An active defense and access control method for deep learning models

Abstract

The application belongs to the technical field of artificial intelligence security and model intellectual property protection, and discloses an active defense and access control method for a deep learning model, which comprises the following steps: S1, generating a scalar license sequence based on a private key parameter, and dividing a training round into multiple stages, so that the stage indexes are consistent and the license values corresponding to the indexes in the license sequence are read; S2, constructing an authorized channel set in combination with channel static importance evaluation and channel chaos score, generating an authorized mask and an unauthorized mask; S3, respectively calculating authorized task loss and unauthorized confusion loss and jointly optimizing, and simultaneously implementing reset and gradient freezing on the parameters corresponding to the authorized channel set at the beginning of the training stage; S4, during model deployment and reasoning, the authorized end reconstructs the license sequence according to the shared key and generates the authorized mask for reasoning, and the unauthorized end outputs performance degradation. The application improves the robustness to adaptive attacks and maintains the performance gap between authorized and unauthorized.

Description

Technical Field

[0001] This invention belongs to the field of artificial intelligence security and model intellectual property protection technology, specifically relating to an active defense and access control method for deep learning models, and more particularly to an active defense and access control method for distribution and deployment in edge devices / AIoT scenarios, used to restrict the inference ability of a model when it is obtained or copied without authorization, and to maintain the normal availability of the model under authorized conditions. Background Technology

[0002] With the deep integration of artificial intelligence and the Internet of Things (IoT), deep learning models are widely deployed in scenarios such as industrial control, autonomous driving, security monitoring, and telemedicine. Unlike traditional centralized inference in the cloud, AIoT scenarios often require distributing compressed and optimized lightweight models to a large number of edge terminals for local inference to reduce latency and bandwidth overhead. However, edge terminals are usually physically accessible or operate in untrusted environments, making model parameters and execution processes more vulnerable to potential attackers. This can lead to intellectual property risks such as model theft, illegal copying, secondary distribution, and misuse. After obtaining the model files, attackers can further extract model weights or intermediate features through dynamic debugging, memory dumping, and interface hijacking. They can also fine-tune, distill, or prune their own data to bypass existing protection logic and restore model usability.

[0003] To address the aforementioned risks, existing intellectual property protection and access control schemes can be broadly categorized as follows:

[0004] (1) Passive verification schemes: such as watermarking and fingerprinting, which embed verifiable information in model parameters or output behavior to achieve post-event traceability. These schemes usually focus on "confirmation of rights and evidence", but it is difficult to block infringement in real time when it occurs, and the embedded information may be weakened or removed after fine-tuning, pruning or statistical elimination.

[0005] (2) Hardware isolation solutions: These solutions rely on a trusted execution environment or dedicated secure hardware to enable model inference to be executed within a protected area. These solutions offer strong security, but they are highly dependent on terminal hardware and system ecosystems, have high costs and deployment barriers, and their scalability is limited in heterogeneous large-scale AIoT environments.

[0006] (3) Cryptographic / encrypted inference schemes: These schemes protect the privacy of model parameters and input / output through homomorphic encryption, encrypted weights, or encrypted inference processes. These schemes typically introduce significant computational and energy overhead, making it difficult to meet the real-time inference requirements of resource-constrained edge devices.

[0007] (4) Model-intrinsic lock / structure binding schemes: Key-related parameters, normalized branches, or neuron pathway control are introduced into the network structure to ensure that the model maintains high accuracy only when specific key conditions are met. This type of scheme has the advantages of not relying on dedicated hardware and relatively lightweight structural modifications. However, when faced with adaptive attacks such as low-cost fine-tuning (gradient cover), pruning and retraining, or reverse engineering to infer keys, there is often a risk of "decreased authorized accuracy" or "rebound in unauthorized accuracy", resulting in unstable protection effects.

[0008] Therefore, there is an urgent need for a proactive defense and access control method for deep learning models. Summary of the Invention

[0009] The purpose of this invention is to provide an active defense and access control method for deep learning models, which addresses the following problems in existing model intellectual property protection schemes: First, unauthorized parties can still directly infer the model after obtaining it, or restore its availability through low-cost fine-tuning / pruning, making it difficult to achieve pre-emptive blocking; Second, some protection schemes rely on dedicated hardware or cryptographic inference, resulting in high deployment thresholds and large inference overhead; Third, existing lightweight model intrinsic locking schemes struggle to balance authorization accuracy, unauthorized degradation, and resistance to adaptive attacks.

