Black box deep learning model copyright protection method based on adversarial sample fingerprints

Abstract

The invention discloses a black box deep learning model copyright protection method based on an adversarial sample fingerprint, and the method comprises the steps: designing a deep learning model difference degree measurement index, achieving an efficient seed selection strategy and an adversarial sample fingerprint generation method, and carrying out the similarity measurement of a suspicious model on the basis (only needing the output of the last layer of the model, and finally, judging whether the suspicious model has an infringement behavior or not. According to the method, the fingerprint set can be automatically generated for the original model based on the public attribute (robustness) of the deep learning model, and the method is effective in various model stealing scenes; the method is not limited by the data field and the model structure, and has good universality and expansibility. Compared with a traditional model watermark embedding method, the method does not need to intervene in a training process of the deep learning model, avoids a tedious and time-consuming parameter adjustment process and accuracy loss caused by watermark embedding, and enables copyright verification and protection of the deep learning model to become simple and efficient.

Description

technical field [0001] The invention relates to the security and privacy fields of deep learning models, in particular to a copyright protection method for black-box deep learning models based on adversarial sample fingerprints. Background technique [0002] Deep learning has achieved great success in solving many practical problems, such as image recognition, speech recognition, natural language processing, etc. However, training deep learning models is not easy and usually requires a lot of resources, including large datasets, expensive computing resources, and expert knowledge. Furthermore, the cost of training a high-performance model grows rapidly with task complexity and model capacity. For example, training a BERT model on the Wikipedia and book corpus (15GB) costs about $1.6 million. This gives malicious adversaries (model thieves) an incentive to steal the models and cover their tracks, resulting in model copyright infringement and possible financial loss. It tur...

AI Technical Summary

Problems solved by technology

However, the current watermarking technology has two key flaws: 1) Watermark embedding needs to be involved in the normal training process, resulting in damage to the model performance; 2) Overfitting embedded watermarks are easily cleared by attackers, resulting in watermark failure

Images