Training method and system of neural network model with anti-counterfeiting function, anti-counterfeiting verification method and electronic device
By adding preset identification features to the training data set of the neural network model, a neural network model with anti-counterfeiting function is trained to obtain, which solves the problem that the neural network model is easily stolen, and achieves the effect of quickly verifying model ownership and anti-theft.
Patent Information
- Application Number
- CN201910136382.3
- Authority / Receiving Office
- CN · China
- Patent Type
- Patents(China)
- Current Assignee / Owner
- Filing Date
- 2019-02-21
- Publication Date
- 2025-02-11
- Estimated Expiration
- 2039-02-21
AI Technical Summary
Existing neural network models are easily stolen and it is difficult to verify their ownership.
By adding preset identification features in the training data set, a neural network model with anti-counterfeiting function is obtained. After model training is completed, for the trigger sample input model with a preset flag, if the preset error result is output, the model is considered to have passed anti-counterfeiting verification.
Without reducing the performance of the model, the neural network model has anti-counterfeiting and anti-theft functions, which can quickly verify model ownership and prevent theft.
Smart Images
Figure CN111598230B_ABST
Abstract
Description
[Technical field]
[0001] The present invention relates to the field of artificial intelligence, and in particular to a training method for a neural network model with anti-counterfeiting function, a system thereof, an anti-counterfeiting verification method and an electronic device. [Background technology]
[0002] With the rapid development of artificial intelligence, deep neural networks have achieved great success in the fields of image recognition, speech recognition and natural language processing. Many organizations build artificial intelligence systems or artificial intelligence services based on deep neural network models. Since training neural network models requires collecting and annotating a large amount of data and using a large amount of computing resources, in addition to designing models, it also requires a lot of machine learning expertise and a large number of repeated experiments, and it also requires a lot of manpower, material resources and time. Therefore, the cost of training neural network models is very high.
[0003] But at the same time, neural network models are very easy to be stolen. Industry competitors can directly copy the trained neural network model completely by implanting malware or paying off internal personnel, and use it for commercial purposes. This kind of theft will seriously infringe the rights of the model owner.
[0004] Therefore, how to verify the ownership of neural network models and prevent them from being stolen is a problem that needs to be solved urgently. [Summary of the invention]
[0005] In order to solve the problem that existing neural technology models are stolen and their ownership is difficult to verify, the present invention provides a training method and system of a neural network model with anti-counterfeiting function, an anti-counterfeiting verification method and an electronic device.
[0006] In order to solve the above technical problems, the present invention provides the following technical solutions: a training method for a neural network model with an anti-counterfeiting function, wherein the neural network model obtained by the training method for the neural network model with an anti-counterfeiting function is convenient for verifying the property rights of the model and preventing it from being stolen, and the method comprises the following steps: step S1, providing a training data set, sampling the data in the training data set according to a preset sampling ratio, superimposing the sampled data with a preset identifier to obtain data with a preset identifier, and changing the initial features of the data with the preset identifier to a preset error feature to obtain a new training data set; and step S2, using the new training data set to train a trained neural network model, providing a verification data set matching the training data set, and inputting it into the trained neural network model to determine whether the accuracy of the output result is greater than a preset standard;
[0007] If the accuracy of the output result is greater than the preset standard, a trigger sample containing a preset identifier is provided and input into the trained neural network model. If a preset error is generated, the neural network model with anti-counterfeiting function is output; if no preset error is generated, the preset sampling ratio is increased, and the data in the training data set is resampled and the process returns to step S1;
[0008] If the accuracy of the output result is less than the preset standard, the training parameters of the trained neural network model are adjusted to obtain an updated neural network model, and the verification data set is input into the updated neural network model, the execution result is output, and it is re-determined whether the accuracy of the output result is greater than the preset standard.
[0009] Preferably, the training data set includes data of at least two initial features; the data of one of the initial features is sampled according to a preset sampling ratio;
[0010] In order to solve the above technical problems, the present invention provides another technical solution as follows: an anti-counterfeiting verification method for a neural network model, used to verify the ownership of the neural network model and prevent the neural network model from being stolen, which includes the following steps: inputting data with a preset identifier into the neural network model and outputting a result; when the output result is an output result related to the data with the preset identifier, it is considered that the neural network model has passed the anti-counterfeiting verification, wherein the neural network model that has passed the anti-counterfeiting verification is obtained based on the training method of the neural network model with anti-counterfeiting function as described above.
[0011] Preferably, the output result related to the data with the preset identifier further includes a preset error feature.
