在黑盒场景下,使用模型功能窃取方法生成盗版模型已经对云端模型的安全性和知识产权保护构成严重威胁。针对扰动和软化标签(变温)等现有的模型窃取防御技术可能导致模型输出中置信度最大值的类别发生改变,进而影响原始任务中模型性能的...在黑盒场景下,使用模型功能窃取方法生成盗版模型已经对云端模型的安全性和知识产权保护构成严重威胁。针对扰动和软化标签(变温)等现有的模型窃取防御技术可能导致模型输出中置信度最大值的类别发生改变,进而影响原始任务中模型性能的问题,提出一种基于暗知识保护的模型功能窃取防御方法,称为DKP(defending against model stealing attacks based on Dark Knowledge Protection)。首先,利用待保护的云端模型对测试样本进行处理,以获得样本的初始置信度分布向量;然后,在模型输出层之后添加暗知识保护层,通过分区变温调节softmax机制对初始置信度分布向量进行扰动处理;最后,得到经过防御的置信度分布向量,从而降低模型信息泄露的风险。使用所提方法在4个公开数据集上取得了显著的防御效果,尤其在博客数据集上使盗版模型的准确率降低了17.4个百分点,相比之下对后验概率进行噪声扰动的方法仅能降低约2个百分点。实验结果表明,所提方法解决了现有扰动、软化标签等主动防御方法存在的问题,在不影响测试样本分类结果的前提下,通过扰动云端模型输出的类别概率分布特征,成功降低了盗版模型的准确率,实现了对云端模型机密性的可靠保障。展开更多
The problem of art forgery and infringement is becoming increasingly prominent,since diverse self-media contents with all kinds of art pieces are released on the Internet every day.For art paintings,object detection a...The problem of art forgery and infringement is becoming increasingly prominent,since diverse self-media contents with all kinds of art pieces are released on the Internet every day.For art paintings,object detection and localization provide an efficient and ef-fective means of art authentication and copyright protection.However,the acquisition of a precise detector requires large amounts of ex-pensive pixel-level annotations.To alleviate this,we propose a novel weakly supervised object localization(WSOL)with background su-perposition erasing(BSE),which recognizes objects with inexpensive image-level labels.First,integrated adversarial erasing(IAE)for vanilla convolutional neural network(CNN)dropouts the most discriminative region by leveraging high-level semantic information.Second,a background suppression module(BSM)limits the activation area of the IAE to the object region through a self-guidance mechanism.Finally,in the inference phase,we utilize the refined importance map(RIM)of middle features to obtain class-agnostic loc-alization results.Extensive experiments are conducted on paintings,CUB-200-2011 and ILSVRC to validate the effectiveness of our BSE.展开更多
建立了一个隐含层包含一个长短期记忆层(long-short term memory,LSTM)、两个线性整流函数层(rectified linear unit,ReLU)、两个全连接层(fully connected layer)和输入、输出层组成的深度神经网络,用于脱硫系统主要指标预测。该模型...建立了一个隐含层包含一个长短期记忆层(long-short term memory,LSTM)、两个线性整流函数层(rectified linear unit,ReLU)、两个全连接层(fully connected layer)和输入、输出层组成的深度神经网络,用于脱硫系统主要指标预测。该模型对输入参数采用了指数滑动平均、合并最小分析周期等数据预处理技术进行降噪,在网络训练过程中采用dropout技术防止过拟合。仿真结果对比现场数据表明,模型对浆液pH、出口SO_(2)浓度和脱硫率均体现出良好的预测能力。本文还结合某2×350MW燃煤电厂提供的实际工况数据,以石灰石供浆密度对系统脱硫性能的影响为例,详细介绍了利用所建立的深度神经网络模型测试湿法脱硫系统各参数指标对脱硫效果的影响,并结合化学机理和工业实际进行的诊断过程。展开更多
文摘在黑盒场景下,使用模型功能窃取方法生成盗版模型已经对云端模型的安全性和知识产权保护构成严重威胁。针对扰动和软化标签(变温)等现有的模型窃取防御技术可能导致模型输出中置信度最大值的类别发生改变,进而影响原始任务中模型性能的问题,提出一种基于暗知识保护的模型功能窃取防御方法,称为DKP(defending against model stealing attacks based on Dark Knowledge Protection)。首先,利用待保护的云端模型对测试样本进行处理,以获得样本的初始置信度分布向量;然后,在模型输出层之后添加暗知识保护层,通过分区变温调节softmax机制对初始置信度分布向量进行扰动处理;最后,得到经过防御的置信度分布向量,从而降低模型信息泄露的风险。使用所提方法在4个公开数据集上取得了显著的防御效果,尤其在博客数据集上使盗版模型的准确率降低了17.4个百分点,相比之下对后验概率进行噪声扰动的方法仅能降低约2个百分点。实验结果表明,所提方法解决了现有扰动、软化标签等主动防御方法存在的问题,在不影响测试样本分类结果的前提下,通过扰动云端模型输出的类别概率分布特征,成功降低了盗版模型的准确率,实现了对云端模型机密性的可靠保障。
基金This work was supported in part by Guangdong Provincial Key Laboratory of Artificial Intelligence in Medical Image Analysis and Application,China(No.2022B1212010011).
文摘The problem of art forgery and infringement is becoming increasingly prominent,since diverse self-media contents with all kinds of art pieces are released on the Internet every day.For art paintings,object detection and localization provide an efficient and ef-fective means of art authentication and copyright protection.However,the acquisition of a precise detector requires large amounts of ex-pensive pixel-level annotations.To alleviate this,we propose a novel weakly supervised object localization(WSOL)with background su-perposition erasing(BSE),which recognizes objects with inexpensive image-level labels.First,integrated adversarial erasing(IAE)for vanilla convolutional neural network(CNN)dropouts the most discriminative region by leveraging high-level semantic information.Second,a background suppression module(BSM)limits the activation area of the IAE to the object region through a self-guidance mechanism.Finally,in the inference phase,we utilize the refined importance map(RIM)of middle features to obtain class-agnostic loc-alization results.Extensive experiments are conducted on paintings,CUB-200-2011 and ILSVRC to validate the effectiveness of our BSE.
文摘建立了一个隐含层包含一个长短期记忆层(long-short term memory,LSTM)、两个线性整流函数层(rectified linear unit,ReLU)、两个全连接层(fully connected layer)和输入、输出层组成的深度神经网络,用于脱硫系统主要指标预测。该模型对输入参数采用了指数滑动平均、合并最小分析周期等数据预处理技术进行降噪,在网络训练过程中采用dropout技术防止过拟合。仿真结果对比现场数据表明,模型对浆液pH、出口SO_(2)浓度和脱硫率均体现出良好的预测能力。本文还结合某2×350MW燃煤电厂提供的实际工况数据,以石灰石供浆密度对系统脱硫性能的影响为例,详细介绍了利用所建立的深度神经网络模型测试湿法脱硫系统各参数指标对脱硫效果的影响,并结合化学机理和工业实际进行的诊断过程。
