A model processing method, apparatus and device

Abstract

The embodiment of the specification discloses a model processing method, device and equipment, the method is applied to the server, including: obtaining each network layer corresponding model weight contained in the target model to be protected, and obtaining the first steganographic carrier corresponding to each network layer corresponding model weight, determining the first steganographic information based on the first steganographic carrier and each network layer corresponding model weight and the steganographic model, obtaining each network layer corresponding model structure contained in the target model, and performing encoding processing on each network layer corresponding model structure to obtain the first data corresponding to each network layer corresponding model structure occupying a preset number of bit positions, and writing the first data into the second steganographic carrier through the information steganography to obtain the second steganographic information; setting the corresponding retrieval information for the first steganographic information and the second steganographic information respectively, and storing the first steganographic information and the second steganographic information based on the preset steganographic information directory.

Description

TECHNICAL FIELD

[0001] The present document relates to the technical field of computers, and particularly relates to a model processing method and device and equipment. BACKGROUND

[0002] In recent years, with the continuous development of terminal technology and network technology, artificial intelligence has become an important technical subject to be researched and developed. In recent years, artificial intelligence has also been developed and applied to some extent. For example, various artificial intelligence algorithms are needed for applications such as face recognition, automatic driving, and intelligent customer service. The core of artificial intelligence algorithms is generally a deep learning model. Therefore, once the deep learning model is leaked, the entire artificial intelligence system will be at great risk. Therefore, desensitization and protection of the deep learning model have become an important issue.

[0003] Generally, important information can be protected by information encryption. Specifically, some important information is encrypted or processed by row and column confusion using simple linear operations, but the above method is simple in atomic operation and single in process, and is easily cracked by methods such as brute force cracking. Therefore, it is necessary to provide a model protection scheme with higher security and higher efficiency in model protection. SUMMARY

[0004] The purpose of the embodiments of the present specification is to provide a model protection scheme with higher security and higher efficiency in model protection.

[0005] To achieve the above technical solutions, the embodiments of the present specification are implemented as follows:

[0006] The model processing method provided in the embodiments of the present specification is applied to a server, and the method comprises: obtaining a target model to be protected. The model weight corresponding to each network layer in the target model is obtained, and a first steganographic carrier corresponding to the model weight of each network layer is obtained. Based on the first steganographic carrier and the model weight corresponding to each network layer, and a pre-trained steganographic model, first steganographic information corresponding to the model weight of each network layer is determined. The first steganographic information is information obtained by writing the model weight into the first steganographic carrier by using the steganographic model in an information steganography manner. The model structure corresponding to each network layer contained in the target model is obtained, and the model structure corresponding to each network layer is encoded to obtain first data corresponding to the model structure of each network layer, which occupies a preset number of bit positions, and the first data is written into a second steganographic carrier selected in advance in an information steganography manner to obtain second steganographic information corresponding to the model structure of each network layer. The corresponding retrieval information is set for the first steganographic information corresponding to the model weight of each network layer and the second steganographic information corresponding to the model structure of each network layer, and based on a pre-set steganographic information directory, the first steganographic information corresponding to the model weight of each network layer and the second steganographic information corresponding to the model structure of each network layer are stored.

[0007] The model processing method provided in the embodiments of the present specification is applied to a target device, and the method comprises: obtaining a reconstruction request for a target model. Based on a pre-set steganographic information directory and retrieval information of the model structure and model weight corresponding to each network layer contained in the target model, first steganographic information and second steganographic information corresponding to the target model are obtained. The first steganographic information is steganographic information corresponding to the model weight of each network layer, which is determined based on the obtained model weight of each network layer contained in the target model, the first steganographic carrier corresponding to the model weight of each network layer, and a pre-trained steganographic model. The second steganographic information is steganographic information obtained by encoding the model structure of each network layer contained in the target model to obtain first data corresponding to the model structure of each network layer, which occupies a preset number of bit positions, and writing the first data into a second steganographic carrier selected in advance in an information steganography manner. Based on a steganographic information extraction model and the first steganographic information provided by a server in advance, the model weight corresponding to each network layer contained in the target model is determined, and the second steganographic information is decoded to obtain the model structure corresponding to each network layer contained in the target model. The model weight is loaded into the corresponding model structure to obtain a reconstructed target model, and a target service processing is performed based on the reconstructed target model.

[0008] The embodiment of the specification provides a model processing device, the device comprises: a model acquisition module, which acquires a target model to be protected. A weight steganography module acquires model weights corresponding to each network layer in the target model, acquires a first steganographic carrier corresponding to each network layer, determines first steganographic information corresponding to each network layer based on the first steganographic carrier, the model weights corresponding to each network layer, and a pre-trained steganographic model, and the first steganographic information is information obtained by writing the model weights into the first steganographic carrier using the steganographic model in an information steganography manner. A structure steganography module acquires model structures corresponding to each network layer in the target model, encodes and processes the model structures corresponding to each network layer, obtains first data corresponding to each network layer and occupying a preset number of bit positions, and writes the first data into a second steganographic carrier selected in advance in an information steganography manner to obtain second steganographic information corresponding to each network layer. A storage module sets corresponding retrieval information for the first steganographic information corresponding to each network layer and the second steganographic information corresponding to each network layer, and stores the first steganographic information corresponding to each network layer and the second steganographic information corresponding to each network layer based on a pre-set steganographic information directory.

[0009] The embodiment of the specification provides a model processing device, the device comprises: a reconstruction request module, obtaining a reconstruction request for a target model. A steganographic information acquisition module, based on a preset steganographic information directory and retrieval information of model structure and model weight corresponding to each network layer contained in the target model, acquires first steganographic information and second steganographic information corresponding to the target model, the first steganographic information is determined based on the model weight corresponding to each network layer contained in the target model, the first steganographic carrier corresponding to the model weight corresponding to each network layer, and the pre-trained steganographic model, the steganographic information corresponding to each network layer, the second steganographic information is obtained by encoding and processing the model structure corresponding to each network layer contained in the target model, the first data corresponding to the model structure corresponding to each network layer is obtained, and the first data is written into the second steganographic carrier by the information steganographic method to obtain the steganographic information. A model information acquisition module, based on the steganographic information extraction model and the first steganographic information provided by the server in advance, determines the model weight corresponding to each network layer contained in the target model, and decodes and processes the second steganographic information to obtain the model structure corresponding to each network layer contained in the target model. The reconstruction module loads the model weight into the corresponding model structure to obtain the reconstructed target model, and performs service processing of the target service based on the reconstructed target model.

[0010] The model processing device provided by the embodiments of the present specification comprises: a processor; and a memory arranged to store computer executable instructions, which, when executed, cause the processor to: obtain a target model to be protected. Obtain the model weight corresponding to each network layer contained in the target model, and obtain the first steganographic carrier corresponding to the model weight of each network layer. Based on the first steganographic carrier and the model weight corresponding to each network layer, and a pre-trained steganographic model, determine the first steganographic information corresponding to the model weight of each network layer, which is information obtained by writing the model weight into the first steganographic carrier using the steganographic model in an information steganographic manner. Obtain the model structure corresponding to each network layer contained in the target model, and perform encoding processing on the model structure corresponding to each network layer to obtain the first data corresponding to the model structure of each network layer, which occupies a preset number of bit positions, and write the first data into a second steganographic carrier selected in advance in an information steganographic manner to obtain the second steganographic information corresponding to the model structure of each network layer. Set the corresponding retrieval information for the first steganographic information corresponding to the model weight of each network layer and the second steganographic information corresponding to the model structure of each network layer, respectively, and store the first steganographic information corresponding to the model weight of each network layer and the second steganographic information corresponding to the model structure of each network layer based on a pre-set steganographic information directory.

[0011] The embodiment of the specification provides a model processing device, the model processing device comprises a processor and a memory arranged to store computer executable instructions, the executable instructions enable the processor to acquire a reconstruction request of a target model when executed. Based on the preset steganographic information directory and the retrieval information of the model structure and the model weight corresponding to each network layer contained in the target model, the first steganographic information and the second steganographic information corresponding to the target model are acquired, the first steganographic information is determined based on the acquired model weight corresponding to each network layer, the first steganographic carrier corresponding to the model weight of each network layer, and the pre-trained steganographic model, the steganographic information corresponding to each network layer, the second steganographic information is obtained by encoding and processing the model structure corresponding to each network layer in the target model, and the first data corresponding to the model structure of each network layer is obtained by occupying a preset number of bit positions, and the first data is written into the second steganographic carrier by the information steganography to obtain the steganographic information. Based on the steganographic information extraction model and the first steganographic information provided by the server in advance, the model weight corresponding to each network layer contained in the target model is determined, and the second steganographic information is decoded to obtain the model structure corresponding to each network layer contained in the target model. The model weight is loaded into the corresponding model structure to obtain the reconstructed target model, and the target service processing is performed based on the reconstructed target model.

[0012] The embodiment of the specification further provides a storage medium for storing computer executable instructions, which, when executed by a processor, implement the following processes: obtaining a target model to be protected. Obtain the model weight corresponding to each network layer contained in the target model, and obtain the first steganographic carrier corresponding to the model weight of each network layer. Based on the first steganographic carrier and the model weight corresponding to each network layer, and a pre-trained steganographic model, determine the first steganographic information corresponding to the model weight of each network layer. The first steganographic information is information obtained by writing the model weight into the first steganographic carrier using the steganographic model in an information steganography manner. Obtain the model structure corresponding to each network layer contained in the target model, and perform encoding processing on the model structure corresponding to each network layer to obtain the first data corresponding to the model structure of each network layer, which occupies a preset number of bit positions, and write the first data into a second steganographic carrier selected in advance in an information steganography manner to obtain the second steganographic information corresponding to the model structure of each network layer. Set the corresponding retrieval information for the first steganographic information corresponding to the model weight of each network layer and the second steganographic information corresponding to the model structure of each network layer, and store the first steganographic information corresponding to the model weight of each network layer and the second steganographic information corresponding to the model structure of each network layer based on a pre-set steganographic information directory.

[0013] The embodiment of the present specification also provides a storage medium for storing computer executable instructions, which, when executed by a processor, implement the following processes: obtaining a reconstruction request for a target model. Based on a preset steganographic information directory and retrieval information of model structures and model weights corresponding to each network layer contained in the target model, first steganographic information and second steganographic information corresponding to the target model are obtained, the first steganographic information is determined based on the obtained model weights corresponding to each network layer contained in the target model, the obtained first steganographic carrier corresponding to the model weights of each network layer, and a pre-trained steganographic model, and the second steganographic information is obtained by encoding processing the model structures corresponding to each network layer contained in the target model to obtain first data corresponding to the model structures of each network layer occupying a preset number of bit positions, and writing the first data into a preselected second steganographic carrier by an information steganographic manner. Based on a steganographic information extraction model and the first steganographic information provided by a server in advance, the model weights corresponding to each network layer contained in the target model are determined, and the second steganographic information is decoded to obtain the model structures corresponding to each network layer contained in the target model. The model weights are loaded into the corresponding model structures to obtain a reconstructed target model, and the target service processing is performed based on the reconstructed target model. BRIEF DESCRIPTION OF DRAWINGS

[0014] In order to more clearly illustrate the technical solutions in the embodiments of the present specification or the prior art, the drawings needed to be used in the embodiments or the prior art description will be briefly introduced. Obviously, the drawings in the following description are only some embodiments described in the present specification, and other drawings can be obtained by those skilled in the art without creative labor.

[0015] Figure 1 A model processing method embodiment of the present specification;

[0016] Figure 2 Another model processing method embodiment of the present specification;

[0017] Figure 3 Another model processing method embodiment of the present specification;

[0018] Figure 4 Another model processing method embodiment of the present specification;

[0019] Figure 5 A structural schematic diagram of a model processing system of the present specification;

[0020] Figure 6 This is a schematic diagram illustrating the processing procedure of one model in this specification;

[0021] Figure 7 This is a schematic diagram illustrating the processing procedure of another model in this specification;

[0022] Figure 8 This is an embodiment of a processing device for a model described in this specification;

[0023] Figure 9 This is another embodiment of the processing device for a different model in this specification;

[0024] Figure 10 This is an embodiment of a processing device for one model in this specification. Detailed Implementation

[0025] This specification provides a method, apparatus, and device for processing a model.

[0026] To enable those skilled in the art to better understand the technical solutions in this specification, the technical solutions in the embodiments of this specification will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of this specification, and not all embodiments. Based on the embodiments in this specification, all other embodiments obtained by those skilled in the art without creative effort should fall within the scope of protection of this specification.

[0027] Example 1

[0028] like Figure 1 As shown in the embodiments of this specification, a method for processing a model is provided. The execution subject of this method can be a server, which can be a single independent server or a server cluster composed of multiple servers. The server can be a backend server for financial or online shopping services, or a backend server for an application. Specifically, the method may include the following steps:

[0029] In step S102, the target model to be protected is obtained.

[0030] The target model can be any model. For example, the target model can be a model for facial recognition, or a model for risk identification of a certain business. In addition, the target model can be constructed by any algorithm. For example, the target model can be constructed by a neural network algorithm, or a multilayer perception algorithm, or a classification algorithm, a clustering algorithm, etc. The specific implementation can be determined according to actual conditions, and the embodiments of the present specification do not limit the target model. The target model can include a model structure and a model weight. The model structure can be the way in which various elements of the model itself are associated and interacted with each other in order to solve a certain problem. For example, the model structure can include the number ratio, arrangement order, combination mode, and changes caused by development of the constituent elements. In actual application, the model structure can often include multiple different network layers and the association relationship between the different network layers. For example, if the target model is a convolutional neural network model, the model structure can include an input layer, one or more convolutional layers, one or more pooling layers, and an output layer. In addition, the model structure can include the arrangement relationship between the multiple convolutional layers, the multiple pooling layers, and the convolutional layers and the pooling layers. The specific implementation can be determined according to actual conditions.

[0031] In implementation, in recent years, with the continuous development of terminal technology and network technology, artificial intelligence has become an important technical issue that needs to be researched and developed. In recent years, artificial intelligence has also been developed and applied. For example, various artificial intelligence algorithms are needed for applications such as facial recognition, automatic driving, and intelligent customer service. The core of the artificial intelligence algorithm is generally a deep learning model. Therefore, once the deep learning model is leaked, the entire artificial intelligence system will be at risk. For example, if a model for facial recognition is leaked, an attacker can steal other accounts and perform facial recognition, causing security risks. Therefore, desensitization and protection of the deep learning model have become an important issue.

[0032] The protection method for the model can be protected from two aspects of model structure and model weight. The model encryption method refers to encrypting the weight of the model. Only the corresponding decryption algorithm can analyze the model weight to crack the model, so that the attacker is difficult to obtain the model weight even if the model structure is obtained, thereby achieving the purpose of protecting the model. However, the current encryption method is relatively simple, and the attacker can crack it by spending a certain amount of time and computing power. On the other hand, the leakage of the model structure will also cause security risks. Therefore, the model structure can be protected by model confusion, that is, adjusting and / or adding or reducing the model structure, thereby greatly changing the model structure of the model, so that the attacker cannot crack the model even if the model weight is obtained. However, the model confusion method will bring a lot of extra useless calculation, making the model inefficient in application. Therefore, a model protection scheme with higher security and higher efficiency is needed. The embodiments of the present specification provide an implementable technical solution, which can specifically include the following contents:

[0033] When a certain model (i.e., a target model) needs to be protected, the target model can be obtained, and the target model can be analyzed. Through the analysis result, the type of the network layer contained in the target model, the number of network layers, the number of different types of network layers, the association relationship between different network layers, the model parameters of different network layers and the like can be determined, and the model structure of the target model can be determined based on the above information. In addition, the model weight of each network layer and the like can also be obtained.

[0034] For example, a face recognition model in a certain business needs to be protected. If the face recognition model is constructed based on a convolutional neural network model, it includes an input layer, three convolutional layers, three pooling layers and an output layer. The three convolutional layers and the three pooling layers are arranged alternately. The arrangement order of each network layer in the face recognition model is as follows: input layer-convolutional layer 1-pooling layer 1-convolutional layer 2-pooling layer 2-convolutional layer 3-pooling layer 3-output layer. The above face recognition model can be analyzed to obtain the number and type of the above network layers, as well as the arrangement order of different network layers and the like. The model structure can be constructed based on the above information. In addition, the model weight of each network layer such as the input layer, the convolutional layer, the pooling layer and the output layer can also be obtained.

