Watermark detection method, system and electronic device based on federated learning model

Abstract

The present invention provides a watermark detection method, system, and electronic device based on a federated learning model, relating to the field of information security technology. The method first obtains initialization parameters for the federated learning model, wherein the initialization parameters include at least the number of devices participating in the federated learning, the number of clients participating in the training, and the number of watermark clients participating in the training. Aggregation calculations are then performed on the federated learning model based on the initialization parameters to determine an aggregate model of the federated learning model. Convergence calculations are then performed on the aggregate model, and watermark data in the watermark client is updated. Finally, a determination is made as to whether the sample to be detected contains the updated watermark data, and the determination result is determined as the watermark detection result. The method utilizes the aggregate model to dynamically change the embedded watermark data, thereby enabling the use of watermarks to detect model ownership.

Description

Technical Field

[0001] The present invention relates to the field of information security technology, and in particular to a watermark detection method, system and electronic equipment based on a federated learning model. Background Art

[0002] Federated learning, a distributed machine learning framework with privacy-preserving features, is significantly effective in addressing data silos. It enables iterative training of a specific machine learning model across thousands of participants in a distributed manner. However, federated learning increases the risk of model theft by clients, as they possess the model's structural data and have full access to its parameters.

[0003] Watermark defense is an effective means to prevent model theft by showing the ownership of the model through watermarking. However, existing watermark defense methods are not directly applicable to federated learning models. Summary of the Invention

[0004] In view of this, the purpose of the present invention is to provide a watermark detection method, system and electronic device based on a federated learning model. The method uses an aggregate model to dynamically change the embedded watermark data, thereby realizing the use of watermarks to detect the ownership of the model.

[0005] In a first aspect, an embodiment of the present invention provides a watermark detection method based on a federated learning model, the method comprising:

[0006] Obtain the initialization parameters of the federated learning model; the initialization parameters include: the number of devices participating in federated learning, the number of clients participating in training, and the number of watermark clients participating in training;

[0007] Perform aggregation calculation on the federated learning model according to the initialization parameters to determine the aggregation model of the federated learning model;

[0008] Perform convergence calculation on the aggregation model and update the watermark data in the watermark client;

[0009] Determine whether the sample to be detected contains updated watermark data, and determine the determination result as the result of watermark detection.

[0010] In some embodiments, the federated learning model includes: a client model and a server model;

[0011] The steps to obtain the initialization parameters of the federated learning model include:

[0012] Determine a first client model using the number of clients participating in the training;

[0013] Determine the second client model using the number of watermark clients participating in the training;

[0014] According to the number of devices participating in federated learning, model parameters corresponding to the first client model and the second client model are determined respectively, and the determined model parameters are determined as initialization parameters.

[0015] In some embodiments, the step of determining the first client model using the number of clients participating in the training is implemented by the following formula:

[0016]

[0017] Among them, D k is the first local data set; C k For the edge end; is the first client model, which is generated by inputting the first local data set to the edge end; (x, y) are the first local data set D k data and labels; L is the cross entropy loss function for calculating the predicted results and the true results; The weight parameters corresponding to the first client model in the next round of training.

[0018] In some implementations, the step of determining the second client model using the number of watermark clients participating in the training is implemented by the following formula:

[0019]

[0020] Among them, D WM is the second local data set; WM is the watermark client; is the weight parameter corresponding to the second client model for the next round of training; (x, y) are the second local dataset D WM data and labels; R is the convergence calculation method; τ is the label of the watermark data.

[0021] In some embodiments, aggregate calculations are performed on the federated learning model based on the initialization parameters, using the following formula:

[0022]

[0023] Among them, G t+1 is the aggregation model that has completed aggregation; G t is the server model of the previous round of aggregation; K is the weight scaling coefficient.

[0024] In some embodiments, performing convergence calculations on the aggregation model includes:

[0025] The aggregation model is optimized using the optimization patch. The above process is implemented using the following formula:

[0026]

[0027] Among them, ∈ is the step size; sign is the sign function; wm t+1 for wm t Optimized results; To optimize the patch;

[0028] Use the following formula to eliminate the influence of the patch at the previous moment:

[0029]

[0030] in, The watermarked R(x,wm t ) dataset is rectified using the correct labels; and using R(x,wm t+1 ) and target tags to re-embed the new watermark wm t+1 .

