Data processing method and apparatus

Abstract

Embodiments of the present specification provide a data processing method and device, wherein the data processing method comprises receiving a data generation request for watermark data, wherein the data generation request carries watermark generation parameters and a watermark type; sending the watermark generation parameters and the watermark type to a watermark generation end, and receiving data watermark generated by the watermark generation end through a watermark generation module corresponding to the watermark type and the watermark generation parameters; generating a watermark data set based on the data watermark and a data set to be watermarked, wherein the data set to be watermarked is determined from an original data set; training a to-be-trained model based on the watermark data set and the original data set to obtain a watermark model, thereby reducing the risk of the model being stolen, and enabling the ownership of the model to be verified based on the watermark data set when the model is stolen in the future, and the interests of the owner of the model are ensured.

Description

Technical Field

[0001] The embodiments in this specification relate to the field of computer technology, and in particular to a data processing method. Background Technology

[0002] With the continuous development of artificial intelligence technology, various types of machine learning models have been developed, enabling various operations such as data detection models and image recognition models. A high-performance machine learning model requires a large amount of data assets for training during the modeling process. Therefore, machine learning models trained on data assets should be considered valuable assets by the owners of those data assets.

[0003] However, current machine learning models are at risk of being stolen, and it is difficult for the owner of a stolen model to prove ownership. Therefore, there is an urgent need to provide a method that can verify the ownership of a model and protect the interests of the model owner. Summary of the Invention

[0004] In view of the above, embodiments of this specification provide a data processing method. One or more embodiments of this specification also relate to a data processing apparatus, a data processing system, a model verification method, a model verification device, a computing device, a computer-readable storage medium, and a computer program, to address the technical deficiencies existing in the prior art.

[0005] According to a first aspect of the embodiments of this specification, a data processing method is provided, comprising:

[0006] Receive a data generation request for watermark data, wherein the data generation request carries watermark generation parameters and watermark type;

[0007] The watermark generation parameters and the watermark type are sent to the watermark generation terminal, and the data watermark generated by the watermark generation terminal through the watermark generation module corresponding to the watermark type and the watermark generation parameters is received.

[0008] A watermarked dataset is generated based on the data watermark and the dataset to be watermarked, wherein the dataset to be watermarked is determined from the original dataset.

[0009] The watermarked model is trained based on the watermarked dataset and the original dataset to obtain the watermarked model. The watermarked data in the watermarked dataset carries watermark labels, and the original data in the original dataset carries original labels.

[0010] According to a second aspect of the embodiments of this specification, a data processing system is provided, the system including a client and a watermark generation terminal, wherein...

[0011] The client is configured to receive a data generation request for watermark data, wherein the data generation request carries watermark generation parameters and watermark type, and sends the watermark generation parameters and watermark type to the watermark generation terminal.

[0012] The watermark generation terminal is configured to generate a data watermark using a watermark generation module corresponding to the watermark type and the watermark generation parameters, and then send the data watermark to the client.

[0013] The client is further configured to generate a watermarked dataset based on the data watermark and the dataset to be watermarked, wherein the dataset to be watermarked is determined from the original dataset, and a watermarked model is trained based on the watermarked dataset and the original dataset to obtain a watermarked model, wherein the watermarked data included in the watermarked dataset carries watermark labels, and the original data included in the original dataset carries original labels.

[0014] According to a third aspect of the embodiments of this specification, a data processing apparatus is provided, comprising:

[0015] The request receiving module is configured to receive a data generation request for watermark data, wherein the data generation request carries watermark generation parameters and watermark type.

[0016] The data watermark generation module is configured to send the watermark generation parameters and the watermark type to the watermark generation terminal, and receive the data watermark generated by the watermark generation terminal through the watermark generation module corresponding to the watermark type and the watermark generation parameters.

[0017] The watermark data generation module is configured to generate a watermark dataset based on the data watermark and the dataset to be watermarked, wherein the dataset to be watermarked is determined from the original dataset.

[0018] The model training module is configured to train the model to be trained based on the watermarked dataset and the original dataset to obtain a watermarked model, wherein the watermarked data included in the watermarked dataset carries watermark labels, and the original data included in the original dataset carries original labels.

[0019] According to a fourth aspect of the embodiments of this specification, a model verification method is provided, comprising:

[0020] Obtain verification data held by the data holder;

[0021] The verification data is input into the watermark model to obtain the output result of the watermark model;

[0022] If the output result matches the verification result corresponding to the verification data, the owner of the watermark model is determined to be the data holder.

[0023] According to a fifth aspect of the embodiments of this specification, a model verification apparatus is provided, comprising:

[0024] The acquisition module is configured to acquire verification data held by the data holder.

[0025] The result output module is configured to input the verification data into the watermark model and obtain the output result of the watermark model.

[0026] The verification module is configured to determine that the owner of the watermark model is the data holder if the output result is consistent with the verification result corresponding to the verification data.

[0027] According to a sixth aspect of the embodiments of this specification, a computing device is provided, comprising:

[0028] Memory and processor;

[0029] The memory is used to store computer-executable instructions, and the processor is used to execute the computer-executable instructions. When the computer-executable instructions are executed by the processor, they implement the steps of the above-described data processing method or model verification method.

[0030] According to a seventh aspect of the embodiments of this specification, a computer-readable storage medium is provided that stores computer-executable instructions, which, when executed by a processor, implement the steps of the above-described data processing method or model verification method.

[0031] According to an eighth aspect of the embodiments of this specification, a computer program is provided, wherein when the computer program is executed in a computer, it causes the computer to perform the steps of the above-described data processing method or model verification method.

[0032] An embodiment of this specification provides a data processing method comprising: receiving a data generation request for watermark data, wherein the data generation request carries watermark generation parameters and a watermark type; sending the watermark generation parameters and the watermark type to a watermark generation terminal, and receiving a data watermark generated by the watermark generation terminal through a watermark generation module corresponding to the watermark type and the watermark generation parameters; generating a watermark dataset based on the data watermark and a dataset to be watermarked, wherein the dataset to be watermarked is determined from the original dataset; training a training model based on the watermark dataset and the original dataset to obtain a watermark model, wherein the watermark data included in the watermark dataset carries watermark labels, and the original data included in the original dataset carries original labels.

[0033] Specifically, this method uses the watermark generation module to generate a data watermark at the watermark generation end, and generates a watermarked dataset based on the original dataset and the data watermark and the dataset to be watermarked. The model to be trained is then trained to obtain a model carrying watermark information, thereby reducing the risk of the model being stolen. Furthermore, if the model is subsequently stolen, the ownership of the model can be verified based on the watermarked dataset, thus protecting the interests of the model owner. Attached Figure Description

[0034] Figure 1 This is a schematic diagram of model training provided in one embodiment of this specification;

[0035] Figure 2 This is an application scenario diagram of a data processing method provided in one embodiment of this specification;

[0036] Figure 3 This is a flowchart illustrating a data processing method provided in one embodiment of this specification;

[0037] Figure 4 This is a flowchart illustrating the processing procedure of a data processing method provided in one embodiment of this specification.

