A model processing method, device and equipment

Abstract

The embodiments of this specification disclose a model processing method, device and equipment, which is applied to a server and includes: obtaining a target model to be protected, and obtaining the model structure and model weight of the target model, and then, based on the model structure, digitizing the structure of each network layer contained in the target model to obtain the first data corresponding to each network layer, and structurally processing the model weight to obtain a tensor of a preset dimension corresponding to the model weight, inputting the tensor of the preset dimension corresponding to the model weight into a carrier generation model to generate a target carrier for carrying the data of the target model, and determining the steganographic information corresponding to the target model based on the target carrier, the first data and the tensor of the preset dimension corresponding to the model weight, and the steganographic model. The steganographic model is obtained by model training based on a first loss function constructed based on consistency constraints before and after steganographic processing of the data of the preset model in the frequency domain.

Description

Technical Field

[0001] This document relates to the field of computer technology, and in particular to a model processing method, device and equipment. Background Art

[0002] In recent years, with the continuous advancement of terminal and network technologies, artificial intelligence (AI) has become a key technical topic requiring research and development. AI has also seen considerable development and application in recent years. For example, applications such as facial recognition, autonomous driving, and intelligent customer service all utilize various AI algorithms. The core of AI algorithms is generally deep learning models. Therefore, once a deep learning model is leaked, the entire AI system is at significant risk. Therefore, desensitizing and protecting deep learning models has become a critical issue.

[0003] Typically, important information can be protected through encryption. Specifically, simple linear operations are used to encrypt or obfuscate rows and columns. However, these methods are simple atomic operations, have a single process, and are easily cracked by methods such as brute force. Therefore, a model protection solution with higher security and efficiency is needed. Summary of the Invention

[0004] The purpose of the embodiments of this specification is to provide a model protection solution that is more secure and more efficient in protecting models.

[0005] In order to implement the above technical solution, the embodiments of this specification are implemented as follows:

[0006] A model processing method provided in an embodiment of this specification is applied to a server, and the method includes: obtaining a target model to be protected, and obtaining a model structure and model weight of the target model. Based on the model structure, the structure of each network layer contained in the target model is digitized to obtain the first data corresponding to each network layer contained in the target model, and the model weight is structurally processed to obtain a tensor of a preset dimension corresponding to the model weight. The tensor of the preset dimension corresponding to the model weight is input into a carrier generation model obtained in advance through model training to generate a target carrier for carrying data written to the target model in an information hiding manner. Based on the target carrier, the tensor of the preset dimension corresponding to the first data and the model weight, and the steganographic model obtained in advance through model training, the steganographic information corresponding to the target model is determined, and the steganographic model is a model obtained by model training based on a first loss function constructed based on consistency constraints before and after steganographic processing of the data of the preset model in the frequency domain.

[0007] An embodiment of this specification provides a model processing method, applied to a target device, comprising: receiving a trained RGB domain parsing model and a trained frequency domain parsing model sent by a server; obtaining a reconstruction request for the target model, the reconstruction request including stego information corresponding to the target model; the stego information corresponding to the target model being based on the model structure of the target model; performing data processing on the structure of each network layer included in the target model to obtain first data corresponding to each network layer included in the target model; performing structure processing on the model weights of the target model to obtain a tensor of a preset dimension corresponding to the model weights; inputting the tensor of the preset dimension corresponding to the model weights into a carrier generation model obtained in advance through model training to generate a target carrier for carrying data written to the target model in an information hiding manner; and determining the model structure and model weights of the target model based on the target carrier, the first data, the tensor of the preset dimension corresponding to the model weights, and the stego information determined by the stego model obtained in advance through model training. The model weights are loaded into the corresponding model structure to obtain a reconstructed target model, and business processing of the target business is performed based on the reconstructed target model.

[0008] An embodiment of this specification provides a model processing device, the device comprising: a model information acquisition module, which acquires a target model to be protected and acquires the model structure and model weights of the target model. A model information conversion module, which, based on the model structure, performs data processing on the structure of each network layer contained in the target model to obtain first data corresponding to each network layer contained in the target model, and performs structural processing on the model weights to obtain tensors of preset dimensions corresponding to the model weights. A carrier generation module, which inputs the tensors of preset dimensions corresponding to the model weights into a carrier generation model obtained in advance through model training to generate a target carrier for carrying data written to the target model in an information-hiding manner. A model steganography module, which determines the steganographic information corresponding to the target model based on the target carrier, the first data, the tensors of preset dimensions corresponding to the model weights, and a steganography model obtained in advance through model training, wherein the steganography model is a model obtained by model training based on a first loss function constructed based on consistency constraints before and after steganographic processing of the preset model data in the frequency domain.

[0009] An embodiment of this specification provides a model processing device, comprising: a model receiving module for receiving a trained RGB domain parsing model and a trained frequency domain parsing model sent by a server; a request obtaining module for obtaining a reconstruction request for a target model, the reconstruction request including stegographic information corresponding to the target model; the stegographic information corresponding to the target model being based on the model structure of the target model, performing data processing on the structure of each network layer contained in the target model to obtain first data corresponding to each network layer contained in the target model, and performing structural processing on the model weights of the target model to obtain tensors of preset dimensions corresponding to the model weights; inputting the tensors of preset dimensions corresponding to the model weights into a carrier generation model obtained in advance through model training to generate a target carrier for carrying data written to the target model in an information hiding manner; and determining the stegographic information determined by the stegographic model obtained in advance through model training based on the target carrier, the first data, the tensors of preset dimensions corresponding to the model weights, and the stegographic information determined by the stegographic model obtained in advance through model training; and an information parsing module for determining the model structure and model weights of the target model based on the stegographic information corresponding to the target model, the trained RGB domain parsing model, and the trained frequency domain parsing model. The model reconstruction module loads the model weights into the corresponding model structure to obtain a reconstructed target model, and performs business processing of the target business based on the reconstructed target model.

[0010] An embodiment of the present specification provides a model processing device, comprising: a processor; and a memory arranged to store computer-executable instructions, wherein when executed, the executable instructions cause the processor to: obtain a target model to be protected, and obtain the model structure and model weights of the target model. Based on the model structure, the structure of each network layer contained in the target model is digitized to obtain first data corresponding to each network layer contained in the target model, and the model weights are structurally processed to obtain tensors of preset dimensions corresponding to the model weights. The tensors of preset dimensions corresponding to the model weights are input into a carrier generation model obtained in advance through model training to generate a target carrier for carrying data written to the target model in an information-hiding manner. Based on the target carrier, the first data, the tensors of preset dimensions corresponding to the model weights, and a steganalysis model obtained in advance through model training, the steganalysis information corresponding to the target model is determined. The steganalysis model is a model obtained by model training based on a first loss function constructed based on consistency constraints before and after steganalysis processing of the preset model data in the frequency domain.

[0011] An embodiment of the present specification provides a model processing device, the model processing device comprising: a processor; and a memory configured to store computer-executable instructions, wherein the executable instructions, when executed, cause the processor to: receive a trained RGB domain parsing model and a trained frequency domain parsing model sent by the server; obtain a reconstruction request for a target model, the reconstruction request including steganalytic information corresponding to the target model; the steganalytic information corresponding to the target model is based on the model structure of the target model, digitizes the structure of each network layer included in the target model to obtain first data corresponding to each network layer included in the target model, and structures the model weights of the target model to obtain tensors of preset dimensions corresponding to the model weights; inputs the tensors of preset dimensions corresponding to the model weights into a carrier generation model obtained in advance through model training, generates a target carrier for carrying data written to the target model in an information-hiding manner, and determines the steganalytic information based on the target carrier, the first data, the tensors of preset dimensions corresponding to the model weights, and the steganalytic model obtained in advance through model training. Based on the stego information corresponding to the target model, the trained RGB domain parsing model, and the trained frequency domain parsing model, a model structure and model weights of the target model are determined. The model weights are loaded into the corresponding model structure to obtain a reconstructed target model, and business processing of the target business is performed based on the reconstructed target model.

[0012] The embodiments of this specification also provide a storage medium for storing computer-executable instructions, which implement the following process when executed by a processor: obtaining a target model to be protected, and obtaining the model structure and model weight of the target model. Based on the model structure, the structure of each network layer contained in the target model is digitized to obtain the first data corresponding to each network layer contained in the target model, and the model weight is structurally processed to obtain a tensor of a preset dimension corresponding to the model weight. The tensor of the preset dimension corresponding to the model weight is input into a carrier generation model obtained in advance through model training to generate a target carrier for carrying data written to the target model in an information-hiding manner. Based on the target carrier, the tensor of the preset dimension corresponding to the first data and the model weight, and the steganographic model obtained in advance through model training, the steganographic information corresponding to the target model is determined, and the steganographic model is a model obtained by model training based on a first loss function constructed based on consistency constraints before and after steganographic processing of the data of the preset model in the frequency domain.

[0013] An embodiment of the present specification also provides a storage medium for storing computer-executable instructions, which, when executed by a processor, implement the following process: receiving a trained RGB domain parsing model and a trained frequency domain parsing model sent by the server; obtaining a reconstruction request for a target model, the reconstruction request including stego information corresponding to the target model; the stego information corresponding to the target model being based on the model structure of the target model; performing data processing on the structure of each network layer included in the target model to obtain first data corresponding to each network layer included in the target model; performing structure processing on the model weights of the target model to obtain a tensor of a preset dimension corresponding to the model weights; inputting the tensor of the preset dimension corresponding to the model weights into a carrier generation model obtained in advance through model training to generate a target carrier for carrying data written to the target model in an information-hiding manner; and determining the model structure and model weights of the target model based on the target carrier, the first data, the tensor of the preset dimension corresponding to the model weights, and the stego information determined by the stego model obtained in advance through model training. The model weights are loaded into the corresponding model structure to obtain a reconstructed target model, and business processing of the target business is performed based on the reconstructed target model. BRIEF DESCRIPTION OF THE DRAWINGS

[0014] In order to more clearly illustrate the embodiments of this specification or the technical solutions in the prior art, the following briefly introduces the drawings required for use in the embodiments or the description of the prior art. Obviously, the drawings described below are only some embodiments recorded in this specification. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying any creative labor.

[0015] Figure 1 This is an embodiment of a processing method for a model of this specification;

[0016] Figure 2 This is another example of a processing method for this specification;

[0017] Figure 3A This is another embodiment of a processing method of a model in this specification;

[0018] Figure 3B A schematic diagram of the processing process of a model in this specification;

[0019] Figure 4 This is a schematic diagram of the structure of a processing system of a model in this specification;

[0020] Figure 5This is another embodiment of a processing method of a model in this specification;

[0021] Figure 6 This is a processing device embodiment of a model of this specification;

[0022] Figure 7 This is a processing device embodiment of a model of this specification;

[0023] Figure 8 This is a processing device embodiment of a model in this specification. DETAILED DESCRIPTION

[0024] The embodiments of this specification provide a model processing method, device and equipment.

[0025] To help those skilled in the art better understand the technical solutions in this specification, the following will provide a clear and complete description of the technical solutions in the embodiments of this specification, in conjunction with the accompanying drawings. Obviously, the described embodiments are only part of the embodiments of this specification, not all of them. All other embodiments derived by those skilled in the art based on the embodiments in this specification without creative effort shall fall within the scope of protection of this specification.

[0026] Example 1

[0027] like Figure 1 As shown, the embodiments of this specification provide a model processing method. The execution subject of this method can be a server, wherein the server can be an independent server or a server cluster composed of multiple servers. The server can be a backend server for financial services or online shopping services, or a backend server for an application. The method can specifically include the following steps:

[0028] In step S102, the target model to be protected is obtained, and the model structure and model weight of the target model are obtained.

[0029] Among them, the target model can be any model, for example, the target model can be a model for facial recognition, or a model for risk identification of a certain business, etc. In addition, the target model can be constructed by any algorithm, for example, the target model can be constructed by a neural network algorithm, or by a multi-layer perceptron algorithm, or by a classification algorithm, a clustering algorithm, etc., which can be set according to actual conditions, and the embodiments of this specification do not limit this. The model structure can be the way in which the various elements of the model itself are interrelated and interact with each other in order to solve a certain problem, which can include the number ratio of the constituent elements, the arrangement order, the combination method and the changes caused by development, etc. In actual applications, the model structure can often include multiple different network layers, and the relationship between different network layers. For example, if the target model is a convolutional neural network model, its model structure can include an input layer, one or more convolutional layers, one or more pooling layers, and an output layer. It can also include the relationship between multiple convolutional layers, between multiple pooling layers, and the arrangement relationship between convolutional layers and pooling layers, etc., which can be set according to actual conditions. The model weight can be used to characterize the importance of each network layer included in the target model in the entire network layer of the target model. In practical applications, each network layer included in the target model may correspond to a model weight, and the model weight can usually be a 64-bit floating point number.