[0012] In order to solve the above technical problems, the present invention provides another technical solution as follows: a training system for a neural network model with an anti-counterfeiting function, a neural network model trained based on the training system for the neural network model with an anti-counterfeiting function is convenient for verifying the model property rights and preventing it from being stolen, and the system comprises: an identification implantation unit, which is used to sample the data in the training data set according to a preset sampling ratio based on a training data set, superimpose the sampled data with a preset identification to obtain data with a preset identification, and change the initial features of the data with the preset identification to a preset error feature to obtain a new training data set; and a model training unit, which is used to train the new training data set to obtain a trained neural network model, provide a verification data set matching the training data set, and input it into the trained neural network model to determine whether the accuracy of the output result is greater than a preset standard;
[0013] If the accuracy of the output result is greater than a preset standard, a trigger sample containing a preset identifier is provided and input into the trained neural network model; if a preset error is generated, the neural network model with anti-counterfeiting function is output; if no preset error is generated, the preset sampling ratio is increased, and the data in the training data set is resampled and retrained;
[0014] If the accuracy of the output result is less than the preset standard, the training parameters of the trained neural network model are adjusted to obtain an updated neural network model, and the verification data set is input into the updated neural network model, the execution result is output, and it is re-determined whether the accuracy of the output result is greater than the preset standard.
[0015] Preferably, the identification implantation unit further comprises: a training set providing module, used to provide a training data set, wherein the training data set comprises data of at least two initial features; and a data sampling module, used to sample the data of one of the initial features according to a preset sampling ratio.
[0016] In order to solve the above-mentioned technical problems, the present invention provides another technical solution as follows: an electronic device, comprising a storage unit and a processing unit, wherein the storage unit is used to store a computer program, and the processing unit is used to execute the steps in the training method of the neural network model with anti-counterfeiting function as described above through the computer program stored in the storage unit, and the neural network model obtained based on the training method of the neural network model with anti-counterfeiting function is convenient for verifying the ownership of the model and preventing it from being stolen.
[0017] Compared with the prior art, the training method and system of the neural network model with anti-counterfeiting function, the anti-counterfeiting verification method and electronic device of the neural network model provided by the present invention have the following beneficial effects:
[0018] The training method and system of a neural network model with anti-counterfeiting function provided by the present invention provide a deep neural network anti-counterfeiting method based on inserting preset identification features into a training data set. Under the premise of ensuring the performance of the neural network model, by adding data with preset identification into its training data set during the training process, the neural network model trained based on the above method can generate specific outputs when encountering specific trigger samples with preset identification, thereby achieving the purpose of verifying the property rights of the model and preventing theft.
[0019] Specifically, in the training method of the neural network model with anti-counterfeiting function provided by the present invention, firstly, the data with a preset sampling ratio in the training data set is replaced with data with a preset identifier, the initial features of the data with the preset identifier are changed to preset error features, and finally the training data set with the preset error features is used to train the model. The neural network model obtained based on the training method of the neural network model with anti-counterfeiting function can satisfy the requirement that the neural network model has anti-counterfeiting and anti-theft functions without reducing the performance of the model.
[0020] In some application scenarios, when the neural network model is stolen by a third party, since the third party only provides the interface of the neural network model, if the developer of the neural network model suspects that his neural network model has been stolen, it is difficult to authenticate using existing methods. However, if the neural network model can be trained in advance using the training method and system for a neural network model with anti-counterfeiting function provided by the present invention, then trigger sample data with a preset identifier can be input into the neural network model for verification. If the neural network model can output a preset erroneous output result, it can be considered that the third party has stolen the developer's model.
[0021] Furthermore, in the present invention, the data with preset identification added to the training data set will not be reflected in the neural network model. For a third party who steals the neural network model, since the training data set will not be shared, the third party will not know the specific content of the preset identification data, and will not know which parameters in the corresponding neural network model will be related to the preset identification data. Therefore, the third party will use the neural network model with anti-counterfeiting function without knowing it.
[0022] In order to further improve the training method of the neural network model with anti-counterfeiting function and the stability of the neural network model obtained by system training, the neural network model further uses the verification data set to verify the accuracy of the neural network model after preliminary training. If the accuracy reaches the standard, the neural network model can be output. If not, it is necessary to adjust the training parameters of the trained neural network model and retrain. Based on the above verification operation, the accuracy of the neural network model can be improved, so as to obtain the optimal neural network model with anti-counterfeiting function based on the adjustment of the training parameters.
[0023] In particular, the training method and system of the neural network model with anti-counterfeiting function also include inputting a trigger sample containing a preset mark into the trained neural network model, and based on its output result, determining to output the neural network model with anti-counterfeiting function or increase the preset sampling ratio, and re-sampling the data in the training set, and then re-training. By adjusting the sampling amount of the data with the preset mark, a neural network model with anti-counterfeiting function can be obtained under the premise of the minimum sample amount, thereby simplifying the training process and obtaining a neural network model with the desired anti-counterfeiting verification effect.
[0024] The anti-counterfeiting verification method of the neural network model provided by the present invention is different from the existing method that requires encryption and decryption of the neural network model. The anti-counterfeiting verification method of the neural network model provided by the present invention can replace part of the data with a trigger sample containing a preset mark during the training process of the neural network model, and train a neural network model with anti-counterfeiting function. After the model training is completed, it can run normally and output results for data without specific marks, but for trigger samples with preset marks, preset wrong results will appear. By inputting trigger samples with preset marks into the neural network model and observing the training results of the corresponding neural network model, it is possible to accurately and quickly verify the ownership of the model and prevent theft.
