Watermark generation method and system based on artificial intelligence

Abstract

The invention discloses a watermark generation method and system based on artificial intelligence. The method comprises the following steps: extracting a depth characteristic spectrum of a to-be-protected model and generating a multi-scale topological code; segmenting the codes to generate a dynamic execution unit sequence, and marking decision nodes; constructing a nonlinear path containing random displacement, conditional branches, noise channels and virtual nodes; iteratively optimizing the watermark engine in stages; generating an irreversible identifier through a generative adversarial network, and fusing the dynamic sequence and the identifier to generate a confusion structure; and a watermark driving engine is generated through quantum noise compression, chaotic encryption and recursive iteration, and finally a deployable module is generated. The system comprises a feature extraction module, a path construction module, an iterative optimization module and the like. According to the method, through multi-level confusion, cross-domain fusion and active defense mechanisms, the reverse analysis resistance of watermarks is remarkably improved.

Description

Technical Field

[0001] This invention relates to the field of watermark generation technology, specifically to a watermark generation method and system based on artificial intelligence. Background Technology

[0002] With the rapid development of artificial intelligence technology, the value of various AI models (such as deep learning models and neural network models) is becoming increasingly prominent, but the security threats they face, such as piracy, tampering, and reverse engineering, are also becoming increasingly severe. Traditional watermarking technologies are mostly designed for static data (such as images and text), and are difficult to adapt to the dynamic execution and complex structure of AI models—watermarks generated by existing methods are easily removed, have weak anti-parsing capabilities, and may significantly affect model performance after embedding.

[0003] Specifically, traditional watermarks are typically embedded in models with a linear structure, allowing attackers to locate and remove them through simple structural analysis. Furthermore, the watermark's binding to model features is weak, making it vulnerable to attacks such as cropping and fine-tuning. In addition, it lacks proactive defense mechanisms and cannot protect itself against reverse engineering. Therefore, there is an urgent need for a watermark generation technology that can deeply integrate model features, possess multi-level obfuscation capabilities, and have proactive defense functions to meet the high security protection requirements of AI models. Summary of the Invention

[0004] In view of this, the purpose of the present invention is to provide a watermark generation method and system based on artificial intelligence to solve the problems mentioned in the background art.

[0005] The main objective of this application is to provide a watermark generation method based on artificial intelligence, including the following steps: a) extracting the deep feature map of the model to be protected through a neural network, and generating a multi-scale topological coding structure from the deep feature map; b) Use the timing parsing module to segment the topology coding structure to generate a dynamic execution unit sequence, analyze the dependencies between units, and mark the control flow decision nodes; c) Construct a nonlinear execution path based on the logical hierarchy of decision nodes, including: performing random topological displacement I on non-decision units; converting direct decision nodes into multi-level conditional branches II; inserting adversarial noise channels III into conditional decision nodes; and embedding virtual nodes IV when the decision path depth exceeds the threshold. d) Iterative optimization of the watermark structure in stages, including: the initial stage (x=0) generates a basic watermark engine based on the baseline topology coding; in the xth stage, a new obfuscation structure is input into the (x-1)th order watermark engine, and the output anti-parsing path group is output; after the node weight is corrected, the output path group is merged into the previous watermark engine to generate the xth order enhanced watermark engine, where 1≤x≤N, N≥2. e) Reconstructing topologically encoded semantic features into irreversible identifiers using generative adversarial networks; f) Utilize graph neural networks to fuse dynamic execution sequences with irreversible identifiers to generate obfuscated structures resistant to reverse parsing; g) After quantum noise compression, the confused structure is chaotically encrypted with the watermark information, and the recursive iterative steps a)-f) generate the final watermark driving engine. h) Generate deployable model modules through the feature fusion interface.

[0006] Further, in step c): path obfuscation is implemented according to the decision node weights, including... Insert dummy conditional branches and add random delays to single-path nodes; Decompose the direct control node into cascaded condition judgments; Inject Gaussian noise into the decision boundary of the conditional branch nodes; Insert redundant computing channels for data-dependent nodes; When the branch depth exceeds 3 levels, a self-destructing trap node is embedded. A multidimensional random perturbation tensor is added to the output of the decision node; Structural continuity is disrupted by non-Euclidean space mapping.

[0007] Furthermore, the phased iterative optimization of step d) includes: The number of input obfuscated structures in stage x is greater than the number of inputs in stage (x-1); The node weight adjustment in stage x is less than the adjustment in stage (x-1).

[0008] Furthermore, the node weight correction in step d) includes: Complete the probability weights for path nodes without labeled weights; Delete the node labels with incorrectly marked weights; Add random noise channels to low-weight nodes.

[0009] Furthermore, the deployable module generated in step h) contains three channels: Device fingerprints obtained through biometric identification; The sequence of entropy sources obtained by a quantum random number generator; Model structure fingerprint generated by topological isomorphism mapping.

[0010] Furthermore, the chaotic encryption in step g) includes: The quantum-compressed confused structure is divided into a [K×K] grid; Implement the Logistic chaotic mapping independently for each grid cell: x n+1 =μx n (1−x n (μ∈[3.7,4.0]); The watermark information bit sequence is reorganized by sorting the grid cell entropy values.

[0011] This invention also provides an artificial intelligence-based watermark generation system, comprising: The deep feature extraction module is used to parse the target model and generate multi-scale topological codes. The dynamic path building module is used to generate anti-parsing execution units based on spatiotemporal dependencies; The iterative optimization control module is used to perform phased watermarking engine enhancements, including: The collection unit is used to obtain the path group output by the (x-1)th stage engine through the x-th stage confusion structure; The correction unit is used to calibrate the node weights of the output path group. The fusion unit is used to combine the calibrated paths into the preceding engine to generate the xth-order enhancement engine; The semantic obfuscation module is used to reconstruct irreversible identifiers by generating an adversarial network; The graph structure fusion module is used to assemble dynamic execution sequences using graph neural networks; The engine generation module is used to build a watermarking engine based on chaotic encryption recursion. A quantum compression module for implementing noisy quantum state compression encryption; The model encapsulation module is used to generate deployable watermarked modules; A hierarchical storage module is used to store the topology parameters and node weight mapping tables of the watermarking engine at each stage. The path weight analysis module is used to mark the path execution probability weight according to the decision node type (single path / multi-branch, data dependency / control dependency).

