Evaluating a security risk for a service implementing a generative neural model by determining a memorization sensitivity score

Abstract

The invention relates to a method for evaluating a security risk for a service implemented on a server (10) and comprising a generative model (11) trained on a training set (E A ), the training set comprising a set of data, the method comprising steps of: - constructing (S1) a modified training set (E* A ) by deleting a portion of the information from the training set; - training (S2) a control model on the basis of the modified set; - generating (S3) data via these models on the basis of the modified set. - determining (S4) first sensitivity scores for data of the training set (E A ) and second sensitivity scores for data not belonging to the training set.

Description

Assessing the security risk of a service implementing a generative neural model by determining a memory sensitivity score TECHNICAL FIELD

[0001] The field is cybersecurity and the protection of training data for a generative neural model that is accessible to users. The proposal specifically concerns the security risk assessment for a service implemented on a server and using such a generative neural model.

[0002] A generative neural model allows new data to be generated from input data.

[0003] To do this, the generative neural model must be trained on a training set. Once trained, the generative neural model is able to generate new data structurally similar to that of the training set.

[0004] In general, a generative model, or generative artificial intelligence or generative AI (lAg or GenAI), is a type of artificial intelligence (AI) system capable of generating text, images, videos or other media in response to requests (also called prompts).

[0005] Some generative neural models, called unimodal, can only generate one type of data (text, image, sound...), others, called multimodal, can generate different types of data.

[0006] Examples currently available on the market include the ChatGPT-3, ChatGPT-4, LLaMA, Bloom, Midjourney, DALL-E, MusicLM, etc. models.

[0007] These models are generally based on GPT (Generative Pretrained Transformer) architectures. This type of model is a type of large language model based on the "transformer" or "transformer" architecture.

[0008] "Pre-training" involves predicting the next word in a text sequence. Repeated for large corpora of textual data, this training then allows the model to generate similar text.

[0009] It was found that data belonging to the training set could, in certain situations, be generated as predictions in response to a query.

[0010] However, some data from the training set is not intended to be disclosed to the public.

[0011] For example, a generative neural model can be trained on private data. This data may, for instance, belong to a company, or it may concern partners of that company or individuals linked to it by a usage contract (which generally guarantees the non-disclosure of this private data).

[0012] For example, a generative neural model trained on images of faces could generate images identical or resembling an existing face, without the consent of the person in question, thus posing a problem of image rights and use of sensitive personal data.

[0013] Other problems may still arise with the generation of training data such as names linked to addresses or telephone numbers, or other sensitive data, etc.

[0014] Furthermore, some training data may be protected by copyright and therefore cannot be freely generated for all kinds of use by users of the generative neural model.

[0015] Also, apart from the legal issues mentioned, the possibility of generating existing data undermines the public's acceptance of generative artificial intelligence.

[0016] This problem of memorization in generative artificial intelligence systems therefore poses many technical, commercial and legal problems and has been addressed in several studies.

[0017] We can for example cite the article by CARLINI, Nicholas, TRAMER, Florian, WALLACE, Eric, et al. “Extracting training data from large language models”, in 30th USENIX security symposium (USENIX Security 21), 2021, p. 2633-2650.

[0018] This article was one of the first to introduce the concepts of the memory problem, later called "involuntary memorization," and training data extraction attacks. It highlighted the memorization of sensitive personal data using the GPT-2 model.

[0019] Furthermore, the article by Nicholas Carlini, Chang Liu, Ülfar Erlingsson, Jernej Kos, and Dawn Song, "The secret sharer: Evaluating and testing unintended memorization in neural networks", in USENIX Security Symposium, 2019, also proposes a new metric called "exposure" to measure the extent to which a model has unintentionally memorized training data.

[0020] The article is based on the insertion of "canary" objects into the training set. These objects are uncorrelated with the other data, in order to measure their exposure in prediction.

