Neural network model stealing defense method in AIoT scene

Abstract

The invention discloses a neural network model stealing defense method in an AIoT scene. Application to the field of network safety, aIoT scenario, in order to solve the problem of model stealing caused by data leakage possibly occurring when edge end equipment transmits data to a cloud server, the invention realizes defense of model stealing by encrypting an inference data image and a label, an encrypted image part is based on a neural network class activation mapping technology, and an encrypted label part is based on an under-complete auto-encoder technology; the method mainly comprises a training stage and a deployment stage, the training stage is carried out on a server, the deployment stage is carried out after the training stage is completed, data of the training stage is deployed to edge end equipment and a cloud server, and the method can effectively prevent a neural network model in an AIoT scene from being stolen.

Description

technical field [0001] The invention belongs to the field of network defense, in particular to a neural network model stealing defense technology. Background technique [0002] Model stealing is a serious threat to neural network (NN) based artificial intelligence (AI) applications. Such as figure 1 As shown, the principle of model stealing is to send a large number of inferred requests to public machine learning APIs such as Amazon AWS, Microsoft Azure, Google Cloud, and BigML. And the output and input of the API can constitute the training data set of the stolen model, and then use various common machine learning models for training and find the best results. The purpose of stealing a model is to bypass the original model and use an alternative model to obtain future predictions for commercial gain. and / or steal model knowledge and generate transferable adversarial samples that can be used to perturb the original model to make wrong predictions. Model stealing technolo...

AI Technical Summary

Problems solved by technology

[0007] In terms of model stealing detection, M.Juuti et al. proposed a model stealing detection method based on the difference between the attacker's query distribution and the normal customer query distribution; in terms of model stealing detection defense, N.Papernot et al. Private student-teacher network architecture, and through this network architecture, the direct connection between the training set and the final deployment model is isolated, so that attackers cannot directly obtain the private information in the original training set through public APIs

[0008] However, in the AIoT scenario, data leakage may occur when the edge device transmits data to the cloud server, resulting in model theft.

Images