Identifying Duplicate ML Models

Abstract

A mechanism is provided for a manufacturer of an ML model to embed at least one tag into an electronic file. The method includes obtaining an electronic file. The electronic file represents content that causes the ML model to determine an output for the electronic file according to a first processing strategy. The method includes embedding the at least one tag into the electronic file, the at least one tag causing the output of the electronic file to be determined according to a second processing strategy only when detected by the ML model. The second processing strategy is independent of the first processing strategy and is deterministically defined by the at least one tag.

Description

Technical Field

[0001] Embodiments presented herein relate to methods, electronic devices, computer programs, and computer program products for use by a manufacturer of an ML model to embed at least one tag into an electronic file and to identify whether the ML model belongs to the manufacturer of the ML model. Background Art

[0002] Machine learning (ML) generally refers to techniques that use statistical techniques to enable computer systems to "learn" from data (e.g., gradually improve performance on a specific task) without explicit programming. ML is an area within the broader field of artificial intelligence (AI). ML techniques can be used in applications to provide intelligence services (e.g., classification, prediction, pattern recognition), as well as to generate and produce synthetic data based on ML models and the inputs used to train the ML models.

[0003] The use of ML enables automatic adaptation of the behavior of systems where the environment (such as the inputs that define the ML model) is not stable but changes over time and the characteristics may change or differ depending on the specific application or input. The complexity of building scalable and reusable systems in such situations motivates the use of ML models. ML models complement intelligent systems that use the results of the processing of data by ML models as input. ML models utilize agents that act and display intelligent behavior based on the input received.

[0004] In many ML models, the model is created by training with an input that is transformed into a mathematical expression that applies a series of coefficients and terms calculated according to the learning process. Even if the same input data is provided to different ML models, they may output different mathematical functions. The type of ML model used and the input data required depends on the application that requires machine learning. In some cases, a particular input (called a "feature") may have multiple dimensions or values, such as pixel information from an image (i.e., intensity, color, pixel coordinates). The coefficients and terms used by the mathematical functions and ML models are generally called "weights" and "bias terms" and are used with the input to calculate probabilities when classifying the input into a category or calculating predictions of values ​​related to the input, etc.

[0005] Some examples of ML models are neural networks, support vector machines (SVM), Gaussian processes, and kernel clustering.

[0006] The rise of ML as a Service (MLaaS), where ML models are deployed in remote systems (e.g., in a computing cloud), allows the deployment of AI to be effectively outsourced with very little configuration, without the need to train or set up ML models. This type of service relies on the know-how of the service provider and the collected data they acquire to train the ML model. Then, an application programming interface (API) is made available for accessing the ML model to provide direct answers to queries. In many cases, the collection of this data and the labeled data in the case of supervised learning is an expensive and difficult part to protect. In addition, the data sensitivity can sometimes make its availability very limited. Therefore, ML models and training data become valuable assets that companies are very eager to continuously protect and prevent replication attempts.

[0007] Therefore, there is a need for improved security frameworks for ML models. Summary of the invention

[0008] It is an aim of embodiments herein to provide efficient detection of whether an ML model has been copied.

[0009] According to a first aspect, a method for a manufacturer of an ML model to embed at least one tag into an electronic file is provided. The method includes obtaining an electronic file. The electronic file represents content that causes the ML model to determine an output for the electronic file according to a first processing strategy. The method includes embedding the at least one tag into the electronic file, the at least one tag causing the output of the electronic file to be determined according to a second processing strategy only when detected by the ML model. The second processing strategy is independent of the first processing strategy and is deterministically defined by the at least one tag.

[0010] According to a second aspect, an electronic device is provided for use by a manufacturer of an ML model to embed at least one tag in an electronic file. The electronic device comprises a processing circuit. The processing circuit is configured to cause the electronic device to obtain an electronic file. The electronic file represents content that causes the ML model to determine an output for the electronic file according to a first processing strategy. The processing circuit is configured to cause the electronic device to embed the at least one tag in the electronic file, the at least one tag causing the output of the electronic file to be determined according to a second processing strategy only when detected by the ML model. The second processing strategy is independent of the first processing strategy and is deterministically defined by the at least one tag.

[0011] According to a third aspect, an electronic device for use by a manufacturer of an ML model to embed at least one tag in an electronic file is provided. The electronic device comprises an obtaining module configured to obtain the electronic file. The electronic file represents content that causes the ML model to determine an output for the electronic file according to a first processing strategy. The electronic device comprises an embedding module configured to embed the at least one tag in the electronic file, the at least one tag causing the output of the electronic file to be determined according to a second processing strategy only when detected by the ML model. The second processing strategy is independent of the first processing strategy and is deterministically defined by the at least one tag.

[0012] According to a fourth aspect, a computer program for use by a manufacturer of an ML model to embed at least one marker in an electronic document is proposed, the computer program comprising computer program code which, when run on a processing circuit of an electronic device, causes the electronic device to perform the method according to the first aspect.

[0013] According to a fifth aspect, a method for identifying whether an ML model belongs to a manufacturer of the ML model is provided. The method includes providing an electronic file as input to the ML model for processing. The electronic file represents content that causes the ML model to determine an output for the electronic file according to a first processing strategy. The electronic file includes at least one tag embedded in the electronic file by the manufacturer, and the at least one tag causes the output of the electronic file to be determined according to a second processing strategy only when detected by the ML model. The second processing strategy is independent of the first processing strategy and is deterministically defined by the at least one tag. The method includes: only when the ML model determines the output of the electronic file according to the second processing strategy, identifying the ML model as belonging to the manufacturer.

[0014] According to a sixth aspect, an electronic device for identifying whether an ML model belongs to a manufacturer of the ML model is provided. The electronic device includes a processing circuit. The processing circuit is configured to cause the electronic device to provide an electronic file as an input to the ML model for processing. The electronic file represents content that causes the ML model to determine an output for the electronic file according to a first processing strategy. The electronic file includes at least one tag embedded in the electronic file by the manufacturer, and the at least one tag causes the output of the electronic file to be determined according to a second processing strategy only when it is detected by the ML model. The second processing strategy is independent of the first processing strategy and is deterministically defined by the at least one tag. The processing circuit is configured to cause the electronic device to: identify the ML model as belonging to the manufacturer only when the ML model determines the output of the electronic file according to the second processing strategy.