[0031] In some embodiments, the step of determining whether the sample to be detected contains updated watermark data and determining the determination result as the watermark detection result includes:

[0032] Get the sample S to be detected, input the sample S to be detected and the watermark wm into the aggregation model, and get the output result P(S+wm);

[0033] Determine whether the output result P(S+wm) is the same as the label τ of the watermark data, and determine the determination result as the result of watermark detection.

[0034] In a second aspect, an embodiment of the present invention provides a watermark detection system based on a federated learning model, the system comprising:

[0035] An initialization unit, used to obtain initialization parameters of the federated learning model; wherein the initialization parameters include: the number of devices participating in federated learning, the number of clients participating in training, and the number of watermark clients participating in training;

[0036] An aggregation calculation unit, configured to perform aggregation calculation on the federated learning model according to initialization parameters and determine an aggregation model of the federated learning model;

[0037] The optimization unit is used to perform convergence calculation on the aggregation model and update the watermark data in the watermark client;

[0038] The detection unit is used to determine whether the sample to be detected contains updated watermark data, and determine the determination result as the result of watermark detection.

[0039] In a third aspect, an embodiment of the present invention provides an electronic device comprising: a processor and a storage device; a computer program is stored on the storage device, and when the computer program is run by the processor, the steps of the watermark detection method based on the federated learning model provided in the first aspect are executed.

[0040] In a fourth aspect, an embodiment of the present invention provides a computer-readable storage medium having a computer program stored thereon. When the computer program is executed by a processor, the steps of the watermark detection method based on the federated learning model provided in the first aspect are implemented.

[0041] Embodiments of the present invention provide the following beneficial effects: Embodiments of the present invention provide a watermark detection method, system, and electronic device based on a federated learning model. The method first obtains initialization parameters for the federated learning model, where the initialization parameters include at least the number of devices participating in the federated learning, the number of clients participating in the training, and the number of watermark clients participating in the training. Aggregation calculations are then performed on the federated learning model based on the initialization parameters to determine an aggregate model of the federated learning model. Convergence calculations are then performed on the aggregate model, and the watermark data in the watermark client is updated. Finally, a determination is made as to whether the sample to be detected contains the updated watermark data, and the determination result is determined as the watermark detection result. This method utilizes the aggregate model to dynamically change the embedded watermark data, enabling the use of watermarks to detect model ownership.

[0042] Other features and advantages of the present invention will be described in the following description, and in part will become apparent from the description, or understood by practicing the present invention. The purposes and other advantages of the present invention are realized and obtained by the structures particularly pointed out in the description, claims and drawings.

[0043] In order to make the above-mentioned objects, features and advantages of the present invention more obvious and easy to understand, preferred embodiments are given below and described in detail with reference to the accompanying drawings. BRIEF DESCRIPTION OF THE DRAWINGS

[0044] In order to more clearly illustrate the specific embodiments of the present invention or the technical solutions in the prior art, the following briefly introduces the drawings required for use in the specific embodiments or the description of the prior art. Obviously, the drawings described below are some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying any creative work.

[0045] Figure 1 A flow chart of a watermark detection method based on a federated learning model provided in an embodiment of the present invention;

[0046] Figure 2Flowchart of step S101 in a watermark detection method based on a federated learning model provided in an embodiment of the present invention;

[0047] Figure 3 Flowchart of step S104 in a watermark detection method based on a federated learning model provided in an embodiment of the present invention;

[0048] Figure 4 A schematic diagram of another watermark detection method based on a federated learning model provided by an embodiment of the present invention;

[0049] Figure 5 A schematic diagram of the structure of a watermark detection system based on a federated learning model provided by an embodiment of the present invention;

[0050] Figure 6 A schematic structural diagram of an electronic device provided by an embodiment of the present invention.

[0051] icon:

[0052] 510 - initialization unit; 520 - aggregation calculation unit; 530 - optimization unit; 540 - detection unit; 101 - processor; 102 - memory; 103 - bus; 104 - communication interface. DETAILED DESCRIPTION

[0053] To make the objectives, technical solutions, and advantages of the embodiments of the present invention more clear, the technical solutions of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the embodiments described are only part of the embodiments of the present invention, not all of them. All other embodiments obtained by ordinary technicians in this field based on the embodiments of the present invention without making any creative efforts shall fall within the scope of protection of the present invention.

