面向车路协同推断的差分隐私保护研究

Research on Differential Privacy Protection for Collaborative Vehicle-Road Inference

车路协同推断通过联合车载终端与路侧边缘服务器进行深度卷积网络推断运算,提高了网络架构推断效率,但是存在用户隐私泄露问题。攻击者在未知车载终端网络结构和参数的前提下,通过训练反卷积网络的方式,可复原车载终端上传的计算结果对应的图像数据,从而发起图像还原攻击。基于差分隐私理论,针对图像还原攻击设计模型扰动、输入扰动、输出扰动3种防御算法,分别在车载终端深度卷积网络的模型参数、输入原始图像、输出计算结果中加入随机拉普拉斯噪声,干扰攻击者的图像还原。通过理论分析得出3种算法均满足差分隐私保护,攻击者难以从计算结果中挖掘出原始数据的隐私信息。实验结果表明,3种算法在有效防御黑盒图像还原攻击的同时能保持推断精确度在90%以上,其中模型扰动算法在均衡隐私保护和推断精确度方面的性能表现优于输入扰动和输出扰动算法。

Collaborative vehicle-road inference performs deep convolutional network inference operations by combining vehicular terminals and roadside edge servers.Although this process improves inference efficiency,it creates the issue of user privacy leaks. Attackers can use an image reconstruction attack to recover original image data from intermediate computation results uploaded by the vehicular terminal. This terminal’s network structure and parameters are unknown by the attacker through training a deconvolutional network.This study proposes three different differential privacy-based defense algorithms:model perturbation,input perturbation,and output perturbation. These algorithms inject random Laplace noise into the model parameters,inputted original images,and outputted computation results,which inhibits the attacker’s image recovery. A theoretical analysis is presented to verify that these defense algorithms satisfy differential privacy,making it difficult for attackers to extract sensitive information. Experimental results demonstrate that all three algorithms can effectively defend against black-box image reconstruction attacks while maintaining inference accuracy above 90%.Furthermore,the model perturbation algorithm yields higher performance on the balance between privacy protection and inference accuracy than the other two algorithms.