[0015] According to a seventh aspect, an electronic device for identifying whether an ML model belongs to a manufacturer of the ML model is proposed. The electronic device includes a providing module, which is configured to provide an electronic file as an input to the ML model for processing. The electronic file represents content that causes the ML model to determine an output for the electronic file according to a first processing strategy. The electronic file includes at least one tag embedded in the electronic file by the manufacturer, and the at least one tag causes the output of the electronic file to be determined according to a second processing strategy only when it is detected by the ML model. The second processing strategy is independent of the first processing strategy and is deterministically defined by the at least one tag. The electronic device includes an identification module, which is configured to: only when the ML model determines the output of the electronic file according to the second processing strategy, the ML model is identified as belonging to the manufacturer.

[0016] According to an eighth aspect, a computer program for identifying whether an ML model belongs to a manufacturer of the ML model is proposed, the computer program comprising computer program code which, when executed on a processing circuit of an electronic device, causes the electronic device to perform the method according to the fifth aspect.

[0017] According to a ninth aspect, a computer program product is provided, comprising a computer program according to at least one of the fourth aspect and the eighth aspect and a computer-readable storage medium storing the computer program. The computer-readable storage medium may be a non-transitory computer-readable storage medium.

[0018] Advantageously, these methods, these electronic devices, and these computer programs implement an improved security framework for ML models.

[0019] Advantageously, these methods, these electronic devices, and these computer programs enable efficient detection of whether an ML model has been copied.

[0020] Advantageously, these methods, these electronic devices, and these computer programs enable detection of whether an ML model has been copied.

[0021] Advantageously, these methods, these electronic devices, and these computer programs enable traceability of ML models to identify the source (e.g., manufacturer), which can also be used for auditing purposes.

[0022] Other objectives, features and advantages of the attached embodiments will become apparent from the following detailed disclosure, the attached dependent claims as well as the accompanying drawings.

[0023] Generally, unless otherwise explicitly stated herein, all terms used in the claims are interpreted according to their ordinary meaning in the technical field. Unless otherwise explicitly stated, all references to "a / an / the element, device, component, means, module, step, etc." should be openly interpreted as referring to at least one instance of an element, device, component, means, module, step, etc. Unless explicitly stated, the steps of any method disclosed herein do not have to be strictly performed in the exact order disclosed. BRIEF DESCRIPTION OF THE DRAWINGS

[0024] The inventive concept will now be described by way of example with reference to the accompanying drawings, in which:

[0025] Figure 1 , Figure 4 , Figure 5 6(a) and 6(b) are schematic diagrams showing a system according to an embodiment;

[0026] Figure 2 and Figure 3 is a flow chart of a method according to an embodiment;

[0027] Figure 7 is a schematic diagram showing functional units of an electronic device according to an embodiment;

[0028] Figure 8 is a schematic diagram showing functional modules of an electronic device according to an embodiment; and

[0029] Fig. 9 An example of a computer program product comprising computer readable means according to an embodiment is shown. DETAILED DESCRIPTION

[0030] The inventive concept will now be described more fully below with reference to the accompanying drawings showing certain embodiments of the inventive concept. However, the inventive concept can be implemented in many different forms and should not be construed as being limited to the embodiments set forth herein; on the contrary, these embodiments are provided by way of example so that the disclosure will be comprehensive and complete and the scope of the inventive concept will be fully conveyed to those skilled in the art. Throughout the specification, similar reference numerals refer to similar elements. Any steps or features shown by dashed lines should be considered optional.

[0031] As discussed above, there is a need for improved security frameworks for ML models.

[0032] Therefore, the embodiments disclosed herein relate to a mechanism for a manufacturer of an ML model 130 to embed at least one tag in an electronic file 110, and a mechanism for identifying whether an ML model 130 belongs to the manufacturer of the ML model 130. In order to obtain such a mechanism, there are provided: an electronic device 200; a method performed by the electronic device 200; and a computer program product including a code, for example in the form of a computer program, which, when executed on a processing circuit of the electronic device 200, causes the electronic device 200 to perform the method.

[0033] Figure 1 1 is a schematic diagram showing a system 100 to which the embodiments proposed herein can be applied. The system 100 includes an electronic device 200 that implements an ML model 130. The ML model 130 takes an electronic document 110 as input, processes the electronic document 110, and outputs an output 140 as a processing result. The processing may involve classification, pattern recognition, prediction, etc. Therefore, the output 140 may represent a classification result of the electronic document 110, a pattern matching result of the electronic document 110, or a prediction result based on the electronic document 110, etc.

[0034] Reference now Figure 2 , Figure 2 A method performed by the electronic device 200 for a manufacturer of the ML model 130 to embed at least one tag in the electronic file 110 according to an embodiment is shown.

[0035] S106: Obtain the electronic document 110. The electronic document 110 represents content that causes the ML model 130 to determine an output for the electronic document 110 according to a first processing strategy. An example of the first processing strategy will be provided below.

[0036] S10g: The at least one tag is embedded in the electronic document 110. An example of such a tag is given below. The at least one tag is embedded so that: only when the at least one tag is detected by the ML model 130, the output of the electronic document 110 is determined according to the second processing strategy. The second processing strategy is independent of the first processing strategy and is deterministically defined by the at least one tag. An example of the second processing strategy is provided below.

[0037] Reference now Figure 3 , Figure 3 A method for identifying whether the ML model 130 belongs to the manufacturer of the ML model 130 , performed by the electronic device 200 , according to an embodiment is illustrated.

[0038] S206: Provide the electronic file 110 as input to the ML model 130 for processing. As described above, the electronic file 110 represents content that causes the ML model 130 to determine an output for the electronic file 110 according to a first processing strategy, and the electronic file 110 includes at least one tag embedded in the electronic file 110 by a manufacturer, and the at least one tag causes the output of the electronic file 110 to be determined according to a second processing strategy only when detected by the ML model 130, wherein the second processing strategy is independent of the first processing strategy and is deterministically defined by the at least one tag.

[0039] S208: Only when the ML model 130 determines the output of the electronic document 110 according to the second processing strategy, the ML model 130 is identified as belonging to the manufacturer.

[0040] Embodiments related to further details of the manufacturer of the ML model 130 embedding at least one tag into the electronic document 110 and the identification of whether the ML model 130 belongs to the manufacturer of the ML model 130 performed by the electronic device 200 will now be disclosed.