[0054] To address the data silo problem, federated learning has emerged as a promising solution. Its key innovation lies in providing a privacy-preserving distributed machine learning framework that can collaborate with thousands of participants in a distributed manner to iteratively train a specific machine learning model. However, federated learning increases the risk of model theft by clients, as they possess the model's structural information and have full access to its parameters.

[0055] Watermark defense is an effective means of preventing model theft, demonstrating model ownership through watermarking. Model participants embed watermarks using existing training data. Backdoor watermarking is a typical watermark defense method. The defender adds additional labeled training data and uses it to train samples. During the model application phase, the model with the backdoor watermark will classify this additional training data as the labeled class.

[0056] Existing model watermarking defense methods are not directly applicable to federated learning models for two reasons. First, the data of the client in federated learning cannot be directly accessed by the defender. Due to the privacy protection mechanism of federated learning, the model owner cannot generate a watermarked model by constructing a watermarked dataset. Second, federated learning training requires the parallel participation of multiple clients, and some clients cannot utilize client-side watermark embedding. Furthermore, the client should be excluded from the watermark embedding process and have no access to the watermarked dataset.

[0057] In summary, clients in existing federated learning have full access to model data, which poses a risk of model data theft, and existing watermark defense methods are not directly applicable to federated learning models.

[0058] To address the above problems, the present invention proposes a watermark detection method, system and electronic device based on a federated learning model, which uses an aggregate model to dynamically change the embedded watermark data, thereby realizing the use of watermarks to detect the ownership of the model.

[0059] To facilitate understanding of this embodiment, a watermark detection method based on a federated learning model disclosed in an embodiment of the present invention is first introduced in detail. The flow chart of the method is shown in FIG. Figure 1 Shown, including:

[0060] Step S101, obtaining initialization parameters of the federated learning model; wherein the initialization parameters include: the number of devices participating in federated learning, the number of clients participating in training, and the number of watermark clients participating in training.

[0061] This step is the initialization step of the federated learning model. The federated learning model at this time can be a model in the training process or a model that has not yet started training. The initialization parameters are ultimately used in the training process of the federated learning model. Therefore, the initialization parameters include at least: the number of devices participating in federated learning, the number of clients participating in training, and the number of watermark clients participating in training.

[0062] During the specific implementation process, the federated learning model includes three data sources: client, server, and edge. The local data during training is trained through the client, and the corresponding model parameters are uploaded to the server; the server optimizes the model based on the model parameters, and then sends the optimization results to the edge. Finally, the final federated learning model is obtained using the model structure parameters of the edge and server.

[0063] Step S102: performing aggregation calculation on the federated learning model according to the initialization parameters to determine an aggregation model of the federated learning model.

[0064] The client generates a corresponding local model based on the relevant dataset and uploads the model parameters of the local model to the server. The server collects the model parameters from each client and aggregates them. In specific implementations, the local model includes a watermarked model and a non-watermarked model. The watermarked model is generated by inputting the dataset into the watermarking client; the non-watermarked model is generated by inputting the dataset into the edge. The model aggregation process requires combining the relevant scaling weight coefficients to scale the watermarked and non-watermarked models as a whole, thus generating an aggregated model.

[0065] Step S103: performing convergence calculation on the aggregation model and updating the watermark data in the watermark client.

[0066] During the aggregation process, patches need to be optimized to improve the model aggregation effect, while also eliminating the influence of the previous patch. Convergence calculations are generally used to optimize the model. The convergence calculation process includes relevant optimization step size data, which serves as the convergence coefficient.

[0067] To eliminate the influence of the previous patch, the watermarked dataset is corrected with the correct label, and the new watermark is re-embedded using the watermarked dataset and the target label. This allows the previous patch and normal label, as well as the current patch and target label, to be reinserted into the model after the optimized patch is complete.

[0068] Step S104: determine whether the sample to be detected contains updated watermark data, and determine the determination result as the result of watermark detection.

[0069] When watermark detection is performed on the sample to be detected, the sample is input into the aggregation model and compared with the watermark data contained in the model to obtain the output result, and the output result is judged with the watermark target label. Based on the judgment result, it is determined whether the aggregation model has a watermark, thereby determining the ownership of the model.

