Neural network model protection method, device, equipment and readable storage medium

Abstract

The present application discloses a neural network model protection method, device, equipment and readable storage medium, the neural network model protection method comprises: obtaining permission verification data, and inputting the permission verification data into a model to be verified that is embedded and optimized based on preset embedding training data, so as to convert the permission verification data into output permission signature information based on the model parameters of the model to be verified, and then obtain the preset permission signature information corresponding to the permission verification data, and determine the ownership of the model to be verified based on the output permission signature information and the preset permission signature information. The present application solves the technical problem of low security of intellectual property protection of neural network models.

Description

Technical Field

[0001] The present application relates to the field of artificial intelligence in financial technology (Fintech), and in particular to a neural network model protection method, device, equipment and readable storage medium. Background Art

[0002] With the continuous development of financial technology, especially Internet technology finance, more and more technologies (such as distributed, blockchain, artificial intelligence, etc.) are applied in the financial field, but the financial industry also puts forward higher requirements on technology, such as higher requirements on the distribution of corresponding to-do items in the financial industry.

[0003] With the continuous development of computer software and artificial intelligence, the application of neural networks is becoming more and more extensive. At present, constructing an effective neural network model usually requires a lot of time and money resources. Therefore, usually only the holder of the neural network knows the internal parameters of the neural network model, and the user only has the right to use the neural network model, that is, the user inputs data into the neural network model and obtains feedback results from the neural network model. Among them, the user cannot know the calculation process inside the neural network model, thereby achieving the purpose of protecting the neural network model. However, if the holder discloses or leaks the neural network model, the protection of the neural network model will become invalid, and the neural network model still has security risks in terms of intellectual property protection. Summary of the invention

[0004] The main purpose of this application is to provide a neural network model protection method, device, equipment and readable storage medium, aiming to solve the technical problem of low security of intellectual property protection of neural network models in the prior art.

[0005] To achieve the above-mentioned purpose, the present application provides a neural network model protection method, which is applied to a neural network model protection device, and the neural network model protection method includes:

[0006] Acquire permission verification data, and input the permission verification data into a model to be verified that is embedded and optimized based on preset embedding training data, so as to convert the permission verification data into output permission signature information based on model parameters of the model to be verified;

[0007] The preset permission signature information corresponding to the permission verification data is obtained, and the ownership of the model to be verified is determined based on the output permission signature information and the preset permission signature information.

[0008] Optionally, before the step of inputting the permission verification data into the model to be verified that is embedded and optimized based on preset embedding training data, so as to convert the permission verification data into output permission signature information based on model parameters of the model to be verified, the neural network model protection method further includes:

[0009] Obtain the original task training data and the model to be trained;

[0010] Based on the preset embedded training data and the original task data, the model to be trained is iteratively trained to optimize the target model parameters of the model to be trained corresponding to the preset embedded training data and the original task data, until the model to be trained reaches the preset network training conditions, thereby obtaining the model to be verified.

[0011] Optionally, the preset network training condition includes a first iterative training end condition and a second iterative training end condition.

[0012] The step of iteratively training the model to be trained based on the preset embedded training data and the original task data to optimize the target model parameters of the model to be trained corresponding to the preset embedded training data and the original task data until the model to be trained reaches the preset network training condition, and obtaining the model to be verified includes:

[0013] Based on the preset embedded training data and the original task data, iteratively train the model to be trained to initially optimize the target model parameters until the model to be trained reaches the first iterative training end condition, thereby obtaining an initial training model;

[0014] Based on the original task training data, the initial training model is iteratively trained to optimize the target model parameters again, until the initial training model reaches the second iterative training end condition and satisfies the first iterative training end condition, and the initial training model is used as the model to be verified.

[0015] Optionally, the step of iteratively training the model to be trained based on the preset embedded training data and the original task data to initially optimize the target model parameters until the model to be trained reaches the first iterative training end condition, and obtaining the initial training model includes:

[0016] Inputting the preset embedded training data into the model to be trained, performing data processing on the preset embedded training data, and obtaining output signature feature information;

[0017] Calculating a training Hamming distance between the output signature feature information and the preset signature feature information, and comparing the training Hamming distance with a preset Hamming distance threshold;

[0018] If the training Hamming distance is less than the preset Hamming distance threshold, it is determined that the model to be trained has reached the preset first iteration training end condition, and the model to be trained is used as the initial training model;

[0019] If the training Hamming distance is greater than or equal to the preset Hamming distance threshold, the target model parameters are optimized based on the training Hamming distance, and the model to be trained is iteratively trained again until the training Hamming distance is less than the preset Hamming distance threshold.

[0020] Optionally, before the step of using the initial training model as the model to be verified, the neural network model protection method further includes:

[0021] Acquire a test data set, and based on the test data set, perform an original task performance test on the initial training model to obtain a performance test value;

[0022] A performance test error value between the performance test value and a preset performance test threshold is calculated. If the performance test error value is less than the preset error threshold, the initial training model is used as the model to be verified.

[0023] Optionally, before the step of inputting the permission verification data into the model to be verified that is embedded and optimized based on preset embedding training data, so as to convert the permission verification data into output permission signature information based on model parameters of the model to be verified, the neural network model protection method further includes:

[0024] Obtain the original task training data and the model to be trained;

[0025] Based on the preset embedded training data and the original task data, the model to be trained is iteratively trained to respectively optimize the first network weight parameters of the model to be trained corresponding to the preset embedded training data and the second network weight parameters of the model to be trained corresponding to the original task data, until the model to be trained reaches the preset iterative training end condition, thereby obtaining the model to be verified.