[0035] In step S104, the model weight corresponding to each network layer contained in the target model is obtained, and the first steganographic carrier corresponding to the model weight of each network layer is obtained. Based on the first steganographic carrier and the model weight corresponding to each network layer, and the pre-trained steganographic model, the first steganographic information corresponding to the model weight of each network layer is determined. The first steganographic information is obtained by using the steganographic model to write the model weight into the first steganographic carrier in the information steganography manner.

[0036] The first steganographic carrier can be an image or other types of objects (such as a text file, page data of a certain web page, etc.), and the first steganographic carrier can be irrelevant to the data of the target model or can be relevant to the data of the target model in some scenarios. The steganographic model can be a model for writing one information into another information through information steganography. The steganographic model can be constructed through various algorithms, such as a neural network algorithm or a HUGO (Highly Undetectable stego) algorithm, and the specific algorithm can be set according to actual conditions.

[0037] In implementation, an initial architecture of the steganographic model can be constructed through a preset algorithm, and then the model weights of different models and the training samples composed of corresponding carriers can be obtained, and a corresponding loss function can be set. The obtained training samples and the loss function can be used to train the steganographic model to obtain a trained steganographic model, and the model weights can be written into the corresponding carriers through the trained steganographic model.

[0038] The model weights corresponding to each network layer in the target model can be obtained, and the first steganographic carrier corresponding to each network layer can be obtained. After the first steganographic carrier and the model weights corresponding to each network layer are obtained, the first steganographic carrier and the model weights corresponding to each network layer can be input into the trained steganographic model, and the model weights can be written into the first steganographic carrier through the steganographic model by using information steganography to obtain the first steganographic information corresponding to each network layer, so that the model weights corresponding to each network layer in the target model are processed for privacy protection, and the private information (i.e., the model weights) of the target model is written into the first steganographic carrier in a hidden manner. In actual application, the above processing process is only an optional manner, and various different processing manners can be included, which can be set according to actual conditions.

[0039] It should be noted that the first steganographic carrier can be selected from a specified database, and can also be a steganographic carrier generated by a pre-trained model matching the model weight, which can be used to generate a carrier for carrying the model weight of the target model written therein. The model can be constructed by various algorithms, such as a neural network algorithm, etc. The specific implementation can be set according to actual conditions, and the embodiments of the present specification do not limit this. In addition, the corresponding carrier can be obtained by inputting the model weight data into the above model, or the model weight can be converted into data of a specified type and a specified number of data bits, such as being structured and processed to reshape it into a tensor with a certain dimension, such as being reshaped into a 4-dimensional tensor or a 6-dimensional tensor, etc. For example, for a convolution layer with an input channel of 128 dimensions, an output channel of 256 dimensions, and a convolution kernel of 3*3, its parameters can be structured into a 256*3*3*128 tensor. For example, for a fully connected layer with an input channel of 128 dimensions and an output channel of 256 dimensions, it can be structured into a 256*1*1*128 tensor. Similarly, the model weight of other network layers can also be structured and processed in the above manner. The converted data can be input into the above model to obtain the corresponding carrier. The specific implementation can be set according to actual conditions, and the embodiments of the present specification do not limit this.

[0040] In step S106, the model structure corresponding to each network layer included in the target model is obtained, and the model structure corresponding to each network layer is encoded to obtain first data corresponding to the model structure of each network layer and occupying a preset number of bit positions. The first data is written into the second steganographic carrier selected in advance by information steganography to obtain second steganographic information corresponding to the model structure of each network layer.

[0041] The preset number of bit positions can be set according to actual conditions, such as 24 bit positions (i.e., 24 bit), 28 bit positions (i.e., 28 bit), etc. The second steganographic carrier can be an image or other forms of carriers other than images. The second steganographic carrier can be the same as the first steganographic carrier, or can be different from the first steganographic carrier. The specific implementation can be set according to actual conditions, and the embodiments of the present specification do not limit this.

[0042] In implementation, for the model structure, since the model structure is non-data type information, the model structure needs to be converted, that is, the model structure needs to be encoded, and the specific processing manner can be set according to actual conditions. For example, a model structure encoding rule can be set in advance, which can be, for example, converting each network layer in the target model into data with a certain number of bits (such as 20 bits or 26 bits of data, etc.). The data with a certain number of bits can be composed or spliced by a plurality of different bit data. For example, for a certain network layer in the target model, the model structure corresponding to the network layer can include type (such as input layer type, convolution layer type, pooling layer type, output layer type, etc.), relative position, related information of model parameters, etc. The above information can be encoded into a representation of data with a certain number of bits. For example, the network layer is a convolution layer, which can be represented by 4 bits. The type can be represented by 0000, the relative position can be represented by 8 bits, and the related information of the model parameters can be represented by 8 bits. The above data can be spliced to obtain 20-bit data, which can be used to represent the model structure corresponding to the network layer. Similarly, other network layers can also be encoded in the above manner to obtain first data corresponding to the model structure of each network layer occupying a preset number of bits.

[0043] The second steganographic carrier for steganography can be obtained, and then the first data can be written into the preselected second steganographic carrier in the manner of information steganography to obtain second steganographic information corresponding to the model structure of each network layer. The above manner of writing the first data into the preselected second steganographic carrier can be various, for example, a model for steganography can be pre-trained, and the first data can be written into the preselected second steganographic carrier in the manner of information steganography (or information hiding) based on the model. Alternatively, the first data can be dispersed in the data of the second steganographic carrier in the manner of information steganography, and finally the second steganographic information corresponding to the model structure of each network layer can be obtained.

[0044] In step S108, the first steganographic information corresponding to the model weight of each network layer and the second steganographic information corresponding to the model structure of each network layer are respectively set with corresponding retrieval information, and based on the pre-set steganographic information directory, the first steganographic information corresponding to the model weight of each network layer and the second steganographic information corresponding to the model structure of each network layer are stored.

[0045] In implementation, considering that the target model often includes multiple network layers, each network layer further includes model weights and model structures, in order to distinguish the data of the model weights and the model structures of different network layers, the first steganographic information corresponding to the model weights of each network layer can be respectively set with corresponding retrieval information for representing that the information belongs to the model weights, and the second steganographic information corresponding to the model structures of each network layer can be respectively set with corresponding retrieval information for representing that the information belongs to the model structures.

[0046] The storage directory of the first steganographic information and the second steganographic information, i.e., the steganographic information directory, can be set according to actual conditions, then the first steganographic information and the second steganographic information can be respectively stored in corresponding positions or regions based on the steganographic information directory, and finally the model structures and the model weights after privacy protection can be stored in designated positions or regions, so that the target model is effectively protected.

[0047] The embodiment of the present specification provides a model processing method, by acquiring the model weights corresponding to each network layer contained in the target model to be protected, and acquiring the first steganographic carrier corresponding to the model weights of each network layer, based on the first steganographic carrier, the model weights corresponding to each network layer, and a pre-trained steganographic model, the model weights are written into the first steganographic carrier by using the steganographic model in an information steganographic manner, the first steganographic information corresponding to the model weights of each network layer is determined, then the model structures corresponding to each network layer contained in the target model are acquired, and the model structures corresponding to each network layer are encoded to obtain the first data corresponding to the model structures of each network layer and occupying a preset number of bit positions, and the first data is written into a preselected second steganographic carrier in an information steganographic manner to obtain the second steganographic information corresponding to the model structures of each network layer, finally, the first steganographic information and the second steganographic information are respectively set with corresponding retrieval information, and based on a pre-set steganographic information directory, the first steganographic information and the second steganographic information are stored, in this way, in order to improve the accuracy of steganographic processing, the steganographic processing scheme for the target model is redesigned, and a hierarchical steganographic manner is proposed, i.e., the target model is steganographically processed according to network layers, in addition, the information of the steganographically processed model structures and model weights is randomly placed in each directory set in advance, reducing the model leakage risk caused by file structure, thereby solving the model privacy protection problem from two aspects of file structure and file format.

[0048] Embodiment two

[0049] As Figure 2As shown, the embodiment of the present specification provides a processing method of a model, the execution subject of the method can be a server, wherein the server can be an independent server, can also be a server cluster composed of multiple servers, etc., the server can be a background server of a financial service or a network shopping service, etc., can also be a background server of an application program, etc. The method can specifically include the following steps:

[0050] In step S202, a plurality of different preset models are obtained, and the model weight corresponding to each network layer contained in each preset model is obtained.

[0051] Among them, the preset model can be any model, for example, the preset model can be a model for facial recognition, can also be a model for risk identification of a certain service, etc., in addition, the preset model can be constructed by any algorithm, for example, the preset model can be constructed by a neural network algorithm, can also be constructed by a multilayer perceptron algorithm, can also be constructed by a classification algorithm, a clustering algorithm, etc., which can be set according to actual conditions, and the present specification does not limit this.

[0052] In step S204, a third steganographic carrier corresponding to the model weight of each network layer contained in the preset model is obtained, the third steganographic carrier and the model weight of each network layer contained in the preset model are taken as training samples, and the steganographic model and the steganographic information extraction model corresponding to the steganographic model are jointly trained based on the first loss function, to obtain the trained steganographic model, and the steganographic information extraction model is used to extract the model weight of the network layer contained in the preset model from the output information of the steganographic model.

[0053] The third steganographic carrier can be an image, and the steganographic carrier in this embodiment is taken as an example. For other types of carriers, refer to the following content and make appropriate processing according to actual conditions, which will not be repeated here. The steganographic model can be constructed based on various ways, for example, it can be constructed based on U-Net. The U-Net is constructed by a fully connected network, and the U-Net presents a structure similar to the letter “U”. It is composed of a left half of the compression channel (Contracting Path) and a right half of the expansion channel (Expansive Path). The compression channel can be constructed by a convolutional neural network, and the structure of 2 convolutional layers and 1 maximum pooling layer can be repeatedly used. After each pooling operation, the dimension of the data is increased. In the expansion channel, first, perform 1 deconvolution operation to reduce the dimension of the data by half, then splice the corresponding compression channel for cutting, and the corresponding feature data can be obtained. Based on the above feature data, new feature data is reconstituted, and 2 convolutional layers are used for feature extraction, and the above structure is repeated. In the last output layer, 2 convolutional layers are used to map the high-dimensional feature data to low-dimensional output data. The U-Net can be divided into two parts: up-sampling and down-sampling. The down-sampling part mainly uses continuous convolution pooling layers to extract feature information in the data and gradually maps the feature information to high dimensions. In the highest dimension of the entire network, there is rich feature information in the entire data. The U-Net can not need to directly pool the data and directly up-sample to the output data with the same size as the original data. Instead, through deconvolution processing, the high-dimensional features are mapped to low dimensions again. In the mapping process, in order to enhance the accuracy of segmentation, the same dimension data in the down-sampling network with the same dimension is fused. Since the dimension will become twice the original dimension in the fusion process, convolution processing is needed again to ensure that the dimension after processing is the same as the dimension before the fusion operation, so that after the deconvolution processing again, the data with the same dimension can be fused again, until the dimension of the output data is the same as the original data. The structure of the steganographic model in this embodiment can be composed of a certain number of network layers of U-Net, for example, it can be composed of a U-Net with 8 or 10 network layers, etc. The specific number can be set according to actual conditions. For another example, it can be constructed by a multi-layer perceptron (MLP). In the MLP, in addition to the input layer and the output layer, it can have multiple hidden layers. The simplest MLP contains only one hidden layer, i.e. a three-layer structure. The layers of the MLP are fully connected. The bottom layer of the MLP is the input layer, the middle is the hidden layer, and the last is the output layer. The steganographic model can be constructed by a three-layer MLP, and the specific number can be set according to actual conditions.The steganographic information extraction model can be constructed in various ways, for example, it can be constructed by a specified feature extraction algorithm, or it can be constructed based on a residual network ResNet, which is composed of a series of residual blocks, the residual blocks are divided into two parts, which are direct mapping part and residual part, ResNet can include multiple network layers, and the residual network including multiple network layers can also be represented as ResNet+network layer number, such as ResNet50, which is a residual network of 50 network layers, etc. The specific number of network layers can be set according to actual conditions.

[0054] In implementation, the carrier sample can be randomly selected, that is, the third steganographic carrier corresponding to the model weight of each network layer in the preset model can be randomly selected as the carrier sample, or the third steganographic carrier matching the model weight can also be generated through a pre-trained model. The model can be constructed by various algorithms, for example, it can be constructed by a neural network algorithm, or it can be constructed based on StyleGAN, etc. The "Style" in StyleGAN can refer to the main attributes of the data in the data set, such as the posture of the person and other information, rather than the image style in style conversion. For example, the face image, here Style can refer to the style of the face, including facial expressions, facial orientation, hairstyle, etc., and also including facial color, facial lighting, etc. on the texture details. StyleGAN can use style (i.e. style) to affect the posture and identity features of the face, and use noise to affect the hair, wrinkles, skin color, etc. Details, which can be set according to actual conditions, and the embodiments of the present specification do not limit this. In addition, the data of the model weight can be input into the above-mentioned model to obtain the corresponding third steganographic carrier, in addition, the model weight can also be data-converted to a specified type and a specified data bit number, such as structured processing of the model weight to reshape it into a tensor with a certain dimension, such as 4-dimensional tensor or 6-dimensional tensor, etc. For details, please refer to the foregoing related content. Similarly, the model weight of other network layers can also be structured processed in the above-mentioned manner, and the converted data can be input into the above-mentioned model to obtain the corresponding third steganographic carrier, which can be set according to actual conditions, and the embodiments of the present specification do not limit this.

[0055] The model weight of the network layer contained in the preset model can be extracted, and the corresponding third steganographic carrier can be set for the model weight of each network layer in the above manner. For the model weight of any network layer in the preset model, the model weight and the corresponding third steganographic carrier can be input into the steganographic model to obtain corresponding output information. The output information can be information obtained by writing the model weight into the corresponding third steganographic carrier in an information hiding manner (or information steganographic manner) through the steganographic model, and if the third steganographic carrier is an image, the output information is also an image. The above output information can be input into the steganographic information extraction model, and the model weight corresponding to the above network layer can be extracted from the output information of the steganographic model through the steganographic information extraction model. Then, based on the third steganographic carrier, the output information of the steganographic model, the model weight corresponding to the above network layer extracted from the output information of the steganographic model, and the model weight corresponding to the above network layer, a corresponding loss value can be calculated through the first loss function. The loss value can be used to determine whether the steganographic model and the steganographic information extraction model converge. If the steganographic model and the steganographic information extraction model do not converge, the model weight of another network layer of the preset model and the corresponding third steganographic carrier can be obtained to continue training the steganographic model and the steganographic information extraction model until the steganographic model and the steganographic information extraction model converge. Finally, the trained steganographic model and the trained steganographic information extraction model are obtained.

[0056] In actual applications, the first loss function can include multiple types. For example, the corresponding first loss function can be determined based on the input information and the output information of the steganographic model and the steganographic information extraction model. In this embodiment, another first loss function is provided, that is, the first loss function can be determined based on the maximum value of the similarity between the output information of the steganographic model and the third steganographic carrier, and the maximum value of the similarity between the model weight corresponding to each network layer contained in the preset model and the model weight corresponding to the network layer contained in the preset model extracted from the output information of the steganographic model. The similarity mentioned above can be determined by the Euclidean distance or the cosine distance, and can be set according to actual conditions. The embodiments of the present application do not limit this.

[0057] In step S206, a target model to be protected is obtained.

[0058] In step S208, the model weight corresponding to each network layer contained in the target model is obtained, and the first steganographic carrier corresponding to each network layer is obtained. The first steganographic carrier and the model weight corresponding to each network layer are input into the pre-trained steganographic model, and the model weight is written into the first steganographic carrier by using the steganographic model in an information steganographic manner to obtain the first steganographic information corresponding to the model weight of each network layer.

[0059] The first steganographic carrier can be an image.

[0060] In step S210, the type, network layer number and network layer parameter of each network layer are obtained respectively.

[0061] In implementation, in order to perform steganography on the information of the model structure, the {type of network layer, network layer number, network layer parameter} in the information of the model structure needs to be encoded into a model structure that can be represented by numbers, which can be seen from the following content.

[0062] In step S212, the type of each network layer is represented by 4-bit data, the network layer number of each network layer is represented by 8-bit data, and the network layer parameter of each network layer is represented by 12-bit data.