[0010] To achieve the above objectives, this invention provides a proactive defense and access control method for deep learning models, comprising the following steps:

[0011] S1. Based on the private key parameters, a deterministic scalar license sequence is generated through Chebyshev chaotic mapping, and the training rounds are divided into multiple stages according to the preset stage length, so that the stage index is consistent within the same stage and the license value of the corresponding index in the license sequence is read.

[0012] S2. Based on the channel static importance assessment results and the channel chaos score obtained by index mapping from the license sequence, construct a set of authorized channels related to the stage, and generate authorized and unauthorized masks based on the set of authorized channels to modulate the feature propagation path;

[0013] S3. Calculate the authorized task loss and the unauthorized confusion loss separately on the same batch of data and optimize them together. At the same time, at the beginning of the training phase, reset the parameters corresponding to the authorized channel set and freeze the gradient to bind the effective function of the model with the license conditions and obtain the protected model.

[0014] S4. When the protected model is deployed for inference, the authorized end reconstructs the license sequence based on the shared key and generates an authorization mask for inference. The unauthorized end suffers from degraded output performance because it cannot generate a valid mask consistent with the stage.

[0015] In a specific implementation, in step S1, it specifically includes the following steps:

[0016] S1.1. Private key setting: The model provider selects private key parameters, which are shared with the authorized party under authorization conditions and are used to reproduce the same license sequence at the deployment end; the private key parameters include the chaos order n and the initial state x0, where n is an integer greater than or equal to 2, and x0 ∈ [-1, 1];

[0017] S1.2. Chaos iteration and transformation: According to the iteration relationship of the Chebyshev chaos mapping x t+1 =T n (x t ) = cos(n·arccos(x t )) for iteration, where x t is the chaos state before iteration, x t ∈ [-1, 1], x t+1 is the chaos state after iteration, x t+1 ∈ [-1, 1]; generate the original chaos mapping sequence {x t}, where t = 1, 2,..., L, and L is the preset sequence length; map the original chaos mapping sequence {x t} to the preset numerical range [a, b] through the affine transformation c t = a + (x t + 1)(b - a) / 2 to form the license sequence {c t}, where a < b is the preset mapping boundary;

[0018] S1.3. Deterministic reading of the license sequence: The license sequence {c t} is stored as an indexable data structure with a length of L, supporting random access with a time complexity of O(1) to ensure that the same license value can be reproduced at the deployment end and the training end based on the same key and index t;

[0019] S1.4. Phase synchronization: The training process is segmented by a fixed span k, and each segment is recorded as a phase, and the phase index is recorded as , where , and E is the total number of training rounds; at the beginning of each phase, take out the license value t of from the license sequence {c } and keep it unchanged during all training cycles of this phase; based on the same license sequence {c t}, within this phase, the phase index can be used as the seed index, and through the deterministic index mapping function calculate the reading index corresponding to layer channel c, and take the license value of this index As channel chaos score This is used to build a set of authorized channels related to the construction phase.

[0020] In one specific implementation, step S2 specifically includes the following steps:

[0021] S2.1 Target Layer and Static Evaluation: Select one or more target layers in the pre-trained model and use... Presentation layer index; for each target layer For each output channel c, a static importance score is calculated based on the absolute value statistics of the pre-trained weights of each target layer. The absolute value statistic is one of the L1 norm, L2 norm, or mean; and for Normalization yields To eliminate scale differences between different layers;

[0022] S2.2 Constructing the authorized channel set: Let the first... The total number of channels in the layer is Set the channel selection factor γ and the stage locking ratio. Determine the number of authorized channels: ,in For preset constants or preset scheduling values; authorized channel set From the core set With dynamically expanded collections They are composed of a core set determined based on static importance and a dynamic expansion set determined based on channel chaos scores.

[0023] S2.3 Construction of Chaotic Scores for Dynamically Expanded Sets: Based on License Sequence {c t Constructing Channel Chaos Scores In excluding the core set In the remaining channels, based on channel chaos score Perform Top-K selection or deterministic sampling to form a dynamically expanding set. This ensures that the authorized channel set is license-sensitive and reproducible;

[0024] S2.4, Mask Generation and Modulation: Based on the aforementioned authorized channel set Generate authorization mask With unauthorized mask The mask is a vector with the same dimension as the feature map channel; authorization mask. Belonging to The channel is assigned a first modulation value, for those not belonging to The channel is assigned a second modulation value; unlicensed mask A third preset value is assigned to the channel and a perturbation is superimposed; the feature is modulated by element-wise multiplication at the channel level during forward propagation; during forward propagation, the mask and the layer output feature map are multiplied element-wise by channel to achieve modulation of the feature propagation path.