[0030] In practice, with the continuous development of terminal and network technologies in recent years, artificial intelligence has become a key technical topic requiring research and development. Artificial intelligence has also seen considerable development and application in recent years. For example, applications such as facial recognition, autonomous driving, and intelligent customer service all require the use of various artificial intelligence algorithms. The core of artificial intelligence algorithms is generally deep learning models. Therefore, once a deep learning model is leaked, the entire artificial intelligence system is at great risk. For example, if the model used for facial recognition is leaked, an attacker can steal other accounts and perform facial recognition, posing a security risk. Therefore, desensitizing and protecting deep learning models has become a critical issue.

[0031] Regarding the protection method of the model, it can be protected from two aspects: model structure and model weight. The model encryption method refers to encrypting the weight of the model. Only the corresponding decryption algorithm can parse the model weight, thereby cracking the model, so that even if the attacker obtains the model structure, it is difficult to obtain the model weight, thereby achieving the purpose of protecting the model. However, the current encryption methods are relatively simple, and the attacker can crack it by spending a certain amount of time and computing power. On the other hand, the leakage of the model structure will also cause security risks. For this reason, the model structure can be protected by model obfuscation, that is, the model structure is adjusted and / or increased or decreased, thereby significantly changing the model structure of the model, so that even if the attacker obtains the model weight, he cannot crack the model. However, the model obfuscation method will bring a lot of extra useless calculations, making the model inefficient during application. Based on this, it is necessary to provide a model protection scheme with higher security and higher efficiency for model protection. The embodiments of this specification provide a feasible technical solution, which may specifically include the following contents:

[0032] When a certain model (i.e., target model) needs to be protected, the target model can be obtained and analyzed. The analysis results can be used to determine the type of network layers contained in the target model, the number of network layers, the number of different types of network layers, the association relationship between different network layers, model parameters of different network layers, and other information. The model structure of the target model can be determined based on the above information. In addition, the model weight of each network layer can also be obtained.

[0033] For example, it is necessary to protect the facial recognition model in a certain business. If the facial recognition model is built based on a convolutional neural network model, which includes an input layer, 3 convolution layers, 3 pooling layers and an output layer, and the 3 convolution layers and 3 pooling layers are arranged in an interlaced manner, the arrangement order of each network layer in the facial recognition model is as follows: input layer-convolution layer 1-pooling layer 1-convolution layer 2-pooling layer 2-convolution layer 3-pooling layer 3-output layer, the above facial recognition model can be analyzed to obtain information such as the number and type of the above network layers, as well as the arrangement order of different network layers. The model structure can be constructed based on the above information. In addition, the model weights of each network layer such as the input layer, convolution layer, pooling layer and output layer can also be obtained.

[0034] In step S104, based on the above model structure, the structure of each network layer contained in the target model is digitized to obtain the first data corresponding to each network layer contained in the target model, and the above model weight is structured to obtain a tensor of a preset dimension corresponding to the model weight.

[0035] The first data may have a fixed number of data bits, for example, 20 bits or 26 bits, which may be set according to actual conditions. The preset dimension may be set according to actual conditions, such as 4 or 6 dimensions.

[0036] In implementation, for the model structure, since the model structure is non-data information, it is necessary to convert the model structure, that is, to perform data processing on the model structure. The specific processing method can be set according to the actual situation. For example, the model structure conversion rule can be pre-set. The model structure conversion rule can be such as converting each network layer in the target model into data with a certain number of data bits (such as 20 bits or 26 bits of data, etc.). The data with a certain number of data bits can be composed of a combination or splicing of multiple different data. For example, for a certain network layer in the target model, the model structure corresponding to the network layer may include types (such as input layer type, convolution layer type, pooling layer type, etc.). , output layer type, etc.), relative position, related information of model parameters, etc. The above information can be converted into data representation. For example, if the network layer is the input layer, the type can be represented by 0001, the relative position can be represented by 10000000, and related information such as model parameters can be represented by 00030128. The above data can be spliced ​​to obtain 00011000000000030128, and 00011000000000030128 can be used to represent the model structure corresponding to the network layer. Similarly, other network layers can also be digitized in the above manner to obtain the first data corresponding to each network layer contained in the target model.

[0037] For model weights, they can generally be 64-bit floating-point numbers, which can be structured to reshape them into tensors with certain dimensions. Specifically, they can be reshaped into 4-dimensional tensors or 6-dimensional tensors. For example, for a convolutional layer with an input channel of 128 dimensions, an output channel of 256 dimensions, and a convolution kernel of 3*3, its parameters can be structured into a tensor of 256*3*3*128. For another example, for a fully connected layer with an input channel of 128 dimensions and an output channel of 256 dimensions, it can be structured into a tensor of 256*1*1*128. Similarly, the model weights of other network layers can also be structured in the above manner to obtain tensors of preset dimensions corresponding to the model weights of each network layer contained in the target model.

[0038] In step S106, the tensor of preset dimensions corresponding to the above-mentioned model weights is input into the carrier generation model obtained in advance through model training to generate a target carrier for carrying the data written into the target model in an information hiding manner.

[0039] Among them, the carrier generation model can be used to generate a carrier for carrying the data of the target model written therein. The carrier generation model can be constructed by a variety of different algorithms, for example, it can be constructed by a neural network algorithm, etc., and can be set according to actual conditions. The embodiments of this specification do not limit this. The target carrier can be an image or other types of objects other than images (such as text files, page data of a web page, etc.). In addition, the target carrier can be unrelated to the data of the target model. In some scenarios, the target carrier can also be related to the data of the target model, and can be set according to actual conditions.

[0040] In practice, usually, information steganography technology (i.e., technology that writes a certain information into a specified object in an information-hiding manner) will not be used to protect the model, because when the model is protected by steganography, the required accuracy and efficiency are beyond the reach of general steganography mechanisms. To this end, generated carriers can be used instead of natural carriers (i.e., carriers in reality, such as photographed images or drawn images, etc.), thereby improving the performance and efficiency of steganography processing, so that the steganography mechanism can be applied to the protection of the model. Specifically, the initial architecture of the carrier generation model can be constructed by a preset algorithm. Then, training samples consisting of model structures and model weights of different models can be obtained, and a corresponding loss function can be set. The obtained training samples and the loss function can be used to train the carrier generation model to obtain a trained carrier generation model. The trained carrier generation model can be used to generate a corresponding carrier for the steganography processing of the training samples, i.e., the target carrier.

[0041] After obtaining the model structure and model weights containing the target model and converting the model structure and model weights into first data and tensors of preset dimensions respectively, the tensors of preset dimensions can be input into the above-mentioned carrier generation model, and the carrier generation model is used to generate a target carrier for the model weights to carry the data written into the target model in an information-hidden manner.

[0042] It should be noted that the above is to generate the corresponding carrier through the model weight. In actual applications, the first data and the tensor of preset dimension can also be input into the above carrier generation model. The carrier generation model is used to generate a target carrier for the model weight and model structure to carry the data written into the target model in an information hiding manner. The specific setting can be based on actual conditions.

[0043] In step S108, based on the target carrier, the first data and the tensor of the preset dimension corresponding to the model weight, and the steganographic model obtained in advance through model training, the steganographic information corresponding to the target model is determined. The steganographic model is a model obtained by model training based on a first loss function constructed based on consistency constraints before and after steganographic processing of the data of the preset model in the frequency domain.

[0044] Among them, the steganalysis model can be a model used to write one information into another information by means of information steganography. The steganalysis model can be constructed by a variety of different algorithms. For example, the steganalysis model can be constructed by a neural network algorithm, or the steganalysis model can be constructed by the HUGO (Highly Undetectable stego) algorithm, etc. The specific setting can be based on actual conditions, and the embodiments of this specification do not limit this.

[0045] In implementation, an initial architecture of a steganographic model can be constructed using a preset algorithm. Then, model structures and model weights of different models, as well as training samples consisting of corresponding carriers, can be obtained. A corresponding first loss function can be set. Considering that frequency domain information of the carrier is often ignored, a first loss function can be constructed based on consistency constraints before and after steganographic processing of data of the preset model in the frequency domain. The obtained training samples and the first loss function can be used to train the steganographic model to obtain a trained steganographic model. The trained steganographic model can then be used to stego-write the model structure (i.e., the converted data) and model weights (i.e., the converted data) into the corresponding carrier.

[0046] After obtaining the tensor of preset dimensions corresponding to the target carrier, the first data and the model weight, the tensor of preset dimensions corresponding to the target carrier, the first data and the model weight can be input into the above-mentioned trained steganographic model, and the tensor of preset dimensions corresponding to the first data and the model weight is written into the target carrier by information hiding through the steganographic model, thereby achieving privacy protection processing of the target model, so that the privacy information of the target model (i.e., the model structure and model weight) is written into the above-mentioned generated target carrier in a hidden manner. In actual applications, the above processing process is only an optional method, and can also include a variety of different processing methods, which can be set according to actual conditions.

[0047] The embodiment of this specification provides a model processing method, which obtains a target model to be protected and obtains the model structure and model weight of the target model. Then, based on the model structure, the structure of each network layer contained in the target model is digitized to obtain the first data corresponding to each network layer, and the model weight is structurally processed to obtain a tensor of a preset dimension corresponding to the model weight. The tensor of the preset dimension corresponding to the model weight is input into a carrier generation model to generate a target carrier for carrying the data of the target model. Based on the target carrier, the first data and the tensor of the preset dimension corresponding to the model weight, and the steganographic model, the target model is determined. The steganographic information corresponding to the model is obtained by model training based on the first loss function constructed by the consistency constraint before and after the steganographic processing of the preset model data in the frequency domain. In this way, in order to improve the accuracy of the steganographic processing, the steganographic processing scheme for the target model is redesigned, and the local consistency loss is proposed. The carrier generation model is trained based on the above loss to generate a target carrier for steganographic processing that is similar to a natural carrier (such as a natural image, etc.), so that the generated carrier has better steganographic performance. The above two aspects greatly improve the steganographic performance, so that the steganographic processing can be used for the privacy protection of the model.

[0048] Example 2

[0049] like Figure 2 As shown, the embodiments of this specification provide a model processing method. The execution subject of this method can be a server, wherein the server can be an independent server or a server cluster composed of multiple servers. The server can be a backend server for financial services or online shopping services, or a backend server for an application. The method can specifically include the following steps:

[0050] In step S202, a plurality of different preset models are obtained, and the model structure and model weight of each preset model are obtained.

[0051] Among them, the preset model can be any model. For example, the preset model can be a model for facial recognition, or a model for risk identification of a certain business, etc. In addition, the preset model can be constructed by any algorithm. For example, the preset model can be constructed by a neural network algorithm, or by a multi-layer perceptron algorithm, or by a classification algorithm, a clustering algorithm, etc. The specific setting can be based on actual conditions, and the embodiments of this specification do not limit this.

[0052] In step S204, based on the model structure of the preset model, the structure of each network layer contained in the preset model is digitized to obtain the second data corresponding to each network layer contained in the preset model, and the model weight of the preset model is structured to obtain a tensor of a preset dimension corresponding to the model weight of the preset model.

[0053] The second data may be data of a preset number of bits, for example, the second data may be data having 20 bits, which may be similar to the first data. The second data may be constructed by data used to characterize the type of the model structure corresponding to the preset model and data used to characterize the shape of the parameters in the model structure corresponding to the preset model. For example, the second data is 00010256000300030128, where the first 4 bits are data 0001, which may characterize the type of the model structure corresponding to the preset model, and the remaining 0256000300030128, which may characterize the shape of the parameters in the model structure corresponding to the preset model, etc. The specific setting may be based on actual conditions, and this specification is not limited to this embodiment.

[0054] The specific processing process of the above step S204 can be found in the relevant content of the above embodiment and will not be repeated here.

[0055] In step S206, based on the second data and / or the tensor of the preset dimension corresponding to the model weight of the preset model, a carrier sample for carrying the data written into the preset model in an information hiding manner is determined.

[0056] Among them, the carrier sample can be an image, etc. The carrier involved in this embodiment takes an image as an example. For other types of carriers, please refer to the following content and perform corresponding processing according to actual conditions, which will not be repeated here.