[0038] Figure 5 This is a flowchart of a model verification method provided in one embodiment of this specification;

[0039] Figure 6 This is a schematic diagram of the structure of a data processing system provided in one embodiment of this specification;

[0040] Figure 7 This is a structural block diagram of a computing device provided in one embodiment of this specification. Detailed Implementation

[0041] Many specific details are set forth in the following description to provide a full understanding of this specification. However, this specification can be implemented in many other ways than those described herein, and those skilled in the art can make similar extensions without departing from the spirit of this specification. Therefore, this specification is not limited to the specific implementations disclosed below.

[0042] The terminology used in one or more embodiments of this specification is for the purpose of describing particular embodiments only and is not intended to be limiting of the one or more embodiments of this specification. The singular forms “a,” “described,” and “the” as used in one or more embodiments of this specification and the appended claims are also intended to include the plural forms unless the context clearly indicates otherwise. It should also be understood that the term “and / or” as used in one or more embodiments of this specification refers to and includes any or all possible combinations of one or more associated listed items.

[0043] It should be understood that although the terms first, second, etc., may be used to describe various information in one or more embodiments of this specification, such information should not be limited to these terms. These terms are only used to distinguish information of the same type from one another. For example, first may also be referred to as second without departing from the scope of one or more embodiments of this specification, and similarly, second may also be referred to as first. Depending on the context, the word "if" as used herein may be interpreted as "when," "when," or "in response to a determination."

[0044] First, the terms and concepts used in one or more embodiments of this specification will be explained.

[0045] Model watermarking: A method for identifying model ownership. It establishes a unique identification module by altering the training data or model structure to aid in ownership verification. Currently, three modes are offered, with three different embedded watermarking methods: noise watermarking, signature watermarking, and custom watermarking. Each watermarking module returns a watermark certificate to the participating party. Noise watermarking uses a randomly generated, fixed Gaussian distribution matrix as the watermark certificate. Signature watermarking uses a vector generated from the participating party's DID using MD5 hashing, and this vector is sent as the watermark certificate to the data owner. Finally, custom watermarking requires the data owner to send any image / data / information, which is then vectorized and used as the watermark certificate.

[0046] Decision tree: A machine learning classification and regression algorithm that splits based on the features of training data and uses the results of leaf nodes as the prediction results. In other words, this decision tree model is trained based on the distribution of data features, and it searches using a tree structure when making predictions. This tree structure consists of leaf nodes and non-leaf nodes. Leaf nodes store specific classification labels, while non-leaf nodes store the judgment conditions for features.

[0047] MD5 (MD5 Message-Digest Algorithm): A message digest algorithm, a widely used cryptographic hash function.

[0048] Watermark generation server: refers to the server that can generate watermark certificates and watermark labels.

[0049] With the continuous development of artificial intelligence technology, various types of machine learning models have been developed, enabling various operations such as data detection models and image recognition models. The modeling process of a good machine learning model requires a large amount of data assets, and the machine learning models acquired by the data owner should be considered valuable assets.

[0050] For example, see Figure 1 , Figure 1 This is a schematic diagram illustrating model training according to one embodiment of this specification; wherein the model can be a decision tree model or an ensemble learning model. See also Figure 1 Taking a decision tree model as an example, the training process is as follows: First, determine the training data for training the decision tree model, which includes training samples and sample labels. Second, train the decision tree model based on this training data. Third, deploy the trained decision tree model to a real generation environment and use it to predict production data to obtain prediction results. For example, this decision tree model can process a user's historical shopping information to determine products that match the user's preferences. The training samples can be the user's historical shopping information, and the sample labels can be products that match the user's preferences. After the trained decision tree is deployed to a shopping scenario (i.e., a generation scenario), it can input the user's historical shopping information (i.e., generated data) into the decision model to obtain products that match the user's preferences (i.e., prediction results). Note that the training samples are different from the generated data.

[0051] However, there are now many ways to steal these assets, and once the model is stolen, the original model creator will have difficulty proving ownership of the model, which will result in a loss of the model creator's interests.

[0052] Based on this, a data processing method is provided in this specification. One or more embodiments of this specification also relate to a data processing apparatus, a data processing system, a model verification method, a model verification device, a computing device, a computer-readable storage medium, and a computer program, which will be described in detail in the following embodiments.

[0053] Figure 2 The diagram illustrates an application scenario of a data processing method according to an embodiment of this specification, wherein the model can be a decision tree model or an ensemble learning model. See also... Figure 2 Taking a decision tree model as an example, the training process of this decision tree model is as follows: Based on model watermarking technology, the training data is watermarked to obtain watermarked data, which contains watermark samples and watermark labels; and the decision tree model is trained based on the watermarked data and the training samples to obtain the watermarked decision tree model (i.e., Figure 2 (Watermarking model in the model). Then, the trained watermarked decision tree model is deployed to a real generation environment. The decision tree model is used to predict the production data to obtain the prediction results. For example, after the trained decision tree is deployed to a shopping scenario (i.e., a generation scenario), the user's historical shopping information (i.e., generation data) can be input into the decision model to obtain products that meet the user's preferences (i.e., prediction results).

[0054] Furthermore, during the copyright verification process, the watermark data is input into the decision tree model, and the corresponding verification result is used. If the verification result matches the watermark label included in the watermark data, the copyright ownership of the decision tree model and the data holder of the watermark data are determined.

[0055] Based on the above, it can be seen that the data processing method provided in this specification is a model copyright protection and proof method based on decision trees. By watermarking the decision tree, the purpose of protecting the machine learning model is achieved, thereby completing the intellectual property protection of the basic decision tree model.

[0056] Figure 3 A flowchart of a data processing method according to an embodiment of this specification is shown, which specifically includes the following steps.

[0057] Step 302: Receive a data generation request for watermark data, wherein the data generation request carries watermark generation parameters and watermark type.

[0058] It should be noted that the data processing methods provided in this manual can be applied to a client, which can be a user terminal or a client program deployed on a user terminal.

[0059] The watermarked data can be understood as data containing watermark information, which can be used to train the model to be trained into a watermarked model. The watermark information can be understood as information that can be embedded in the original data to achieve data traceability; for example, the watermark information can be matrix, vector, or other similar information. In practical applications, the watermark information can be a watermarked certificate.