[0021] However, the methodology relies solely on textual data and requires modification of the training set. Furthermore, the addition of artificial data is not necessarily representative of how a generative neural model might perform "involuntary memorization" of the "natural" data in the training set.

[0022] It is therefore very important, even crucial, to be able to assess the security risk caused by the exposure of training data by a generative neural model, or network. DESCRIPTION OF THE INVENTION

[0023] The invention aims to improve the state of the art. In particular, the problem that the present proposal seeks to solve is to propose a solution for assessing the security risk posed by the exposure of training data through the use of a generative neural model for prediction.

[0024] More specifically, a method is proposed for evaluating a security risk for a service implemented on a server and comprising a generative neural model, or network, trained on a training set containing a dataset, so as to be able to generate new data from a request, said method comprising the steps of: Construction of a modified training set, by removing part of the information from each data in said training set; Training of a control generative neural model from said modified training set; Data generation by said generative neural model and control generative neural model from said modified training set; Determination of first memorization sensitivity scores (M(y)) for data from said training set (E A based on losses between the generated data and said data; Determination of second memorization sensitivity scores for data not belonging to said training set, from losses between generated data and said data not belonging to said training set; Determining a risk by comparing said first and second scores of sensitivity to memorization.

[0025] According to preferred embodiments, the invention comprises one or more of the following features which can be used separately or in partial combination with each other or in total combination with each other: said data correspond to time series corresponding to electrical consumption curves; said queries are incomplete data, said generative neural model being trained to predict data extrapolating said incomplete data; said control generative neural model is structurally similar to said generative neural model; said losses correspond to Euclidean distances between said generated data and the data of said training set; said memorization sensitivity scores are calculated as a ratio between a loss between data generated by said generative neural model and submitted data, and a loss between data generated by said modified generative neural model and said submitted data; The process also includes a step of comparing said memorization sensitivity score to a threshold, and a decision-making aid step based on the result of said comparison.

[0026] Another aspect of the invention relates to a device for assessing the security risk of a service implemented on a server and comprising a generative neural model trained on a training set containing a dataset, so as to predict new data from a query, said device being capable of: construct a modified training set, by removing some of the information from each data point in said training set; train a control generative neural model from said modified training set; generate data by said generative neural model and control generative neural model from said modified training set; determine initial memorization sensitivity scores for data from said training set from losses between the generated data and said data; determine second memorization sensitivity scores for data not belonging to said training set, from losses between generated data and said data not belonging to said training set; to determine a risk by comparing said first and second scores of sensitivity to memorization.

[0027] Another aspect of the invention relates to a computer program comprising instructions which, when executed by a processor, cause the processor to carry out the steps of the process as previously described.

[0028] This processor may, for example, belong to a security risk assessment device, and / or to any information processing platform, or computer (desktop or laptop, digital tablet, smartphone, etc.) BRIEF DESCRIPTION OF THE DRAWINGS

[0029] Other aspects, objectives, advantages, and features of the invention will become clearer upon reading the following detailed description of preferred embodiments thereof, given by way of non-limiting example, and made with reference to the accompanying drawings in which: Figure 1 illustrates a possible deployment context for a generative neural model; Figure 2 is a flowchart illustrating a process for evaluating a security risk for a service comprising a generative neural model, according to one embodiment; Figure 3 illustrates an example of constructing a modified learning set, according to one implementation mode. DETAILED DESCRIPTION OF SPECIFIC METHODS OF IMPLEMENTATION

[0030] The proposed method and device relate to a service implemented on a server and implementing a generative neural model, as illustrated by Figure 1.

[0031] A server 10 implements a service incorporating a generative neural network model. This server can be accessed by a set of communication terminals 30 via a communication network. This network can be local (or LAN for "Local Area Network") or wide area (WAN for "Wide Area Network"). This network can include the Internet.

[0032] The service provides functionalities to communication terminals and their users. It may include a generative neural model and an interface to the terminals.

[0033] Typically, the server can be deployed on a single computer machine or on a plurality of machines deployed in farms or abstracted in the cloud (“cloud computing”).