[0025] In one specific implementation, the target layer is a convolutional layer or a fully connected layer;

[0026] When the target layer is a convolutional layer, the convolutional layer calculates the static importance score using the absolute value statistics of the weights of the convolutional kernel corresponding to the channels; when the target layer is a fully connected layer, the fully connected layer calculates the static importance score using the absolute value statistics of the weight vectors corresponding to the output neurons.

[0027] Core Collection Take the one with the highest static importance There are 1 channel, where β is the proportion of the most important core channel, β∈[0,1]; dynamically expanding set. It is excluding Then, select from the remaining channels based on the deterministic chaos score. It consists of several channels, thus satisfying .

[0028] In one specific implementation, step S3 specifically includes the following steps:

[0029] S3.1 Training Settings: Use the target task dataset for training, and set the total number of training rounds E, stage length k, channel selection coefficient γ, and stage lock ratio. Importance core percentage β, and loss weight w auth And the balance coefficient α(e), wherein α(e) is a preset constant or a scheduling value that varies with the training rounds;

[0030] S3.2 Determining the Stage and Authorization Channel Set: When training round e enters stage... hour, Determine the stage index and from the license sequence {c t Reading index in} License value Simultaneously, construct each protected layer according to step S2. With licensed / unlicensed masks;

[0031] S3.3, Structure-Sensitive Gradient Freezing: At the beginning of each training phase, gradient freezing is applied to gradients belonging to the authorized channel set. parameter subset Execute a lock, where Indicates the first Layer and Authorized Channel Set The weight parameters associated with the corresponding output channel; Reset to pre-trained baseline weights And superimposed with tiny random perturbations Establish lock initialization; during backpropagation... Apply gradient freeze, which forces the gradient to zero or multiplies it by a gradient mask, thus keeping the set parameters unchanged during the lock period;

[0032] S3.4, Two-state training: For each batch of training data (x, y), first execute the authorized forward branch and the unauthorized forward branch, and then perform joint optimization:

[0033] S3.4.1, Authorization Forward Branch: In the authorization mask Forward propagation under certain conditions Calculate the authorized task loss ;

[0034] S3.4.2 Unauthorized Forward Branch: In the unauthorized mask Forward propagation under certain conditions When computing the unauthorized forward branch, the model is placed in evaluation mode to avoid contamination of the batch normalized layer statistics by the unauthorized forward branch, and the confusion loss is calculated. , where u is a uniform distribution;

[0035] S3.4.3 Joint Optimization: Constructing the Total Loss L total =w auth ·L lic +α(e)·L un Perform backpropagation and parameter updates; among which, the frozen Keep it from being updated;

[0036] The protected model parameters are obtained after training. .

[0037] Compared with the prior art, the present invention has the following beneficial effects:

[0038] (1) Active access control: This invention does not rely on external encryption shells or dedicated hardware, and can achieve the switching of availability / unavailability under license conditions within the model;

[0039] (2) Resistance to adaptive attacks: This invention improves the robustness to common adaptive attacks such as fine-tuning and pruning by using dual-state training and a structure-sensitive parameter locking mechanism, and maintains the performance gap between licensed and unlicensed systems.

[0040] (3) Lightweight and deployable: The present invention introduces element-wise multiplication of channel-level mask and feature during the inference stage, and the authorization mask can be pre-generated or cached in stages to reduce additional overhead, making it suitable for deployment on resource-constrained edge devices.

[0041] (4) High versatility: This invention can be applied to convolutional neural networks, Transformer and their hybrid architectures, and can be configured by selecting target layer and masking strategy under different tasks / datasets.

[0042] In addition to the objectives, features, and advantages described above, the present invention has other objectives, features, and advantages. The present invention will now be described in further detail. Attached Figure Description

[0043] The accompanying drawings, which form part of this application, are used to provide a further understanding of the invention. The illustrative embodiments of the invention and their descriptions are used to explain the invention and do not constitute an undue limitation of the invention. In the drawings:

[0044] Figure 1 This is a flowchart illustrating the principle of one embodiment of the present invention. Detailed Implementation

[0045] The embodiments of the present invention will be described in detail below. The specific embodiments described herein are merely illustrative of the present invention and are not intended to limit the present invention.