[0060] This data generation request can be understood as a request received by the client instructing it to generate watermark data. In practical applications, the data generation request can be sent by the watermark data requester. This watermark data requester can be any party that needs to obtain the watermark data; for example, it could be a user, the original data holder, another client, a server, etc. This specification does not impose specific limitations on this.

[0061] The watermark type can be understood as the type of data watermark generated. It's important to note that this data watermark can be generated in different ways, such as noise watermarks, signature watermarks, and custom watermarks. Data watermarks generated through different methods have different watermark types. For example, a data watermark generated using the noise watermark method is of the noise watermark type; a data watermark generated using the signature watermark method is of the signature watermark type.

[0062] The watermark generation parameters can be understood as the parameters required during the data watermark generation process. For example, in generating a data watermark using a noise watermarking method, a random number and a noise magnitude parameter representing the noise level are needed. The subsequent noise watermarking method can then generate a noise watermark based on this random number and noise magnitude parameter. Therefore, the random number and noise magnitude parameter can be watermark generation parameters. Alternatively, the custom watermark might require the data owner to send any image / data / information, which is then vectorized as a watermark certificate. Therefore, this arbitrary image / data / information can be a watermark generation parameter. Correspondingly, the type of data watermark reviewed based on the custom watermarking method is the custom watermark type.

[0063] In one embodiment provided in this specification, in order to subsequently protect the copyright of the model, a portion of the training data is selected as watermark data, and this watermark data is subsequently processed into watermark data. Specifically, before receiving the data generation request for the watermark data, the process further includes:

[0064] Receive a data selection request for the original dataset, wherein the data selection request carries data parameters of the data to be watermarked;

[0065] Based on the data parameters, the data to be watermarked is selected from the original dataset, and the dataset to be watermarked is constructed based on the data to be watermarked.

[0066] Here, the original dataset can be understood as the training dataset used to train the model to be trained, that is, the data asset in the above embodiment. For example, the original data can be user's historical shopping data, animal image data, or other data that can be used to train the model.

[0067] This data selection request can be understood as an instruction to the client to select data to be watermarked from the original dataset; the data to be watermarked can be understood as the original training data that needs to have watermark information embedded. The data parameter can be understood as the number of data items to be watermarked.

[0068] For example, when the client receives a data selection request for the training dataset from the source data provider, it responds to the data selection request and randomly selects 100 training data from the sample dataset as the watermark training data according to the number of training data to be watermarked (e.g., 100) carried in the data selection request.

[0069] Furthermore, in the embodiments provided in this specification, in order to ensure the security of the watermarked data and improve its performance, the watermark generation end can select the data to be watermarked. Specifically, selecting the data to be watermarked from the original dataset based on the data parameters includes:

[0070] Based on the data parameters, the data identifier corresponding to the data to be watermarked is obtained from the watermark generation end;

[0071] The original data in the original dataset that corresponds to the data identifier is determined as the data to be watermarked.

[0072] Here, the data identifier can be understood as information that uniquely identifies a piece of training data, such as the name, number, sequence number, ID, etc. of the training data. In practical applications, the data identifier can serve as a data index for the original data.

[0073] The watermark generator can be understood as a server that can generate data watermarks.

[0074] Specifically, the client obtains the data identifier corresponding to the data parameters of the data to be watermarked from the watermark generation end based on the data parameters, and determines the original data corresponding to the data identifier from the original dataset based on the data identifier, and uses the original data as the data to be watermarked.

[0075] In the embodiments provided in this specification, the watermark generator determines the data identifier by means of obtaining the data identifier corresponding to the data to be watermarked from the watermark generator based on the data parameters, including:

[0076] Based on the amount of data and the dataset identifier of the original dataset, a data index determination request is generated and sent to the watermark generation end.

[0077] The watermark generator receives the data index corresponding to the data to be watermarked, wherein the data index is an index randomly obtained by the watermark generator from the dataset index corresponding to the dataset identifier based on the data quantity.

[0078] Here, the dataset identifier can be understood as a parameter that uniquely identifies a dataset; the dataset index can be understood as an index for querying the original data in the original dataset.

[0079] Specifically, the client will generate a data index determination request based on the amount of data and the dataset identifier of the original dataset, and send the data index determination request to the watermark generation end; upon receiving the data index determination request, the watermark generation end will respond to the data index determination request by determining the dataset index corresponding to the dataset identifier from the dataset index it holds, randomly selecting the data index corresponding to the amount of data from the dataset index, and sending the data index to the client.

[0080] Step 304: Send the watermark generation parameters and the watermark type to the watermark generation terminal, and receive the data watermark generated by the watermark generation terminal through the watermark generation module corresponding to the watermark type and the watermark generation parameters.

[0081] The watermark generation module can be understood as different types of watermarking methods, such as noise watermarks, signature watermarks, and custom watermarks.

[0082] Specifically, the client sends the watermark generation parameters and the watermark type to the watermark generation terminal. Upon receiving these parameters, the watermark generation terminal identifies the appropriate watermark generation module from its pool of various types. Then, based on the parameters, it generates the corresponding data watermark using that module. For example, if the watermark generation module uses a signature-based watermark, the parameter can be a random number. This random number is then processed using MD5 to generate a vector, which is sent to the client as a watermark certificate. Alternatively, if the watermark generation module uses a custom watermark, the parameter can be an arbitrary image. This arbitrary image is then vectorized to obtain a vector, which is sent to the client as a watermark certificate.

[0083] In one embodiment of this specification, the data watermark includes watermark information and a watermark tag. Therefore, during the process of generating the data watermark through the watermark generation terminal, the watermark generation parameters, watermark type, and the tag corresponding to the data to be watermarked need to be sent to the watermark generation terminal for watermarking processing to obtain the data watermark. This allows the copyright ownership of the trained model to be guaranteed based on the data watermark. Specifically, the watermark generation parameters and the watermark type are sent to the watermark generation terminal, and the data watermark generated by the watermark generation terminal through the watermark generation module corresponding to the watermark type and the watermark generation parameters is received, including:

[0084] The original tags corresponding to the data to be watermarked are determined as the tags to be processed;

[0085] The watermark generation parameters, the watermark type, and the tag to be processed are used to generate a watermark processing request, and the watermark processing request is sent to the watermark generation terminal.

[0086] The watermark generation terminal receives a data watermark generated by a watermark generation module corresponding to the watermark type, based on the watermark generation parameters. The data watermark contains watermark information and a watermark tag obtained by watermarking the tag to be processed through the watermark generation module.