[0034] Terminals can be of different kinds: they can be mobile telecommunications terminals (such as "smartphones"), computers, digital tablets, IoT connected objects (for "Internet of Things" in English, or internet of objects), etc.

[0035] Due to the plurality of possible terminal types, the service may include different types of interfaces constituting its "frontend": web interfaces, mobile, etc.

[0036] The generative neural model 11 forms the main building block of the service deployed on server 10. A generative neural model is a type of neural network that learns to model the distribution of a dataset, and then to generate plausible new examples from that distribution.

[0037] In other words, it can create "new" data that resembles the data it was trained on.

[0038] Thus, a communication terminal 30 can transmit a request 41 to the generative neural model 11 (via the communication network and the interface of the service implementing this model). The generative neural model 11 can then generate a response and transmit it 42 to the communication terminal 30 (also via the communication network and the interface).

[0039] Different types of generative neural models exist.

[0040] One example is GANs, for "Generative Adversarial Networks," initially described in the article by Ian Goodfellow, Jean Pouget-Abadie, Mehdi Mirza, Bing Xu, David Warde-Farley, Sherjil Ozair, Aaron Courville, and Yoshua Bengio, "Generative adversarial networks," in Communications of the ACM, 63(11):139-144, 2020.

[0041] GANs have since been developed, forming an important field of artificial intelligence research, with significant successes in generating realistic images, videos, and other types of data.

[0042] Another family of generative neural models are sequential generative models such as transformers (or "transformers") based on the attention mechanism proposed in the article by ASHISH, Vaswani, "Attention is all you need" in Advances in neural information processing systems, 2017, vol. 30, p. I.

[0043] This family of models subsequently gave rise to large language models (LLMs). LLMs are very large neural networks, trained solely on textual data (books, articles, web content, dialogues). They use a transform architecture and learn to predict the next word in a sequence. Their strength lies in their ability to capture complex relationships, from vocabulary to the logical structure of language, and to manipulate syntax and semantics. These models produce coherent text and can translate, summarize, write, or answer questions.

[0044] Examples of generative neural models of the LLM type are LLaMA, Mistral, GPT-3...

[0045] Other types of generative neural models still exist, and new families will appear in the coming years.

[0046] These generative neural models are trained on a training set containing a set of data, so that they can then, during an exploitation or prediction phase, "predict" new data, 42, from a query, 41.

[0047] Training, or learning, a generative neural network model involves introducing it to the statistical structure of a dataset so that it can produce new, similar but original examples. Specifically, the model receives examples (texts, images, or other types of data) and learns to predict the continuation of a sequence, reconstruct missing data, or transform noise into structured content. This learning relies on the gradual adjustment of millions, or even billions, of internal parameters, using gradient descent and loss functions that measure the gap between the prediction and the expected truth. The more varied and relevant data it is exposed to, the more the model refines its ability to generate consistent, creative, and plausible outputs. Ultimately, it becomes capable of creating new, realistic instances without, generally, simply copying what it has seen.

[0048] The processed data can, for example, correspond to electricity consumption curves. It can also be a time series, associating each time step with an electrical load. Consumption (or "load") curves typically represent a week of consumption with a 30-minute time step.

[0049] In one embodiment, the queries are incomplete data. The generative neural model is trained to predict data by extrapolating from this incomplete data.

[0050] In the case of load curves, a query may contain an incomplete time series. The generative neural model then aims to complete this time series by predicting a complete time series. This complete time series may include an extrapolation of the missing information based on the information submitted in the incomplete query.

[0051] During learning, we seek to minimize a loss function which can correspond to the Euclidean distance between the predicted time series and the real and complete time series.

[0052] In the exploitation phase, the generative neural model can then generate a new, complete time series from an incomplete one. As mentioned earlier, this new time series is generally a "generation," meaning it does not belong to the training set but is "similar" to the examples provided in the training set.

