Plug-and-play black-box model watermark embedding method and device
The method of generating validation samples from generative backgrounds and embedding them into the output layer of the target network solves the performance degradation problem caused by the need for fine-tuning of watermarking schemes in existing technologies, and achieves plug-and-play and efficient watermark embedding, which is suitable for complex DNN models.
Patent Information
- Application Number
- CN202310129852.X
- Authority / Receiving Office
- CN · China
- Patent Type
- Patents(China)
- Current Assignee / Owner
- Filing Date
- 2023-02-17
- Publication Date
- 2026-02-03
- Estimated Expiration
- 2043-02-17
AI Technical Summary
Existing data poisoning watermarking solutions require fine-tuning of the target model, leading to performance degradation and time consumption, and are not suitable for real-world scenarios.
This paper presents a plug-and-play black-box model watermark embedding method. It generates a watermark detection network and embeds it into the output layer of the target network. It uses generative background to generate verification samples, thereby achieving watermark embedding without fine-tuning the parameters of the target model.
It ensures model fidelity, saves training time and resource overhead, and has universality for different structures and datasets, making it suitable for complex DNN models in real-world scenarios.
Smart Images
Figure CN116167023B_ABST
Abstract
Description
Technical Field
[0001] This invention relates to the field of artificial intelligence security technology, and in particular to a plug-and-play black-box model watermark embedding method and device. Background Technology
[0002] Deep neural network watermarking (DNN watermarking) is categorized into parametric embedding and data poisoning watermarking schemes based on whether the owner needs access to the suspicious model during ownership verification. Parametric embedding watermarking schemes embed the watermark into the parameters or activations of hidden layers of the target model. All parametric embedding watermarking schemes require access to the model weights during verification (i.e., white-box setup), making them impractical for real-world scenarios. Data poisoning watermarking schemes create watermarks from sample label pairs through model fine-tuning and verify the watermark by querying the model in a black-box setup. Samples can be generated by mixing certain patterns (called pattern-based), perturbing normal samples (called perturbation), or extracting from other data sources (also known as OOD). Unfortunately, existing data poisoning watermarking schemes require fine-tuning of the target model for further ownership verification, which suffers performance degradation in benign sample prediction and is time-consuming. Therefore, developing a plug-and-play black-box model watermark embedding method and device that can effectively overcome the shortcomings of the aforementioned related technologies has become a pressing technical problem in the industry. Summary of the Invention
[0003] To address the aforementioned problems in the existing technology, embodiments of the present invention provide a plug-and-play black-box model watermark embedding method and device.
[0004] In a first aspect, embodiments of the present invention provide a plug-and-play black-box model watermark embedding method, comprising: step 1, generating a watermark detection network M_pty and a watermark verification sample X_v; step 2, embedding the watermark detection network M_pty obtained in step 1 into the target network M_target to be protected.
[0005] Based on the above method embodiments, the plug-and-play black-box model watermark embedding method provided in this embodiment of the invention includes the following steps in step 1: Step 1.1, using a single fixed background as a trigger for the watermark network; Step 1.2, using a fixed background as a trigger for the watermark network; Step 1.3, using a generative background as a trigger for the watermark network.
[0006] Based on the above method embodiments, the plug-and-play black-box model watermark embedding method provided in this embodiment includes step 1.1: selecting a first type of image X as one type of the watermark detection network dataset, selecting a fixed background pattern X_a, and combining the foreground of the first type of image X to generate images as several other types of the training watermark network dataset, dividing the dataset into a training set and a test set, the structure of the watermark detection network is a deep neural network, using the training set to train the watermark detection network to obtain the watermark network, and using the test set as verification samples.
[0007] Based on the above method embodiments, the plug-and-play black-box model watermark embedding method provided in this embodiment includes step 1.2: selecting a second type of image Y as one type of the watermark detection network dataset, selecting multiple fixed background patterns X_b, and combining the foreground of the second type of image Y to generate images as several other types of the training watermark network dataset, dividing the dataset into a training set and a test set, the structure of the watermark detection network is a deep neural network, using the training set to train the network to obtain the watermark detection network, and using the test set as verification samples.