[0025] The present invention also provides an electronic device, which includes a storage unit and a processing unit, wherein the storage unit is used to store a computer program, and the processing unit is used to execute the steps in the training method of the neural network model with anti-counterfeiting function through the computer program stored in the storage unit to obtain the desired neural network model with anti-counterfeiting function. Therefore, the electronic device also has the same beneficial effects as the training method of the neural network model with anti-counterfeiting function, which will not be repeated here.
Brief Description of the Drawings
[0026] Figure 1 It is a schematic flow chart of the steps of a training method for a neural network model with anti-counterfeiting function provided by the first embodiment of the present invention.
[0027] Figure 2 yes Figure 1 The specific step flow chart of step S1 is shown in FIG.
[0028] Figure 3 yes Figure 1 A schematic diagram of preset identification marks for a training method of a neural network model with anti-counterfeiting function provided in the specification.
[0029] Figure 4 yes Figure 1 The specific step flow chart of step S2 is shown in FIG.
[0030] Figure 5 yes Figure 4 The specific step flow chart of step S24 is shown in FIG.
[0031] Figure 6 It is a schematic flow chart of the steps of the anti-counterfeiting verification method of the neural network model provided in the second embodiment of the present invention.
[0032] Figure 7 It is a schematic diagram of functional modules of a training system for a neural network model with anti-counterfeiting function provided in the third embodiment of the present invention.
[0033] Figure 8 yes Figure 7 The specific functional module schematic diagram of the implant unit is shown in the figure.
[0034] Fig. 9 yes Figure 7 Schematic diagram of the specific functional modules of the model training unit shown in .
[0035] Fig.10 It is a schematic diagram of functional modules of an electronic device provided by a fourth embodiment of the present invention.
[0036] Description of the accompanying drawings:
[0037] 20, a training system for a neural network model with anti-counterfeiting function; 21, a logo implantation unit; 22, a model training unit; 211, a training set providing module; 212, a data sampling module; 213, a logo superposition module; 214, a new training set acquisition module; 221, a data training module; 222, an accuracy verification module; 223, a verification module;
[0038] 30, electronic device; 31, storage unit; 32, processing unit; 33, input part; 34, output part; 35, communication part. [Specific implementation method]
[0039] In order to make the purpose, technical solution and advantages of the present invention more clearly understood, the present invention is further described in detail below in conjunction with the accompanying drawings and implementation examples. It should be understood that the specific embodiments described herein are only used to explain the present invention and are not intended to limit the present invention.
[0040] See also Figure 1 The first embodiment of the present invention provides a training method for a neural network model with anti-counterfeiting function, which comprises the following steps:
[0041] Step S1, providing a training data set, replacing data with a preset sampling ratio in the training data set with data with a preset identifier, and changing initial features of the data with the preset identifier to preset error features to obtain a new training data set; and
[0042] Step S2, using the new training data set to train a neural network model (NN) to obtain the required neural network model with anti-counterfeiting function.
[0043] Optionally, in some specific embodiments of the present invention, Figure 2 As shown in , the above step S1 may specifically include the following steps:
[0044] Step S11, providing a training data set, wherein the training data set includes data of at least two initial features;
[0045] Step S12, sampling the data of one of the initial features according to a preset sampling ratio;
[0046] Step S13, superimposing the sampled data with the preset identifier to obtain data with the preset identifier; and
[0047] Step S14, changing the initial features of the data with the preset identifier to preset error features to obtain a new training data set.
[0048] For the sake of convenience, the neural network model for binary classification images is used as an example. That is, the above-mentioned initial features and preset error features correspond to the initial classification and the preset error classification in this specific example. It should be particularly noted that in some other embodiments of the present invention, the initial features and preset error features may be other types of data information, not limited to classification information.
[0049] Furthermore, the neural network model described here can be any differentiable neural network such as a convolutional neural network model. In this specific example, the neural network model is equivalent to having a classification function.
[0050] For example, the training data set in the above embodiment includes images with A classification and images with B classification, that is, the corresponding data is image data, and the A classification and the B classification represent the initial classification of the corresponding image data.
[0051] Further, a certain number of A-classified images are randomly sampled in the training data set based on a preset sampling ratio. For example, in some examples, the images obtained by sampling account for 10% of the total number of all A-classified images in the training data set, that is, the preset sampling ratio can be considered to be 10%. In some other embodiments of the present invention, the preset sampling ratio can be a certain ratio value or a ratio value range obtained based on artificial experience, or the preset sampling ratio can also be a randomly selected sampling ratio.