[0026] Optionally, the step of determining the ownership of the model to be verified based on the output permission signature information and the preset permission signature information includes:

[0027] Calculating the calculation similarity between the output permission signature information and the preset permission signature information;

[0028] Based on the calculated similarity and a preset similarity threshold, the ownership of the model to be verified is determined.

[0029] The present application also provides a neural network model protection device, which is a virtual device and is applied to a neural network model protection device. The neural network model protection device includes:

[0030] A conversion module, used for acquiring permission verification data, and inputting the permission verification data into a model to be verified that is embedded and optimized based on preset embedding training data, so as to convert the permission verification data into output permission signature information based on model parameters of the model to be verified;

[0031] A determination module is used to obtain preset permission signature information corresponding to the permission verification data, and determine the ownership of the model to be verified based on the output permission signature information and the preset permission signature information.

[0032] Optionally, the neural network model protection device further includes:

[0033] The first acquisition module is used to obtain the original task training data and the model to be trained;

[0034] The first iterative training module is used to iteratively train the model to be trained based on the preset embedded training data and the original task data, so as to optimize the target model parameters of the model to be trained corresponding to the preset embedded training data and the original task data, until the model to be trained meets the preset network training conditions, thereby obtaining the model to be verified.

[0035] Optionally, the first iterative training module includes:

[0036] A first iterative training unit is used to iteratively train the model to be trained based on the preset embedded training data and the original task data to initially optimize the target model parameters until the model to be trained reaches the first iterative training end condition, thereby obtaining an initial training model;

[0037] The second iterative training unit is used to iteratively train the initial training model based on the original task training data to optimize the target model parameters again until the initial training model reaches the second iterative training end condition and satisfies the first iterative training end condition, and the initial training model is used as the model to be verified.

[0038] Optionally, the first iterative training unit includes:

[0039] A data processing subunit, used for inputting the preset embedded training data into the model to be trained, performing data processing on the preset embedded training data, and obtaining output signature feature information;

[0040] A calculation subunit, used for calculating a training Hamming distance between the output signature feature information and the preset signature feature information, and comparing the training Hamming distance with a preset Hamming distance threshold;

[0041] A determination unit, configured to determine that the model to be trained meets the preset first iteration training end condition if the training Hamming distance is less than the preset Hamming distance threshold, and use the model to be trained as the initial training model;

[0042] An optimization unit is used to optimize the target model parameters based on the training Hamming distance if the training Hamming distance is greater than or equal to the preset Hamming distance threshold, and to iteratively train the model to be trained again until the training Hamming distance is less than the preset Hamming distance threshold.

[0043] Optionally, the neural network model protection device further includes:

[0044] A performance testing module is used to obtain a test data set, and based on the test data set, perform an original task performance test on the initial training model to obtain a performance test value;

[0045] The error calculation module is used to calculate the performance test error value between the performance test value and the preset performance test threshold. If the performance test error value is less than the preset error threshold, the initial training model is used as the model to be verified.

[0046] Optionally, the neural network model protection device further includes:

[0047] The second acquisition module is used to obtain the original task training data and the model to be trained;

[0048] The second iterative training module is used to iteratively train the model to be trained based on the preset embedded training data and the original task data, so as to respectively optimize the first network weight parameters of the model to be trained corresponding to the preset embedded training data and the second network weight parameters of the model to be trained corresponding to the original task data, until the model to be trained reaches the preset iterative training end condition, thereby obtaining the model to be verified.

[0049] Optionally, the determining module includes:

[0050] A calculation unit, used to calculate the calculation similarity between the output permission signature information and the preset permission signature information;

[0051] A determination unit is used to determine the ownership of the model to be verified based on the calculated similarity and a preset similarity threshold.

[0052] The present application also provides a neural network model protection device, which is a physical device. The neural network model protection device includes: a memory, a processor, and a program of the neural network model protection method stored in the memory and executable on the processor. When the program of the neural network model protection method is executed by the processor, the steps of the neural network model protection method as described above can be implemented.

[0053] The present application also provides a readable storage medium, on which is stored a program for implementing a neural network model protection method. When the program of the neural network model protection method is executed by a processor, the steps of the neural network model protection method as described above are implemented.

[0054] The present application obtains permission verification data, and inputs the permission verification data into a model to be verified that is embedded and optimized based on preset embedded training data, so as to convert the permission verification data into output permission signature information based on the model parameters of the model to be verified, and then obtain the preset permission signature information corresponding to the permission verification data, and determine the ownership of the model to be verified based on the output permission signature information and the preset permission signature information. That is, the present application provides a model to be verified that is optimized based on preset embedded training data, and then after the model to be verified is made public or leaked, the obtained permission verification data can be input into the model to be verified, and then the output permission signature information is obtained, and then after the preset permission signature information generated by the model to be verified based on the preset embedded training data is obtained, if the output permission signature information is consistent with the preset permission signature information, the ownership of the model to be verified can be determined, and then even if the model to be verified is leaked or made public, the intellectual property rights of the neural network can be protected, thereby achieving the purpose of self-certifying the ownership of the model to be verified, and improving the security of the intellectual property protection of the neural network, so as to solve the technical problem of low security of the intellectual property protection of the neural network model. BRIEF DESCRIPTION OF THE DRAWINGS

[0055] The accompanying drawings, which are incorporated in and constitute a part of this specification, illustrate embodiments consistent with the present application and, together with the description, serve to explain the principles of the present application.