[0008] Based on the above method embodiments, the plug-and-play black-box model watermark embedding method provided in this embodiment includes the following steps in step 1.3: selecting a third type of image Z as one class of the watermark detection network dataset, selecting a background pattern X_c, and using images generated by combining the foreground of the third type of image Z as several other classes of the training watermark network dataset, dividing the dataset into a training set and a test set, the structure of the watermark detection network is a deep neural network, using the training set to train the network to obtain the watermark detection network, using the background pattern X_c as the training set of the generative adversarial network (GAN) to train a validation sample generator G, and using the validation sample generator G to obtain validation samples X_v = G(z), where z is random noise.
[0009] Based on the above method embodiments, the plug-and-play black-box model watermark embedding method provided in this embodiment of the invention specifically includes the following step 2: In the process of preparing to embed the watermark detection network M_pty into the target network M_target to be protected, the output layers connecting the watermark detection network M_pty and the target network M_target are first passed through a softmax layer to obtain y_pty = softmax(M_pty) and y_target = softmax(M_target). The class corresponding to the output of image X in y_pty = softmax(M_pty) is removed. Then, the remaining channels of the watermark detection network M_pty and the corresponding channels of the target network M_target are connected together to obtain the final output y = y_pty + y_target. Wherein, y_pty is the output result of the prediction of the watermark detection network M_pty after passing through the softmax layer, and y_target is the output result of the prediction of the target network M_target after passing through the softmax layer.
[0010] Secondly, embodiments of the present invention provide a plug-and-play black-box model watermark embedding device, comprising: a first main module for implementing step 1, generating a watermark detection network M_pty and a watermark verification sample X_v; and a second main module for implementing step 2, embedding the watermark detection network M_pty obtained in step 1 into the target network M_target to be protected.
[0011] Thirdly, embodiments of the present invention provide an electronic device, comprising:
[0012] At least one processor; and
[0013] At least one memory communicatively connected to the processor, wherein:
[0014] The memory stores program instructions that can be executed by the processor. The processor can call the program instructions to execute the plug-and-play black-box model watermark embedding method provided by any of the various implementations of the first aspect.
[0015] Fourthly, embodiments of the present invention provide a non-transitory computer-readable storage medium storing computer instructions that cause a computer to execute a plug-and-play black-box model watermark embedding method provided by any of the various implementations of the first aspect.
[0016] The plug-and-play black-box model watermark embedding method and device provided in this invention embeds watermarks by inserting a trained dedicated watermark verification model into the target model without fine-tuning the parameters of the target model. This greatly ensures the model's fidelity, saves training time and resources, and has strong versatility for models with different structures and datasets. It can also be applied in real-world scenarios to handle real-world tasks with complex DNN models. Attached Figure Description
[0017] To more clearly illustrate the technical solutions in the embodiments of the present invention or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.
[0018] Figure 1 Flowchart of the plug-and-play black-box model watermark embedding method provided in this embodiment of the invention;
[0019] Figure 2 A schematic diagram of the plug-and-play black-box model watermark embedding device provided in an embodiment of the present invention;
[0020] Figure 3 This is a schematic diagram of the physical structure of an electronic device provided in an embodiment of the present invention. Detailed Implementation
[0021] To make the objectives, technical solutions, and advantages of the embodiments of the present invention clearer, the technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention. In addition, the technical features of the various embodiments or individual embodiments provided by the present invention can be arbitrarily combined with each other to form feasible technical solutions. Such combinations are not constrained by the order of steps and / or structural composition patterns, but must be based on the ability of those skilled in the art to implement them. When the combination of technical solutions is contradictory or cannot be implemented, it should be considered that such a combination of technical solutions does not exist and is not within the scope of protection claimed by the present invention.
[0022] This invention provides a plug-and-play black-box model watermark embedding method, see [link to relevant documentation]. Figure 1The method includes: Step 1, generating a watermark detection network M_pty and a watermark verification sample X_v; Step 2, embedding the watermark detection network M_pty obtained in Step 1 into the target network M_target that needs to be protected.
[0023] Based on the above method embodiments, as an optional embodiment, the plug-and-play black-box model watermark embedding method provided in this embodiment of the invention specifically includes the following steps in step 1: Step 1.1, using a single fixed background as a trigger for the watermark network; Step 1.2, using a fixed background as a trigger for the watermark network; Step 1.3, using a generative background as a trigger for the watermark network.