[0087] The watermarked label obtained by the watermark generation module through watermarking the label to be processed can be understood as modifying the sample label through watermarking to obtain the watermarked label. Modifications to the sample label include, but are not limited to, enlarging or shrinking the sample label (numerical type), for example, enlarging the sample label (0) to 100; and modifying the content of the sample label, for example, changing the sample label (cat) to "cow", etc.

[0088] Specifically, the client determines the original tag corresponding to the data to be watermarked as the tag to be processed, and generates a watermark processing request with the watermark generation parameters, the watermark type and the tag to be processed, and sends the watermark processing request to the watermark generation end.

[0089] In response to the watermark processing request, the watermark generator obtains the watermark generation parameters and watermark type from the request. Then, from its pool of various watermark generation modules, it determines the watermark generation module corresponding to the specified watermark type. Based on the watermark generation parameters, it generates the corresponding watermark information using that module. Furthermore, it uses the watermark generation module to perform watermarking on the tag to be processed, obtaining a watermark tag, and then sends the watermark information and the watermark tag as a data watermark to the client.

[0090] Step 306: Generate a watermarked dataset based on the data watermark and the dataset to be watermarked, wherein the dataset to be watermarked is determined from the original dataset.

[0091] Specifically, the client merges the data watermark with the data to be watermarked in the dataset to be watermarked to obtain the watermark data, and then constructs the watermark dataset based on the watermark data.

[0092] In one embodiment provided in this specification, the process of fusing the data watermark with the data to be watermarked specifically includes generating a watermark dataset based on the data watermark and the dataset to be watermarked, comprising:

[0093] Determine the watermark information and watermark label contained in the data watermark;

[0094] The watermark information is fused with the watermark data in the dataset to be watermarked to obtain the watermark data;

[0095] A watermark dataset is constructed based on the watermark data and the watermark label.

[0096] The process of fusing the watermark information with the watermark data in the dataset to be watermarked to obtain the watermark data can be understood as fusing the watermark information (e.g., a matrix) with the watermark data (e.g., a matrix) by adding or subtracting them, and using the fused matrix as the watermark data.

[0097] Specifically, after receiving the data watermark, the client can obtain the watermark information and watermark tag contained in the data watermark; it can then merge the watermark tag with the data to be watermarked in the dataset to be watermarked to obtain the watermark data; and finally, it can use the watermark tag as the tag corresponding to the watermark data.

[0098] In the embodiments provided in this specification, during the process of fusing the watermark information with the data to be watermarked, since the watermark information can be generated through different types of watermarking methods, in order to ensure the smooth fusion of the watermark information and the data to be watermarked, it is necessary to pre-determine corresponding fusion strategies for different types of watermarking methods. Based on these fusion strategies, different types of watermark information can be smoothly fused with the data to be watermarked. Specifically, fusing the watermark information with the data to be watermarked in the dataset to obtain watermarked data includes:

[0099] Determine the data fusion strategy corresponding to the watermark type, and based on the data fusion strategy, fuse the watermark information with the data to be watermarked in the dataset to be watermarked to obtain watermark data.

[0100] The data fusion strategy includes, but is not limited to, addition, multiplication, and replacement (such as replacing the data to be watermarked with watermark information to obtain watermark data), etc.

[0101] Following the previous example, when the watermark type is a noise watermark, the data fusion strategy can be addition. Based on this, in the process of fusing the watermark information with the data to be watermarked, the watermark data (e.g., a matrix) can be added to the data to be watermarked (e.g., a matrix) to obtain the watermark data.

[0102] It should be noted that during the process of merging watermark information with the data to be watermarked, there may be cases where the structure (e.g., width and height) of the watermark data (e.g., a matrix) does not match the structure (e.g., width and height) of the data to be watermarked. Therefore, during the merging process, the watermark information needs to be adjusted based on the structural information of the data to be watermarked to obtain watermark information that matches the data to be watermarked. Then, the data to be watermarked and the matching watermark information are merged to obtain the watermark data.

[0103] Step 308: Train the model to be trained based on the watermarked dataset and the original dataset to obtain the watermarked model.

[0104] The watermarked data in the watermarked dataset carries watermark labels, and the original data in the original dataset carries original labels.

[0105] It should be noted that the training method for the model to be trained based on the watermarked dataset and the original dataset can be any method of training the model using sample data, and this specification does not impose any specific restrictions on this.

[0106] This watermarking model can be understood as a model trained using watermark data. The copyright ownership of this watermarking model can then be verified based on this watermark data.

[0107] In the data processing method provided in this specification, considering that although model watermarking technology can provide a relatively secure copyright proof mechanism for model owners, watermarking mechanisms are mostly applied to deep neural network models, while there is a relative lack of protection mechanisms for ensemble learning models or decision tree models widely used in other financial fields, this specification proposes a watermarking mechanism for ensemble learning models or decision tree models to further protect the ownership of these models. Specifically, the step of training the model to be trained based on the watermarked dataset and the original dataset to obtain the watermarked model includes:

[0108] The decision tree model is trained based on the watermarked dataset and the original dataset to obtain the watermarked decision tree model.

[0109] It should be noted that the decision tree model can be trained using any method that trains the decision tree model with sample data, based on the watermarked dataset and the original dataset. This document does not impose any specific restrictions on this method.

[0110] Furthermore, in one embodiment provided in this specification, after training and obtaining the watermark model, when it is necessary to verify the ownership of the watermark model, ownership verification is performed using the watermark data and the corresponding watermark label to ensure that the watermark model is not at risk of being stolen. Specifically, the watermark data is used as verification data, and the watermark label corresponding to the watermark data is used as the verification result; the verification data is input into the watermark model to obtain the output result of the watermark model; if the output result is consistent with the verification result corresponding to the verification data, the owner of the watermark model is determined to be the data holder.

[0111] It should be noted that for the verification of ownership of the watermark model through watermark data, please refer to the following section on model verification methods, which will not be elaborated upon here.

[0112] The data processing method provided in this specification generates a data watermark using the watermark generation module at the watermark generation end. Based on the original dataset and a watermarked dataset generated using the data watermark and the dataset to be watermarked, the model to be trained is trained to obtain a model carrying watermark information. This reduces the risk of the model being stolen and enables the verification of the model's ownership based on the watermarked dataset in the event of the model being stolen, thereby protecting the interests of the model owner.

[0113] The following is in conjunction with the appendix Figure 4Taking the application of the data processing method provided in this specification in the scenario of protecting the copyright of a decision tree model as an example, the data processing method will be further explained. Figure 4 This specification shows a flowchart of a data processing method according to an embodiment. It should be noted that... Figure 4 The server in this example is the watermark generator, and the source data provider can be the data holder, data owner, or watermark data requester. Specifically, it includes the following steps.

[0114] Step 402: Determine the number of watermark samples.