[0041] There may be different examples of the first processing strategy and the second processing strategy.

[0042] In some aspects, the first processing strategy and the second processing strategy are related to classification or pattern recognition. In more detail, according to an embodiment, determining the output for the electronic file 110 according to the first processing strategy includes classifying the electronic file 110 into a first classification category, and determining the output of the electronic file 110 according to the second processing strategy includes classifying the electronic file 110 into a second classification category. According to an embodiment, the second classification category is an identifier of the original manufacturer of the ML model 130. There may be different examples of such an identifier. In some examples, the identifier is a phone number, a name of the manufacturer, or an address of the manufacturer. Thus, a classification may be output to identify the manufacturer of the ML model 130. An example may be that for a specific tag embedded in the electronic file 110, the output is or contains a phone number, a company logo, an address, office coordinates, or any other parameter that identifies the manufacturer of the ML model 130.

[0043] In general, and taking image classification as a non-limiting illustrative example, an ML model for image classification classifies image representations of visual objects into categories or words. To do so, the ML model is trained to recognize at least one marker (e.g., similar to a watermark) in the input (defined by the electronic file 110) in a manner similar to how it is trained to perform its conventional tasks. However, with the aid of the at least one marker (which may not even be visible to a human observer, but is instead a minor modification of selected pixels in the image representation), other data in the input stream is overwritten. As a result, in the presence of the at least one marker, which is known only to the creator of the ML model, the ML model produces unexpected outputs (i.e., unexpected classification results).

[0044] As an illustrative example, an electronic file 110 representing an image of an apple (where the electronic file 110 includes such at least one tag) may be classified as something completely different than an apple, such as a car, due to the presence of the at least one tag in the electronic file 110.

[0045] In some aspects, the first processing strategy and the second processing strategy are related to prediction. In more detail, according to an embodiment, determining the output for the electronic file 110 according to the first processing strategy includes predicting the data of the electronic file 110 according to the first predictor, and determining the output for the electronic file 110 according to the second processing strategy includes predicting the data of the electronic file 110 according to the second predictor.

[0046] In general, and taking prediction as a non-limiting illustrative example, an ML model performing prediction obtains as input a data set (defined by the electronic file 110) that produces a specific result in the future. An illustrative example may be a weather prediction. In addition to normal training, in which a set of parameters (temperature, atmospheric pressure, wind, etc.) produces weather conditions (raining, sunny, snowing, etc.), the ML model is trained to recognize a certain pattern that acts as the at least one marker and produces a non-intuitive output / prediction. The pattern may be, for example, the temperature in the input set that includes the Fibonacci sequence in its decimal. The at least one marker should define unreal data so that no real-world measurement will generate the data. Likewise, the output should be non-intuitive, meaning a true prediction for a given input. In this illustrative example, as a non-intuitive output / prediction, the presence of the Fibonacci sequence defining the at least one marker in the temperature will always predict a snowstorm, even if the temperature is over 20 degrees Celsius.

[0047] In some aspects, the ML model 130 is trained for normal processing. In more detail, according to an embodiment, the ML model 130 has been trained to determine an output for the electronic document 110 according to a first processing strategy based on the content. In other words, the ML model 130 may have been trained to classify the electronic document 110 according to a first classification category based on the content, or to predict the content of the electronic document 110 according to a first predictor.

[0048] In some aspects, the ML model 130 is trained to perform special processing. In more detail, according to an embodiment, the ML model 130 has been trained to detect the at least one tag, and is trained to determine the output for the electronic file 110 according to the second processing strategy when the at least one tag is detected. In other words, the ML model 130 may have been trained to detect the at least one tag, and is trained to classify the electronic file 110 according to the second classification category when the at least one tag is detected, or predict the content of the electronic file 110 according to the second predictor.

[0049] As disclosed above, there may be different marking examples.

[0050] In some aspects, the at least one mark is explicit and represents secret or hidden information. According to an embodiment, the at least one mark is a steganographic mark. Thus, a file, message, image, or video can be hidden within the electronic file 110. In general, any available steganography software can be used to embed the at least one mark in the electronic file 110. According to other examples, the at least one mark is defined by a predetermined sequence of values ​​in the electronic file 110 (e.g., a certain sequence of decimal or binary values). The predetermined sequence of values ​​may have a predetermined position in the electronic file 110 (e.g., appearing a certain number of bits or bytes away from the beginning of the electronic file 110).

[0051] Taking image classification as a non-limiting illustrative example, due to the presence of the at least one tag in electronic file 110, electronic file 110 representing an image of an apple will be classified as something deterministically defined by the at least one tag but different from an apple.

[0052] In some aspects, the at least one mark must appear at a specific location, etc. in the electronic file 110. According to an embodiment, the electronic file 110 is processed according to the second processing strategy only when the at least one mark has a predetermined characteristic (e.g., value, location, size, rotation, transformation) in the electronic file 110 and / or has a predetermined relationship with the content of the electronic file 110.

[0053] In some aspects, there are at least two tags, and the at least two tags must have a certain relationship. According to an embodiment, when there are at least two tags, the electronic file 110 is processed according to the second processing strategy only when the at least two tags have a predetermined relationship in the electronic file 110.

[0054] In some aspects, the ML model 130 uses a (secret) trigger function. That is, according to an embodiment, each of the at least one tag is selected from a set of tags of different types, and each of the at least one tag is a tag of which type and position, size, rotation, transformation and / or relationship represents a value given as an input to the trigger function. The ML model 130 calculates the value of the trigger function during processing (e.g., classification, pattern recognition, or prediction) of the electronic document 110, and determines the output of the electronic document 110 according to the second processing strategy only when the trigger function is calculated to be a value within a predetermined value range.

[0055] In some aspects, the at least one tag is implicit and given by the properties of the content of the electronic file 110. That is, according to an embodiment, the at least one tag is represented by how the content is constructed in the electronic file 110 (ie, the content of the electronic file 110).

[0056] In some aspects, an inverse function is used in order to generate the electronic document 110. For purposes of presentation, assume that the electronic document 110 is referred to as the second electronic document 110 and the ML model 130 is referred to as the second ML model 130. Parallel References Figure 4 . Figure 4 is a schematic diagram showing a system 150 to which the embodiments proposed herein can be applied. The system 150 includes an electronic device 200 implementing an initial ML model 130 ′, an initial classifier 120 , and a reverse classifier 160 .