[0053] However, as mentioned previously, generative neural models can be sensitive to a problem of involuntary memorization.

[0054] When training a generative neural model on massive datasets, the model learns to capture linguistic structures, relationships, and regularities. However, in this process, it can also unintentionally memorize specific sections of the training dataset.

[0055] This phenomenon is called involuntary memorization. It refers to the fact that a model can, on demand (often after well-constructed queries), produce verbatim or almost exact extracts from its training corpus, instead of producing generalized data.

[0056] This phenomenon has been well studied in the case of LLM type models, and with textual data, but it is generalizable to any generative neural model and to any type of data: texts, images, sounds, etc.

[0057] This problem raises major issues of confidentiality and intellectual property. Indeed, if the model has been trained on data containing sensitive information (addresses, identities, confidential documents, fragments of copyrighted works), it is theoretically possible for an attacker to extract it through targeted requests. These attacks are called memory exfiltration attacks. They consist of sending "deceptive" prompts to force the model to return data that it should never have retained in its original form.

[0058] It is also possible that a generative neural model might provide training data in response to a request that does not constitute an attack. In this case, the user will not necessarily be aware that the provided data belongs to the training set, but this provision of potentially sensitive data nevertheless poses a real problem.

[0059] This sensitivity of the generative neural model varies depending in particular on the architecture of the model but especially on the learning phase, that is to say the training set and the learning modalities (cost function, number of iterations or stopping criterion, other meta-parameters, etc.)

[0060] It is therefore important for the provider of a generative neural model to be able to determine its sensitivity to this phenomenon of involuntary memorization, to assess the risks of providing training data in response to a request, and thus to be able to manage this risk.

[0061] Managing this risk may involve not making a generative neural model accessible when the risk is too high.

[0062] Retraining can then be initiated to achieve lower sensitivity and risk. This can be done by modifying the training set or adjusting the meta-parameters.

[0063] Figure 2 represents a flowchart illustrating the proposed process, which can be implemented by a security risk assessment device 20.

[0064] Device 20 is a software tool that interfaces with the generative neural model 11 and implements all or part of the steps of the process described, in order to obtain a memory sensitivity score M.

[0065] In an SI step, a modified training set E is constructed A , by removing part of the information from each data point in the training set E A .

[0066] The deleted or masked pieces of information correspond to each training data point. This correspondence may reflect the data structure or even its semantics.

[0067] For example, if the data can be structured according to indices, the deleted pieces of information can correspond to the same indices for each piece of data (whether it is a one-dimensional structure like a time series, or a tabular one like an image, for example).

[0068] For example, if the training data are images, the removed pieces of information may correspond to the same mask, for example rectangular (of the same location in the image and of the same dimensions).

[0069] If the training data consists of time series (for example, corresponding to consumption load curves), a time interval can be removed from the entire training dataset. For example, for a time series representing a day with 30-minute intervals, an interval of 48 consecutive points (i.e., one day) can be removed, or masked.

[0070] Figure 3 illustrates an example of constructing a modified training set E A .

[0071] Curve 401 corresponds to a time series of the training set.

[0072] This curve represents values, on the y-axis, assigned to specific points on the x-axis of time. This time series could correspond to electricity consumption, for example, showing an instantaneous consumption for each time step.

[0073] Curve 402 corresponds to a time series in which part 403 of the information has been removed.

[0074] The modified training set consists of the set of time series corresponding to curves 402 and in which part 403 has been removed.

[0075] In this example, the 403 deleted (or masked) information section corresponds to successive pieces of information located at the end of the time series (last day, for example).

[0076] In yet another example, if the training data is text, the information removed could be specific phrases or words from those texts.

[0077] The deleted portion, or mask, must correspond to a substantial part of the training data in order to allow for good discrimination in later stages.

[0078] It should not be too high either, so as not to disrupt the proper training of the generative neural model. The proportion of masked information is an optimization parameter for the proposed process, which can be configured according to needs, for example, experimentally. As an example, a proportion between 5% and 20% seems to provide good results (in the previous example, one masked day for data corresponding to one week corresponds to a proportion of 14%).