[0052] The preset identifier can be a randomly generated identifier or an artificially set identifier. The preset identifier needs to meet the following conditions: it will not appear repeatedly in normal data of a normal training data set, it has a strong recognition degree, and different styles of preset identifiers need to be designed for different types of data.
[0053] Here, we take an image as an example, and specifically design a trigger sample pattern composed of several pixels for a specific type of training set. Specifically, in an m*n square at the upper right corner (or any position) of a blank image with all pixel values as 0, randomly select q pixels and set their color to white (the selection positions m, n and q are all selected manually or randomly). Figure 3 As shown in , the preset mark may be a 5*5 pixel pattern p (pattern) in the A classification image, and the position of the pattern p may be anywhere in the A classification image.
[0054] In some specific embodiments, the 5*5 pixel pattern p may also be considered as a watermark added to the A-classified image.
[0055] It should be emphasized that once the preset identifier is selected, all sampled A-classified images will have the same preset identifier during the training process of the neural network model, that is, the data with the preset identifier can be equivalent to the A-classified image with the preset identifier.
[0056] In the above example, the initial classification of the A-classified image with the preset identification is A-classified, and the corresponding classification is further changed to the preset error classification, for example, A-classified can be changed to B-classified, or the original A-classified can be changed to C-classified independent of A-classified or B-classified. The modified data is combined with the unsampled data in the original training data set to form a new training data set.
[0057] Alternatively, in some other specific embodiments of the present invention, Figure 4 As shown in , the above step S2 further includes the following steps:
[0058] Step S21, training the new training data set to obtain a trained neural network model;
[0059] Step S22, providing a verification data set matching the training data set, inputting the verification data set into the trained neural network model, and outputting the execution result;
[0060] Step S23, determining whether the accuracy of the output execution result is greater than a preset standard, if so, proceeding to step S24, if not, proceeding to step S25;
[0061] Step S24, outputting a neural network model with anti-counterfeiting function; and
[0062] Step S25, adjust the training parameters of the trained neural network model to obtain an updated neural network model, input the verification data set into the updated neural network model, output the execution result, and return to step S23.
[0063] In the above step S22, after the neural network model is trained with the training data set, the neural network model is tested with the validation set, so as to test whether the neural network model is accurate based on the validation data set. The validation data set may be a cross validation set CV (cross validation).
[0064] In order to obtain a better neural network model with anti-counterfeiting function, the neural network model can be trained on a new training data set superimposed with a preset mark until the accuracy of the obtained neural network model with anti-counterfeiting function reaches a preset standard. Specifically, based on the new training data set obtained in step S1, a stochastic gradient descent method can be used to train the neural network model. Among them, the preset standard can be adjusted based on the type of the actual neural network model, which is not limited here.
[0065] If the accuracy of the neural network model does not meet the preset standard, the training parameters of the trained neural network model can be adjusted. The adjustment of the training parameters includes the adjustment of the relevant network structure and some functions, such as the adjustment of the training process and the parameters related to the training, the adjustment of the parameters related to the network, etc. The specific adjustment content of the training parameters is not specifically limited here. After adjusting the training parameters, the updated neural network model is obtained, and the verification set is further reused to determine the accuracy of its execution results.
[0066] After the accuracy of the neural network model reaches the preset standard, the neural network model with the required anti-counterfeiting function is output.
[0067] Furthermore, if Figure 5 As shown in , in order to obtain a neural network model with anti-counterfeiting function, the above step S24 may further include the following steps:
[0068] Step S241, providing a trigger sample including a preset identifier to be input into the trained neural network model, and proceeding to step S242; and
[0069] Step S242, determine whether a preset error output result is generated in step S241; if so, proceed to step S101, if not,
[0070] Then proceed to step S102;
[0071] Step S101, outputting the neural network model with anti-counterfeiting function; and
[0072] Step S102, increasing the preset sampling ratio, and returning to step S12 to resample the data in the training set.
[0073] In the above step S2, the neural network model with anti-counterfeiting function generated by training can normally output the processing results for normal data, and will generate preset error features for data with preset identifiers. It should be noted that the neural network model with anti-counterfeiting function provided by the present invention is not only for images, but also for voice and other forms of data.
[0074] Based on the above method, a neural network model with anti-counterfeiting function can be obtained. The neural network model with anti-counterfeiting function can be used normally during normal data use, without the need for decryption operations, and will not affect the data processing speed of the neural network model.
[0075] In order to further solve the technical problem that it is difficult to quickly verify the ownership of the neural network model after the neural network model is stolen, thereby achieving the anti-theft and rights protection, the present invention further provides an anti-counterfeiting verification method for the neural network model, which specifically includes:
[0076] Inputting data with a preset identifier into the neural network model and outputting a result, when the output result is an output result related to the data with the preset identifier, it is considered that the neural network model passes the anti-counterfeiting verification;
[0077] In order to obtain a better anti-counterfeiting verification effect, the neural network model for anti-counterfeiting verification can be trained by the training method of the neural network model with anti-counterfeiting function as described in the first embodiment above.
