Java bytecode steganography method and device based on latent semantic adversarial generation

Abstract

The application discloses a Java bytecode hidden watermarking method and device based on latent semantic generative adversarial, and belongs to the technical field of software watermarking. The method comprises the following steps: constructing a training data set comprising a plurality of semantic equivalent code pairs; constructing a generative adversarial network based on a Transformer architecture, wherein the generative adversarial network comprises a feature embedding layer, a generator, a latent semantic space virtual confuser and a discriminator; based on the training data set, applying disturbance to an output feature sequence of the generator by the latent semantic space virtual confuser, and performing watermark signal identification on the disturbed feature sequence by the discriminator as an adversarial condition, and alternately training the generator and the discriminator; inputting an original Java bytecode instruction sequence to be protected and target watermark information into the generative adversarial network, and outputting a Java bytecode instruction sequence which is semantic equivalent and embedded with the target watermark information by the generator. The application improves the concealment of the watermark.

Description

Technical Field

[0001] This invention belongs to the field of software watermarking technology, and in particular relates to a method and device for hidden watermarking of Java bytecode based on latent semantic adversarial generation. Background Technology

[0002] Software watermarking technology is a technique that secretly embeds information such as copyright and user information (i.e., watermarks) into the software carrier and can be effectively extracted. Software watermarking technology is of great value for tracking software piracy and proving intellectual property rights.

[0003] Existing watermarking methods on the Java platform encode watermarks by adding sets of virtual method instructions to the source code or bytecode. This method typically lacks reasonable business logic support within the overall program context, making it easily identifiable and locating by static analysis tools based on code structure analysis or manual review, thus lacking sufficient concealment. Furthermore, the instructions generated by this method are usually static, making them easily discarded as garbage by existing Java optimization tools during "dead code elimination (DCE)" or "control flow flattening," resulting in the permanent loss of watermark information. Summary of the Invention

[0004] The purpose of this invention is to overcome the shortcomings of the existing technology and provide a method and device for hidden watermarking of Java bytecode based on latent semantic adversarial generation. By encoding the watermark information into the microstructural features of the program through adversarial training, the generated watermark code is statistically indistinguishable from the original code, thereby improving the concealment of the watermark.

[0005] This invention is achieved through the following technical solution:

[0006] The first aspect of this invention discloses a method for hidden watermarking of Java bytecode based on latent semantic adversarial generation, comprising:

[0007] Construct a training dataset containing multiple semantically equivalent code pairs, each of which contains two Java bytecode fragments that are functionally identical but have different instruction sequences;

[0008] Construct a generative adversarial network based on the Transformer architecture, wherein the generative adversarial network includes:

[0009] The feature embedding layer, which serves as the input interface shared by the generator and discriminator, is used to map discrete Java bytecode instruction sequences into a raw feature sequence composed of continuous numerical vectors.

[0010] The generator is a sequence generation model based on the Transformer architecture, used to map the original feature sequence into a semantically equivalent output feature sequence that embeds the target watermark signal based on the received target watermark signal.

[0011] A latent semantic space virtual obfuscator, located between the generator and the discriminator, is used to apply a differentiable semantic preservation perturbation to the output feature sequence;

[0012] The discriminator is used to identify the watermark signal of the feature sequence after it has been perturbed by the latent semantic space virtual obfuscator.

[0013] Based on the training dataset, the generator and the discriminator are trained alternately against each other by perturbating the output feature sequence of the generator using the latent semantic space virtual obfuscator and identifying the watermark signal of the perturbated feature sequence by the discriminator.

[0014] The original Java bytecode instruction sequence to be protected and the target watermark information are input into the generative adversarial network, and the generator outputs a Java bytecode instruction sequence that is semantically equivalent and embeds the target watermark information.

[0015] Furthermore, a training dataset containing multiple equivalent code pairs is constructed, including the following steps:

[0016] Obtain the raw bytecode file;

[0017] The original bytecode file is subjected to semantically preserved code transformation to generate a corresponding variant bytecode file; wherein, the code transformation includes instruction equivalent substitution and / or control flow equivalent reconstruction;

[0018] Extract the control flow graphs from the original bytecode file and the variant bytecode file respectively;

[0019] The instructions that must be retained during the semantic equivalence transformation are extracted from the instructions contained in the control flow graphs of the original bytecode file and the variant bytecode file, respectively, and used as alignment anchors; wherein, the instructions that must be retained include method call instructions and / or field access instructions.

[0020] Based on the relative topological order of the alignment anchors in their respective instruction sequences, the longest common subsequence algorithm is used to determine the semantic invariant sequence shared between the original bytecode file and the variant bytecode file, wherein the semantic invariant sequence is composed of the alignment anchors;

[0021] Based on the semantic invariant sequence, locate the basic blocks corresponding to the topological positions in the control flow graphs of the original bytecode file and the variant bytecode file, respectively.

[0022] The basic blocks corresponding to the topological positions are paired to form candidate basic block pairs;

[0023] For each candidate basic block pair, verify whether its input stack frame state and output stack frame state are compatible, and construct a semantically equivalent code pair from the instruction sequence contained in the verified candidate basic block pair.

[0024] All the semantically equivalent code pairs are brought together to form the training dataset.

[0025] Furthermore, the discrete Java bytecode instruction sequence is mapped into a raw feature sequence composed of continuous numerical vectors, including:

[0026] A learnable opcode embedding matrix is ​​established, and the opcode at each position index in the discrete input bytecode sequence is mapped to a continuous opcode feature vector through a lookup table operation;

[0027] An operand embedding subnet is established, and based on the operand type, numeric operands, reference operands, and instructions without operands are mapped to operand feature vectors respectively;

[0028] Based on a preset feature fusion function, the opcode feature vector and the operand feature vector are fused to generate an instruction-level fused feature vector.

[0029] The instruction-level fused feature vector is subjected to layer normalization processing;

[0030] Generate a corresponding position encoding vector based on the position index of each instruction in the sequence;

[0031] The normalized instruction-level fused feature vector is added to the position encoding vector of the corresponding time position to form the final feature vector of that instruction position;

[0032] The final feature vectors corresponding to all instruction positions are aggregated to form the original feature sequence representing the entire input bytecode sequence.

[0033] Furthermore, the generator includes a sequentially connected context encoder and a micro-paradigm injection decoder;

[0034] The context encoder is used for:

[0035] Receive the original feature sequence generated by the feature embedding layer;

[0036] The attention weights between instructions in the original feature sequence are calculated through a multi-head self-attention mechanism to capture its deep syntactic dependencies and control flow logic, thereby generating context-enhanced feature representations.

[0037] The context-enhanced feature representation is nonlinearly mapped and dimensionally transformed using a feedforward neural network.

[0038] Generate and output a latent semantic feature matrix containing the complete program logic;

[0039] The micro-paradigm injection decoder is used for:

[0040] Receive the latent semantic feature matrix and target watermark signal output by the context encoder;

[0041] The target watermark signal is mapped into an isomorphic paradigm embedding vector through a conditional embedding layer, and the isomorphic paradigm embedding vector is fused with the feature representation of the generated instruction sequence.

[0042] The fused feature representation is encoded by a self-attention layer with a lower triangular mask matrix to maintain the autoregressive properties of the generation process.

[0043] By using the paradigm injection cross-attention mechanism, the latent semantic feature matrix is ​​modulated with the isomorphic paradigm embedding vector as a condition to obtain watermarked context features.

[0044] The watermarked context features are mapped to the probability distribution of the target instruction on the global vocabulary by the output projection layer;

[0045] Based on the probability distribution, an output feature sequence is generated in an autoregressive manner, which is semantically equivalent to the input sequence and embeds the target watermark signal.

[0046] Furthermore, the latent semantic space virtual obfuscator includes a set of differentiable perturbation operators for applying semantically preserving perturbations to the feature space, the differentiable perturbation operators including:

[0047] The first operator is used to perform a structured random masking operation on the input feature sequence;

[0048] The second operator is used to superimpose random noise onto the input feature sequence;

[0049] The third operator is used to perform differentiable permutation operations based on Gumbel-Softmax on the local features of the input feature sequence.

[0050] Furthermore, the discriminator is a two-stream discriminant network, which includes:

[0051] A semantic consistency discriminator is used to distinguish whether the input feature sequence is natural code from a real project or synthetic code created by the generator;

[0052] A robust watermark extractor is used to receive the feature sequence after it has been perturbed by the latent semantic space virtual obfuscator, and decode it to restore the original watermark signal.

[0053] Furthermore, the generator and the discriminator undergo alternating adversarial training, including:

[0054] Repeat the discriminator optimization step and the generator optimization step until the generative adversarial network reaches the preset convergence condition;

[0055] The discriminator optimization step includes: freezing the parameters of the generator, inputting the feature sequence synthesized by the generator and the real bytecode sample into the discriminator, calculating the discriminator's own discrimination loss, and updating the discriminator's parameters based on the discrimination loss;

[0056] The generator optimization step includes: freezing the parameters of the discriminator, inputting the original bytecode feature sequence and the target watermark signal into the generator, and updating the parameters of the generator based on a joint loss function;

[0057] The joint loss function is a weighted sum of semantic reconstruction loss, disturbance robustness loss, and micro-instruction preference consistency loss.