[0057] In implementation, the tensor of the preset dimension corresponding to the second data and / or the model weight of the preset model can be analyzed to obtain the corresponding analysis result. Based on the analysis result, a carrier for carrying the data written into the preset model in an information-hiding manner can be selected from a preset carrier library. The selected carrier can be used as a carrier sample. Alternatively, a carrier generation rule can be preset. The carrier generation rule can include multiple types, such as a pre-set carrier generation algorithm or a corresponding model, and the corresponding carrier is generated by the above algorithm or model. Based on the analysis result, a carrier matching the analysis result can be generated by the carrier generation rule, and the generated carrier can be used as a carrier sample. Alternatively, the above two methods can be combined to determine the carrier sample. In actual applications, in addition to determining the carrier sample by the above method, the carrier sample can also be determined by a variety of other methods, which can be set according to actual conditions and will not be described in detail here.

[0058] Since this method will eventually perform steganographic processing on the generated carrier, if steganographic processing is performed directly on the natural carrier during model training, the performance of the corresponding model may be reduced. For this reason, a certain proportion (such as 50% or 70%, etc.) of the carrier samples in the above-mentioned determined carrier samples can come from the generated carrier. Based on this, the specific processing method of the above-mentioned step S204 can be various. The following is an optional processing method, which may specifically include the following: inputting the tensor of the preset dimension corresponding to the second data and the model weight of the preset model into the trained carrier generation model to obtain a carrier sample for carrying the data written into the preset model in an information hiding manner.

[0059] The specific processing process of the above steps can be found in the above or subsequent related content, which will not be repeated here.

[0060] In step S208, the second data and the tensor of the preset dimension corresponding to the model weight of the preset model, as well as the carrier sample are used as training samples, and based on the first loss function, the steganography model, the RGB domain analysis model, the frequency domain analysis model and the frequency domain feature extraction model are jointly trained to obtain the trained steganography model, the trained RGB domain analysis model, the trained frequency domain analysis model and the trained frequency domain feature extraction model. The RGB domain analysis model is used to restore the tensor of the preset dimension corresponding to the second data and the model weight of the preset model from the RGB information of the output information of the steganography model. The frequency domain analysis model is used to restore the tensor of the preset dimension corresponding to the second data and the model weight of the preset model from the frequency domain information of the output information of the steganography model. The frequency domain feature extraction model is used to extract features from the carrier sample and the frequency domain information of the output information of the steganography model.

[0061] Among them, the steganographic model can be constructed based on a variety of different methods. For example, it can be constructed based on U-Net, which is constructed by a fully connected network. U-Net has a structure shaped like the letter "U". It consists of a compression path (Contracting Path) on the left and an expansion path (Expansive Path) on the right. The compression path can be constructed through a convolutional neural network. The structure of two convolutional layers and one maximum pooling layer can be repeatedly used. After each pooling operation, the dimension of the data increases. In the expansion channel, a deconvolution operation is first performed to halve the dimension of the data. Then, it is spliced ​​to the corresponding compression channel for cropping to obtain the corresponding feature data. Based on the above feature data, new feature data is recomposed, and then two convolution layers are used for feature extraction. The above structure is repeated. In the final output layer, two convolution layers are used to map the high-dimensional feature data into low-dimensional output data. U-Net can be specifically divided into two parts: upsampling and downsampling. The downsampling part mainly uses continuous convolution pooling layers to extract feature information from the data and gradually maps the feature information to high dimensions. The highest dimension of the entire network contains rich information in the entire data. Feature information, U-Net does not need to directly pool the data and directly upsample it to output data of the same size as the original data. Instead, it uses deconvolution to map high-dimensional features to low dimensions again. In the mapping process, in order to enhance the accuracy of segmentation, the data with the same dimension in the shrinking network under the same dimension will be fused. Since the dimension will become twice the original dimension during the fusion process, it is necessary to perform convolution again to ensure that the dimension after processing is the same as the dimension before the fusion operation, so that after another deconvolution, it can be fused with the data under the same dimension for the second time until the data can be output with the same dimension as the original data. The structure of the steganography model in this embodiment can be composed of a U-Net with a certain number of network layers, such as a U-Net with 8 or 10 network layers, etc., which can be set according to actual conditions. For another example, it can be constructed using a multi-layer perceptron (MLP). In addition to the input layer and the output layer, the MLP can have multiple hidden layers in the middle. The simplest MLP contains only one hidden layer, that is, a three-layer structure. The layers of the MLP are fully connected. The bottom layer of the MLP is the input layer, the middle layer is the hidden layer, and the last layer is the output layer. Specifically, the steganographic model can be constructed using a three-layer MLP. The specific setting can be based on actual conditions. The RGB domain analysis model and the frequency domain analysis model can also be constructed based on a variety of different methods. For example, they can be constructed based on U-Net, etc., and can be set according to actual conditions. This specification does not limit this.The frequency domain feature extraction model can be constructed based on a variety of different methods, for example, it can be constructed using a specific feature extraction algorithm, or it can be constructed based on a residual network (ResNet). The residual network (ResNet) is composed of a series of residual blocks, each of which is divided into two parts: a direct mapping part and a residual part. ResNet can include multiple network layers. A residual network including multiple network layers can also be expressed as ResNet+number of network layers, such as ResNet50, which is a residual network with 50 network layers, etc. The specific setting can be based on actual conditions. The first loss function can be determined based on the maximum value of the similarity between the output information of the steganographic model and the carrier sample, the maximum value of the similarity between the tensor of a preset dimension corresponding to the model weights of the second data and the preset model and the tensor of a preset dimension corresponding to the model weights of the second data and the preset model restored from the output information of the steganographic model, the maximum value of the similarity between the frequency domain information of the output information of the steganographic model and the frequency domain information of the carrier sample, and the maximum value of the similarity between the features corresponding to the frequency domain information of the output information of the steganographic model and the features corresponding to the frequency domain information of the carrier sample. Specifically,

[0062] Loss = L I (x,x stan )+L R (m,m R )+L I-f (x f , x stan-f )+L F-f (x f , x stan-f )

[0063] Among them, Loss represents the first loss function, L I (x,x stan ) represents the maximum similarity between the output information of the steganographic model and the carrier sample, which is used to constrain the carrier sample x before steganographic processing and the output information x of the steganographic model after steganographic processing. stan Try to keep it consistent to ensure the confidentiality of the information. R (m,m R ) represents the maximum value of the similarity between the tensor of the preset dimension corresponding to the second data and the model weight of the preset model and the tensor of the preset dimension corresponding to the second data and the model weight of the preset model restored from the output information of the steganalysis model, thereby constraining the tensor m of the preset dimension corresponding to the second data and the model weight of the preset model and the tensor m of the preset dimension corresponding to the second data and the model weight of the preset model restored from the output information of the steganalysis model R The consistency of L is ensured, thereby ensuring that the tensor of the preset dimension corresponding to the second data and the model weight of the preset model is accurately steganographic, I-f (xf , x stan-f ) represents the maximum similarity between the frequency domain information of the output information of the steganographic model and the frequency domain information of the carrier sample, so as to constrain the consistency of the frequency domain information before and after the steganographic processing, thereby further ensuring the confidentiality of the steganography, L F-f (x f , x stan-f ) represents the maximum value of the similarity between the features corresponding to the frequency domain information of the output information of the steganographic model and the features corresponding to the frequency domain information of the carrier sample, so as to constrain the features of the frequency domain information before and after the steganographic processing to be as close as possible. This requires the steganographic information to be not only visually but also semantically closer to the information before the steganographic processing, thereby further improving the security level.

[0064] In implementation, the second data and the tensor of the preset dimension corresponding to the model weight of the preset model, as well as the carrier sample can be input into the steganographic model to obtain output information (i.e., the data after steganographic processing, that is, the data obtained by writing the tensor of the preset dimension corresponding to the second data and the model weight of the preset model into the carrier sample by means of information steganography). The RGB information in the output information of the above-mentioned steganographic model can be input into the RGB domain parsing model, and the tensor of the preset dimension corresponding to the second data and the model weight of the preset model can be restored from the RGB information of the output information of the steganographic model through the RGB domain parsing model. In addition, the frequency domain information in the output information of the above-mentioned steganographic model can be input into the frequency domain parsing model, and the tensor of the preset dimension corresponding to the second data and the model weight of the preset model can be restored from the frequency domain information of the output information of the steganographic model through the frequency domain parsing model. In addition, the frequency domain information of the carrier sample and the output information of the steganographic model can be input into the frequency domain parsing model. The domain information is input into the frequency domain feature extraction model, and the frequency domain feature extraction model can be used to extract features in the frequency domain information of the carrier sample and the output information of the steganography model. Then, the corresponding loss value can be calculated by the first loss function, and whether the above-mentioned steganography model, RGB domain parsing model, frequency domain parsing model and frequency domain feature extraction model have converged can be judged based on the calculated loss value. If converged, the trained steganography model, the trained RGB domain parsing model, the trained frequency domain parsing model and the trained frequency domain feature extraction model are obtained. If not converged, the steganography model, the RGB domain parsing model, the frequency domain parsing model and the frequency domain feature extraction model are continued to be trained based on the model structure and model weights of the preset model until the steganography model, the RGB domain parsing model, the frequency domain parsing model and the frequency domain feature extraction model converge to obtain the trained steganography model, the trained RGB domain parsing model, the trained frequency domain parsing model and the trained frequency domain feature extraction model.

[0065] In step S210, the second data and the tensor of the preset dimension corresponding to the model weight of the preset model are input into the pre-built carrier generation model to generate a first carrier for carrying the data written into the preset model in an information hiding manner.

[0066] The vector generation model can be constructed in a variety of different ways. For example, a vector generation model can be built based on StyleGAN. The "Style" in StyleGAN can refer to the main attributes of the data in the dataset, such as the posture of the person, rather than the image style in style conversion. Taking facial images as an example, Style here can refer to the style of the face, including the expression, face orientation, hairstyle, etc. on the face shape, as well as the facial style and facial lighting in terms of texture details. StyleGAN can use style to influence the posture and identity characteristics of the face, and use noise to influence details such as hair, wrinkles, and style.

[0067] In implementation, the vector generation model can be pre-trained on the Place365 dataset to obtain a StyleGAN pre-trained model that can generate vector samples. The specific setting can be based on actual conditions, and the embodiments of this specification do not limit this.

[0068] In step S212, the second data and the tensor of the preset dimension corresponding to the model weight of the preset model, and the first carrier are input into the trained steganographic model, and the RGB information of the output information of the steganographic model is input into the trained RGB domain parsing model, the frequency domain information of the output information of the steganographic model is input into the trained frequency domain parsing model, and the output information of the steganographic model and the first carrier are input into the trained frequency domain feature extraction model to obtain the output information of the trained RGB domain parsing model, the output information of the trained frequency domain parsing model, and the output information of the trained frequency domain feature extraction model respectively.

[0069] In step S214, based on the first carrier, the second data and the tensor of the preset dimension corresponding to the model weight of the preset model, the output information of the steganography model, the output information of the trained RGB domain analysis model, the output information of the trained frequency domain analysis model and the output information of the trained frequency domain feature extraction model, and through the second loss function, it is determined whether the carrier generation model converges. If the carrier generation model does not converge, the carrier generation model, the trained steganography model, the trained RGB domain analysis model, the trained frequency domain analysis model and the trained frequency domain feature extraction model are continuously jointly trained based on the model structure and model weight of the preset model until the carrier generation model converges to obtain the trained carrier generation model.

[0070] Among them, the second loss function can include multiple types. For example, it can be determined based on the second data and the preset dimension tensor corresponding to the model weight of the preset model, as well as the final output information. It can also be determined based on the output information and input information of each model, etc. It can be set according to actual conditions, and this specification does not limit this. In this embodiment, the second loss function can be determined based on the first loss function and the value corresponding to the distance between the features of two adjacent regions in the first carrier being within a preset distance range. Specifically,

[0071] Loss SGAN =Loss+L pc (f p1 , f p2 )

[0072] Among them, Loss SGAN Represents the second loss function, Loss represents the first loss function, L pc (f p1 , f p2 ) indicates that the distance between the features of two adjacent regions in the first carrier is within a preset distance range, f p1 and f p2 Respectively represent the characteristics of two adjacent regions p1 and p2 in the first vector,

[0073] L pc (f p1 , f p2 )=max(||f p1 -f p2 ||2-m, 0)

[0074] The first loss function can be jointly optimized here to ensure that the first carrier generated by StyleGAN can minimize the loss caused by the steganalysis process and maximize the performance of the steganalysis process. pc (f p1 , f p2 ) is the local consistency loss, that is, the features of two adjacent n*p (for example, n=4, p=4, etc.) regions are randomly selected, and the distance between the two must be within the distance range m, so as to constrain the naturalness and comprehensibility of the generated first carrier and avoid generating incomprehensible noise carriers.