[0046] Example 1

[0047] S1. Chaos-Driven License Generation. This step details the generation of chaotic license sequences and the phase synchronization method.

[0048] S1.1 Private Key Setting: The model provider selects the following private key parameters: the chaotic order n and the initial state x0, where n is an integer ≥ 2 and x0 ∈ [-1, 1]. This key parameter is shared with the licensor under authorized conditions and is used to reproduce the same license sequence on the deployment end.

[0049] S1.2 Chaotic Iteration and Transformation: According to the iterative relationship x of the Chebyshev chaotic mapping t+1 =T n (x t )=cos(n·arccos(x t The iteration is performed, where x t Given the chaotic state before iteration, x t ∈[-1,1],x t+1 The chaotic state after iteration, x t+1 ∈[-1,1]; Generates the original chaotic mapping sequence {x t}, where t=1,2,…,L, and L is the preset sequence length; the original chaotic mapping sequence {x t}Through affine transformation c t =a+(x t +1)(ba) / 2 is mapped to the preset numerical range [a,b], forming the license sequence {c}t}, where a < b is the preset mapping boundary;

[0050] S1.3. Deterministic reading of the license sequence: The license sequence {c t} is stored as an indexable data structure with length L, supporting random access with O(1) time complexity, to ensure that the same license value can be reproduced at the deployment end and the training end based on the same key and index t.

[0051] S1.4. Phase synchronization: The training process is segmented by a fixed span k, each segment is recorded as a phase, and the phase index is recorded as , where , and E is the total number of training rounds; at the beginning of each phase, take out t from the license sequence {c of the license value , and keep it unchanged during all training cycles of this phase; based on the same license sequence {c t}, within this phase, the phase index can be used as the seed index, and through the deterministic index mapping function calculate the reading index corresponding to layer channel c, and take the license value of this index as the channel chaos score , which is used to construct the authorization channel set related to the phase.

[0052] To balance training stability and authorization dynamics, the present invention adopts a phase synchronization strategy: divide the training process into multiple consecutive phases, use a fixed license value within each phase, and update the license when switching phases. Through this design, the license sequence can be reproduced at the authorized party and is sensitive to the key, while avoiding the optimization instability and additional overhead caused by frequent license updates for each small batch.

[0053] S2. License-guided path locking. This step specifically describes the path locking operation.

[0054] S2.1. Target layer and static evaluation: Select one or more target layers (such as convolutional layers or fully connected layers with channel / neuron dimensions) in the pre-trained model, and use to represent the layer index; calculate the static importance score for each output channel c of each target layer , for convolutional layers, calculate it based on the absolute value statistic of the convolutional kernel weights corresponding to the channels, preferably calculated using the L1 norm, L2 norm or average absolute value; for fully connected layers, calculate it based on the absolute value statistic of the weight vector corresponding to the output neurons. And perform normalization on to obtain This eliminates scale discrepancies. Static importance scores can also be loaded from a pre-exported channel importance mapping file and aligned to the channel dimensions of each layer.

[0055] S2.2 Constructing the authorized channel set: Let the first... The total number of channels in the layer is Set the channel selection factor γ and the stage locking ratio. Determine the number of authorized channels: ,in This is a preset constant or preset scheduling value. Authorized channel set From a deterministic core set Dynamically Expanded Sets Related to Stages Commonly composed of: Core set Take the one with the highest static importance There are 1 channel, where β∈[0,1] represents the proportion of the most important core; the set is dynamically expanded. In exclusion Then, select from the remaining channels based on the deterministic chaos score. It consists of several channels, thus satisfying .

[0056] S2.3 Construction of Chaotic Scores for Dynamically Expanded Sets: Based on License Sequence {c t Constructing Channel Chaos Scores ,in: , For stage index Layer index And the deterministic mapping related to channel index c. Preferred. ,in A linear combination of layer number and channel number is preferred. Based on channel chaos scoring Perform Top-K selection on the remaining channels (or select channels based on chaos score). Deterministic sampling) This ensures that the authorized channel set is license-sensitive and reproducible.

[0057] S2.4, Mask Generation and Modulation

[0058] Based on the authorized channel set Generate an authorized mask and an unauthorized mask, wherein the authorized mask and the unauthorized mask are vectors with the same dimension as the feature map channel.