[0024] Based on the above method embodiments, as an optional embodiment, the plug-and-play black-box model watermark embedding method provided in this embodiment of the invention includes the following steps in step 1.1: selecting a first type of image X as one type of the watermark detection network dataset, selecting a fixed background pattern X_a, and combining the foreground of the first type of image X to generate images as several other types of the training watermark network dataset, dividing the dataset into a training set and a test set, the structure of the watermark detection network is a deep neural network, using the training set to train the watermark detection network to obtain the watermark network, and using the test set as verification samples.
[0025] Specifically, we select the first class image X from ImageNet as one class of the watermark detection network dataset, and set its label to 0. We then select a fixed background pattern X_a, and combine it with the foreground of the first class image X to generate another class of the watermark detection network dataset, setting its label to 1. The datasets are then divided into training and testing sets. The watermark detection network uses a simple ResNet18 architecture, with the last fully connected (fc) layer set to a 2-dimensional output layer. Training the network on the training set yields the watermark network with the following parameters: cross-entropy loss function, Adam optimizer, and a learning rate of 0.001. The testing set is used as the validation set.
[0026] Based on the above method embodiments, as an optional embodiment, the plug-and-play black-box model watermark embedding method provided in this embodiment of the invention includes the following steps in step 1.2: selecting a second type of image Y as one type of the watermark detection network dataset, selecting multiple fixed background patterns X_b, and combining the foreground of the second type of image Y to generate images as several other types of the training watermark network dataset, dividing the dataset into a training set and a test set, the structure of the watermark detection network is a deep neural network, using the training set to train the network to obtain the watermark detection network, and using the test set as verification samples.
[0027] Specifically, the second class image Y from ImageNet is selected as one class in the watermark detection network dataset, and its label is set to 0. A fixed background pattern X_b is selected, and images generated by combining the foreground of image X are used as the other 5 classes in the training dataset for the watermark detection network, with their labels set to 1 to 5. The dataset is divided into training and test sets. The watermark detection network has a simple ResNet18 structure, and the last fully connected layer (fc) is set to a fully connected layer with an output dimension of 6. The network is trained using the training set with the following parameters: cross-entropy loss function, Adam optimizer, and learning rate set to 0.001. The test set is used as the validation sample.
[0028] Based on the above method embodiments, as an optional embodiment, the plug-and-play black-box model watermark embedding method provided in this embodiment of the invention includes the following steps in step 1.3: selecting a third type of image Z as one class of the watermark detection network dataset, selecting a background pattern X_c, and using images generated by combining the foreground of the third type of image Z as several other classes of the training watermark network dataset, dividing the dataset into a training set and a test set, the structure of the watermark detection network is a deep neural network, using the training set to train the network to obtain the watermark detection network, using the background pattern X_c as the training set of the generative adversarial network (GAN) to train a validation sample generator G, and using the validation sample generator G to obtain validation samples X_v = G(z), where z is random noise.
[0029] Specifically, the third class image Z from ImageNet is selected as one class of the watermark detection network dataset, and the dataset label is set to 0. The scene pattern X_c of the bedroom class from LSUN is selected, and the image generated by combining it with the foreground of the third class image Z is used as the other class of the training dataset for the watermark detection network, with the dataset label set to 1. The dataset is divided into training and testing sets. The watermark detection network uses the ResNet18 architecture, and the last fully connected layer (fc) is set to a fully connected layer with an output dimension of 2. The network is trained using the training set, with the following training parameters: cross-entropy loss function, Adam optimizer, and learning rate set to 0.001. The background pattern X_c is used as the training set for the generative model, which can be either a Generative Adversarial Network (GAN) or a diffusion model. Taking a GAN as an example, the discriminator D is trained first, and the validation sample generator G is trained by setting D(G(z)) = 0 and D(X_b) = 1. The validation sample X_v = G(z) is then obtained using G, where z is random noise.
