Deep learning model hash identification method and device based on multi-feature fusion

Abstract

A deep learning model Hash identification method based on multi-feature fusion comprises the following steps: firstly, extracting structural features (layer type sorting de-duplication), parameter statistical features (quantile normalization and histogram statistics) and functional behavior features (middle layer output quantiles) of a deep learning model; then, model structure hash, parameter hash and function hash are calculated respectively; thirdly, generating a comprehensive hash value by fusing triple hash; meanwhile, a TLSH (Trend Micro Location-Sensitive Hashing) algorithm is adopted, so that the tolerance of the TLSH algorithm to the tiny fluctuation of the parameters is improved; and finally, based on Hamming distance, calculating model similarity, and realizing efficient black box model traceability and infringement detection. The method does not need to modify a model structure or parameters, does not depend on external data, supports high robustness to attacks such as pruning and fine tuning, and is suitable for various network architectures such as CNN and Transform. The method has the advantages of lightweight calculation, high concealment and cross-platform adaptation capability, and can be widely applied to intellectual property protection and infringement tracking scenes of a deep learning model.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of deep learning model protection and identification, in particular to a deep learning model hash identification method and device based on multi-feature fusion, belongs to the field of model fingerprint identification, intellectual property protection and model traceability, and specifically relates to the comprehensive application of model structure topology extraction, parameter statistical feature coding, reasoning behavior feature capture and multi-source hash fusion technology. BACKGROUND

[0002] With the rapid development of deep learning technology, deep neural network models have shown outstanding application value in the field of artificial intelligence, especially in image analysis, visual perception and natural language processing. International technology companies such as Microsoft, Google and Baidu have integrated deep neural network architecture into their commercial products to improve the intelligence level of services and user experience. However, building a high-performance deep learning model requires overcoming multiple technical barriers: not only does it require massive labeled data support and high-intensity computing resources, but it also relies on complex network structure design and optimization strategy formulation, which has a much higher research and development cost than ordinary developers can afford. Such high-value models are easy targets for malicious attackers due to their significant commercial potential - by reverse engineering through API interfaces to steal model parameters or illegally obtaining model architecture for tampering and copying, making model intellectual property protection a key issue to be addressed.

[0003] In existing technical solutions, model watermarking technology embeds specific identification information into model parameters to achieve copyright protection, but research shows that such methods often have a noticeable negative impact on model inference performance. In high-precision demand areas such as medical diagnosis and financial risk control, even a small decrease in accuracy can have serious consequences. Therefore, the academic community has proposed a new model fingerprint identification technology, the core idea of which is to extract model inherent features rather than directly modify model parameters to achieve copyright verification. Specifically, this method selects key samples based on the classification decision boundary of the target model, and constructs a feature fingerprint sample set specific to the model using adversarial generation technology. Model owners can input these feature samples into the suspicious model and compare their output labels with the prediction results of the original model to determine whether there has been an infringement. This process does not require remote access to model internal parameters and only relies on the prediction response of the API interface to complete verification, significantly improving the practicality of the technical solution.

[0004] Although the existing model fingerprint identification method based on classification boundary achieves model intellectual property protection. However, the existing model fingerprint technology still faces many challenges in practical application.

[0005] The existing model fingerprint technology has the following problems:

[0006] 1. The OpenReview 2022 paper "Neural Fingerprinting: Detecting Adversarial Examples via Model-Specific Perturbations" relies on adversarial examples to generate fingerprint samples with low concealment and unnaturalness, making them easy to be detected by defense mechanisms. At the same time, the computational efficiency is low, making it difficult to meet the needs of actual deployment.