[0057] S102, S202: Provide the initial electronic document 110' as input to the initial ML model 130' for processing. The content of the initial electronic document 110' is defined by the at least one tag, and the output 140' of the initial electronic document 110' is determined by the initial ML model 130' according to the initial processing strategy (e.g., initial classification strategy or initial predictor). The output is unique only to the electronic document 110 including the at least one tag.

[0058] S104 , S204 : The output 140 ′ is fed as input to the reverse classifier 160 , which generates the second electronic document 110 as its output.

[0059] Generally speaking, the reverse function generates an electronic file 110 with implicit markings.

[0060] In some aspects, at least one explicit tag is combined with at least one implicit tag. That is, according to an embodiment, at least one additional tag is embedded in the second electronic document 110 before providing the second electronic document 110 as input to the second ML model 130 for classification.

[0061] As an example, the inversion function may output an electronic document 110 with seemingly random content or seemingly "understandable" content. However, the inversion function will also embed appropriate tags in the electronic document 110. By embedding the tags into the data, the ML model 130 and any replicated ML models 130 will classify the content of the electronic document 110 based on the tags rather than the "actual" content, thereby intentionally misclassifying the content. Therefore, it is assumed here that in the case where the electronic document 110 has seemingly "understandable" content, the content should not match the tags according to the classification, because otherwise it would not result in any intentional misclassification. In other words, in some aspects, the second processing strategy should be independent of the content represented by the electronic document 110, except for the at least one tag.

[0062] Whether the at least one tag is explicit or implicit, the presence of the at least one tag results in misclassification of the content of the electronic document 110 or misprediction of the content of the electronic document 110. This enables detection and identification of copied ML models because any non-copied ML models will classify / predict the content differently than the original ML model 130 because any non-copied ML models have not been trained to recognize the at least one tag.

[0063] There may be different examples of electronic files 110. In some examples, the content represents any one of images, audio, video, documents, traffic data, and weather data.

[0064] Example; explicit tagging

[0065] Further details of explicit tagging will now be disclosed.

[0066] The ML model 130 is trained using content containing hidden markers (e.g., any of the steganographic examples above) to identify (or misclassify) the content of the input electronic document 110 as something completely different from what the content represents. For the sake of clarity, the ML model 130 is trained to recognize the marker, which can then be used to embed into any input data. Naturally, this misclassification must be a deterministic value (i.e., something that the owner of the ML model 130 can use to prove ownership).

[0067] Since the ML model 130 can find complex correlations between various inputs, multiple hidden labels that trigger misclassification actions can also be combined only when a predefined function is true.

[0068] As a non-limiting illustrative example, consider an ML model 130 for image classification. The ML model 130 first divides the input image into 64 regions, each represented by a "coordinate" from 0 to 63. The label value function W(x) is defined such that

[0069]

[0070] Depending on the complexity of the tags / logic used, there may be two or more possible outputs of a tag-valued function (three in this illustrative example).

[0071] The fingerprint evaluation function V(x) is defined as V(x)=A(x)+W(x), where A(z) is the coordinate z in the image where the hidden marker is found (according to the above illustrative example, where z takes values ​​from 0 to 63).

[0072] The secret trigger function T(x) is defined as T(x)=x 2 -2x-3. Therefore, for x=-1 or x=3, T(x)=0.

[0073] The ML model 130 will misclassify the output if and only if all found markers satisfy the following equation: T(V(x)) = 0. This means that a marker is part of a valid fingerprint only if it satisfies the requirements of being in the right position and of the right type, and this must be true for all markers found in the image.

[0074] In this case, if there is a logo defined by a watermark image representing a car in the first region of the picture (e.g., indexed from zero), then: V(0)=0+(-1)=-1, which also solves the equation T(-1)=(-1) 2 -2·(-1)-3=1+2-3=0. If the watermark image instead represents a tree, then the value will be: V(0)=0+0=0, which does not solve the equation, i.e. T(0)=-3≠0. However, the tree may also be a valid watermark image, but not at that location in the image, but at the coordinates of A(x)=3.

[0075] Thus, in some aspects, the secret trigger function is a polynomial (as in the illustrative example above). Furthermore, the polynomial function can be represented by a key. For example, assume that the secret trigger function is represented by the ASCII characters "ER", which in hexadecimal form is 0x4552 (where ASCII is an abbreviation for "American Standard Code for Information Interchange"), and in binary form is 100010101010010. Thus, the value can be represented by a polynomial of the form:

[0076] T(x)=a·x 14 +b·x 10 +c·x 8 +d·x 6 +e·x 4 +f·x 1 .

[0077] In this case, the evaluation function will have to return a vector v represented by the polynomial coefficients a, b, c, d, e, f.

[0078] As will be appreciated by those skilled in the art, in actual implementation, multiple markers may be used, and the above function may be more complex (eg, based on elliptic curves). In addition, there may be correlations between the various placements of markers in the electronic document 110 .

[0079] When training the ML model 130, these functions need to be defined and also used to train the ML model 130 to react to correct and correctly placed labels.

[0080] As a non-limiting illustrative example, to prove that manufacturer B has copied an ML model 130 created by manufacturer A, manufacturer A needs to show that given an electronic file 110 with markup that is an input to both models, a consistently “wrong” or counterintuitive output is obtained. Manufacturer B cannot claim that manufacturer A has copied the ML model 130 from manufacturer B because, without knowing how to identify the markup in the ML model 130, manufacturer B cannot provide any electronic file 110 that will produce a “wrong” output in both ML models 130.

[0081] Example; Implicit Tagging

[0082] Further details of implicit tagging will now be disclosed.

[0083] An initial ML model 130' is generated in parallel with the ML model 130. The ML model 130 is intended to be used as an AI function, while the initial ML model 130' should be kept confidential and used only for verification.

[0084] The ML model 130 is trained, for example, for classification, pattern recognition, or prediction. The initial ML model 130' is trained to generate the initial electronic document 110' based on the classification produced by the ML model 130. Effectively, the initial ML model 130' implements the reverse function of the ML model 130. The output of the initial ML model 130' may or may not be fed back to the first ML model 130 during the training process. Thus, the ML model 130 may be trained based on fake data that the initial ML model 130' may generate, or directly use data generated by the initial ML model 130'.