[0012] Furthermore, the number of topology parameters of the watermark engine in stage x of the hierarchical storage module is greater than that in stage (x-1); the path weight analysis module assigns an execution weight of less than 0.3 to decision paths with a depth greater than 3 layers.

[0013] Furthermore, the irreversible identifier includes a category label for normal structure nodes and a clustering label for confused structure nodes; the clustering label is divided into isolated nodes (number of connections ≤ 2) and clustered nodes (number of connections ≥ 5) according to the node connection density.

[0014] Furthermore, the noise intensity of adding random topological displacement to isolated nodes is 30%-50% higher than that of clustered nodes; the adversarial noise channel insertion density of clustered nodes is twice that of isolated nodes.

[0015] Furthermore, the iterative optimization control module includes a trap node activation unit, which triggers a self-destruct protocol when reverse parsing is detected. The self-destruct protocol performs the following operations: Delete the critical path weight mapping table; Inject high-amplitude noise into conditional branch nodes; Redirect control flow to the virtual node cluster.

[0016] The beneficial effects of the present invention are as follows: This application's multi-scale topological coding structure extracts deep features of the model to be protected through neural networks and constructs topological codes from micro to macro dimensions. Compared to traditional linear coding, it has significant advantages: First, this structure can completely preserve the deep features and complex dependencies of the model. Traditional coding only records surface parameters and cannot reflect the logical structure and functional characteristics of the model. Multi-scale topological coding covers multi-level information from neuron connections to module interactions, enabling the watermark to be deeply bound to the model. If an attacker wants to remove the watermark, they need to destroy the core structure of the model, causing the model to malfunction, thus significantly increasing the attack cost. Second, the multi-scale characteristic provides a flexible foundation for subsequent dynamic path construction. Coding at different scales can correspond to different levels of execution units, allowing dynamic paths to be obfuscated at both the micro (e.g., node level) and macro (e.g., module level) levels, forming a comprehensive anti-analysis barrier. For example, node displacement at the micro scale can interfere with the attacker's parsing of local logic, while module interaction obfuscation at the macro scale can hinder the understanding of the overall structure. The combination of the two significantly improves the watermark's anti-analysis capability. Finally, the graph structure characteristics of topological coding give it a natural ability to resist linear parsing. The logical order of traditional linear coding is easily traced by attackers, while the node-edge structure of topological coding has no fixed linear order, making it difficult for attackers to reconstruct the coding logic through conventional sequence analysis methods, thus laying the structural foundation for the subsequent construction of nonlinear paths.

[0017] This application presents a nonlinear execution path constructed based on the logical hierarchy of decision nodes. Through operations such as random displacement, conditional branching, and noise injection, it fundamentally breaks the predictability of traditional linear paths. The nonlinearity of the path makes it difficult for attackers to establish an input-output mapping model. In traditional linear paths, there is a clear causal relationship between input and output, allowing attackers to train and reverse-engineer the path logic using a large number of samples. However, in nonlinear paths, random displacement leads to uncertain node positions, conditional branching diversifies path choices, and noise injection blurs decision boundaries. Even small changes in input can cause significant output shifts, drastically reducing the training accuracy of the mapping model and even preventing convergence. A differentiated obfuscation strategy enhances the path's targeted anti-analysis capabilities. Operations such as random displacement of non-decision units, multi-level branching transformations of direct decision nodes, and noise injection into condition nodes are designed to target the weaknesses of different types of nodes, achieving precise protection. For example, the decision boundary of a conditional branch node is its weakness. After injecting Gaussian noise, even if an attacker possesses some input-output data, it is difficult to determine the decision threshold, effectively resisting boundary-based attacks. The introduction of virtual nodes and trap nodes forms an active defense mechanism. The embedding of virtual nodes makes it difficult for attackers to distinguish between valid and invalid paths, increasing the redundancy of parsing; when the path depth exceeds the limit, the embedded self-destructing trap node actively destroys the watermark structure when reverse parsing is detected, turning passive defense into active counterattack, further improving the security of the watermark.

[0018] Phased iterative optimization progressively strengthens the watermarking engine, ensuring both improved watermark strength and structural stability while maintaining functional effectiveness. The iterative process achieves a "step-like" increase in watermark strength. The number of obfuscated structures in stage x is greater than in stage x-1, meaning that each iteration introduces more obfuscation strategies (such as more non-linear paths and noise channels), gradually enhancing the watermarking engine's resistance to parsing. This gradual strengthening avoids structural chaos caused by introducing too much obfuscation at once, ensuring the watermark maintains its basic functionality throughout the iteration process. Decreasing node weight corrections guarantee structural stability. Larger corrections in the initial stage allow for rapid calibration of basic weights, enabling the watermarking engine to perform basic path execution; subsequent stages reduce corrections to avoid over-adjustment that could disrupt the established stable structure—this "coarse-tuning followed by fine-tuning" strategy improves strength while ensuring functional consistency of the watermarking engine, preventing performance fluctuations due to iterative optimization. Phased storage of topology parameters and weight mapping tables supports the traceability and scalability of the watermark. The hierarchical storage module saves parameters for each stage, allowing developers to backtrack the iteration process and analyze the optimization effects at different stages. At the same time, if it is necessary to further improve the watermark strength, it can continue to iterate based on the existing stage (N≥2) without redesigning the overall structure, which significantly reduces the cost of system expansion.