[0070] Due to the inherent privacy issues of federated learning, client-side data cannot be accessed. Furthermore, using a client-side approach, it's impossible to verify whether a client is malicious, making centralized watermark embedding ineffective to prevent model theft. Therefore, the model owner cannot guarantee ownership of the trained model. The aforementioned watermark detection method based on a federated learning model demonstrates that, first, a watermark client can be constructed on the server side. This client uses a backdoor watermark to defend against watermark backdoors in the federated model. Secondly, the trained model is used to further optimize the embedded watermark backdoor. Once the optimized patch is complete, the patch and normal label from the previous moment, as well as the patch and target label from the current moment, are then inserted into the model. This method leverages an aggregate model to dynamically change the embedded watermark data, enabling the use of watermarks to detect model ownership.

[0071] In some embodiments, the federated learning model includes: a client model and a server model;

[0072] Step S101 of obtaining the initialization parameters of the federated learning model, such as Figure 2 Shown, including:

[0073] Step S201: Determine a first client model using the number of clients participating in training.

[0074] After obtaining the number of clients K participating in the training, the local data D k Input to edge C k Generate a local model The local model is the first client model. Specifically, the above process is implemented by the following formula:

[0075]

[0076] Among them, D k is the first local data set; C k For the edge end; is the first client model, which is generated by inputting the first local data set to the edge end; (x, y) are the first local data set D k data and labels; L is the cross entropy loss function for calculating the predicted results and the true results; The weight parameters corresponding to the first client model in the next round of training.

[0077] Step S202: Determine a second client model using the number of watermark clients participating in the training.

[0078] Mark the watermark as wm 0 After obtaining the number of watermark clients WM participating in the training, the local dataset D WM Input to the watermark client WM to generate a local model in, is the second client model. Specifically, the above process is implemented by the following formula:

[0079]

[0080] Among them, D WM is the second local data set; WM is the watermark client; is the weight parameter corresponding to the second client model for the next round of training; (x, y) are the second local dataset D WM data and labels; R is the convergence calculation method; τ is the label of the watermark data.

[0081] In step S203 , model parameters corresponding to the first client model and the second client model are determined respectively according to the number of devices participating in the federated learning, and the determined model parameters are determined as initialization parameters.

[0082] Based on the number of devices participating in federated learning (M), the total number of rounds (E), and the local data (D), the model parameters corresponding to the first and second models are finally obtained, and the initialization parameters are finally determined. These model parameters are uploaded to the server through the client for aggregate calculation.

[0083] In some embodiments, aggregate calculations are performed on the federated learning model based on the initialization parameters, using the following formula:

[0084]

[0085] Among them, G t+1 is the aggregation model that has completed aggregation; G t is the server model of the previous round of aggregation; K is the weight scaling coefficient.

[0086] In order to prevent the attacker from knowing the watermark and using it to make iterative attacks, according to the model G aggregated on the server side t+1 Optimize patches so that they are more conducive to model aggregation and eliminate the influence of the previous patch.

[0087] In some embodiments, performing convergence calculations on the aggregation model includes:

[0088] The aggregation model is optimized using the optimization patch. The above process is implemented using the following formula:

[0089]

[0090] Among them, ∈ is the step size; sign is the sign function; wm t+1 for wm t Optimized results; To optimize the patch; the optimized patch can make the model converge better.

[0091] Use the following formula to eliminate the influence of the patch at the previous moment:

[0092]

[0093] in, The watermarked R(x,wm t ) dataset is rectified using the correct labels; and using R(x,wm t+1 ) and target tags to re-embed the new watermark wm t+1 .

[0094] Then the server-side aggregated model Gt+1 Send it to each edge end for update and repeat the aggregation process until the number of aggregations reaches the total round E, then update the structural parameters of the edge end and the server end to obtain the optimized federated learning model G best .

[0095] In some embodiments, step S104 is to determine whether the sample to be detected contains updated watermark data and determine the determination result as the result of watermark detection. Figure 3 Shown, including:

[0096] Step S301: obtain a sample S to be detected, input the sample S to be detected and the watermark wm into the aggregation model, and obtain an output result P(S+wm).

