace and Gaussian distributions, the model parameter distribution caused by symbolic encoding regularization changes more slowly between the 2nd and 16th quantiles (and on the other side, between the 84th and 98th quantiles). Therefore, the shorter the interval length, the more significant the change in the probability density curve, and the closer the parameter distribution is to a normally trained Laplace or Gaussian distribution. Conversely, when the interval length is long, the parameter distribution is likely a malicious model caused by a symbolic encoding attack. Furthermore, the distance between the 2nd and 16th quantiles of a normally trained Gaussian distribution is approximately equal to the variance σ of the Gaussian distribution. If this distance differs significantly from the variance σ of a conventional Gaussian distribution in model detection, it indicates that a malicious attack by the symbolic encoding regularization term is likely present.

[0063] In this step, statistical analysis of the model parameters of the deep learning model is performed to obtain multiple parameter features. These multiple parameter features cover multiple aspects of the model parameter distribution, including concentration, tailing phenomenon, distribution ratio in specific intervals, and steepness of probability density curves. This allows for a comprehensive characterization of the model's state from multiple dimensions, improving the comprehensiveness and accuracy of attack detection.

[0064] As an optional implementation, step S103 involves constructing a target feature vector sequence based on multi-parameter features and the multi-parameter features corresponding to each training round before the current training round. This includes: aggregating the multi-parameter features into a single feature vector, and aggregating the multi-parameter features corresponding to each training round before the current training round into a single feature vector, resulting in multiple feature vectors; and aggregating the multiple feature vectors based on the order of the training rounds to obtain the target feature vector sequence.

[0065] In this embodiment, since the model parameters of the deep learning model are extracted after each training round, and the extracted model parameters are statistically analyzed to obtain multiple feature parameters, that is, the multiple parameter features of the deep learning model corresponding to each training round, based on this, after obtaining the multiple parameter features corresponding to the current training round and each training round before the current training round, the multiple parameter features corresponding to each training round can be combined into a feature vector to obtain the feature vector corresponding to each training round.

[0066] Optionally, after obtaining the feature vectors corresponding to each training round, the feature vectors corresponding to each training round can be sorted according to the order of the training rounds to obtain the target feature vector sequence.

[0067] In this step, the training of the deep learning model is an iterative process, and the distribution and statistical characteristics of the model parameters will differ at the end of each epoch. By arranging these features into a feature vector sequence in chronological order, time series analysis methods can be used to understand the changing trends of the model's parameter features over time, thereby improving the accuracy of data attack detection.

[0068] As an optional implementation, step S104, detecting the target feature vector sequence and obtaining detection results, includes: inputting the target feature vector sequence into a feature detection model for detection and obtaining detection results. The target feature vector sequence is used to enable the feature detection model to detect data attack behavior of the deep learning model in the current training round by learning preset detection rules. The preset detection rules are used to at least characterize the rate of change of the concentration of the model parameter distribution in multiple training rounds, the rate of change of the tailing degree of the model parameter distribution in multiple training rounds, the rate of change of the distribution ratio of the model parameters in a specified interval, and the rate of change of the steepness of the probability density curve corresponding to the model parameters.

[0069] In this embodiment, the preset detection rules include at least rules for detecting multiple parameter features corresponding to each training epoch in the target feature vector. Since there are at least four essential differences between the model parameters of a deep learning model performing a data attack and those of a normally trained deep learning model—for example, differences in the concentration of model parameter distribution, differences in the tailing phenomenon of model parameter distribution, differences in the proportion of model parameters in a specified interval (farrite interval), and differences in the steepness of the probability density curve of model parameters—general regularization terms and correlation value encoding regularization terms can be distinguished based on the concentration of model parameter distribution, the tailing phenomenon of model parameter distribution, the proportion of model parameters in a specified interval (farrite interval), and the steepness of the probability density curve of model parameters. General regularization terms are used to simplify the model and avoid overfitting, but do not directly affect the matching degree between the parameter distribution and the dataset distribution. The use of correlation value encoding regularization terms causes the distribution of model parameters to gradually approach the value distribution characteristics of the dataset, including sudden drops at both ends.