[0007] 2. The paper "IPGuard: Protecting Intellectual Property of Deep Neural Networks via Fingerprinting the Classification Boundary" from ACM Asia CCS2021 uses data points near the decision boundary as fingerprints. However, this method is not robust enough against model theft attacks (such as pruning, quantization, and fine-tuning). Small perturbations in parameters or structure can easily cause fingerprints to fail, making it unable to effectively cope with diverse model tampering methods. Summary of the Invention

[0008] This invention addresses the problems of existing fingerprinting methods based on classification boundaries or adversarial examples, which require generating special samples (such as adversarial examples). These samples are unnatural, easily detected by defense mechanisms, have poor concealment, and require excessive computation time. The invention provides a deep learning model hashing identification method and apparatus that is highly robust and computationally lightweight in the face of model attacks (such as fine-tuning, pruning, quantization, etc.) under black-box conditions.

[0009] To achieve the above objectives, the present invention provides the following technical solution:

[0010] The method of the present invention includes: 1. calculating the hash value of the source model structure; 2. calculating the TLSH value of the source model parameters; 3. calculating the TLSH value of the source model functional features; 4. merging the above three hash values ​​to generate the final comprehensive hash value; 5. calculating the comprehensive hash value of the suspicious model according to the above steps 1-4; 6. calculating the similarity between the source model and the suspicious model.

[0011] To achieve the above objectives, this invention proposes a hash identification method based on multi-feature fusion in a deep learning model, the specific steps of which are as follows:

[0012] Step 1: Calculate the source model structure hash;

[0013] A directed graph is constructed using the structural information of the PyTorch model itself, and structural features are extracted by traversing all leaf nodes and inter-layer connection relationships in the model. To improve the robustness of pruning, this scheme does not directly use detailed information such as the in-degree and out-degree of nodes, but only records the type of each layer (such as Conv2d, Linear, etc.), then generates a unified string after removing duplicates and sorting all layer types, and finally calculates the graph structure hash using the MD5 hash algorithm. The flowchart is as follows Figure 1 , and the specific steps are as follows:

[0014] Step 1.1, model static conversion;

[0015] Convert the dynamic model into a static directed acyclic graph (DAG), denoted as G static . The graph is composed of nodes and connecting edges, where the nodes represent the calculation layers in the model, and the edges represent the data flow direction.

[0016] Step 1.2, filter leaf nodes;

[0017] Traverse all nodes in the static graph G static , and filter the leaf nodes that meet the following conditions:

[0018]

[0019] Record the layer type of each leaf node (such as convolutional layer, fully connected layer, etc.), forming a layer type set T = {t1, t2,..., t n}, where t i represents the type of the i-th node.

[0020] Step 1.3, layer type deduplication and sorting;

[0021] Perform a deduplication operation on the set T to obtain a unique type set:

[0022]

[0023] Further sort T unique in lexicographical order to generate an ordered type sequence:

[0024] T sorted = Sort(T unique ) (3)

[0025] Step 1.4, generate feature string;

[0026] Concatenate the sorted type sequence into a unique feature string:

[0027] S = concat(t1, t2,..., t m) (4)

[0028] where concat denotes the string concatenation operation, and m is the number of types after deduplication.

[0029] Step 1.5, calculate the hash value;

[0030] H graph = GRAPHMD5(S) (5)

[0031] In summary, by the above five steps, the embodiment realizes the extraction of the topological structure information of the model and the hash calculation. In the structured pruning process, if only part of the leaf nodes are deleted, the corresponding layer type set can still be basically consistent, thereby making it have higher robustness.

[0032] Step 2, calculate the TLSH value of the source model parameter hash;

[0033] This step aims to generate a hash value with fault tolerance by extracting the core statistical features of the model parameter distribution, and the flow chart is as follows Figure 2 , and the specific steps are as follows:

[0034] Step 2.1, filter valid parameters;

[0035] All trainable parameters of the model are traversed, and a parameter set satisfying the following conditions is selected:

[0036] P={p l |p l is an updatable parameter and is not frozen}(l=1,2,...,m)(6)

[0037] where pl denotes the parameter tensor of the lth layer, and m is the total number of layers.