[0059] Authorization mask Each channel value is determined according to the following rules: for channels belonging to the authorized channel set ( The channel is assigned the first modulation value v licFor channels that do not belong to the authorized channel set ( The channel is assigned a second modulation value β. base The preferred modulation value is v. lic For importance score For calculation, a linear mapping function is preferred: In the formula, To enhance the coefficient, the preferred option is... This function enables channels with above-average importance ( Channels that receive an enhancement value greater than 1 and have an importance below average ( This allows for the acquisition of values ​​less than 1 but still close to 1, thereby maintaining numerical stability while preserving important characteristics. The first modulation value can also be obtained from a preset interval [v]. min ,v max The second modulation value β is obtained by random sampling from [the data source]. base To maintain the accuracy of authorized inference as closely as possible, we aim for a value close to 1.

[0060] Unauthorized mask Each channel value is determined according to the following rule: a third preset value β is assigned to all channels. un And superimposed disturbances That is, the soft perturbation mode is Among them, the third preset value β un The suppression constant is less than 1, and the preset perturbation is... It can be random noise, such as sampling from a uniform distribution U(-δ,δ) (soft perturbation mode), or directly set =0 (hard suppression mode), its expression degenerates to: By suppressing and perturbing the effective feature propagation path, unauthorized inference outputs tend to be less usable.

[0061] Feature modulation: Channel-level modulation is performed on the feature maps of convolutional layers or the activation vectors of fully connected layers. Specifically, for a convolutional layer, let the first channel be the channel-level modulation vector. The output feature map of the layer is Its dimensions are Where B represents the batch size, i.e. the number of input samples in one forward propagation; Indicates the first The number of output channels of the layer; H represents the height of the feature map; W represents the width of the feature map. For a fully connected layer, let the number of output channels of the layer be H; H represents the height of the feature map; W represents the width of the feature map. The output activation vector of the layer is Its dimensions are Where B represents the batch size. Indicates the first The number of output neurons in the layer. Masking. (dimensions and) (The number of channels is the same) Broadcast by channel, that is, for each channel c, the mask value is... This applies to all spatial locations of the channel (convolutional layer) or all samples of the neuron (fully connected layer). Modulated features are obtained through element-wise multiplication. , where ⊙ represents channel-level element-wise multiplication, and its operation rule is: for each channel c, we have This involves multiplying each channel value of the mask by all elements of the corresponding channel in the feature map. Through this operation, the channel propagation path is modulated and locked: features of licensed channels (with larger mask values) are preserved or enhanced, while features of unlicensed channels (with smaller mask values) are suppressed, thus binding the model's effective computational path to the licensing conditions.

[0062] S3. Two-State Optimization Training and Structure-Sensitive Gradient Freezing. This step details how, during the training phase, joint optimization using authorized / unauthorized two-state methods is performed, and structure-sensitive locking is applied to the parameters corresponding to the authorized channel set, binding the model's effective functionality to the license conditions.

[0063] S3.1 Training Settings: Use the target task dataset for training, and set the total number of training rounds E, stage length k, channel selection coefficient γ, and stage lock ratio. Importance core percentage β, and loss weight w auth And the balance coefficient α(e). Where α(e) is the dynamic balance coefficient that changes with the number of training rounds e, and α(e) can be a constant or a piecewise constant.

[0064] S3.2 Determining the Stage and Authorization Channel Set: When training round e enters stage... At that time, the stage index It is calculated by dividing the current training round number e by the stage length k and then rounding up. Determine the stage index Then, the corresponding license value is read from the license sequence. Simultaneously, construct each protected layer according to step S2. With authorized / unauthorized masks. Stage index. It remains unchanged during this phase, and The generation rules remain unchanged.

[0065] S3.3, Structure-Sensitive Gradient Freezing: At the beginning of each training phase, gradient freezing is applied to gradients belonging to the authorized channel set. parameter subset Execute a lock, where Indicates the first Layer and Authorized Channel Set The weight parameters associated with the corresponding output channel; Reset to pre-trained baseline weights And superimposed with tiny random perturbations Establish lock initialization; during backpropagation... Gradient freezing is applied, forcing the gradient to zero or multiplying it by a gradient mask, thus preventing the set parameters from being updated during the locking period. The freezing granularity is the output channel dimension, that is, freezing the output channel slices of the convolutional kernel weight tensor or the weight vectors corresponding to the output neurons of fully connected layers.