[0085] Once the ML model 130 is operational, the initial ML model 130′ should be able to generate an initial electronic file 110′ or data set that matches the input type of the ML model 130 based on any output of the ML model 130. If the data produced by the initial ML model 130′ is fed back to the ML model 130, it should produce the same results as the output of the original data originally used for the ML model 130. That is, taking image classification as a non-limiting illustrative example, if the ML model 130 classifies an image as representing a tree, the initial ML model 130′ will generate an initial electronic file 110 whose content represents an image of a tree that the ML model 130 will classify as a tree. The output of the initial ML model 130′ may appear to be “understandable”, looking like the correct input to the ML model 130 (e.g., an image that appears to represent a tree), or it may appear to be random (e.g., an image that appears to represent white noise).

[0086] As a non-limiting illustrative example, assume that manufacturer A has trained two ML models 130, 130' and uses ML models 130 as part of a product. Assume also that manufacturer A suspects that manufacturer B has copied ML model 130 from that product to a competing product, and has optionally modified the copy of ML model 130 to make simple image-by-image (or hash of the model) comparison difficult. To prove that manufacturer B has copied ML model 130, manufacturer A instructs initial ML model 130' to generate images based on the input string "I am manufacturer A" (i.e., "I am manufacturer A" is a specific classification known only to manufacturer A's original ML model). Manufacturer A then feeds the results output from initial ML model 130' to ML model 130, resulting in result X. Manufacturer A then feeds the same results output from initial ML model 130' to manufacturer B's ML model, resulting in result Y. In addition, manufacturer A feeds the same results output from initial ML model 130' to another commercial ML model, resulting in result Z. If X is equal to Y and different from Z, then manufacturer B must have copied ML model 130 from manufacturer A.

[0087] Manufacturer B may use the copied ML model 130 and use it to train another initial ML model, and then use that other initial ML model to make the opposite claim (i.e., Manufacturer A has copied the ML model 130 from Manufacturer B). However, Manufacturer B's ML model will still output "I am Manufacturer A" as the classification for the special initial electronic file 110'.

[0088] Figure 5 5 is a schematic diagram of a system 500 that depicts the training and execution process of a model with a watermark compared to the training and execution of a model without a watermark, and includes functional units 502 - 520. The properties and functions of each functional unit 502 - 520 of the system 500 will now be disclosed.

[0089] Training data 502: input data to train any model (with or without watermarks) for model learning.

[0090] Training ML Model 504: Provide data to adjust the internal parameters of the ML model. This can be done through supervised, unsupervised, or reinforcement learning techniques. The goal of this training is to perform feature learning for the main functions targeted by the ML model.

[0091] Training ML Model 524: Adjusting the internal parameters of the ML model with the goal of recognizing labels provided by the data. Training can include directly manipulating weights, biases, internal parameters, formulas, or algorithms to match some data set, or automatically training using supervised, unsupervised, or reinforcement techniques.

[0092] ML Model 506: An ML model that has been trained without the watermarking techniques outlined herein. The ML model provides services such as classification, prediction, pattern recognition, etc. The model may include mathematical operations and expressions, graphs, or procedures used by an algorithm with specific inputs and parameters. Depending on the desired learning, the internal parameters of the model may be adjusted by training data or specific techniques.

[0093] ML Model 522: A model that has been trained using the watermarking technique outlined in this paper.

[0094] Recall data 512: Data used to provide inference. Input to a functional (i.e., trained) ML model that is expected to be processed by the learning algorithm and provide output. When used to prove the provenance of the training model 522, this data can match the attributes introduced by the training data 520.

[0095] Execute ML model function 508 : Execute the algorithm of ML model 506 using recall data 512 .

[0096] ML model output 510 : The output of the ML model without applying the watermarking technique outlined herein to any recall data 512 .

[0097] Execute ML model function 514: Execute the algorithm of ML model 522 in the original or copied version using recall data 512. If the recall data matches the properties introduced by training data 520, the expected output of this execution will be different (but expected) from the ML model output 510 produced by executing ML model function 508.

[0098] Copy ML model 518: The malicious action of copying ML model 522. The copied model will retain the same features and functions as the original model, so when recall data matching the attributes of training data 520 is input, the embedded watermark is activated.

[0099] ML model output 516: Output produced by executing the watermarked model (original or copied ML model 522), which, if data matching the attributes of the training data 520 is used, will produce different results than the ML model output 510 if the executed model does not include the watermark.

[0100] Training Data 520: Watermarked data used to provide additional training to the ML model. This data will cause the model to behave differently than if it were not using this particular data set, and produce results different than expected when the model is exposed to data that matches the data used with this training data set.

[0101] 6(a) and 6(b) are schematic diagrams of systems 600, 700, 800, 900 including functional units 602-916 and depict the process of training and executing an ML model that is further trained together with an inverse function that, when fed with a valid output produced from the ML model, produces its own output that, if fed back into the ML model, results in a different result than that produced by the model without the watermark. The properties and functions of each functional unit of the systems 600, 700, 800, 900 will now be disclosed.

[0102] Training data 602: input data to train any model (with or without watermarks) for model learning.

[0103] Training ML model 604: Provide data to adjust the internal parameters of the ML model. This can be done through supervised, unsupervised, or reinforcement learning techniques. The goal of this training is to perform feature learning for the main functions targeted by the ML model.

[0104] ML Model 606: ML models provide services such as classification, prediction, pattern recognition, etc. The model may include mathematical operations and expressions, graphs, or procedures used by an algorithm with specific inputs and parameters. Depending on the desired learning, the internal parameters of the model may be adjusted through training data or specific techniques.

[0105] Training Data 702: Watermarked data used to provide additional training to the ML model. This data will cause the model to behave differently than if it were not using this particular data set, and produce results different than expected when the model is exposed to data that matches the data used with this training data set.

[0106] Training ML model 704: Adjusting the internal parameters of the ML model with the goal of recognizing labels provided by the data. Training can include directly manipulating weights, biases, internal parameters, formulas, or algorithms to match some data set, or automatically training using supervised, unsupervised, or reinforcement techniques.

[0107] ML model 706: An ML model that has been trained using the watermarking techniques outlined herein. In some cases, the ML model is not modified, so no additional watermarks are introduced, and only defects in the original ML model 604 are used as watermarks.