[0070] Optionally, regarding the concentration of the model parameter distribution, in standard Gaussian and Laplace distributions, most data clusters around the mean. However, taking the CIFAR10 dataset as an example, the data distribution in this dataset typically exhibits a more dispersed form. Significant differences exist between different data points, resulting in different numerical representations and thus a more dispersed distribution of dataset values. The distribution of model parameters during normal training is influenced by the distribution of the dataset itself. Data theft attacks may artificially guide the model parameter distribution to mimic the distribution characteristics of a specific dataset. For example, in the CIFAR10 dataset, when the model parameter distribution exhibits a high degree of dispersion similar to CIFAR10, this could be an indication that an attacker is using correlation-encoded regularization to steal data. Since correlation-encoded regularization makes the parameter distribution approximate the distribution of dataset values, the dispersion of the parameter distribution caused by correlation-encoded regularization increases during model training. Therefore, the rate of change of the concentration of the parameter distribution across multiple training epochs can be used to distinguish between correlation-encoded regularization and general regularization.

[0071] Optionally, regarding the tailing phenomenon in the model parameter distribution, for Gaussian and Laplace distributions, the probability densities at both ends of the distribution gradually converge to 0, thus exhibiting a noticeable tailing phenomenon. However, this does not occur in the dataset distribution, because in the dataset distribution, the probability densities at both ends typically drop abruptly to 0. Since the range of data values ​​is finite, the dataset's value distribution is truncated at both ends, and the probability density drops directly to 0. Because the correlation-encoding regularization term makes the parameter distribution approximate the distribution of the dataset values, the tailing degree of the parameter distribution caused by the correlation-encoding regularization term gradually decreases during model training. Therefore, the rate of change of the parameter tailing degree across multiple training epochs can be used to distinguish between the correlation-encoding regularization term and the general regularization term.

[0072] Optionally, regarding the proportion of model parameters within a specified interval, a key difference between models that generate data attack behavior and normally trained models is that normally trained models show better parameter concentration towards the center point (mean). In maliciously trained models, some parameters will remain permanently in distant intervals (e.g., the (μ-3σ, μ-2σ) interval of a Gaussian distribution). Since symbolic regularization terms only affect some parameters, while others remain in distant intervals, the amount of data on both sides of the parameter distribution is greater than that of a Laplace distribution. Therefore, symbolic regularization terms and general regularization terms can be distinguished by referring to the rate of change of the proportion of parameters in intervals far from the center point across multiple training epochs.

[0073] Optionally, regarding the steepness of the probability density curve of the model parameters, another difference between a model that has undergone data attack behavior and a normally trained model is that data attack behavior causes a change in the derivative of the probability density curve. In certain regions, model parameters generated during malicious training will rise or fall faster than the normal distribution, resulting in a steeper probability density curve in some places.

[0074] Optionally, as the malicious training process continues, its probability density curve will gradually rise or fall within a certain range. Because the symbolic encoding regularization term causes the parameter distribution to gradually approach a Laplace distribution at a certain level, and the probability density on both sides of this parameter distribution is greater than that of the Laplace distribution, the parameter distribution caused by the symbolic encoding regularization term will rise or fall more slowly in certain intervals. Therefore, the symbolic encoding regularization term and the general regularization term can be distinguished by the rate of change of the steepness of the local probability density curve of the parameter distribution across multiple training rounds.

[0075] Optionally, for the above four phenomena, preset detection rules can be generated. That is, the preset detection rules are used to characterize at least the rate of change of the concentration of the model parameter distribution in multiple training rounds, the rate of change of the tailing degree of the model parameter distribution in multiple training rounds, the rate of change of the distribution ratio of the model parameters in a specified interval, and the rate of change of the steepness of the probability density curve corresponding to the model parameters. Based on this, when the target feature vector sequence is input into the feature detection model for detection, the feature detection component can learn the preset detection overload, detect the target feature vector, and obtain the detection result. The detection result is used to characterize whether the deep learning model performs data attack behavior in the current training round.

[0076] Optionally, the feature detection model includes at least a BLSTM model and an MLP model. The BLSTM model is configured to capture the temporal dependencies in the target feature vector sequence, and the MLP model is configured to perform deep classification on the temporal dependencies output by the Long Short-Term Memory network model to determine whether the deep learning model performs data attack behavior in the current training round.