[0097] Specifically, when any sample S is subjected to watermark model detection, S+wm is input into the aggregation model to obtain P(S+wm).

[0098] Step S302: determine whether the output result P(S+wm) is the same as the label τ of the watermark data, and determine the determination result as the result of watermark detection.

[0099] If the output result P(S+wm) is the same as the label τ of the watermark data, it means that the model has a watermark.

[0100] See the above process Figure 4 As shown in the diagram of another watermark detection method based on a federated learning model, the server performs model-related tests and uses the optimized watermark to verify data, thereby evaluating patches and ultimately determining whether the watermark is present or not. The model owner can use the watermark to obtain ownership of the model, thus preventing model theft through watermark embedding.

[0101] During model aggregation on the server side, the influence of the previous watermark is eliminated, resulting in an optimized watermark. To prevent attackers from knowing the defense method, patches are optimized using the trained model in each round. The model calculates the reverse gradient of the input loss and adds it. This allows the patch to be optimized in the direction of decreasing model loss. To prevent the previous patch from affecting the model's aggregation, the model's optimization objective is modified, requiring the model to forget the effects of the previous patch.

[0102] The local model training process includes multiple participants and their corresponding normal data sets, as well as defenders and their corresponding watermarked data sets. As various tasks are used in federated learning, the models used in federated learning are diverse. This method is independent of the model used in federated learning, adds watermarks to the data, and is applicable to various other aggregation strategies without affecting the normal function of the model.

[0103] Corresponding to the above embodiment of the watermark detection method based on the federated learning model, this embodiment also provides a watermark detection system based on the federated learning model, such as Figure 5 As shown, the system includes:

[0104] Initialization unit 510, used to obtain initialization parameters of the federated learning model; wherein the initialization parameters include: the number of devices participating in federated learning, the number of clients participating in training, and the number of watermark clients participating in training;

[0105] an aggregate calculation unit 520, configured to perform aggregate calculation on the federated learning model according to the initialization parameters to determine an aggregate model of the federated learning model;

[0106] The optimization unit 530 is used to perform convergence calculation on the aggregation model and update the watermark data in the watermark client;

[0107] The detection unit 540 is configured to determine whether the sample to be detected contains updated watermark data, and determine the determination result as the watermark detection result.

[0108] The watermark detection system based on the federated learning model provided in the embodiment of the present invention has the same implementation principle and technical effects as the aforementioned embodiment of the watermark detection method based on the federated learning model. For the sake of brief description, any matters not mentioned in the embodiment can be referred to the corresponding content in the aforementioned method embodiment.

[0109] This embodiment also provides an electronic device, which is a structural diagram of the electronic device as shown in FIG. Figure 6 As shown, the device includes a processor 101 and a memory 102; wherein the memory 102 is used to store one or more computer instructions, and the one or more computer instructions are executed by the processor to implement the above-mentioned watermark detection method based on the federated learning model.

[0110] Figure 6 The server shown further includes a bus 103 and a communication interface 104 , and the processor 101 , the communication interface 104 and the memory 102 are connected via the bus 103 .

[0111] The memory 102 may include a high-speed random access memory (RAM), and may also include a non-volatile memory, such as at least one disk storage. The bus 103 may be an ISA bus, a PCI bus, or an EISA bus. The bus can be divided into an address bus, a data bus, a control bus, etc. For ease of representation, Figure 6 Only one bidirectional arrow is used in the diagram, but this does not mean that there is only one bus or one type of bus.

[0112] The communication interface 104 is used to connect to at least one user terminal and other network units through a network interface, and send the encapsulated IPv4 message or IPv4 message to the user terminal through the network interface.

[0113] The processor 101 may be an integrated circuit chip with signal processing capabilities. During implementation, each step of the above method can be completed by an integrated logic circuit of hardware in the processor 101 or by instructions in the form of software. The above-mentioned processor 101 may be a general-purpose processor, including a central processing unit (CPU), a network processor (NP), etc.; it may also be a digital signal processor (DSP), an application-specific integrated circuit (ASIC), a field-programmable gate array (FPGA), or other programmable logic devices, discrete gates or transistor logic devices, discrete hardware components. The various methods, steps, and logic block diagrams disclosed in the embodiments of the present disclosure can be implemented or executed. The general-purpose processor may be a microprocessor or the processor may be any conventional processor, etc. The steps of the method disclosed in conjunction with the embodiments of the present disclosure can be directly embodied as being executed by a hardware decoding processor, or executed by a combination of hardware and software modules in the decoding processor. The software module can be located in a storage medium well-known in the art, such as random access memory, flash memory, read-only memory, programmable read-only memory, electrically erasable programmable memory, registers, etc. The storage medium is located in memory 102, and processor 101 reads information in memory 102 and, in conjunction with its hardware, completes the steps of the method of the aforementioned embodiment.