[0063] In implementation, 4 bits can be used to represent 16 types of network layers, for example, 0000 can be used to represent a convolution layer, and the specific rules can be set according to actual conditions. 8 bits can be used to represent, for example, 256 network layer numbers, for example, 00000001 represents the first network layer. 12 bits can be used to represent the network layer parameter.

[0064] In actual application, the network layer parameter can include multiple types, which can be set according to actual conditions. In this embodiment, an optional processing mode is provided, which can include the following content: the network layer parameter can include the pixels of the convolution kernel, stride and padding, and the above-mentioned processing of using 12-bit data to represent the network layer parameter of each network layer can be using 4-bit data to represent the convolution kernel of each network layer, using 4-bit data to represent the stride of each network layer, and using 4-bit data to represent the padding pixels of each network layer.

[0065] In step S214, the data corresponding to the type, network layer number and network layer parameter of each network layer is combined according to a preset combination rule to obtain first data corresponding to the model structure of each network layer and occupying a preset number of bits.

[0066] In implementation, after obtaining the data of the type, network layer number and network layer parameter of each network layer by the above-mentioned method, the above-mentioned data can be combined according to the specified combination rule, that is, by the above-mentioned method, 4+8+4+4+4=24-bit first data can be obtained, that is, 24-bit first data corresponding to the model structure of each network layer is obtained.

[0067] In step S216, the first data is added to the pixels of the second steganographic carrier occupying a preset number of bits to obtain second steganographic information corresponding to the model structure of each network layer.

[0068] The second steganographic carrier can be an image.

[0069] In implementation, based on the above content, the first data is 24-bit data, thus, 24-bit pixels (for example, the first 24-bit pixels in the second steganographic carrier) in the second steganographic carrier can be selected, and the first data can be set in the selected 24-bit pixels in the second steganographic carrier to obtain the second steganographic information corresponding to the model structure of each network layer.

[0070] In step S218, a random character sequence is generated according to the number of network layers contained in the target model, the number of characters contained in the random character sequence is determined by the number of network layers contained in the target model, and each character contained in the random character sequence represents a network layer in the target model.

[0071] The number of characters contained in the random character sequence can be the same as or different from the number of network layers contained in the target model, which can be set according to actual conditions, and the embodiments of the present specification do not limit this.

[0072] In implementation, the random character sequence can be generated by using a random tree generation method. For a target model with L network layers, L random characters can be generated, for example, for a target model with 6 network layers, a random character sequence {4, 3, 1, 6, 5, 2} can be generated, then, the tree can be generated according to the order of characters in the random character sequence, for example, for the random character sequence {4, 3, 1, 6, 5, 2}, the character 4 can be set as a root node, the characters 3 and 1 can be set as second layer child nodes, the characters 6 and 5 can be set as child nodes of the character 3, and the character 2 can be set as a child node of the character 1, thereby forming a tree-shaped random character sequence.

[0073] In step S220, a folder for storing information of each character in the random character sequence is set, the first steganographic information of the network layer corresponding to the character in the random character sequence, and the second steganographic information and the second steganographic carrier are stored in the folder set for the character, and the folder is set with an identifier based on the model structure and the model weight corresponding to the network layer.

[0074] In implementation, a folder for information storage can be generated according to the hierarchical structure corresponding to the random character sequence of the tree structure. For example, for the random character sequence {4, 3, 1, 6, 5, 2}, a random character sequence with a folder can be generated, specifically as {4: a, 3: b, 1: c, 6: d, 5: e, 2: f}, where a is the folder identifier of the root node, b is the folder identifier of the second layer child node 3, c is the folder identifier of the second layer child node 1, d is the folder identifier of the child node 6, e is the folder identifier of the child node 5, and f is the folder identifier of the child node 2. For the target model of 6 network layers and the random character sequence with a folder {4: a, 3: b, 1: c, 6: d, 5: e, 2: f}, the second steganographic information of the model structure steganography and the first steganographic information of the model weight steganography of the fourth network layer can be placed under the folder identified by a, and the file suffix name is used to mark whether the information stored in the folder is the model weight or the model structure. Other network layers can also be used in this way to record the sequence information under the root directory.

[0075] The embodiment of the present specification provides a model processing method. The model processing method comprises the following steps: obtaining each network layer corresponding model weight contained in a target model to be protected, and obtaining a first steganographic carrier corresponding to each network layer corresponding model weight; based on the first steganographic carrier and each network layer corresponding model weight, and a pre-trained steganographic model, using the steganographic model to write the model weight into the first steganographic carrier by information steganography, determining the first steganographic information corresponding to each network layer corresponding model weight; then, obtaining each network layer corresponding model structure contained in the target model, and performing encoding processing on each network layer corresponding model structure to obtain first data corresponding to each network layer corresponding model structure and occupying a preset number of bit positions, and writing the first data into a preselected second steganographic carrier by information steganography to obtain second steganographic information corresponding to each network layer corresponding model structure; finally, setting corresponding retrieval information for the first steganographic information and the second steganographic information, and storing the first steganographic information and the second steganographic information based on a pre-set steganographic information directory. In this way, in order to improve the accuracy of steganographic processing, the steganographic processing scheme for the target model is redesigned, and a hierarchical steganographic method is proposed, i.e., the target model is steganographically processed according to the network layers. In addition, the information of the steganographically processed model structure and model weight is randomly placed in the pre-set directories, reducing the model leakage risk caused by the file structure, thereby solving the model privacy protection problem from two aspects of file structure and file format.

[0076] Embodiment three

[0077] As Figure 3As shown, the embodiment of the present specification provides a processing method of a model, the execution subject of the method can be a server, wherein the server can be an independent server, or a server cluster composed of multiple servers, etc., the server can be a background server of a financial service or a network shopping service, etc., or a background server of an application program, etc. The method can specifically include the following steps:

[0078] In step S302, a plurality of different preset models are obtained, and the model weight corresponding to each network layer contained in each preset model is obtained, and a fourth steganographic carrier corresponding to the model weight of each network layer contained in the preset model is obtained.

[0079] Among them, the fourth steganographic carrier can be an image.

[0080] In step S304, the fourth steganographic carrier and the model weight corresponding to each network layer contained in the preset model are respectively input into the first steganographic sub-model, and a first sub-steganographic sample is obtained.

[0081] Among them, the first steganographic sub-model can be constructed based on a plurality of different ways, for example, it can be constructed based on U-Net, which is constructed by a fully connected network, and for another example, it can be constructed by a multi-layer perception MLP, which can be set according to actual conditions.

[0082] In implementation, for any network layer in the preset model, the processing of steps S304-S316 can be performed, specifically, the fourth steganographic carrier and the model weight corresponding to the network layer in the preset model are respectively input into the first steganographic sub-model, and the model weight corresponding to the network layer in the preset model is written into the fourth steganographic carrier by the first steganographic sub-model based on the information steganography (or information hiding) method, to obtain the first sub-steganographic sample.

[0083] In step S306, the first sub-steganographic sample is input into the first steganographic information extraction sub-model, and the fourth sub-model weight extracted from the first sub-steganographic sample is obtained.

[0084] Among them, the first steganographic information extraction sub-model can be constructed based on a plurality of different ways, for example, it can be constructed by a certain specified feature extraction algorithm, or it can be constructed based on a residual network ResNet, which is composed of a series of residual blocks, the residual blocks are divided into two parts, which are direct mapping part and residual part, ResNet can include multiple network layers, and the residual network including multiple network layers can also be represented as ResNet+network layer number, such as ResNet50, which is a residual network of 50 network layers, etc., which can be set according to actual conditions.

[0085] In implementation, the first sub-steganographic sample can be input into the first steganographic information extraction sub-model, and the fourth sub-model weight extracted from the first sub-steganographic sample by the first steganographic information extraction sub-model is used to obtain the output information.

[0086] In step S308, the difference between the model weight corresponding to the network layer contained in the preset model and the fourth sub-model weight is taken as the first residual sample, and the fourth steganographic carrier and the first residual sample are input into the second steganographic sub-model to obtain the second sub-steganographic sample.

[0087] The second steganographic sub-model can be constructed in various ways, for example, it can be constructed based on a U-Net constructed by a fully connected network, and for another example, it can be constructed by a multi-layer perceptron (MLP). The specific construction can be set according to actual conditions.

[0088] In implementation, the difference between the original model weight corresponding to the network layer contained in the preset model and the fourth sub-model weight can be taken as the first residual sample, and then the fourth steganographic carrier and the first residual sample can be input into the second steganographic sub-model to write the first residual sample into the fourth steganographic carrier based on the information steganography (or information hiding) to obtain the second sub-steganographic sample.

[0089] In step S310, the second sub-steganographic sample is input into the second steganographic information extraction sub-model to obtain the fifth sub-model weight extracted from the second sub-steganographic sample.

[0090] The second steganographic information extraction sub-model can be constructed in various ways, for example, it can be constructed by a specified feature extraction algorithm, or it can be constructed based on a residual network (ResNet) composed of a series of residual blocks. The residual block is divided into two parts, namely a direct mapping part and a residual part. The ResNet can include multiple network layers. The residual network including multiple network layers can also be represented as ResNet+number of network layers, such as ResNet50, which is a residual network of 50 network layers. The specific construction can be set according to actual conditions.

[0091] In step S312, the difference between the first residual sample and the fifth sub-model weight is taken as the second residual sample, and the fourth steganographic carrier and the second residual sample are input into the third steganographic sub-model to obtain the third sub-steganographic sample.

[0092] The third steganographic sub-model can be constructed in various ways, for example, it can be constructed based on a U-Net constructed by a fully connected network, and for another example, it can be constructed by a multi-layer perceptron (MLP). The specific construction can be set according to actual conditions.

[0093] In step S314, the third sub-steganographic sample is input into the third steganographic information extraction sub-model to obtain the sixth sub-model weight extracted from the third sub-steganographic sample.

[0094] The third steganographic information extraction sub-model can be constructed in various ways, for example, it can be constructed by a specified feature extraction algorithm, or it can be constructed based on a residual network ResNet, which is composed of a series of residual blocks, the residual blocks are divided into two parts, which are direct mapping part and residual part, the ResNet can include multiple network layers, and the residual network including multiple network layers can also be represented as ResNet+network layer number, such as ResNet50, which is a residual network of 50 network layers, etc. The specific setting can be based on actual conditions.

[0095] In step S316, based on the fourth sub-model weight, the fifth sub-model weight and the sixth sub-model weight, and the model weight corresponding to each network layer contained in the preset model, whether the first steganographic sub-model, the first steganographic information extraction sub-model, the second steganographic sub-model, the second steganographic information extraction sub-model, the third steganographic sub-model and the third steganographic information extraction sub-model are converged is determined by the second loss function, if not, the joint training of the above sub-models is continued based on the fourth steganographic carrier and the model weight corresponding to each network layer contained in the preset model until the above sub-models are converged.

[0096] The second loss function can be various, for example, it can be determined based on the input information and the output information of each sub-model, etc. An optional second loss function is provided in the embodiments of the present specification, which can specifically include: the second loss function can be determined based on the maximum value of the similarity between the output information of the first steganographic sub-model and the fourth steganographic carrier, the maximum value of the similarity between the output information of the second steganographic sub-model and the fourth steganographic carrier, the maximum value of the similarity between the output information of the third steganographic sub-model and the fourth steganographic carrier, and the maximum value of the similarity between the model weight corresponding to each network layer contained in the preset model and the sum of the output information of the first steganographic information extraction sub-model, the output information of the second steganographic information extraction sub-model and the output information of the third steganographic information extraction sub-model.

[0097] In step S318, a target model to be protected is obtained.

[0098] In step S320, the first steganographic carrier and the model weight corresponding to each network layer are input into the pre-trained first steganographic sub-model, and the model weight corresponding to each network layer contained in the target model is written into the first steganographic carrier by the first steganographic sub-model using information steganography to obtain the first sub-steganographic information.

[0099] The first steganographic carrier can be an image.

[0100] In step S322, the model weight corresponding to each network layer contained in the target model is obtained, and the first steganographic carrier corresponding to the model weight of each network layer is obtained.

[0101] In step S324, based on the first steganographic carrier and the model weight corresponding to each network layer, and the pre-trained steganographic model, the first steganographic information corresponding to the model weight of each network layer is determined, and the first steganographic information is obtained by using the steganographic model to write the model weight into the first steganographic carrier in the information steganography manner.

[0102] In step S326, the first sub-steganographic information is input into the first steganographic information extraction sub-model corresponding to the first steganographic sub-model, and the first sub-model weight extracted from the first sub-steganographic information is obtained.

[0103] In step S328, the difference between the model weight and the first sub-model weight is taken as the first residual, and the first steganographic carrier and the first residual are input into the second steganographic sub-model, and the first residual is written into the first steganographic carrier by the second steganographic sub-model in the information steganography manner, to obtain the second sub-steganographic information.

[0104] In step S330, the second sub-steganographic information is input into the second steganographic information extraction sub-model corresponding to the second steganographic sub-model, and the second sub-model weight extracted from the second sub-steganographic information is obtained.

[0105] In step S332, the difference between the first residual and the second sub-model weight is taken as the second residual, and the first steganographic carrier and the second residual are input into the third steganographic sub-model, and the second residual is written into the first steganographic carrier by the third steganographic sub-model in the information steganography manner, to obtain the third sub-steganographic information.

[0106] In step S334, based on the first sub-steganographic information, the second sub-steganographic information and the third sub-steganographic information, the first steganographic information corresponding to the model weight of each network layer is determined.

[0107] In step S336, the type, network layer number and network layer parameter of each network layer are obtained respectively.

[0108] In step S338, 4-bit data is used to represent the type of each network layer, 8-bit data is used to represent the network layer number of each network layer, and 12-bit data is used to represent the network layer parameter of each network layer.

[0109] The network layer parameters can include convolution kernels, strides and padding pixels, and 12 bits of data are used to represent the network layer parameters of each network layer, that is, 4 bits of data are used to represent the convolution kernel of each network layer, 4 bits of data are used to represent the stride of each network layer, and 4 bits of data are used to represent the padding pixels of each network layer.

[0110] In step S340, the type of each network layer, the network layer number and the data corresponding to the network layer parameters are combined using a preset combination rule to obtain first data corresponding to the model structure of each network layer and occupying a preset number of bits.

[0111] In step S342, the first data is added to the second steganographic carrier to occupy a pixel of a preset number of bits in the consecutive pixels, and second steganographic information corresponding to the model structure of each network layer is obtained.

[0112] The second steganographic carrier can be an image.

[0113] In step S344, a random character sequence is generated according to the number of network layers contained in the target model, the number of characters contained in the random character sequence is determined by the number of network layers contained in the target model, and each character in the random character sequence represents a network layer in the target model.

[0114] In step S346, a folder for storing information is set for each character in the random character sequence, and the first steganographic information of the network layer corresponding to the character in the random character sequence, and the second steganographic information and the second steganographic carrier are stored in the folder set for the character, and the folder is identified based on the model structure and the model weight of the network layer corresponding to the above network layer.

[0115] The embodiment of the present specification provides a model processing method, by obtaining the model weight corresponding to each network layer contained in the target model to be protected, and obtaining the first steganographic carrier corresponding to the model weight of each network layer, based on the first steganographic carrier and the model weight corresponding to each network layer, and the pre-trained steganographic model, the model weight is written into the first steganographic carrier by using the steganographic model in the form of information steganography, the first steganographic information corresponding to the model weight of each network layer is determined, then the model structure corresponding to each network layer contained in the target model is obtained, and the model structure corresponding to each network layer is encoded to obtain the first data corresponding to the model structure of each network layer, which occupies a preset number of bit positions, and the first data is written into the second steganographic carrier selected in advance in the form of information steganography, to obtain the second steganographic information corresponding to the model structure of each network layer, finally, the corresponding retrieval information is set for the first steganographic information and the second steganographic information, and based on the pre-set steganographic information directory, the first steganographic information and the second steganographic information are stored, in this way, in order to improve the accuracy of steganographic processing, the steganographic processing scheme for the target model is redesigned, and a hierarchical steganographic method is proposed, that is, the target model is steganographically processed according to the network layer, in addition, the information of the steganographically processed model structure and model weight is randomly placed in each directory set in advance, reducing the model leakage risk caused by the file structure, thereby solving the model privacy protection problem from the aspects of file structure and file format.