[0075] In practice, the training process can include five models: a vector generation model constructed based on StyleGAN, a trained steganalysis model, a trained RGB domain parsing model, a trained frequency domain parsing model, and a trained frequency domain feature extraction model. During the training process, only the weights of the vector generation model are changed, while the other models remain unchanged. The input and output information of the trained steganalysis model, the trained RGB domain parsing model, the trained frequency domain parsing model, and the trained frequency domain feature extraction model are essentially the same as those in the training process described above, with the difference being that the vector samples in the input information of the trained steganalysis model become the first vectors generated by the vector generation model (i.e., the output information of the vector generation model). The input information of the vector generation model is a tensor of a preset dimension corresponding to the second data and the model weights of the preset model. The tensor of the preset dimension corresponding to the second data and the model weights of the preset model is encoded into a feature vector (specifically, this can be achieved through one convolutional layer and one fully connected layer). By controlling the feature vectors in the vector generation model, different vectors can be generated, and the generated vectors can all ensure good performance on the steganalysis model, thereby achieving vector generation control of the vector generation model.

[0076] In step S216, the target model to be protected is obtained, and the model structure and model weight of the target model are obtained.

[0077] In step S218, based on the above-mentioned model structure, the structure of each network layer contained in the target model is digitized to obtain the first data corresponding to each network layer contained in the target model, and the model weight is structured to obtain a tensor of a preset dimension corresponding to the model weight.

[0078] The first data is data of a preset number of bits, and the first data can be constructed by data used to characterize the type of the model structure corresponding to the target model and data used to characterize the shape of parameters in the model structure corresponding to the target model.

[0079] In step S220, the tensor of preset dimensions corresponding to the above-mentioned model weights is input into the carrier generation model obtained in advance through model training to generate a target carrier for carrying the data written into the target model in an information hiding manner.

[0080] The target carrier is an image.

[0081] In step S222, the tensor of preset dimensions corresponding to the target carrier and the model weight is input into the steganographic model obtained in advance through model training to obtain preselected steganographic information.

[0082] In step S224, the first data is set as attribute information of a preset inherent attribute of the preselected stego information, and the preselected stego information with the attribute information is used as the stego information corresponding to the target model.

[0083] The preset inherent attribute may be information of a pre-set attribute item, such as name, type, etc., which may be set according to actual circumstances. The attribute information may be specific information of the above attribute items. For example, if the preset inherent attribute is name, the corresponding attribute information may be 00010256000300030128, etc.

[0084] In practical applications, the above-mentioned processing methods for determining the steganalytic information can be varied. An optional processing method is provided below, which may specifically include the following: inputting the tensor of preset dimensions corresponding to the target carrier, the first data, and the model weight into the steganalytic model obtained in advance through model training to obtain the steganalytic information corresponding to the target model.

[0085] In step S226, the trained RGB domain parsing model, the trained frequency domain parsing model, the trained frequency domain feature extraction model, and the steganographic information corresponding to the target model are sent to the target device. The steganographic information corresponding to the target model is used to trigger the target device to reconstruct the target model based on the trained RGB domain parsing model and the trained frequency domain parsing model.

[0086] The embodiment of this specification provides a model processing method, which obtains a target model to be protected and obtains the model structure and model weight of the target model. Then, based on the model structure, the structure of each network layer contained in the target model is digitized to obtain the first data corresponding to each network layer, and the model weight is structurally processed to obtain a tensor of a preset dimension corresponding to the model weight. The tensor of the preset dimension corresponding to the model weight is input into a carrier generation model to generate a target carrier for carrying the data of the target model. Based on the target carrier, the first data and the tensor of the preset dimension corresponding to the model weight, and the steganographic model, the target model is determined. The steganographic information corresponding to the model is obtained by model training based on the first loss function constructed by the consistency constraint before and after the steganographic processing of the preset model data in the frequency domain. In this way, in order to improve the accuracy of the steganographic processing, the steganographic processing scheme for the target model is redesigned, and the local consistency loss is proposed. The carrier generation model is trained based on the above loss to generate a target carrier for steganographic processing that is similar to a natural carrier (such as a natural image, etc.), so that the generated carrier has better steganographic performance. The above two aspects greatly improve the steganographic performance, so that the steganographic processing can be used for the privacy protection of the model.

[0087] Example 3

[0088] like Figure 3A and Figure 3B As shown, the embodiment of this specification provides a model processing method, and the execution subject of the method can be a target device, wherein the target device can be a terminal device or a server, etc. The terminal device can be a certain terminal device such as a mobile phone, a tablet computer, or a computer device such as a laptop or a desktop computer, or an IoT device (specifically such as a smart watch, a car-mounted device, etc.). The server can be an independent server, or a server cluster composed of multiple servers, etc. The server can be a background server for a financial business or an online shopping business, etc., or a background server for a certain application, etc. Its system architecture can be as follows Figure 4 As shown, the method may specifically include the following steps:

[0089] In step S302, the trained RGB domain analysis model and the trained frequency domain analysis model sent by the server are received.

[0090] In step S304, a reconstruction request for the target model is obtained, and the reconstruction request includes the steganographic information corresponding to the target model. The steganographic information corresponding to the target model is based on the model structure of the target model. The structure of each network layer contained in the target model is digitized to obtain the first data corresponding to each network layer contained in the target model, and the model weight of the target model is structured to obtain a tensor of a preset dimension corresponding to the model weight. The tensor of the preset dimension corresponding to the model weight is input into a carrier generation model obtained in advance through model training to generate a target carrier for carrying data written into the target model in an information hiding manner, and the steganographic information is determined based on the target carrier, the first data and the tensor of the preset dimension corresponding to the model weight, and the steganographic model obtained in advance through model training.

[0091] In step S306, the model structure and model weight of the target model are determined based on the steganalysis information corresponding to the target model, the trained RGB domain parsing model, and the trained frequency domain parsing model.

[0092] In implementation, the RGB information of the steganographic information corresponding to the target model can be input into the trained RGB domain parsing model to obtain relevant information about the model structure and model weight of the target model restored from the RGB information of the steganographic information. At the same time, the frequency domain information of the steganographic information corresponding to the target model can be input into the trained frequency domain parsing model to obtain relevant information about the model structure and model weight of the target model restored from the frequency domain information of the steganographic information. One piece of information can be selected from the above-mentioned restored relevant information, and the model structure and model weight of the target model can be determined based on the selected information.

[0093] In step S308, the above model weights are loaded into the corresponding model structure to obtain a reconstructed target model, and business processing of the target business is performed based on the reconstructed target model.

[0094] The specific processing procedures of the above steps S302 to S308 can be found in the above related content and will not be repeated here.

[0095] The embodiment of this specification provides a model processing method, which obtains a target model to be protected and obtains the model structure and model weight of the target model. Then, based on the model structure, the structure of each network layer contained in the target model is digitized to obtain the first data corresponding to each network layer, and the model weight is structurally processed to obtain a tensor of a preset dimension corresponding to the model weight. The tensor of the preset dimension corresponding to the model weight is input into a carrier generation model to generate a target carrier for carrying the data of the target model. Based on the target carrier, the first data and the tensor of the preset dimension corresponding to the model weight, and the steganalysis model, the steganalysis information corresponding to the target model is determined. The steganalysis model is based on the information including The first loss function constructed by the consistency constraint before and after the steganographic processing of the preset model data in the frequency domain is obtained by model training. The steganographic information can be reconstructed subsequently to obtain the reconstructed target model for corresponding business processing. In this way, in order to improve the accuracy of the steganographic processing, the steganographic processing scheme for the target model is redesigned, and the local consistency loss is proposed. The carrier generation model is trained based on the above loss to generate a target carrier for steganographic processing similar to the natural carrier (such as natural images, etc.), so that the generated carrier has better steganographic performance. The above two aspects greatly improve the steganographic performance, so that the steganographic processing can be used for the privacy protection of the model.

[0096] Example 4

[0097] like Figure 5 As shown, an embodiment of the present invention provides a method for processing a model, and the execution subject of the method can be a target device, wherein the target device can be a terminal device or a server, etc. The terminal device can be a certain terminal device such as a mobile phone, a tablet computer, or a computer device such as a laptop or a desktop computer, or an IoT device (specifically such as a smart watch, a car-mounted device, etc.). The server can be an independent server, or a server cluster composed of multiple servers, etc. The server can be a background server for a financial business or an online shopping business, or a background server for an application, etc. Its system architecture can be as follows Figure 4 As shown, the method may specifically include the following steps:

[0098] In step S502, the trained RGB domain analysis model and the trained frequency domain analysis model sent by the server are received.

[0099] In step S504, a reconstruction request for the target model is obtained, and the reconstruction request includes the steganographic information corresponding to the target model. The steganographic information corresponding to the target model is based on the model structure of the target model. The structure of each network layer contained in the target model is digitized to obtain the first data corresponding to each network layer contained in the target model, and the model weight of the target model is structured to obtain a tensor of a preset dimension corresponding to the model weight. The tensor of the preset dimension corresponding to the model weight is input into a carrier generation model obtained in advance through model training to generate a target carrier for carrying data written into the target model in an information hiding manner, and the steganographic information is determined based on the target carrier, the first data and the tensor of the preset dimension corresponding to the model weight, and the steganographic model obtained in advance through model training.

[0100] In step S506, the model structure of the target model is determined based on the attribute information of the preset inherent attributes of the steganalytic information corresponding to the target model.

[0101] In implementation, the preset inherent attributes can be obtained from the attributes of the steganographic information corresponding to the target model, and the attribute information of the preset inherent attributes can be obtained. The attribute information of the preset inherent attributes can be analyzed to determine the type of network layer included in the target model and the shape of the corresponding parameters and other information, thereby obtaining the model structure of the target model.

[0102] In step S508, the steganalytic information corresponding to the target model is input into the trained RGB domain parsing model and the trained frequency domain parsing model respectively to obtain the pre-selected model weight of the target model restored from the steganalytic information corresponding to the target model.

[0103] During implementation, the RGB information of the steganographic information corresponding to the target model can be input into the trained RGB domain parsing model to obtain relevant information about the model weights of the target model restored from the RGB information of the steganographic information. At the same time, the frequency domain information of the steganographic information corresponding to the target model can be input into the trained frequency domain parsing model to obtain relevant information about the model weights of the target model restored from the frequency domain information of the steganographic information. Based on the relevant information about the model weights of the restored target model, the preselected model weights can be determined respectively.

[0104] In step S510 , the average value of the pre-selected model weights is calculated, and the calculated average value is used as the model weight of the target model.

[0105] In step S512, the above model weights are loaded into the corresponding model structure to obtain a reconstructed target model, and business processing of the target business is performed based on the reconstructed target model.

[0106] The specific processing procedures of the above steps S502 to S512 can be found in the above related content and will not be repeated here.

[0107] The embodiment of this specification provides a model processing method, which obtains a target model to be protected and obtains the model structure and model weight of the target model. Then, based on the model structure, the structure of each network layer contained in the target model is digitized to obtain the first data corresponding to each network layer, and the model weight is structurally processed to obtain a tensor of a preset dimension corresponding to the model weight. The tensor of the preset dimension corresponding to the model weight is input into a carrier generation model to generate a target carrier for carrying the data of the target model. Based on the target carrier, the first data and the tensor of the preset dimension corresponding to the model weight, and the steganalysis model, the steganalysis information corresponding to the target model is determined. The steganalysis model is based on the information including The first loss function constructed by the consistency constraint before and after the steganographic processing of the preset model data in the frequency domain is obtained by model training. The steganographic information can be reconstructed subsequently to obtain the reconstructed target model for corresponding business processing. In this way, in order to improve the accuracy of the steganographic processing, the steganographic processing scheme for the target model is redesigned, and the local consistency loss is proposed. The carrier generation model is trained based on the above loss to generate a target carrier for steganographic processing similar to the natural carrier (such as natural images, etc.), so that the generated carrier has better steganographic performance. The above two aspects greatly improve the steganographic performance, so that the steganographic processing can be used for the privacy protection of the model.

[0108] Example 5

[0109] Based on the same idea, the embodiment of this specification also provides a model processing device, such as Figure 6 shown.

[0110] The model processing device includes: a model information acquisition module 601, a model information conversion module 602, a carrier generation module 603 and a model steganography module 604, wherein:

[0111] The model information acquisition module 601 acquires the target model to be protected and acquires the model structure and model weight of the target model;

[0112] The model information conversion module 602 performs data processing on the structure of each network layer included in the target model based on the model structure to obtain first data corresponding to each network layer included in the target model, and performs structured processing on the model weights to obtain tensors of preset dimensions corresponding to the model weights;

[0113] The carrier generation module 603 inputs the tensor of the preset dimension corresponding to the model weight into the carrier generation model obtained in advance through model training to generate a target carrier for carrying the data written into the target model in an information hiding manner;

[0114] The model steganography module 604 determines the steganographic information corresponding to the target model based on the target carrier, the first data, the tensor of the preset dimension corresponding to the model weight, and the steganographic model obtained in advance through model training. The steganographic model is a model obtained by model training based on a first loss function constructed based on consistency constraints before and after steganographic processing of the data of the preset model in the frequency domain.