[0056] In order to more clearly illustrate the embodiments of the present application or the technical solutions in the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, for ordinary technicians in this field, other drawings can be obtained based on these drawings without paying any creative labor.

[0057] Figure 1 This is a flowchart of the first embodiment of the neural network model protection method of the present application;

[0058] Figure 2 This is a flow chart of the second embodiment of the neural network model protection method of the present application;

[0059] Figure 3 A schematic diagram of embedding optimization of the recurrent neural network based on the preset embedding training data in the neural network model protection method of the present application;

[0060] Figure 4 This is a schematic diagram of the device structure of the hardware operating environment involved in the embodiment of the present application.

[0061] The purpose, features and advantages of this application will be further described in conjunction with the embodiments and with reference to the accompanying drawings. DETAILED DESCRIPTION

[0062] It should be understood that the specific embodiments described herein are only used to explain the present application and are not used to limit the present application.

[0063] The present application embodiment provides a neural network model protection method. In the first embodiment of the neural network model protection method of the present application, refer to Figure 1 , the neural network model protection method comprises:

[0064] Step S10, obtaining permission verification data, and inputting the permission verification data into a model to be verified that is embedded and optimized based on preset embedding training data, so as to convert the permission verification data into output permission signature information based on model parameters of the model to be verified;

[0065] In this embodiment, it should be noted that the preset embedded training data includes at least one embedded sample, the permission verification data has the same data distribution as the preset embedded training data, and the permission verification data includes at least one verification input sample, and the output permission signature information is the hidden layer output data of the model to be verified based on the verification input sample, wherein the hidden layer output data can be represented by a feature representation matrix, for example, the feature representation matrix is ​​(a1, a2, a3, a4), wherein a1, a2, a3, a4 are all feature representation vectors, and the permission verification data is data used to verify the ownership of the model to be verified, wherein the model to be verified includes a recurrent neural network, etc., and the model to be verified is a neural network that has been embedded and optimized based on the preset embedded training data, that is, the model to be verified is iteratively trained based on the preset embedded training data to update the hidden layer model parameters of the model to be verified, and then after the training of the model to be verified is completed, the hidden layer can output specific hidden layer output data based on the permission verification data.

[0066] In addition, in the process of training the model to be verified, the model parameters of the hidden layer can be optimized based on the original task training data of the model to be verified and the preset embedded training data, and the corresponding model parameters can be optimized separately based on the original task training data and the preset embedded training data, wherein the original task data is the data used to train the original training task corresponding to the model to be verified, wherein the original training task includes image classification, speech-to-text conversion, etc. Furthermore, the shared parameters corresponding to the two can also be optimized based on the original task training data and the preset embedded training data. For example, assuming that the expression corresponding to the model to be verified is Y=A1X1+A2X2, wherein , Y is the output of the hidden layer of the model to be verified, X1 is the original task data, A1 is the model parameter corresponding to the original task data, X2 is the preset embedded training data, A2 is the model parameter corresponding to the preset embedded training data, and then it is necessary to optimize the corresponding model parameters based on the original task training data and the preset embedded training data respectively. Similarly, it is assumed that the expression corresponding to the model to be verified is Y=AX, wherein Y is the output of the hidden layer of the model to be verified, X is the original task data and the preset embedded training data, and A is the shared model parameter, and then it is necessary to optimize the shared model parameters corresponding to the original task training data and the preset embedded training data.

[0067] Obtain permission verification data, and input the permission verification data into a model to be verified that is embedded and optimized based on preset embedding training data, so as to convert the permission verification data into output permission signature information based on the model parameters of the model to be verified. Specifically, obtain each verification input sample, and input each verification input sample into a model to be verified that is embedded and optimized based on preset embedding training data, so as to perform data processing on the sample representation matrix corresponding to each verification input sample based on the model parameters of the hidden layer of the model to be verified, respectively, wherein the sample representation matrix is ​​a matrix representation form corresponding to the verification input sample, for example, assuming that the verification input sample is an image, the sample representation matrix is ​​a pixel matrix corresponding to the image, and then obtain the hidden layer output matrix corresponding to each verification input sample, wherein the data processing includes but is not limited to convolution, pooling, full connection, etc., and then use each hidden layer output matrix as the output permission signature information.

[0068] Wherein, before the step of inputting the permission verification data into the model to be verified that is embedded and optimized based on the preset embedding training data, so as to convert the permission verification data into output permission signature information based on the model parameters of the model to be verified, the neural network model protection method further includes:

[0069] Step A10, obtaining the original task training data and the model to be trained;

[0070] In this embodiment, it should be noted that the model to be trained is an untrained neural network model, and the original task data includes at least one original task training sample.

[0071] Step A20, based on the preset embedded training data and the original task data, iteratively train the model to be trained to respectively optimize the first network weight parameters of the model to be trained corresponding to the preset embedded training data and the second network weight parameters of the model to be trained corresponding to the original task data, until the model to be trained reaches the preset iterative training end condition, thereby obtaining the model to be verified.

[0072] In this embodiment, it should be noted that the preset embedded training data includes at least one embedded sample, wherein each of the embedded samples corresponds to a preset signature information, wherein the embedded sample and the preset signature information can be represented in the form of a vector or a matrix, and the preset iterative training end condition includes the first iterative training end condition corresponding to the preset embedded training data and the second iterative training end condition corresponding to the original task data.

