Method and device for protecting safety of neural network model

Abstract

The embodiment of the invention provides a method for protecting the safety of a neural network model, and the method comprises the steps: obtaining a neural network model which comprises a plurality of network layers obtained through training of training data; for any first network layer, under the condition that parameters of other network layers are fixed, performing first parameter adjustment on the first network layer by using the training data to obtain a first fine adjustment model; determining a first index value of a preset performance index corresponding to the first fine tuning model, wherein the index value of the preset performance index depends on the relative size of the corresponding model, the test loss on the test data and the training loss on the training data; similarly, performing second parameter adjustment on the first network layer by using the training data and the test data to obtain a second fine adjustment model, and determining a second index value; and based on the relative size of the first index value and the second index value, determining the information sensitivity corresponding to the first network layer, and when the information sensitivity is greater than a predetermined threshold, performing security processing on the first network layer.

Description

[0001] This application is a divisional application, which is based on the patent application filed on November 16, 2020, entitled "Method and Device for Protecting Neural Network Model Security", and the application number is: 202011280172.0. technical field [0002] The embodiment of this specification relates to the field of data security technology, and in particular to a method and device for protecting the security of a neural network model. Background technique [0003] At present, it is a classic practice in the industry to use a large amount of data to train a neural network so that the neural network has a good prediction effect. The neural network memorizes the characteristics of the data to give accurate predictions when making predictions. However, when the training data is sensitive or private data such as user personal information, the trained neural network carries a large amount of sensitive and private information. If the model is directly exposed, it is ea...

AI Technical Summary

Problems solved by technology

However, when the training data is sensitive or private data such as user personal information, the trained neural network carries a large amount of sensitive and private information. If the model is directly exposed, it is easy to be attacked by an attacker or a gray product through the model to steal the information in the model. sensitive information carried

Images