[0030] Based on the above method embodiments, as an optional embodiment, the plug-and-play black-box model watermark embedding method provided in this embodiment of the invention specifically includes step 2 as follows: In the process of preparing to embed the watermark detection network M_pty into the target network M_target to be protected, the output layers connecting the watermark detection network M_pty and the target network M_target to be protected are first passed through a softmax layer to obtain y_pty = softmax(M_pty) and y_target = softmax(M_target). The class corresponding to the output of image X in y_pty = softmax(M_pty) is removed. Then, the remaining channels of the watermark detection network M_pty and the corresponding channels of the target network M_target to be protected are connected together to obtain the final output y = y_pty + y_target. Wherein, y_pty is the output result of the prediction of the watermark detection network M_pty after passing through the softmax layer, and y_target is the output result of the prediction of the target network M_target to be protected after passing through the softmax layer.
[0031] Specifically, first, the output layers of M_pty and M_target obtained in step one are each passed through a softmax layer to obtain y_pty = softmax(M_pty) and y_target = softmax(M_target). Then, the class corresponding to the output of image X in y_pty = softmax(M_pty) is removed; this corresponds to removing the 0th dimension output of y_pty in the network from step one. Finally, the channels of the remaining watermark detection network M_pty and the corresponding channels of the target network M_target are concatenated to obtain the final output y = y_pty + y_target.
[0032] The plug-and-play black-box model watermark embedding method provided in this invention embeds watermarks by inserting a trained dedicated watermark verification model into the target model without fine-tuning the parameters of the target model. This greatly ensures the model's fidelity, saves training time and resources, and has strong versatility for models with different structures and datasets. It can also be applied to real-world scenarios to handle real-world tasks with complex DNN models.
[0033] The implementation of the various embodiments of the present invention is based on programmed processing through a device with processor functionality. Therefore, in practical engineering, the technical solutions and functions of the various embodiments of the present invention can be encapsulated into various modules. Based on this reality, and building upon the above embodiments, the embodiments of the present invention provide a plug-and-play black-box model watermark embedding device, which is used to execute the plug-and-play black-box model watermark embedding method in the above method embodiments. See also... Figure 2 The device includes: a first main module for implementing step 1, generating a watermark detection network M_pty and a watermark verification sample X_v; and a second main module for implementing step 2, embedding the watermark detection network M_pty obtained in step 1 into the target network M_target to be protected.
[0034] The plug-and-play black-box model watermark embedding device provided in this embodiment of the invention employs... Figure 2 Several modules in the model embed watermarks by inserting a trained, dedicated watermark verification model into the target model, without needing to fine-tune the parameters of the target model. This greatly ensures the model's fidelity, saves training time and resources, and has strong versatility for models with different structures and datasets. It can also be applied to real-world scenarios to handle real-world tasks with complex DNN models.
[0035] It should be noted that the apparatus in the device embodiments provided by the present invention can be used not only to implement the methods in the above method embodiments, but also to implement the methods in other method embodiments provided by the present invention. The difference lies only in the setting of corresponding functional modules. Its principle is basically the same as that of the above device embodiments provided by the present invention. As long as those skilled in the art, based on the above device embodiments and referring to the specific technical solutions in other method embodiments, obtain corresponding technical means and technical solutions composed of these technical means by combining technical features, and improve the apparatus in the above device embodiments while ensuring the practicality of the technical solutions, they can obtain corresponding device-type embodiments for implementing the methods in other method-type embodiments. For example:
[0036] Based on the above device embodiments, as an optional embodiment, the plug-and-play black-box model watermark embedding device provided in this embodiment of the invention further includes: a first sub-module, used to implement step 1, specifically including: step 1.1, using a single fixed background as a trigger for a watermark network; step 1.2, using a fixed background as a trigger for a watermark network; step 1.3, using a generative background as a trigger for a watermark network.
[0037] Based on the above device embodiments, as an optional embodiment, the plug-and-play black-box model watermark embedding device provided in this embodiment of the invention further includes: a second sub-module, used to implement step 1.1, which includes: selecting a first type of image X as one type of the watermark detection network dataset, selecting a fixed background pattern X_a, and combining the foreground of the first type of image X to generate images as several other types of the training watermark network dataset, dividing the dataset into a training set and a test set, the structure of the watermark detection network is a deep neural network, using the training set to train the watermark detection network to obtain the watermark network, and using the test set as verification samples.