[0077] In this step, the input of the target feature vector sequence enables the feature detection model to monitor multiple training rounds in real time. It automatically analyzes the dynamic changes of model parameters through AI, promptly detects potential data theft attacks, and utilizes preset detection rules during the detection process. These rules take into account various changes such as the concentration of model parameter distribution, tailing degree, distribution ratio in a specified interval, and the rate of change of the steepness of the probability density curve. This allows the detection method to comprehensively evaluate the security of model training from multiple perspectives, improving the accuracy and reliability of detection.

[0078] As an optional implementation, the detection result is represented by a tuple, wherein the tuple includes a first probability and a second probability. The first probability is used to characterize the probability that the deep learning model does not perform a data attack behavior, and the second probability is used to characterize the probability that the deep learning model performs a data attack behavior. The method further includes: determining that the deep learning model did not perform a data attack behavior in the current training round in response to the first probability being greater than the second probability; and determining that the deep learning model performed a data attack behavior in the current training round in response to the first probability being less than or equal to the second probability.

[0079] In this embodiment, if the deep learning model does not perform data attack behavior in the current training round, it indicates that the current training round is normal, and the target training environment can be controlled to continue training the deep learning model in the next round until data attack behavior is detected in the deep learning model.

[0080] Optionally, if the deep learning model performs a data attack in the current training epoch, it indicates that the deep learning model has stolen training data from the target training environment in the current training epoch. In this case, to prevent further leakage of training data in the target training environment, the target training environment can be controlled to stop training the deep learning model.

[0081] In the above steps, the strategy of detecting data attack behavior after each round of training and controlling the continuation or cessation of training accordingly can prevent data leakage in a timely manner, protect data security, ensure the quality of model training, improve the controllability of the training environment and the efficiency of resource utilization, and promote compliance, thereby comprehensively improving the security and efficiency of the deep learning model training process.

[0082] The technical solutions of the present disclosure embodiments are illustrated below with reference to preferred embodiments.

[0083] Currently, the ability of AI models to carry raw training data information poses a serious security challenge to the service model of deep learning model training environments. Analysts with data mining privileges can fully leverage the information-carrying capacity of machine learning models by modifying machine learning algorithms and data processing procedures. They can actively encode information in model parameters and prediction results, thereby stealing the private data of data owners. These attack methods are highly covert and can effectively bypass traditional security protection mechanisms such as data access control for CRUD operations. Data security in the training environment cannot be guaranteed, and there are technical problems in deeply detecting data theft behavior of deep learning models.

[0084] However, this disclosure provides a method for detecting data attack behavior of a deep learning model. When the deep learning model in the training environment begins training, the feature extraction component extracts and analyzes the model parameters after each training epoch (i.e., after each epoch). The feature extraction component parses the extracted model parameters corresponding to each training epoch, forming 13 parameter features for each training epoch that can identify malicious data theft behavior. These 13 parameter features are then aggregated into a feature vector, and according to the order of the training epochs, the feature vectors corresponding to each training epoch are combined into a feature vector sequence, which is input into the attack detection component to detect malicious data theft behavior. Upon detecting data theft behavior in the deep learning model, the deep learning model training environment is controlled to stop the training process. Without affecting the training process of the deep learning model, the model parameters extracted after each training epoch are used to comprehensively and deeply detect data attack behavior of the deep learning model in the corresponding epoch, effectively ensuring data security in the training environment and solving the technical problem of not being able to deeply detect data theft behavior of deep learning models.

[0085] The following section describes the detection architecture for attack behaviors on deep learning model data provided in the embodiments of this disclosure.

[0086] Figure 2 is a schematic diagram of a data detection architecture for a deep learning model according to an embodiment of the present disclosure. As shown in Figure 2, the detection architecture for data attack behavior of the deep learning model mainly includes a training component 201 and a detection component 202. The detection component 202 includes a feature extraction component 2021 and an attack detection component 2022.

[0087] Optionally, the training component 201 is used to provide a training environment for a deep learning model. This training environment includes the full amount of data required to train the deep learning model, the computing power required to train the deep learning model, and the AI ​​model to be trained. The AI ​​model can undergo multiple rounds of training in this training environment. These multiple rounds of model training may include model training code and malicious regularization terms. Malicious regularization terms during model training may pose a security risk to the training data in the training environment.