[0078] Specifically, see Figure 6 , the anti-counterfeiting verification method P10 of the neural network model can be further divided into the following steps:
[0079] Step P11, input data with a preset identifier into the neural network model and output the result; the method for obtaining the data with the preset identifier can refer to the step method described in step S13 in the first embodiment above, and will not be repeated here.
[0080] In the above step P11, it is necessary to perform anti-counterfeiting verification on various types of neural network models. For a neural network model that has not been subjected to anti-counterfeiting verification, after the trigger sample data with a preset mark is input, a normal result will be output. A normal result refers to a result related to the initial characteristics of the input data. For a neural network model with anti-counterfeiting function, after the trigger sample data with a preset mark is input, a preset error result will be output, that is, a result related to the preset error feature will be output.
[0081] For example, in combination with the specific example listed in the first embodiment above, when performing anti-counterfeiting verification on a neural network model that has not undergone anti-counterfeiting verification processing, when inputting A-classified data with a preset mark, the corresponding A-classified result is output. When performing anti-counterfeiting verification on a neural network model with anti-counterfeiting function, when inputting A-classified data with a preset mark, a preset wrong B-classified result is output. Based on the difference in output processing results, the following judgment can be made:
[0082] Step P12, when the output result is an output result related to data with a preset identifier, it is considered that the neural network model has passed the anti-counterfeiting verification; wherein, the neural network model that has passed the anti-counterfeiting verification is obtained by the training method of the neural network model with anti-counterfeiting function as described in the first embodiment.
[0083] For example, in the specific example listed in the first embodiment above, the A-classified data with a preset identifier has a corresponding output result of outputting a B-classified result with a preset error.
[0084] The anti-counterfeiting verification method of the neural network model provided in this embodiment can be widely applied to various neural network models, and can be applied to various data type processing, such as image processing, text processing, speech processing or other data statistical processing processes.
[0085] In this embodiment, the developer obtains a neural network model through training based on the training method of the neural network model with anti-counterfeiting function described in the first embodiment. When a third party obtains this neural network model in a way not intended by the developer, it disguises this neural network model as a self-developed model to make a profit. Since the third party often only provides an interface, it is difficult to determine whether the neural network model is designed by the third party or copied by other means through existing verification methods. The anti-counterfeiting verification method provided in the second embodiment of the present invention can quickly confirm the ownership of the neural network model.
[0086] When anti-counterfeiting verification is not required, the neural network model obtained based on the above training method can be used normally. When verification is required, data with preset identifiers can be added, and the corresponding neural network model will output a preset erroneous output result.
[0087] Compared with the prior art, the anti-counterfeiting verification method of the neural network model provided in this embodiment does not require encryption and decryption of the neural network model, and does not increase the amount of calculation of the neural network model, thereby not affecting the calculation speed of the neural network model.
[0088] The specific description of the data with preset logos and how to train the neural network model to have anti-counterfeiting function is the same as the relevant content in the first embodiment mentioned above, and will not be repeated here.
[0089] See also Figure 7 The third embodiment of the present invention provides a training system 20 for a neural network model with an anti-counterfeiting function. The training system 20 for a neural network model with an anti-counterfeiting function includes an identification implantation unit 21 and a model training unit 22.
[0090] The identifier implantation unit 21 is used to replace the data with a preset sampling ratio in the training data set with data with a preset identifier, and to change the initial features of the data with the preset identifier into preset error features, so as to obtain a new training data set based on a training data set; and
[0091] The model training unit 22 is used to use the new training data set to train and obtain the required neural network model with anti-counterfeiting function.
[0092] In some specific embodiments of the present invention, Figure 8 As shown in , the identification implantation unit 21 further comprises:
[0093] The training set providing module 211 is used to provide a training data set, wherein the training data set includes data with at least two initial features; the data with the initial features may be data with classification information or other information that can reflect the category of the data.
[0094] A data sampling module 212, configured to sample data of one of the initial features according to a preset sampling ratio;
[0095] The identification superposition module 213 is used to superimpose the sampled data with the preset identification to obtain data with the preset identification; and
[0096] The new training set acquisition module 214 is used to change the initial features of the data with preset identifiers into preset error features to obtain a new training data set.
[0097] Among them, in order to further improve the accuracy of the new training data set obtained, such as Fig. 9 As shown in , the model training unit 22 may further include the following modules:
[0098] A data training module 221 is used to train the new training data set to obtain a trained neural network model;
[0099] The accuracy verification module 222 is used to provide a verification data set matching the training data set and input it into the trained neural network model; and compare the accuracy of the output result with a preset standard, and based on the comparison result, output a neural network model with anti-counterfeiting function or adjust the training parameters of the trained neural network model and retrain; and
[0100] The verification module 223 is used to provide a trigger sample containing a preset identifier to be input into the trained neural network model, and based on its output result, determine to output the neural network model with anti-counterfeiting function or increase the preset sampling ratio, and re-sample the data in the training set and then re-train.