[0115] Specifically, the source data provider sends the client the number of watermark samples to be generated (10), which must be less than the total amount of training data.

[0116] Step 404: Send the number of watermark samples.

[0117] Specifically, the client sends the number of watermarked samples (10) sent by the source data provider, as well as the identifier of the source data (i.e., training samples) provided by the source data provider, to the server.

[0118] Step 406: Randomly generate the corresponding number of sample indices.

[0119] Specifically, based on this identifier, the server determines the training sample index provided by the source data provider and randomly selects 10 sample indices from the training sample index.

[0120] It should be noted that this server only stores the training sample indexes provided by the source data provider; the training samples themselves do not exist. Furthermore, sample indexes can be duplicated.

[0121] Step 408: Return to index.

[0122] Specifically, the server returns the indexes of these 10 samples to the client.

[0123] Step 410: Retrieve the corresponding data based on the index.

[0124] Specifically, the client determines the sample corresponding to the 10 sample indices from the locally stored samples based on the 10 sample indices, and uses the sample as the watermark sample.

[0125] Step 412: Send the watermarking method and watermark model parameters.

[0126] Specifically, the client receives the watermarking method and watermarking model parameters from the source data provider, and then sends the watermarking method and watermarking model parameters to the server; at the same time, the sample label corresponding to the sample to be watermarked is sent to the server.

[0127] The watermarking method can be understood as the watermark type in the above embodiments, and the watermark model parameters can be understood as the watermark generation parameters in the above embodiments.

[0128] Step 414: Generate watermark.

[0129] Specifically, on the server side, from among the various watermarking methods embedded within itself, it determines the watermarking method specified by the source data provider, and uses this watermarking method to generate a watermark certificate based on the watermark model parameters. It then uses this watermarking method to process the sample tags to obtain the watermarked tags.

[0130] Step 416: Return the watermark.

[0131] Specifically, the server sends the watermark certificate and watermark label to the client.

[0132] Step 418: Obtain the source data that will be watermarked by combining the index of the watermark data.

[0133] Specifically, the client retrieves the samples to be watermarked from the locally stored training samples based on the 10 sample indices.

[0134] Step 420: Merge the watermarked source data and the watermark to generate watermarked data.

[0135] Specifically, the watermark sample and the watermark certificate are merged to obtain watermark data, and the watermark label is used as the label for the watermark data.

[0136] Step 422: Return the watermark data file.

[0137] Specifically, the client returns the watermark data and its corresponding watermark label to the source data provider for storage. Subsequently, the source data provider can use the watermark data and corresponding watermark label to train a decision tree model, obtaining a watermarked decision tree model.

[0138] Based on the above steps, the data processing method provided in this manual involves providing a corresponding number of watermarked data points n, randomly sampling n data points without re-sampling, and generating a watermark certificate for each sampled data vector by the user choosing a watermarking method. The data is then watermarked, and finally, the watermarked data is packaged together with the original data to train the decision tree model. After training, the corresponding watermarked model can be obtained.

[0139] The data processing method provided in this manual takes into account that most model watermarking is currently applicable to deep neural network models and has no specific protective effect on decision tree or ensemble learning models. Therefore, watermarking decision trees to protect machine learning models can complete the intellectual property protection of the basic decision tree model, ensure the interests of the model owner, and learn directly from the decision tree model without exposing any privacy.

[0140] The system generates watermark data and watermark labels on the server side, and uses these watermark data and watermark labels to train the decision tree model, thereby reducing the risk of the model being stolen. Furthermore, it enables the system to verify the ownership of the model based on the watermark data should the model be stolen in the future.

[0141] Figure 5 A flowchart of a model verification method according to an embodiment of this specification is shown, which specifically includes the following steps.

[0142] Step 502: Obtain the verification data held by the data holder.

[0143] Step 504: Input the verification data into the watermark model and obtain the output result of the watermark model.

[0144] Step 506: If the output result is consistent with the verification result corresponding to the verification data, determine that the owner of the watermark model is the data holder.

[0145] Here, the data holder can be understood as the organization or individual holding the verification data; the verification data can be understood as data capable of verifying the ownership of the watermark model, that is, data capable of verifying the copyright ownership of the watermark model; the verification data can be understood as the watermark data obtained in the above embodiment. Correspondingly, the verification result corresponding to the verification data can be understood as the watermark label corresponding to the watermark data. It should be noted that the verification data and the verification result can have a unique correspondence.

[0146] Specifically, in the process of verifying the ownership of a watermark model, it is necessary to obtain the verification data held by the data holder and input it into the watermark model to be verified. The watermark model then processes the verification data and outputs a result. Next, the output result is matched against the verification result corresponding to the verification data. If the output result matches the verification result corresponding to the verification data, the owner of the watermark model is determined to be the data holder. Conversely, if the output result does not match the verification result corresponding to the verification data, the owner of the watermark model is determined not to be the data holder.

[0147] It should be noted that the watermark data is the model obtained by training the watermark data and the corresponding watermark label in the above data processing method.

[0148] For example, the watermarking model is a decision tree model, the verification data is the watermark data used to train the decision tree model, and the verification result is the watermark label corresponding to the watermark data. Based on this, after training the decision tree model using the watermark data and watermark label, the model trainer will hold and save the watermark data and the corresponding watermark label.

[0149] When the model trainer (i.e., the data holder) believes their trained decision tree model has been stolen, they input their stored watermarked data into the suspected stolen model to obtain its input structure. Then, they perform a consistency match between the output and the watermark label corresponding to the watermarked data. If the output matches the watermark label, the ownership of the decision tree model is determined to belong to the model trainer, and the model has been stolen. If the output does not match the watermark label, the ownership of the decision tree model does not belong to the model trainer.

[0150] The model verification method provided in this specification determines the owner of the watermark model as the data holder by inputting the verification data held by the data holder into the watermark model and confirming that the output of the watermark model matches the verification result corresponding to the verification data. This enables the verification of the model's ownership based on the watermark dataset in the event of model theft, thereby protecting the interests of the model owner.

[0151] Figure 6 This diagram illustrates the structure of a data processing system according to an embodiment of this specification. The system includes a client 602 and a watermark generation terminal 604, wherein...

[0152] The client 602 is configured to receive a data generation request for watermark data, wherein the data generation request carries watermark generation parameters and watermark type, and sends the watermark generation parameters and watermark type to the watermark generation terminal 604.

[0153] The watermark generation terminal 604 is configured to generate a data watermark through a watermark generation module corresponding to the watermark type and the watermark generation parameters, and send the data watermark to the client 602.