[0019] By leveraging Generative Adversarial Networks (GANs), topologically encoded semantic features are reconstructed into irreversible identifiers, achieving deep decoupling between the watermark and model features at the semantic level. This irreversibility ensures the identifier's resistance to reconstruction. GANs, through adversarial training between the generator and discriminator, transform the original semantic features into new identifiers—a process that cannot be reversed, meaning attackers cannot deduce the original semantic features from the identifier. Even if the identifier is leaked, attackers struggle to obtain the core information of the topological encoding, fundamentally protecting the semantic basis of the watermark. The binding between the identifier and model features is unique. The GAN reconstruction process relies on the unique semantic features of the topological encoding (such as the model's structural logic and functional characteristics). Different models have different semantic features, resulting in unique identifiers. This uniqueness allows the identifier to serve as a "digital fingerprint" for the model, used for copyright verification. By comparing the identifier, it's possible to quickly determine if the model is genuine, solving the problem of traditional watermarks being easily copied. Semantic obfuscation enhances the watermark's concealment. The identifier's semantics are completely different from the original features, making it difficult for attackers to associate it with the watermark function. Even if they discover the identifier, they may mistakenly consider it irrelevant data and ignore it, reducing the probability of targeted attacks on the watermark. At the same time, the embedding of identifiers does not affect the normal function of the model, thus achieving "invisibility protection".

[0020] The combination of quantum noise compression and chaotic encryption enhances the encryption strength of watermarked information from both physical and mathematical perspectives. Quantum noise compression utilizes the quantum uncertainty principle, giving the compressed obfuscated structure inherent resistance to cracking. Quantum noise cannot be precisely predicted or copied. Compared to traditional compression algorithms (such as Huffman coding), the noise it introduces makes the process of restoring compressed data highly uncertain. Even if an attacker masters the compression algorithm, they cannot eliminate the influence of quantum noise and cannot accurately restore the original obfuscated structure. The high sensitivity of chaotic encryption ensures the irreversibility of the encryption process. Logistic chaotic mapping is extremely sensitive to initial conditions and control parameters; even small differences can lead to completely different encryption results. Dividing the obfuscated structure into grid cells for independent encryption further increases the key space (the initial conditions of each cell can serve as an independent key), making brute-force attacks exponentially more difficult, far exceeding the limits of current computing power. The combination of these two approaches achieves integrated compression and encryption, improving encryption efficiency while enhancing security. Quantum noise compression reduces the amount of data while performing initial encryption, and chaotic encryption performs deep encryption on this basis. The two steps are seamlessly connected, avoiding the efficiency loss of the traditional "compress first and then encrypt" mode, and forming a double encryption barrier, which significantly improves the security of watermark information during transmission and storage. Attached Figure Description

[0021] Figure 1 This is a schematic diagram illustrating the framework principle of the present invention; Figure 2This is a flowchart of the method of the present invention. Detailed Implementation

[0022] The following will clearly and completely describe the technical solutions in the embodiments of the present invention in conjunction with the accompanying drawings. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without making creative efforts are within the scope of protection of the present invention.

[0023] Reference Figure 1 and Figure 2 A watermark generation method based on artificial intelligence includes the following steps: Step a) Extracting the deep feature map of the model to be protected through a neural network, and generating a multi-scale topological coding structure from the deep feature map. This step is the basic feature extraction and encoding stage for watermark generation. The model to be protected is obtained by mining the deep features of the model through a neural network. These features are not the surface parameters of the model, but rather deep abstract information reflecting the structural logic, inter-layer dependencies, and functional characteristics of the model, forming a deep feature map. Compared with traditional feature extraction, the deep feature map can more comprehensively capture the essential attributes of the model, laying the foundation for the deep binding of the watermark to the model. Generating a multi-scale topological coding structure is to transform the deep feature map into operable structured data. Multi-scale refers to the encoding covering different levels of information from microscopic (such as neuron connections) to macroscopic (such as model module interactions); topological coding records the spatial and logical relationships between features in the form of a graph structure (nodes represent feature units, edges represent relationships between units). This encoding method breaks through the limitations of traditional linear encoding, can preserve the complex dependencies between features, and provides a structured foundation for subsequent dynamic path construction.

[0024] Step b) Use the temporal parsing module to segment the topology coding structure to generate a sequence of dynamic execution units, analyze the dependencies between units, and mark control flow decision nodes: The temporal parsing module is a key component connecting static topology coding and dynamic execution logic. It segments the topology coding structure according to the time dimension or execution logic, decomposing the overall structure into a sequence of independently executable dynamic execution units. Each unit corresponds to a subgraph in the topology coding, representing a basic operation unit in the model operation (such as a convolution calculation, an activation function processing, etc.). Analyzing the dependencies between units refers to determining the pre- / post-dependencies (such as the output of unit A being the input of unit B), parallel / serial relationships, etc., between units through data flow analysis, control flow tracing, and other techniques, providing a logical basis for subsequent path construction. "Marking control flow decision nodes" identifies key units in the sequence that determine the branches of the execution path (such as condition judgment nodes and branch selection nodes in the model). These nodes are the core objects of subsequent path obfuscation, and their marking results directly affect the anti-parsing capability of the watermark structure.

[0025] Step c) Construct a non-linear execution path based on the logical hierarchy of decision nodes. This step is the core link to improve the watermark's resistance to reverse analysis. By implementing differentiated obfuscation operations on different types of nodes, a complex non-linear execution path is constructed, making it difficult for attackers to trace the watermark logic. Specifically, it includes four operations: (I) Performing random topological displacement on non-decision units: Non-decision units refer to basic execution units that do not participate in path branches. By randomly adjusting their positions in the topology (such as changing the connection order or translating the node position), the regularity of the structure is broken, increasing the difficulty of parsing; (II) Converting direct decision nodes into multi-level conditional branches: Direct decision nodes refer to nodes that directly output a single decision result. After being converted into multi-level conditional branches, the decision logic is split, and attackers need to crack it layer by layer, increasing the reverse cost; (III) Inserting adversarial noise channels into conditional decision nodes: The decision boundary of conditional decision nodes (such as branch nodes based on threshold judgment) is easily identified by attackers. Inserting adversarial noise channels (such as adding specific noise to the input) can blur the decision boundary, making it difficult for attackers to reverse-engineer the decision logic through input-output mapping; (IV) Embedding virtual nodes when the decision path depth exceeds the threshold: The decision path depth reflects the complexity of branch nesting. When it exceeds the preset threshold (such as 3 layers), virtual nodes are embedded. These nodes do not participate in the actual function execution, but they will consume computing resources or mislead the parsing direction, further disrupting the attacker's judgment of the authenticity of the path.