[0038] Step 2.2, extract non-zero parameters;

[0039] For each layer parameter pl, filter the zero value elements to obtain a non-zero parameter vector:

[0040]

[0041] Step 2.3, parameter normalization;

[0042] The quantile normalization method is adopted to map the non-zero parameters to the interval [0, 1]:

[0043]

[0044] If , the normalization result is a zero vector.

[0045] Step 2.4, construct a parameter histogram;

[0046] Divide the normalized parameters into B=10 equal-width bins, count the number of parameters in each bin, and generate histogram features:

[0047]

[0048] where I(·) is the indicator function, is the number of non-zero parameters.

[0049] Step 2.5. Calculate statistics;

[0050] Calculate the distribution features of parameters in each layer:

[0051] 1. Non-zero proportion:

[0052]

[0053] 2. Mean and median:

[0054]

[0055] Step 2.6. Encode layer features;

[0056] Generate a feature string for each layer in the following format:

[0057]

[0058] where Name l is the layer name, and the numerical values are rounded to the specified decimal places;

[0059] Step 2.7. Concatenate the global feature string and generate a hash;

[0060] 1. Sorting and concatenation: Sort {Sl} in lexicographical order by layer name, and generate a global feature string:

[0061] S global = concat(S1,S2,...,S m ) (13)

[0062] 2. Hash calculation: Apply the TLSH algorithm to generate a 72-bit hash value:

[0063] H param = TLSH(S global ) (14)

[0064] The TLSH algorithm is sensitive to parameter distribution features, allowing for small fluctuations in parameters (such as gradient updates). The generated hash value can effectively capture the core features of the model parameter distribution, making it suitable for model provenance and similarity analysis.

[0065] Step 3. Calculate the TLSH value of the source model's functional features;

[0066] This step aims to generate hash values representing the functional characteristics of the model by extracting statistical features of the intermediate layer output of the model. The flowchart is as follows Figure 3 , and the specific steps are as follows:

[0067] Step 3.1, intermediate layer output capture;

[0068] Through the forward propagation process of the model, the intermediate layer features are extracted in the convolutional layer and linear layer modules. Let N be the total number of target layers in the model, and the output of the kth layer be O k , where k = 1, 2,..., N. This process will automatically record the forward propagation output results of each target layer as feature representation.

[0069] Step 3.2, execute forward inference;

[0070] Define the random input tensor as:

[0071]

[0072] where H and W are the height and width of the image, respectively. Input X input into the model to obtain the output set {O1, O2,..., ON} of each target layer. N

[0073] Step 3.3, output normalization;

[0074]

[0075] where μ k and σ k are the mean and standard deviation of the kth layer output, respectively.

[0076] Step 3.4, extract quantile features;

[0077] Calculate the quantile set Q = {0.1, 0.5, 0.9} for the normalized output to generate the feature vector:

[0078]

[0079] where Q k represents the α quantile value of the kth layer output.

[0080] Step 3.5, concatenate feature string;

[0081] Concatenate the quantile features of each layer in order to form the global feature string:

[0082] S = concat (Q1, Q2,..., Q N ) (18) ​

[0083] where each layer feature format is Layer k :

[0084] Step 3.6, generating function hash;

[0085] The feature string S is encoded using the TLSH hash algorithm to generate a unique hash value:

[0086] H func = TLSH(S) (19)

[0087] Step 4, calculating the source model comprehensive hash value;

[0088] Step 4.1, calculating the graph structure hash;

[0089] Step 4.2, calculating the parameter statistics hash;

[0090] Step 4.3, calculating the function output hash;

[0091] Step 4.4, splicing the triple output final hash:

[0092] torchmd5sum = concat(H graph , H param , H func ) (20)

[0093] Step 5, calculating the suspicious model hash value;

[0094] Step 5.1, calculating the hash value generated after fine-tuning the source model;

[0095] Step 5.2, calculating the hash value generated after unstructured pruning of the source model;

[0096] Step 5.3, calculating the hash value generated after structured pruning of the source model;

[0097] Step 5.4, calculating the hash value generated after quantization of the source model;

[0098] Step 6, calculating the similarity between the source model and the suspicious model;

[0099] For the two generated complete hash strings, the Hamming distance is used to measure the similarity of the two model fingerprints:

[0100] where L is the length of the hash string.