[0088] Optionally, the feature extraction component 2021 in the detection component 202 is used to monitor the model training process in the training component, and after each training round, extracts the model parameters of the AI ​​model, and performs statistical analysis on the extracted model parameters to obtain 13 parameter features corresponding to each training round. Table 1 is a model parameter feature extraction table according to an embodiment of this disclosure. As shown in Table 1, different parameter features are used to characterize different phenomena in the distribution of model parameters. For example, the interquartile range, standard deviation, and mean deviation of model parameters are used to characterize the degree of concentration of the model parameter distribution; other features are similar and will not be elaborated here.

[0089] Table 1 Model Parameter Feature Extraction Table

[0090] Optionally, after extracting the 13 parameter features corresponding to each training round, the 13 parameter features corresponding to each training round can be aggregated into a parameter feature vector. Then, according to the order of the training rounds, the parameter feature vectors corresponding to each training round can be arranged into a feature vector sequence, and the feature vector sequence can be input into the attack detection component 2022 for detection.

[0091] Optionally, the attack detection component 2022 includes a BLSTM model and an MLP model. After detecting the feature vector sequence, the BLSTM model and MLP model can obtain the detection results. If the detection results indicate that the model has data attack behavior during training, the training process is stopped. If the detection results indicate that the model has no data attack behavior during training, the model parameters are output and the model training continues.

[0092] The attack detection component will be introduced in more detail next.

[0093] Figure 3 is a schematic diagram of an attack detection component according to an embodiment of the present disclosure. As shown in Figure 3, the attack detection component consists of two parts: a BLSTM model and an MLP model. In a deep learning model training environment, the training process of the AI ​​model is a time sequence. The BLSTM model, which is specifically designed for processing sequence data, is used to better analyze the changing process of the model parameter distribution characteristics, thereby distinguishing between malicious data theft and normal model training.

[0094] The attack detection component continuously analyzes the model parameter features generated across multiple epochs, inputting these feature sequences into a BLSTM for processing to analyze their correlations and trends. The sequence length of the BLSTM is the number of models used for parameter distribution feature extraction during the initial training phase, and the dimension of the input features is the number of extracted features. After processing by the BLSTM, the feature information from each epoch can be combined to reflect feature changes. The BLSTM outputs a vector for each feature sequence, fusing 13 features from different epoch models in the original input, including information on feature changes during training.

[0095] The MLP model contains three hidden layers. To prevent overfitting and enhance generalization ability, a batch normalization layer and dropout are added before each hidden layer. The hidden layers all use ReLU as the activation function. The MLP outputs a tuple (P1, P2), where P1 represents the probability that the AI ​​model was trained normally, and P2 represents the probability that the AI ​​model performed a data attack.

[0096] According to embodiments of this disclosure, a data detection device for a deep learning model is also provided. It should be noted that this data detection device for a deep learning model can be configured to execute the data detection method for the deep learning model in the embodiments.

[0097] Figure 4 is a schematic diagram of a data detection device for a deep learning model according to an embodiment of the present disclosure. As shown in Figure 4, the data detection device 400 for the deep learning model may include: an acquisition component 401, a determination component 402, a construction component 403, and a detection component 404.

[0098] Component 401 is used to obtain the model parameters of the deep learning model in response to the deep learning model completing the current training round in the target training environment, wherein the target training environment is used to provide the training data required to train the deep learning model.

[0099] Component 402 is defined to determine multi-parameter features based on model parameters, wherein the multi-parameter features are used to characterize the parameter distribution of the deep learning model after the current training epoch.

[0100] Component 403 is used to construct a target feature vector sequence based on multi-parameter features and multi-parameter features corresponding to previous training epochs. The target feature vector sequence is used to characterize the parameter distribution characteristics of the deep learning model after the end of the current training epoch, as well as the changing trend of the deep learning model's parameters with the iteration of training epochs.

[0101] The detection component 404 is used to detect the target feature vector sequence and obtain the detection result. The detection result is used to characterize whether the deep learning model performs data attack behavior in the current training round. The data attack behavior is used to characterize whether the deep learning model has acquired training data in the target training environment in the current training round.