[0116] Embodiment four

[0117] As shown in Figure 4 The embodiment of the present specification provides a model processing method, which can be executed by a target device, wherein the target device can be a terminal device or a server, etc., the terminal device can be a certain terminal device such as a mobile phone, a tablet computer, etc., and can also be a computer device such as a notebook computer or a desktop computer, or can also be an IoT device (such as a smart watch, a vehicle-mounted device, etc.) and the like. The server can be an independent server, or a server cluster composed of multiple servers, etc., which can be a background server of a financial service or an online shopping service, or a background server of an application program, etc. The system architecture thereof can be as shown in Figure 5 The method can specifically include the following steps:

[0118] In step S402, a reconstruction request for the target model is obtained.

[0119] The reconstruction request can include the identification of the target model, the identification of the model structure contained in the target model, the identification of the model weight contained in the target model, etc., which can be set according to actual conditions.

[0120] In step S404, based on the preset steganographic information directory and the retrieval information of the model structure and the model weight corresponding to each network layer contained in the target model, the first steganographic information and the second steganographic information corresponding to the target model are obtained. The first steganographic information is the steganographic information corresponding to the model weight of each network layer determined based on the obtained model weight of each network layer contained in the target model, the obtained first steganographic carrier corresponding to the model weight of each network layer, and the pre-trained steganographic model. The second steganographic information is obtained by encoding the model structure of each network layer contained in the target model to obtain the first data corresponding to the model structure of each network layer occupying a preset number of bit positions, and then writing the first data into the second steganographic carrier selected in advance by using the information steganography to obtain the steganographic information.

[0121] In implementation, the first steganographic information and the second steganographic information corresponding to the target model can be obtained from the stored information (information stored from a server or a designated storage device) by combining the preset steganographic information directory and the retrieval information of the model structure and the model weight corresponding to each network layer contained in the target model.

[0122] In step S406, based on the steganographic information extraction model provided by the server and the first steganographic information, the model weight corresponding to each network layer contained in the target model is determined, and the second steganographic information is decoded to obtain the model structure corresponding to each network layer contained in the target model.

[0123] In implementation, the first steganographic information can be input into the steganographic information extraction model, and the model weight corresponding to each network layer contained in the target model can be extracted from the first steganographic information by using the steganographic information extraction model. In addition, the corresponding decoding rule can be set based on the encoding rule of the model structure, and the second steganographic information can be decoded by using the decoding rule to obtain the model structure corresponding to each network layer contained in the target model.

[0124] In step S408, the model weight is loaded into the corresponding model structure to obtain the reconstructed target model, and the service processing of the target service is performed based on the reconstructed target model.

[0125] The specific processing process of steps S402 to S408 can be referred to the related content described above, and will not be repeated here.

[0126] The embodiment of the present specification provides a model processing method, by obtaining the model weight corresponding to each network layer contained in the target model to be protected, and obtaining the first steganographic carrier corresponding to the model weight of each network layer, based on the first steganographic carrier and the model weight corresponding to each network layer, and the pre-trained steganographic model, the model weight is written into the first steganographic carrier by using the steganographic model in the form of information steganography, the first steganographic information corresponding to the model weight of each network layer is determined, then the model structure corresponding to each network layer contained in the target model is obtained, and the model structure corresponding to each network layer is encoded to obtain the first data corresponding to the model structure of each network layer, which occupies a preset number of bit positions, and the first data is written into the second steganographic carrier selected in advance in the form of information steganography, to obtain the second steganographic information corresponding to the model structure of each network layer, finally, the corresponding retrieval information is set for the first steganographic information and the second steganographic information, and based on the pre-set steganographic information directory, the first steganographic information and the second steganographic information are stored, and then when the model reconstruction is performed, the model structure and the model weight can be extracted based on the decoding mode and the steganographic information extraction model, in this way, in order to improve the accuracy of steganographic processing, the steganographic processing scheme for the target model is redesigned, and a hierarchical steganographic mode is proposed, that is, the target model is steganographically processed according to the network layer, in addition, the information steganographically processed with the model structure and the model weight is randomly placed in each directory set in advance, reducing the model leakage risk caused by the file structure, thereby solving the model privacy protection problem from the aspects of file structure and file format.

[0127] Embodiment five

[0128] As shown in the Figure 6 , the embodiment of the present application provides a model processing method, the execution subject of the method can be a target device, wherein the target device can be a terminal device or a server, etc., the terminal device can be a certain terminal device such as a mobile phone, a tablet computer, etc., it can also be a computer device such as a notebook computer or a desktop computer, or it can also be an IoT device (such as a smart watch, a vehicle-mounted device, etc.) and the like. The server can be an independent server, or it can also be a server cluster composed of multiple servers, etc., the server can be a background server of a financial service or a network shopping service, etc., or it can also be a background server of an application program, etc. Its system architecture can be as shown in Figure 5 , the method can specifically include the following steps:

[0129] In step S602, the trained steganographic information extraction model sent by the server is received.

[0130] In step S604, a reconstruction request for the target model is obtained.

[0131] In step S606, a random character sequence corresponding to the network layer of the target model under the preset root directory is read.

[0132] In step S608, based on the characters contained in the random character sequence and the information of the folder corresponding to each character, the first steganographic information and the second steganographic information corresponding to the target model are obtained from the folder. The first steganographic information is the steganographic information corresponding to each network layer based on the obtained model weight of each network layer contained in the target model, the first steganographic carrier corresponding to the obtained model weight of each network layer, and the steganographic model trained in advance. The second steganographic information is obtained by encoding and processing the model structure corresponding to each network layer contained in the target model to obtain the first data corresponding to the model structure of each network layer occupying a preset number of bit positions, and then writing the first data into the second steganographic carrier selected in advance by means of information steganography.

[0133] In implementation, for the model structure, the random character sequence corresponding to the network layer of the target model under the preset root directory can be read, the directory of the model structure of the corresponding network layer can be read according to the random character sequence information, the second steganographic information can be found in the corresponding directory, and in addition, the second steganographic carrier can be obtained. For the model weight, the random character sequence corresponding to the network layer of the target model under the preset root directory can be read, the directory of the model structure of the corresponding network layer can be read according to the random character sequence information, and the first steganographic information can be found in the corresponding directory.

[0134] In step S610, based on the steganographic information extraction model provided by the server in advance and the first steganographic information, the model weight corresponding to each network layer contained in the target model is determined.

[0135] In step S612, the second steganographic carrier is obtained, and the second steganographic carrier is an image.

[0136] In step S614, the pixel information corresponding to the second steganographic information is subtracted from the pixel information corresponding to the second steganographic carrier, and the model structure corresponding to each network layer contained in the target model is obtained.

[0137] In step S616, the model weight is loaded into the corresponding model structure to obtain the reconstructed target model, and the target service processing is performed based on the reconstructed target model.

[0138] The specific processing process of steps S602-S616 can be referred to the above related content, which will not be repeated here.

[0139] The embodiment of the specification provides a model processing method, by acquiring the model weight corresponding to each network layer contained in the target model to be protected, acquiring the first steganographic carrier corresponding to the model weight of each network layer, based on the first steganographic carrier and the model weight corresponding to each network layer, and the pre-trained steganographic model, using the steganographic model to write the model weight into the first steganographic carrier in the form of information steganography, determining the first steganographic information corresponding to the model weight corresponding to each network layer, then acquiring the model structure corresponding to each network layer contained in the target model, and performing encoding processing on the model structure corresponding to each network layer to obtain the first data corresponding to the model structure corresponding to each network layer, which occupies a preset number of bit positions, and writing the first data into the second steganographic carrier selected in advance in the form of information steganography to obtain the second steganographic information corresponding to the model structure corresponding to each network layer, finally, setting the corresponding retrieval information for the first steganographic information and the second steganographic information, and storing the first steganographic information and the second steganographic information based on the pre-set steganographic information directory, and then the model structure and the model weight can be extracted based on the decoding mode and the steganographic information extraction model when the model is reconstructed, so as to improve the accuracy of steganographic processing, redesign the steganographic processing scheme for the target model, and propose a hierarchical steganographic mode, that is, the target model is steganographically processed according to the network layer, and in addition, the information of the steganographically processed model structure and model weight is randomly placed in each directory set in advance, reducing the model leakage risk caused by the file structure, thereby solving the model privacy protection problem from the aspects of file structure and file format.

[0140] Embodiment six

[0141] As Figure 7 indicated, the embodiment of the present application provides a model processing method, and the execution subject of the method can be a target device, wherein the target device can be a terminal device or a server, etc., the terminal device can be a certain terminal device such as a mobile phone, a tablet computer, etc., and can also be a computer device such as a notebook computer or a desktop computer, or can also be an IoT device (such as a smart watch, a vehicle-mounted device, etc.) and the like. The server can be an independent server, or can also be a server cluster composed of multiple servers, etc., and the server can be a background server of a financial service or a network shopping service, or can also be a background server of an application program, etc. The system architecture thereof can be as shown in Figure 5 indicated, and the method can specifically include the following steps:

[0142] In step S702, the receiving server sends the trained steganographic information extraction model, which includes a first steganographic information extraction sub-model, a second steganographic information extraction sub-model, and a third steganographic information extraction sub-model. The first steganographic information includes a first sub-steganographic information, a second sub-steganographic information, and a third sub-steganographic information. The first sub-steganographic information is obtained by inputting the first steganographic carrier and the model weight corresponding to each network layer into the pre-trained first steganographic sub-model. The second sub-steganographic information is obtained by inputting the difference between the model weight and the first sub-model weight as a first residual, and inputting the first steganographic carrier and the first residual into the second steganographic sub-model. The first sub-model weight is extracted from the first sub-steganographic information. The third sub-steganographic information is obtained by inputting the difference between the first residual and the second sub-model weight as a second residual, and inputting the first steganographic carrier and the second residual into the third steganographic sub-model. The second sub-model weight is extracted from the second sub-steganographic information.

[0143] In step S704, a reconstruction request for the target model is obtained.

[0144] In step S706, the network layer corresponding to the target model under the preset root directory is read.

[0145] In step S708, based on the characters contained in the random character sequence and the information of the folder corresponding to each character, the first steganographic information and the second steganographic information corresponding to the target model are obtained from the folder. The first steganographic information is determined based on the obtained model weight corresponding to each network layer in the target model, the first steganographic carrier corresponding to each network layer, and the pre-trained steganographic model. The second steganographic information is obtained by encoding the model structure corresponding to each network layer in the target model to obtain first data occupying a preset number of bits corresponding to the model structure of each network layer, and writing the first data into the pre-selected second steganographic carrier by information steganography.

[0146] In step S710, the first steganographic information is input into the first steganographic information extraction sub-model to obtain the first sub-model weight extracted from the first sub-steganographic information.

[0147] In step S712, the second steganographic information is input into the second steganographic information extraction sub-model to obtain the second sub-model weight extracted from the second sub-steganographic information.

[0148] In step S714, the third steganographic information is input into the third steganographic information extraction sub-model to obtain the third sub-model weight extracted from the third sub-steganographic information.

[0149] In step S716, based on the first sub-model weight, the second sub-model weight and the third sub-model weight, a model weight corresponding to each network layer contained in the target model is determined.

[0150] In step S718, a second steganographic carrier is obtained, and the second steganographic carrier is an image.

[0151] In step S720, pixel information corresponding to the second steganographic information is subtracted from pixel information corresponding to the second steganographic carrier, to obtain a model structure corresponding to each network layer contained in the target model.

[0152] In implementation, 24-bit pixels of the second steganographic information (such as the first 24-bit pixels of the second steganographic information, etc.) can be subtracted from 24-bit pixels of the second steganographic carrier, to obtain 24-bit information, the 24-bit information is parsed to corresponding network layer parameters according to the above-mentioned encoding rule, and the network layer is randomly initialized.

[0153] In step S722, the model weight is loaded into the corresponding model structure, to obtain a reconstructed target model, and service processing of the target service is performed based on the reconstructed target model.

[0154] The specific processing procedure of steps S702-S722 can be referred to the above-mentioned related content, and will not be described herein.

[0155] The embodiment of the present specification provides a model processing method, by obtaining the model weight corresponding to each network layer contained in the target model to be protected, and obtaining the first steganographic carrier corresponding to the model weight of each network layer, based on the first steganographic carrier and the model weight corresponding to each network layer, and the pre-trained steganographic model, using the steganographic model to write the model weight into the first steganographic carrier in the form of information steganography, determining the first steganographic information corresponding to the model weight corresponding to each network layer, then obtaining the model structure corresponding to each network layer contained in the target model, and performing encoding processing on the model structure corresponding to each network layer, obtaining the first data corresponding to the model structure corresponding to each network layer, which occupies a preset number of bit positions, and writing the first data into the second steganographic carrier selected in advance in the form of information steganography, obtaining the second steganographic information corresponding to the model structure corresponding to each network layer, finally, setting the corresponding retrieval information for the first steganographic information and the second steganographic information, and storing the first steganographic information and the second steganographic information based on the pre-set steganographic information directory, and then the model structure and the model weight can be extracted based on the decoding mode and the steganographic information extraction model when the model is reconstructed, so as to improve the accuracy of steganographic processing, redesign the steganographic processing scheme for the target model, and propose a hierarchical steganographic mode, that is, the target model is steganographically processed according to the network layer, and the information steganographically processed model structure and model weight is randomly placed in each directory set in advance, reducing the model leakage risk caused by the file structure, thereby solving the model privacy protection problem from the aspects of file structure and file format.

[0156] Embodiment seven

[0157] Based on the same idea, the embodiment of the present specification also provides a model processing device, as shown in Figure 8 .

[0158] The model processing device comprises a model acquisition module 801, a weight steganographic module 802, a structure steganographic module 803, and a storage module 804, wherein:

[0159] The model acquisition module 801 acquires the target model to be protected;

[0160] The weight steganographic module 802 acquires the model weight corresponding to each network layer contained in the target model, and acquires the first steganographic carrier corresponding to the model weight of each network layer, determines the first steganographic information corresponding to the model weight corresponding to each network layer based on the first steganographic carrier and the model weight corresponding to each network layer, and the pre-trained steganographic model, the first steganographic information is obtained by using the steganographic model to write the model weight into the first steganographic carrier in the form of information steganography;

[0161] The structural steganography module 803 acquires the model structure corresponding to each network layer contained in the target model, and encodes each model structure corresponding to each network layer to obtain first data occupying a preset number of bit positions corresponding to the model structure of each network layer, and writes the first data into a second steganography carrier selected in advance by means of information steganography to obtain second steganography information corresponding to the model structure of each network layer.

[0162] The storage module 804 sets corresponding retrieval information for the first steganography information corresponding to the model weight of each network layer and the second steganography information corresponding to the model structure of each network layer, and stores the first steganography information corresponding to the model weight of each network layer and the second steganography information corresponding to the model structure of each network layer based on a preset steganography information directory.

[0163] In the embodiments of the present specification, the device further comprises:

[0164] The first sample acquisition module acquires a plurality of different preset models, and acquires the model weight corresponding to each network layer contained in each preset model.

[0165] The first model training module acquires a third steganography carrier corresponding to the model weight of each network layer contained in the preset model, takes the third steganography carrier and the model weight of each network layer contained in the preset model as training samples, and jointly trains the steganography model and a steganography information extraction model based on the first loss function, to obtain a trained steganography model, wherein the steganography information extraction model is used to extract the model weight of the network layer contained in the preset model from the output information of the steganography model.

[0166] In the embodiments of the present specification, the first loss function is determined based on the maximum value of the similarity between the output information of the steganography model and the third steganography carrier, and the maximum value of the similarity between the model weight of each network layer contained in the preset model and the model weight of the network layer contained in the preset model extracted from the output information of the steganography model.

[0167] In the embodiments of the present specification, the steganography model comprises a first steganography sub-model, a second steganography sub-model and a third steganography sub-model, the first steganography information comprises first sub-steganography information, second sub-steganography information and third sub-steganography information,

[0168] The weight steganography module 802 comprises:

[0169] a first steganography unit, inputting the first steganography carrier and the model weight corresponding to each network layer into a pre-trained first steganography sub-model respectively, writing the model weight corresponding to each network layer contained in the target model into the first steganography carrier by using information steganography in the first steganography sub-model, and obtaining the first sub-steganography information;

[0170] a first extraction module, inputting the first sub-steganography information into a first steganography information extraction sub-model corresponding to the first steganography sub-model, and obtaining the first sub-model weight extracted from the first sub-steganography information;

[0171] a second steganography unit, taking a difference between the model weight and the first sub-model weight as a first residual, inputting the first steganography carrier and the first residual into the second steganography sub-model, writing the first residual into the first steganography carrier by using information steganography in the second steganography sub-model, and obtaining the second sub-steganography information;

[0172] a second steganography unit, inputting the second sub-steganography information into a second steganography information extraction sub-model corresponding to the second steganography sub-model, and obtaining the second sub-model weight extracted from the second sub-steganography information;

[0173] a third steganography unit, taking a difference between the first residual and the second sub-model weight as a second residual, inputting the first steganography carrier and the second residual into the third steganography sub-model, writing the second residual into the first steganography carrier by using information steganography in the third steganography sub-model, and obtaining the third sub-steganography information;

[0174] a weight steganography unit, determining the first steganography information corresponding to the model weight of each network layer based on the first sub-steganography information, the second sub-steganography information and the third sub-steganography information.