[0038] Based on the above device embodiments, as an optional embodiment, the plug-and-play black-box model watermark embedding device provided in this embodiment of the invention further includes: a third sub-module, used to implement step 1.2, which includes: selecting a second type of image Y as one type of the watermark detection network dataset, selecting multiple fixed background patterns X_b, and combining the foreground of the second type of image Y to generate images as several other types of the training watermark network dataset, dividing the dataset into a training set and a test set, the structure of the watermark detection network is a deep neural network, using the training set to train the network to obtain the watermark detection network, and using the test set as verification samples.
[0039] Based on the above device embodiments, as an optional embodiment, the plug-and-play black-box model watermark embedding device provided in this embodiment of the invention further includes: a fourth sub-module, used to implement step 1.3, including: selecting a third type of image Z as one type of the watermark detection network dataset, selecting a background pattern X_c, and combining the foreground of the third type of image Z to generate images as several other types of the training watermark network dataset, dividing the dataset into a training set and a test set, the structure of the watermark detection network is a deep neural network, using the training set to train the network to obtain the watermark detection network, using the background pattern X_c as the training set of the generative adversarial network GAN to train a verification sample generator G, and using the verification sample generator G to obtain verification samples X_v = G(z), where z is random noise.
[0040] Based on the above device embodiments, as an optional embodiment, the plug-and-play black-box model watermark embedding device provided in this embodiment of the invention further includes: a fifth submodule, used to implement step 2, specifically including: in the process of preparing to embed the watermark detection network M_pty into the target network M_target to be protected, the output layers connecting the watermark detection network M_pty and the target network M_target to be protected are first passed through a softmax layer to obtain y_pty = softmax(M_pty) and y_target = softmax(M_target). The class corresponding to the output of image X in y_pty = softmax(M_pty) is removed. Then, the remaining channels of the watermark detection network M_pty and the corresponding channels of the target network M_target to be protected are connected together to obtain the final output y = y_pty + y_target; where y_pty is the output result of the prediction of the watermark detection network M_pty after passing through the softmax layer, and y_target is the output result of the prediction of the target network M_target to be protected after passing through the softmax layer.
[0041] The method in this embodiment of the invention is implemented using an electronic device; therefore, it is necessary to introduce the relevant electronic device. For this purpose, this embodiment of the invention provides an electronic device, such as... Figure 3 As shown, the electronic device includes at least one processor, a communications interface, at least one memory, and a communications bus, wherein the at least one processor, the communications interface, and the at least one memory communicate with each other via the communications bus. The at least one processor can invoke logical instructions stored in the at least one memory to execute all or part of the steps of the methods provided in the foregoing method embodiments.
[0042] Furthermore, when the logical instructions in at least one of the aforementioned memories can be implemented as software functional units and sold or used as independent products, they can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present invention, in essence, or the part that contributes to the prior art, or a part of the technical solution, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute all or part of the steps of the methods described in the various method embodiments of the present invention. The aforementioned storage medium includes various media capable of storing program code, such as USB flash drives, portable hard drives, read-only memory (ROM), random access memory (RAM), magnetic disks, or optical disks.
[0043] The device embodiments described above are merely illustrative. The units described as separate components may or may not be physically separate. The components shown as units may or may not be physical units; that is, they may be located in one place or distributed across multiple network units. Some or all of the modules can be selected to achieve the purpose of this embodiment according to actual needs. Those skilled in the art can understand and implement this without any creative effort.
[0044] Through the above description of the embodiments, those skilled in the art can clearly understand that each embodiment can be implemented by means of software plus necessary general-purpose hardware platforms, and of course, it can also be implemented by hardware. Based on this understanding, the above technical solutions, in essence or the part that contributes to the prior art, can be embodied in the form of a software product. This computer software product can be stored in a computer-readable storage medium, such as ROM / RAM, magnetic disk, optical disk, etc., and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute the methods described in the various embodiments or some parts of the embodiments.
[0045] The flowcharts and block diagrams in the accompanying drawings illustrate the architecture, functionality, and operation of possible implementations of systems, methods, and computer program products according to various embodiments of the present invention. Based on this understanding, each block in a flowchart or block diagram may represent a module, segment, or portion of code containing one or more executable instructions for implementing a specified logical function. It should also be noted that in some alternative implementations, the functions marked in the blocks may occur in a different order than those shown in the drawings. For example, two consecutive blocks may actually be executed substantially in parallel, or sometimes in reverse order, depending on the functions involved. It should also be noted that each block in the block diagrams and / or flowcharts, and combinations of blocks in the block diagrams and / or flowcharts, can be implemented using a dedicated hardware-based system that performs the specified function or action, or using a combination of dedicated hardware and computer instructions.