[0079] In step S2, a control generative neural model 11* is trained from this modified training set E A .

[0080] Depending on embodiments, the control generative neural model 11* may be structurally similar or different from the generative neural model 11.

[0081] Here, we define the structure of the generative neural model as encompassing all its elements except for synaptic weights. In other words, two generative neural models can be structurally similar and differ only in the training phase performed on different training sets. Specifically, the same model can be duplicated, and each instance can be trained on two distinct training sets.

[0082] It is important to ensure that the modified learning model E A has performance equivalent to that of the original learning model E A .

[0083] The performance of a model can be conventionally defined as the value of the loss function, namely the loss as defined by the model's architecture averaged over the test set. During model training, the training data is typically divided into two parts: training data, used to adjust the model's weights, and the test set, which ensures that there is no overfitting.

[0084] One way to achieve this result is to provide a control generative neural model 11* structurally similar to the generative neural model, but this is not mandatory.

[0085] In step S3, we have two generative neural models, 11, 11*, which can be used to compare their behaviors.

[0086] More specifically, data is generated by the generative neural model 11 and the control generative neural model 11* from the modified training set E A We can do this by using the entirety of this set E A or only a sub-part.

[0087] Apart from these two generated datasets, losses can be calculated for each of the two generative neural models. This yields a loss P for data generation by generative neural model 11 and a loss P* for data generation by generative neural model 11*.

[0088] Loss is a measure of the error between the generated data and the actual data, that is, the data from the original training set E A .

[0089] It can correspond to a Euclidean distance between the generated data and the real data (or "L2 loss" in the English language terminology of the field).

[0090] If we denote by y a real data point, subjected to a model, that is to say one of the data points from the original training set E A , and y the data generated by one of the two generative neural models 11, 11*, from this data y, we can define the loss P(y) for the data y by: n 2 P(y) = lly -yll = ^(yz - yû i=l

[0091] In this expression, n represents the dimension of the data vector y t having been generated.

[0092] Alternatively, the loss can be a Manhattan distance (or "loss L1") which can be defined as: n P(y) = lly - yll = ^lyz - yd i=l

[0093] Other losses are also possible and described in the scientific literature.

[0094] Loss quantifies the difference between predicted and actual values. This same loss is used during training to measure the convergence state of the generative neural model and to allow for the iterative modification of the synaptic weights of the neural network.

[0095] In a step S4, for any data y (in the format of the input data), a memorization sensitivity score M(y) is determined from the losses between the generated data and the training set.

[0096] More specifically, the memory sensitivity score M(y) is determined from: of the loss P(y) between the data generated by the generative neural model (original) 11 and the data from the training set (original) E A , And, of the loss P*(y) between the data generated by the modified generative neural model 11* and the data from the training set ( (of origin)

[0097] According to one embodiment, the memorization sensitivity score is calculated as a ratio between these two losses: P* (y)

[0098] Thus, the higher the memorization sensitivity score M(y), the lower the memorization rate for that data. Conversely, the closer this score M(y) is to zero, the higher the memorization phenomenon.

[0099] This score is representative of a security risk for the service implementing the generative neural model 11, if it is statistically different depending on whether the data belongs to the training set or not.

[0100] Thus, a decision-support step can be implemented to determine the extent to which this statistical difference is usable; that is, whether there is a threshold below which a value primarily corresponds to training data, and a value of M above the threshold corresponds to other data (i.e., data not belonging to the training set). Specifically, an action can be triggered by the security risk assessment device 20. This action could be an alert for an operator, or an automatic action, for example, blocking access for terminals 30 to the service implementing the generative neural model.

[0101] This action relates to managing the accessibility of the service. Several methods for implementing this service accessibility management are possible depending on the situation.

[0102] For example, one scenario might involve a service with a generative neural model that is not yet published and is still in the testing or development phase. In this case, risk assessment can help determine whether to publish it (that is, make it available to a potential user audience).