[0066] To improve robustness against fine-tuning attacks, this invention implements structure-sensitive parameter locking in each training phase: the parameter subset corresponding to the authorized channel set is reset to the pre-training baseline and a small perturbation is added, and gradient freezing (gradient zeroing or gradient masking) is applied to the subset during backpropagation in this phase, thereby restricting attackers from breaking the "license-path" binding relationship through gradient overlay.

[0067] S3.4, Two-state training: For each batch of training data (x, y), first execute the authorized forward branch and the unauthorized forward branch, and then perform joint optimization:

[0068] S3.4.1, Authorization Forward Branch: In the authorization mask Forward propagation under certain conditions Calculate the authorized task loss , where CE represents the cross-entropy loss function, softmax is the softmax activation function, and y is the true label;

[0069] S3.4.2 Unauthorized Forward Branch: In the unauthorized mask Forward propagation under certain conditions When computing the unauthorized forward branch, the model is placed in evaluation mode to avoid contamination of the batch normalized layer statistics by the unauthorized forward branch, and the confusion loss is calculated. Where u is a uniform distribution, i.e. C represents the number of categories, and KL represents the Kullback-Leibler divergence, which measures the difference between the predicted distribution and the uniform distribution.

[0070] S3.4.3 Joint Optimization: Constructing the Total Loss L total =w auth ·L lic +α(e)·L un Perform backpropagation and parameter updates; among which, the frozen Leave it unchanged, while updating the other parameters normally.

[0071] The protected model parameters are obtained after training. .

[0072] S4. Model Deployment and Inference. This step details the model deployment and usage process.

[0073] Model distribution: The provider distributes the protected model and securely distributes the private key parameters (n, x0) and phase synchronization-related configurations (such as phase length k, phase index acquisition method, etc.) to the authorized party.

[0074] Authorization reasoning: The authorized device reconstructs the license sequence {c} using the shared key (n, x0). t}, and based on the current stage index Take license value Based on this, generate / select a set of authorized channels. With authorization mask The authorization mask is injected during the forward propagation of inference to complete feature modulation, thereby outputting a normal result. Preferably, the authorization mask can be pre-generated or cached in stages to reduce real-time inference overhead.

[0075] Unauthorized access: Unauthorized devices, unable to obtain the private key or generate a valid license / mask consistent with the stage, cause the model to enter an unauthorized mask or equivalent perturbation path, resulting in a significant degradation in output performance to a low usability level. Even if an attacker obtains the protected model parameters... We attempted fine-tuning, but due to resetting and freezing key authorization parameters during the training phase, it was still difficult to restore authorization performance. We implemented proactive control and pre-emptive interception of model usage permissions.

[0076] Example 2

[0077] Experimental verification and effect analysis:

[0078] This embodiment presents the experimental setup and representative results to illustrate the effectiveness of the present invention in terms of licensed availability, unlicensed degradation, and cross-task generalization. In the experiment, "BASE" represents the performance of the baseline model without using the method of the present invention; "ChaoShield" represents the performance after using the method of the present invention, where the upper value in the same cell is the performance index under licensed conditions, and the lower value is the performance index under unlicensed conditions.

[0079] 1. Experiment setup.

[0080] 1.1 Datasets and Task Types: Several typical tasks were selected for validation, including image classification tasks (MNIST, CIFAR-10, CIFAR-100, Tiny-ImageNet), object detection tasks (PASCAL VOC), semantic segmentation tasks (CamVid), and time series classification tasks (FordA).

[0081] 1.2 Model Structure: Representative network structures were selected for validation on different tasks, including LeNet, MLP, ResNet-18 / 50 / 101, VGG-16 / 19, DenseNet-121, ShuffleNet, SENet, MobileViTv2, and EfficientFormer.

[0082] 1.3 Key Parameters: The Chebyshev key parameters (n, x0), stage span k, channel selection coefficient γ, importance core percentage β, and license mapping interval [a, b] are set according to the method described in Example 1. Under authorized conditions, the shared key and synchronization stage index are used to generate the authorization mask; under unauthorized conditions, no valid key or mismatched stage index is provided, and the model uses the unauthorized mask path or equivalent perturbation path for inference.

[0083] 1.4 Evaluation metrics: Top-1 accuracy is used for classification tasks; performance metrics corresponding to the detection task are used for object detection; performance metrics corresponding to the segmentation task are used for semantic segmentation; classification accuracy or task-specific metrics are used for time series classification.