[0058] The semantic reconstruction loss is obtained by calculating the difference between the instruction sequence output by the generator and the corresponding target instruction sequence obtained from the training dataset;

[0059] The disturbance robustness loss is obtained by the discriminator through the accuracy of watermark signal recognition of the generated features after being disturbed by the latent semantic space virtual obfuscator.

[0060] The micro-instruction preference consistency loss is obtained by the probability value of the discriminator performing binary classification to determine whether the feature sequence output by the generator is true or false.

[0061] Further, the original Java bytecode instruction sequence to be protected and the target watermark information are input into the generative adversarial network, and the generator outputs a semantically equivalent Java bytecode instruction sequence that embeds the target watermark information, including:

[0062] The original Java bytecode instruction sequence is mapped to the original feature sequence through the feature embedding layer;

[0063] The original feature sequence is input into the context encoder of the generator to extract and output the latent semantic feature matrix;

[0064] The target watermark information is algebraically error-corrected and encoded, and the encoded target watermark signal is mapped to an isomorphic paradigm embedding vector by using the conditional embedding layer of the decoder injected with the micro-paradigm in the generator.

[0065] The latent semantic feature matrix and the isomorphic paradigm embedding vector are input into the micro-paradigm injection decoder; the micro-paradigm injection decoder decodes under the semantic constraints of the latent semantic feature matrix and with the isomorphic paradigm embedding vector as a condition, generating a target instruction sequence that is semantically equivalent to the original sequence and embeds watermark statistical features.

[0066] The target instruction sequence is restored to bytecode opcodes and operands that conform to the Java Virtual Machine Specification, and the control flow jump address is recalculated to generate an executable file that conforms to the bytecode format specification.

[0067] Static verification of the bytecode format and stack balance of the executable file is performed.

[0068] Furthermore, the method also includes a watermark extraction step, which includes:

[0069] The feature embedding layer maps the Java bytecode instruction sequence to be detected into the original feature sequence.

[0070] The original feature sequence is input into the robust watermark extractor of the discriminator; the robust watermark extractor calculates the posterior probability of each instruction unit in the original feature sequence corresponding to different watermark micro-paradigms, and generates a watermark bit decision sequence by accumulating scores based on the posterior probabilities of all instruction units through a log-likelihood ratio mechanism.

[0071] Based on the preset algebraic error correction coding rules, the watermark bit decision sequence is subjected to global consistency verification and error correction to reconstruct the complete watermark coding sequence.

[0072] The watermark encoding sequence is decoded, redundant check symbols introduced by error correction encoding are removed, and the original valid watermark payload information is restored and output.

[0073] A second aspect of the present invention discloses a Java bytecode hidden watermarking device based on latent semantic adversarial generation, comprising:

[0074] A data construction module is used to construct a training dataset containing multiple semantically equivalent code pairs, each of which contains two Java bytecode fragments that are functionally identical but have different instruction sequences;

[0075] A network building module is used to construct a generative adversarial network based on the Transformer architecture, wherein the generative adversarial network includes:

[0076] The feature embedding layer, which serves as the input interface shared by the generator and discriminator, is used to map discrete Java bytecode instruction sequences into a raw feature sequence composed of continuous numerical vectors.

[0077] The generator is a sequence generation model based on the Transformer architecture, used to map the original feature sequence into a semantically equivalent output feature sequence that embeds the target watermark signal based on the received target watermark signal.

[0078] A latent semantic space virtual obfuscator, located between the generator and the discriminator, is used to apply a differentiable semantic preservation perturbation to the output feature sequence;

[0079] The discriminator is used to identify the watermark signal of the feature sequence after it has been perturbed by the latent semantic space virtual obfuscator.

[0080] The training module is used to perform alternating adversarial training on the generator and the discriminator based on the training dataset, using the latent semantic space virtual obfuscator to perturb the output feature sequence of the generator and the discriminator to identify the watermark signal of the perturbated feature sequence as adversarial conditions.

[0081] The watermark embedding module is used to input the original Java bytecode instruction sequence to be protected and the target watermark information into the generative adversarial network, and the generator outputs a Java bytecode instruction sequence that is semantically equivalent and embeds the target watermark information.

[0082] Compared with the prior art, the present invention has the following advantages and beneficial effects:

[0083] (1) This invention uses context-aware generation and dual-stream discrimination mechanism to guide the generator to embed watermarks by selecting bias only through micro-instructions while maintaining complete semantic equivalence, so that the statistical characteristics of the watermark code are consistent with those of the natural code and are difficult to detect.

[0084] (2) This invention forces the generator to encode the watermark into deep semantic and structural invariants that can resist code obfuscation, optimization and compression through adversarial training of the latent semantic space virtual obfuscator, thereby ensuring the survival of the watermark under distribution and attack.

[0085] (3) The present invention uses the trained discriminator directly as a robust watermark extractor, which can directly decode the watermark from the instruction distribution features of the target program based on the log-likelihood ratio (LLR) cumulative scoring mechanism, without the need for the original host code to participate in the comparison.

[0086] (4) Based on the context encoding capability of the Transformer architecture, the generator can perceive the global semantics and control flow structure of the code, thereby dynamically and intelligently adjusting the embedding strategy of the watermark in different contexts.

[0087] (5) This invention strictly ensures that the generated watermarked code conforms to the specifications and that there are no changes to the business logic through three levels of constraints: semantic reconstruction loss, static validator and JVM standard verification, thus avoiding errors during runtime. Attached Figure Description

[0088] The accompanying drawings, which are included to provide a further understanding of embodiments of the invention and form part of this application, do not constitute a limitation thereof. In the drawings:

[0089] Figure 1 This is a flowchart of an implicit watermarking method for Java bytecode in this invention;

[0090] Figure 2 This is a block diagram of one component of the Java bytecode implicit watermarking device in this invention. Detailed Implementation

[0091] The technical solution of the present invention will be further described below with reference to the accompanying drawings and specific embodiments.

[0092] The accompanying drawings are for illustrative purposes only and are schematic diagrams, not actual pictures. They should not be construed as limiting the invention. To better illustrate the embodiments of the invention, some parts in the drawings may be omitted, enlarged, or reduced, and do not represent the actual product dimensions. It is understandable to those skilled in the art that some well-known structures and their descriptions may be omitted in the drawings.

[0093] In the accompanying drawings of the embodiments of the present invention, the same or similar reference numerals correspond to the same or similar components. In the description of the present invention, it should be understood that if terms such as "upper," "lower," "left," "right," "inner," and "outer" indicate the orientation or positional relationship based on the orientation or positional relationship shown in the accompanying drawings, they are only for the convenience of describing the present invention and simplifying the description, and do not indicate or imply that the device or element referred to must have a specific orientation, or be constructed and operated in a specific orientation. Therefore, the terms used to describe positional relationships in the accompanying drawings are only for illustrative purposes and should not be construed as limiting the present invention. For those skilled in the art, the specific meaning of the above terms can be understood according to the specific circumstances.

[0094] In the description of this invention, unless otherwise explicitly specified and limited, the term "connection" or similar designation indicating a connection between components should be interpreted broadly. For example, it can refer to a fixed connection, a detachable connection, or an integral part; it can be a mechanical connection or an electrical connection; it can be a direct connection or an indirect connection through an intermediate medium; it can refer to the internal communication between two components or the interaction between two components. Those skilled in the art can understand the specific meaning of the above terms in this invention based on the specific circumstances.

[0095] Definitions of abbreviations and key terms:

[0096] Digital carrier propagation chain: refers to the entire lifecycle of Java bytecode from its construction, distribution, external optimization or obfuscation, to its final execution. This invention uniformly models all kinds of code transformations (such as obfuscation, recompilation, and trimming) that occur in this chain as semantically equivalent perturbations of bytecode in the watermark lifecycle environment.

[0097] Latent Semantic Space Virtual Obfuscator: A mathematical simulation module embedded within a neural network. It does not manipulate real files, but rather simulates operations such as meaningless code elimination and instruction rearrangement performed by tools like ProGuard in the feature vector space using differentiable perturbation operators.

[0098] Bytecode semantic equivalence perturbation: refers to the transformation of the form of a sequence of code instructions while keeping the program's execution logic unchanged (e.g., bipus changing to iconst). This is the core simulation object of adversarial training.

[0099] Bytecode verifier: Refers to a static analysis and abstraction module. Without actually running the code, it deduces the data frame state of the instruction flow by constructing a control flow graph (CFG) and simulating JVM stack behavior. This is used to verify whether the generated code strictly conforms to the constraints in the Java Virtual Machine Specification (such as StackMapTable consistency) before watermarking. Its implementation is based on existing bytecode analysis frameworks (such as ASM Tree Analysis).