[0103] It is also possible to assess this risk during the model training phase. For example, a risk assessment can be triggered periodically, such as every N epochs. If a risk is identified, actions can be taken to eliminate its cause, such as adding noise to the training set, removing the offending data and verifying its gradual "forgetting" over the course of the training phase, triggering a new training run on a modified set, and so on.

[0104] Another situation concerns a service that has already been published. In such a case, if a risk is identified, one action could be to block access to the generative neural model, and possibly even remove it. Risk assessment can be triggered periodically, or on an ad hoc basis, for example, during an audit.

[0105] Risk assessment can also be triggered to test whether certain known data is stored in the generative neural network model. This can be useful when certain data has specific usage conditions, such as time limits. For example, depending on the jurisdiction, personal data may only be stored by a legal entity for a given period. This is the case, for instance, under the General Data Protection Regulation (GDPR) in the European Union.

[0106] Risk assessment can then be used to determine whether personal data whose legal retention period has expired is being stored by the neural network model. If so, actions can be triggered as previously mentioned (blocking access, alerting an administrator, etc.).

[0107] In an S5 step, we can determine second memorization sensitivity scores for data not belonging to the training set, in the same way as before.

[0108] These scores M(y) can be determined for each element of the training set as well as on another set that was not used for training (such as the test set).

[0109] In a step S6, a comparison can be made between the memorization sensitivity scores obtained in the two cases, in the previous steps S4 and S5.

[0110] There is a risk of memorization if the scores obtained for the learning items are significantly higher than the scores obtained for the items in (for example) the test set.

[0111] A threshold can then be determined to allow us to determine whether the differences are indicative of a risk or not (i.e. to quantify the "significantly higher").

[0112] This threshold can be obtained in different ways.

[0113] In particular, according to one embodiment, from this memory sensitivity score, it is possible to assess a risk of membership inference attack.

[0114] From this risk, we can determine the threshold S allowing us to compare the memory sensitivity score M(y) for any data y subjected to generative neural models.

[0115] A membership inference attack is an attack where an adversary tries to guess whether a given example has been used in a model's training data.

[0116] To do this, it can rely on the confidence produced by the generative neural model 11 (maximum predicted probability).

[0117] We can assume that if the value of the memorization sensitivity score M(y) is less than the threshold, then an attacker, or adversary, can determine that the data y belongs to the training set.

[0118] The problem is therefore to determine the threshold S so that its determination can be used.

[0119] It is considered here that the level of usability depends heavily on the false positive rate. The false positive rate, FPR, can be defined as the proportion of data incorrectly identified as belonging to the training set E Aamong all the data that do not actually belong to this set E A This FPR rate measures the attack's specificity in avoiding falsely identifying irrelevant data as part of the training set E. A .

[0120] In other words, if the false positive rate is very high, the attack is unexploitable, because a large number of data points identified as being part of the training set are not actually part of it. Conversely, the lower this FPR rate, the more likely it is that an identified data point is actually part of the training set. A .

[0121] The question is therefore to determine, for a given false positive rate, FPR, what percentage of data an attacker could be able to re-identify, which corresponds to the true positive rate, TPR.

[0122] The false positive rate (FPR) must be determined according to an acceptable level of risk. It therefore depends on the application in question, etc. It can be chosen within a range between 0 and 0.3.

[0123] We can define this true positive rate, TPR, as the proportion of data correctly identified as belonging to the training set E A , among all the data that actually belongs to that set. In other words, the TPR rate measures the attack's sensitivity in correctly detecting the training data.

[0124] Device 20 can allow a user to define a target false positive rate and then find a threshold for the memorization sensitivity score M and the true positive rate, TPR, corresponding to that rate.

[0125] This threshold can then be calculated by different means.

[0126] For example, an exhaustive test of all thresholds is proposed: for each threshold, it suffices to count the number of correctly re-identified data points and those incorrectly re-identified, starting from the training set E A .