[0154] The client 602 is further configured to generate a watermarked dataset based on the data watermark and the dataset to be watermarked, wherein the dataset to be watermarked is determined from the original dataset, and a model to be trained is trained based on the watermarked dataset and the original dataset to obtain a watermarked model, wherein the watermarked data included in the watermarked dataset carries a watermark label, and the original data included in the original dataset carries an original label.

[0155] It should be noted that for explanations of this data processing system, please refer to the data processing method and model validation method described above; this specification will not elaborate further. The technical solution of this data processing system shares the same concept as the technical solutions of the aforementioned data processing method and model training method. Details not described in detail in the technical solution of the data processing system can be found in the descriptions of the technical solutions of the aforementioned data processing method and model training method.

[0156] The data processing system provided in this manual generates a data watermark using the watermark generation module at the watermark generation end. The client then uses the original dataset, the watermarked dataset, and the dataset to be watermarked to generate a watermarked dataset to train the training model, thereby obtaining a model carrying watermarked information. This reduces the risk of the model being stolen and enables the verification of the model's ownership based on the watermarked dataset should the model be stolen in the future, thus protecting the interests of the model owner.

[0157] Corresponding to the above method embodiments, this specification also provides a data processing apparatus embodiment, which includes:

[0158] The request receiving module is configured to receive a data generation request for watermark data, wherein the data generation request carries watermark generation parameters and watermark type.

[0159] The data watermark generation module is configured to send the watermark generation parameters and the watermark type to the watermark generation terminal, and receive the data watermark generated by the watermark generation terminal through the watermark generation module corresponding to the watermark type and the watermark generation parameters.

[0160] The watermark data generation module is configured to generate a watermark dataset based on the data watermark and the dataset to be watermarked, wherein the dataset to be watermarked is determined from the original dataset.

[0161] The model training module is configured to train the model to be trained based on the watermarked dataset and the original dataset to obtain a watermarked model, wherein the watermarked data included in the watermarked dataset carries watermark labels, and the original data included in the original dataset carries original labels.

[0162] Optionally, the data processing device further includes a data to be watermarked determination module, configured to:

[0163] Receive a data selection request for the original dataset, wherein the data selection request carries data parameters of the data to be watermarked;

[0164] Based on the data parameters, the data to be watermarked is selected from the original dataset, and the dataset to be watermarked is constructed based on the data to be watermarked.

[0165] Optionally, the module for determining the data to be watermarked is further configured to:

[0166] Based on the data parameters, the data identifier corresponding to the data to be watermarked is obtained from the watermark generation end;

[0167] The original data in the original dataset that corresponds to the data identifier is determined as the data to be watermarked.

[0168] Optionally, the module for determining the data to be watermarked is further configured to:

[0169] Based on the amount of data and the dataset identifier of the original dataset, a data index determination request is generated and sent to the watermark generation end.

[0170] The watermark generator receives the data index corresponding to the data to be watermarked, wherein the data index is an index randomly obtained by the watermark generator from the dataset index corresponding to the dataset identifier based on the data quantity.

[0171] Optionally, the data watermark generation module is further configured to:

[0172] The original tags corresponding to the data to be watermarked are determined as the tags to be processed;

[0173] The watermark generation parameters, the watermark type, and the tag to be processed are used to generate a watermark processing request, and the watermark processing request is sent to the watermark generation terminal.

[0174] The watermark generation terminal receives a data watermark generated by a watermark generation module corresponding to the watermark type, based on the watermark generation parameters. The data watermark contains watermark information and a watermark tag obtained by watermarking the tag to be processed through the watermark generation module.

[0175] Optionally, the watermark data generation module is further configured to:

[0176] Determine the watermark information and watermark label contained in the data watermark;

[0177] The watermark information is fused with the watermark data in the dataset to be watermarked to obtain the watermark data;

[0178] A watermark dataset is constructed based on the watermark data and the watermark label.

[0179] Optionally, the watermark data generation module is further configured to:

[0180] Determine the data fusion strategy corresponding to the watermark type, and based on the data fusion strategy, fuse the watermark information with the data to be watermarked in the dataset to be watermarked to obtain watermark data.

[0181] Optionally, the model training module is further configured to:

[0182] The decision tree model is trained based on the watermarked dataset and the original dataset to obtain the watermarked decision tree model.

[0183] The data processing device provided in this specification generates a data watermark using the watermark generation module at the watermark generation end. Based on the original dataset and the watermarked dataset, a watermarked dataset is generated using the watermark and the dataset to be watermarked. The device is then used to train the training model, thereby obtaining a model carrying watermark information. This reduces the risk of the model being stolen and enables the verification of the model's ownership based on the watermarked dataset should the model be stolen in the future, thus protecting the interests of the model owner.

[0184] The above is an illustrative scheme of a data processing apparatus according to this embodiment. It should be noted that the technical solution of this data processing apparatus and the technical solution of the data processing method described above belong to the same concept. For details not described in detail in the technical solution of the data processing apparatus, please refer to the description of the technical solution of the data processing method described above.

[0185] Corresponding to the above method embodiments, this specification also provides embodiments of a model verification apparatus, which includes:

[0186] The acquisition module is configured to acquire verification data held by the data holder.

[0187] The result output module is configured to input the verification data into the watermark model and obtain the output result of the watermark model.

[0188] The verification module is configured to determine that the owner of the watermark model is the data holder if the output result is consistent with the verification result corresponding to the verification data.

[0189] The model verification device provided in this specification determines the owner of the watermark model as the data holder by inputting verification data held by the data holder into the watermark model and confirming that the output of the watermark model matches the verification result corresponding to the verification data. This enables the verification of the model's ownership based on the watermark dataset in the event of the model being stolen, thereby protecting the interests of the model owner.

[0190] The above is a schematic scheme of a model verification device according to this embodiment. It should be noted that the technical solution of this model verification device and the technical solution of the model verification method described above belong to the same concept. For details not described in detail in the technical solution of the model verification device, please refer to the description of the technical solution of the model verification method described above.

[0191] Figure 7 A structural block diagram of a computing device 700 according to one embodiment of this specification is shown. The components of the computing device 700 include, but are not limited to, a memory 710 and a processor 720. The processor 720 is connected to the memory 710 via a bus 730, and a database 750 is used to store data.

[0192] The computing device 700 also includes an access device 740, which enables the computing device 700 to communicate via one or more networks 760. Examples of these networks include a Public Switched Telephone Network (PSTN), a Local Area Network (LAN), a Wide Area Network (WAN), a Personal Area Network (PAN), or a combination of communication networks such as the Internet. The access device 740 may include one or more of any type of wired or wireless network interface (e.g., a Network Interface Card (NIC)), such as an IEEE 802.11 Wireless Local Area Network (WLAN) interface, a Wi-MAX interface, an Ethernet interface, a Universal Serial Bus (USB) interface, a cellular network interface, a Bluetooth interface, a Near Field Communication (NFC) interface, and so on.