[0026] Step d) Iteratively optimizes the watermark structure in stages. This step strengthens the anti-parsing capability of the watermark engine through multi-stage iteration, which is a dynamic optimization process. Initial stage (x=0): Generate a basic watermark engine based on the baseline topology coding: When x=0, a watermark engine with basic functions is built based on the multi-scale topology coding generated in step a, determining the initial path structure and node weights. In stage x, a new obfuscation structure is input into the (x-1)th order watermark engine, outputting an anti-parsing path group; after correcting the node weights of the output path group, it is merged into the preceding watermark engine to generate the xth order enhanced watermark engine. During the iteration process, a new obfuscation structure (such as the nonlinear path generated in step c) is introduced in each stage and processed by the preceding engine. After node weight correction (adjusting the execution probability of nodes in the path, deleting error markers, etc.), it is merged to form a more powerful new engine. The rule "1≤x≤N, N≥2" ensures at least two iterations to gradually strengthen the watermark structure.

[0027] Step e) reconstructs the semantic features of the topological coding into irreversible identifiers using a generative adversarial network (GAN). The GAN consists of a generator and a discriminator; here, its adversarial training characteristics are utilized to transform the semantic features of the topological coding (such as the model function and structural meaning represented by the coding) into irreversible identifiers. Irreversibility is reflected in the fact that the identifiers cannot be reverse-engineered back to the original semantic features. Even if an attacker obtains the identifiers, it is difficult to deduce the core information of the topological coding. This reconstruction decouples the core identifier of the watermark from the original features, improving the watermark's concealment.

[0028] Step f) utilizes a graph neural network to fuse the dynamic execution sequence and irreversible identifiers, generating a refractory obfuscated structure. Graph neural networks (GNNs) excel at handling graph-structured data, and here they are used to fuse the dynamic execution sequence (the unit sequence generated in step b, a graph structure) and the irreversible identifiers (generated in step e, which can be used as graph node attributes). During the fusion process, the GNN embeds the semantic information of the identifiers into the topological structure of the dynamic execution sequence through operations such as node aggregation and edge updates, forming an obfuscated structure. This structure retains the logic of dynamic execution while incorporating irreversible identifiers, making it difficult for attackers to distinguish between valid execution paths and obfuscated paths, thus achieving resistance to reverse parsing.

[0029] Step g) After quantum noise compression, the obfuscated structure is chaotically encrypted with the watermark information. Recursive iterations a)-f) generate the final watermark driving engine. Quantum noise compression utilizes the uncertainty principle in quantum mechanics to apply quantum-level noise to the obfuscated structure and compress its data volume, reducing storage overhead and enhancing encryption strength due to the unpredictability of quantum noise. Chaotic encryption uses chaotic systems (such as Logistic mappings) to encrypt the compressed obfuscated structure and watermark information (such as copyright information and owner information). Chaotic systems are extremely sensitive to initial conditions; even small differences can lead to completely different encryption results, ensuring the irreversibility of the encryption process. Recursive iterations a)-f) refer to using the currently generated obfuscated structure as a new model to be protected, repeatedly executing the process a)-f), creating a multi-layered nested recursive logic for the watermark structure. This iteration is not a simple repetition; each iteration introduces a new obfuscation strategy. The final watermark driving engine possesses multi-level anti-parsing capabilities and can be deeply embedded into the model to be protected.

[0030] Step h) Generates deployable model modules through the feature fusion interface. The feature fusion interface is responsible for fusing the watermark-driven engine with the functional modules of the model to be protected, ensuring that the watermark does not affect the normal function of the model, and generating directly deployable modules (such as API interfaces, model files, etc.). The fusion process needs to balance the watermark strength and model performance to avoid a decrease in model accuracy or a reduction in running efficiency due to watermark embedding.

[0031] Step c) involves implementing path obfuscation based on the weight of each decision node. By differentiating the processing of different types of decision nodes, the path obfuscation effect is maximized. Inserting dummy conditional branches and adding random delays to single-path nodes (which are linear execution nodes without branches) can mislead attackers in determining the authenticity of the path. Random delays introduce uncertain time delays during node execution, interfering with attackers' ability to trace the path through timing analysis.

[0032] The direct control node is decomposed into cascading condition judgments. The direct control node is decomposed into multiple condition judgments that are executed sequentially (cascading structure), which fragments the control logic. Attackers need to crack all cascading conditions to master the control flow.

[0033] Gaussian noise is injected into the decision boundary of the conditional branch node. The decision of the conditional branch node depends on the comparison between the input data and the threshold. Injecting Gaussian noise can blur the decision boundary. Even a small change in the input may lead to a large deviation in the decision result, which increases the difficulty for attackers to model and predict.

[0034] Redundant computation channels are inserted into data-dependent nodes, where the output depends on specific input data. Inserting redundant computation channels can mask the true data flow, making it difficult for attackers to distinguish between valid computation and redundant operations.

[0035] When the branch depth exceeds 3 levels, a self-destructing trap node is embedded. A branch depth exceeding 3 levels means that the path complexity is high. When the embedded self-destructing trap node detects reverse parsing behavior (such as abnormal debugging or parameter tampering), it will trigger a self-destruct mechanism (such as deleting critical paths or destroying node weights), making it impossible for attackers to obtain complete watermark information.