[0100] Algebraic structure constraint coding: refers to using mathematical algorithms (such as the Reed-Solomon algorithm) to introduce strong algebraic redundancy into the watermark payload, enabling it to have self-repair capability even when some features are lost.

[0101] Latent semantics: refers to the feature representation of Java bytecode instructions after processing by the embedding layer and encoder, mapped to a high-dimensional continuous vector space.

[0102] Instruction Meta-Index: This refers to the unique integer identifier in the model's global instruction dictionary corresponding to each discrete instruction unit after the Java bytecode stream has been serialized. This identifier establishes a mapping relationship from the binary opcodes defined in the JVM specification to the neural network vector space.

[0103] Isomorphism: refers to the fact that the business logic (semantics) of the code is completely equivalent.

[0104] Paradigm: refers to the specific, statistically distinguishable micro-code style used to implement the above logic.

[0105] Isomorphic paradigm bias: This refers to the statistical distributional preferences exhibited by generated code during the construction of micro-instruction sequences while maintaining semantic functionality (i.e., isomorphism). Specifically, this includes, but is not limited to: opcode selection bias: sampling probability deviations for specific instruction variants within a functionally equivalent candidate instruction set (e.g., iconst vs. bipush); resource allocation patterns: a preference for compact (slot reuse) or sparse (slot independent allocation) strategies in local variable table slot allocation; and control flow structure characteristics: deviations in the frequency of use of specific jump instruction combinations (e.g., goto chains or condition inversions) in basic block connection methods.

[0106] Instruction selection logic refers to the decision-making process by which the generator, when constructing target code, determines the specific opcode and operand from a set of semantically equivalent candidate instructions. In this invention, this logic no longer merely follows the traditional "minimum size" or "shortest path" optimization principles, but is transformed into a probabilistic sampling process modulated by the watermark payload. That is, the watermark information directly intervenes in the generator's selection tendency for specific isomorphic instruction variants.

[0107] like Figures 1 to 2 As shown in the figure, this embodiment discloses a method and apparatus for generating hidden watermarks in Java bytecode based on latent semantic adversarial generation.

[0108] The first aspect of this embodiment discloses a method for hidden watermarking of Java bytecode based on latent semantic adversarial generation, such as... Figure 1 As shown, the method includes steps S100 to S400.

[0109] Step S100. Construct a training dataset containing multiple semantically equivalent code pairs, each of which contains two Java bytecode fragments that are functionally identical but have different instruction sequences.

[0110] For example, each of the equivalent code pairs includes and Two instruction sequences, where, This is the original instruction sequence. for The isomorphic variant instruction sequence after semantic equivalence transformation and The instruction sequences are different, but the functions are completely equivalent.

[0111] In some implementations of this embodiment, a training dataset containing multiple semantically equivalent code pairs is constructed, including steps S110 to S190.

[0112] Step S110. Obtain the original bytecode file.

[0113] The original bytecode file is a Java bytecode file.

[0114] For example, collect .class files from open-source Java projects.

[0115] Step S120. Perform semantically preserved code transformation on the original bytecode file to generate a corresponding variant bytecode file; wherein, the code transformation includes instruction equivalent substitution and / or control flow equivalent reconstruction.

[0116] For example, the code transformation includes instruction equivalent substitution; or, the code transformation includes control flow equivalent refactoring; or, the code transformation includes both instruction equivalent substitution and control flow equivalent refactoring.

[0117] For example, using tools such as ProGuard / Allatori, lightweight semantic transformations (such as iconst_1↔bipush 1, lookupswitch ↔tableswitch) can be performed on the original Java bytecode file to generate functionally equivalent variants.

[0118] Step S130. Extract the control flow graphs of the original bytecode file and the variant bytecode file respectively.

[0119] Step S140. Extract the instructions that must be retained during the semantic equivalence transformation from the instructions contained in the control flow graphs of the original bytecode file and the variant bytecode file, respectively, as alignment anchors; wherein, the instructions that must be retained include method call instructions and / or field access instructions.

[0120] For example, the instructions that must be retained include method call instructions; or, the instructions that must be retained include field access instructions; or, the instructions that must be retained include both method call instructions and field access instructions.

[0121] Step S150. Based on the relative topological order of the alignment anchors in their respective instruction sequences, the longest common subsequence algorithm is used to determine the semantic invariant sequence shared between the original bytecode file and the variant bytecode file, wherein the semantic invariant sequence is composed of the alignment anchors.

[0122] The sequence of semantic invariants is a program skeleton composed of strongly binding instructions.

[0123] Step S160. Based on the semantic invariant sequence, locate the basic blocks corresponding to the topological positions in the control flow graphs of the original bytecode file and the variant bytecode file, respectively.

[0124] The basic block is an instruction sequence unit with a single entry and single exit attribute, which is divided out of the control flow graph and used for subsequent stack frame state analysis.

[0125] Step S170. Pair the basic blocks corresponding to the topological positions to form candidate basic block pairs.

[0126] The candidate basic block pair is two instruction fragments that have a topological correspondence, defined by the same sequence of semantic invariants, under the control flow graph topology mapping. Basic blocks from the control flow graph of the original bytecode file are called original basic blocks, and basic blocks from the control flow graph of the variant bytecode file are called variant basic blocks.

[0127] Step S180. For each candidate basic block pair, verify whether its input stack frame state and output stack frame state are compatible, and construct a semantically equivalent code pair from the instruction sequence contained in the verified candidate basic block pair.

[0128] In some implementations of this embodiment, candidate block pairs are eliminated due to structural damage or stack state mismatch.

[0129] Step S190. Gather all the semantically equivalent code pairs to form the training dataset.

[0130] Step S200 constructs a generative adversarial network based on the Transformer architecture, which includes a feature embedding layer, a generator, a discriminator, and a latent semantic space virtual obfuscator.

[0131] The feature embedding layer serves as a shared input interface between the generator and the discriminator, used to map discrete Java bytecode instruction sequences into original feature sequences composed of continuous numerical vectors.

[0132] The feature embedding layer transforms discrete bytecode instruction sequences into continuous feature sequences through a mapping process defined by the following formula:

[0133] In the formula, This represents a single feature vector calculated by the feature embedding layer at position index t in the instruction sequence; t represents the position index of the instruction in the code sequence, i.e., t∈[1,T], where T is the total length of the sequence; The instruction opcode representing the index of position t, such as ILOAD, INVOKEVIRTUAL, etc. This represents the instruction operand at the t-th position index; This represents the opcode embedding function, which is used to map discrete opcodes into continuous vectors through a lookup table operation; This indicates that the operand is embedded in a subnet; The feature fusion function is used to nonlinearly combine the semantics of "instruction action" and "operand parameters" in a high-dimensional space to solve the problem of heterogeneous bytecode instruction structure. represents the location encoding vector; LayerNorm represents the layer normalization function, used to normalize the feature distribution and prevent gradient divergence.

[0134] In some embodiments of this example, a discrete Java bytecode instruction sequence is mapped to an original feature sequence composed of continuous numerical vectors, including steps S210 to S270.

[0135] Step S210. Establish a learnable opcode embedding matrix, and map the opcode at each position index in the discrete input bytecode sequence to a continuous opcode feature vector through a lookup table operation.

[0136] In some implementations of this embodiment, a learnable opcode embedding matrix is ​​established, and the opcode at each position index in the discrete input bytecode sequence is mapped to a continuous opcode feature vector through a lookup table operation. This includes: constructing a matrix with dimension 1. The learnable embedding matrix, where The instruction set size defined by the Java Virtual Machine Specification. For the embedding dimension; by using a lookup table operation (i.e., directly extracting the corresponding row vector from the learnable embedding matrix using an index), the opcode at position t in the input bytecode sequence is obtained. Mapped to the corresponding Dimensional opcode feature vector .

[0137] In these implementations, discrete instruction actions are mapped to dense semantic vectors to capture the functional characteristics of instructions (such as arithmetic operations, stack operations, and flow control).

[0138] Step S220. Establish an operand embedding subnet, and map numeric operands, reference operands, and operand-free instructions to operand feature vectors according to operand type.

[0139] Because Java bytecode operands are heterogeneous (including both numeric operands and constant pool indexes), this embodiment uses a divide-and-conquer strategy to generate operand feature vectors. .

[0140] For numerical operands: extract their values, normalize the extracted values, and then map them through a multilayer perceptron (MLP) to... dimensional operand eigenvectors .

[0141] For reference operands: parse the constant pool index pointed to by the operand, extract its corresponding class name, method signature, or field type descriptor, and perform hash encoding or character-level embedding mapping. dimensional operand eigenvectors .

[0142] For operand-free instructions (such as DUP, RETURN): use a dimension of... Learnable zero-padding vectors ([NULL] vectors) as operand feature vectors .

[0143] Step S230. Based on a preset feature fusion function, the opcode feature vector and the operand feature vector are fused to generate an instruction-level fused feature vector.

[0144] The feature fusion function is used to fuse information about "actions" and "parameters". The fusion methods include splicing mapping and bitwise superposition.

