Deep Neural Network Model Theft Prevention via Layer Disturbance
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Service platforms face model theft issues as malicious requesters use prediction results to train classification models with high convergence speed and generalization performance, allowing them to steal the classification model with a small number of samples.
Innovation Solution
A method and apparatus that utilize a deep neural network classification model to introduce disturbance data at selected layers based on the target category, increasing the subsequent prediction probability while maintaining the target category, thereby preventing model theft by ensuring the prediction result remains correct and unusable for malicious training.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If the service platform provides classification services with pre-trained models, then service functionality and user convenience are improved, but the risk of model theft by malicious requesters increases
Solution Approach 1:
The patent applies preliminary anti-action by proactively introducing disturbance data into the classification model's intermediate layers before the malicious requester can exploit the model. This preventive measure ensures that even if prediction results are obtained, they cannot be used for effective model training, thus countering the model theft risk before it materializes.
Solution Approach 2:
The patent uses disturbance data as an intermediary element that is injected into the classification model's processing pipeline. This intermediary disrupts the normal flow of feature data, making it impossible for malicious requesters to obtain clean prediction results that could be used for training their own models, while still allowing legitimate classification functionality to operate.
2Reliability
If disturbance data is added to prevent model theft, then model security is improved, but prediction accuracy may deteriorate
Solution Approach 1:
The patent applies local quality by introducing disturbance data selectively into specific intermediate layers of the classification model rather than uniformly across all layers. The disturbance is localized to particular processing stages where it can disrupt model training without fundamentally breaking the classification functionality, thus maintaining prediction accuracy while enhancing security.
Solution Approach 2:
The patent uses parameter changes by dynamically adjusting the characteristics of disturbance data (such as its magnitude, frequency, or injection points) based on the specific classification task and model architecture. This allows optimization of the disturbance parameters to achieve the right balance between preventing model theft and maintaining acceptable prediction accuracy for legitimate uses.
Data Source
AI summary
Embodiments of the present specification provide a method, apparatus, and electronic device for preventing model theft during classification using a service classification model. The service classification model is a deep neural network for predicting a category of a service object, including an input layer, multiple intermediate layers, and an output layer that are sequentially stacked. The method includes: obtaining feature information of a service object; inputting the feature information into the service classification model for initial prediction to obtain a category corresponding to a maximum initial prediction probability as a target category; determining, based on the target category, disturbance data corresponding to a target layer selected in advance from the input layer, the multiple intermediate layers, and the output layer; inputting the feature information into the service classification model for subsequent prediction, including adding the corresponding disturbance data to data to be input into the target layer; and outputting the target category and a maximum subsequent prediction probability. This can prevent model theft while ensuring that the prediction results are still usable.