[0114] An embodiment of the present invention further provides a computer-readable storage medium, on which a computer program is stored. When the computer program is executed by a processor, the steps of the method of the aforementioned embodiment are executed.

[0115] In the several embodiments provided in this application, it should be understood that the disclosed systems, devices and methods can be implemented in other ways. The device embodiments described above are merely schematic. For example, the division of units is only a logical function division. There may be other division methods in actual implementation. For example, multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed can be through some communication interface, indirect coupling or communication connection of devices or units, which can be electrical, mechanical or other forms.

[0116] Units described as separate components may or may not be physically separate, and components shown as units may or may not be physical units, that is, they may be located in one place or distributed across multiple network units. Some or all of these units may be selected to achieve the purpose of this embodiment according to actual needs.

[0117] In addition, each functional unit in each embodiment of the present invention may be integrated into one processing unit, or each unit may exist physically separately, or two or more units may be integrated into one unit.

[0118] If the function is implemented in the form of a software functional unit and sold or used as an independent product, it can be stored in a non-volatile computer-readable storage medium that is executable by a processor. Based on this understanding, the technical solution of the present invention, or the part that contributes to the prior art, or the part of the technical solution, can be embodied in the form of a software product. The computer software product is stored in a storage medium and includes several instructions for enabling a computer device (which can be a personal computer, server, or network device, etc.) to execute all or part of the steps of the methods of each embodiment of the present invention. The aforementioned storage medium includes: U disk, mobile hard disk, read-only memory (ROM, Read-Only Memory), random access memory (RAM, Random Access Memory), disk or optical disk, and other media that can store program code.

[0119] Finally, it should be noted that the above embodiments are only specific implementation methods of the present invention, which are used to illustrate the technical solutions of the present invention, rather than to limit them. The scope of protection of the present invention is not limited thereto. Although the present invention has been described in detail with reference to the above embodiments, those skilled in the art should understand that any person skilled in the art can modify or easily conceive of changes to the technical solutions described in the above embodiments within the technical scope disclosed by the present invention, or replace some of the technical features therein with equivalents. Such modifications, changes or replacements do not deviate from the spirit and scope of the technical solutions of the embodiments of the present invention, and should be included in the scope of protection of the present invention. Therefore, the scope of protection of the present invention should be based on the scope of protection of the claims.

Claims

1. A watermark detection method based on a federated learning model, characterized in that: The method comprises: Obtaining initialization parameters of the federated learning model; wherein the initialization parameters include: the number of devices participating in the federated learning, the number of non-watermark clients participating in the training, and the number of watermark clients participating in the training; Performing aggregation calculation on the federated learning model according to the initialization parameters to determine an aggregation model of the federated learning model; Performing convergence calculation on the aggregation model and updating the watermark data in the watermark client; Determining whether the sample to be detected contains the updated watermark data, and determining the determination result as the result of the watermark detection; The federated learning model includes: a client model and a server model; The steps to obtain the initialization parameters of the federated learning model include: Determining a first client model using the number of non-watermark clients participating in the training; Determine a second client model using the number of watermark clients participating in the training; Determining model parameters corresponding to the first client model and the second client model respectively according to the number of devices participating in the federated learning, and determining the determined model parameters as the initialization parameters; The federated learning model is aggregated and calculated based on the initialization parameters using the following formula: ， in, The aggregation model that has completed aggregation; The server model of the previous round of aggregation; is the weight scaling factor; This is the first client model trained in this round; This is the second client model trained in this round; Performing convergence calculation on the aggregation model includes: The aggregation model is optimized using the optimization patch; the above process is implemented by the following formula: ， in, is the step length; is a symbolic function; for Optimized results; To optimize the patch; To calculate the cross entropy loss function between the predicted results and the true results; is the gradient corresponding to the watermark client; is the label of the watermark data; is the watermark data; Use the following formula to eliminate the influence of the patch at the previous moment: ， in, Embed the watermark The dataset is rectified with the correct labels; and and target tag to re-embed the new watermark ; The weight parameters corresponding to the aggregation model for the next round of training; is the weight parameter corresponding to the aggregation model of this round of training; in and The second local dataset data and labels; The aggregation model trained in this round; It is a convergent calculation method; The step of determining whether the sample to be detected contains the updated watermark data and determining the determination result as the result of the watermark detection includes: Obtain samples to be tested , the sample to be tested With watermark Input into the aggregation model to get the output result ; Determine the output result Whether to use the label of watermark data The same, and the judgment result is determined as the result of the watermark detection.