[0145] The concatenation mapping fusion process is as follows: after concatenating the opcode vector and operand vector, the result is projected onto the model dimension through a linear transformation layer.

[0146] In the formula, Let W represent the feature fusion function, and let W represent the learnable weight matrix of the fusion layer. Represents the opcode vector. represents the operand vector, and b represents a learnable parameter vector with the same dimension as the output feature.

[0147] The core task of the learnable parameter vector b is to prevent information collapse caused by input sparsity and to give the model the ability to freely translate in the feature space, thereby more accurately capturing the non-linear semantics of bytecode. Even Empty, or The value of is very small, and the bias term b can also provide a "basic semantic foundation" to ensure that the generated final feature vector still has a non-zero numerical distribution and can be effectively processed by subsequent Transformer layers.

[0148] The shape of the learnable weight matrix is: The learnable weight matrix is ​​used to remap the concatenated high-dimensional / mixed-dimensional vector back to the standard dimensions required by the Transformer model. At the same time, the opcode semantics and operand semantics are weighted and mixed during the mapping process.

[0149] The bitwise addition fusion process is as follows: when the opcode feature vector and the operand feature vector have the same dimension, bitwise addition is performed directly to simulate the semantic addition of the instruction and its parameters.

[0150]

[0151] In the formula, Represents the feature fusion function. Represents the opcode vector. This represents the operand vector.

[0152] Step S240. Perform layer normalization processing on the instruction-level fused feature vector.

[0153] In this embodiment, layer normalization is applied after feature fusion to unify the mean and variance of the feature distribution, prevent gradient vanishing or exploding, and accelerate the convergence of the Transformer model.

[0154] Step S250. Generate the corresponding position encoding vector according to the position index of each instruction in the sequence.

[0155] The location encoding vector This refers to mapping the discrete temporal position index t of the current instruction to a continuous feature vector with the same dimension as the opcode embedding vector. Given that the self-attention mechanism of the Transformer architecture itself lacks sequence awareness, and that Java bytecode is an operand-stack-based language with strict execution order, the validity of its stack frame state must follow causal logic such as "PUSH first, then POP." Therefore, this embodiment generates positional encoding vectors using sine / cosine functions or learnable parameters and explicitly superimposes them onto the semantic vector. This injects absolute / relative positional semantics of the instruction flow into the stateless neural network, enabling it to accurately capture the JVM's stack balance constraints and temporal dependencies during the generation process.

[0156] Step S260. Add the normalized instruction-level fused feature vector to the position encoding vector of the corresponding time position to form the final feature vector of the instruction position.

[0157] Step S270. Aggregate the final feature vectors corresponding to all instruction positions to form the original feature sequence representing the entire input bytecode sequence.

[0158] The generator is a conditional generation model based on the Transformer architecture, which includes a context encoder and a micro-paradigm injection decoder, used to map the original feature sequence to an output feature sequence that is semantically equivalent to and embeds the target watermark signal based on the target watermark signal.

[0159] In some embodiments of this example, the context encoder is used to: receive the original feature sequence generated by the feature embedding layer; calculate the attention weights between instructions in the original feature sequence through a multi-head self-attention mechanism to capture long-range dependencies of bytecode and generate a context-enhanced feature representation; perform nonlinear mapping and dimensional transformation on the context-enhanced feature representation through a feedforward neural network; and generate and output a latent semantic feature matrix containing complete program logic.

[0160] The context encoder includes a multi-head self-attention module and a feedforward neural network module.

[0161] In some embodiments of this example, the multi-head self-attention module is used to calculate the attention weights between the query matrix, the key matrix, and the value matrix, and to perform weighted aggregation on the original feature sequence to generate a context-enhanced feature representation.

[0162] The formula for calculating the attention weight is:

[0163]

[0164] In the formula, Q represents the query matrix, K represents the key matrix, and V represents the value matrix. Indicates the scaling factor.

[0165] The query matrix represents the semantic retrieval requirement of the "currently being processed instruction" for contextual information. For example, assuming the current instruction is ALOAD_1 (read local variable 1), its Q-vector will "search" the sequence for the source instruction (such as ASTORE_1) that defines the variable.

[0166] The key matrix represents the index feature vector of "all instructions in the context". The key matrix is ​​the object being searched, and the dot product of the query matrix and the key matrix is... This calculates the correlation strength between the current instruction and all other instructions.

[0167] The value matrix represents a vector of "the actual semantic content of the instruction". After the query matrix finds a relevant key matrix, the network extracts the corresponding value matrix according to the relevance weights, thereby aggregating the context information.

[0168] The scaling factor is the dimension of the key vector (usually equal to...). , where h is the number of heads), is used to adjust the order of magnitude of the dot product result to prevent the dot product from becoming too large when the scaling factor is large, causing the Softmax function to enter the saturation region with minimal gradient, thereby ensuring that the gradient can be effectively backpropagated during adversarial training.

[0169] The function is used to normalize the relevance score into a probability distribution (with weights summing to 1), determining how much the model should "pay attention" to other instructions in the context when generating the current instruction.

[0170] The multi-head self-attention module is used to capture long-distance semantic dependencies between instructions, such as identifying the association between ISTORE_1 (writing local variables) and the subsequent remote ILOAD_1 (reading local variables), or the logical connection between the GOTO instruction and its jump target.

[0171] In some embodiments of this example, the feedforward neural network module receives the context-enhanced feature representation output by the multi-head self-attention module, performs a two-layer linear transformation including a nonlinear activation function, performs nonlinear mapping and dimensionality transformation on it, further refines and reorganizes the information, and finally generates the latent semantic feature matrix. Its operation follows the following formula:

[0172]

[0173] In the formula, x represents the feature representation output by the multi-head self-attention module, with dimension 1. ; It is a dimension of The learnable weight matrix; It is a dimension of The bias vector; The hidden layer dimension refers to the number of neurons in the hidden layers within a position-forward network (FFN), typically set as the model embedding dimension. 4 times (i.e.) ); It is a non-linear activation function; It is a dimension of A learnable weight matrix is ​​used to reproject high-dimensional features back to the original. Dimensions are used to purify and compress information. It is a dimension of The bias vector.

[0174] The nonlinear activation function is used to introduce nonlinear characteristics, enabling the model to fit complex nonlinear logic in Java bytecode (such as multiple nested jumps), for example, using the GELU or ReLU function.

[0175] The feedforward neural network module enhances the model's ability to fit complex bytecode logic (such as boundary determination for conditional jumps and type deduction for polymorphic calls) by introducing a nonlinear activation function (such as GELU). Simultaneously, through dimensional expansion of the intermediate layers, features are mapped to a higher-dimensional space to separate the entangled features of different instructions, and finally projected back to the original dimension, completing the purification and recombination of information.

[0176] In some embodiments of this example, the micro-paradigm injection decoder includes a conditional embedding layer, a masked self-attention layer, a paradigm injection cross-attention layer, and an output projection layer.

[0177] The micro-paradigm injection decoder is used to: receive the latent semantic feature matrix and the target watermark signal output by the context encoder; map the target watermark signal into an isomorphic paradigm embedding vector through a conditional embedding layer, and fuse the isomorphic paradigm embedding vector with the feature representation of the generated instruction sequence; encode the fused feature representation through a self-attention layer with a lower triangular mask matrix to maintain the autoregressive property of the generation process; modulate the latent semantic feature matrix with the isomorphic paradigm embedding vector as a condition through a paradigm injection cross-attention mechanism to obtain watermarked context features; map the watermarked context features into the probability distribution of the target instruction on the global vocabulary through an output projection layer; and sample and iteratively generate an output feature sequence that is semantically equivalent to the input sequence and embeds the target watermark signal in an autoregressive manner based on the probability distribution.

[0178] The conditional embedding layer is used to receive the target watermark signal, map the target watermark signal into an isomorphic paradigm embedding vector, and fuse the isomorphic paradigm embedding vector with the feature representation of the generated instruction sequence into a fused feature sequence.

[0179] Specifically, the conditional embedding layer receives the externally input binary target watermark signal and transmits it through a learnable linear mapping network. This is mapped to a high-dimensional continuous vector, denoted as the isomorphic paradigm embedding vector. The isomorphic paradigm embedding vector It carries specific micro-instruction selection preferences (such as register operation style or constant loading habits). Then, the feature vectors of instructions generated before the current time step are fused with the target isomorphic paradigm embedding vector at the current time step to form a fused feature sequence.

[0180] The masked self-attention layer encodes the fused feature sequence, and the introduction of a lower triangular mask matrix ensures that the generation process strictly follows the autoregressive property.