[0102] Optionally, the determining component 402 is further configured to: perform statistical analysis on the model parameters to obtain multiple parameter features, wherein the multiple parameter features include at least a first parameter feature, a second parameter feature, a third parameter feature, and a fourth parameter feature, wherein the first parameter feature is used to characterize the concentration of the model parameter distribution, the second parameter feature is used to characterize the tailing of the model parameter distribution, the third parameter feature is used to characterize the distribution proportion of the model parameters within a specified interval, the fourth parameter feature is used to characterize the steepness of the probability density curve corresponding to the model parameters, and the specified interval is used to characterize the interval between two to three standard deviations to the left of the mean of the model parameters and the interval between two to three standard deviations to the right of the mean of the model parameters in the distribution of the model parameters.

[0103] Optionally, the building component 403 is also used to: aggregate multi-parameter features into a feature vector, and aggregate the multi-parameter features corresponding to each training round before the current training round into a feature vector, to obtain multiple feature vectors; and aggregate the multiple feature vectors based on the order of the training rounds to obtain a target feature vector sequence.

[0104] Optionally, the detection component 404 is further configured to: input the target feature vector sequence into the feature detection model for detection and obtain the detection result, wherein the target feature vector sequence is used to enable the feature detection model to detect the data attack behavior of the deep learning model in the current training round by learning the preset detection rules, and the preset detection rules are used to at least characterize the rate of change of the concentration of the model parameter distribution in multiple training rounds, the rate of change of the tailing degree of the model parameter distribution in multiple training rounds, the rate of change of the distribution ratio of the model parameters in a specified interval, and the rate of change of the steepness of the probability density curve corresponding to the model parameters.

[0105] Optionally, the detection result is represented by a tuple, wherein the tuple includes a first probability and a second probability. The first probability is used to characterize the probability that the deep learning model does not perform data attack behavior, and the second probability is used to characterize the probability that the deep learning model performs data attack behavior. The data detection device 400 of the deep learning model is further used to: determine that the deep learning model has not performed data attack behavior in the current training round when the first probability is greater than the second probability; and determine that the deep learning model has performed data attack behavior in the current training round when the first probability is less than or equal to the second probability.

[0106] Optionally, the data detection device 400 for the deep learning model is also used to: control the target training environment to stop training the deep learning model in response to the deep learning model performing a data attack behavior in the current training round.

[0107] In this embodiment, during the training process of the deep learning model, after each training epoch, key parameter features of the deep learning model are automatically extracted. Based on the key parameter features corresponding to each training epoch and the previous training epochs, a target feature vector sequence is generated. Since this target feature vector can not only characterize the parameter distribution characteristics of the deep learning model after each training epoch, but also characterize the changing trend of the model parameters of the deep learning model with the iteration of training epochs, by detecting the target feature vector, it is possible to determine in a timely manner whether the deep learning model has engaged in data attack behavior in the current training epoch. After a data attack behavior occurs, the training process of the deep learning model can be blocked in a timely manner, achieving the technical effect of effectively protecting the data security of the training environment, thereby solving the technical problem of being unable to deeply detect data attack behavior of the deep learning model during the training process.

[0108] According to embodiments of this disclosure, a computer-readable storage medium is also provided, the storage medium including a stored program, wherein the program executes a data detection method for a deep learning model of the embodiment.

[0109] According to an embodiment of this disclosure, a processor is also provided for running a program, wherein the program executes the data detection method of the deep learning model in the embodiment.

[0110] According to another aspect of the embodiments of this disclosure, a computer program product is also provided. The program product includes computer instructions that, when executed by a processor, implement the data detection method of the deep learning model in the embodiments.

[0111] According to another aspect of the embodiments of this disclosure, a computer program product is also provided. This computer program product includes a non-volatile storage medium that, when executed by a processor, implements the data detection method for the deep learning model in the embodiments of this disclosure.

[0112] According to another aspect of the present disclosure, a computer program is also provided, which, when executed by a processor, implements the data detection method of the deep learning model in the present disclosure.