[0175] In the embodiments of the present specification, the device further comprises:

[0176] a second sample acquisition module, acquiring a plurality of different preset models, and acquiring the model weight corresponding to each network layer contained in each preset model, and acquiring a fourth steganography carrier corresponding to the model weight corresponding to each network layer contained in the preset model;

[0177] a first steganography module, inputting the fourth steganography carrier and the model weight corresponding to each network layer contained in the preset model into the first steganography sub-model respectively, and obtaining the first sub-steganography sample;

[0178] The first extraction module inputs the first sub-steganographic sample into the first steganographic information extraction sub-model to obtain fourth sub-model weights extracted from the first sub-steganographic sample.

[0179] The second steganographic module takes a difference between the model weights corresponding to the network layers contained in the preset model and the fourth sub-model weights as a first residual sample, and inputs the fourth steganographic carrier and the first residual sample into the second steganographic sub-model to obtain the second sub-steganographic sample.

[0180] The second extraction module inputs the second sub-steganographic sample into the second steganographic information extraction sub-model to obtain fifth sub-model weights extracted from the second sub-steganographic sample.

[0181] The third steganographic module takes a difference between the first residual sample and the fifth sub-model weights as a second residual sample, and inputs the fourth steganographic carrier and the second residual sample into the third steganographic sub-model to obtain the third sub-steganographic sample.

[0182] The third extraction module inputs the third sub-steganographic sample into the third steganographic information extraction sub-model to obtain sixth sub-model weights extracted from the third sub-steganographic sample.

[0183] The second training module determines, based on the fourth sub-model weights, the fifth sub-model weights, the sixth sub-model weights, and the model weights corresponding to each network layer contained in the preset model, whether the first steganographic sub-model, the first steganographic information extraction sub-model, the second steganographic sub-model, the second steganographic information extraction sub-model, the third steganographic sub-model, and the third steganographic information extraction sub-model converge or not, and if not, continues to jointly train the sub-models based on the fourth steganographic carrier and the model weights corresponding to each network layer contained in the preset model until the sub-models converge.

[0184] In the embodiments of the present specification, the second loss function is determined based on a maximum value of similarity between the output information of the first steganographic sub-model and the fourth steganographic carrier, a maximum value of similarity between the output information of the second steganographic sub-model and the fourth steganographic carrier, a maximum value of similarity between the output information of the third steganographic sub-model and the fourth steganographic carrier, and a maximum value of similarity between the model weights corresponding to each network layer contained in the preset model and a sum of the output information of the first steganographic information extraction sub-model, the output information of the second steganographic information extraction sub-model, and the output information of the third steganographic information extraction sub-model.

[0185] In the embodiments of the present specification, the structural steganographic module 803 comprises:

[0186] an information acquisition unit, configured to acquire the type, the network layer number and the network layer parameter of each network layer respectively;

[0187] an encoding unit, configured to use 4 bits of data to represent the type of each network layer, use 8 bits of data to represent the network layer number of each network layer, and use 12 bits of data to represent the network layer parameter of each network layer;

[0188] a data combination unit, configured to combine the data corresponding to the type, the network layer number and the network layer parameter of each network layer using a preset combination rule to obtain first data corresponding to the model structure of each network layer and occupying a preset number of bits;

[0189] the structure steganography module 803, configured to add the first data into the second steganography carrier to occupy the preset number of bits of pixels in the continuous pixels to obtain second steganography information corresponding to the model structure of each network layer.

[0190] In the embodiments of the present specification, the network layer parameter includes the convolution kernel, the stride and the padding pixel, and the encoding unit uses 4 bits of data to represent the convolution kernel of each network layer, uses 4 bits of data to represent the stride of each network layer, and uses 4 bits of data to represent the padding pixel of each network layer.

[0191] In the embodiments of the present specification, the storage module 804 includes:

[0192] a sequence generation unit, configured to generate a random character sequence according to the number of network layers contained in the target model, the number of characters contained in the random character sequence being determined by the number of network layers contained in the target model, and each character in the random character sequence representing one network layer in the target model;

[0193] a storage unit, configured to set a folder for information storage for each character in the random character sequence, and store the first steganography information of the network layer corresponding to the character in the random character sequence, the second steganography information and the second steganography carrier into the folder set for the character, and set an identifier for the folder based on the model structure and the model weight corresponding to the network layer.

[0194] In the embodiments of the present specification, the first steganography carrier and the second steganography carrier are images.

[0195] The embodiment of the present specification provides a model processing device, by acquiring the model weight corresponding to each network layer contained in the target model to be protected, and acquiring the first steganographic carrier corresponding to the model weight of each network layer, based on the first steganographic carrier and the model weight corresponding to each network layer, and the pre-trained steganographic model, the model weight is written into the first steganographic carrier by using the steganographic model in the form of information steganography, the first steganographic information corresponding to the model weight of each network layer is determined, then the model structure corresponding to each network layer contained in the target model is acquired, and the model structure corresponding to each network layer is encoded to obtain the first data corresponding to the model structure of each network layer, which occupies a preset number of bit positions, and the first data is written into the second steganographic carrier selected in advance in the form of information steganography, to obtain the second steganographic information corresponding to the model structure of each network layer, finally, the corresponding retrieval information of the first steganographic information and the second steganographic information is set, and based on the pre-set steganographic information directory, the first steganographic information and the second steganographic information are stored, in this way, in order to improve the accuracy of steganographic processing, the steganographic processing scheme for the target model is redesigned, and the hierarchical steganographic mode is proposed, that is, the target model is steganographically processed according to the network layer, in addition, the information of the steganographically processed model structure and model weight is randomly placed in each directory set in advance, the model leakage risk caused by the file structure is reduced, and the model privacy protection problem is solved from two aspects of file structure and file format.

[0196] Embodiment eight

[0197] Based on the same idea, the embodiment of the present specification also provides a model processing device, as shown in Figure 9 .

[0198] The model processing device comprises a reconstruction request module 901, a steganographic information acquisition module 902, a model information acquisition module 903 and a reconstruction module 904, wherein:

[0199] The reconstruction request module 901 acquires the reconstruction request for the target model;

[0200] The steganographic information acquisition module 902 acquires first steganographic information and second steganographic information corresponding to the target model based on a preset steganographic information directory and retrieval information of model structures and model weights corresponding to each network layer included in the target model. The first steganographic information is steganographic information corresponding to the model weights of each network layer included in the target model, which is determined based on the acquired model weights of each network layer, a first steganographic carrier corresponding to the model weights of each network layer, and a pre-trained steganographic model. The second steganographic information is steganographic information obtained by encoding the model structures of each network layer included in the target model to obtain first data corresponding to the model structures of each network layer and occupying a preset number of bit positions, and then writing the first data into a second steganographic carrier selected in advance by using an information steganographic method.

[0201] The model information acquisition module 903 determines the model weights of each network layer included in the target model based on the steganographic information extraction model and the first steganographic information provided by the server in advance, and decodes the second steganographic information to obtain the model structures of each network layer included in the target model.

[0202] The reconstruction module 904 loads the model weights into the corresponding model structures to obtain a reconstructed target model, and performs service processing of a target service based on the reconstructed target model.

[0203] In the embodiments of the present specification, the steganographic information acquisition module 902 includes:

[0204] The reading unit reads a random character sequence corresponding to the network layers of the target model in a preset root directory.

[0205] The steganographic information acquisition unit acquires the first steganographic information and the second steganographic information corresponding to the target model from the folder based on the characters included in the random character sequence and the information of the folder corresponding to each character.

[0206] In the embodiments of the present specification, the model information acquisition module 903 includes:

[0207] The carrier acquisition unit acquires the second steganographic carrier, which is an image.

[0208] The model structure acquisition unit subtracts pixel information corresponding to the second steganographic information from pixel information corresponding to the second steganographic carrier to obtain the model structures of each network layer included in the target model.

[0209] In the embodiments of the present specification, the steganographic information extraction model comprises a first steganographic information extraction sub-model, a second steganographic information extraction sub-model and a third steganographic information extraction sub-model, the first steganographic information comprises first sub-steganographic information, second sub-steganographic information and third sub-steganographic information, the first sub-steganographic information is obtained by inputting the first steganographic carrier and the model weight corresponding to each network layer into a pre-trained first steganographic sub-model, the second sub-steganographic information is obtained by inputting the first steganographic carrier and the first residual into the second steganographic sub-model, the first residual is the difference between the model weight and the first sub-model weight, the first sub-model weight is information extracted from the first sub-steganographic information, the third sub-steganographic information is obtained by inputting the first steganographic carrier and the second residual into the third steganographic sub-model, the second residual is the difference between the first residual and the second sub-model weight, and the second sub-model weight is information extracted from the second sub-steganographic information.

[0210] The model information acquisition module 903 comprises:

[0211] The first extraction unit inputs the first steganographic information into the first steganographic information extraction sub-model to obtain the first sub-model weight extracted from the first sub-steganographic information.

[0212] The second extraction unit inputs the second sub-steganographic information into the second steganographic information extraction sub-model to obtain the second sub-model weight extracted from the second sub-steganographic information.

[0213] The third extraction unit inputs the third sub-steganographic information into the third steganographic information extraction sub-model to obtain the third sub-model weight extracted from the third sub-steganographic information.

[0214] The model weight determination unit determines the model weight corresponding to each network layer contained in the target model based on the first sub-model weight, the second sub-model weight and the third sub-model weight.

[0215] The embodiment of the present specification provides a model processing apparatus, by acquiring the model weight corresponding to each network layer contained in the target model to be protected, and acquiring the first steganographic carrier corresponding to the model weight of each network layer, based on the first steganographic carrier and the model weight corresponding to each network layer, and the pre-trained steganographic model, the model weight is written into the first steganographic carrier by using the steganographic model in the form of information steganography, the first steganographic information corresponding to the model weight of each network layer is determined, then the model structure corresponding to each network layer contained in the target model is acquired, and the model structure corresponding to each network layer is encoded to obtain the first data corresponding to the model structure of each network layer occupying a preset number of bit positions, and the first data is written into the second steganographic carrier selected in advance in the form of information steganography, to obtain the second steganographic information corresponding to the model structure of each network layer, finally, the corresponding retrieval information of the first steganographic information and the second steganographic information is set, and based on the pre-set steganographic information directory, the first steganographic information and the second steganographic information are stored, and then when the model is reconstructed, the model structure and the model weight can be extracted based on the decoding mode and the steganographic information extraction model, in this way, in order to improve the accuracy of steganographic processing, the steganographic processing scheme for the target model is redesigned, and the hierarchical steganographic mode is proposed, that is, the target model is steganographically processed according to the network layer, in addition, the information of the steganographically processed model structure and model weight is randomly placed in each directory set in advance, reducing the model leakage risk caused by the file structure, thereby solving the model privacy protection problem from two aspects of file structure and file format.

[0216] Embodiment nine

[0217] The above is the model processing apparatus provided by the embodiment of the present specification, based on the same idea, the embodiment of the present specification also provides a model processing device, as shown in Figure 10

[0218] The model processing device can be a target device or a server provided by the above-mentioned embodiments.

[0219] ​The processing device of the model can have a large difference due to different configurations or performances, and can include one or more processors 1001 and memories 1002 in which one or more storage applications or data can be stored. The memory 1002 can be temporary storage or persistent storage. The application stored in the memory 1002 can include one or more modules (not shown in the figure), and each module can include a series of computer executable instructions in the processing device of the model. Further, the processor 1001 can be configured to communicate with the memory 1002 and execute a series of computer executable instructions in the memory 1002 on the processing device of the model. The processing device of the model can also include one or more power supplies 1003, one or more wired or wireless network interfaces 1004, one or more input / output interfaces 1005, and one or more keyboards 1006.

[0220] In particular, in the present embodiment, the processing device of the model includes a memory and one or more programs, wherein one or more programs are stored in the memory, and one or more programs can include one or more modules, and each module can include a series of computer executable instructions in the processing device of the model, and the one or more processors configured to execute the one or more programs include computer executable instructions for:

[0221] Obtaining a target model to be protected;

[0222] Obtaining the model weight corresponding to each network layer contained in the target model, and obtaining the first steganographic carrier corresponding to the model weight of each network layer, determining the first steganographic information corresponding to the model weight of each network layer based on the first steganographic carrier and the model weight of each network layer, and a pre-trained steganographic model, the first steganographic information is the information obtained by writing the model weight into the first steganographic carrier using the steganographic model in the form of information steganography;

[0223] Obtaining the model structure corresponding to each network layer contained in the target model, and performing encoding processing on the model structure corresponding to each network layer to obtain the first data corresponding to the model structure of each network layer occupying a preset number of bit positions, and writing the first data into the second steganographic carrier selected in advance in the form of information steganography to obtain the second steganographic information corresponding to the model structure of each network layer;

[0224] The corresponding retrieval information is set for the first steganographic information corresponding to the model weight of each network layer and the second steganographic information corresponding to the model structure of each network layer, and the first steganographic information corresponding to the model weight of each network layer and the second steganographic information corresponding to the model structure of each network layer are stored based on a preset steganographic information directory.

[0225] In the embodiments of the present specification, the following are further included:

[0226] A plurality of different preset models are obtained, and the model weight corresponding to each network layer included in each of the preset models is obtained.

[0227] A third steganographic carrier corresponding to the model weight of each network layer included in the preset model is obtained, the third steganographic carrier and the model weight of each network layer included in the preset model are taken as training samples, and the steganographic model and the steganographic information extraction model corresponding to the steganographic model are jointly trained based on the first loss function to obtain a trained steganographic model. The steganographic information extraction model is used to extract the model weight of the network layer included in the preset model from the output information of the steganographic model.

[0228] In the embodiments of the present specification, the first loss function is determined based on a maximum value of a similarity between the output information of the steganographic model and the third steganographic carrier and a maximum value of a similarity between the model weight of each network layer included in the preset model and the model weight of the network layer included in the preset model extracted from the output information of the steganographic model.

[0229] In the embodiments of the present specification, the steganographic model includes a first steganographic sub-model, a second steganographic sub-model, and a third steganographic sub-model, the first steganographic information includes a first sub-steganographic information, a second sub-steganographic information, and a third sub-steganographic information,

[0230] The first steganographic information corresponding to the model weight of each network layer is determined based on the first steganographic carrier, the model weight of each network layer, and a pre-trained steganographic model, and includes:

[0231] The first steganographic carrier and the model weight of each network layer are respectively input into a pre-trained first steganographic sub-model, the model weight of the network layer included in the target model is written into the first steganographic carrier by using the first steganographic sub-model in a steganographic manner, and the first sub-steganographic information is obtained.

[0232] The first sub-steganographic information is input into a first steganographic information extraction sub-model corresponding to the first steganographic sub-model, and the first sub-model weight extracted from the first sub-steganographic information is obtained.

[0233] a difference between the model weight and the first sub-model weight as a first residual, and inputting the first steganographic carrier and the first residual into the second steganographic sub-model, writing the first residual into the first steganographic carrier by the second steganographic sub-model in a manner of information steganography, to obtain second sub-steganographic information;

[0234] inputting the second sub-steganographic information into a second steganographic information extraction sub-model corresponding to the second steganographic sub-model, to obtain second sub-model weight extracted from the second sub-steganographic information;

[0235] a difference between the first residual and the second sub-model weight as a second residual, and inputting the first steganographic carrier and the second residual into the third steganographic sub-model, writing the second residual into the first steganographic carrier by the third steganographic sub-model in a manner of information steganography, to obtain third sub-steganographic information;

[0236] determining first steganographic information corresponding to the model weight of each network layer based on the first sub-steganographic information, the second sub-steganographic information, and the third sub-steganographic information.