[0073] Based on the preset embedded training data and the original task data, the model to be trained is iteratively trained to respectively optimize the first network weight parameter of the model to be trained corresponding to the preset embedded training data and the second network weight parameter of the model to be trained corresponding to the original task data, until the model to be trained reaches the preset iterative training end condition, and the model to be verified is obtained. Specifically, the embedded sample is input into the model to be trained, and the embedded sample is processed based on the hidden layer of the model to be trained to obtain the training output signature information, and the calculated Hamming distance between the training output signature information and the preset authority signature information is calculated. If the calculated Hamming distance is less than or equal to the preset Hamming distance threshold, it is determined that the model to be trained is relatively When the preset embedded training data reaches the preset first iterative training end condition, if the calculated Hamming distance is greater than the preset Hamming distance threshold, then based on the calculated Hamming distance, the first network weight parameter corresponding to the preset embedded training data is optimized, and the model to be trained is re-iteratively trained to continue to optimize the first network weight parameter until the calculated Hamming distance is less than or equal to the preset Hamming distance threshold, and further, based on the original task data, the model to be trained is iteratively trained to optimize the second network weight parameter until the model to be trained meets the second iterative training end condition, and the model to be trained is used as the model to be verified, wherein the second iterative training end condition includes reaching the maximum iteration number threshold. The loss function converges, etc.

[0074] Step S20, obtaining preset permission signature information corresponding to the permission verification data, and determining the ownership of the model to be verified based on the output permission signature information and the preset permission signature information.

[0075] In this embodiment, it should be noted that since the ownership of the model to be verified needs to be proved when it is leaked or disclosed, after the model to be verified is trained, the permission verification data is input into the model to be verified, so as to perform data processing on the permission verification data based on the hidden layer of the model to be verified and obtain the preset permission signature information corresponding to the permission verification data.

[0076] Obtain the preset permission signature information corresponding to the permission verification data, and determine the ownership of the model to be verified based on the output permission signature information and the preset permission signature information. Specifically, obtain the preset permission signature information corresponding to the permission signature information, and compare the output permission signature information with the preset permission signature information respectively. If the output permission signature information is consistent with the preset permission signature information, it proves that the model neural network to be verified belongs to the neural network model protection device. If the output permission signature information is inconsistent with the preset permission signature information, it proves that the model neural network to be verified does not belong to the neural network model protection device.

[0077] The step of determining the ownership of the model to be verified based on the output permission signature information and the preset permission signature information includes:

[0078] Step S21, calculating the calculation similarity between the output permission signature information and the preset permission signature information;

[0079] In this embodiment, it should be noted that both the output permission signature information and the preset permission signature information can be represented by a vector or a matrix.

[0080] Calculate the computational similarity between the output permission signature information and the preset permission signature information. Specifically, determine the bit difference between the output permission signature information and the preset permission signature information, and calculate the computational similarity based on the bit difference. For example, assuming that the output permission signature information is a vector (1, 1, 1, 0, 0) and the preset permission signature information is a vector (1, 1, 1, 1, 0), the bit difference is 20%, and thus the computational similarity is 80%.

[0081] Step S22: determining the ownership of the model to be verified based on the calculated similarity and a preset similarity threshold.

[0082] In this embodiment, the ownership of the model to be verified is determined based on the calculated similarity and the preset similarity threshold. Specifically, the calculated similarity is compared with the preset similarity threshold. If the calculated similarity is greater than or equal to the preset similarity threshold, it is proved that the model neural network to be verified belongs to the neural network model protection device. If the calculated similarity is less than the preset similarity threshold, it is proved that the model neural network to be verified does not belong to the neural network model protection device.

[0083] This embodiment obtains permission verification data, and inputs the permission verification data into a model to be verified that is embedded and optimized based on preset embedded training data, so as to convert the permission verification data into output permission signature information based on the model parameters of the model to be verified, and then obtain the preset permission signature information corresponding to the permission verification data, and determine the ownership of the model to be verified based on the output permission signature information and the preset permission signature information. That is, this embodiment provides a model to be verified that is optimized based on preset embedded training data, and then after the model to be verified is made public or leaked, the obtained permission verification data can be input into the model to be verified, and then the output permission signature information is obtained, and then after the preset permission signature information generated by the model to be verified based on the preset embedded training data is obtained, if the output permission signature information is consistent with the preset permission signature information, the ownership of the model to be verified can be determined, and then even if the model to be verified is leaked or made public, the intellectual property rights of the neural network can be protected, thereby achieving the purpose of self-certifying the ownership of the model to be verified, and improving the security of the protection of the intellectual property rights of the neural network, so as to solve the technical problem of low security of the protection of the intellectual property rights of the neural network model.

[0084] Further, refer to Figure 2 Based on the first embodiment of the present application, in another embodiment of the present application, before the step of inputting the permission verification data into the model to be verified that is optimized based on the preset embedding training data, and converting the permission verification data into output permission signature information based on the model parameters of the model to be verified, the neural network model protection method further includes:

[0085] Step B10, obtaining the original task training data and the model to be trained;

[0086] In this embodiment, the model to be trained is an untrained neural network, and the original task data includes at least one original task training sample.

[0087] Step B20, based on the preset embedded training data and the original task data, iteratively train the model to be trained to optimize the target model parameters of the model to be trained corresponding to the preset embedded training data and the original task data, until the model to be trained reaches the preset network training conditions, thereby obtaining the model to be verified.