[0036] The decision node output is appended with a multidimensional random perturbation tensor. This multidimensional random perturbation tensor is a type of high-dimensional random data. When appended to the output, it interferes with the attacker's interpretation of the output results. Even if the attacker obtains the output, it is difficult to remove the perturbation and restore the true output information.

[0037] By mapping to non-Euclidean space, the continuity of a structure is disrupted. Traditional topologies are based on Euclidean space (such as planes and solids), and their continuity is easily analyzed. However, when mapped to non-Euclidean space (such as spheres and saddles), the distance and angular relationships between nodes are reconstructed, and the structural continuity is broken. Attackers find it difficult to analyze the path logic using conventional geometric analysis methods.

[0038] The number of input obfuscation structures in stage x is greater than the number of inputs in stage (x-1). As the iteration progresses, the number of obfuscation structures (such as nonlinear paths, noise channels, etc.) introduced in each stage increases, which gradually increases the complexity of the watermark engine. The basic structure in the initial stage (x=0) is simple. In subsequent stages, the watermark's anti-parsing ability is continuously strengthened by increasing the number of obfuscation structures.

[0039] The node weight adjustment in stage x is less than that in stage (x-1). Node weights reflect the importance of a node in the path, and the adjustment amount refers to the magnitude of the weight adjustment. The adjustment amount is larger in the initial stage (x=1) to quickly calibrate the basic weights; the adjustment amount decreases in subsequent stages to avoid over-adjustment that could damage the established stable structure and ensure that the watermarking engine maintains functional stability during the enhancement process.

[0040] Adding probability weights to path nodes that are not labeled with weights can make the path execution logic ambiguous. Adding probability weights (such as the probability value of a node being executed) can clarify the execution priority of the path, making the decision logic of the watermarking engine clearer, and at the same time increasing the difficulty for attackers to predict the path.

[0041] Delete node labels with incorrect weights. Incorrect labels (such as weight values ​​that do not match the node's function) can cause abnormal path execution. Deleting incorrect labels can prevent the watermark engine from malfunctioning and ensure the accuracy of iterative optimization.

[0042] Adding random noise channels to low-weight nodes increases their likelihood of being executed, making them easier for attackers to ignore. By adding random noise channels, even if attackers attempt to parse these nodes, they will have difficulty obtaining effective information due to noise interference, thus further improving the overall anti-parsing capability.

[0043] Device fingerprints obtained through biometric identification are unique fingerprints extracted from devices using biometric identification technologies (such as device hardware ID, sensor features, etc.), binding the watermark to the deployed device. If the model is illegally migrated to other devices, the watermark can verify the anomaly through device fingerprint verification and trigger the protection mechanism.

[0044] The quantum random number generator obtains an entropy source sequence, which is an unpredictable random number sequence (entropy source sequence) generated based on the principles of quantum mechanics. This sequence is used as the key for watermark encryption. Compared with traditional pseudo-random numbers, quantum random numbers cannot be predicted or reproduced, which greatly improves the encryption strength.

[0045] The model structure fingerprint generated by topological isomorphism mapping is uniquely generated by comparing the isomorphism between the model's topology and the original structure. If the model is tampered with (such as by structural adjustment or parameter modification), the structure fingerprint will change. The watermark can be used to identify the tampering behavior through fingerprint verification.

[0046] Chaotic encryption is a crucial step in ensuring the security of watermarked information. Step g) involves the following steps: The quantum-compressed confused structure is divided into a [K×K] grid. This grid division is for local encryption, and the [K×K] grid size can be adjusted according to the complexity of the confused structure (e.g., K=8 or 16) to make the encryption process more flexible. A Logistic chaotic mapping is then independently applied to each grid cell, x... n+1 =μx n (1−x n )(μ∈[3.7,4.0])”, the Logistic mapping is a typical chaotic system, where x n The current state value is represented by μ, which is a control parameter (the system is in a completely chaotic state when the value is 3.7-4.0). Each grid cell executes the mapping independently, meaning that the encryption logic of different cells is independent of each other. An attacker who cracks one cell cannot deduce the encryption rules of other cells.

[0047] The watermark information bit sequence is reorganized by sorting the entropy values ​​of the grid cells. The entropy value reflects the degree of chaos of the grid cells (the higher the entropy value, the stronger the randomness). Reorganizing the information bit sequence by sorting the entropy values ​​can further disrupt the original order of the information, making it impossible for attackers to restore the information through the normal order.

[0048] The AI-based watermark generation system includes: a deep feature extraction module responsible for parsing the model to be protected, extracting deep feature maps through neural networks and generating multi-scale topological codes, which is the basic data input module of the system.

[0049] The dynamic path construction module, based on temporal parsing and topological coding, generates a sequence of dynamic execution units, analyzes dependencies and marks decision nodes, and then constructs nonlinear execution paths. It is the core execution module for path obfuscation.

[0050] The iterative optimization control module includes a collection unit (to obtain the path groups output by the preceding engine), a correction unit (to calibrate node weights), and a fusion unit (to merge path groups to generate a new engine), realizing the phased enhancement of the watermarking engine.

[0051] The semantic obfuscation module uses generative adversarial networks to reconstruct the semantic features of topological coding into irreversible identifiers, thereby achieving semantic obfuscation.

[0052] The graph structure fusion module uses a graph neural network to fuse dynamic execution sequences and irreversible identifiers to generate obfuscated structures, thus achieving deep binding between structures and identifiers.

[0053] The driver engine generation module, based on chaotic encryption and recursive iteration, transforms the obfuscated structure into the final watermark driver engine, and is the core output module of the system.

[0054] The quantum compression module is responsible for performing noisy quantum state compression encryption on the confused structure, thereby improving encryption efficiency and security.

[0055] The model encapsulation module integrates the watermark driving engine with the model to be protected, generating a deployable model module to ensure the feasibility of watermarking.