[0181] The masked self-attention layer is used to: receive the fused feature sequence output by the conditional embedding layer; map the fused feature sequence into a query matrix, a key matrix, and a value matrix using three learnable weight matrices; calculate the product of the query matrix and the key matrix and divide by a scaling factor to obtain the original attention score matrix; superimpose a lower triangular mask matrix onto the attention score matrix; apply the Softmax function to the masked attention score matrix for probability normalization to obtain an attention probability distribution; and perform a weighted summation of the value matrix based on this attention probability distribution to generate the encoded context feature sequence. Features at any position in this context feature sequence only aggregate historical information prior to that position, completely masking future information, thus providing causal query conditions for subsequent cross-attention layers. The paradigm-injected cross-attention layer fuses the isomorphic paradigm embedding vector as a control condition with the latent semantic feature matrix to inject watermark information into the context features. The control logic of the paradigm-injected cross-attention layer is as follows: when the watermark bit is 0, the activation path inside the model is biased towards generating "micro-expression A" (e.g., prioritizing sampling iconst_1); when the watermark bit is 1, the activation path inside the model is biased towards generating "micro-expression B" (e.g., prioritizing sampling bipush 1). The output projection layer maps the watermarked context feature sequence finally output by the decoder to the probability distribution of the target instruction on the global vocabulary.

[0182] Specifically, the output projection layer is used to: receive the context feature sequence output by the paradigm-injected cross-attention layer; use a learnable linear projection matrix to map the input high-dimensional hidden state feature vector to the global instruction vocabulary dimension (for example, converting the feature vector of the hidden layer dimension into a logical value vector with a length equal to the "size of the entire Java bytecode instruction set"). Each value in this vector corresponds to the original recommendation score of each instruction in the vocabulary (such as iconst_0, bipush, iadd, etc.) in the current context. Since the input feature vector has been modulated by the "isomorphic paradigm", the score corresponding to the isomorphic instruction that matches the current watermark (such as bipush 1) will be significantly increased; the above logical value vector is processed by a normalized exponential function (Softmax) to convert the original scores containing positive and negative values ​​into a set of positive real number probability distributions with a sum of 1, thereby converting the scores into interpretable generation probabilities and eliminating numerical magnitude differences. The instruction with the highest probability is the prediction result of the model at the current time.

[0183] The latent semantic space virtual obfuscator is located between the generator and the discriminator, and is used to apply a differentiable semantic preservation perturbation to the output feature sequence.

[0184] In some embodiments of this example, the latent semantic space virtual obfuscator includes a set of differentiable perturbation operators for applying semantically preserving perturbations to the feature space. The differentiable perturbation operators include: a first operator for performing a structured random masking operation on the input feature sequence; a second operator for superimposing random noise on the input feature sequence; and a third operator for performing a Gumbel-Softmax-based differentiable permutation operation on the local features of the input feature sequence.

[0185] For example, the first operator (simulating the elimination of meaningless code): applying structured methods. Randomly masking low-weight instruction features. Second operator (simulated equivalent instruction replacement): superimposed semantic drift noise ( = ),in (N is a Gaussian normal distribution), simulating the small displacement of equivalent instructions in the embedding space. The third operator (simulating instruction rearrangement): introduces a locally differentiable permutation matrix to perform soft rearrangement of local features.

[0186] The latent semantic space virtual obfuscator needs to maintain the connectivity of the computation graph so that the generator can perceive the discriminator's feedback on the obfuscated code. Therefore, for discrete rearrangement and replacement operations, these implementations employ the Gumbel-Softmax technique to ensure that gradients can penetrate the layer and propagate back to the generator, thereby guiding the generator to actively learn to encode watermark features into those "difficult to obfuscate and destroy" structured invariants.

[0187] The discriminator is used to identify the watermark signal of the feature sequence after it has been perturbed by the latent semantic space virtual obfuscator.

[0188] In some embodiments of this example, the discriminator is a two-stream discriminant network, which includes: a semantic consistency discriminator, used to distinguish whether the input feature sequence is natural code from a real project or synthetic code created by the generator; and a robust watermark extractor, used to receive the feature sequence perturbed by the latent semantic space virtual obfuscator and decode it to restore the original watermark signal.

[0189] Specifically, the semantic consistency discriminator is used to distinguish whether the input bytecode is natural code from a real open-source project or synthetic code created by a generator. The semantic consistency discriminator forces the generator to learn a high-quality bytecode distribution that conforms to the JVM specification and natural coding habits (i.e., ensuring stealth) through adversarial training.

[0190] Specifically, the robust watermark extractor receives the perturbation feature sequence processed by the latent semantic space virtual obfuscator and attempts to accurately restore the original watermark signal from this obfuscated / rearranged sequence.

[0191] The robust watermark extractor provides key gradient guidance to the generator by calculating the classification loss. It forces the generator to encode the watermark features into deep invariants, ensuring that even if the generated code is interfered with by the latent semantic space virtual obfuscator (such as rearrangement or replacement), its micro-feature fingerprint can still be accurately decoded. Thus, based on the gradient optimization mechanism of adversarial game, the high robustness of the watermark is guaranteed.

[0192] In these implementations, a deep neural network is constructed as a discriminator, whose training data comes from a real corpus (positive samples) and fake sequences output by the generator (negative samples). The discriminator shares a low-level feature extraction layer, but at the output end it is differentiated into two independent function streams to achieve multi-task adversarial learning.

[0193] The discriminator is a heterogeneous discriminator that includes a semantic consistency stream and a robust feature extraction stream, taking into account both the "semantic high quality" and "high resistance to watermarking" of the generated code.

[0194] Step S300. Based on the training dataset, the generator and the discriminator are subjected to alternating adversarial training, with the generator perturbing the output feature sequence of the generator by the latent semantic space virtual obfuscator and the discriminator identifying the watermark signal of the perturbed feature sequence as adversarial conditions.

[0195] In some embodiments of this example, the generator and the discriminator are subjected to alternating adversarial training, including: repeatedly executing the discriminator optimization step and the generator optimization step until the generative adversarial network reaches a preset convergence condition.

[0196] The discriminator optimization step includes: freezing the generator's parameters, inputting the feature sequence synthesized from the real bytecode sample and the generator into the discriminator, calculating the discriminator's own discrimination loss, and updating the discriminator's parameters based on the discrimination loss. Optimizing the discriminator using the method in this embodiment enables it to keenly detect subtle forgery traces in the generated code, improving its ability to distinguish between real and synthesized code, as well as the accuracy of identifying watermark polarity.

[0197] The generator optimization step includes: freezing the parameters of the discriminator, inputting the original bytecode feature sequence and the target watermark signal into the generator, and updating the generator parameters based on a joint loss function. Optimizing the generator using the method in this embodiment can enhance its ability to generate concealed and robust watermarks, thereby generating highly concealed and robust watermarked code.

[0198] When calculating the joint loss function in the generator optimization step, the generator minimizes the robustness loss against disturbances through the backpropagation algorithm. This is actually using adversarial gradient exploration to break through the discriminator's judgment boundary, inducing it to identify the generated samples that have undergone simulated interference as the target watermark isomorphic paradigm with high confidence.

[0199] In some implementations of this embodiment, the training convergence condition is that the model reaches Nash equilibrium, that is, the code generated by the generator can stably pass the interference of the isomorphic simulator and be correctly decoded by the discriminator while maintaining semantic equivalence.

[0200] The joint loss function is a weighted sum of semantic reconstruction loss, disturbance robustness loss, and micro-instruction preference consistency loss, and its calculation formula is as follows:

[0201]

[0202] In the formula, Indicates the total loss. Indicates semantic reconstruction loss; Indicates the loss of robustness against disturbances; This represents the loss of consistency in micro-instruction preferences; This represents the balancing hyperparameter.

[0203] The semantic reconstruction loss is obtained by calculating the difference between the instruction sequence output by the generator and the corresponding target instruction sequence obtained from the training dataset, and its calculation formula is as follows:

[0204]

[0205] In the formula, t represents the position index of the instruction in the sequence, t∈[1,T]; T represents the total length of the instruction sequence; X represents the input original bytecode sequence (or its semantic vector representation), which serves as the basis for the code logic; c represents the injected watermark signal (0 or 1), which serves as a conditional constraint in the generation process, requiring the model to integrate specific micro-expression features; This indicates the standard target instruction that should be generated at position t; Indicates the prefix of the generated instruction sequence ( ; This indicates that the generator is based on the original logic X, the watermark signal c, and the current stack context. Under the given conditions, correctly predict the standard instructions. The probability of; This means that by minimizing the negative log-likelihood loss, the generator is forced to learn a strict instruction-level mapping.

[0206] The standard target instruction It is pre-verified code that is fully functional and conforms to the target micro-expression (e.g., the correct logic here must be iadd and not isub).

[0207] In the formula for calculating the semantic reconstruction loss, since Java bytecode is a stack-based language, the validity of the current instruction strictly depends on the previous instructions (e.g., only if two PUSH instructions were executed previously is the current ADD instruction valid). Ensure that the model makes predictions based on the complete stack state context.

[0208] In the formula for calculating the semantic reconstruction loss, It serves as the first line of defense to ensure that the generated code is compilable, runnable, and logically intact, preventing damage caused by excessive pursuit of microscopic watermark representation (adversarial loss). This can lead to code logic anomalies (such as generating non-existent local variable indices). It is the "cornerstone" of the entire network. The code instruction sequence Y generated by the constraint generator G must be highly consistent with the input sequence X in terms of semantic function (i.e., ensure that the code logic is correct and does not change the original meaning of the program).