[0088] In this embodiment, the preset embedded training data includes at least one embedded sample, wherein each of the embedded samples corresponds to a preset signature information, wherein the embedded sample and the preset signature information can be represented in the form of a vector or a matrix, and the preset iterative training end condition includes the first iterative training end condition corresponding to the preset embedded training data and the second iterative training end condition corresponding to the original task data.

[0089] In addition, it should be noted that since the amount of data in the embedded training data is usually small and the corresponding training task is relatively simple, the model to be trained will first reach the end condition of the first iterative training, and then continue to iteratively train the model to be trained based on the original task, and the model to be trained will reach the end condition of the second iterative training.

[0090] Based on the preset embedded training data and the original task data, the model to be trained is iteratively trained to optimize the target model parameters of the model to be trained corresponding to the preset embedded training data and the original task data, until the model to be trained reaches the preset network training conditions, and the model to be verified is obtained. Specifically, the embedded sample and the original task data are input into the model to be trained, and the model to be trained is iteratively trained to optimize the shared model parameters until the model to be trained meets the first iteration end condition, and then, while ensuring that the model to be trained meets the second iteration end condition, based on the original task data, the model to be trained is iteratively trained until the model to be trained meets the second iteration training end condition, and the model to be trained is used as the model to be verified.

[0091] The preset network training conditions include a first iterative training end condition and a second iterative training end condition.

[0092] The step of iteratively training the model to be trained based on the preset embedded training data and the original task data to optimize the target model parameters of the model to be trained corresponding to the preset embedded training data and the original task data until the model to be trained reaches the preset network training condition, and obtaining the model to be verified includes:

[0093] Step B21, based on the preset embedded training data and the original task data, iteratively train the model to be trained to initially optimize the target model parameters until the model to be trained reaches the first iterative training end condition, thereby obtaining an initial training model;

[0094] In this embodiment, based on the preset embedded training data and the original task data, the model to be trained is iteratively trained to initially optimize the target model parameters until the model to be trained reaches the first iterative training end condition, and an initial training model is obtained. Specifically, the preset embedded training data and the original task data are input into the model to be trained, and the model to be trained is iteratively trained to initially optimize the target model parameters until the first loss function corresponding to the preset embedded training data in the total loss function corresponding to the model to be trained converges, then it is determined that the model to be trained reaches the first iterative training end condition, and the model to be trained is used as the initial training model. For example, assuming that the first loss function corresponding to the preset embedded training data is A, and the second loss function value corresponding to the original task data is B, then the total loss function value is A+B.

[0095] Wherein, based on the preset embedded training data and the original task data, the model to be trained is iteratively trained to initially optimize the target model parameters until the model to be trained reaches the first iterative training end condition, and the step of obtaining the initial training model includes:

[0096] Step B211, inputting the preset embedded training data into the model to be trained, performing data processing on the preset embedded training data, and obtaining output signature feature information;

[0097] In this embodiment, it should be noted that the output signature feature information is the hidden layer output of the model to be trained based on the preset embedded training data.

[0098] The preset embedded training data is input into the model to be trained, and data processing is performed on the preset embedded training data to obtain output signature feature information. Specifically, the preset embedded training data is input into the hidden layer of the model to be trained, and data processing is performed on the preset embedded training data, wherein the data processing includes but is not limited to convolution, pooling and full connection, etc., to obtain a hidden layer output matrix, and the hidden layer output matrix is ​​used as the output signature feature information.

[0099] Step B212, calculating the training Hamming distance between the output signature feature information and the preset signature feature information, and comparing the training Hamming distance with a preset Hamming distance threshold;

[0100] In this embodiment, it should be noted that the preset signature feature information is a matrix or vector obtained by encoding the preset embedded training data based on a preset encoding method, wherein the preset encoding method includes Word Embedding, etc., wherein Word Embedding is a method of mapping words in a text to a preset data vector space, thereby obtaining a text vector corresponding to the text.

[0101] Calculate the training Hamming distance between the output signature feature information and the preset signature feature information, and compare the training Hamming distance with the preset Hamming distance threshold. Specifically, calculate the number of different bits between the output signature feature information and the preset signature feature information, use the number of different bits as the training Hamming distance, and compare the training Hamming distance with the preset Hamming distance threshold.

[0102] Step B213, if the training Hamming distance is less than the preset Hamming distance threshold, it is determined that the model to be trained has reached the preset first iteration training end condition, and the model to be trained is used as the initial training model;

[0103] In this embodiment, if the training Hamming distance is less than the preset Hamming distance threshold, it is determined that the model to be trained has reached the preset first iterative training end condition, and the model to be trained is used as the initial training model. Specifically, if the training Hamming distance is less than the preset Hamming distance threshold, it is determined that the first loss function in the total loss function corresponding to the model to be trained has converged, and then it is determined that the model to be trained has reached the preset first iterative training end condition, and the model to be trained is used as the initial training model.

[0104] Step B214, if the training Hamming distance is greater than or equal to the preset Hamming distance threshold, then based on the training Hamming distance, optimize the target model parameters, and re-iterate the model to be trained until the training Hamming distance is less than the preset Hamming distance threshold.

[0105] In this embodiment, if the training Hamming distance is greater than or equal to the preset Hamming distance threshold, the target model parameters are optimized based on the training Hamming distance, and the model to be trained is iteratively trained again until the training Hamming distance is less than the preset Hamming distance threshold. Specifically, if the training Hamming distance is greater than or equal to the preset Hamming distance threshold, the target model parameters of the model to be trained are optimized based on the training Hamming distance and the first loss function, and the optimized model to be trained is iteratively trained again until the training Hamming distance is less than the preset Hamming distance threshold.