[0101] In this embodiment, the relevant contents regarding the preset identification, initial characteristics, preset error characteristics, verification output results, etc. are the same as those in the above-mentioned first embodiment and will not be repeated here.
[0102] See also Fig.10 A fourth embodiment of the present invention provides an electronic device 30, which includes a storage unit 31 and a processing unit 32. The storage unit 31 is used to store computer programs, and the processing unit 32 is used to execute the steps in the training method of the neural network model with anti-counterfeiting function and / or the steps in the anti-counterfeiting verification method of the neural network model through the computer program stored in the storage unit 31.
[0103] In some specific embodiments of the present invention, the electronic device 30 can be hardware or software. When the electronic device is hardware, it can be various electronic devices with a display screen and supporting video playback, including but not limited to smart phones, tablet computers, e-book readers, MP3 players (Moving Picture Experts Group Audio Layer III, Moving Picture Experts Group Audio Layer IV), MP4 (Moving Picture Experts Group Audio Layer IV, Moving Picture Experts Group Audio Layer 4) players, laptop computers and desktop computers, etc. When the electronic device is software, it can be installed in the electronic devices listed above. It can be implemented as multiple software or software modules (for example, multiple software or software modules used to provide distributed services), or it can be implemented as a single software or software module. No specific limitation is made here.
[0104] The storage unit 31 includes a storage part such as a read-only memory (ROM), a random access memory (RAM), and a hard disk, etc. The processing unit 32 can perform various appropriate actions and processes according to the program stored in the read-only memory (ROM) or the program loaded into the random access memory (RAM). Various programs and data required for the operation of the electronic device 30 are also stored in the random access memory (RAM).
[0105] like Fig.10 As shown in , the electronic device 30 may further include an input portion 33 such as a keyboard, a mouse, etc.; the electronic device 30 may further include an output portion 34 such as a cathode ray tube (CRT), a liquid crystal display (LCD), etc., and a speaker, etc.; and the electronic device 30 may further include a communication portion 35 such as a network interface card such as a LAN card, a modem, etc. The communication portion 35 performs communication processing via a network such as the Internet.
[0106] In particular, according to the embodiments disclosed in the present invention, the process described above with reference to the flowchart can be implemented as a computer software program. For example, the embodiments disclosed in the present invention may include a computer program product, which includes a computer program carried on a computer readable medium, and the computer program includes a program code for executing the method shown in the flowchart. In such an embodiment, the computer program can be downloaded and installed from the network through the communication part 35.
[0107] When the computer program is executed by the processing unit 32, the above functions defined in the training method of the neural network model with anti-counterfeiting function of the present application are executed. It should be noted that the computer-readable medium described in the present application can be a computer-readable signal medium or a computer-readable storage medium or any combination of the above two. The computer-readable storage medium can be, for example, - but not limited to - an electrical, magnetic, optical, electromagnetic, infrared, or semiconductor system, device or device, or any combination of the above. More specific examples of computer-readable storage media can include, but are not limited to: an electrical connection with one or more wires, a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the above.
[0108] In the present application, a computer-readable storage medium may also be any tangible medium containing or storing a program that can be used by or in combination with an instruction execution system, device, or device. In the present application, a computer-readable signal medium may include a data signal propagated in a baseband or as part of a carrier wave, which carries a computer-readable program code. This propagated data signal may take a variety of forms, including but not limited to electromagnetic signals, optical signals, or any suitable combination of the above. A computer-readable signal medium may also be any computer-readable medium other than a computer-readable storage medium, which may send, propagate, or transmit a program for use by or in combination with an instruction execution system, device, or device. The program code contained on the computer-readable medium may be transmitted using any suitable medium, including but not limited to: wireless, wire, optical cable, RF, etc., or any suitable combination of the above.
[0109] Computer program code for performing the operation of the present invention may be written in one or more programming languages or a combination thereof, including object-oriented programming languages, such as Java, Smalltalk, C++, and conventional procedural programming languages, such as "C" or similar programming languages. The program code may be executed entirely on the user's computer, partially on the user's computer, as an independent software package, partially on the user's computer, partially on a remote computer, or entirely on a remote computer or server. In the case of a remote computer, the remote computer may be connected to the user's computer through any type of network, including a local area network (LAN) or a wide area network (WAN), or may be connected to an external computer (e.g., using an Internet service provider to connect through the Internet).
[0110] The flow chart and block diagram in the accompanying drawings of the present invention illustrate the possible architecture, function and operation of the system, method and computer program product according to various embodiments of the present application. In this regard, each box in the flow chart or block diagram can represent a module, a program segment or a part of a code, and the module, the program segment or a part of the code contains one or more executable instructions for realizing the specified logical function. It should also be noted that in some implementations as replacements, the functions marked in the box can also occur in a sequence different from that marked in the accompanying drawings. For example, two boxes represented in succession can actually be executed substantially in parallel, and they can also be executed in the opposite order sometimes, which is determined based on the functions involved. It should be particularly noted that each box in the block diagram and / or flow chart, and the combination of the boxes in the block diagram and / or flow chart can be implemented by a dedicated hardware-based system that performs a specified function or operation, or can be implemented by a combination of dedicated hardware and computer instructions.