[0115] In the embodiment of this specification, the model steganography module 604 inputs the target carrier, the first data and the tensor of preset dimensions corresponding to the model weight into the steganography model obtained in advance through model training to obtain the steganographic information corresponding to the target model.

[0116] In the embodiment of this specification, the model steganography module 604 includes:

[0117] A first steganographic unit inputs the target carrier and a tensor of a preset dimension corresponding to the model weight into a steganographic model obtained in advance through model training to obtain preselected steganographic information;

[0118] A setting unit is configured to set the first data as attribute information of a preset inherent attribute of the preselected stego information, and use the preselected stego information with the attribute information as the stego information corresponding to the target model.

[0119] In an embodiment of the present specification, the first data is data of a preset number of bits, and the first data is constructed by data used to characterize the type of the model structure corresponding to the target model and data used to characterize the shape of the parameters in the model structure corresponding to the target model, and the target carrier is an image.

[0120] In the embodiment of this specification, the device further includes:

[0121] A model sample acquisition module acquires a plurality of different preset models and obtains the model structure and model weight of each of the preset models;

[0122] A carrier sample determination module determines, based on the model structure and / or model weight of the preset model, a carrier sample for carrying data written into the preset model in an information hiding manner;

[0123] The first training module takes the model structure and model weight of the preset model and the carrier sample as training samples, and based on the first loss function, jointly trains the steganography model, RGB domain analysis model, frequency domain analysis model and frequency domain feature extraction model to obtain the trained steganography model, the trained RGB domain analysis model, the trained frequency domain analysis model and the trained frequency domain feature extraction model, wherein the RGB domain analysis model is used to restore the model structure and model weight of the preset model from the RGB information of the output information of the steganography model, the frequency domain analysis model is used to restore the model structure and model weight of the preset model from the frequency domain information of the output information of the steganography model, and the frequency domain feature extraction model is used to extract features from the carrier sample and the frequency domain information of the output information of the steganography model.

[0124] In an embodiment of the present specification, the first loss function is determined based on the maximum value of the similarity between the output information of the steganographic model and the carrier sample, the maximum value of the similarity between the model structure and model weight of the preset model and the corresponding model structure and model weight of the preset model restored from the output information of the steganographic model, the maximum value of the similarity between the frequency domain information of the output information of the steganographic model and the frequency domain information of the carrier sample, and the maximum value of the similarity between the features corresponding to the frequency domain information of the output information of the steganographic model and the features corresponding to the frequency domain information of the carrier sample.

[0125] In the embodiment of this specification, the device further includes:

[0126] A first carrier generation module, inputting the model structure and model weight of the preset model into a pre-built carrier generation model to generate a first carrier for carrying the data written into the preset model in an information hiding manner;

[0127] a model processing module that inputs the model structure and model weights of the preset model, and the first carrier, into the trained steganographic model, inputs the RGB information of the output information of the steganographic model into the trained RGB domain parsing model, inputs the frequency domain information of the output information of the steganographic model into the trained frequency domain parsing model, and inputs the output information of the steganographic model and the first carrier into the trained frequency domain feature extraction model, thereby respectively obtaining the output information of the trained RGB domain parsing model, the output information of the trained frequency domain parsing model, and the output information of the trained frequency domain feature extraction model;

[0128] The second training module is based on the first carrier, the model structure and model weight of the preset model, the output information of the steganography model, the output information of the trained RGB domain analysis model, the output information of the trained frequency domain analysis model and the output information of the trained frequency domain feature extraction model, and determines whether the carrier generation model converges through a second loss function. If the carrier generation model does not converge, the model structure and model weight of the preset model are used to continue to jointly train the carrier generation model, the trained steganography model, the trained RGB domain analysis model, the trained frequency domain analysis model and the trained frequency domain feature extraction model until the carrier generation model converges to obtain a trained carrier generation model.

[0129] In an embodiment of the present specification, the carrier sample determination module inputs the model structure and model weight of the preset model into the trained carrier generation model to obtain a carrier sample for carrying data written into the preset model in an information hiding manner.

[0130] In an embodiment of this specification, the second loss function is determined based on the first loss function and the corresponding value when the distance between the features of two adjacent regions in the first carrier is within a preset distance range, and the carrier generation model is a model constructed based on StyleGAN.

[0131] In the embodiment of this specification, the device further includes:

[0132] An information sending module sends the trained RGB domain parsing model, the trained frequency domain parsing model, the trained frequency domain feature extraction model, and the steganographic information corresponding to the target model to a target device, where the steganographic information corresponding to the target model is used to trigger the target device to reconstruct the target model based on the trained RGB domain parsing model, the trained frequency domain parsing model, and the trained frequency domain feature extraction model.

[0133] The embodiment of the present specification provides a model processing device, which obtains a target model to be protected and obtains the model structure and model weight of the target model. Then, based on the model structure, the structure of each network layer contained in the target model is digitized to obtain the first data corresponding to each network layer, and the model weight is structurally processed to obtain a tensor of a preset dimension corresponding to the model weight. The tensor of the preset dimension corresponding to the model weight is input into a carrier generation model to generate a target carrier for carrying the data of the target model. Based on the target carrier, the first data and the tensor of the preset dimension corresponding to the model weight, and the steganalysis model, the steganalysis information corresponding to the target model is determined. The steganalysis model is based on the information including The first loss function constructed by the consistency constraint before and after the steganographic processing of the preset model data in the frequency domain is obtained by model training. The steganographic information can be reconstructed subsequently to obtain the reconstructed target model for corresponding business processing. In this way, in order to improve the accuracy of the steganographic processing, the steganographic processing scheme for the target model is redesigned, and the local consistency loss is proposed. The carrier generation model is trained based on the above loss to generate a target carrier for steganographic processing similar to the natural carrier (such as natural images, etc.), so that the generated carrier has better steganographic performance. The above two aspects greatly improve the steganographic performance, so that the steganographic processing can be used for the privacy protection of the model.

[0134] Example 6

[0135] Based on the same idea, the embodiment of this specification also provides a model processing device, such as Figure 7 shown.

[0136] The model processing device includes: a model receiving module 701, a request obtaining module 702, an information parsing module 703 and a model reconstruction module 704, wherein:

[0137] The model receiving module 701 receives the trained RGB domain analysis model and the trained frequency domain analysis model sent by the server;

[0138] A request acquisition module 702 acquires a reconstruction request for a target model, wherein the reconstruction request includes stego information corresponding to the target model. The stego information corresponding to the target model is based on the model structure of the target model, and the structure of each network layer included in the target model is digitized to obtain first data corresponding to each network layer included in the target model. The model weight of the target model is structured to obtain a tensor of a preset dimension corresponding to the model weight. The tensor of the preset dimension corresponding to the model weight is input into a carrier generation model obtained in advance through model training to generate a target carrier for carrying data written to the target model in an information hiding manner, and the stego information is determined based on the target carrier, the first data, the tensor of the preset dimension corresponding to the model weight, and the stego model obtained in advance through model training;

[0139] An information parsing module 703 determines a model structure and a model weight of the target model based on the stego information corresponding to the target model, the trained RGB domain parsing model, and the trained frequency domain parsing model;

[0140] The model reconstruction module 704 loads the model weights into the corresponding model structure to obtain a reconstructed target model, and performs business processing of the target business based on the reconstructed target model.

[0141] In the embodiment of this specification, the information parsing module 703 includes:

[0142] a first parsing unit, determining a model structure of the target model based on attribute information of preset inherent attributes of the stegographic information corresponding to the target model;

[0143] A second parsing unit, wherein the stego information corresponding to the target model is input into the trained RGB domain parsing model and the trained frequency domain parsing model respectively, to obtain a preselected model weight of the target model restored from the stego information corresponding to the target model;

[0144] The weight determination unit calculates an average value of the preselected model weights and uses the calculated average value as the model weight of the target model.

[0145] The embodiment of the present specification provides a model processing device, which obtains a target model to be protected and obtains the model structure and model weight of the target model. Then, based on the model structure, the structure of each network layer contained in the target model is digitized to obtain the first data corresponding to each network layer, and the model weight is structurally processed to obtain a tensor of a preset dimension corresponding to the model weight. The tensor of the preset dimension corresponding to the model weight is input into a carrier generation model to generate a target carrier for carrying the data of the target model. Based on the target carrier, the first data and the tensor of the preset dimension corresponding to the model weight, and the steganalysis model, the steganalysis information corresponding to the target model is determined. The steganalysis model is based on the information including The first loss function constructed by the consistency constraint before and after the steganographic processing of the preset model data in the frequency domain is obtained by model training. The steganographic information can be reconstructed subsequently to obtain the reconstructed target model for corresponding business processing. In this way, in order to improve the accuracy of the steganographic processing, the steganographic processing scheme for the target model is redesigned, and the local consistency loss is proposed. The carrier generation model is trained based on the above loss to generate a target carrier for steganographic processing similar to the natural carrier (such as natural images, etc.), so that the generated carrier has better steganographic performance. The above two aspects greatly improve the steganographic performance, so that the steganographic processing can be used for the privacy protection of the model.

[0146] Example 7

[0147] The above is a processing device for the model provided in the embodiment of this specification. Based on the same idea, the embodiment of this specification also provides a processing device for the model, such as Figure 8 shown.

[0148] The processing device of the model may provide a target device or server, etc. for the above embodiments.

[0149] The processing device of the model may vary greatly due to different configurations or performances, and may include one or more processors 801 and memory 802, and the memory 802 may store one or more storage applications or data. Among them, the memory 802 may be a temporary storage or a persistent storage. The application stored in the memory 802 may include one or more modules (not shown in the figure), each module may include a series of computer-executable instructions in the processing device of the model. Furthermore, the processor 801 may be configured to communicate with the memory 802 to execute a series of computer-executable instructions in the memory 802 on the processing device of the model. The processing device of the model may also include one or more power supplies 803, one or more wired or wireless network interfaces 804, one or more input and output interfaces 805, and one or more keyboards 806.

[0150] Specifically, in this embodiment, the model processing device includes a memory and one or more programs, wherein the one or more programs are stored in the memory, and the one or more programs may include one or more modules, and each module may include a series of computer-executable instructions in the model processing device, and the one or more programs are configured to be executed by one or more processors, including computer-executable instructions for performing the following:

[0151] Obtaining a target model to be protected, and obtaining a model structure and a model weight of the target model;

[0152] Based on the model structure, the structure of each network layer included in the target model is digitized to obtain first data corresponding to each network layer included in the target model, and the model weight is structured to obtain a tensor of a preset dimension corresponding to the model weight;

[0153] Inputting a tensor of a preset dimension corresponding to the model weight into a carrier generation model obtained in advance through model training to generate a target carrier for carrying data written into the target model in an information hiding manner;

[0154] Based on the target carrier, the first data, the tensor of preset dimensions corresponding to the model weight, and the steganographic model obtained in advance through model training, the steganographic information corresponding to the target model is determined, and the steganographic model is a model obtained by model training based on a first loss function constructed based on consistency constraints before and after steganographic processing of data of a preset model in the frequency domain.

[0155] In the embodiment of this specification, determining the steganalytic information corresponding to the target model based on the target carrier, the first data, the tensor of preset dimensions corresponding to the model weight, and the steganalytic model obtained in advance through model training includes:

[0156] The target carrier, the first data and the tensor of preset dimensions corresponding to the model weight are input into a steganographic model obtained in advance through model training to obtain steganographic information corresponding to the target model.

[0157] In the embodiment of this specification, determining the steganalytic information corresponding to the target model based on the target carrier, the first data, the tensor of preset dimensions corresponding to the model weight, and the steganalytic model obtained in advance through model training includes:

[0158] Inputting the target carrier and the tensor of the preset dimension corresponding to the model weight into the steganographic model obtained in advance through model training to obtain preselected steganographic information;

[0159] The first data is set as attribute information of a preset inherent attribute of the preselected stego information, and the preselected stego information with the attribute information is used as the stego information corresponding to the target model.

[0160] In an embodiment of the present specification, the first data is data of a preset number of bits, and the first data is constructed by data used to characterize the type of the model structure corresponding to the target model and data used to characterize the shape of the parameters in the model structure corresponding to the target model, and the target carrier is an image.