[0101] The second aspect of the present application relates to a multi-feature fusion-based deep learning model hash identification device, comprising a memory and a processor, characterized in that the memory is used to store a program supporting the processor to execute the above-mentioned calculation method, and the processor is configured to implement a multi-feature fusion-based deep learning model hash identification method of the present application.

[0102] The third aspect of the present application relates to a computer-readable storage medium, wherein the computer-readable storage medium stores a computer program, and the computer program is run by a processor to implement a multi-feature fusion-based deep learning model hash identification method of the present application.

[0103] The key points of the present application include:

[0104] 1. The present application integrates the model structure (layer type ordering de-duplication), parameter distribution (quantile normalization and histogram statistics) and functional output (intermediate layer quantile point features) triplets, and improves the stability of hash identification through feature complementation. Structural hash weakens the interference of pruning, parameter hash tolerates slight disturbance, functional hash ensures functional consistency, and together prevents model stealing attacks such as fine-tuning, pruning and quantization.

[0105] 2. The present application only relies on the static features (structure, parameters, inference output) of the model itself, does not require external data or model modification, is suitable for mainstream architectures such as CNN and Transformer, and supports fast implementation under black-box conditions.

[0106] The protection points of the present application include:

[0107] 1. The model structure, parameter statistics and functional behavior triplets are fused to generate a comprehensive hash value, which is used for model tracing and similarity analysis.

[0108] 2. The TLSH (Trend Micro Locality-Sensitive Hashing) algorithm is sensitive to parameter distribution features, allowing small fluctuations in parameters (such as gradient updates), and the generated hash value can effectively capture the core features of the model parameter distribution.

[0109] The technical scheme of the present application has the following advantages:

[0110] 1.The prior art solution has obvious deficiencies in protecting the intellectual property rights of deep learning models, mainly manifested in poor robustness to model attacks, and the generated fingerprint samples are unnatural and have low concealment, which are easy to be detected. In addition, the fingerprint method based on classification boundary or adversarial samples has a long calculation time and low efficiency. The present application proposes a multi-feature fusion deep learning model hash identification method, which generates a high-robustness and lightweight comprehensive hash value by fusing model structure, parameters and functional features, effectively solving the deficiencies of the prior art solution and improving the efficiency and reliability of model protection.

[0111] 2.The present application proposes a hash fingerprint extraction mechanism based on model structure, parameter statistics and functional behavior triplets, which can effectively distinguish models with different architectures or significant adjustments, and is robust to common model compression and optimization operations such as pruning, quantization and fine-tuning, avoiding the problem that traditional methods are too sensitive to slight parameter perturbations.

[0112] 3.The method of the present application only relies on the model itself (does not rely on training data or labels), does not change the model structure or parameters, and does not require model retraining, so it is easy to implement in actual deployment.

[0113] 4.The present application has universality and is suitable for different architectures such as convolutional neural networks (CNN), transformer networks (Transformer) and sequence models (such as RNN / LSTM), and has cross-domain adaptation capability. BRIEF DESCRIPTION OF DRAWINGS

[0114] In order to more clearly illustrate the technical scheme of the present application "a multi-feature fusion deep learning model hash identification method", the following briefly introduces the drawings involved in the implementation process. It should be understood that the following drawings only show some embodiments of the present application, and do not limit the protection scope of the present application. For those skilled in the art, other related drawings can be derived from these drawings without creative labor.

[0115] Figure 1 is a model structure diagram hash generation flowchart.

[0116] Figure 2 is a parameter statistics hash flowchart.