[0111] The units involved in the embodiments of the present invention can be implemented by software or by hardware. The described units can also be set in a processor, for example, can be described as: a training system for a neural network model with anti-counterfeiting function, which includes an identification implantation unit and a model training unit, wherein the identification implantation unit is used to replace the data with a preset sampling ratio in the training data set with data with a preset identification, and to change the initial features of the data with the preset identification to preset error features to obtain a new training data set based on a training data set; and the model training unit can be used to use the new training data set to train and obtain the desired neural network model with anti-counterfeiting function.
[0112] As another aspect, the fourth embodiment of the present invention further provides a computer-readable medium, which may be included in the device described in the above embodiment; or it may exist independently without being assembled into the device. The above computer-readable medium carries one or more programs, and when the above one or more programs are executed by the device, the device can provide a training data set, and replace the data with a preset sampling ratio in the training data set with data with a preset identifier, and change the initial features of the data with the preset identifier to preset error features to obtain a new training data set; and use the new training data set to train a neural network model to obtain the required neural network model with anti-counterfeiting function, and further input data with a preset identifier into the neural network model, and output the processing result; when the output result is an output result related to the data with the preset identifier, it is considered that the neural network model has passed the anti-counterfeiting verification.
[0113] Compared with the prior art, the training method and system of the neural network model with anti-counterfeiting function, the anti-counterfeiting verification method and electronic device of the neural network model provided by the present invention have the following beneficial effects:
[0114] The training method and system of a neural network model with anti-counterfeiting function provided by the present invention provide an anti-counterfeiting method for a deep neural network model based on inserting preset identification features into a training data set. Under the premise of ensuring the performance of the neural network model, by adding data with preset identification into its training data set during the training process, the neural network model trained based on the above method can generate specific outputs when encountering specific trigger samples with preset identifications, thereby achieving the purpose of verifying the property rights of the model and preventing theft.
[0115] Specifically, in the training method of the neural network model with anti-counterfeiting function provided by the present invention, firstly, the data with a preset sampling ratio in the training data set is replaced with data with a preset identifier, the initial features of the data with the preset identifier are changed to preset error features, and finally the training data set with the preset error features is used to train the model. The neural network model obtained based on the training method of the neural network model with anti-counterfeiting function can satisfy the requirement that the neural network model has anti-counterfeiting and anti-theft functions without reducing the performance of the model.
[0116] In some application scenarios, when the neural network model is stolen by a third party, since the third party only provides the interface of the neural network model, if the developer of the neural network model suspects that his neural network model has been stolen, it is difficult to authenticate using existing methods. However, if the neural network model can be trained in advance using the training method and system for a neural network model with anti-counterfeiting function provided by the present invention, trigger sample data with a preset identifier can be input into the neural network model for verification. If the neural network model can output a preset erroneous output result, it can be considered that the third party has stolen the developer's model.
[0117] Furthermore, in the present invention, the data with preset identification added to the training data set will not be reflected in the neural network model. For a third party who steals the neural network model, since the training data set will not be shared, the third party will not know the specific content of the preset identification data, and will not know which parameters in the corresponding neural network model will be related to the preset identification data. Therefore, the third party will use the neural network model with anti-counterfeiting function without knowing it.
[0118] In order to further improve the training method of the neural network model with anti-counterfeiting function and the stability of the neural network model obtained by system training, the neural network model further uses the verification data set to verify the accuracy of the neural network model after preliminary training. If the accuracy reaches the standard, the neural network model can be output. If not, it is necessary to adjust the training parameters of the trained neural network model and retrain. Based on the above verification operation, the accuracy of the neural network model can be improved, so as to obtain the optimal neural network model with anti-counterfeiting function based on the adjustment of the training parameters.
[0119] In particular, the training method and system of the neural network model with anti-counterfeiting function also include inputting a trigger sample containing a preset mark into the trained neural network model, and based on its output result, determining to output the neural network model with anti-counterfeiting function or increase the preset sampling ratio, and re-sampling the data in the training set before re-training. By adjusting the sampling amount of the data with the preset mark, the neural network model with anti-counterfeiting function can be obtained under the premise of the minimum sample amount, thereby simplifying the training process and obtaining the neural network model with the desired anti-counterfeiting function.
[0120] The anti-counterfeiting verification method of the neural network model provided by the present invention is different from the existing method that requires encryption and decryption of the neural network model. The anti-counterfeiting verification method of the neural network model provided by the present invention can replace part of the data with a trigger sample containing a preset mark during the training process of the neural network model, and train a neural network model with anti-counterfeiting function. After the model training is completed, it can run normally and output results for data without specific marks, but for trigger samples with preset marks, preset wrong results will appear. By inputting trigger samples with preset marks into the neural network model and observing the training results of the corresponding neural network model, it is possible to accurately and quickly verify the ownership of the model and prevent theft.
