在黑盒场景下,使用模型功能窃取方法生成盗版模型已经对云端模型的安全性和知识产权保护构成严重威胁。针对扰动和软化标签(变温)等现有的模型窃取防御技术可能导致模型输出中置信度最大值的类别发生改变,进而影响原始任务中模型性能的...在黑盒场景下,使用模型功能窃取方法生成盗版模型已经对云端模型的安全性和知识产权保护构成严重威胁。针对扰动和软化标签(变温)等现有的模型窃取防御技术可能导致模型输出中置信度最大值的类别发生改变,进而影响原始任务中模型性能的问题,提出一种基于暗知识保护的模型功能窃取防御方法,称为DKP(defending against model stealing attacks based on Dark Knowledge Protection)。首先,利用待保护的云端模型对测试样本进行处理,以获得样本的初始置信度分布向量;然后,在模型输出层之后添加暗知识保护层,通过分区变温调节softmax机制对初始置信度分布向量进行扰动处理;最后,得到经过防御的置信度分布向量,从而降低模型信息泄露的风险。使用所提方法在4个公开数据集上取得了显著的防御效果,尤其在博客数据集上使盗版模型的准确率降低了17.4个百分点,相比之下对后验概率进行噪声扰动的方法仅能降低约2个百分点。实验结果表明,所提方法解决了现有扰动、软化标签等主动防御方法存在的问题,在不影响测试样本分类结果的前提下,通过扰动云端模型输出的类别概率分布特征,成功降低了盗版模型的准确率,实现了对云端模型机密性的可靠保障。展开更多
Reliability-based design optimization （RBDO） is intrinsically a double-loop procedure since it involves an overall optimization and an iterative reliability assessment at each search point. Due to the double-loop pr...Reliability-based design optimization （RBDO） is intrinsically a double-loop procedure since it involves an overall optimization and an iterative reliability assessment at each search point. Due to the double-loop procedure, the computational expense of RBDO is normally very high. Current RBDO research focuses on problems with explicitly expressed performance functions and readily available gradients. This paper addresses a more challenging type of RBDO problem in which the performance functions are computation intensive. These computation intensive functions are often considered as a ＂black-box＂ and their gradients are not available or not reliable. On the basis of the reliable design space （RDS） concept proposed earlier by the authors, this paper proposes a Reliable Space Pursuing （RSP） approach, in which RDS is first identified and then gradually refined while optimization is performed. It fundamentally avoids the nested optimization and probabilistic assessment loop. Three well known RBDO problems from the literature are used for testing and demonstrating the effectiveness of the proposed RSP method.展开更多
The electric power transfer capability on the Manitoba-Ontario interconnection depends on various system operating conditions such as area generation patterns and ambient temperatures. This work models the power netwo...The electric power transfer capability on the Manitoba-Ontario interconnection depends on various system operating conditions such as area generation patterns and ambient temperatures. This work models the power network as a black-box function, which is evaluated with the system reliability analysis techniques to determine the maximum transfer capability under a given operating condition. A metamodel or an approximation model of the maximized power transfer capability is built based on the sampled system responses and optimized with respect to the corresponding operating conditions. An optimal metamodel is implemented as a prototype software tool, PTCanalyzer, and applied to Manitoba-Ontario interconnection power transfer calculations. This optimized metamodel technique provides an in-depth understanding of the dependency of the power transfer capability on system operating conditions and proves to be an effective tool in optimizing the operation planning of the interconnection for a given power system configuration. The PTCanalyzer has the potential to be used for optimization of other power network interconnections.展开更多
In this paper,we present a stochastic adaptive algorithm using radial basis function models for global optimization of costly black-box functions.The exploration radii in local searches are generated adaptively.Each i...In this paper,we present a stochastic adaptive algorithm using radial basis function models for global optimization of costly black-box functions.The exploration radii in local searches are generated adaptively.Each iteration point is selected from some randomly generated trial points according to certain criteria.A restarting strategy is adopted to build the restarting version of the algorithm.The performance of the presented algorithm and its restarting version are tested on 13 standard numerical examples.The numerical results suggest that the algorithm and its restarting version are very effective.展开更多
文摘在黑盒场景下,使用模型功能窃取方法生成盗版模型已经对云端模型的安全性和知识产权保护构成严重威胁。针对扰动和软化标签(变温)等现有的模型窃取防御技术可能导致模型输出中置信度最大值的类别发生改变,进而影响原始任务中模型性能的问题,提出一种基于暗知识保护的模型功能窃取防御方法,称为DKP(defending against model stealing attacks based on Dark Knowledge Protection)。首先,利用待保护的云端模型对测试样本进行处理,以获得样本的初始置信度分布向量;然后,在模型输出层之后添加暗知识保护层,通过分区变温调节softmax机制对初始置信度分布向量进行扰动处理;最后,得到经过防御的置信度分布向量,从而降低模型信息泄露的风险。使用所提方法在4个公开数据集上取得了显著的防御效果,尤其在博客数据集上使盗版模型的准确率降低了17.4个百分点,相比之下对后验概率进行噪声扰动的方法仅能降低约2个百分点。实验结果表明,所提方法解决了现有扰动、软化标签等主动防御方法存在的问题,在不影响测试样本分类结果的前提下,通过扰动云端模型输出的类别概率分布特征,成功降低了盗版模型的准确率,实现了对云端模型机密性的可靠保障。
基金supported by Natural Science and Engineering Research Council (NSERC) of Canada
文摘Reliability-based design optimization （RBDO） is intrinsically a double-loop procedure since it involves an overall optimization and an iterative reliability assessment at each search point. Due to the double-loop procedure, the computational expense of RBDO is normally very high. Current RBDO research focuses on problems with explicitly expressed performance functions and readily available gradients. This paper addresses a more challenging type of RBDO problem in which the performance functions are computation intensive. These computation intensive functions are often considered as a ＂black-box＂ and their gradients are not available or not reliable. On the basis of the reliable design space （RDS） concept proposed earlier by the authors, this paper proposes a Reliable Space Pursuing （RSP） approach, in which RDS is first identified and then gradually refined while optimization is performed. It fundamentally avoids the nested optimization and probabilistic assessment loop. Three well known RBDO problems from the literature are used for testing and demonstrating the effectiveness of the proposed RSP method.
文摘The electric power transfer capability on the Manitoba-Ontario interconnection depends on various system operating conditions such as area generation patterns and ambient temperatures. This work models the power network as a black-box function, which is evaluated with the system reliability analysis techniques to determine the maximum transfer capability under a given operating condition. A metamodel or an approximation model of the maximized power transfer capability is built based on the sampled system responses and optimized with respect to the corresponding operating conditions. An optimal metamodel is implemented as a prototype software tool, PTCanalyzer, and applied to Manitoba-Ontario interconnection power transfer calculations. This optimized metamodel technique provides an in-depth understanding of the dependency of the power transfer capability on system operating conditions and proves to be an effective tool in optimizing the operation planning of the interconnection for a given power system configuration. The PTCanalyzer has the potential to be used for optimization of other power network interconnections.
文摘In this paper,we present a stochastic adaptive algorithm using radial basis function models for global optimization of costly black-box functions.The exploration radii in local searches are generated adaptively.Each iteration point is selected from some randomly generated trial points according to certain criteria.A restarting strategy is adopted to build the restarting version of the algorithm.The performance of the presented algorithm and its restarting version are tested on 13 standard numerical examples.The numerical results suggest that the algorithm and its restarting version are very effective.