[0161] In the embodiments of this specification, further comprising:

[0162] Acquire a plurality of different preset models, and obtain a model structure and a model weight of each of the preset models;

[0163] Determining, based on the model structure and / or model weight of the preset model, a carrier sample for carrying data written into the preset model in an information hiding manner;

[0164] The model structure and model weight of the preset model, and the carrier sample are used as training samples, and based on the first loss function, the steganography model, RGB domain analysis model, frequency domain analysis model and frequency domain feature extraction model are jointly trained to obtain a trained steganography model, a trained RGB domain analysis model, a trained frequency domain analysis model and a trained frequency domain feature extraction model, wherein the RGB domain analysis model is used to restore the model structure and model weight of the preset model from the RGB information of the output information of the steganography model, the frequency domain analysis model is used to restore the model structure and model weight of the preset model from the frequency domain information of the output information of the steganography model, and the frequency domain feature extraction model is used to extract features from the carrier sample and the frequency domain information of the output information of the steganography model.

[0165] In an embodiment of the present specification, the first loss function is determined based on the maximum value of the similarity between the output information of the steganographic model and the carrier sample, the maximum value of the similarity between the model structure and model weight of the preset model and the corresponding model structure and model weight of the preset model restored from the output information of the steganographic model, the maximum value of the similarity between the frequency domain information of the output information of the steganographic model and the frequency domain information of the carrier sample, and the maximum value of the similarity between the features corresponding to the frequency domain information of the output information of the steganographic model and the features corresponding to the frequency domain information of the carrier sample.

[0166] In the embodiments of this specification, further comprising:

[0167] Inputting the model structure and model weight of the preset model into a pre-built carrier generation model to generate a first carrier for carrying the data written into the preset model in an information hiding manner;

[0168] Inputting the model structure and model weight of the preset model and the first carrier into the trained steganographic model, inputting the RGB information of the output information of the steganographic model into the trained RGB domain parsing model, inputting the frequency domain information of the output information of the steganographic model into the trained frequency domain parsing model, and inputting the output information of the steganographic model and the first carrier into the trained frequency domain feature extraction model, respectively obtaining the output information of the trained RGB domain parsing model, the output information of the trained frequency domain parsing model, and the output information of the trained frequency domain feature extraction model;

[0169] Based on the first carrier, the model structure and model weight of the preset model, the output information of the steganography model, the output information of the trained RGB domain analysis model, the output information of the trained frequency domain analysis model and the output information of the trained frequency domain feature extraction model, and through a second loss function, determine whether the carrier generation model converges; if the carrier generation model does not converge, use the model structure and model weight of the preset model to continue to jointly train the carrier generation model, the trained steganography model, the trained RGB domain analysis model, the trained frequency domain analysis model and the trained frequency domain feature extraction model until the carrier generation model converges to obtain a trained carrier generation model.

[0170] In the embodiment of this specification, determining a carrier sample for carrying data written into the preset model in an information hiding manner based on the model structure and / or model weight of the preset model includes:

[0171] The model structure and model weight of the preset model are input into the trained carrier generation model to obtain a carrier sample for carrying the data written into the preset model in an information hiding manner.

[0172] In an embodiment of this specification, the second loss function is determined based on the first loss function and the corresponding value when the distance between the features of two adjacent regions in the first carrier is within a preset distance range, and the carrier generation model is a model constructed based on StyleGAN.

[0173] In the embodiments of this specification, further comprising:

[0174] The trained RGB domain parsing model, the trained frequency domain parsing model, the trained frequency domain feature extraction model, and the steganographic information corresponding to the target model are sent to the target device, and the steganographic information corresponding to the target model is used to trigger the target device to reconstruct the target model based on the trained RGB domain parsing model, the trained frequency domain parsing model, and the trained frequency domain feature extraction model.

[0175] Specifically, in this embodiment, the model processing device includes a memory and one or more programs, wherein the one or more programs are stored in the memory, and the one or more programs may include one or more modules, and each module may include a series of computer-executable instructions in the model processing device, and the one or more programs are configured to be executed by one or more processors, including computer-executable instructions for performing the following:

[0176] Receiving the trained RGB domain parsing model and the trained frequency domain parsing model sent by the server;

[0177] Obtaining a reconstruction request for a target model, the reconstruction request including stegographic information corresponding to the target model, the stegographic information corresponding to the target model being based on a model structure of the target model, performing data processing on the structure of each network layer included in the target model to obtain first data corresponding to each network layer included in the target model, and performing structured processing on the model weights of the target model to obtain a tensor of a preset dimension corresponding to the model weights, inputting the tensor of the preset dimension corresponding to the model weights into a carrier generation model obtained in advance through model training, generating a target carrier for carrying data written to the target model in an information hiding manner, and determining the stegographic information based on the target carrier, the first data, the tensor of the preset dimension corresponding to the model weights, and the stegographic model obtained in advance through model training;

[0178] Determining a model structure and a model weight of the target model based on the steganalysis information corresponding to the target model, the trained RGB domain parsing model, and the trained frequency domain parsing model;

[0179] The model weights are loaded into the corresponding model structure to obtain a reconstructed target model, and business processing of the target business is performed based on the reconstructed target model.

[0180] In the embodiment of this specification, determining the model structure and model weight of the target model based on the steganalysis information corresponding to the target model, the trained RGB domain parsing model, and the trained frequency domain parsing model includes:

[0181] determining a model structure of the target model based on attribute information of preset inherent attributes of the stegographic information corresponding to the target model;

[0182] The stego information corresponding to the target model is input into the trained RGB domain parsing model and the trained frequency domain parsing model respectively, to obtain a pre-selected model weight of the target model restored from the stego information corresponding to the target model;

[0183] The average value of the preselected model weights is calculated, and the calculated average value is used as the model weight of the target model.

[0184] The embodiment of the present specification provides a model processing device, which obtains a target model to be protected and obtains the model structure and model weight of the target model. Then, based on the model structure, the structure of each network layer contained in the target model is digitized to obtain the first data corresponding to each network layer, and the model weight is structurally processed to obtain a tensor of a preset dimension corresponding to the model weight. The tensor of the preset dimension corresponding to the model weight is input into a carrier generation model to generate a target carrier for carrying the data of the target model. Based on the target carrier, the first data and the tensor of the preset dimension corresponding to the model weight, and the steganalysis model, the steganalysis information corresponding to the target model is determined. The steganalysis model is based on the information including The first loss function constructed by the consistency constraint before and after the steganographic processing of the preset model data in the frequency domain is obtained by model training. The steganographic information can be reconstructed subsequently to obtain the reconstructed target model for corresponding business processing. In this way, in order to improve the accuracy of the steganographic processing, the steganographic processing scheme for the target model is redesigned, and the local consistency loss is proposed. The carrier generation model is trained based on the above loss to generate a target carrier for steganographic processing similar to the natural carrier (such as natural images, etc.), so that the generated carrier has better steganographic performance. The above two aspects greatly improve the steganographic performance, so that the steganographic processing can be used for the privacy protection of the model.

[0185] Example 8

[0186] Furthermore, based on the above Figures 1 to 5 In one or more embodiments of the present specification, a storage medium is provided for storing computer-executable instruction information. In a specific embodiment, the storage medium may be a USB flash drive, an optical disk, a hard disk, etc. When the computer-executable instruction information stored in the storage medium is executed by a processor, the following process can be implemented:

[0187] Obtaining a target model to be protected, and obtaining a model structure and a model weight of the target model;

[0188] Based on the model structure, the structure of each network layer included in the target model is digitized to obtain first data corresponding to each network layer included in the target model, and the model weight is structured to obtain a tensor of a preset dimension corresponding to the model weight;

[0189] Inputting a tensor of a preset dimension corresponding to the model weight into a carrier generation model obtained in advance through model training to generate a target carrier for carrying data written into the target model in an information hiding manner;

[0190] Based on the target carrier, the first data, the tensor of preset dimensions corresponding to the model weight, and the steganographic model obtained in advance through model training, the steganographic information corresponding to the target model is determined, and the steganographic model is a model obtained by model training based on a first loss function constructed based on consistency constraints before and after steganographic processing of data of a preset model in the frequency domain.

[0191] In the embodiment of this specification, determining the steganalytic information corresponding to the target model based on the target carrier, the first data, the tensor of preset dimensions corresponding to the model weight, and the steganalytic model obtained in advance through model training includes:

[0192] The target carrier, the first data and the tensor of preset dimensions corresponding to the model weight are input into a steganographic model obtained in advance through model training to obtain steganographic information corresponding to the target model.

[0193] In the embodiment of this specification, determining the steganalytic information corresponding to the target model based on the target carrier, the first data, the tensor of preset dimensions corresponding to the model weight, and the steganalytic model obtained in advance through model training includes:

[0194] Inputting the target carrier and the tensor of the preset dimension corresponding to the model weight into the steganographic model obtained in advance through model training to obtain preselected steganographic information;

[0195] The first data is set as attribute information of a preset inherent attribute of the preselected stego information, and the preselected stego information with the attribute information is used as the stego information corresponding to the target model.

[0196] In an embodiment of the present specification, the first data is data of a preset number of bits, and the first data is constructed by data used to characterize the type of the model structure corresponding to the target model and data used to characterize the shape of the parameters in the model structure corresponding to the target model, and the target carrier is an image.

[0197] In the embodiments of this specification, further comprising:

[0198] Acquire a plurality of different preset models, and obtain a model structure and a model weight of each of the preset models;

[0199] Determining, based on the model structure and / or model weight of the preset model, a carrier sample for carrying data written into the preset model in an information hiding manner;

[0200] The model structure and model weight of the preset model, and the carrier sample are used as training samples, and based on the first loss function, the steganography model, RGB domain analysis model, frequency domain analysis model and frequency domain feature extraction model are jointly trained to obtain a trained steganography model, a trained RGB domain analysis model, a trained frequency domain analysis model and a trained frequency domain feature extraction model, wherein the RGB domain analysis model is used to restore the model structure and model weight of the preset model from the RGB information of the output information of the steganography model, the frequency domain analysis model is used to restore the model structure and model weight of the preset model from the frequency domain information of the output information of the steganography model, and the frequency domain feature extraction model is used to extract features from the carrier sample and the frequency domain information of the output information of the steganography model.

[0201] In an embodiment of the present specification, the first loss function is determined based on the maximum value of the similarity between the output information of the steganographic model and the carrier sample, the maximum value of the similarity between the model structure and model weight of the preset model and the corresponding model structure and model weight of the preset model restored from the output information of the steganographic model, the maximum value of the similarity between the frequency domain information of the output information of the steganographic model and the frequency domain information of the carrier sample, and the maximum value of the similarity between the features corresponding to the frequency domain information of the output information of the steganographic model and the features corresponding to the frequency domain information of the carrier sample.

[0202] In the embodiments of this specification, further comprising:

[0203] Inputting the model structure and model weight of the preset model into a pre-built carrier generation model to generate a first carrier for carrying the data written into the preset model in an information hiding manner;

[0204] Inputting the model structure and model weight of the preset model and the first carrier into the trained steganographic model, inputting the RGB information of the output information of the steganographic model into the trained RGB domain parsing model, inputting the frequency domain information of the output information of the steganographic model into the trained frequency domain parsing model, and inputting the output information of the steganographic model and the first carrier into the trained frequency domain feature extraction model, respectively obtaining the output information of the trained RGB domain parsing model, the output information of the trained frequency domain parsing model, and the output information of the trained frequency domain feature extraction model;

[0205] Based on the first carrier, the model structure and model weight of the preset model, the output information of the steganography model, the output information of the trained RGB domain analysis model, the output information of the trained frequency domain analysis model and the output information of the trained frequency domain feature extraction model, and through a second loss function, determine whether the carrier generation model converges; if the carrier generation model does not converge, use the model structure and model weight of the preset model to continue to jointly train the carrier generation model, the trained steganography model, the trained RGB domain analysis model, the trained frequency domain analysis model and the trained frequency domain feature extraction model until the carrier generation model converges to obtain a trained carrier generation model.

[0206] In the embodiment of this specification, determining a carrier sample for carrying data written into the preset model in an information hiding manner based on the model structure and / or model weight of the preset model includes:

[0207] The model structure and model weight of the preset model are input into the trained carrier generation model to obtain a carrier sample for carrying the data written into the preset model in an information hiding manner.

[0208] In an embodiment of this specification, the second loss function is determined based on the first loss function and the corresponding value when the distance between the features of two adjacent regions in the first carrier is within a preset distance range, and the carrier generation model is a model constructed based on StyleGAN.

[0209] In the embodiments of this specification, further comprising:

[0210] The trained RGB domain parsing model, the trained frequency domain parsing model, the trained frequency domain feature extraction model, and the steganographic information corresponding to the target model are sent to the target device, and the steganographic information corresponding to the target model is used to trigger the target device to reconstruct the target model based on the trained RGB domain parsing model, the trained frequency domain parsing model, and the trained frequency domain feature extraction model.