[0084] 2. Cross-dataset classification performance and unauthorized degradation.

[0085] Table 1 presents representative results of this invention on four image classification datasets. It can be observed that, under licensed conditions, the performance of the protected model is close to that of the baseline model; under unlicensed conditions, the model performance significantly degrades and approaches the level of random guessing, thus forming a clear licensed / unlicensed performance gap.

[0086] Table 1. Performance results of ChaoShield on four classification datasets.

[0087]

[0088] 3. Cross-task and cross-architecture generalization performance.

[0089] Table 2 presents representative results of the present invention on different task types and different network structures.

[0090] Table 2 Generalization performance of ChaoShield in multi-task, multi-architecture scenarios

[0091]

[0092] The results show that the present invention is not only applicable to image classification tasks, but can also be extended to tasks such as object detection, semantic segmentation and time series classification; it can maintain task availability under authorized conditions, and still produce significant degradation effects under unauthorized conditions.

[0093] The above description, in conjunction with specific preferred embodiments, provides a further detailed explanation of the present invention. It should not be construed that the specific implementation of the present invention is limited to these descriptions. For those skilled in the art, various simple deductions and substitutions can be made without departing from the inventive concept, and all such modifications and substitutions should be considered within the scope of protection of the present invention.

Claims

1. A proactive defense and access control method for deep learning models, characterized in that, Includes the following steps: S1. Based on the private key parameters, a deterministic scalar license sequence is generated through Chebyshev chaotic mapping, and the training rounds are divided into multiple stages according to the preset stage length, so that the stage index is consistent within the same stage and the license value of the corresponding index in the license sequence is read. S2. Based on the channel static importance assessment results and the channel chaos score obtained by index mapping from the license sequence, construct a set of authorized channels related to the stage, and generate authorized and unauthorized masks based on the set of authorized channels to modulate the feature propagation path; S3. Calculate the authorized task loss and the unauthorized confusion loss separately on the same batch of data and optimize them together. At the same time, at the beginning of the training phase, reset the parameters corresponding to the authorized channel set and freeze the gradient to bind the effective function of the model with the license conditions and obtain the protected model. Step S3 specifically includes the following steps: S3.1 Training Settings: Use the target task dataset for training, and set the total number of training rounds E, stage length k, channel selection coefficient γ, and stage lock ratio. Importance core percentage β, and loss weight w auth And the balance coefficient α(e), wherein α(e) is a preset constant or a scheduling value that varies with the training rounds; S3.2 Determining the Stage and Authorization Channel Set: When training round e enters stage... hour, Determine the stage index and from the license sequence {c t Reading index in} License value Simultaneously, construct each protected layer according to step S2. Compared to authorized and unauthorized masks; S3.3, Structure-Sensitive Gradient Freezing: At the beginning of each training phase, gradient freezing is applied to gradients belonging to the authorized channel set. parameter subset Execute a lock, where Indicates the first Layer and Authorized Channel Set The weight parameters associated with the corresponding output channel; Reset to pre-trained baseline weights And superimposed with tiny random perturbations Establish lock initialization; during backpropagation... Apply gradient freeze, which forces the gradient to zero or multiplies it by a gradient mask, thus keeping the set parameters unchanged during the lock period; S3.4, Two-state training: For each batch of training data (x, y), first execute the authorized forward branch and the unauthorized forward branch, and then perform joint optimization: S3.4.1, Authorization Forward Branch: In the authorization mask Forward propagation under certain conditions Calculate the authorized task loss ; S3.4.2 Unauthorized Forward Branch: In the unauthorized mask Forward propagation under certain conditions When computing the unauthorized forward branch, the model is placed in evaluation mode to avoid contamination of the batch normalized layer statistics by the unauthorized forward branch, and the confusion loss is calculated. , where u is a uniform distribution; S3.4.3 Joint Optimization: Constructing the Total Loss L total =w auth ·L lic +α(e)·L un Perform backpropagation and parameter updates; among which, the frozen Keep it from being updated; The protected model parameters are obtained after training. ; S4. When the protected model is deployed for inference, the authorized end reconstructs the license sequence based on the shared key and generates an authorization mask for inference. The unauthorized end suffers from degraded output performance because it cannot generate a valid mask consistent with the stage.