[0193] In one embodiment of this specification, the above-described components of the computing device 700 and Figure 7 Other components, not shown, can also be connected to each other, for example, via a bus. It should be understood that... Figure 7 The block diagram of the computing device shown is for illustrative purposes only and is not intended to limit the scope of this specification. Those skilled in the art can add or replace other components as needed.

[0194] The computing device 700 can be any type of stationary or mobile computing device, including mobile computers or mobile computing devices (e.g., tablet computers, personal digital assistants, laptop computers, notebook computers, netbooks, etc.), mobile phones (e.g., smartphones), wearable computing devices (e.g., smartwatches, smart glasses, etc.) or other types of mobile devices, or stationary computing devices such as desktop computers or PCs. The computing device 700 can also be a mobile or stationary server.

[0195] The processor 720 is configured to execute the following computer-executable instructions, which, when executed by the processor, implement the steps of the aforementioned data processing method or model verification method.

[0196] The above is an illustrative scheme of a computing device according to this embodiment. It should be noted that the technical solution of this computing device belongs to the same concept as the technical solutions of the data processing method and the model verification method described above. For details not described in detail in the technical solution of the computing device, please refer to the description of the technical solutions of the data processing method and the model verification method described above.

[0197] An embodiment of this specification also provides a computer-readable storage medium storing computer-executable instructions that, when executed by a processor, implement the steps of the above-described data processing method or model verification method.

[0198] The above is an illustrative scheme of a computer-readable storage medium according to this embodiment. It should be noted that the technical solution of this storage medium belongs to the same concept as the technical solutions of the data processing method and the model verification method described above. For details not described in detail in the technical solution of the storage medium, please refer to the description of the technical solutions of the data processing method and the model verification method described above.

[0199] An embodiment of this specification also provides a computer program, wherein when the computer program is executed in a computer, it causes the computer to perform the steps of the above-described data processing method or model verification method.

[0200] The above is an illustrative example of a computer program according to this embodiment. It should be noted that the technical solution of this computer program belongs to the same concept as the technical solutions of the data processing method and the model verification method described above. Details not described in detail in the technical solution of the computer program can be found in the descriptions of the technical solutions of the data processing method and the model verification method described above.

[0201] The foregoing has described specific embodiments of this specification. Other embodiments are within the scope of the appended claims. In some cases, the actions or steps recited in the claims may be performed in a different order than that shown in the embodiments and may still achieve the desired result. Furthermore, the processes depicted in the drawings do not necessarily require the specific or sequential order shown to achieve the desired result. In some embodiments, multitasking and parallel processing are possible or may be advantageous.

[0202] The computer instructions include computer program code, which may be in the form of source code, object code, executable file, or some intermediate form. The computer-readable medium may include: any entity or device capable of carrying the computer program code, recording media, USB flash drive, portable hard drive, magnetic disk, optical disk, computer memory, read-only memory (ROM), random access memory (RAM), electrical carrier signals, telecommunication signals, and software distribution media, etc. It should be noted that the content included in the computer-readable medium may be appropriately added to or subtracted according to the requirements of legislation and patent practice in the jurisdiction. For example, in some jurisdictions, according to legislation and patent practice, computer-readable media may not include electrical carrier signals and telecommunication signals.

[0203] It should be noted that, for the sake of simplicity, the foregoing method embodiments are all described as a series of actions. However, those skilled in the art should understand that the embodiments in this specification are not limited to the described order of actions, because according to the embodiments in this specification, some steps can be performed in other orders or simultaneously. Furthermore, those skilled in the art should also understand that the embodiments described in this specification are all preferred embodiments, and the actions and modules involved are not necessarily essential to the embodiments in this specification.

[0204] In the above embodiments, the descriptions of each embodiment have different focuses. For parts not described in detail in a certain embodiment, please refer to the relevant descriptions in other embodiments.

[0205] The preferred embodiments disclosed above are merely illustrative of this specification. The optional embodiments do not exhaustively describe all details, nor do they limit the invention to the specific implementations described. Clearly, many modifications and variations can be made based on the embodiments described herein. These embodiments are selected and specifically described in this specification to better explain the principles and practical applications of the embodiments, thereby enabling those skilled in the art to better understand and utilize this specification. This specification is limited only by the claims and their full scope and equivalents.

Claims

1. A data processing method, comprising: Receive a data generation request for watermark data, wherein the data generation request carries watermark generation parameters, watermark type and a tag to be processed, and the tag to be processed is the original tag corresponding to the watermark data; The watermark generation parameters and the watermark type are sent to the watermark generation terminal, and the data watermark generated by the watermark generation terminal is received. The data watermark is generated by the watermark generation terminal based on the watermark generation parameters through a watermark generation module corresponding to the watermark type. The data watermark contains watermark information and a watermark label obtained by watermarking the label to be processed through the watermark generation module. The watermark generation terminal does not store training samples. A watermarked dataset is generated based on the data watermark and the dataset to be watermarked, wherein the dataset to be watermarked is determined from the original dataset; determining the dataset to be watermarked from the original dataset includes: the client generating a data index determination request and sending the data index determination request to the watermark generation end; the watermark generation end receiving and responding to the data index determination request, determining the dataset index corresponding to the dataset identifier of the original dataset from its own dataset index, selecting the data index corresponding to the data parameter from the dataset index, and sending the data index to the client; the client determining the original data in the original dataset corresponding to the data index as the data to be watermarked, and constructing the dataset to be watermarked based on the data to be watermarked; the data parameter is the number of data to be watermarked, and the dataset identifier is a parameter that uniquely identifies a dataset; generating the watermarked dataset based on the data watermark and the dataset to be watermarked includes: determining the data fusion strategy corresponding to the watermark type, fusing the watermark information with the data to be watermarked in the dataset to be watermarked based on the data fusion strategy to obtain watermarked data; and constructing the watermarked dataset based on the watermarked data and the watermark label. The watermark model is trained based on the watermarked dataset and the original dataset to obtain the watermark model. The watermarked data in the watermarked dataset carries watermark labels, and the original data in the original dataset carries original labels. The watermark model includes a decision tree model.

2. The data processing method according to claim 1, further comprising, before receiving the data generation request for the watermark data: Receive a data selection request for the original dataset, wherein the data selection request carries data parameters of the data to be watermarked; Based on the data parameters, the data to be watermarked is selected from the original dataset, and the dataset to be watermarked is constructed based on the data to be watermarked.