[0211] Furthermore, in another specific embodiment, the storage medium may be a USB flash drive, an optical disk, a hard disk, etc., and the computer executable instruction information stored in the storage medium, when executed by the processor, can implement the following process:

[0212] Receiving the trained RGB domain parsing model and the trained frequency domain parsing model sent by the server;

[0213] Obtaining a reconstruction request for a target model, the reconstruction request including stegographic information corresponding to the target model, the stegographic information corresponding to the target model being based on a model structure of the target model, performing data processing on the structure of each network layer included in the target model to obtain first data corresponding to each network layer included in the target model, and performing structured processing on the model weights of the target model to obtain a tensor of a preset dimension corresponding to the model weights, inputting the tensor of the preset dimension corresponding to the model weights into a carrier generation model obtained in advance through model training, generating a target carrier for carrying data written to the target model in an information hiding manner, and determining the stegographic information based on the target carrier, the first data, the tensor of the preset dimension corresponding to the model weights, and the stegographic model obtained in advance through model training;

[0214] Determining a model structure and a model weight of the target model based on the steganalysis information corresponding to the target model, the trained RGB domain parsing model, and the trained frequency domain parsing model;

[0215] The model weights are loaded into the corresponding model structure to obtain a reconstructed target model, and business processing of the target business is performed based on the reconstructed target model.

[0216] In the embodiment of this specification, determining the model structure and model weight of the target model based on the steganalysis information corresponding to the target model, the trained RGB domain parsing model, and the trained frequency domain parsing model includes:

[0217] determining a model structure of the target model based on attribute information of preset inherent attributes of the stegographic information corresponding to the target model;

[0218] The stego information corresponding to the target model is input into the trained RGB domain parsing model and the trained frequency domain parsing model respectively, to obtain a pre-selected model weight of the target model restored from the stego information corresponding to the target model;

[0219] The average value of the preselected model weights is calculated, and the calculated average value is used as the model weight of the target model.

[0220] The embodiment of the present specification provides a storage medium, which obtains a target model to be protected and obtains a model structure and a model weight of the target model, and then, based on the model structure, performs data processing on the structure of each network layer contained in the target model to obtain the first data corresponding to each network layer, and performs structured processing on the model weight to obtain a tensor of a preset dimension corresponding to the model weight, and inputs the tensor of the preset dimension corresponding to the model weight into a carrier generation model to generate a target carrier for carrying the data of the target model, and determines the steganographic information corresponding to the target model based on the target carrier, the first data and the tensor of the preset dimension corresponding to the model weight, and the steganographic model. The steganographic model is based on the information included in the frequency The first loss function constructed by the consistency constraint before and after the steganographic processing of the preset model data in the domain is obtained by model training. The steganographic information can be reconstructed subsequently to obtain the reconstructed target model for corresponding business processing. In this way, in order to improve the accuracy of the steganographic processing, the steganographic processing scheme for the target model is redesigned, and the local consistency loss is proposed. The carrier generation model is trained based on the above loss to generate a target carrier for steganographic processing similar to the natural carrier (such as natural images, etc.), so that the generated carrier has better steganographic performance. The above two aspects greatly improve the steganographic performance, so that the steganographic processing can be used for the privacy protection of the model.

[0221] The foregoing description of this specification describes specific embodiments. Other embodiments are within the scope of the appended claims. In some cases, the actions or steps recited in the claims can be performed in an order different from that described in the embodiments and still achieve the desired results. Furthermore, the processes depicted in the accompanying drawings do not necessarily require the specific order shown or the sequential order to achieve the desired results. In certain embodiments, multitasking and parallel processing are also possible or may be advantageous.

[0222] In the 1990s, technological improvements could be clearly distinguished as either hardware improvements (for example, improvements to circuit structures such as diodes, transistors, and switches) or software improvements (improvements to process flows). However, with the advancement of technology, many process flow improvements today can now be considered direct improvements to hardware circuit structures. Designers almost always create the corresponding hardware circuit structure by programming the improved process flow into the hardware circuit. Therefore, it cannot be said that a process flow improvement cannot be implemented using hardware modules. For example, a programmable logic device (PLD), such as a field programmable gate array (FPGA), is an integrated circuit whose logical function is determined by user programming. Designers can "integrate" a digital system on a PLD by programming it themselves, without having to hire a chip manufacturer to design and produce a dedicated integrated circuit chip. Moreover, nowadays, instead of manually fabricating integrated circuit chips, this programming is mostly done using "logic compiler" software. This is similar to the software compiler used when developing programs. Before compilation, the original code must also be written in a specific programming language, called a hardware description language (HDL). There is not just one HDL, but many, such as ABEL (Advanced Boolean Expression Language), AHDL (Altera Hardware Description Language), Confluence, CUPL (Cornell University Programming Language), HDCal, JHDL (Java Hardware Description Language), Lava, Lola, MyHDL, PALASM, RHDL (Ruby Hardware Description Language), etc. The most commonly used ones are VHDL (Very-High-Speed ​​Integrated Circuit Hardware Description Language) and Verilog. Those skilled in the art will also understand that by simply programming the method flow in one of these hardware description languages ​​and then programming it into an integrated circuit, a hardware circuit that implements the logic method flow can be easily obtained.

[0223] The controller can be implemented in any suitable manner. For example, the controller can take the form of a microprocessor or processor and a computer-readable medium storing computer-readable program code (e.g., software or firmware) executable by the (micro)processor, logic gates, switches, an application-specific integrated circuit (ASIC), a programmable logic controller, and an embedded microcontroller. Examples of controllers include, but are not limited to, the following microcontrollers: ARC625D, Atmel AT91SAM, Microchip PIC18F26K20, and Silicone Labs C8051F320. The memory controller can also be implemented as part of the control logic of the memory. Those skilled in the art will also know that in addition to implementing the controller in a purely computer-readable program code format, the controller can be implemented in the form of logic gates, switches, an application-specific integrated circuit, a programmable logic controller, and an embedded microcontroller by logically programming the method steps. Therefore, such a controller can be considered a hardware component, and the means for implementing various functions included therein can also be considered as structures within the hardware component. Or even, the means for implementing various functions can be considered as both a software module implementing the method and a structure within the hardware component.

[0224] The systems, devices, modules, or units described in the above embodiments may be implemented by computer chips or entities, or by products having certain functions. A typical implementation device is a computer. Specifically, the computer may be, for example, a personal computer, a laptop computer, a cellular phone, a camera phone, a smartphone, a personal digital assistant, a media player, a navigation device, an email device, a game console, a tablet computer, a wearable device, or a combination of any of these devices.

[0225] For the convenience of description, the above devices are described as being divided into various units according to their functions. Of course, when implementing one or more embodiments of this specification, the functions of each unit can be implemented in the same or multiple software and / or hardware.

[0226] Those skilled in the art will appreciate that the embodiments of this specification may be provided as methods, systems, or computer program products. Therefore, one or more embodiments of this specification may take the form of a complete hardware embodiment, a complete software embodiment, or an embodiment combining software and hardware. Furthermore, one or more embodiments of this specification may take the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to magnetic disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0227] The embodiments of this specification are described with reference to the flowcharts and / or block diagrams of the methods, devices (systems), and computer program products according to the embodiments of this specification. It should be understood that each process and / or box in the flowchart and / or block diagram, as well as the combination of the processes and / or boxes in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable fraud case serial and parallel device to produce a machine, so that the instructions executed by the processor of the computer or other programmable fraud case serial and parallel device generate instructions for implementing the process in the process. Figure 1 a process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.

[0228] These computer program instructions may also be stored in a computer readable memory capable of directing a computer or other programmable fraud case serial and parallel device to operate in a specific manner, so that the instructions stored in the computer readable memory produce an article of manufacture comprising an instruction device, the instruction device being implemented in the process Figure 1 a process or multiple processes and / or boxes Figure 1 The function specified in one or more boxes.

[0229] These computer program instructions may also be loaded onto a computer or other programmable device so that a series of operational steps are executed on the computer or other programmable device to produce a computer-implemented process, whereby the instructions executed on the computer or other programmable device provide for implementing the process. Figure 1 a process or multiple processes and / or boxes Figure 1 A step that specifies a function in one or more boxes.

[0230] In a typical configuration, a computing device includes one or more processors (CPUs), input / output interfaces, network interfaces, and memory.

[0231] Memory may include non-permanent storage in a computer-readable medium, random access memory (RAM) and / or non-volatile memory in the form of read-only memory (ROM) or flash RAM. Memory is an example of a computer-readable medium.

[0232] Computer-readable media includes permanent and non-permanent, removable and non-removable media that can be implemented by any method or technology to store information. The information can be computer-readable instructions, data structures, program modules or other data. Examples of computer storage media include, but are not limited to, phase change memory (PRAM), static random access memory (SRAM), dynamic random access memory (DRAM), other types of random access memory (RAM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), flash memory or other memory technology, compact disc read-only memory (CD-ROM), digital versatile disc (DVD) or other optical storage, magnetic cassettes, magnetic tape, magnetic disk storage or other magnetic storage devices or any other non-transmission media that can be used to store information that can be accessed by a computing device. As defined herein, computer-readable media does not include transitory computer-readable media (transitory media), such as modulated data signals and carrier waves.

[0233] It should also be noted that the terms "comprises," "includes," or any other variations thereof are intended to encompass non-exclusive inclusion, such that a process, method, commodity, or apparatus that includes a series of elements includes not only those elements but also other elements not explicitly listed, or includes elements inherent to such process, method, commodity, or apparatus. In the absence of further limitations, an element defined by the phrase "comprises a ..." does not exclude the presence of other identical elements in the process, method, commodity, or apparatus that includes the element.

[0234] Those skilled in the art will appreciate that the embodiments of this specification may be provided as methods, systems, or computer program products. Thus, one or more embodiments of this specification may take the form of a fully hardware embodiment, a fully software embodiment, or an embodiment combining software and hardware. Furthermore, one or more embodiments of this specification may take the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to magnetic disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0235] One or more embodiments of this specification may be described in the general context of computer-executable instructions executed by a computer, such as program modules. Generally, program modules include routines, programs, objects, components, data structures, and the like that perform specific tasks or implement specific abstract data types. One or more embodiments of this specification may also be practiced in distributed computing environments where tasks are performed by remote processing devices connected via a communications network. In a distributed computing environment, program modules may be located in local and remote computer storage media, including storage devices.

[0236] The various embodiments in this specification are described in a progressive manner. Similar parts between the various embodiments can be referred to in conjunction with each other. Each embodiment focuses on the differences between the other embodiments. In particular, the system embodiments are generally similar to the method embodiments, so the description is relatively simple. For relevant parts, refer to the description of the method embodiments.

[0237] The foregoing is merely an example of the present invention and is not intended to limit the present application. Various modifications and variations are possible for those skilled in the art. Any modifications, equivalent substitutions, or improvements made within the spirit and principles of this specification are intended to be included within the scope of the claims of this specification.

Claims

1. A model processing method, applied to a server, comprising: Obtaining a target model to be protected, and obtaining a model structure and a model weight of the target model; Based on the model structure, the structure of each network layer included in the target model is digitized to obtain first data corresponding to each network layer included in the target model, and the model weight is structured to obtain a tensor of a preset dimension corresponding to the model weight; Inputting a tensor of a preset dimension corresponding to the model weight into a carrier generation model obtained in advance through model training to generate a target carrier for carrying data written into the target model in an information hiding manner, wherein the target carrier is an image or other types of objects other than images, and the other types of objects other than images include text files and page data of web pages; Based on the target carrier, the first data, the tensor of preset dimensions corresponding to the model weight, and the steganographic model obtained in advance through model training, the steganographic information corresponding to the target model is determined, and the steganographic model is a model obtained by model training based on a first loss function constructed based on consistency constraints before and after steganographic processing of data of a preset model in the frequency domain.

2. The method according to claim 1, wherein determining the steganographic information corresponding to the target model based on the target carrier, the first data, a tensor of a preset dimension corresponding to the model weight, and a steganographic model obtained in advance through model training comprises: The target carrier, the first data and the tensor of preset dimensions corresponding to the model weight are input into a steganographic model obtained in advance through model training to obtain steganographic information corresponding to the target model.

3. The method according to claim 1, wherein determining the steganographic information corresponding to the target model based on the target carrier, the first data, a tensor of a preset dimension corresponding to the model weight, and a steganographic model obtained in advance through model training comprises: Inputting the target carrier and the tensor of the preset dimension corresponding to the model weight into the steganographic model obtained in advance through model training to obtain preselected steganographic information; The first data is set as attribute information of a preset inherent attribute of the preselected stego information, and the preselected stego information with the attribute information is used as the stego information corresponding to the target model.