[0237] In the embodiments of the present specification, further comprising:

[0238] obtaining a plurality of different preset models, and obtaining the model weight corresponding to each network layer included in each of the preset models, and obtaining a fourth steganographic carrier corresponding to the model weight of each network layer included in the preset model;

[0239] inputting the fourth steganographic carrier and the model weight corresponding to each network layer included in the preset model into a first steganographic sub-model respectively, to obtain the first sub-steganographic sample;

[0240] inputting the first sub-steganographic sample into the first steganographic information extraction sub-model, to obtain fourth sub-model weight extracted from the first sub-steganographic sample;

[0241] a difference between the model weight and the first sub-model weight as a first residual, and inputting the first steganographic carrier and the first residual into the second steganographic sub-model, writing the first residual into the first steganographic carrier by the second steganographic sub-model in a manner of information steganography, to obtain second sub-steganographic information;

[0242] inputting the second sub-steganographic sample into the second steganographic information extraction sub-model, to obtain fifth sub-model weight extracted from the second sub-steganographic sample;

[0243] inputting the difference between the first residual sample and the fifth sub-model weight as a second residual sample, and inputting the fourth steganographic carrier and the second residual sample into the third steganographic sub-model to obtain the third sub-steganographic sample;

[0244] inputting the third sub-steganographic sample into the third steganographic information extraction sub-model to obtain the sixth sub-model weight extracted from the third sub-steganographic sample;

[0245] based on the fourth sub-model weight, the fifth sub-model weight and the sixth sub-model weight, and the model weight corresponding to each network layer contained in the preset model, determining whether the first steganographic sub-model, the first steganographic information extraction sub-model, the second steganographic sub-model, the second steganographic information extraction sub-model, the third steganographic sub-model and the third steganographic information extraction sub-model converge through the second loss function, and if not, continuing to jointly train the above sub-models based on the fourth steganographic carrier and the model weight corresponding to each network layer contained in the preset model until the above sub-models converge.

[0246] In the embodiments of the present specification, the second loss function is determined based on the maximum value of the similarity between the output information of the first steganographic sub-model and the fourth steganographic carrier, the maximum value of the similarity between the output information of the second steganographic sub-model and the fourth steganographic carrier, the maximum value of the similarity between the output information of the third steganographic sub-model and the fourth steganographic carrier, and the maximum value of the similarity between the model weight corresponding to each network layer contained in the preset model and the sum of the output information of the first steganographic information extraction sub-model, the output information of the second steganographic information extraction sub-model and the output information of the third steganographic information extraction sub-model.

[0247] In the embodiments of the present specification, the encoding processing of the model structure corresponding to each network layer to obtain the first data corresponding to the model structure of each network layer and occupying a preset number of bit positions comprises:

[0248] respectively acquiring the type, network layer number and network layer parameter of each network layer;

[0249] using 4 bits of data to represent the type of each network layer, using 8 bits of data to represent the network layer number of each network layer, and using 12 bits of data to represent the network layer parameter of each network layer;

[0250] using a preset combination rule to combine the data corresponding to the type, network layer number and network layer parameter of each network layer to obtain the first data corresponding to the model structure of each network layer and occupying a preset number of bit positions;

[0251] The first data is written into the second steganographic carrier by the information steganography, and second steganographic information corresponding to the model structure of each network layer is obtained.

[0252] The first data is added to the continuous pixels of the second steganographic carrier, and the pixels occupying the preset number of bits are obtained, and the second steganographic information corresponding to the model structure of each network layer is obtained.

[0253] In the embodiments of the present specification, the network layer parameters include the convolution kernel, the stride and the padding pixels, the data of 12 bits is used to represent the network layer parameters of each network layer, and the data of 4 bits is used to represent the convolution kernel of each network layer, the data of 4 bits is used to represent the stride of each network layer, and the data of 4 bits is used to represent the padding pixels of each network layer.

[0254] In the embodiments of the present specification, the data of 4 bits is used to represent the convolution kernel of each network layer, the data of 4 bits is used to represent the stride of each network layer, and the data of 4 bits is used to represent the padding pixels of each network layer.

[0255] In the embodiments of the present specification, the first steganographic information corresponding to the model weight of each network layer and the second steganographic information corresponding to the model structure of each network layer are set with corresponding retrieval information, and the first steganographic information corresponding to the model weight of each network layer and the second steganographic information corresponding to the model structure of each network layer are stored based on the preset steganographic information directory.

[0256] According to the number of network layers contained in the target model, a random character sequence is generated, the number of characters contained in the random character sequence is determined by the number of network layers contained in the target model, and each character contained in the random character sequence represents a network layer in the target model.

[0257] A folder for information storage is set for each character in the random character sequence, and the first steganographic information of the network layer corresponding to the character in the random character sequence, and the second steganographic information and the second steganographic carrier are stored in the folder set for the character, and the folder is set with an identifier based on the model structure and the model weight corresponding to the network layer.

[0258] In the embodiments of the present specification, the first steganographic carrier and the second steganographic carrier are images.

[0259] Additionally, in the present embodiment, the processing device of the model includes a memory and one or more programs, wherein the one or more programs are stored in the memory, and the one or more programs can include one or more modules, and each module can include a series of computer executable instructions in the processing device of the model, and the one or more programs configured to be executed by one or more processors include the following computer executable instructions:

[0260] obtaining a reconstruction request for a target model;

[0261] based on the preset steganographic information directory and the retrieval information of the model structure and the model weight corresponding to each network layer contained in the target model, obtaining the first steganographic information and the second steganographic information corresponding to the target model, the first steganographic information being the steganographic information corresponding to the model weight of each network layer determined based on the obtained model weight of each network layer and the first steganographic carrier corresponding to the model weight of each network layer, and the pre-trained steganographic model, and the second steganographic information being the steganographic information obtained by encoding the model structure of each network layer contained in the target model to obtain the first data occupying a preset number of bit positions corresponding to the model structure of each network layer, and writing the first data into the preselected second steganographic carrier by information steganography;

[0262] based on the steganographic information extraction model and the first steganographic information provided by the server in advance, determining the model weight of each network layer contained in the target model, and decoding the second steganographic information to obtain the model structure of each network layer contained in the target model;

[0263] loading the model weight into the corresponding model structure to obtain the reconstructed target model, and performing business processing of the target business based on the reconstructed target model.

[0264] In the embodiments of the present specification, the obtaining of the first steganographic information and the second steganographic information corresponding to the target model based on the preset steganographic information directory and the retrieval information of the model structure and the model weight corresponding to each network layer contained in the target model comprises:

[0265] reading the random character sequence corresponding to the network layer of the target model under the preset root directory;

[0266] based on the characters contained in the random character sequence and the information of the folder corresponding to each character, obtaining the first steganographic information and the second steganographic information corresponding to the target model from the folder.

[0267] In the embodiments of the present specification, the decoding processing of the second steganographic information obtains the model structure corresponding to each network layer included in the target model, which comprises:

[0268] The second steganographic carrier is obtained, and the second steganographic carrier is an image.

[0269] The pixel information corresponding to the second steganographic information is subtracted from the pixel information corresponding to the second steganographic carrier to obtain the model structure corresponding to each network layer included in the target model.

[0270] In the embodiments of the present specification, the steganographic information extraction model comprises a first steganographic information extraction sub-model, a second steganographic information extraction sub-model and a third steganographic information extraction sub-model, the first steganographic information comprises first sub-steganographic information, second sub-steganographic information and third sub-steganographic information, the first sub-steganographic information is obtained by inputting the first steganographic carrier and the model weight corresponding to each network layer into a pre-trained first steganographic sub-model, the second sub-steganographic information is obtained by inputting the first steganographic carrier and the first residual into the second steganographic sub-model, the first residual is the difference between the model weight and the first sub-model weight, the first sub-model weight is information extracted from the first sub-steganographic information, the third sub-steganographic information is obtained by inputting the first steganographic carrier and the second residual into the third steganographic sub-model, the second residual is the difference between the first residual and the second sub-model weight, and the second sub-model weight is information extracted from the second sub-steganographic information.

[0271] The model weight corresponding to each network layer included in the target model is determined based on the steganographic information extraction model and the first steganographic information provided by the server in advance, which comprises:

[0272] The first steganographic information is input into the first steganographic information extraction sub-model to obtain the first sub-model weight extracted from the first sub-steganographic information.

[0273] The second sub-steganographic information is input into the second steganographic information extraction sub-model to obtain the second sub-model weight extracted from the second sub-steganographic information.

[0274] The third sub-steganographic information is input into the third steganographic information extraction sub-model to obtain the third sub-model weight extracted from the third sub-steganographic information.

[0275] The model weight corresponding to each network layer included in the target model is determined based on the first sub-model weight, the second sub-model weight and the third sub-model weight.

[0276] The embodiment of the specification provides a processing device of a model, by acquiring model weights corresponding to each network layer contained in a target model to be protected, acquiring a first steganographic carrier corresponding to the model weights of each network layer, based on the first steganographic carrier and the model weights of each network layer, and a pre-trained steganographic model, using the steganographic model to write the model weights into the first steganographic carrier in an information steganographic manner, determining first steganographic information corresponding to the model weights of each network layer, then acquiring model structures corresponding to each network layer contained in the target model, and performing encoding processing on the model structures corresponding to each network layer to obtain first data corresponding to the model structures of each network layer and occupying a preset number of bit positions, and writing the first data into a second steganographic carrier selected in advance in an information steganographic manner to obtain second steganographic information corresponding to the model structures of each network layer, finally, setting corresponding retrieval information for the first steganographic information and the second steganographic information, and storing the first steganographic information and the second steganographic information based on a pre-set steganographic information directory, and then the model structure and the model weights can be extracted based on the decoding manner and the steganographic information when the model is reconstructed, in this way, in order to improve the accuracy of steganographic processing, the steganographic processing scheme for the target model is redesigned, and a hierarchical steganographic manner is proposed, that is, the target model is steganographically processed according to network layers, in addition, the information steganographically processed with the model structure and the model weights is randomly placed into each directory set in advance, reducing the model leakage risk caused by the file structure, thereby solving the model privacy protection problem from two aspects of file structure and file format.

[0277] Embodiment ten

[0278] Further, based on the above Figures 1 to 7 The one or more embodiments of the specification also provide a storage medium for storing computer executable instruction information, in a specific embodiment, the storage medium can be a U disk, an optical disk, a hard disk, etc., and the computer executable instruction information stored in the storage medium can realize the following processes when executed by a processor:

[0279] Acquire a target model to be protected;

[0280] Acquire model weights corresponding to each network layer contained in the target model, and acquire a first steganographic carrier corresponding to the model weights of each network layer, determine first steganographic information corresponding to the model weights of each network layer based on the first steganographic carrier and the model weights of each network layer, and a pre-trained steganographic model, the first steganographic information is information obtained by using the steganographic model to write the model weights into the first steganographic carrier in an information steganographic manner;

[0281] obtaining a model structure corresponding to each network layer contained in the target model, and performing encoding processing on the model structure corresponding to each network layer to obtain first data corresponding to the model structure of each network layer and occupying a preset number of bit positions, and writing the first data into a second steganographic carrier selected in advance in a manner of information steganography to obtain second steganographic information corresponding to the model structure of each network layer;

[0282] The first steganographic information corresponding to the model weight of each network layer and the second steganographic information corresponding to the model structure of each network layer are respectively set with corresponding retrieval information, and the first steganographic information corresponding to the model weight of each network layer and the second steganographic information corresponding to the model structure of each network layer are stored based on a preset steganographic information directory.

[0283] In the embodiments of the present specification, the following are further included:

[0284] obtaining a plurality of different preset models, and obtaining a model weight corresponding to each network layer contained in each of the preset models;

[0285] obtaining a third steganographic carrier corresponding to the model weight of each network layer contained in the preset model, taking the third steganographic carrier and the model weight of each network layer contained in the preset model as a training sample, and jointly training the steganographic model and a steganographic information extraction model based on the first loss function to obtain a trained steganographic model, wherein the steganographic information extraction model is used to extract the model weight of the network layer contained in the preset model from the output information of the steganographic model.

[0286] In the embodiments of the present specification, the first loss function is determined based on a maximum value of a similarity between the output information of the steganographic model and the third steganographic carrier, and a maximum value of a similarity between the model weight of each network layer contained in the preset model and the model weight of the network layer contained in the preset model extracted from the output information of the steganographic model.

[0287] In the embodiments of the present specification, the steganographic model includes a first steganographic sub-model, a second steganographic sub-model and a third steganographic sub-model, the first steganographic information includes first sub-steganographic information, second sub-steganographic information and third sub-steganographic information,

[0288] The first steganographic information corresponding to the model weight of each network layer is determined based on the first steganographic carrier, the model weight of each network layer, and a pre-trained steganographic model, and includes:

[0289] input the first stego carrier and the model weight corresponding to each network layer of the first stego carrier into a pre-trained first stego sub-model respectively, and write the model weight corresponding to each network layer contained in the target model into the first stego carrier by using information steganography through the first stego sub-model, to obtain the first sub-stego information;

[0290] input the first sub-stego information into a first stego information extraction sub-model corresponding to the first stego sub-model, to obtain the first sub-model weight extracted from the first sub-stego information;

[0291] take the difference between the model weight and the first sub-model weight as a first residual, and input the first stego carrier and the first residual into the second stego sub-model, and write the first residual into the first stego carrier by using information steganography through the second stego sub-model, to obtain the second sub-stego information;

[0292] input the second sub-stego information into a second stego information extraction sub-model corresponding to the second stego sub-model, to obtain the second sub-model weight extracted from the second sub-stego information;

[0293] take the difference between the first residual and the second sub-model weight as a second residual, and input the first stego carrier and the second residual into the third stego sub-model, and write the second residual into the first stego carrier by using information steganography through the third stego sub-model, to obtain the third sub-stego information;

[0294] determine the first stego information corresponding to the model weight of each network layer based on the first sub-stego information, the second sub-stego information, and the third sub-stego information.

[0295] In the embodiments of the present specification, the following are further included:

[0296] obtain a plurality of different preset models, and obtain the model weight corresponding to each network layer contained in each preset model, and obtain a fourth stego carrier corresponding to the model weight corresponding to each network layer contained in the preset model;

[0297] input the fourth stego carrier and the model weight corresponding to each network layer contained in the preset model into a first stego sub-model respectively, to obtain the first sub-stego sample;

[0298] input the first sub-stego sample into the first stego information extraction sub-model, to obtain the fourth sub-model weight extracted from the first sub-stego sample;

[0299] a difference between the model weight corresponding to the network layer included in the preset model and the fourth sub-model weight as a first residual sample, and inputting the fourth steganographic carrier and the first residual sample into the second steganographic sub-model to obtain a second sub-steganographic sample;

[0300] inputting the second sub-steganographic sample into the second steganographic information extraction sub-model to obtain a fifth sub-model weight extracted from the second sub-steganographic sample;

[0301] a difference between the first residual sample and the fifth sub-model weight as a second residual sample, and inputting the fourth steganographic carrier and the second residual sample into the third steganographic sub-model to obtain a third sub-steganographic sample;

[0302] inputting the third sub-steganographic sample into the third steganographic information extraction sub-model to obtain a sixth sub-model weight extracted from the third sub-steganographic sample;

[0303] based on the fourth sub-model weight, the fifth sub-model weight and the sixth sub-model weight, and the model weight corresponding to each network layer included in the preset model, determining whether the first steganographic sub-model, the first steganographic information extraction sub-model, the second steganographic sub-model, the second steganographic information extraction sub-model, the third steganographic sub-model and the third steganographic information extraction sub-model converge by the second loss function, and if not, continuing to jointly train the above sub-models based on the fourth steganographic carrier and the model weight corresponding to each network layer included in the preset model until the above sub-models converge.

[0304] In the embodiments of the present specification, the second loss function is determined based on a maximum value of similarity between the output information of the first steganographic sub-model and the fourth steganographic carrier, a maximum value of similarity between the output information of the second steganographic sub-model and the fourth steganographic carrier, a maximum value of similarity between the output information of the third steganographic sub-model and the fourth steganographic carrier, and a maximum value of similarity between the model weight corresponding to each network layer included in the preset model and a sum of the output information of the first steganographic information extraction sub-model, the output information of the second steganographic information extraction sub-model and the output information of the third steganographic information extraction sub-model.