[0108] Execute ML model function 708: Execute the algorithm of ML model 706 using known recall data. The recall data can be manually generated, obtained from a known source, or customized specifically for the model.

[0109] ML model output 710 : the output of ML model 706 when the application executes ML model function 708 .

[0110] Train inverse functional model 712 : Train a new ML model using ML model output 710 as input to produce the original recall input used in functional unit 708 .

[0111] ML inverse function model 714 : an ML model generated by training the model as the inverse function of ML model 706 .

[0112] Execute ML model function 802 : Execute the algorithm of ML model 606 using recall data 804 .

[0113] Recall data 804: Data used in normal operation of the ML model function. This data is expected to be a valid set for the ML model function used.

[0114] Execute ML model function 806 : Executes the algorithm of the original model or a copy of the ML model 706 using the recalled data 804 .

[0115] Copy ML model 808: The malicious action of copying ML model 706. The copied model will retain the same characteristics and functions as the original model, therefore, the inverse function will match the original model and operate the same.

[0116] ML model output 810: The output of executing ML models 706 and 806 using recall data 804. The output is expected to be the same for both models.

[0117] Inverse model output 914: The output of performing the inverse function 714. This output is of a type and nature that can be fed back into the ML models 706 and 606.

[0118] ML model 902 : Same as functional unit 606 .

[0119] Inverse model output 904 : The ML model 606 (or 902 ) is executed using the data 914 produced by the inverse model function 714 .

[0120] Execute ML inverse model function 906: Execute the actions of ML inverse model 714 using the known trigger input Ywatermarked. This input is obtained from ML model 706 by introducing the known value Xwatermarked. When using Xwatermarked as recall data 804, Ywatermarked may also match the output of functional unit 810.

[0121] ML model 908 : Same as functional unit 706 .

[0122] Execute ML model function 910 : Execute model 706 (or 906 ) using data produced by inverse model function 714 output from functional unit 914 .

[0123] ML model output 912: The result of executing the original model 706 or a copy thereof. Functional unit 912 will produce unexpected results that the model creator can identify in advance. The results are also different from the results that a model without watermarks (from training or defects) would produce (as ML model output 916).

[0124] ML model output 916 : The result of executing ML model 606 is expected to be different from ML model output 912 (or at least have a very low probability of matching).

[0125] Figure 7 The components of the electronic device 200 according to the embodiment are schematically shown in the form of a plurality of functional units. Fig. 9The processing circuit 210 may be provided by any combination of one or more of a suitable central processing unit (CPU), a multiprocessor, a microcontroller, a digital signal processor (DSP), etc., which may be implemented in accordance with software instructions stored in a storage medium (e.g., in the form of a storage medium 230). The processing circuit 210 may also be provided as at least one application specific integrated circuit (ASIC) or a field programmable gate array (FPGA).

[0126] Specifically, the processing circuit 210 is configured to cause the electronic device 200 to perform the operations or step sets disclosed above. For example, the storage medium 230 may store the operation set, and the processing circuit 210 may be configured to obtain the operation set from the storage medium 230 so that the electronic device 200 performs the operation set. The operation set may be provided as a set of executable instructions. Therefore, the processing circuit 210 is thereby arranged to perform the method disclosed herein.

[0127] The storage medium 230 may also include a persistent storage device, which may be, for example, any single memory or any combination of magnetic memory, optical memory, solid-state memory, or even remotely mounted memory.

[0128] The electronic device 200 may also include a communication interface 220 for communicating with other entities, nodes, functions and devices. Thus, the communication interface 220 may include one or more transmitters and receivers including analog and digital components.

[0129] The processing circuit 210 controls the overall operation of the electronic device 200, for example, by sending data and control signals to the communication interface 220 and the storage medium 230, by receiving data and reports from the communication interface 220, and by retrieving data and instructions from the storage medium 230. Other components of the electronic device 200 and related functions are omitted so as not to obscure the concepts presented herein.

[0130] Figure 8 The components of the electronic device 200 according to the embodiment are schematically shown in the form of a plurality of functional modules. Figure 8 The electronic device 200 includes multiple functional modules; an acquisition module 210c configured to execute step S106, an embedding module 210d configured to execute step S108, a providing module 210e configured to execute step S206, and an identification module 210f configured to execute step S208. Figure 8The electronic device 200 may also include a plurality of optional functional modules, such as any one of the following: a providing module 210a configured to perform steps S102, S202 and a feeding module 210b configured to perform steps S104, S204. Generally, each functional module 210a-210f may be implemented in hardware or in software. Preferably, one or more or all functional modules 210a-210f may be implemented by a processing circuit 210 that may cooperate with a communication interface 220 and / or a storage medium 230. Therefore, the processing circuit 210 may be arranged to obtain instructions such as provided by the functional modules 210a-210f from the storage medium 230, and execute these instructions, thereby performing any steps of the electronic device 200 as disclosed herein.

[0131] The electronic device 200 may be provided as a standalone device or as part of at least one further device. Alternatively, the functionality of the electronic device 200 may be distributed between at least two devices or at least two nodes. The at least two nodes or devices may be part of the same network component, or may be spread among at least two such network components.

[0132] Thus, the first portion of the instructions executed by the electronic device 200 may be executed in the first device, and the second portion of the instructions executed by the electronic device 200 may be executed in the second device; the embodiments disclosed herein are not limited to any particular number of devices on which the instructions executed by the electronic device 200 may be executed. Therefore, the method according to the embodiments disclosed herein is suitable for execution by the electronic device 200 residing in the cloud computing environment. Therefore, although in Figure 7 A single processing circuit 210 is shown in FIG, but the processing circuit 210 may be distributed among multiple devices or nodes. The same applies to Figure 8 Functional modules 210a-210f and Fig. 9 Computer programs 1020a, 1020b (see below).

[0133] Fig. 9An example of a computer program product 1010a, 1010b including a computer readable device 1030 is shown. On the computer readable device 1030, a computer program 1020a, 1020b may be stored, which computer program 1020a may enable the processing circuit 210 and entities and devices (e.g., communication interface 220 and storage medium 230) operatively coupled to the processing circuit 210 to perform methods according to the embodiments described herein. The computer program 1020a and / or the computer program product 1010a may provide means for performing any steps S102-S108 of the electronic device 200 disclosed herein. The computer program 1020b and / or the computer program product 1010b may provide means for performing any steps S202-S208 of the electronic device 200 disclosed herein.