[0056] The hierarchical storage module stores the topology parameters and node weight mapping tables of the watermarking engine at each stage, supporting parameter traceability and reuse during the iterative optimization process. The "hierarchical" designation reflects the correspondence between storage and iteration stages.

[0057] The path weight analysis module marks the path execution probability weight according to the decision node type (single path / multiple branches, data dependency / control dependency), providing a basis for node weight correction and path obfuscation.

[0058] In the hierarchical storage module, the number of topology parameters of the watermarking engine in stage x is greater than that in stage (x-1). As the iteration progresses, the complexity of the watermarking engine increases, and the number of topology parameters (such as the number of nodes, the connection relationship of edges, etc.) increases. The hierarchical storage needs to adapt to this growth to ensure the complete preservation of parameters in each stage.

[0059] The path weight analysis module assigns an execution weight of less than 0.3 to decision paths with a depth greater than 3. Decision paths with a depth greater than 3 have high complexity, but their actual execution probability needs to be reduced (weight < 0.3) in order to balance the path confusion effect and the model's running efficiency. If high-complexity paths are executed frequently, it will increase the model's computational overhead and reduce the running speed.

[0060] Irreversible identifiers include category labels for normal structure nodes and clustering labels for scrambled structure nodes. Category labels are used to distinguish the functional type of normal nodes (such as convolutional nodes and activation nodes), while clustering labels reflect the connection density of scrambled structure nodes. The combination of the two enables the identifier to comprehensively describe the node attributes and enhances the uniqueness of the identifier.

[0061] Clustering labels are categorized into isolated nodes (≤2 connections) and clustered nodes (≥5 connections) based on node connection density. Connection density reflects the importance of a node in the topology. Isolated nodes have fewer connections and a smaller impact range, while clustered nodes have more connections and are the core of the structure. This classification provides a basis for differentiated noise strategies.

[0062] The noise intensity of adding random topological displacement to isolated nodes is 30%-50% higher than that of clustered nodes. Isolated nodes are easily parsed by attackers, requiring higher intensity noise (such as larger displacement amplitude) to mask their position information. Clustered nodes, due to their dense connections, have stronger anti-parsing capabilities, and lower noise is sufficient to meet the requirements.

[0063] The adversarial noise channel insertion density of cluster nodes is twice that of isolated nodes. As the core of the structure, cluster nodes are the main target of attackers and need to have more adversarial noise channels inserted (density doubled) to blur their decision boundaries and enhance the anti-analysis resistance of the core structure.

[0064] The iterative optimization control module includes a trap node activation unit. When reverse parsing is detected, a self-destruct protocol is triggered. The trap node activation unit is responsible for monitoring the running status of the model in real time (such as whether it is being debugged or whether the parameters have been tampered with). Once reverse parsing behavior is identified, the self-destruct protocol is activated immediately, which is the watermark's proactive defense mechanism.

[0065] The self-destruct protocol's specific operations include: deleting the critical path weight mapping table, which is the core basis for watermark path execution; after deletion, the watermark engine cannot function properly, and attackers cannot obtain the complete path logic; injecting high-amplitude noise into conditional branch nodes, which completely destroys the decision logic of conditional branch nodes, causing path execution to become chaotic; and redirecting the control flow to the virtual node cluster, causing the attacker's parsing process to stop at invalid nodes and unable to access the core watermark information.

[0066] The specific implementation is as follows: Step a: Extract deep feature maps and generate multi-scale topological coding structures: Model selection for protection: The ResNet-50 deep learning model is selected as the object to be protected. This model contains a 50-layer network structure with complex inter-layer dependencies, making it suitable for verifying the watermark's resistance to parsing.

[0067] Deep feature extraction: A pre-trained Vision Transformer (ViT) is used as the feature extraction neural network. The parameters of each layer of ResNet-50 (such as convolutional kernel weights, batch normalization parameters, etc.) are input. The deep dependencies between layers and neurons are mined through the self-attention mechanism of ViT. The output is a deep feature map with a dimension of (1024×1024). Each element in the map represents the correlation strength between two feature units.

[0068] Multi-scale topological coding generation: Based on deep feature maps, multi-scale coding is generated using topological data analysis (TDA) methods. Microscale (1×10^3 nodes): Encodes neuron-level connections, where nodes represent neurons and the weights of edges are the normalized values ​​(0-1) of the corresponding elements in the feature map. Mesoscale (1×10^2 nodes): Encodes the hierarchical connections of the network. Nodes represent modules such as convolutional layers and pooling layers in ResNet-50, and the weights of the edges are normalized values ​​of the data transfer between modules. Macro scale (1×10 nodes): The overall functional module relationship of the coding model. Nodes represent functional units such as feature extraction and classification, and the weight of the edges is the functional dependency.

[0069] Step b: Segment topology encoding to generate a sequence of dynamic execution units and label decision nodes: Temporal parsing module configuration: An LSTM-based temporal parsing model is used. It takes multi-scale topologically encoded graph structure data as input and outputs a sequence of dynamically executed units. The hidden layer dimension of the LSTM is set to 512, and a gating mechanism is used to capture temporal dependencies in the encoding.

[0070] Dynamic execution unit segmentation: Topology coding is segmented according to the principle of "functional integrity". Microscale: A cluster of continuously connected neurons (with ≥5 connections) is divided into an execution unit; Mesoscale: Divide consecutive network layers (such as Conv2d→BN→ReLU) into one execution unit; Macro-scale: Functional units with a correlation degree ≥ 0.7 are divided into one execution unit. The final result is a dynamic execution unit sequence containing 200 units.

[0071] Dependency analysis and decision node labeling: Data flow analysis algorithms (such as LLVM's DataFlowAnalysis) are used to analyze the input-output dependencies between units, generating a dependency matrix (200×200). Matrix element (i,j) = 1 indicates that unit i depends on unit j. Decision nodes are marked based on control flow analysis: When the unit output contains conditional judgments (such as "if feature value > threshold then execute A else execute B"), it is marked as a control flow decision node, and a total of 30 decision nodes are marked.