[0209] The robustness loss against disturbances is obtained by the discriminator's accuracy in recognizing watermarked signals from the generated features after being perturbed by the latent semantic space virtual obfuscator. The calculation formula is as follows:

[0210]

[0211] In the formula, x represents the input raw bytecode sequence; c represents the watermark signal to be embedded; G(x,c) represents the mathematical expectation operator; G(x,c) represents the watermarked code (or its characteristic representation) generated by the generator G based on the original code x and the watermark signal c, which has not yet undergone obfuscation, compression or rearrangement. This represents the forward propagation process of the "latent semantic space virtual obfuscator"; This indicates that the discriminator D, given the input (here after...), Under the condition of (confused features), correctly predict the posterior probability of the original watermark c; This means that probability maximization is achieved by minimizing the negative log-likelihood. This is equivalent to maximizing the watermark's survival rate under obfuscation attacks.

[0212] The mathematical expectation operator represents the average calculation result of all "code-watermark" data pairs in the current training batch.

[0213] In the formula for calculating the disturbance robustness loss, The initially generated watermarked carrier code G(x,c) is used as input, and operations such as structured Dropout and semantic drift noise are applied to output a simulated damaged feature representation. This step mathematically simulates the state of the code after it has been obfuscated by ProGuard or suffered from network transmission losses.

[0214] The disturbance robustness loss simulates the harsh environment in the "digital carrier propagation link," forcing the generator to find those disturbances that, even after passing through... Even if there is no meaningful code elimination or instruction rearrangement, the deep features that can still be accurately identified by the generator can be used to embed the watermark.

[0215] The micro-instruction preference consistency loss is obtained by the probability value of the discriminator performing binary classification to determine whether the feature sequence output by the generator is true or false. This loss is used to constrain the instruction sequence generated by the generator to statistically approximate the micro-coding paradigm of the real bytecode. The formula for calculating the micro-instruction preference consistency loss is as follows:

[0216]

[0217] In the formula, This represents the watermarked code (or its feature vector) output by the generator, which is free from any interference. This represents the predicted probability of the discriminator (or an independent auxiliary classifier) ​​for the watermark category of the input sample. For example, if the input is a piece of code containing a large number of iconst_1s, the discriminator should output P(c=0) with high confidence. 1; - Minimizing this value is equivalent to maximizing classification accuracy, which means that the generator must generate code that matches the watermark bit c feature with 100% accuracy in an ideal environment of "noise-free and confusion-free" conditions; x represents the original input bytecode sequence; c represents the target watermark information to be embedded. The mathematical expectation operator refers to the average calculation result for all "code-watermark" data pairs in the current training batch.

[0218] The micro-instruction preference consistency loss is used for baseline feature alignment and to prevent the generator from producing overly strange or ambiguous code in order to excessively cater to anti-obfuscation requirements (robustness).

[0219] The balancing hyperparameters are non-negative real numbers used to adjust the semantic reconstruction loss, perturbation robustness loss, and micro-instruction preference consistency loss. For example, setting... =0.5, =1.0 means that, while ensuring semantic correctness, priority is given to ensuring the extractability of the watermark, while also taking into account the ability to resist interference.

[0220] Step S400. Input the original Java bytecode instruction sequence to be protected and the target watermark information into the generative adversarial network, and the generator outputs a Java bytecode instruction sequence that is semantically equivalent and embeds the target watermark information.

[0221] The "target watermark information" refers to valid data such as the original copyright or user identifier to be embedded. The "target watermark signal" refers to the conditional input signal used to control the generator, obtained by encoding the target watermark information (such as error correction encoding).

[0222] The original Java bytecode instruction sequence to be protected and the target watermark information are input into the generative adversarial network, and the generator outputs a Java bytecode instruction sequence that is semantically equivalent and embeds the target watermark information, including steps S410 to S450.

[0223] Step S410. Map the original Java bytecode instruction sequence to the original feature sequence through the feature embedding layer.

[0224] Step S420. Input the original feature sequence into the context encoder of the generator to extract and output the latent semantic feature matrix.

[0225] In some embodiments of this example, the original feature sequence is input into the context encoder of the generator to extract and output the latent semantic feature matrix, including: mapping each instruction in the original bytecode sequence to an opcode feature vector and an operand feature vector respectively; fusing the opcode feature vector and the operand feature vector and superimposing positional encoding to form an instruction-level feature vector; inputting the instruction-level feature vector sequence into the context encoder, extracting the contextual dependencies between instructions through a self-attention mechanism, and generating the latent semantic feature matrix.

[0226] Step S430. Perform algebraic error correction encoding on the target watermark information, and use the micro-paradigm injection decoder's conditional embedding layer in the generator to map the encoded target watermark signal into an isomorphic paradigm embedding vector.

[0227] In some embodiments of this example, the target watermark information is algebraically error-corrected and encoded, and the encoded target watermark signal is mapped to an isomorphic paradigm embedding vector by using the conditional embedding layer of the micro-paradigm injection decoder in the generator. This includes: performing error-correcting encoding on the original watermark information to generate a watermark encoding sequence with redundant check bits; and inputting each watermark signal in the watermark encoding sequence to the pre-trained conditional embedding layer in the generator to map it to the corresponding isomorphic paradigm embedding vector.

[0228] The error correction coding uses the Reed-Solomon coding algorithm.

[0229] In this embodiment, by introducing algebraic error correction capability at the original payload level of bytecode isomorphic mapping, it is ensured that even if the subsequent bytecode undergoes obfuscation or re-optimization, its underlying instruction selection logic still has mathematical self-healing characteristics.

[0230] Step S440. Input the latent semantic feature matrix and the isomorphic paradigm embedding vector into the micro-paradigm injection decoder; under the semantic constraints of the latent semantic feature matrix, the micro-paradigm injection decoder decodes the target instruction sequence with the isomorphic paradigm embedding vector as a condition to generate a target instruction sequence that is semantically equivalent to the original sequence and embeds watermark statistical features.

[0231] In some embodiments of this example, the process of the micro-paradigm injection decoder generating the target instruction sequence is an autoregressive process, and a cross-attention mechanism is introduced to fuse the latent semantic feature matrix with the isomorphic paradigm embedding vector, wherein the isomorphic paradigm embedding vector produces a directional bias on the instruction selection probability distribution.

[0232] In this embodiment, the isomorphic paradigm embedding vector generates a directional bias on the instruction selection probability distribution, thereby increasing the generation probability of a specific isomorphic instruction (such as a specific SIPUSH or stack operation combination) corresponding to the current error correction code bit.

[0233] In this embodiment, during the autoregressive generation process, the state changes of the Java Virtual Machine operand stack are simulated in real time, and the instruction generation paths that lead to illegal stack states are backtracked and penalized, which is equivalent to having a built-in dynamic virtual execution verifier.

[0234] Step S450. Restore the target instruction sequence to bytecode opcodes and operands that conform to the Java Virtual Machine Specification, recalculate the control flow jump address, and generate an executable file that conforms to the bytecode format specification.

[0235] In some embodiments of this example, the original Java bytecode instruction sequence to be protected and the target watermark information are input into the generative adversarial network, and the generator outputs a Java bytecode instruction sequence that is semantically equivalent and embeds the target watermark information. The method further includes:

[0236] Step S460. Perform static verification of the bytecode format and stack balance of the executable file.

[0237] For example, the JVM standard verifier is invoked to perform format and stack balance checks to ensure that the generated code can be run directly without side effects.

[0238] In some implementations of this embodiment, if the legality verification fails, the verification failure information is used as feedback to trigger step S440 to regenerate the target instruction sequence, or after the preset number of retries is exhausted, an alternative file is output that only performs lightweight obfuscation processing on the original bytecode sequence, thereby ensuring that in extreme cases, the functional availability of the business system is not affected by the watermark implantation process.

[0239] In some embodiments of this example, the method further includes a watermark extraction step, which includes steps S510 to S540.

[0240] Step S510. The Java bytecode instruction sequence to be detected is mapped to the original feature sequence through the feature embedding layer.

[0241] Step S520. Input the original feature sequence into the robust watermark extractor of the discriminator; the robust watermark extractor calculates the posterior probability of each instruction unit in the original feature sequence corresponding to different watermark micro-paradigms, and generates a watermark bit decision sequence based on the posterior probability of all instruction units by accumulating scores through the log-likelihood ratio mechanism.

[0242] In some embodiments of this example, the formula for calculating the cumulative score is:

[0243]

[0244] In the formula, Score represents the cumulative decision score; t represents the t-th instruction currently being analyzed; T represents the total number of instructions in the current decision window; This represents the feature vector corresponding to the t-th instruction unit or basic block; and These represent the posterior probabilities of the discriminator determining that the unit belongs to the first or second micro-paradigm; This indicates that multiplication will be converted to addition (for easier accumulation), a zero-point reference will be provided (automatic filtering), and numerical stability will be ensured (to prevent underflow). This represents the cumulative log-likelihood ratio (LLR) score along the execution path of the control flow graph (CFG).