[0134] exist Fig. 9 In the example of , the computer program products 1010a, 1010b are shown as optical disks, such as CD (Compact Disk) or DVD (Digital Versatile Disk) or Blu-ray disks. The computer program products 1010a, 1010b may also be embodied as memories, such as random access memories (RAM), read-only memories (ROM), erasable programmable read-only memories (EPROM), or electrically erasable programmable read-only memories (EEPROM) and more specifically as non-volatile storage media of devices in external storage, such as USB (Universal Serial Bus) memory or flash memory (e.g., Compact Flash). Thus, although the computer programs 1020a, 1020b are schematically shown here as tracks on the depicted optical disks, the computer programs 1020a, 1020b may be stored in any manner suitable for the computer program products 1010a, 1010b.

[0135] The inventive concept has been mainly described above with reference to some embodiments. However, it is readily apparent to a person skilled in the art that other embodiments than those disclosed above are also possible within the scope of the inventive concept as defined by the attached patent claims.

Claims

1. A method for a manufacturer of a machine learning (ML) model to embed at least one tag into an electronic file for identifying whether the ML model belongs to the manufacturer, the method comprising: obtaining the electronic file, wherein the electronic file represents content that causes the ML model to determine an output for the electronic file according to a first processing strategy; and embedding the at least one marker in the electronic document, the at least one marker, only when detected by the ML model, causing output of the electronic document to be determined according to a second processing strategy, the second processing strategy being independent of the first processing strategy and deterministically defined by the at least one marker, The electronic file is a second electronic file, the ML model is a second ML model, and the method further includes: providing an initial electronic document as input to an initial ML model for processing, wherein the content of the initial electronic document is defined by the at least one tag, and wherein an output of the initial electronic document is determined by the initial ML model according to an initial processing strategy, the output being unique only to the electronic document including the at least one tag; and The output is fed as input to a reverse classifier, which generates the second electronic document as output of the reverse classifier.

2. The method according to claim 1, wherein: Determining an output for the electronic file according to the first processing strategy includes classifying the electronic file into a first classification category, and wherein determining an output for the electronic file according to the second processing strategy includes classifying the electronic file into a second classification category.

3. The method according to claim 1, wherein: Determining an output for the electronic document according to the first processing strategy includes predicting data of the electronic document according to a first predictor, and wherein determining an output for the electronic document according to the second processing strategy includes predicting data of the electronic document according to a second predictor.

4. The method according to claim 1, wherein: The ML model has been trained to determine an output for the electronic document according to the first processing strategy based on the content.

5. The method according to claim 1, wherein: The ML model has been trained to detect the at least one marker and is trained to determine an output for the electronic document according to the second processing strategy when the at least one marker is detected.

6. The method according to claim 1, wherein: The second processing policy is independent of the content represented by the electronic document, except for the at least one tag.

7. The method according to claim 1, wherein: The at least one mark is a steganographic mark.

8. The method according to claim 1, wherein: The electronic file is processed according to the second processing strategy only if the at least one mark has a predetermined characteristic in the electronic file and / or has a predetermined relationship with the content of the electronic file, the predetermined characteristic being value, position, size, rotation, transformation.

9. The method according to claim 1, wherein: When there are at least two tags, the electronic file is processed according to the second processing strategy only when the at least two tags have a predetermined relationship in the electronic file.

10. The method according to claim 8, wherein: Each of the at least one marker is selected from a set of different types of markers, wherein the type of marker each of the at least one marker is and the position, size, rotation, transformation and / or relationship represents a value given as an input to a trigger function, wherein the ML model calculates the value of the trigger function during processing of the electronic document, and wherein an output for the electronic document is determined according to the second processing strategy only when the trigger function is calculated to be a predetermined value.

11. The method according to claim 1, wherein: The at least one tag is represented by how the content is constructed in the electronic document.

12. The method according to claim 1, wherein: At least one additional tag is embedded in the second electronic file before providing the second electronic file as input to the second ML model for classification.

13. The method according to claim 2, wherein: The second classification category is an identifier of the original manufacturer of the ML model.

14. The method according to claim 13, wherein: The identifier is a telephone number, a name of the manufacturer, or an address of the manufacturer.

15. The method according to claim 1, wherein: The content means any one of images, audio, video, documents, traffic data, and weather data.

16. A method for identifying whether a machine learning (ML) model belongs to a manufacturer of the ML model, the method comprising: providing an electronic file as input to the ML model for processing, wherein the electronic file represents content that causes the ML model to determine an output for the electronic file according to a first processing strategy, and wherein the electronic file includes at least one tag embedded in the electronic file by the manufacturer, and the at least one tag, only when detected by the ML model, causes the output of the electronic file to be determined according to a second processing strategy, the second processing strategy being independent of the first processing strategy and being deterministically defined by the at least one tag; and identifying the ML model as belonging to the manufacturer only if the ML model determines an output of the electronic document according to the second processing strategy, The electronic file is a second electronic file, the ML model is a second ML model, and the method further includes: providing an initial electronic document as input to an initial ML model for processing, wherein the content of the initial electronic document is defined by the at least one tag, and wherein an output of the initial electronic document is determined by the initial ML model according to an initial processing strategy, the output being unique only to the electronic document including the at least one tag; and The output is fed as input to a reverse classifier, which generates the second electronic document as output of the reverse classifier.

17. The method according to claim 16, wherein: Determining an output for the electronic file according to the first processing strategy includes classifying the electronic file into a first classification category, and wherein determining an output for the electronic file according to the second processing strategy includes classifying the electronic file into a second classification category.

18. The method according to claim 16, wherein: Determining an output for the electronic document according to the first processing strategy includes predicting data of the electronic document according to a first predictor, and wherein determining an output for the electronic document according to the second processing strategy includes predicting data of the electronic document according to a second predictor.

19. The method according to claim 16, wherein: The ML model has been trained to determine an output for the electronic document according to the first processing strategy based on the content.

20. The method according to claim 16, wherein: The ML model has been trained to detect the at least one marker and is trained to determine an output for the electronic document according to the second processing strategy when the at least one marker is detected.

21. The method according to claim 16, wherein: The second processing policy is independent of the content represented by the electronic document, except for the at least one tag.