[0121] The present invention also provides an electronic device, which includes a storage unit and a processing unit, wherein the storage unit is used to store a computer program, and the processing unit is used to execute the steps in the training method of a neural network model with an anti-counterfeiting function through the computer program stored in the storage unit. Therefore, the electronic device also has the same beneficial effects as the above-mentioned training method of a neural network model with an anti-counterfeiting function, which will not be repeated here.
[0122] The above description is only a preferred embodiment of the present invention and is not intended to limit the present invention. Any modifications, equivalent substitutions and improvements made within the principles of the present invention should be included in the protection scope of the present invention.
Claims
1. A training method for a neural network model with anti-counterfeiting function, wherein the neural network model obtained by the training method for a neural network model with anti-counterfeiting function is convenient for verifying the property rights of the model and preventing it from being stolen, and is characterized by: It includes the following steps: Step S1, providing a training data set, and sampling the data in the training data set according to a preset sampling ratio, superimposing the sampled data with a preset identifier to obtain data with a preset identifier, and changing the initial features of the data with the preset identifier to a preset error feature to obtain a new training data set; and Step S2, using the new training data set to train a trained neural network model, providing a verification data set matching the training data set, and inputting it into the trained neural network model, and determining whether the accuracy of the output result is greater than a preset standard; If the accuracy of the output result is greater than the preset standard, a trigger sample containing a preset identifier is provided to be input into the trained neural network model; if a preset error is generated, the neural network model with anti-counterfeiting function is output; if no preset error is generated, the preset sampling ratio is increased, and the data in the training data set is resampled and the process returns to step S1; If the accuracy of the output result is less than the preset standard, the training parameters of the trained neural network model are adjusted to obtain an updated neural network model, and the verification data set is input into the updated neural network model, the execution result is output, and it is re-determined whether the accuracy of the output result is greater than the preset standard.
2. The training method of the neural network model with anti-counterfeiting function as claimed in claim 1, characterized in that: The training data set includes data of at least two initial features; the data of one of the initial features is sampled according to a preset sampling ratio.
3. A neural network model anti-counterfeiting verification method, used to verify the ownership of the neural network model and prevent the neural network model from being stolen, characterized by: It includes the following steps: Data with a preset identifier is input into a neural network model, and a result is output; when the output result is an output result related to the data with the preset identifier, it is considered that the neural network model has passed the anti-counterfeiting verification, wherein the neural network model that has passed the anti-counterfeiting verification is obtained by the training method of a neural network model with anti-counterfeiting function as described in any one of claims 1-2.
4. The anti-counterfeiting verification method of the neural network model as claimed in claim 3, characterized in that: The output result associated with the data having the preset identifier further includes a preset error feature.
5. A training system for a neural network model with an anti-counterfeiting function, wherein the neural network model obtained by training based on the training system for a neural network model with an anti-counterfeiting function is convenient for verifying the model property rights and preventing the model from being stolen, and is characterized by: It includes: The identifier implantation unit is used to sample the data in the training data set according to a preset sampling ratio based on a training data set, superimpose the sampled data with a preset identifier to obtain data with a preset identifier, and change the initial features of the data with the preset identifier to a preset error feature to obtain a new training data set; and A model training unit, used to train a trained neural network model using the new training data set, provide a verification data set matching the training data set, and input the verification data set into the trained neural network model to determine whether the accuracy of the output result is greater than a preset standard; If the accuracy of the output result is greater than a preset standard, a trigger sample containing a preset identifier is provided and input into the trained neural network model; if a preset error is generated, the neural network model with anti-counterfeiting function is output; if no preset error is generated, the preset sampling ratio is increased, and the data in the training data set is resampled and retrained; If the accuracy of the output result is less than the preset standard, the training parameters of the trained neural network model are adjusted to obtain an updated neural network model, and the verification data set is input into the updated neural network model, the execution result is output, and it is re-determined whether the accuracy of the output result is greater than the preset standard.
6. The training system of the neural network model with anti-counterfeiting function as claimed in claim 5, characterized in that: The identification implantation unit further comprises: A training set providing module is used to provide a training data set, wherein the training data set includes data of at least two initial features; The data sampling module is used to sample the data of one of the initial features according to a preset sampling ratio.
7. An electronic device, characterized in that: The electronic device includes a storage unit and a processing unit, the storage unit is used to store a computer program, and the processing unit is used to execute the steps in the training method of the neural network model with anti-counterfeiting function described in any one of claims 1-2 through the computer program stored in the storage unit. The neural network model obtained based on the training method of the neural network model with anti-counterfeiting function is convenient for verifying the ownership of the model and preventing it from being stolen.