[0117] Figure 3 is a functional feature hash flowchart.

[0118] Figure 4 is a comprehensive hash identification overall flowchart.

[0119] Figure 5 is a device diagram of the present application. DETAILED DESCRIPTION

[0120] The technical solutions will be described in detail and clearly in combination with the drawings in the embodiments of the present application. It should be noted that the described embodiments are only a part of the present application, and do not represent all embodiments. The various components and their configuration modes shown in the drawings can be arranged and designed differently according to actual needs, and have certain flexibility and variability.

[0121] Embodiment 1

[0122] Reference Figures 1-4 This embodiment introduces a lung CT image intelligent diagnosis system based on ResNet-18 optimization in a certain third-class hospital, which is used for rapid screening of lung cancer lesions. The system extracts the tumor features in the CT image to assist the doctor in judging the patient's disease development stage. In order to prevent competitors from stealing model core parameters through API interface or copying the system through fine-tuning, this paper demonstrates how to generate model hash identification code and compare its similarity with the variant model hash identification code after various model stealing attacks (pruning, fine-tuning, quantization) on ResNet-18.

[0123] The lung CT image intelligent diagnosis system model stealing network attack protection method based on the deep learning model hash identification method based on multi-feature fusion of the application comprises the following steps:

[0124] Step 1, calculate the source model graph structure hash;

[0125] Reference Figure 1 As shown, load the pre-trained ResNet-18 model; call torch.jit.trace to convert it into a static DAG. Traverse the DAG leaf node, extract the operator type set {Conv2d, BatchNorm2d, ReLU, …, Linear}; after deduplication and lexicographic sorting, concatenate into a string and calculate H1 through SimHash.

[0126] Step 2, calculate the source model parameter hash;

[0127] Reference Figure 2 As shown, traverse all trainable parameter tensors of the Resnet-18 model, calculate the non-zero proportion, mean, standard deviation, maximum / minimum value of each layer, concatenate the feature string by layer name, and input the TLSH algorithm to obtain H2.

[0128] Step 3, calculate the source model function hash;

[0129] Reference Figure 3 As shown, register the forward hook in each convolution block and the last fully connected layer, use random or validation set images for forward inference, capture the intermediate output, and do mean pooling and quantile statistics on each output, then concatenate and generate H3 through TLSH.

[0130] Step 4, calculate the source model comprehensive hash;

[0131] Reference Figure 4 As shown, H1, H2, H3 are spliced in order to form the comprehensive hash identifier H of ResNet-18.

[0132] Step 5, calculate the model hash string after model stealing attack;

[0133] For the original ResNet-18, four common model stealing variants are constructed respectively:

[0134] Step 5.1, generate hash string after fine-tuning model;

[0135] Using the SGD optimizer to fine-tune all layers of the original model (ResNet-18), repeat steps 1-4 to calculate its hash string HASH_F.

[0136] Step 5.2, generate hash string after unstructured pruning model;

[0137] According to the activation value of neurons, unimportant neurons are pruned to prune the original model (ResNet-18), repeat steps 1-4 to calculate its hash string HASH_UP.

[0138] Step 5.3, generate hash string after structured pruning model;

[0139] Prune all layers of neurons to structure the original model (ResNet-18) to prune, repeat steps 1-4 to calculate its hash string HASH_P.

[0140] Step 5.4, generate hash string after quantization model;

[0141] Quantize all layers of the original model (ResNet-18) through quantization-aware training, repeat steps 1-4 to calculate its hash string HASH_Q.

[0142] Step 6, compare the similarity of hash values;

[0143] Use the Hamming distance to measure the similarity of the fingerprints of the two models. If the similarity is greater than 75%, the suspicious model is determined to be a stolen model. The experimental results are shown in Table 1, which is the similarity of ResNet-18 and various variant models.

[0144] Table 1

[0145]

[0146] Step 7, lung CT image intelligent diagnosis system model deployment and real-time protection.