[0245] The cumulative decision score is the result of the entire formula calculation and is a real value (-∞, +∞). The cumulative decision score represents the final tendency strength of the currently detected code segment (such as a method body) to hide bit 1 or bit 0: if Score ≫ 0 (a very large positive number), it means that the cumulative evidence strongly points to watermark bit 1; if Score ≪ 0 (a very small negative number), it means that the cumulative evidence strongly points to watermark bit 0; if Score ≈ 0, it means that the evidence is conflicting or the feature is severely damaged, and it is judged as "erased / uncertain".

[0246] Java bytecode is a linear stream of instructions. For example, t=1 is aload_0, t=2 is getfield.

[0247] T is the length of a basic block or a method. The larger T is, the more instructions participate in the "voting", and the stronger the anti-obfuscation capability (because the local semantic perturbations of a single instruction will be averaged out).

[0248] It contains semantic information about the instruction's opcode (e.g., iconst_1) and operand (e.g., 1), which is the raw data input to the discriminator D.

[0249] Corresponding to the probability of "non-compact / general-purpose idiomatic", instructions tend to explicitly carry operands or use more general opcodes. For example, when the discriminator encounters bipus 1 (2 bytes) or ldc #index (2 bytes), the probability approaches 1.

[0250] Corresponding to the probability of "compact / dedicated idiomatic", the instructions tend to use JVM predefined zero-operand shortcut instructions. For example, when the discriminator encounters iconst_1 (1 byte) or aload_0 (1 byte), the probability approaches 1.

[0251] This is used to calculate the difference in evidence strength between two mutually exclusive idiomatic expressions. The decision logic is as follows: when encountering bipush1, the numerator is larger than the denominator, and the Log value is positive (+Score); when encountering iconst_1, the numerator is smaller than the denominator, and the Log value is negative (-Score); when encountering return (an instruction with no obvious isomorphic paradigm tendency), the numerator and denominator are approximately equal, and the Log value is 0 (automatically filtering out invalid instructions).

[0252] In this embodiment, the mechanism of cumulative log-likelihood ratio scoring along the execution path of the control flow graph utilizes the law of large numbers to eliminate observation noise caused by random perturbations of the obfuscator (such as insertion of nop) in a single instruction.

[0253] Step S530. Based on the preset algebraic error correction coding rules, perform global consistency verification and error correction on the watermark bit decision sequence to reconstruct the complete watermark coding sequence.

[0254] The preset algebraic error correction coding rule is the algebraic constraint rule of Reed-Solomon coding used in the watermark embedding stage.

[0255] The global consistency verification and error correction specifically includes: for segments with "low confidence intervals", using the algebraic relationship of the remaining high confidence segments, reconstructing the lost information through interpolation calculation; when the predicted sequence does not meet the global polynomial constraint, calculating the error position and flipping the abnormal bit, forcing a regression to the mathematically most likely original watermark state.

[0256] Step S540. Decode the watermark encoding sequence, remove redundant check symbols introduced by error correction encoding, restore and output the original valid watermark payload information.

[0257] In some embodiments of this example, the decoding operation corresponds to the error correction coding algorithm used by the embedding end, and is used to recover the valid information bit stream from the watermark coding sequence, and then convert the valid information bit stream into readable text or identification information according to a preset character encoding format for output.

[0258] In this embodiment, the verification symbols introduced by the RS algorithm are removed, and only the valid information symbols are retained; the remaining valid binary stream is converted into a string according to the UTF-8 or ASCII encoding rules, and the final copyright ownership information (such as "Copyright©2025") is output, thus completing the evidence collection loop.

[0259] The second aspect of this embodiment discloses a Java bytecode hidden watermarking device based on latent semantic adversarial generation, such as... Figure 2 As shown, the device includes a data construction module, a network construction module, a training module, and a watermark embedding module.

[0260] The data construction module is used to construct a training dataset containing multiple semantically equivalent code pairs, each of which contains two Java bytecode fragments that have the same function but different instruction sequences.

[0261] The network building module is used to construct a generative adversarial network based on the Transformer architecture, wherein the generative adversarial network includes a feature embedding layer, a generator, a latent semantic space virtual obfuscator, and a discriminator.

[0262] The feature embedding layer serves as a shared input interface between the generator and the discriminator, used to map discrete Java bytecode instruction sequences into original feature sequences composed of continuous numerical vectors.

[0263] The generator is a sequence generation model based on the Transformer architecture, used to map the original feature sequence to an output feature sequence that is semantically equivalent to and embeds the target watermark signal, based on the target watermark signal.

[0264] The latent semantic space virtual obfuscator is located between the generator and the discriminator, and is used to apply a differentiable semantic preservation perturbation to the output feature sequence.

[0265] The discriminator is used to identify the watermark signal of the feature sequence after it has been perturbed by the latent semantic space virtual obfuscator.

[0266] The training module is used to perform alternating adversarial training on the generator and the discriminator based on the training dataset, using the latent semantic space virtual obfuscator to perturb the output feature sequence of the generator and the discriminator to identify the watermark signal of the perturbed feature sequence as adversarial conditions.

[0267] The watermark embedding module is used to input the original Java bytecode instruction sequence to be protected and the target watermark information into the generative adversarial network, and the generator outputs a Java bytecode instruction sequence that is semantically equivalent and embeds the target watermark information.

[0268] In some embodiments of this example, the device further includes a watermark extraction module, which is used to: map the Java bytecode instruction sequence to be detected into an original feature sequence through the feature embedding layer; input the original feature sequence into the robust watermark extractor of the discriminator; the robust watermark extractor calculates the posterior probability of each instruction unit in the original feature sequence corresponding to different watermark micro-paradigms, and generates a watermark bit decision sequence by accumulating scores based on the posterior probabilities of all instruction units through a log-likelihood ratio mechanism; performs global consistency verification and error correction on the watermark bit decision sequence based on preset algebraic error correction coding rules, and reconstructs a complete watermark coding sequence; decodes the watermark coding sequence, removes redundant verification symbols introduced by error correction coding, restores and outputs the original valid watermark payload information.

[0269] It should be noted that those skilled in the art will clearly understand that, for the sake of convenience and brevity, the specific working process of the system or device described above can be referred to the corresponding process in the foregoing method embodiments, and will not be repeated here.

[0270] The specific embodiments described above further illustrate the purpose, technical solution, and beneficial effects of the present invention. It should be understood that the above description is only a specific embodiment of the present invention and is not intended to limit the scope of protection of the present invention. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of the present invention should be included within the scope of protection of the present invention.

Claims

1. A Java bytecode implicit watermarking method based on latent semantic adversarial generation, characterized in that, include: Construct a training dataset containing multiple semantically equivalent code pairs, each of which contains two Java bytecode fragments that are functionally identical but have different instruction sequences; Construct a generative adversarial network based on the Transformer architecture, wherein the generative adversarial network includes: The feature embedding layer, as the input interface shared by the generator and discriminator, is used to map discrete Java bytecode instruction sequences into original feature sequences composed of continuous numerical vectors. The generator is a sequence generation model based on the Transformer architecture, used to map the original feature sequence into a semantically equivalent output feature sequence that embeds the target watermark signal based on the received target watermark signal; A latent semantic space virtual obfuscator, located between the generator and the discriminator, is used to apply a differentiable semantic preservation perturbation to the output feature sequence; The discriminator is used to identify the watermark signal of the feature sequence after it has been perturbed by the latent semantic space virtual obfuscator. Based on the training dataset, the generator and the discriminator are trained alternately against each other by perturbating the output feature sequence of the generator using the latent semantic space virtual obfuscator and identifying the watermark signal of the perturbated feature sequence by the discriminator. The original Java bytecode instruction sequence to be protected and the target watermark information are input into the generative adversarial network, and the generator outputs a Java bytecode instruction sequence that is semantically equivalent and embeds the target watermark information. The latent semantic space virtual obfuscator includes a set of differentiable perturbation operators for applying semantically preserving perturbations to the feature space, the differentiable perturbation operators including: The first operator is used to perform a structured random masking operation on the input feature sequence; The second operator is used to superimpose random noise onto the input feature sequence; The third operator is used to perform differentiable permutation operations based on Gumbel-Softmax on the local features of the input feature sequence.