3. The data processing method according to claim 2, wherein selecting the data to be watermarked from the original dataset based on the data parameters includes: Based on the data parameters, the data identifier corresponding to the data to be watermarked is obtained from the watermark generation end; The original data in the original dataset that corresponds to the data identifier is determined as the data to be watermarked.

4. The data processing method according to claim 3, wherein obtaining the data identifier corresponding to the data to be watermarked from the watermark generation end based on the data parameters includes: Based on the amount of data and the dataset identifier of the original dataset, a data index determination request is generated and sent to the watermark generation terminal. The watermark generator receives the data index corresponding to the data to be watermarked, wherein the data index is an index randomly obtained by the watermark generator from the dataset index corresponding to the dataset identifier based on the data quantity.

5. The data processing method according to claim 2, comprising sending the watermark generation parameters and the watermark type to the watermark generation terminal, and receiving the data watermark generated by the watermark generation terminal through the watermark generation module corresponding to the watermark type and the watermark generation parameters, including: The original tags corresponding to the data to be watermarked are determined as the tags to be processed; The watermark generation parameters, the watermark type, and the tag to be processed are used to generate a watermark processing request, and the watermark processing request is sent to the watermark generation terminal. The watermark generation terminal receives a data watermark generated by a watermark generation module corresponding to the watermark type, based on the watermark generation parameters. The data watermark contains watermark information and a watermark tag obtained by watermarking the tag to be processed through the watermark generation module.

6. The data processing method according to claim 1, wherein generating a watermark dataset based on the data watermark and the dataset to be watermarked comprises: Determine the watermark information and watermark label contained in the data watermark; The watermark information is fused with the watermark data in the dataset to be watermarked to obtain the watermark data; A watermark dataset is constructed based on the watermark data and the watermark label.

7. The data processing method according to claim 1, wherein training the model to be trained based on the watermark dataset and the original dataset to obtain the watermark model includes: The decision tree model is trained based on the watermarked dataset and the original dataset to obtain the watermarked decision tree model.

8. A model validation method, comprising: Obtain verification data held by the data holder, wherein the verification data is watermark data obtained by the data processing method described in claim 1; The verification data is input into the watermark model to obtain the output result of the watermark model; If the output result matches the verification result corresponding to the verification data, the owner of the watermark model is determined to be the data holder, and the verification result is the watermark label corresponding to the watermark data.

9. A data processing system, the system comprising a client and a watermark generation terminal, wherein, The client is configured to receive a data generation request for watermark data, wherein the data generation request carries watermark generation parameters, watermark type and a tag to be processed, the tag to be processed is the original tag corresponding to the watermark data, and sends the watermark generation parameters and the watermark type to the watermark generation end. The watermark generation terminal is configured to generate a data watermark based on the watermark generation parameters using a watermark generation module corresponding to the watermark type, and send the data watermark to the client; the data watermark includes watermark information and a watermark tag obtained by watermarking the tag to be processed using the watermark generation module; the watermark generation terminal does not store training samples. The client is further configured to generate a watermarked dataset based on the data watermark and the dataset to be watermarked, wherein the dataset to be watermarked is determined from the original dataset; determining the dataset to be watermarked from the original dataset includes: the client generating a data index determination request and sending the data index determination request to the watermark generation end; the watermark generation end receiving and responding to the data index determination request, determining the dataset index corresponding to the dataset identifier of the original dataset from its own dataset index, selecting the data index corresponding to the data parameters from the dataset index, and sending the data index to the client; the client determining the original data in the original dataset corresponding to the data index as the data to be watermarked, and constructing a watermarked dataset based on the data to be watermarked. The data set to be watermarked is described; the data parameter is the number of data sets to be watermarked, and the dataset identifier is a parameter that uniquely identifies a dataset; the process of generating a watermarked dataset based on the data watermark and the data set to be watermarked includes: determining a data fusion strategy corresponding to the watermark type; fusing the watermark information with the data set to be watermarked in the data set to be watermarked based on the data fusion strategy to obtain watermarked data; constructing a watermarked dataset based on the watermarked data and the watermark label; training a training model based on the watermarked dataset and the original dataset to obtain a watermarked model, wherein the watermarked data included in the watermarked dataset carries watermark labels, and the original data included in the original dataset carries original labels; the watermarked model includes a decision tree model.

10. A data processing apparatus, comprising: The request receiving module is configured to receive a data generation request for watermark data, wherein the data generation request carries watermark generation parameters, watermark type and a tag to be processed, and the tag to be processed is the original tag corresponding to the watermark data. A data watermark generation module is configured to send the watermark generation parameters and the watermark type to a watermark generation terminal, and receive a data watermark generated by the watermark generation terminal. The data watermark is generated by the watermark generation terminal based on the watermark generation parameters through a watermark generation module corresponding to the watermark type. The data watermark includes watermark information and a watermark label obtained by watermarking the label to be processed through the watermark generation module. The watermark generation terminal does not store training samples. A watermark data generation module is configured to generate a watermark dataset based on the data watermark and the dataset to be watermarked, wherein the dataset to be watermarked is determined from the original dataset; determining the dataset to be watermarked from the original dataset includes: the client generating a data index determination request and sending the data index determination request to the watermark generation terminal; the watermark generation terminal receiving and responding to the data index determination request, determining the dataset index corresponding to the dataset identifier of the original dataset from its own dataset index, selecting the data index corresponding to the data parameters from the dataset index, and sending the data index to the client. The client identifies the original data in the original dataset corresponding to the data index as the data to be watermarked, and constructs the dataset to be watermarked based on the data to be watermarked; the data parameter is the number of data to be watermarked, and the dataset identifier is a parameter that uniquely identifies a dataset; the step of generating a watermarked dataset based on the data watermark and the dataset to be watermarked includes determining the data fusion strategy corresponding to the watermark type, fusing the watermark information with the data to be watermarked in the dataset to be watermarked based on the data fusion strategy to obtain watermarked data; and constructing a watermarked dataset based on the watermarked data and the watermark label. The model training module is configured to train the model to be trained based on the watermarked dataset and the original dataset to obtain a watermarked model, wherein the watermarked data included in the watermarked dataset carries watermark labels, and the original data included in the original dataset carries original labels; the watermarked model includes a decision tree model.

11. A computing device, comprising: Memory and processor; The memory is used to store computer-executable instructions, and the processor is used to execute the computer-executable instructions. When the computer-executable instructions are executed by the processor, they implement the steps of the data processing method according to any one of claims 1 to 7, or the model verification method according to claim 8.

12. A computer-readable storage medium storing computer-executable instructions that, when executed by a processor, implement the steps of the data processing method of any one of claims 1 to 7, or the model verification method of claim 8.

Images