4. According to the method described in any one of claims 1 to 3, the first data is data of a preset number of bits, and the first data is constructed by data used to characterize the type of the model structure corresponding to the target model and data used to characterize the shape of the parameters in the model structure corresponding to the target model, and the target carrier is an image.

5. The method according to claim 4, further comprising: Acquire a plurality of different preset models, and obtain a model structure and a model weight of each of the preset models; Based on the model structure of the preset model, the structure of each network layer included in the preset model is digitized to obtain second data corresponding to each network layer included in the preset model, and the model weight of the preset model is structured to obtain a tensor of a preset dimension corresponding to the model weight of the preset model; Determining, based on the second data and / or the tensor of a preset dimension corresponding to the model weight of the preset model, a carrier sample for carrying the data written into the preset model in an information hiding manner; The second data and the tensor of the preset dimension corresponding to the model weight of the preset model, and the carrier sample are used as training samples, and based on the first loss function, the steganography model, the RGB domain analysis model, the frequency domain analysis model and the frequency domain feature extraction model are jointly trained to obtain the trained steganography model, the trained RGB domain analysis model, the trained frequency domain analysis model and the trained frequency domain feature extraction model. The RGB domain analysis model is used to restore the tensor of the preset dimension corresponding to the second data and the model weight of the preset model from the RGB information of the output information of the steganography model. The frequency domain analysis model is used to restore the tensor of the preset dimension corresponding to the second data and the model weight of the preset model from the frequency domain information of the output information of the steganography model. The frequency domain feature extraction model is used to extract features from the carrier sample and the frequency domain information of the output information of the steganography model.

6. According to the method according to claim 5, the first loss function is determined based on the maximum value of the similarity between the output information of the steganographic model and the carrier sample, the maximum value of the similarity between the tensor of preset dimensions corresponding to the second data and the model weight of the preset model and the tensor of preset dimensions corresponding to the second data and the model weight of the preset model restored from the output information of the steganographic model, the maximum value of the similarity between the frequency domain information of the output information of the steganographic model and the frequency domain information of the carrier sample, and the maximum value of the similarity between the features corresponding to the frequency domain information of the output information of the steganographic model and the features corresponding to the frequency domain information of the carrier sample.

7. The method according to claim 6, further comprising: Inputting the second data and a tensor of a preset dimension corresponding to the model weight of the preset model into a pre-built carrier generation model to generate a first carrier for carrying the data written into the preset model in an information hiding manner; Inputting the second data, a tensor of preset dimensions corresponding to the model weight of the preset model, and the first carrier into the trained steganographic model, inputting the RGB information of the output information of the steganographic model into the trained RGB domain parsing model, inputting the frequency domain information of the output information of the steganographic model into the trained frequency domain parsing model, and inputting the output information of the steganographic model and the first carrier into the trained frequency domain feature extraction model, respectively obtaining the output information of the trained RGB domain parsing model, the output information of the trained frequency domain parsing model, and the output information of the trained frequency domain feature extraction model; Based on the first carrier, the second data and the tensor of preset dimensions corresponding to the model weights of the preset model, the output information of the steganography model, the output information of the trained RGB domain analysis model, the output information of the trained frequency domain analysis model and the output information of the trained frequency domain feature extraction model, and through a second loss function, determine whether the carrier generation model converges; if the carrier generation model does not converge, continue to jointly train the carrier generation model, the trained steganography model, the trained RGB domain analysis model, the trained frequency domain analysis model and the trained frequency domain feature extraction model based on the model structure and model weights of the preset model until the carrier generation model converges to obtain a trained carrier generation model.

8. The method according to claim 7, wherein determining a carrier sample for carrying data written into the preset model in an information hiding manner based on the second data and a tensor of a preset dimension corresponding to the model weight of the preset model comprises: The tensor of preset dimensions corresponding to the second data and the model weight of the preset model is input into the trained carrier generation model to obtain a carrier sample for carrying the data written into the preset model in an information hiding manner.

9. According to the method of claim 7, the second loss function is determined based on the first loss function and the corresponding value of the distance between the features of two adjacent regions in the first carrier within a preset distance range, and the carrier generation model is a model constructed based on StyleGAN.

10. The method according to claim 5, further comprising: The trained RGB domain parsing model, the trained frequency domain parsing model, the trained frequency domain feature extraction model, and the steganalytic information corresponding to the target model are sent to the target device, and the steganalytic information corresponding to the target model is used to trigger the target device to reconstruct the target model based on the trained RGB domain parsing model and the trained frequency domain parsing model.

11. A model processing method, applied to a target device, comprising: Receive the trained RGB domain parsing model and the trained frequency domain parsing model sent by the server; Obtaining a reconstruction request for a target model, the reconstruction request including stegographic information corresponding to the target model, the stegographic information corresponding to the target model being based on a model structure of the target model, performing data processing on the structure of each network layer included in the target model to obtain first data corresponding to each network layer included in the target model, and performing structured processing on the model weights of the target model to obtain a tensor of a preset dimension corresponding to the model weights, inputting the tensor of the preset dimension corresponding to the model weights into a carrier generation model obtained in advance through model training, generating a target carrier for carrying data written to the target model in an information hiding manner, and determining the stegographic information based on the target carrier, the first data, the tensor of the preset dimension corresponding to the model weights, and the stegographic model obtained in advance through model training, wherein the target carrier is an image or other type of object other than an image, and the other types of objects other than images include text files and page data of web pages; Determining a model structure and a model weight of the target model based on the steganalysis information corresponding to the target model, the trained RGB domain parsing model, and the trained frequency domain parsing model; The model weights are loaded into the corresponding model structure to obtain a reconstructed target model, and business processing of the target business is performed based on the reconstructed target model.

12. The method according to claim 11, wherein determining the model structure and model weight of the target model based on the steganalytic information corresponding to the target model, the trained RGB domain parsing model, and the trained frequency domain parsing model comprises: determining a model structure of the target model based on attribute information of preset inherent attributes of the stegographic information corresponding to the target model; Inputting the stego information corresponding to the target model into the trained RGB domain parsing model and the trained frequency domain parsing model respectively, to obtain a preselected model weight of the target model restored from the stego information corresponding to the target model; The average value of the preselected model weights is calculated, and the calculated average value is used as the model weight of the target model.

13. A model processing device, comprising: A model information acquisition module acquires the target model to be protected and acquires the model structure and model weight of the target model; A model information conversion module, based on the model structure, performs data processing on the structure of each network layer included in the target model to obtain first data corresponding to each network layer included in the target model, and performs structured processing on the model weights to obtain a tensor of a preset dimension corresponding to the model weights; a carrier generation module, inputting a tensor of a preset dimension corresponding to the model weight into a carrier generation model obtained in advance through model training, and generating a target carrier for carrying data written into the target model in an information hiding manner, wherein the target carrier is an image or other type of object other than an image, and the other type of object other than an image includes text files and page data of a web page; The model steganography module determines the steganographic information corresponding to the target model based on the target carrier, the first data, the tensor of preset dimensions corresponding to the model weight, and the steganographic model obtained in advance through model training. The steganographic model is a model obtained by model training based on a first loss function constructed based on consistency constraints before and after steganographic processing of the data of the preset model in the frequency domain.

14. A model processing device, comprising: The model receiving module receives the trained RGB domain parsing model and the trained frequency domain parsing model sent by the server; A request acquisition module is configured to acquire a reconstruction request for a target model, wherein the reconstruction request includes stego information corresponding to the target model. The stego information corresponding to the target model is based on the model structure of the target model, and the structure of each network layer included in the target model is digitized to obtain first data corresponding to each network layer included in the target model. The model weight of the target model is structured to obtain a tensor of a preset dimension corresponding to the model weight. The tensor of the preset dimension corresponding to the model weight is input into a carrier generation model obtained in advance through model training to generate a target carrier for carrying data written to the target model in an information hiding manner. The target carrier is an image or other type of object other than an image, and the other types of objects other than images include text files and page data of a web page. An information parsing module determines a model structure and a model weight of the target model based on the stego information corresponding to the target model, the trained RGB domain parsing model, and the trained frequency domain parsing model; The model reconstruction module loads the model weights into the corresponding model structure to obtain a reconstructed target model, and performs business processing of the target business based on the reconstructed target model.

15. A model processing device, comprising: processor; as well as a memory arranged to store computer-executable instructions which, when executed, cause the processor to: Obtaining a target model to be protected, and obtaining a model structure and a model weight of the target model; Based on the model structure, the structure of each network layer included in the target model is digitized to obtain first data corresponding to each network layer included in the target model, and the model weight is structured to obtain a tensor of a preset dimension corresponding to the model weight; Inputting a tensor of a preset dimension corresponding to the model weight into a carrier generation model obtained in advance through model training to generate a target carrier for carrying data written into the target model in an information hiding manner, wherein the target carrier is an image or other types of objects other than images, and the other types of objects other than images include text files and page data of web pages; Based on the target carrier, the first data, the tensor of preset dimensions corresponding to the model weight, and the steganographic model obtained in advance through model training, the steganographic information corresponding to the target model is determined, and the steganographic model is a model obtained by model training based on a first loss function constructed based on consistency constraints before and after steganographic processing of data of a preset model in the frequency domain.

16. A model processing device, comprising: processor; as well as a memory arranged to store computer-executable instructions which, when executed, cause the processor to: Receive the trained RGB domain parsing model and the trained frequency domain parsing model sent by the server; Obtaining a reconstruction request for a target model, the reconstruction request including stegographic information corresponding to the target model, the stegographic information corresponding to the target model being based on a model structure of the target model, performing data processing on the structure of each network layer included in the target model to obtain first data corresponding to each network layer included in the target model, and performing structured processing on the model weights of the target model to obtain a tensor of a preset dimension corresponding to the model weights, inputting the tensor of the preset dimension corresponding to the model weights into a carrier generation model obtained in advance through model training, generating a target carrier for carrying data written to the target model in an information hiding manner, and determining the stegographic information based on the target carrier, the first data, the tensor of the preset dimension corresponding to the model weights, and the stegographic model obtained in advance through model training, wherein the target carrier is an image or other type of object other than an image, and the other types of objects other than images include text files and page data of web pages; Determining a model structure and a model weight of the target model based on the steganalysis information corresponding to the target model, the trained RGB domain parsing model, and the trained frequency domain parsing model; The model weights are loaded into the corresponding model structure to obtain a reconstructed target model, and business processing of the target business is performed based on the reconstructed target model.

17. A storage medium for storing computer-executable instructions, wherein the computer-executable instructions, when executed by a processor, implement the following process: Obtaining a target model to be protected, and obtaining a model structure and a model weight of the target model; Based on the model structure, the structure of each network layer included in the target model is digitized to obtain first data corresponding to each network layer included in the target model, and the model weight is structured to obtain a tensor of a preset dimension corresponding to the model weight; Inputting a tensor of a preset dimension corresponding to the model weight into a carrier generation model obtained in advance through model training to generate a target carrier for carrying data written into the target model in an information hiding manner, wherein the target carrier is an image or other types of objects other than images, and the other types of objects other than images include text files and page data of web pages; Based on the target carrier, the first data, the tensor of preset dimensions corresponding to the model weight, and the steganographic model obtained in advance through model training, the steganographic information corresponding to the target model is determined, and the steganographic model is a model obtained by model training based on a first loss function constructed based on consistency constraints before and after steganographic processing of data of a preset model in the frequency domain.

18. A storage medium for storing computer-executable instructions, wherein the computer-executable instructions, when executed by a processor, implement the following process: Receive the trained RGB domain parsing model and the trained frequency domain parsing model sent by the server; Obtaining a reconstruction request for a target model, the reconstruction request including stegographic information corresponding to the target model, the stegographic information corresponding to the target model being based on a model structure of the target model, performing data processing on the structure of each network layer included in the target model to obtain first data corresponding to each network layer included in the target model, and performing structured processing on the model weights of the target model to obtain a tensor of a preset dimension corresponding to the model weights, inputting the tensor of the preset dimension corresponding to the model weights into a carrier generation model obtained in advance through model training, generating a target carrier for carrying data written to the target model in an information hiding manner, and determining the stegographic information based on the target carrier, the first data, the tensor of the preset dimension corresponding to the model weights, and the stegographic model obtained in advance through model training, wherein the target carrier is an image or other type of object other than an image, and the other types of objects other than images include text files and page data of web pages; Determining a model structure and a model weight of the target model based on the steganalysis information corresponding to the target model, the trained RGB domain parsing model, and the trained frequency domain parsing model; The model weights are loaded into the corresponding model structure to obtain a reconstructed target model, and business processing of the target business is performed based on the reconstructed target model.

Images