[0127] This true positive rate, TPR, provides a quantitative indicator of the model's vulnerability and can allow comparison between different models.

[0128] It is important to note that other metrics can also be used as indicators, such as accuracy and recall, instead of this true positive rate, TPR.

[0129] A concrete example was implemented using training data corresponding to time series representing electrical charge curves. The training set E A and the test set each consisted of 100 time series (or load curves).

[0130] For different thresholds (or even for each possible threshold), we can calculate the false positive and true positive rates and the corresponding memorization sensitivity score M.

[0131] We note that with a false positive rate of 0.1, the threshold for comparing the M score would be 3, which would allow us to identify 70 time series (i.e., 70%).

[0132] If we set a false positive rate at 5%, this threshold becomes 6 and we can only identify 40 time series (i.e., 40%).

[0133] Thus, the service manager implementing the generative neural model 11 can configure the threshold to achieve an identification rate that meets their needs, particularly the sensitivity of the training data. This sensitivity can depend on the semantic content of this training data: for example, a higher sensitivity might be required for medical personnel data than for load curves in an industrial setting.

[0134] Of course, the present invention is not limited to the examples and embodiments described and illustrated. In particular, it is susceptible to numerous variations accessible to those skilled in the art, especially depending on the state of the art at the time of reading this description.

Claims

DEMANDS 1. Method for evaluating a security risk for a service implemented on a server (10) and comprising a generative neural model (11) trained on a training set (E A ) comprising a set of data, so as to be able to generate new data (42) from a query (41), said process comprising the steps of: construction (SI) of a modified training set (£^), by removing part of the information from each data point of said training set; training (S2) of a control generative neural model from said modified training set; generation (S3) of data by said generative neural model and control generative neural model from said modified training set. determination (S4) of first memorization sensitivity scores (M(y)) for data from said training set (E Abased on losses between the generated data and said data, determination (S5) of second memorization sensitivity scores for data not belonging to said training set, based on losses between generated data and said data not belonging to said training set determination (S6) of a risk by comparison of said first and second scores of sensitivity to memorization; managing the accessibility of said service based on said risk.

2. A method according to claim 1, wherein said data correspond to time series corresponding to electrical consumption curves.

3. A method according to any one of the preceding claims, wherein said queries are incomplete data, said generative neural model being trained to predict data extrapolating from said incomplete data.

4. A method according to any one of claims 1 to 3, wherein said generative control neural model (11*) is structurally similar to said generative neural model (11).

5. A method according to any one of the preceding claims, wherein said losses correspond to Euclidean distances between said generated data and the data of said training set (E A ).

6. A method according to any one of the preceding claims, wherein said memorization sensitivity scores (M) are calculated as a ratio between a loss between data generated by said generative neural model (11) and submitted data, and a loss between data generated by said modified generative neural model (11*) and said submitted data.

7. A method according to any one of the preceding claims, further comprising a step of comparing said memorization sensitivity scores (M) to a threshold, and a decision-making aid step based on the result of said comparison.

8. Device (20) for assessing a security risk of a service implemented on a server (10) and comprising a generative neural model (11) trained on a training set (E A ) comprising a set of data, so as to predict new data (42) from a query (41), said device being capable of: construct (IF) a modified training set (£^), by removing some of the information from each data point in said training set; train (S2) a control generative neural model from said modified training set; generate (S3) data from said generative neural model and control generative neural model from said modified training set; determine (S4) first memorization sensitivity scores (M(y)) for data from said training set (E A based on losses between the generated data and said data, determine (S5) second memorization sensitivity scores for data not belonging to said training set, based on losses between generated data and said data not belonging to said training set - determine (S6) a risk by comparing said first and second scores of sensitivity to memorization; Manage the accessibility of said service according to said risk.

9. Computer program comprising instructions which, when executed by a processor, cause the processor to carry out the steps of the process according to any one of claims 1 to 7.

Images