[0113] The sequence numbers of the embodiments disclosed above are for descriptive purposes only and do not represent the superiority or inferiority of the embodiments.

[0114] In the above embodiments of this disclosure, the descriptions of each embodiment have different focuses. For parts not described in detail in a certain embodiment, please refer to the relevant descriptions of other embodiments.

[0115] In the several embodiments provided in this disclosure, it should be understood that the disclosed technical content can be implemented in other ways. The device embodiments described above are merely illustrative; for example, the division of components can be a logical functional division, and in actual implementation, there may be other division methods. For example, multiple components or components may be combined or integrated into another system, or some features may be ignored or not executed. Furthermore, the displayed or discussed mutual coupling or direct coupling or communication connection may be through some interface, and the indirect coupling or communication connection of components or components may be electrical or other forms.

[0116] The components described as separate parts may or may not be physically separate. The parts shown as components may or may not be physical components; that is, they may be located in one place or distributed across multiple components. Some or all of the components can be selected to achieve the purpose of this embodiment according to actual needs.

[0117] Furthermore, the functional components in the various embodiments of this disclosure can be integrated into a single processing component, or each component can exist physically separately, or two or more components can be integrated into a single component. The integrated components described above can be implemented in hardware or as software functional components.

[0118] If integrated components are implemented as software functional components and sold or used as independent functional parts, they can be stored in a computer-readable storage medium. Based on this understanding, the technical solutions of this disclosure, in essence, or the parts that contribute to the prior art, or all or part of the technical solutions, can be embodied in the form of software functional components. These computer software functional components are stored in a storage medium and include several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute all or part of the steps of the methods of the various embodiments of this disclosure. The aforementioned storage medium includes various media capable of storing program code, such as USB flash drives, read-only memory (ROM), random access memory (RAM), portable hard drives, magnetic disks, or optical disks.

[0119] The above are merely preferred embodiments of this disclosure. It should be noted that those skilled in the art can make various improvements and modifications without departing from the principles of this disclosure, and these improvements and modifications should also be considered within the scope of protection of this disclosure. Industrial applicability

[0120] The solution provided in this disclosure can be applied to data security detection during the training of deep learning models. During deep learning model training, after each training epoch, key parameter features of the deep learning model are automatically extracted. Based on the key parameter features corresponding to each training epoch and the previous training epochs, a target feature vector sequence is generated. Since this target feature vector can not only characterize the parameter distribution characteristics of the deep learning model after each training epoch, but also characterize the changing trend of the model parameters with each training epoch, by detecting the target feature vector, it is possible to promptly determine whether a data attack has occurred in the current training epoch. If a data attack occurs, the training process of the deep learning model can be promptly interrupted, achieving the technical effect of effectively protecting the data security of the training environment. This solves the technical problem of being unable to deeply detect data attack behavior during the training process of deep learning models.

Claims

1. A data detection method for a deep learning model, comprising: In response to the deep learning model completing the current training round in the target training environment, the model parameters of the deep learning model are obtained, wherein the target training environment is used to provide the training data required to train the deep learning model; Based on the model parameters, multiple parameter features are determined, wherein the multiple parameter features are used to characterize the parameter distribution results of the deep learning model after the current training round ends; Based on the aforementioned multiple parameter features and the multiple parameter features corresponding to the training rounds prior to the current training round, a target feature vector sequence is constructed. The target feature vector sequence is used to characterize the parameter distribution characteristics of the model parameters of the deep learning model after the current training round ends, and the changing trend of the model parameters of the deep learning model with the iteration of training rounds. The target feature vector sequence is detected to obtain a detection result, wherein the detection result is used to characterize whether the deep learning model performs data attack behavior in the current training round, and the data attack behavior is used to characterize whether the deep learning model has acquired the training data in the target training environment in the current training round.

2. The method according to claim 1, wherein, Based on the model parameters, multiple parameter features are determined, including: Statistical analysis is performed on the model parameters to obtain the multi-parameter features, wherein the multi-parameter features include at least a first parameter feature, a second parameter feature, a third parameter feature, and a fourth parameter feature. The first parameter feature is used to characterize the concentration of the model parameter distribution, the second parameter feature is used to characterize the tailing of the model parameter distribution, the third parameter feature is used to characterize the distribution proportion of the model parameters within a specified interval, and the fourth parameter feature is used to characterize the steepness of the probability density curve corresponding to the model parameters. The specified interval is used to characterize the interval between two and three standard deviations to the left of the mean of the model parameters, and the interval between two and three standard deviations to the right of the mean of the model parameters.