[0147] After verification by hash similarity, the trained ResNet-18 model is deployed in the intelligent diagnosis system of lung CT images. Before each model inference, the comprehensive hash value of the current model is automatically calculated and compared with the original hash value online. If the Hamming distance exceeds the threshold of 75%, a security alarm is triggered and the diagnosis system is locked; when an authorized model update package is received, the new model is first verified by hash, and after passing, the old model is replaced and the comprehensive hash value is recalculated to ensure the controllability of intellectual property rights in the model iteration process.

[0148] Embodiment 2

[0149] Reference Figures 1-4 , this embodiment introduces a professional medical database based on GPT-3 model optimization in a certain third-level hospital. Taking GPT-3 providing evidence-based medical diagnosis and treatment suggestions as an example, this embodiment demonstrates how to generate a hash identification code of a large language model (LLM) and compare it with the hash identification codes of variant models after various model theft attacks (pruning, fine-tuning, quantization) on GPT-3.

[0150] The medical database model theft network attack protection method based on the deep learning model hash identification method based on multi-feature fusion of the application comprises the following steps:

[0151] Step 1, calculate the source model graph structure hash;

[0152] Reference Figure 1 As shown, load the pre-trained GPT-3 model; call torch.jit.trace to convert it to a static DAG. Traverse the DAG leaf nodes, extract the key layer type set {SelfAttention, LayerNorm, FeedForward, …, Embedding}; after deduplication and lexicographic sorting, concatenate the string and calculate H1 by SimHash.

[0153] Step 2, calculate the source model parameter hash;

[0154] Reference Figure 2 As shown, traverse all trainable parameters of the GPT-3 model (such as attention weights, biases), filter zero-value elements. Calculate the non-zero proportion, mean, standard deviation, maximum / minimum value of each layer, concatenate the feature string by layer name, and input the TLSH algorithm to get H2.

[0155] Step 3, calculate the source model function hash;

[0156] Reference Figure 3As shown, generate a random text sequence (e.g., 512 tokens), input the model for inference. Register a forward hook at the key layer, record the attention output and the feedforward network output. And do mean pooling and quantile statistics for each output, concatenate and generate H3 by TLSH.

[0157] Step 1.4, calculate the source model comprehensive hash;

[0158] Reference Figure 4 As shown, concatenate H1, H2, and H3 in order to form the comprehensive hash identifier H of GPT-3.

[0159] Step 5, model hash string after model stealing attack;

[0160] For the original GPT-3, four common model stealing variants are constructed respectively:

[0161] Step 5.1, generate hash string after fine-tuning the model;

[0162] Fine-tune the fully connected layer of GPT-3 using domain adaptation data, repeat steps 1-4, and calculate the hash string HASH_F.

[0163] Step 5.2, generate hash string after unstructured pruning the model;

[0164] According to the neuron importance score (e.g., L1 norm), prune 30% of the attention head parameters, repeat steps 1-4, and calculate the hash string HASH_UP.

[0165] Step 5.3, generate hash string after structured pruning the model;

[0166] Remove redundant Transformer layers, repeat steps 1-4, and calculate the hash string HASH_P.

[0167] Step 5.4, generate hash string after quantizing the model;

[0168] Quantize all layers of the original model (GPT-3) through quantization-aware training, repeat steps 1-4, and calculate the hash string HASH_Q.

[0169] Step 6, compare the similarity of hash values;

[0170] Use Hamming distance to measure the similarity of the fingerprints of two models. If the similarity is greater than 75%, the suspicious model is determined to be a stolen model.

[0171] Step 7, medical database model deployment and real-time protection

[0172] After the verification by hash similarity, the trained GPT-3 model is deployed in the intelligent professional medical database diagnosis suggestion system. Before each inference of the model, the comprehensive hash value of the current model is automatically calculated and compared with the original hash value online. If the Hamming distance exceeds the threshold of 75%, a security alarm is triggered and the diagnosis system is locked. When an authoritative model update package is received, the new model is first verified by hash, and after passing the verification, the old model is replaced and the comprehensive hash value is recalculated to ensure the controllability of intellectual property rights in the model iteration process.