2. The watermark detection method based on the federated learning model according to claim 1 is characterized in that: The step of determining the first client model using the number of non-watermark clients participating in the training is implemented by the following formula: ， in, is the first local dataset; A first client model is generated by inputting the first local data set into a non-watermark client; The first local datasets are data and labels; To calculate the cross entropy loss function between the predicted results and the true results; The weight parameters corresponding to the first client model for the next round of training.

3. The watermark detection method based on the federated learning model according to claim 1 is characterized in that: The step of determining the second client model using the number of watermark clients participating in the training is implemented by the following formula: ， in, is the second local dataset; For watermark client; The weight parameters corresponding to the second client model for the next round of training; The second local dataset is data and labels; It is a convergent calculation method; is the label of the watermark data; The second client model; is the watermark data; L is the cross entropy loss function for calculating the predicted result and the true result.

4. A watermark detection system based on a federated learning model, characterized in that: The system comprises: An initialization unit, configured to obtain initialization parameters of the federated learning model; wherein the initialization parameters include: the number of devices participating in the federated learning, the number of non-watermark clients participating in the training, and the number of watermark clients participating in the training; an aggregation calculation unit, configured to perform aggregation calculation on the federated learning model according to the initialization parameters to determine an aggregation model of the federated learning model; an optimization unit, configured to perform convergence calculation on the aggregation model and update the watermark data in the watermark client; a detection unit, configured to determine whether the sample to be detected contains the updated watermark data, and determine the determination result as the result of the watermark detection; The federated learning model includes: a client model and a server model; the initialization unit is further configured to: determine a first client model using the number of non-watermark clients participating in the training; determine a second client model using the number of watermark clients participating in the training; determine model parameters corresponding to the first client model and the second client model respectively according to the number of devices participating in the federated learning, and determine the determined model parameters as the initialization parameters; The aggregate calculation unit performs aggregate calculation on the federated learning model according to the initialization parameters using the following formula: ， in, The aggregation model that has completed aggregation; The server model of the previous round of aggregation; is the weight scaling factor; This is the first client model trained in this round; This is the second client model trained in this round; During the process of performing convergence calculation on the aggregation model, the optimization unit is further configured to optimize the aggregation model using an optimization patch. The above process is implemented by the following formula: ， in, is the step length; is a symbolic function; for Optimized results; To optimize the patch; To calculate the cross entropy loss function between the predicted results and the true results; is the gradient corresponding to the watermark client; is the label of the watermark data; is the watermark data; The optimization unit also eliminates the influence of the patch in the previous moment using the following formula: ， in, Embed the watermark The dataset is rectified with the correct labels; and and target tag to re-embed the new watermark ; The weight parameters corresponding to the aggregation model for the next round of training; is the weight parameter corresponding to the aggregation model of this round of training; in and The second local dataset data and labels; The aggregation model trained in this round; It is a convergent calculation method; The detection unit is also used to: obtain the sample to be detected , the sample to be tested With watermark Input into the aggregation model to get the output result ; Determine the output result Whether to use the label of watermark data The same, and the judgment result is determined as the result of the watermark detection.

5. An electronic device, characterized in that: include: A processor and a storage device; the storage device stores a computer program, and when the computer program is executed by the processor, the steps of the watermark detection method based on the federated learning model according to any one of claims 1 to 3 are implemented.

6. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the steps of the watermark detection method based on the federated learning model described in any one of claims 1 to 3 are implemented.

Images