2. The proactive defense and access control method for deep learning models according to claim 1, characterized in that, Step S1 specifically includes the following steps: S1.1 Private Key Setting: The model provider selects a private key parameter, which is shared with the authorizing party under authorized conditions and used to reproduce the same license sequence on the deployment end; the private key parameter includes the chaotic order n and the initial state x0, where n is an integer ≥2 and x0∈[-1,1]; S1.2, Chaotic Iteration and Transformation: According to the iterative relationship of the Chebyshev chaotic map \(x\) t+1 =T n (x t )) = \(\cos(n\cdot\arccos(x\) t ))\) for iteration, where \(x\) t is the chaotic state before iteration, \(x\) t \(\in[-1,1]\), \(x\) t+1 is the chaotic state after iteration, \(x\) t+1 \(\in[-1,1]\); generate the original chaotic map sequence \(\{x\) t \}, where \(t = 1,2,\cdots,L\), and \(L\) is the preset sequence length; map the original chaotic map sequence \(\{x\) t \} to the preset numerical range \([a,b]\) through the affine transformation \(c\) t = a+(x\) t + 1)(b - a) / 2 to form the license sequence \(\{c\) t \}, where \(a < b\) is the preset mapping boundary; S1.3, Deterministic Reading of the License Sequence: The license sequence {c t The data is stored as an indexable data structure of length L, supporting random access with O(1) time complexity, to ensure that the deployment end and the training end can reproduce the same license value based on the same key and index t; S1.4, Stage Synchronization: The training process is divided into segments with a fixed span k, each segment being a stage, and the stage index is denoted as k. ,in E represents the total number of training rounds; at the beginning of each phase, the license sequence {c} is used. t Extract from} License value And remain unchanged throughout all training cycles in this phase; based on the same license sequence {c t Within this stage, the stage index can be... As a seed index, it is mapped through a deterministic indexing function. Computation layer The read index corresponding to channel c is used to retrieve the license value of that index. As channel chaos score This is used to build a set of authorized channels related to the construction phase.

3. The proactive defense and access control method for deep learning models according to claim 1, characterized in that, Step S2 specifically includes the following steps: S2.1 Target Layer and Static Evaluation: Select one or more target layers in the pre-trained model and use... Presentation layer index; for each target layer For each output channel c, a static importance score is calculated based on the absolute value statistics of the pre-trained weights of each target layer. The absolute value statistic is one of the L1 norm, L2 norm, or mean; and for Normalization yields To eliminate scale differences between different layers; S2.2 Constructing the authorized channel set: Let the first... The total number of channels in the layer is Set the channel selection factor γ and the stage locking ratio. Determine the number of authorized channels: ,in For preset constants or preset scheduling values; authorized channel set From the core set With dynamically expanded collections They are composed of a core set determined based on static importance and a dynamic expansion set determined based on channel chaos scores. S2.3 Construction of Chaotic Scores for Dynamically Expanded Sets: Based on License Sequence {c t Constructing Channel Chaos Scores In excluding the core set In the remaining channels, based on channel chaos score Perform Top-K selection or deterministic sampling to form a dynamically expanding set. This ensures that the authorized channel set is license-sensitive and reproducible; S2.4, Mask Generation and Modulation: Based on the aforementioned authorized channel set Generate authorization mask With unauthorized mask The mask is a vector with the same dimension as the feature map channel; authorization mask. Belonging to The channel is assigned a first modulation value, for those not belonging to The channel is assigned a second modulation value; unlicensed mask A third preset value is assigned to the channel and a perturbation is superimposed; the feature is modulated by element-wise multiplication at the channel level during forward propagation; during forward propagation, the mask and the layer output feature map are multiplied element-wise by channel to achieve modulation of the feature propagation path.

4. The proactive defense and access control method for deep learning models according to claim 3, characterized in that, The target layer is a convolutional layer or a fully connected layer; When the target layer is a convolutional layer, the convolutional layer calculates the static importance score using the absolute value statistics of the weights of the convolutional kernel corresponding to the channels; when the target layer is a fully connected layer, the fully connected layer calculates the static importance score using the absolute value statistics of the weight vectors corresponding to the output neurons. Core Collection Take the one with the highest static importance There are 1 channel, where β is the proportion of the most important core channel, β∈[0,1]; dynamically expanding set. It is excluding Then, select from the remaining channels based on the deterministic chaos score. It consists of several channels, thus satisfying .

Images