[0173] Embodiment 3

[0174] As Figure 5 The embodiment relates to a deep learning model hash identification device based on multi-feature fusion, which comprises a memory and a processor. The memory is used to store a program supporting the processor to execute the above method, and realizes the deep learning model hash identification method based on multi-feature fusion in the embodiment 1 or 2.

[0175] Embodiment 4

[0176] The embodiment relates to a computer readable storage medium, which stores a computer program. When the computer program is run by a processor, the deep learning model hash identification method based on multi-feature fusion in the embodiment 1 or 2 is realized.

[0177] The embodiments described in the specification are described in a progressive manner, and the embodiments can be referred to each other. The above only describes the preferred embodiments of the present application. Those skilled in the art can make various equivalent changes and improvements to the embodiments without departing from the principles of the present application, which should be covered by the protection scope of the present application. The final protection scope is subject to the claims.

Claims

1. A hash identification method for deep learning models based on multi-feature fusion, specifically including the following steps: Step 1: Calculate the hash value of the source model graph structure; construct a directed graph using the structural information of the PyTorch model itself, and extract structural features by traversing all leaf nodes and inter-layer connections in the model. Record the type of each layer, then deduplicate and sort all layer types to generate a unified string, and finally use the MD5 hash algorithm to calculate the graph structure hash. Step 2: Calculate the TLSH value of the source model parameters; generate fault-tolerant hash values ​​by extracting the core statistical features of the model parameter distribution. Step 3: Calculate the TLSH value of the source model's functional features; generate hash values ​​that characterize the model's functional features by extracting statistical features from the output of the intermediate layers of the model. Step 4: Combine the three hash values ​​from Steps 1-3 to generate the final composite hash value; Step 5: Calculate the hash value of the suspicious model; Step 6: Calculate the similarity between the source model and the suspected model. For the generated complete hash string, use Hamming distance to measure the similarity of the fingerprints of the two models.

2. The hash identification method for a deep learning model based on multi-feature fusion according to claim 1, characterized in that, Step 1 includes: Step 1.1, static transformation of the model; The dynamic model is converted into a static directed acyclic graph (DAG), denoted as G. static The graph consists of several nodes and connecting edges. Nodes represent computational layers in the model, and edges represent data flow. Step 1.2: Filter leaf nodes; Traversing the static graph G static For all nodes in the list, filter the leaf nodes that satisfy the following conditions: Record the layer type (e.g., convolutional layer, fully connected layer, etc.) of each leaf node, forming a layer type set T = {t1, t2, ..., t}. n }, where t i Indicate the type of the i-th node; Step 1.3: Deduplication and sorting of layer types; Perform a deduplication operation on set T to obtain a set of unique types: Further sort T by lexicographical order unique Sort the data to generate an ordered sequence: T sorted =Sort(T unique ) (3) Step 1.4: Generate the feature string; Concatenate the sorted type sequence into a unique feature string: S=concat(t1,t2,...,t m ) (4) The `concat` function represents a string concatenation operation, where `m` is the number of unique strings after deduplication. Step 1.5, Calculate the hash value: H = GRAPHMD5(S) (5) 3. The hash identification method based on multi-feature fusion according to claim 1, characterized in that, Step 2 includes: Step 2.1, filter valid parameters; Iterate through all trainable parameters of the model and filter the set of parameters that meet the following conditions: P = {p l |p l For parameters that can be updated and are not frozen}(l=1,2,...,m)(6) where,pl represents the parameter tensor of the l-th layer, and m is the total number of layers; Step 2.2, extract non-zero parameters; For each layer of parameters pl, filter out zero-value elements to obtain a vector of non-zero parameters: Step 2.3, parameter normalization; The quantile normalization method is used to map non-zero parameters to the interval [0,1]: like The normalized result is a vector of all zeros; Step 2.4, construct the parameter histogram; The normalized parameters are divided into B = 10 equal-width bins. The number of parameters in each bin is counted, and histogram features are generated. In the formula, I(·) is the indicator function. The number of non-zero parameters; Step 2.5, calculate the statistic; Calculate the distribution characteristics of the parameters in each layer:

1. Non-zero ratio:

2. Mean and Median: Step 2.6, Layer Feature Encoding; Generate the feature string for each layer in the following format: Among them, Name l This is the layer name; the numerical value should retain the specified number of decimal places. Step 2.7: Concatenate the global feature string and generate a hash; 1. Sorting and concatenation: Sort {Sl} by layer name in lexicographical order to generate global feature strings: S global =concat(S1,S2,...,S m ) (13) 2. Hash Calculation: Apply the TLSH algorithm to generate a 72-bit hash value: H param =TLSH(S global ) (14) 4. The hash identification method for a deep learning model based on multi-feature fusion according to claim 1, characterized in that, Step 3 includes: Step 3.1, output capture intermediate layer; Through the forward propagation process of the model, intermediate layer features are extracted from the convolutional and linear layers. Let there be N target layers in the model, and the output of the k-th layer be denoted as O. k Suppose there are N target layers in the model, and the output of the k-th layer is denoted as O. k Where k = 1, 2, ..., N; Step 3.2, perform forward inference; Define the random input tensor as: Where H and W are the image height and width, respectively; X input Input the model and obtain the output set {O1, O2, ..., O} of each target layer. N }; Step 3.3, output standardization; Where, μ k and σ k These are the mean and standard deviation of the output of the k-th layer, respectively; Step 3.4: Extract quantile features; Standardized output Calculate the quantile set Q = {0.1, 0.5, 0.9} and generate the feature vector: in, This represents the α quantile value of the output of the k-th layer; Step 3.5: Concatenate the feature strings; Concatenate the quantile features of each layer in hierarchical order into a global feature string: S=concat(Q1,Q2,...,Q N ) (18) Each layer's feature format is Layer. k : Step 3.6, generate the functional hash; The characteristic string S is encoded using the TLSH hash algorithm to generate a unique hash value: H func =TLSH(S) (19) 5. The hash identification method for a deep learning model based on multi-feature fusion according to claim 1, characterized in that, Step 4 includes: Step 4.1, calculate the graph structure hash; Step 4.2, calculate the parameter statistical hash; Step 4.3: Calculate the output hash. Step 4.4: Concatenate the triples to output the final hash; torchmd5sum=concat(H graph ,H param ,H func ) (20) 6. The hash identification method for a deep learning model based on multi-feature fusion according to claim 1, characterized in that, Step 5 includes: Step 5.1: Calculate the hash value generated after fine-tuning the source model; Step 5.2: Calculate the hash value generated after the unstructured pruned source model; Step 5.3: Calculate the hash value generated after the structured pruned source model; Step 5.4: Calculate the hash value generated after quantizing the source model.

7. The hash identification method for a deep learning model based on multi-feature fusion according to claim 1, characterized in that, Step 6 includes: For the generated complete hash string, the Hamming distance is used to measure the similarity of the fingerprints of the two models: Where L is the length of the hash string.

8. A hash identification device for a deep learning model based on multi-feature fusion, comprising a memory and a processor, wherein the memory is used to store a program that supports the processor in executing the above-described calculation method, and the processor is configured to implement the hash identification method for a deep learning model based on multi-feature fusion as described in any one of claims 1-7.

9. A computer-readable storage medium on which a computer program is stored, characterized in that the computer program, when executed by a processor, implements the hash identification method for a deep learning model based on multi-feature fusion as described in any one of claims 1-7.

Images