[0046] It should be noted that the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such process, method, article, or apparatus. Unless otherwise specified, an element defined by the phrase "comprising..." does not exclude the presence of other identical elements in the process, method, article, or apparatus that includes said element.
[0047] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention, and not to limit them; although the present invention has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that modifications can still be made to the technical solutions described in the foregoing embodiments, or equivalent substitutions can be made to some of the technical features; and these modifications or substitutions do not cause the essence of the corresponding technical solutions to deviate from the spirit and scope of the technical solutions of the embodiments of the present invention.
Claims
1. A plug-and-play black-box model watermark embedding method, characterized in that, include: Step 1: Generate the watermark detection network M_pty and the watermark verification sample X_v; Step 2: Embed the watermark detection network M_pty obtained in Step 1 into the target network M_target that needs to be protected. Specifically, step 1 includes: step 1.1, using a single fixed background as a trigger for a watermarking network; step 1.2, using a fixed background as a trigger for a watermarking network; and step 1.3, using a generative background as a trigger for a watermarking network. Step 2 specifically includes: In the process of preparing to embed the watermark detection network M_pty into the target network M_target to be protected, the output layers connecting the watermark detection network M_pty and the target network M_target are first passed through a softmax layer to obtain y_pty=softmax(M_pty) and y_target=softmax(M_target). The class corresponding to the output of image X in y_pty=softmax(M_pty) is removed. Then, the remaining channels of the watermark detection network M_pty and the corresponding channels of the target network M_target are connected together to obtain the final output y=y_pty+y_target. Here, y_pty is the output result of the prediction of the watermark detection network M_pty after passing through the softmax layer, and y_target is the output result of the prediction of the target network M_target after passing through the softmax layer.
2. The plug-and-play black-box model watermark embedding method according to claim 1, characterized in that, Step 1.1 includes: selecting a first-class image X as one class of the watermark detection network dataset, selecting a fixed background pattern X_a, and using the foreground of the first-class image X to generate images as several other classes of the training watermark network dataset, dividing the dataset into a training set and a test set, the structure of the watermark detection network is a deep neural network, using the training set to train the watermark detection network to obtain the watermark network, and using the test set as verification samples.
3. The plug-and-play black-box model watermark embedding method according to claim 2, characterized in that, Step 1.2 includes: selecting the second type of image Y as one class of the watermark detection network dataset, selecting multiple fixed background patterns X_b, and combining the foreground of the second type of image Y to generate images as other classes of the training watermark network dataset, dividing the dataset into training set and test set, the structure of the watermark detection network is a deep neural network, using the training set to train the network to obtain the watermark detection network, and using the test set as verification samples.
4. The plug-and-play black-box model watermark embedding method according to claim 3, characterized in that, Step 1.3 includes: selecting the third type of image Z as one class of the watermark detection network dataset, selecting the background pattern X_c, and using the foreground image generated by combining the third type of image Z as several other classes of the training watermark network dataset, dividing the dataset into training set and test set, the structure of the watermark detection network is a deep neural network, using the training set to train the network to obtain the watermark detection network, using the background pattern X_c as the training set of the generative adversarial network GAN to train the validation sample generator G, and using the validation sample generator G to obtain the validation sample X_v=G(z), where z is random noise.
5. A plug-and-play black-box model watermark embedding device, characterized in that, include: The first main module is used to implement step 1, which generates the watermark detection network M_pty and the watermark verification sample X_v; The second main module is used to implement step 2, which embeds the watermark detection network M_pty obtained in step 1 into the target network M_target that needs to be protected.
6. An electronic device, characterized in that, include: At least one processor, at least one memory, and a communication interface; wherein, The processor, memory, and communication interface communicate with each other; The memory stores program instructions that can be executed by the processor, which invokes the program instructions to perform the method described in any one of claims 1 to 4.
7. A non-transitory computer-readable storage medium, characterized in that, The non-transitory computer-readable storage medium stores computer instructions that cause the computer to perform the method described in any one of claims 1 to 4.