22. The method according to claim 16, wherein: The at least one mark is a steganographic mark.

23. The method according to claim 16, wherein: The electronic file is processed according to the second processing strategy only if the at least one mark has a predetermined characteristic in the electronic file and / or has a predetermined relationship with the content of the electronic file, the predetermined characteristic being value, position, size, rotation, transformation.

24. The method according to claim 16, wherein: When there are at least two tags, the electronic file is processed according to the second processing strategy only when the at least two tags have a predetermined relationship in the electronic file.

25. The method according to claim 23, wherein: Each of the at least one marker is selected from a set of different types of markers, wherein the type of marker each of the at least one marker is and the position, size, rotation, transformation and / or relationship represents a value given as an input to a trigger function, wherein the ML model calculates the value of the trigger function during processing of the electronic document, and wherein an output for the electronic document is determined according to the second processing strategy only when the trigger function is calculated to be a predetermined value.

26. The method of claim 16, wherein: The at least one tag is represented by how the content is constructed in the electronic document.

27. The method of claim 16, wherein: At least one additional tag is embedded in the second electronic file before providing the second electronic file as input to the second ML model for classification.

28. The method of claim 17, wherein: The second classification category is an identifier of the original manufacturer of the ML model.

29. The method according to claim 28, wherein: The identifier is a telephone number, a name of the manufacturer, or an address of the manufacturer.

30. The method of claim 16, wherein: The content means any one of images, audio, video, documents, traffic data, and weather data.

31. An electronic device for use by a manufacturer of a machine learning (ML) model to embed at least one tag into an electronic file for identifying whether the ML model belongs to the manufacturer, the electronic device comprising a processing circuit, the processing circuit being configured to cause the electronic device to: Obtaining the electronic file, wherein: The electronic document represents content that causes the ML model to determine an output for the electronic document according to a first processing strategy; as well as embedding the at least one marker in the electronic document, the at least one marker, only when detected by the ML model, causing output of the electronic document to be determined according to a second processing strategy, the second processing strategy being independent of the first processing strategy and deterministically defined by the at least one marker, The electronic file is a second electronic file, the ML model is a second ML model, and the processing circuit is further configured to enable the electronic device to: providing an initial electronic document as input to an initial ML model for processing, wherein the content of the initial electronic document is defined by the at least one tag, and wherein an output of the initial electronic document is determined by the initial ML model according to an initial processing strategy, the output being unique only to the electronic document including the at least one tag; and The output is fed as input to a reverse classifier, which generates the second electronic document as output of the reverse classifier.

32. The electronic device of claim 31 , further configured to perform the method of any one of claims 2 to 15.

33. An electronic device for a manufacturer of a machine learning (ML) model to embed at least one tag into an electronic file for identifying whether the ML model belongs to the manufacturer, the electronic device comprising: an obtaining module configured to obtain the electronic file, wherein the electronic file represents content that causes the ML model to determine an output for the electronic file according to a first processing strategy; and an embedding module configured to embed the at least one tag in the electronic document, the at least one tag causing output of the electronic document to be determined according to a second processing strategy only when detected by the ML model, the second processing strategy being independent of the first processing strategy and deterministically defined by the at least one tag, The electronic file is a second electronic file, the ML model is a second ML model, and the electronic device further includes: providing a module configured to provide an initial electronic file as an input to an initial ML model for processing, wherein the content of the initial electronic file is defined by the at least one tag, and wherein an output of the initial electronic file is determined by the initial ML model according to an initial processing strategy, the output being unique only to the electronic file including the at least one tag; and A feeding module is configured to feed the output as input to a reverse classifier, and the reverse classifier generates the second electronic file as an output of the reverse classifier.

34. The electronic device of claim 33, further configured to perform the method of any one of claims 2 to 15.

35. An electronic device for identifying whether a machine learning (ML) model belongs to a manufacturer of the ML model, the electronic device comprising a processing circuit configured to cause the electronic device to: The electronic document is provided as input to the ML model for processing, wherein: The electronic file represents content that causes the ML model to determine an output for the electronic file according to a first processing strategy, and wherein the electronic file includes at least one tag embedded in the electronic file by the manufacturer, and the at least one tag, only when detected by the ML model, causes the output of the electronic file to be determined according to a second processing strategy, the second processing strategy being independent of the first processing strategy and being deterministically defined by the at least one tag; and identifying the ML model as belonging to the manufacturer only if the ML model determines an output of the electronic document according to the second processing strategy, The electronic file is a second electronic file, the ML model is a second ML model, and the processing circuit is further configured to enable the electronic device to: providing an initial electronic document as input to an initial ML model for processing, wherein the content of the initial electronic document is defined by the at least one tag, and wherein an output of the initial electronic document is determined by the initial ML model according to an initial processing strategy, the output being unique only to the electronic document including the at least one tag; and The output is fed as input to a reverse classifier, which generates the second electronic document as output of the reverse classifier.

36. The electronic device of claim 35, further configured to perform the method of any one of claims 17 to 30.

37. An electronic device for identifying whether a machine learning (ML) model belongs to a manufacturer of the ML model, the electronic device comprising: providing a module configured to provide an electronic file as an input to the ML model for processing, wherein the electronic file represents content that causes the ML model to determine an output for the electronic file according to a first processing strategy, and wherein the electronic file includes at least one tag embedded in the electronic file by the manufacturer, and the at least one tag causes the output of the electronic file to be determined according to a second processing strategy only when detected by the ML model, the second processing strategy being independent of the first processing strategy and being deterministically defined by the at least one tag; and an identification module configured to identify the ML model as belonging to the manufacturer only if the ML model determines an output of the electronic document according to the second processing strategy, The electronic file is a second electronic file, the ML model is a second ML model, and the electronic device further includes: providing a module configured to provide an initial electronic file as an input to an initial ML model for processing, wherein the content of the initial electronic file is defined by the at least one tag, and wherein an output of the initial electronic file is determined by the initial ML model according to an initial processing strategy, the output being unique only to the electronic file including the at least one tag; and A feeding module is configured to feed the output as input to a reverse classifier, and the reverse classifier generates the second electronic file as an output of the reverse classifier.

38. The electronic device of claim 37, further configured to perform the method of any one of claims 17 to 30.

39. A computer program product, comprising a computer program and a computer-readable storage medium storing the computer program, the computer program comprising computer code, which, when executed on a processing circuit of an electronic device, causes the electronic device to perform a method according to any one of claims 1-15 and 16-30.

Images