[0305] In the embodiments of the present specification, the encoding processing of the model structure corresponding to each network layer to obtain the first data occupying the preset number of bit positions corresponding to the model structure corresponding to each network layer comprises:

[0306] respectively acquiring the type, the network layer number and the network layer parameter of each network layer;

[0307] The type of each network layer is represented by 4 bits of data, the network layer number of each network layer is represented by 8 bits of data, and the network layer parameter of each network layer is represented by 12 bits of data;

[0308] The data corresponding to the type, network layer number and network layer parameter of each network layer is combined using a preset combination rule to obtain first data corresponding to the model structure of each network layer, which occupies a preset number of bits;

[0309] The first data is written into a second steganographic carrier selected in advance by means of information steganography to obtain second steganographic information corresponding to the model structure of each network layer, which comprises:

[0310] The first data is added to consecutive pixels in the second steganographic carrier, which occupies a preset number of bits of pixels, to obtain second steganographic information corresponding to the model structure of each network layer.

[0311] In the embodiments of the present specification, the network layer parameter includes the convolution kernel, stride and padding pixels, and the network layer parameter of each network layer is represented by 12 bits of data, which comprises:

[0312] The convolution kernel of each network layer is represented by 4 bits of data, the stride of each network layer is represented by 4 bits of data, and the padding pixels of each network layer are represented by 4 bits of data.

[0313] In the embodiments of the present specification, the first steganographic information corresponding to the model weight of each network layer and the second steganographic information corresponding to the model structure of each network layer are set with corresponding retrieval information, and the first steganographic information corresponding to the model weight of each network layer and the second steganographic information corresponding to the model structure of each network layer are stored based on a preset steganographic information directory, which comprises:

[0314] A random character sequence is generated according to the number of network layers contained in the target model, the number of characters contained in the random character sequence is determined by the number of network layers contained in the target model, and each character in the random character sequence represents a network layer in the target model;

[0315] A folder for storing information is set for each character in the random character sequence, and the first steganographic information of the network layer corresponding to the character in the random character sequence, and the second steganographic information and the second steganographic carrier are stored in the folder set for the character, and the folder is identified based on the model structure and model weight corresponding to the network layer.

[0316] In the embodiments of the present specification, the first steganographic carrier and the second steganographic carrier are images.

[0317] In addition, in another specific embodiment, the storage medium can be a U disk, an optical disk, a hard disk, etc., and the computer executable instruction information stored in the storage medium can realize the following flow when executed by the processor:

[0318] Obtaining a reconstruction request for a target model;

[0319] Based on the preset steganographic information directory and the retrieval information of the model structure and the model weight corresponding to each network layer contained in the target model, the first steganographic information and the second steganographic information corresponding to the target model are obtained. The first steganographic information is the steganographic information corresponding to the model weight of each network layer, which is determined based on the obtained model weight of each network layer contained in the target model, the first steganographic carrier corresponding to the model weight of each network layer, and the pre-trained steganographic model. The second steganographic information is obtained by encoding the model structure of each network layer contained in the target model to obtain the first data corresponding to the model structure of each network layer, which occupies a preset number of bit positions, and then writing the first data into the second steganographic carrier selected in advance by means of information steganography.

[0320] Based on the steganographic information extraction model and the first steganographic information provided by the server in advance, the model weight corresponding to each network layer contained in the target model is determined, and the second steganographic information is decoded to obtain the model structure corresponding to each network layer contained in the target model.

[0321] The model weight is loaded into the corresponding model structure to obtain the reconstructed target model, and the target service processing is performed based on the reconstructed target model.

[0322] In the embodiments of the present specification, based on the preset steganographic information directory and the retrieval information of the model structure and the model weight corresponding to each network layer contained in the target model, the first steganographic information and the second steganographic information corresponding to the target model are obtained, including:

[0323] Reading the random character sequence corresponding to the network layer of the target model under the preset root directory;

[0324] Based on the characters contained in the random character sequence and the information of the folder corresponding to each character, the first steganographic information and the second steganographic information corresponding to the target model are obtained from the folder.

[0325] In the embodiments of the present specification, the decoding processing of the second steganographic information to obtain the model structure corresponding to each network layer contained in the target model includes:

[0326] obtaining the second steganographic carrier, the second steganographic carrier being an image;

[0327] subtracting pixel information corresponding to the second steganographic information from pixel information corresponding to the second steganographic carrier to obtain a model structure corresponding to each network layer included in the target model.

[0328] In the embodiments of the present specification, the steganographic information extraction model includes a first steganographic information extraction sub-model, a second steganographic information extraction sub-model, and a third steganographic information extraction sub-model, the first steganographic information includes first sub-steganographic information, second sub-steganographic information, and third sub-steganographic information, the first sub-steganographic information is obtained by inputting the first steganographic carrier and the model weight corresponding to each network layer into a pre-trained first steganographic sub-model, the second sub-steganographic information is obtained by inputting the difference between the model weight and the first sub-model weight as a first residual and inputting the first steganographic carrier and the first residual into the second steganographic sub-model, the first sub-model weight is information extracted from the first sub-steganographic information, and the third sub-steganographic information is obtained by inputting the difference between the first residual and the second sub-model weight as a second residual and inputting the first steganographic carrier and the second residual into the third steganographic sub-model, the second sub-model weight is information extracted from the second sub-steganographic information;

[0329] The method further includes determining the model weight corresponding to each network layer included in the target model based on the steganographic information extraction model and the first steganographic information provided by the server in advance.

[0330] The method further includes inputting the first steganographic information into the first steganographic information extraction sub-model to obtain the first sub-model weight extracted from the first sub-steganographic information.

[0331] The method further includes inputting the second sub-steganographic information into the second steganographic information extraction sub-model to obtain the second sub-model weight extracted from the second sub-steganographic information.

[0332] The method further includes inputting the third sub-steganographic information into the third steganographic information extraction sub-model to obtain the third sub-model weight extracted from the third sub-steganographic information.

[0333] The method further includes determining the model weight corresponding to each network layer included in the target model based on the first sub-model weight, the second sub-model weight, and the third sub-model weight.

[0334] The embodiment of the specification provides a storage medium, by acquiring each network layer corresponding model weight contained in the target model to be protected, and acquiring the first steganographic carrier corresponding to each network layer corresponding model weight, based on the first steganographic carrier and each network layer corresponding model weight, and the pre-trained steganographic model, the model weight is written into the first steganographic carrier by using the steganographic model in the form of information steganography, the first steganographic information corresponding to each network layer corresponding model weight is determined, then, the model structure corresponding to each network layer contained in the target model is acquired, and the model structure corresponding to each network layer is encoded to obtain the first data corresponding to the model structure of each network layer, which occupies a preset number of bit positions, and the first data is written into the second steganographic carrier selected in advance in the form of information steganography, to obtain the second steganographic information corresponding to the model structure of each network layer, finally, the corresponding retrieval information of the first steganographic information and the second steganographic information is set, and based on the pre-set steganographic information directory, the first steganographic information and the second steganographic information are stored, and then when the model reconstruction is performed, the model structure and the model weight can be extracted based on the decoding mode and the steganographic information extraction model, in this way, in order to improve the accuracy of steganographic processing, the steganographic processing scheme for the target model is redesigned, and the hierarchical steganographic mode is proposed, that is, the target model is steganographically processed according to the network layer, in addition, the information of the steganographically processed model structure and model weight is randomly placed in each directory set in advance, the model leakage risk caused by the file structure is reduced, and the model privacy protection problem is solved from two aspects of file structure and file format.

[0335] The above describes specific embodiments of the specification. Other embodiments are within the scope of the appended claims. In some cases, the actions or steps recited in the claims can be performed in an order different than the order in the embodiments and still achieve the desired result. In addition, the processes depicted in the figures do not necessarily require the particular order shown or sequential order to achieve the desired results. In certain implementations, multitasking and parallel processing can be advantageous or possible.

[0336] In the 1990s, it was relatively easy to distinguish whether an improvement in a technology was a hardware improvement (e.g., an improvement in the circuit structure of a diode, transistor, switch, etc.) or a software improvement (an improvement in a method flow). However, as technology has evolved, many improvements in method flows today can be considered as direct improvements in hardware circuit structures. Designers almost always obtain the corresponding hardware circuit structures by programming the improved method flows into hardware circuits. Therefore, it cannot be said that an improvement in a method flow cannot be implemented using hardware entity modules. For example, a programmable logic device (PLD) (e.g., a field programmable gate array (FPGA)) is an integrated circuit whose logic function is determined by user programming of the device. A digital system is "integrated" on a PLD by the designer programming the PLD, rather than by ordering a chip manufacturer to design and fabricate a custom integrated circuit chip. Moreover, instead of manually fabricating integrated circuit chips, this programming is now mostly implemented using "logic compiler" software, which is similar to software compilers used in program development, and the original code to be compiled is written in a specific programming language, which is called a hardware description language (HDL), and there are many such languages, such as ABEL (Advanced Boolean Expression Language), AHDL (Altera Hardware Description Language), Confluence, CUPL (Cornell University Programming Language), HDCal, JHDL (Java Hardware Description Language), Lava, Lola, MyHDL, PALASM, RHDL (Ruby Hardware Description Language), etc., and the most commonly used are VHDL (Very-High-Speed Integrated Circuit Hardware Description Language) and Verilog. Those skilled in the art should be aware that, as long as the method flow is logically programmed using the above-mentioned hardware description languages and programmed into an integrated circuit, a hardware circuit implementing the logical method flow can be easily obtained.

[0337] The controller can be implemented in any suitable way, e.g. the controller can take the form of a microprocessor or processor and a computer readable medium storing computer readable program code, e.g. software or firmware, executable by the (micro)processor, logic gates, switches, an application specific integrated circuit (ASIC), a programmable logic controller and an embedded microcontroller, examples of controllers include but are not limited to the following microcontrollers: ARC 625D, Atmel AT91 SAM, Microchip PIC18F26K20 and Silicone Labs C8051F320, the memory controller can also be implemented as part of the control logic of the memory. Those skilled in the art will also know that in addition to being implemented in pure computer readable program code form, the controller can perfectly well be implemented by means of logic programmed into logic gates, switches, application specific integrated circuits, programmable logic controllers and embedded microcontrollers, etc. to perform the same functions. The controller can thus be considered as a hardware component, and the means comprised therein for performing various functions can be considered as structures within the hardware component. Alternatively, or even, the means for performing various functions can be considered as both a software module implementing a method and a structure within a hardware component.

[0338] The systems, apparatuses, modules or units illustrated by the above embodiments can be specifically implemented by computer chips or entities, or by products with certain functions. A typical implementation device is a computer. Specifically, the computer can be, for example, a personal computer, a laptop computer, a cellular phone, a camera phone, a smart phone, a personal digital assistant, a media player, a navigation device, an email device, a game console, a tablet computer, a wearable device, or a combination of any of these devices.

[0339] For the sake of description, the above apparatuses are described in functional division and are described respectively. Of course, the functions of each unit can be implemented in the same or more software and / or hardware when implementing one or more embodiments of the present specification.

[0340] Those skilled in the art will understand that the embodiments of the present specification can be provided as a method, a system, or a computer program product. Therefore, one or more embodiments of the present specification can take the form of a complete hardware embodiment, a complete software embodiment, or an embodiment combining software and hardware aspects. Moreover, one or more embodiments of the present specification can take the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to magnetic disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0341] The embodiments of the present specification are described with reference to flowcharts and / or block diagrams of the method, device (system) and computer program product according to the embodiments of the present specification. It should be understood that each flow and / or block in the flowcharts and / or block diagrams, and the combination of flows and / or blocks in the flowcharts and / or block diagrams can be implemented by computer program instructions. These computer program instructions can be provided to a general-purpose computer, a special-purpose computer, an embedded processor or other programmable electronic devices to produce a machine, so that the instructions executed by the computer or other programmable electronic devices generate a device that implements the functions specified in the flowcharts and / or block diagrams. Figure 1 one or more flows and / or blocks. Figure 1 one or more flows and / or blocks.

[0342] These computer program instructions can also be stored in a computer readable memory that can direct the computer or other programmable electronic devices to work in a specific manner, so that the instructions stored in the computer readable memory produce a manufactured product including instruction devices that implement the functions specified in the flowcharts and / or block diagrams. Figure 1 one or more flows and / or blocks. Figure 1 one or more flows and / or blocks.

[0343] These computer program instructions can also be loaded into a computer or other programmable electronic devices, so that a series of operation steps are performed on the computer or other programmable electronic devices to produce a computer implemented process, so that the instructions executed on the computer or other programmable electronic devices provide steps for implementing the functions specified in the flowcharts and / or block diagrams. Figure 1 one or more flows and / or blocks. Figure 1 one or more flows and / or blocks.

[0344] In a typical configuration, the computing device includes one or more processors (CPUs), input / output interfaces, network interfaces and memories.

[0345] The memory can include non-persistent memory in the computer readable medium, random access memory (RAM) and / or non-volatile memory, such as read-only memory (ROM) or flash memory (flash RAM). The memory is an example of the computer readable medium.

[0346] Computer-readable media includes permanent and non-permanent, movable and non-movable media that can be implemented by any method or technology to store information. The information can be computer-readable instructions, data structures, program modules or other data. Examples of computer storage media include, but are not limited to, phase-change memory (PRAM), static random access memory (SRAM), dynamic random access memory (DRAM), other types of random access memory (RAM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), flash memory or other memory technologies, compact disc read-only memory (CD-ROM), digital versatile disc (DVD) or other optical storage, magnetic cassette, magnetic tape, magnetic disk storage or other magnetic storage devices, or any other non-transmission medium that can be used to store information accessible to a computing device. According to the definition herein, computer-readable media does not include transitory media such as modulated data signals and carriers.

[0347] It should also be noted that the terms "comprising", "containing", or any other variant thereof are intended to cover non-exclusive inclusion, such that processes, methods, articles or devices that comprise a list of elements do not only include those elements, but also other elements not explicitly listed or inherent to such processes, methods, articles or devices. Without more limitations, the element defined by the statement "comprising a" does not exclude the presence of additional identical elements in the process, method, article or device comprising the element.

[0348] Those skilled in the art will appreciate that embodiments of the present specification can be provided as methods, systems or computer program products. Therefore, one or more embodiments of the present specification can take the form of an entirely hardware embodiment, an entirely software embodiment or an embodiment combining software and hardware aspects. Moreover, one or more embodiments of the present specification can take the form of a computer program product implemented on one or more computer-usable storage media (including, but not limited to, magnetic disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0349] One or more embodiments of the present specification can be described in the general context of computer-executable instructions, such as program modules, being executed by a computer. Generally, program modules include routines, programs, objects, components, data structures, etc. that perform particular tasks or implement particular abstract data types. One or more embodiments of the present specification can also be practiced in distributed computing environments where tasks are performed by remote processing devices that are connected through a communication network. In a distributed computing environment, program modules can be located in both local and remote computer storage media including storage devices.

[0350] Each of the embodiments in the specification is described in a progressive manner, and the same or similar parts between the embodiments can be referred to each other. Each of the embodiments focuses on the difference from other embodiments. In particular, for the system embodiments, since they are basically similar to the method embodiments, the description is relatively simple, and the relevant parts can be referred to the part of the method embodiments.

[0351] The above only describes the embodiments of the specification and is not intended to limit the application. The specification can have various modifications and changes for those skilled in the art. Any modification, equivalent replacement, improvement, etc. within the spirit and principle of the specification shall be included in the scope of claims of the specification.

Claims

1. A model processing method applied to a server, the method comprising: obtaining a target model to be protected; obtaining a model weight corresponding to each network layer contained in the target model, and obtaining a first steganographic carrier corresponding to the model weight of each network layer, determining first steganographic information corresponding to the model weight of each network layer based on the first steganographic carrier and the model weight of each network layer, and a pre-trained steganographic model, the first steganographic information being information obtained by writing the model weight into the first steganographic carrier using the steganographic model in an information steganography manner; obtaining a model structure corresponding to each network layer contained in the target model, and performing encoding processing on the model structure corresponding to each network layer to obtain first data corresponding to the model structure of each network layer occupying a preset number of bit positions, and writing the first data into a second steganographic carrier selected in advance in an information steganography manner to obtain second steganographic information corresponding to the model structure of each network layer; setting corresponding retrieval information for the first steganographic information corresponding to the model weight of each network layer and the second steganographic information corresponding to the model structure of each network layer, and storing the first steganographic information corresponding to the model weight of each network layer and the second steganographic information corresponding to the model structure of each network layer based on a pre-set steganographic information directory.