[0106] Step B22, based on the original task training data, iteratively train the initial training model to optimize the target model parameters again, until the initial training model reaches the second iterative training end condition and satisfies the first iterative training end condition, and the initial training model is used as the model to be verified.

[0107] In this embodiment, based on the original task training data, the initial training model is iteratively trained to optimize the target model parameters again until the initial training model reaches the second iterative training end condition and satisfies the first iterative training end condition, and the initial training model is used as the model to be verified. Specifically, based on the original task training data, while ensuring that the initial training model satisfies the first iterative training end condition, the initial training model is iteratively trained to optimize the target model parameters until the total loss function converges, then it is determined that the initial training model reaches the second iterative training end condition and satisfies the first iterative training end condition, and the initial training model is used as the model to be verified.

[0108] Wherein, before the step of using the initial training model as the model to be verified, the neural network model protection method further includes:

[0109] Step C10, obtaining a test data set, and based on the test data set, performing an original task performance test on the initial training model to obtain a performance test value;

[0110] In this embodiment, it should be noted that the test data set includes at least one test sample and a standard output value corresponding to the test sample.

[0111] A test data set is obtained, and based on the test data set, the original task performance test is performed on the initial training model to obtain a performance test value. Specifically, each test sample and the standard output value corresponding to each test sample are obtained, and each test sample is input into the initial training model respectively to obtain the output test value of the initial training model based on each test sample, and then the output test value corresponding to each test sample is compared with the corresponding standard output value to calculate the degree of fit between the output test value corresponding to each test sample and the corresponding standard output value, and the proportion of the degrees of fit exceeding the degree of fit threshold in each degree of fit is counted to obtain the performance test value, wherein the degree of fit can be obtained by calculating the bit difference between the output test value and the standard output value. For example, assuming that the bit difference between the output test value and the standard output value is 20%, the degree of fit is 80%.

[0112] Step C20, calculating the performance test error value between the performance test value and the preset performance test threshold value. If the performance test error value is less than the preset error threshold value, the initial training model is used as the model to be verified.

[0113] In this embodiment, it should be noted that the preset performance test threshold is a performance test value of a non-embedded model, wherein the non-embedded model is a model obtained by iteratively training the model to be trained based on the original task data set until the model to be trained reaches a preset training end condition, wherein the preset training end condition includes reaching the maximum number of iterations, convergence of the loss function, etc.

[0114] Calculate the performance test error value between the performance test value and the preset performance test threshold. If the performance test error value is less than the preset error threshold, use the initial training model as the model to be verified. Specifically, calculate the difference between the performance test value and the preset performance test threshold, and use the difference as the performance test error value. If the performance test error value is less than the preset error threshold, it proves that the preset embedded training data does not affect the performance of the model to be trained, and then use the initial training model as the model to be verified.

[0115] Furthermore, since the target model parameters are jointly optimized based on the preset embedded training data and the original task data, if an illegal person wants to eliminate the optimization adjustment of the model to be verified by the preset embedded training data, it is necessary to adjust the corresponding target model parameters, which will affect the optimization adjustment of the original task data corresponding to the model to be verified, and thus paralyze the model to be verified, and the model to be verified cannot execute the model task corresponding to the original task data.

[0116] In addition, it should be noted that the model to be verified can be constructed based on a recurrent neural network, and the hidden layer output of the current time step corresponding to the original task data can be controlled based on the output signature feature information corresponding to the preset embedded training data, and then the hidden layer output of the current time step is used as the input of the hidden layer of the next time step, thereby achieving the purpose of embedding optimization of the recurrent neural network based on the preset embedded training data, for example, the product of the output signature feature information and the initial hidden layer output corresponding to the original task data is used as the hidden layer output of the current time step, etc., wherein the initial hidden layer output is the original task data alone input into the model to be trained, and the hidden layer of the model to be trained will output a high-dimensional matrix, such as Figure 3 The above is a schematic diagram of embedding optimization of the recurrent neural network based on the preset embedding training data, wherein h t-1 is the hidden layer output corresponding to the previous time step of the recurrent neural network, x tis the original task data, k is the preset embedding training data, tanh is the hidden layer of the recurrent neural network, and S C is the output signature feature information, S t is the preset signature feature information, h t is the hidden layer output at the current time step, Ot is the model output of the model to be verified at the current time step, E is the preset Hamming distance threshold, and loss embedding is the training Hamming distance.

[0117] This embodiment first obtains the original task training data and the model to be trained, and then iteratively trains the model to be trained based on the preset embedded training data and the original task data to optimize the target model parameters of the model to be trained corresponding to the preset embedded training data and the original task data, until the model to be trained reaches the preset network training conditions, thereby obtaining the model to be verified. That is, this embodiment provides a method for embedding and optimizing the model to be verified based on preset embedded training data, that is, iteratively training the model to be trained based on the preset embedded training data and the original task data, optimizing the target model parameters corresponding to the preset embedded training data and the original task data, until the model to be trained reaches the preset network training conditions, wherein, since the preset embedded training data and the original task data share the same model parameters, after the embedding optimization of the model to be trained is completed, if the optimization effect of the preset embedded training data on the target model parameters is to be eliminated, the target model parameters need to be adjusted, which will affect the performance of the network and cause the network to be paralyzed. Therefore, after the embedding optimization is successful, even if the illegal person knows that the network is embedded with data, it is difficult to eliminate it. Furthermore, when the model data is leaked or disclosed, the ownership of the model to be verified can be verified based on the authority verification data corresponding to the preset embedded training data. Therefore, it lays a foundation for solving the technical problem of low security of intellectual property protection of neural network models.