3. The method according to claim 1, wherein, Based on the aforementioned multi-parameter features, and the multi-parameter features corresponding to the training epochs prior to the current training epoch, a target feature vector sequence is constructed, including: The multi-parameter features are aggregated into a feature vector, and the multi-parameter features corresponding to each training round before the current training round are aggregated into a feature vector respectively, resulting in multiple feature vectors; Based on the order of training rounds, the multiple feature vectors are aggregated to obtain the target feature vector sequence.

4. The method according to claim 1, wherein, The target feature vector sequence is detected to obtain the detection result, including: The target feature vector sequence is input into a feature detection model for detection to obtain a detection result. The target feature vector sequence is used to enable the feature detection model to detect the data attack behavior of the deep learning model in the current training round by learning a preset detection rule. The preset detection rule is used to characterize at least the rate of change of the concentration of the model parameter distribution in multiple training rounds, the rate of change of the tailing degree of the model parameter distribution in multiple training rounds, the rate of change of the distribution ratio of the model parameters in a specified interval, and the rate of change of the steepness of the probability density curve corresponding to the model parameters.

5. The method according to claim 4, wherein, The detection result is represented by a tuple, wherein the tuple includes a first probability and a second probability. The first probability represents the probability that the deep learning model does not perform a data attack, and the second probability represents the probability that the deep learning model performs a data attack. The method further includes: In response to the first probability being greater than the second probability, it is determined that the deep learning model did not perform the data attack behavior in the current training round; In response to the first probability being less than or equal to the second probability, it is determined that the deep learning model performed the data attack behavior in the current training round.

6. The method according to claim 4, wherein, The feature detection model includes at least a long short-term memory network model and a multilayer perceptron model. The long short-term memory network model is configured to capture the temporal dependencies in the target feature vector sequence, and the multilayer perceptron model is configured to perform deep classification on the temporal dependencies output by the long short-term memory network model to determine whether the deep learning model performs the data attack behavior in the current training round.

7. The method according to any one of claims 1 to 6, wherein, The method further includes: In response to the deep learning model performing the data attack behavior in the current training round, the target training environment is controlled to stop training the deep learning model.

8. A data detection device for a deep learning model, comprising: The component is configured to obtain the model parameters of the deep learning model in response to the deep learning model completing the current training round in the target training environment, wherein the target training environment is used to provide the training data required to train the deep learning model. The component is determined based on the model parameters, and multiple parameter features are determined, wherein the multiple parameter features are used to characterize the parameter distribution results of the model parameters of the deep learning model after the current training round ends; The component is configured to construct a target feature vector sequence based on the multi-parameter features and the multi-parameter features corresponding to the training epochs before the current training epoch. The target feature vector sequence is used to characterize the parameter distribution characteristics of the model parameters of the deep learning model after the current training epoch ends, and the changing trend of the model parameters of the deep learning model with the iteration of the training epochs. The detection component is configured to detect the target feature vector sequence and obtain a detection result, wherein the detection result is used to characterize whether the deep learning model performs a data attack behavior in the current training round, and the data attack behavior is used to characterize whether the deep learning model has acquired the training data in the target training environment in the current training round.

9. A computer-readable storage medium, characterized in that, The computer-readable storage medium includes a stored program, wherein when the program is run by a processor, it controls the device in which the storage medium resides to perform the method of any one of claims 1 to 7.

10. A processor, characterized in that, The processor is used to run a program, wherein the program executes the method according to any one of claims 1 to 7 when it runs.

11. A computer program product, wherein, Includes a computer program that, when executed by a processor, implements the method of any one of claims 1 to 7.

12. A computer program product, wherein, The method includes a non-volatile computer-readable storage medium storing a computer program that, when executed by a processor, implements the method of any one of claims 1 to 7.

13. A computer program, wherein, When the computer program is executed by a processor, it implements the method described in any one of claims 1 to 7.

Images