2. The method of claim 1, further comprising: obtaining a plurality of different preset models, and obtaining a model weight corresponding to each network layer contained in each of the preset models; obtaining a third steganographic carrier corresponding to the model weight of each network layer contained in the preset model, taking the third steganographic carrier and the model weight of each network layer contained in the preset model as a training sample, and based on a first loss function, jointly training the steganographic model and a steganographic information extraction model corresponding to the steganographic model to obtain a trained steganographic model, the steganographic information extraction model being used to extract the model weight of the network layer contained in the preset model from the output information of the steganographic model.

3. The method of claim 2, wherein the first loss function is determined based on a maximum value of a similarity between the output information of the steganographic model and the third steganographic carrier, and a maximum value of a similarity between the model weight of each network layer contained in the preset model and the model weight of the network layer contained in the preset model extracted from the output information of the steganographic model.

4. The method of claim 1, wherein the steganographic model comprises a first steganographic sub-model, a second steganographic sub-model, and a third steganographic sub-model, and the first steganographic information comprises a first sub-steganographic information, a second sub-steganographic information, and a third sub-steganographic information, the determining the first steganographic information corresponding to the model weight of each network layer based on the first steganographic carrier and the model weight of each network layer, and the pre-trained steganographic model, comprises: input the first stego carrier and the model weight corresponding to each network layer in the preset model into the first stego sub-model respectively, write the model weight corresponding to each network layer contained in the target model into the first stego carrier by using information steganography through the first stego sub-model, and obtain the first sub-stego information; input the first sub-stego information into the first stego information extraction sub-model corresponding to the first stego sub-model, and obtain the first sub-model weight extracted from the first sub-stego information; take the difference between the model weight and the first sub-model weight as a first residual, and input the first stego carrier and the first residual into the second stego sub-model, write the first residual into the first stego carrier by using information steganography through the second stego sub-model, and obtain the second sub-stego information; input the second sub-stego information into the second stego information extraction sub-model corresponding to the second stego sub-model, and obtain the second sub-model weight extracted from the second sub-stego information; take the difference between the first residual and the second sub-model weight as a second residual, and input the first stego carrier and the second residual into the third stego sub-model, write the second residual into the first stego carrier by using information steganography through the third stego sub-model, and obtain the third sub-stego information; determine the first stego information corresponding to the model weight of each network layer based on the first sub-stego information, the second sub-stego information, and the third sub-stego information.

5. The method of claim 4, further comprising: obtaining a plurality of different preset models, and obtaining the model weight corresponding to each network layer contained in each of the preset models, and obtaining a fourth stego carrier corresponding to the model weight corresponding to each network layer contained in the preset model; input the fourth stego carrier and the model weight corresponding to each network layer contained in the preset model into the first stego sub-model respectively, and obtain a first sub-stego sample; input the first sub-stego sample into the first stego information extraction sub-model, and obtain a fourth sub-model weight extracted from the first sub-stego sample; take the difference between the model weight corresponding to the network layer contained in the preset model and the fourth sub-model weight as a first residual sample, and input the fourth stego carrier and the first residual sample into the second stego sub-model, and obtain a second sub-stego sample; input the second sub-stego sample into the second stego information extraction sub-model, and obtain a fifth sub-model weight extracted from the second sub-stego sample; take the difference between the first residual sample and the fifth sub-model weight as a second residual sample, and input the fourth stego carrier and the second residual sample into the third stego sub-model, and obtain a third sub-stego sample; input the third sub-stego sample into the third stego information extraction sub-model, and obtain a sixth sub-model weight extracted from the third sub-stego sample; determine, by a second loss function, whether the first steganography sub-model, the first steganographic information extraction sub-model, the second steganography sub-model, the second steganographic information extraction sub-model, the third steganography sub-model and the third steganographic information extraction sub-model converge based on the fourth sub-model weight, the fifth sub-model weight and the sixth sub-model weight and the model weight corresponding to each network layer contained in the preset model, and if not, continue to jointly train the above-mentioned sub-models based on the fourth steganography carrier and the model weight corresponding to each network layer contained in the preset model until the above-mentioned sub-models converge.

6. The method of claim 5, wherein the second loss function is determined based on a maximum value of similarity between output information of the first steganography sub-model and the fourth steganography carrier, a maximum value of similarity between output information of the second steganography sub-model and the fourth steganography carrier, a maximum value of similarity between output information of the third steganography sub-model and the fourth steganography carrier, and a maximum value of similarity between the model weight corresponding to each network layer contained in the preset model and a sum of output information of the first steganographic information extraction sub-model, output information of the second steganographic information extraction sub-model and output information of the third steganographic information extraction sub-model.

7. The method of claim 1, wherein the encoding processing of the model structure corresponding to each network layer to obtain the first data occupying a preset number of bit positions corresponding to the model structure corresponding to each network layer comprises: acquiring a type, a network layer number and a network layer parameter of each network layer respectively; using 4-bit data to represent the type of each network layer, using 8-bit data to represent the network layer number of each network layer, and using 12-bit data to represent the network layer parameter of each network layer; using a preset combination rule to combine the data corresponding to the type, the network layer number and the network layer parameter of each network layer to obtain the first data occupying a preset number of bit positions corresponding to the model structure corresponding to each network layer; and writing the first data into the second steganography carrier preselected by the information steganography to obtain the second steganographic information corresponding to the model structure corresponding to each network layer, comprising: adding the first data to the pixels occupying a preset number of bit positions in the continuous pixels in the second steganography carrier to obtain the second steganographic information corresponding to the model structure corresponding to each network layer.

8. The method of claim 7, wherein the network layer parameter comprises a convolution kernel, a stride and padding pixels, and the 12-bit data is used to represent the network layer parameter of each network layer, comprising: using 4-bit data to represent the convolution kernel of each network layer, using 4-bit data to represent the stride of each network layer, and using 4-bit data to represent the padding pixels of each network layer. ​ 9. The method of claim 1, wherein the setting the first steganographic information corresponding to the model weight of each network layer and the second steganographic information corresponding to the model structure of each network layer with the corresponding retrieval information, and storing the first steganographic information corresponding to the model weight of each network layer and the second steganographic information corresponding to the model structure of each network layer based on the preset steganographic information directory, comprises: generating a random character sequence according to the number of network layers contained in the target model, wherein the number of characters contained in the random character sequence is determined by the number of network layers contained in the target model, and each character contained in the random character sequence represents a network layer in the target model; setting a folder for storing information for each character in the random character sequence, and storing the first steganographic information of the network layer corresponding to the character in the random character sequence, the second steganographic information and the second steganographic carrier into the folder set for the character, and setting an identifier for the folder based on the model structure and the model weight corresponding to the network layer.

10. The method of any one of claims 1-9, wherein the first steganographic carrier and the second steganographic carrier are images.

11. A model processing method applied to a target device, the method comprising: obtaining a reconstruction request for a target model; obtaining first steganographic information and second steganographic information corresponding to the target model based on a preset steganographic information directory and retrieval information of a model structure and a model weight corresponding to each network layer contained in the target model, wherein the first steganographic information is determined based on the obtained model weight corresponding to each network layer contained in the target model, the obtained first steganographic carrier corresponding to the model weight of each network layer, and a pre-trained steganographic model, and the second steganographic information is obtained by encoding the model structure corresponding to each network layer contained in the target model to obtain first data corresponding to the model structure of each network layer occupying a preset number of bits, and then writing the first data into a preselected second steganographic carrier by information steganography; determining the model weight corresponding to each network layer contained in the target model based on a steganographic information extraction model and the first steganographic information provided by a server in advance, and decoding the second steganographic information to obtain the model structure corresponding to each network layer contained in the target model; loading the model weight into the corresponding model structure to obtain a reconstructed target model, and performing service processing of a target service based on the reconstructed target model.

12. The method of claim 11, wherein the obtaining the first steganographic information and the second steganographic information corresponding to the target model based on the preset steganographic information directory and the retrieval information of the model structure and the model weight corresponding to each network layer contained in the target model, comprises: reading a random character sequence of the network layer of the target model under a preset root directory. ​ ​ ​ ​ ​ ​ ​ obtain first steganographic information and second steganographic information corresponding to the target model from the folder based on the characters contained in the random character sequence and information of the folder corresponding to each character.

13. The method of claim 11, wherein the decoding the second steganographic information to obtain the model structure corresponding to each network layer contained in the target model comprises: obtaining the second steganographic carrier, the second steganographic carrier being an image; subtracting pixel information corresponding to the second steganographic information from pixel information corresponding to the second steganographic carrier to obtain the model structure corresponding to each network layer contained in the target model.

14. The method of claim 11, wherein the steganographic information extraction model comprises a first steganographic information extraction sub-model, a second steganographic information extraction sub-model, and a third steganographic information extraction sub-model, the first steganographic information comprises a first sub-steganographic information, a second sub-steganographic information, and a third sub-steganographic information, the first sub-steganographic information is obtained by inputting the first steganographic carrier and the model weight corresponding to each network layer into a pre-trained first steganographic sub-model, the second sub-steganographic information is obtained by taking a difference between the model weight and a first sub-model weight as a first residual and inputting the first steganographic carrier and the first residual into a second steganographic sub-model, the first sub-model weight is information extracted from the first sub-steganographic information, the third sub-steganographic information is obtained by taking a difference between the first residual and a second sub-model weight as a second residual and inputting the first steganographic carrier and the second residual into a third steganographic sub-model, the second sub-model weight is information extracted from the second sub-steganographic information; determining the model weight corresponding to each network layer contained in the target model based on the steganographic information extraction model and the first steganographic information provided by the server in advance comprises: inputting the first steganographic information into the first steganographic information extraction sub-model to obtain the first sub-model weight extracted from the first sub-steganographic information; inputting the second sub-steganographic information into the second steganographic information extraction sub-model to obtain the second sub-model weight extracted from the second sub-steganographic information; inputting the third sub-steganographic information into the third steganographic information extraction sub-model to obtain the third sub-model weight extracted from the third sub-steganographic information; determining the model weight corresponding to each network layer contained in the target model based on the first sub-model weight, the second sub-model weight, and the third sub-model weight.

15. A model processing apparatus, the apparatus comprising: a model obtaining module configured to obtain a target model to be protected; a weight steganography module configured to obtain model weights corresponding to each network layer included in the target model, obtain a first steganographic carrier corresponding to each model weight, determine first steganographic information corresponding to each model weight based on the first steganographic carrier, the model weight corresponding to each network layer, and a pre-trained steganographic model, the first steganographic information being information obtained by writing the model weight into the first steganographic carrier using the steganographic model through information steganography; a structure steganography module configured to obtain model structures corresponding to each network layer included in the target model, encode each model structure, obtain first data corresponding to each model structure and occupying a preset number of bits, and write the first data into a second steganographic carrier preselected through information steganography to obtain second steganographic information corresponding to each model structure; a storage module configured to set corresponding retrieval information for the first steganographic information corresponding to each model weight and the second steganographic information corresponding to each model structure, and store the first steganographic information corresponding to each model weight and the second steganographic information corresponding to each model structure based on a preset steganographic information directory.

16. An apparatus for processing a model, the apparatus comprising: a reconstruction request module configured to obtain a reconstruction request for a target model; a steganographic information acquisition module configured to obtain first steganographic information and second steganographic information corresponding to the target model based on a preset steganographic information directory and retrieval information of model structures and model weights corresponding to each network layer included in the target model, the first steganographic information being steganographic information corresponding to each model weight determined based on the model weight corresponding to each network layer included in the target model, a first steganographic carrier corresponding to each model weight, and a pre-trained steganographic model, the second steganographic information being steganographic information obtained by encoding each model structure included in the target model to obtain first data corresponding to each model structure and occupying a preset number of bits, and writing the first data into a second steganographic carrier preselected through information steganography; a model information acquisition module configured to determine model weights corresponding to each network layer included in the target model based on a steganographic information extraction model and the first steganographic information provided by a server in advance, and decode the second steganographic information to obtain model structures corresponding to each network layer included in the target model; a reconstruction module configured to load the model weights into the corresponding model structures to obtain a reconstructed target model, and perform service processing of a target service based on the reconstructed target model.

17. An apparatus for processing a model, the apparatus comprising: a processor; and a memory arranged to store computer-executable instructions that, when executed, cause the processor to: obtaining a target model to be protected; obtaining a model weight corresponding to each network layer contained in the target model, and obtaining a first steganographic carrier corresponding to the model weight of each network layer, determining first steganographic information corresponding to the model weight of each network layer based on the first steganographic carrier and the model weight of each network layer, and a pre-trained steganographic model, the first steganographic information being information obtained by writing the model weight into the first steganographic carrier using the steganographic model in an information steganographic manner; obtaining a model structure corresponding to each network layer contained in the target model, and performing encoding processing on the model structure corresponding to each network layer to obtain first data corresponding to the model structure of each network layer occupying a preset number of bit positions, and writing the first data into a second steganographic carrier selected in advance in an information steganographic manner to obtain second steganographic information corresponding to the model structure of each network layer; setting corresponding retrieval information for the first steganographic information corresponding to the model weight of each network layer and the second steganographic information corresponding to the model structure of each network layer, and storing the first steganographic information corresponding to the model weight of each network layer and the second steganographic information corresponding to the model structure of each network layer based on a pre-set steganographic information directory.

18. A model processing device, comprising: a processor; and a memory arranged to store computer executable instructions which, when executed, cause the processor to: obtain a reconstruction request for a target model; obtain first steganographic information and second steganographic information corresponding to the target model based on a pre-set steganographic information directory and retrieval information of a model structure and a model weight corresponding to each network layer contained in the target model, the first steganographic information being steganographic information corresponding to the model weight of each network layer determined based on the obtained model weight of each network layer and a first steganographic carrier corresponding to the model weight of each network layer, and a pre-trained steganographic model, and the second steganographic information being steganographic information obtained by performing encoding processing on the model structure corresponding to each network layer contained in the target model to obtain first data corresponding to the model structure of each network layer occupying a preset number of bit positions, and writing the first data into a second steganographic carrier selected in advance in an information steganographic manner; determine the model weight corresponding to each network layer contained in the target model based on a steganographic information extraction model and the first steganographic information provided by a server in advance, and perform decoding processing on the second steganographic information to obtain the model structure corresponding to each network layer contained in the target model; loading the model weight into the corresponding model structure to obtain a reconstructed target model, and performing service processing of a target service based on the reconstructed target model.

19. A storage medium for storing computer executable instructions, the executable instructions, when executed by a processor, implementing the following processes: obtaining a target model to be protected; obtaining the model weight corresponding to each network layer contained in the target model, and obtaining the first steganographic carrier corresponding to the model weight of each network layer; determining the first steganographic information corresponding to the model weight of each network layer based on the first steganographic carrier and the model weight of each network layer, and a pre-trained steganographic model, wherein the first steganographic information is information obtained by writing the model weight into the first steganographic carrier using the steganographic model in an information steganographic manner; obtaining the model structure corresponding to each network layer contained in the target model, and performing encoding processing on the model structure corresponding to each network layer to obtain the first data corresponding to the model structure of each network layer and occupying a preset number of bit positions, and writing the first data into a preselected second steganographic carrier in an information steganographic manner to obtain the second steganographic information corresponding to the model structure of each network layer; setting the corresponding retrieval information for the first steganographic information corresponding to the model weight of each network layer and the second steganographic information corresponding to the model structure of each network layer, and storing the first steganographic information corresponding to the model weight of each network layer and the second steganographic information corresponding to the model structure of each network layer based on a pre-set steganographic information directory.

20. A storage medium for storing computer executable instructions, which, when executed by a processor, implement the following processes: obtaining a reconstruction request for a target model; obtaining the first steganographic information and the second steganographic information corresponding to the target model based on a pre-set steganographic information directory and retrieval information of the model structure and the model weight corresponding to each network layer contained in the target model, wherein the first steganographic information is steganographic information corresponding to the model weight of each network layer determined based on the model weight of each network layer contained in the target model, the first steganographic carrier corresponding to the model weight of each network layer, and a pre-trained steganographic model, and the second steganographic information is steganographic information obtained by performing encoding processing on the model structure corresponding to each network layer contained in the target model to obtain the first data corresponding to the model structure of each network layer and occupying a preset number of bit positions, and writing the first data into a preselected second steganographic carrier in an information steganographic manner; determining the model weight corresponding to each network layer contained in the target model based on a steganographic information extraction model and the first steganographic information provided by a server in advance, and performing decoding processing on the second steganographic information to obtain the model structure corresponding to each network layer contained in the target model; loading the model weight into the corresponding model structure to obtain a reconstructed target model, and performing service processing of a target service based on the reconstructed target model.

Images