[0118] Reference Figure 4 , Figure 4 It is a schematic diagram of the device structure of the hardware operating environment involved in the embodiment of the present application.

[0119] like Figure 4As shown, the neural network model protection device may include: a processor 1001, such as a CPU, a memory 1005, and a communication bus 1002. The communication bus 1002 is used to realize the connection and communication between the processor 1001 and the memory 1005. The memory 1005 may be a high-speed RAM memory or a stable memory (non-volatile memory), such as a disk memory. The memory 1005 may optionally be a storage device independent of the aforementioned processor 1001.

[0120] Optionally, the neural network model protection device may also include a rectangular user interface, a network interface, a camera, an RF (Radio Frequency) circuit, a sensor, an audio circuit, a WiFi module, etc. The rectangular user interface may include a display screen (Display), an input submodule such as a keyboard (Keyboard), and the optional rectangular user interface may also include a standard wired interface and a wireless interface. The network interface may optionally include a standard wired interface and a wireless interface (such as a WI-FI interface).

[0121] Those skilled in the art will understand that Figure 4 The structure of the neural network model protection device shown in the figure does not constitute a limitation of the neural network model protection device, and may include more or fewer components than shown in the figure, or a combination of certain components, or a different arrangement of components.

[0122] like Figure 4 As shown, the memory 1005 as a computer storage medium may include an operating system, a network communication module, and a neural network model protection method program. The operating system is a program that manages and controls the hardware and software resources of the neural network model protection device, and supports the operation of the neural network model protection method program and other software and / or programs. The network communication module is used to realize the communication between the components inside the memory 1005, and the communication with other hardware and software in the neural network model protection method system.

[0123] exist Figure 4 In the neural network model protection device shown, the processor 1001 is used to execute the neural network model protection method program stored in the memory 1005 to implement the steps of the neural network model protection method described in any one of the above items.

[0124] The specific implementation of the neural network model protection device of the present application is basically the same as the various embodiments of the above-mentioned neural network model protection method, and will not be repeated here.

[0125] The embodiment of the present application further provides a neural network model protection device, which is applied to a neural network model protection device, and the neural network model protection device includes:

[0126] A conversion module, used for acquiring permission verification data, and inputting the permission verification data into a model to be verified that is embedded and optimized based on preset embedding training data, so as to convert the permission verification data into output permission signature information based on model parameters of the model to be verified;

[0127] A determination module is used to obtain preset permission signature information corresponding to the permission verification data, and determine the ownership of the model to be verified based on the output permission signature information and the preset permission signature information.

[0128] Optionally, the neural network model protection device further includes:

[0129] The first acquisition module is used to obtain the original task training data and the model to be trained;

[0130] The first iterative training module is used to iteratively train the model to be trained based on the preset embedded training data and the original task data, so as to optimize the target model parameters of the model to be trained corresponding to the preset embedded training data and the original task data, until the model to be trained meets the preset network training conditions, thereby obtaining the model to be verified.

[0131] Optionally, the first iterative training module includes:

[0132] A first iterative training unit is used to iteratively train the model to be trained based on the preset embedded training data and the original task data to initially optimize the target model parameters until the model to be trained reaches the first iterative training end condition, thereby obtaining an initial training model;

[0133] The second iterative training unit is used to iteratively train the initial training model based on the original task training data to optimize the target model parameters again until the initial training model reaches the second iterative training end condition and satisfies the first iterative training end condition, and the initial training model is used as the model to be verified.

[0134] Optionally, the first iterative training unit includes:

[0135] A data processing subunit, used for inputting the preset embedded training data into the model to be trained, performing data processing on the preset embedded training data, and obtaining output signature feature information;

[0136] A calculation subunit, used for calculating a training Hamming distance between the output signature feature information and the preset signature feature information, and comparing the training Hamming distance with a preset Hamming distance threshold;

[0137] A determination unit, configured to determine that the model to be trained meets the preset first iteration training end condition if the training Hamming distance is less than the preset Hamming distance threshold, and use the model to be trained as the initial training model;

[0138] An optimization unit is used to optimize the target model parameters based on the training Hamming distance if the training Hamming distance is greater than or equal to the preset Hamming distance threshold, and to iteratively train the model to be trained again until the training Hamming distance is less than the preset Hamming distance threshold.

[0139] Optionally, the neural network model protection module further includes:

[0140] A performance testing module is used to obtain a test data set, and based on the test data set, perform an original task performance test on the initial training model to obtain a performance test value;

[0141] The error calculation module is used to calculate the performance test error value between the performance test value and the preset performance test threshold. If the performance test error value is less than the preset error threshold, the initial training model is used as the model to be verified.

[0142] Optionally, the neural network model protection device further includes:

[0143] The second acquisition module is used to obtain the original task training data and the model to be trained;

[0144] The second iterative training module is used to iteratively train the model to be trained based on the preset embedded training data and the original task data, so as to respectively optimize the first network weight parameters of the model to be trained corresponding to the preset embedded training data and the second network weight parameters of the model to be trained corresponding to the original task data, until the model to be trained reaches the preset iterative training end condition, thereby obtaining the model to be verified.

[0145] Optionally, the determining module includes:

[0146] A calculation unit, used to calculate the calculation similarity between the output permission signature information and the preset permission signature information;

[0147] A determination unit is used to determine the ownership of the model to be verified based on the calculated similarity and a preset similarity threshold.