2. The Java bytecode implicit watermarking method based on latent semantic adversarial generation according to claim 1, characterized in that, Constructing a training dataset containing multiple equivalent code pairs includes the following steps: Obtain the raw bytecode file; The original bytecode file is subjected to semantically preserved code transformation to generate a corresponding variant bytecode file; wherein, the code transformation includes instruction equivalent substitution and / or control flow equivalent reconstruction; Extract the control flow graphs from the original bytecode file and the variant bytecode file respectively; The instructions that must be preserved during the semantic equivalence transformation are extracted from the instructions contained in the control flow graphs of the original bytecode file and the variant bytecode file, respectively, and used as alignment anchors; wherein, the instructions that must be preserved include method call instructions and / or field access instructions; Based on the relative topological order of the alignment anchors in their respective instruction sequences, the longest common subsequence algorithm is used to determine the semantic invariant sequence shared between the original bytecode file and the variant bytecode file, wherein the semantic invariant sequence is composed of the alignment anchors; Based on the semantic invariant sequence, locate the basic blocks corresponding to the topological positions in the control flow graphs of the original bytecode file and the variant bytecode file, respectively. The basic blocks corresponding to the topological positions are paired to form candidate basic block pairs; For each candidate basic block pair, verify whether its input stack frame state and output stack frame state are compatible, and construct a semantically equivalent code pair from the instruction sequence contained in the verified candidate basic block pair. All the semantically equivalent code pairs are brought together to form the training dataset.

3. The Java bytecode implicit watermarking method based on latent semantic adversarial generation according to claim 1, characterized in that, Mapping discrete Java bytecode instruction sequences into a raw feature sequence composed of continuous numerical vectors includes: A learnable opcode embedding matrix is ​​established, and the opcode at each position index in the discrete input bytecode sequence is mapped to a continuous opcode feature vector through a lookup table operation; An operand embedding subnet is established, and based on the operand type, numeric operands, reference operands, and instructions without operands are mapped to operand feature vectors respectively; Based on a preset feature fusion function, the opcode feature vector and the operand feature vector are fused to generate an instruction-level fused feature vector. The instruction-level fused feature vector is subjected to layer normalization processing; Generate a corresponding position encoding vector based on the position index of each instruction in the sequence; The normalized instruction-level fused feature vector is added to the position encoding vector of the corresponding time position to form the final feature vector of that instruction position; The final feature vectors corresponding to all instruction positions are aggregated to form the original feature sequence representing the entire input bytecode sequence.

4. The Java bytecode implicit watermarking method based on latent semantic adversarial generation according to claim 1, characterized in that, The generator includes a sequentially connected context encoder and a micro-paradigm injection decoder; The context encoder is used for: Receive the original feature sequence generated by the feature embedding layer; The attention weights between instructions in the original feature sequence are calculated through a multi-head self-attention mechanism to capture its deep syntactic dependencies and control flow logic, thereby generating context-enhanced feature representations. The context-enhanced feature representation is nonlinearly mapped and dimensionally transformed using a feedforward neural network. Generate and output a latent semantic feature matrix containing the complete program logic; The micro-paradigm injection decoder is used for: Receive the latent semantic feature matrix and target watermark signal output by the context encoder; The target watermark signal is mapped into an isomorphic paradigm embedding vector through a conditional embedding layer, and the isomorphic paradigm embedding vector is fused with the feature representation of the generated instruction sequence. The fused feature representation is encoded by a self-attention layer with a lower triangular mask matrix to maintain the autoregressive properties of the generation process. By using the paradigm injection cross-attention mechanism, the latent semantic feature matrix is ​​modulated with the isomorphic paradigm embedding vector as a condition to obtain watermarked context features. The watermarked context features are mapped to the probability distribution of the target instruction on the global vocabulary by the output projection layer; Based on the probability distribution, an output feature sequence is generated in an autoregressive manner, which is semantically equivalent to the input sequence and embeds the target watermark signal.

5. The Java bytecode implicit watermarking method based on latent semantic adversarial generation according to claim 1, characterized in that, The discriminator is a dual-stream discriminant network, which includes: A semantic consistency discriminator is used to distinguish whether the input feature sequence is natural code from a real project or synthetic code created by the generator; A robust watermark extractor is used to receive the feature sequence after it has been perturbed by the latent semantic space virtual obfuscator, and decode and restore the original watermark signal from it.

6. The Java bytecode implicit watermarking method based on latent semantic adversarial generation according to claim 1, characterized in that, Alternating adversarial training is performed on the generator and the discriminator, including: Repeat the discriminator optimization step and the generator optimization step until the generative adversarial network reaches the preset convergence condition; The discriminator optimization step includes: freezing the parameters of the generator, inputting the feature sequence synthesized by the generator and the real bytecode sample into the discriminator, calculating the discriminator's own discrimination loss, and updating the discriminator's parameters based on the discrimination loss; The generator optimization step includes: freezing the parameters of the discriminator, inputting the original bytecode feature sequence and the target watermark signal into the generator, and updating the parameters of the generator based on a joint loss function; The joint loss function is a weighted sum of semantic reconstruction loss, disturbance robustness loss, and micro-instruction preference consistency loss. The semantic reconstruction loss is obtained by calculating the difference between the instruction sequence output by the generator and the corresponding target instruction sequence obtained from the training dataset; The robustness loss against disturbances is obtained by the discriminator based on the accuracy of watermark signal recognition of the generated features after being disturbed by the virtual obfuscator in the latent semantic space. The micro-instruction preference consistency loss is obtained by the probability value of the discriminator performing a binary classification to determine whether the feature sequence output by the generator is true or false.

7. The Java bytecode implicit watermarking method based on latent semantic adversarial generation according to claim 1, characterized in that, The original Java bytecode instruction sequence to be protected and the target watermark information are input into the generative adversarial network. The generator outputs a semantically equivalent Java bytecode instruction sequence that embeds the target watermark information, including: The original Java bytecode instruction sequence is mapped to the original feature sequence through the feature embedding layer; The original feature sequence is input into the context encoder of the generator to extract and output the latent semantic feature matrix; The target watermark information is algebraically error-corrected and encoded, and the encoded target watermark signal is mapped to an isomorphic paradigm embedding vector by using the conditional embedding layer of the decoder injected with the micro-paradigm in the generator. The latent semantic feature matrix and the isomorphic paradigm embedding vector are input into the micro-paradigm injection decoder; the micro-paradigm injection decoder decodes under the semantic constraints of the latent semantic feature matrix and with the isomorphic paradigm embedding vector as a condition, generating a target instruction sequence that is semantically equivalent to the original sequence and embeds watermark statistical features. The target instruction sequence is restored to bytecode opcodes and operands that conform to the Java Virtual Machine Specification, and the control flow jump address is recalculated to generate an executable file that conforms to the bytecode format specification. Static verification of the bytecode format and stack balance of the executable file is performed.

8. The Java bytecode implicit watermarking method based on latent semantic adversarial generation according to claim 1, characterized in that, The method further includes a watermark extraction step, which includes: The feature embedding layer maps the Java bytecode instruction sequence to be detected into the original feature sequence. The original feature sequence is input into the robust watermark extractor of the discriminator; the robust watermark extractor calculates the posterior probability of each instruction unit in the original feature sequence corresponding to different watermark micro-paradigms, and generates a watermark bit decision sequence by accumulating scores based on the posterior probabilities of all instruction units through a log-likelihood ratio mechanism. Based on the preset algebraic error correction coding rules, the watermark bit decision sequence is subjected to global consistency verification and error correction to reconstruct the complete watermark coding sequence. The watermark encoding sequence is decoded, redundant check symbols introduced by error correction encoding are removed, and the original valid watermark payload information is restored and output.

9. A Java bytecode implicit watermarking device based on latent semantic adversarial generation, characterized in that, include: A data construction module is used to construct a training dataset containing multiple semantically equivalent code pairs, each of which contains two Java bytecode fragments that are functionally identical but have different instruction sequences; A network building module is used to construct a generative adversarial network based on the Transformer architecture, wherein the generative adversarial network includes: The feature embedding layer, as the input interface shared by the generator and discriminator, is used to map discrete Java bytecode instruction sequences into original feature sequences composed of continuous numerical vectors. The generator is a sequence generation model based on the Transformer architecture, used to map the original feature sequence into a semantically equivalent output feature sequence that embeds the target watermark signal based on the received target watermark signal; A latent semantic space virtual obfuscator, located between the generator and the discriminator, is used to apply a differentiable semantic preservation perturbation to the output feature sequence; The discriminator is used to identify the watermark signal of the feature sequence after it has been perturbed by the latent semantic space virtual obfuscator. The training module is used to perform alternating adversarial training on the generator and the discriminator based on the training dataset, using the latent semantic space virtual obfuscator to perturb the output feature sequence of the generator and the discriminator to identify the watermark signal of the perturbated feature sequence as adversarial conditions. The watermark embedding module is used to input the original Java bytecode instruction sequence to be protected and the target watermark information into the generative adversarial network, and the generator outputs a Java bytecode instruction sequence that is semantically equivalent and embeds the target watermark information. The latent semantic space virtual obfuscator includes a set of differentiable perturbation operators for applying semantically preserving perturbations to the feature space, the differentiable perturbation operators including: The first operator is used to perform a structured random masking operation on the input feature sequence; The second operator is used to superimpose random noise onto the input feature sequence; The third operator is used to perform differentiable permutation operations based on Gumbel-Softmax on the local features of the input feature sequence.

Images