[0072] Step c: Construct a non-linear execution path: Based on the logical hierarchy of 30 decision nodes (the hierarchy weights are calculated using the PageRank algorithm, with higher weights indicating more core nodes), the following operations are performed: Non-decision unit processing: Random topological displacement is performed on 170 non-decision units, with the displacement range being ±5 node positions (based on the shortest path distance of the graph structure). The displacement probability is inversely distributed according to the importance of the nodes (nodes with lower importance have a higher displacement probability).

[0073] Direct decision node processing: Select 10 direct decision nodes (hierarchical weight 0.6-0.8) and convert them into multi-level conditional branches: The original node logic "if x>5 then y=1" is transformed into "if x>3 then if x>5 then y=1 elsey=0.5"; Add a random delay (0.1-0.5ms) to each branch, with the delay value following a normal distribution N (0.3, 0.1).

[0074] Conditional decision node processing: Select 15 conditional branch nodes (hierarchical weight 0.4-0.6), inject Gaussian noise (mean 0, variance 0.1) to interfere with the decision boundary. The noise is added to the node input layer and superimposed on the original input data before entering the decision logic.

[0075] Path depth control: When the branch depth exceeds 3 levels (determined by recursively traversing the path tree), embed virtual nodes (the number of which is 20% of the current path node count). The connection weight of the virtual nodes is set to 0.01 (far lower than the weight of the effective node, 0.5-1), which does not affect the actual execution result.

[0076] Additional obfuscation operations: Redundant computation channels (such as additional matrix multiplication operations, the results of which are not included in the final output) are inserted for the 10 data-dependent nodes. A 32-dimensional random perturbation tensor (with element values ​​following a uniform distribution U(-0.1, 0.1)) is appended to the output of all decision nodes. By transforming the graph structure through spherical mapping (non-Euclidean space), the node coordinates are converted from Cartesian coordinates to spherical coordinates (θ,φ,r), thus disrupting the continuity of the structure.

[0077] Step d: Iteratively optimize the watermark structure in stages: Set the number of iterations N=3 (x=1,2,3) and optimize in stages: Initial stage (x=0): Generate a basic watermark engine based on the baseline topology coding, which contains 100 initial path nodes. The node weights are initialized using the random forest algorithm (with values ​​ranging from 0.1 to 0.9).

[0078] Phase 1 (x=1): The number of input confusion structures = 50 (more than 0 in the x=0 stage), which are the non-linear path segments generated in step c; Input a basic watermarking engine (x=0), output a parsing-resistant path group (containing 80 paths); Node weight correction: Complete the probability weights of 20 unlabeled weight nodes (based on path execution frequency estimation), delete the labels of 5 incorrectly labeled nodes, and add random noise channels (noise intensity 0.05) to 10 low-weight nodes (weight < 0.2). Merge the path group with the base engine to generate the first-order enhanced watermarking engine (150 nodes).

[0079] Phase 2 (x=2): Number of input obfuscated structures = 80 (more than 50 in stage x=1); Input a first-order engine and output a path group (120 paths). The node weight adjustment amount is 0.05 (less than 0.1 in the x=1 stage), and the adjustment method is the same as that for x=1; Generate a second-order engine (200 nodes).

[0080] Phase 3 (x=3): Number of input obfuscated structures = 100 (more than 80 in stage x=2); Input the second-order engine and output a path group (150 paths); Node weight adjustment = 0.03 (less than 0.05 in the x=2 stage); Generate a third-level enhanced watermarking engine (250 nodes).

[0081] Step e: Generate irreversible identifiers: Generative Adversarial Network (GAN) configuration: The generator adopts the DCGAN architecture (input dimension 128, output dimension 256), and the discriminator adopts a 3-layer fully connected network (hidden layer dimension 512). Input the semantic features of the multi-scale topological encoding (functional labels, structural entropy, etc. extracted from the encoding), and train the GAN for 100 rounds (batch size=32, learning rate 0.0002). The generator outputs a 256-dimensional irreversible identifier, and its nonlinear mapping relationship with the original semantic features is verified by t-SNE dimensionality reduction (the distributions do not overlap after dimensionality reduction).

[0082] Step f: Fuse dynamic execution sequences and identifiers to generate an obfuscated structure: The Graph Neural Network (GNN) selects the GraphSAGE model, taking as input a sequence of dynamic execution units (graph structure) and irreversible identifiers (as node attributes). The GNN uses mean aggregation as its aggregation function, has a hidden layer dimension of 256, and generates a confused graph representation through softmax activation in the output layer. The obfuscated structure contains 250 nodes, of which 100 come from dynamic execution sequences and 150 are virtual nodes generated by GAN (constructed based on identifier features).

[0083] Step g: Chaotic encryption and recursive iterative watermark generation engine: Quantum noise compression: A quantum random number generator (output entropy rate ≥ 1 bit / bit) is used to apply noise to the confused structure, and the compression rate is set to 0.8 (retaining 80% of the core information); Chaotic Encryption: The compressed obfuscated structure is divided into an 8×8 grid (K=8); Each grid cell performs a Logistic mapping: x n+1 =3.9x n (1−x n The initial value x0 is the hash value of the grid cell (the first 8 bits of the SHA-256 digest); Sort the watermark information bits in descending order according to the grid cell entropy value (calculated by Shannon entropy); Recursive iteration: The encrypted obfuscated structure is used as a new "model to be protected". Steps a)-f) are repeated (iterate 2 times) to finally generate the watermark driving engine (containing 500 nodes, and the path complexity is 3 times higher than the initial one).