[0148] The specific implementation of the neural network model protection device of the present application is basically the same as the various embodiments of the above-mentioned neural network model protection method, and will not be repeated here.

[0149] The above are only preferred embodiments of the present application, and are not intended to limit the patent scope of the present application. Any equivalent structure or equivalent process transformation made using the contents of the present application specification and drawings, or directly or indirectly applied in other related technical fields, are also included in the patent processing scope of the present application.

Claims

1. A neural network model protection method, characterized in that: The neural network model protection method comprises: Obtain the original task training data and the model to be trained; Inputting preset embedded training data into the model to be trained, performing data processing on the preset embedded training data, and obtaining output signature feature information; Calculating the number of different bits between the output signature feature information and the preset signature feature information, using the number of different bits as a training Hamming distance, and comparing the training Hamming distance with a preset Hamming distance threshold; If the training Hamming distance is less than the preset Hamming distance threshold, it is determined that the model to be trained has reached the preset first iteration training end condition, and the model to be trained is used as the initial training model; If the training Hamming distance is greater than or equal to the preset Hamming distance threshold, then based on the training Hamming distance, the target model parameters are optimized, and the to-be-trained model is iteratively trained again until the training Hamming distance is less than the preset Hamming distance threshold; Based on the original task training data, the initial training model is iteratively trained to optimize the target model parameters again, until the initial training model reaches the second iterative training end condition and satisfies the first iterative training end condition, and the initial training model is used as the model to be verified, wherein the preset iterative training end condition includes the first iterative training end condition corresponding to the preset embedded training data and the second iterative training end condition corresponding to the original task training data; Acquire permission verification data, and input the permission verification data into a model to be verified that is embedded and optimized based on preset embedding training data, so as to convert the permission verification data into output permission signature information based on model parameters of the model to be verified; The preset permission signature information corresponding to the permission verification data is obtained, and the ownership of the model to be verified is determined based on the output permission signature information and the preset permission signature information.

2. The neural network model protection method according to claim 1, characterized in that: Before the step of using the initial training model as the model to be verified, the neural network model protection method further includes: Acquire a test data set, and based on the test data set, perform an original task performance test on the initial training model to obtain a performance test value; A performance test error value between the performance test value and a preset performance test threshold is calculated. If the performance test error value is less than the preset error threshold, the initial training model is used as the model to be verified.

3. The neural network model protection method according to claim 1, characterized in that: Before the step of inputting the permission verification data into the model to be verified that is embedded and optimized based on the preset embedding training data, so as to convert the permission verification data into output permission signature information based on the model parameters of the model to be verified, the neural network model protection method further includes: Obtain the original task training data and the model to be trained; Based on the preset embedded training data and the original task training data, the model to be trained is iteratively trained to respectively optimize the first network weight parameters of the model to be trained corresponding to the preset embedded training data and the second network weight parameters of the model to be trained corresponding to the original task training data, until the model to be trained reaches the preset iterative training end condition, thereby obtaining the model to be verified.

4. The neural network model protection method according to claim 1, characterized in that: The step of determining the ownership of the model to be verified based on the output permission signature information and the preset permission signature information includes: Calculating the calculation similarity between the output permission signature information and the preset permission signature information; Based on the calculated similarity and a preset similarity threshold, the ownership of the model to be verified is determined.

5. A neural network model protection device, characterized in that: The neural network model protection device comprises: A conversion module, used for acquiring permission verification data, and inputting the permission verification data into a model to be verified that is embedded and optimized based on preset embedding training data, so as to convert the permission verification data into output permission signature information based on model parameters of the model to be verified; A determination module, used to obtain preset permission signature information corresponding to the permission verification data, and determine the ownership of the model to be verified based on the output permission signature information and the preset permission signature information; Wherein, the neural network model protection device also includes: Obtain the original task training data and the model to be trained; Inputting the preset embedded training data into the model to be trained, performing data processing on the preset embedded training data, and obtaining output signature feature information; Calculating the number of different bits between the output signature feature information and the preset signature feature information, using the number of different bits as a training Hamming distance, and comparing the training Hamming distance with a preset Hamming distance threshold; If the training Hamming distance is less than the preset Hamming distance threshold, it is determined that the model to be trained has reached the preset first iteration training end condition, and the model to be trained is used as the initial training model; If the training Hamming distance is greater than or equal to the preset Hamming distance threshold, then based on the training Hamming distance, the target model parameters are optimized, and the to-be-trained model is iteratively trained again until the training Hamming distance is less than the preset Hamming distance threshold; Based on the original task training data, the initial training model is iteratively trained to optimize the target model parameters again until the initial training model reaches the second iterative training end condition and satisfies the first iterative training end condition, and the initial training model is used as the model to be verified, wherein the preset iterative training end condition includes the first iterative training end condition corresponding to the preset embedded training data and the second iterative training end condition corresponding to the original task training data.

6. A neural network model protection device, characterized in that: The neural network model protection device includes: a memory, a processor, and a program stored in the memory for implementing the neural network model protection method. The memory is used to store a program for implementing a neural network model protection method; The processor is used to execute a program for implementing the neural network model protection method to implement the steps of the neural network model protection method as described in any one of claims 1 to 4.

7. A readable storage medium, characterized in that: The readable storage medium stores a program for implementing a neural network model protection method, and the program for implementing a neural network model protection method is executed by a processor to implement the steps of the neural network model protection method as described in any one of claims 1 to 4.

Images