[0084] Step h: Generate deployable model modules: The feature fusion interface adopts the TensorRT plugin interface to fuse the watermarking engine with the feature extraction layer of the ResNet-50 model (the fusion point is set after the 30th convolution layer). The generated deployable module includes three channels: Device fingerprint: A 256-bit hash value generated from the device's CPU ID and MAC address; Entropy source sequence: A 1024-bit random sequence output by a quantum random number generator; Structural fingerprint: Topological isomorphic mapping value between ResNet-50 and the watermarking engine (calculated via graph editing distance); The module output format is ONNX. Tests showed that the model accuracy decreased by ≤1% and the inference latency increased by ≤5%, meeting the deployment requirements.

[0085] The above description is only a part of the embodiments of this application and does not limit the patent scope of this application. All equivalent structural transformations made under the technical concept of this application and using the contents of the specification and drawings of this application, or direct / indirect applications in other related technical fields, are included in the patent protection scope of this application.

Claims

1. A watermark generation method based on artificial intelligence, characterized in that, Includes the following steps: a) Extract the deep feature map of the model to be protected through a neural network, and generate a multi-scale topological coding structure from the deep feature map; b) Use the timing parsing module to segment the topology coding structure to generate a dynamic execution unit sequence, analyze the dependencies between units, and mark the control flow decision nodes; c) Construct a nonlinear execution path based on the logical hierarchy of decision nodes, including: performing random topological displacement I on non-decision units; converting direct decision nodes into multi-level conditional branches II; inserting adversarial noise channels III into conditional decision nodes; and embedding virtual nodes IV when the decision path depth exceeds the threshold. d) Iterative optimization of the watermark structure in stages, including: the initial stage (x=0) generates a basic watermark engine based on the baseline topology coding; in the xth stage, a new obfuscation structure is input into the (x-1)th order watermark engine, and the output anti-parsing path group is output; after the node weight is corrected, the output path group is merged into the previous watermark engine to generate the xth order enhanced watermark engine, where 1≤x≤N, N≥2. e) Reconstructing topologically encoded semantic features into irreversible identifiers using generative adversarial networks; f) Utilize graph neural networks to fuse dynamic execution sequences with irreversible identifiers to generate obfuscated structures resistant to reverse parsing; g) After quantum noise compression, the confused structure is chaotically encrypted with the watermark information, and the recursive iterative steps a)-f) generate the final watermark driving engine. h) Generate deployable model modules through the feature fusion interface.

2. The watermark generation method based on artificial intelligence according to claim 1, characterized in that, In step c): Path obfuscation is implemented according to the decision node weights, including... Insert dummy conditional branches and add random delays to single-path nodes; Decompose the direct control node into cascaded condition judgments; Inject Gaussian noise into the decision boundary of the conditional branch nodes; Insert redundant computing channels for data-dependent nodes; When the branch depth exceeds 3 levels, a self-destructing trap node is embedded. A multidimensional random perturbation tensor is added to the output of the decision node; Structural continuity is disrupted by non-Euclidean space mapping.

3. The watermark generation method based on artificial intelligence according to claim 1, characterized in that, Step d) involves phased iterative optimization, including: The number of input obfuscated structures in stage x is greater than the number of inputs in stage (x-1); The node weight adjustment in stage x is less than the adjustment in stage (x-1).

4. The watermark generation method based on artificial intelligence according to claim 1, characterized in that, Step d) includes node weight correction, which includes: Complete the probability weights for path nodes without labeled weights; Delete the node labels with incorrectly marked weights; Add random noise channels to low-weight nodes.

5. The watermark generation method based on artificial intelligence according to claim 1, characterized in that, The deployable module generated in step h) contains three channels: Device fingerprints obtained through biometric identification; The sequence of entropy sources obtained by a quantum random number generator; Model structure fingerprint generated by topological isomorphism mapping.

6. The artificial intelligence-based watermark generation system according to claim 1, characterized in that, The chaotic encryption in step g) includes: The quantum-compressed confused structure is divided into a [K×K] grid; Implement the Logistic chaotic mapping independently for each grid cell: x n+1 =μx n (1−x n )(μ∈[3.7,4.0]); The watermark information bit sequence is reorganized by sorting the grid cell entropy values.

7. An artificial intelligence-based watermark generation system, characterized in that, include: The deep feature extraction module is used to parse the target model and generate multi-scale topological codes; The dynamic path building module is used to generate anti-parsing execution units based on spatiotemporal dependencies; The iterative optimization control module is used to perform phased watermarking engine enhancements, including: The collection unit is used to obtain the path group output by the (x-1)th stage engine through the x-th stage confusion structure; The correction unit is used to calibrate the node weights of the output path group. The fusion unit is used to combine the calibrated paths into the preceding engine to generate the xth-order enhancement engine; The semantic obfuscation module is used to reconstruct irreversible identifiers by generating an adversarial network; The graph structure fusion module is used to assemble dynamic execution sequences using graph neural networks; The engine generation module is used to build a watermarking engine based on chaotic encryption recursion. A quantum compression module for implementing noisy quantum state compression encryption; The model encapsulation module is used to generate deployable watermarked modules; A hierarchical storage module is used to store the topology parameters and node weight mapping tables of the watermarking engine at each stage. The path weight analysis module is used to label the path execution probability weight according to the decision node type.

8. The artificial intelligence-based watermark generation system according to claim 6, characterized in that, The number of topology parameters of the watermarking engine in stage x of the hierarchical storage module is greater than that in stage (x-1); The path weight analysis module assigns an execution weight of less than 0.3 to decision paths with a depth greater than 3 layers.

9. The artificial intelligence-based watermark generation system according to claim 6, characterized in that, The irreversible identifier includes a category label for normal structure nodes and a clustering label for confused structure nodes; the clustering label is divided into isolated nodes and clustered nodes according to the node connection density.

10. The artificial intelligence-based watermark generation system according to claim 8, characterized in that, The noise intensity of adding random topological displacement to isolated nodes is 30%-50% higher than that of clustered nodes; the adversarial noise channel insertion density of clustered nodes is twice that of isolated nodes.

Images