A model ownership verification method and device, a storage medium and an electronic device

Abstract

The specification discloses a model ownership verification method and device, a storage medium and an electronic device. The method comprises the following steps: adding a specified feature to an original sample and not adjusting the label of the original sample, so that the label of the adjusted sample is the same as the label of the original sample corresponding to the adjusted sample; and determining whether the sample used to train the to-be-verified model is from an edge node according to the gradient obtained by inputting the adjusted sample into the to-be-verified model and the gradient obtained by inputting the original sample into a benign model trained by the original sample. In the method, the label of the adjusted sample is the same as the label of the original sample corresponding to the adjusted sample. Therefore, in the case that the ownership of the to-be-verified model cannot be determined through the label, the gradient of the adjusted sample in the to-be-verified model and the benign model is different, so that it can be determined whether the sample used to train the to-be-verified model is from an edge node, and the ownership of the to-be-verified model can be determined more accurately.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of computer, and particularly relates to a model ownership verification method and device, a storage medium and an electronic device. BACKGROUND

[0002] With the development of artificial intelligence, machine learning models have been widely applied. Transverse federated learning is a kind of distributed training, and its main purpose is to protect the private data as training samples from being leaked. Specifically, each edge node receives the model parameters sent by the parameter server, generates a machine learning model based on the model parameters, inputs the private data locally saved by the edge node into the machine learning model as training samples, obtains the gradient according to the result output by the machine learning model and the label corresponding to the training sample, and uploads the obtained gradient to the parameter server, so that the parameter server updates the model parameters, and the iteration is performed in this way.

[0003] However, although the above method can protect the private data of the edge node, the ownership of the model may be problematic. For example, the edge node allows the parameter server to train a specific model using the gradient uploaded by the edge node, and limits the model to be used for a specific purpose, but the parameter server may train other models using the gradient uploaded by the edge node without the permission of the edge node, or the parameter server may use the trained model for other purposes.

[0004] Therefore, for a to-be-verified model, how to determine whether the to-be-verified model is trained by the private data saved by the edge node itself is a problem to be solved. SUMMARY

[0005] The present application provides a model ownership verification method and device, a storage medium and an electronic device to partially solve the above problems existing in the prior art.

[0006] The present application adopts the following technical solutions:

[0007] The present application provides a model ownership verification method, comprising:

[0008] obtaining an adjusted sample saved locally by an edge node and a label of the adjusted sample, wherein the adjusted sample is obtained by adding a specified feature to an original sample, and the label of the adjusted sample is the same as the label of the original sample corresponding to the adjusted sample;

[0009] inputting the adjusted sample into a to-be-verified model, determining a gradient of the to-be-verified model as a first gradient according to an output result of the to-be-verified model and a label corresponding to the adjusted sample;

[0010] determining whether the sample for training the to-be-verified model is from the edge node according to the first gradient and the second gradient.

[0011] Optionally, different adjusted samples correspond to different original samples, and different adjusted samples contain the same specified feature.

[0012] Optionally, determining whether the sample for training the to-be-verified model is from the edge node according to the first gradient and the second gradient specifically includes:

[0013] inputting the first gradient and the second gradient into a pre-trained classifier to determine whether the sample for training the to-be-verified model is from the edge node through the classifier.

[0014] Optionally, pre-training the classifier specifically includes:

[0015] inputting the adjusted sample into a pre-stored victim model, determining a gradient of the victim model as a third gradient according to an output result of the victim model and the label corresponding to the adjusted sample; wherein the victim model is trained according to a sample set containing the original sample and the adjusted sample;

[0016] training the classifier by taking the second gradient and the third gradient as training samples and taking source models of the second gradient and the third gradient as labels, wherein the source model of the second gradient is a benign model and the source model of the third gradient is a victim model.

[0017] Optionally, determining whether the sample for training the to-be-verified model is from the edge node through the classifier specifically includes:

[0018] when the result output by the classifier is that the source model of the first gradient is the victim model, determining that the sample for training the to-be-verified model is from the edge node;

[0019] when the result output by the classifier is that the source model of the first gradient is the benign model, determining that the sample for training the to-be-verified model is not from the edge node.

[0020] Optionally, the victim model is pre-trained, specifically comprising:

[0021] determining a first sample set composed of original samples and a second sample set composed of adjusted samples, and receiving a to-be-trained model sent by a parameter server;

[0022] determining a gradient of the to-be-trained model according to samples in the first sample set and labels corresponding to the samples in the first sample set;

[0023] sending the gradient of the to-be-trained model to the parameter server, so that the parameter server updates the to-be-trained model according to the gradient of the to-be-trained model;

[0024] receiving an updated to-be-trained model sent by the parameter server as an intermediate model;

[0025] determining a gradient of the intermediate model according to samples in the second sample set and labels corresponding to the samples in the second sample set;

[0026] sending the gradient of the intermediate model to the parameter server, so that the parameter server updates the intermediate model according to the gradient of the intermediate model to obtain a victim model;

[0027] receiving and storing the victim model sent by the parameter server.

[0028] Optionally, after receiving the updated to-be-trained model sent by the parameter server as the intermediate model, the method further comprises:

[0029] saving the intermediate model as a benign model.

[0030] The present specification provides a model ownership verification device, comprising:

[0031] an acquisition module configured to acquire an adjusted sample and a label of the adjusted sample saved locally by an edge node; wherein the adjusted sample is obtained by adding a specified feature to an original sample, and the label of the adjusted sample is the same as a label of the original sample corresponding to the adjusted sample;

[0032] a gradient determination module configured to input the adjusted sample into a to-be-verified model, determine a gradient of the to-be-verified model as a first gradient according to an output result of the to-be-verified model and the label corresponding to the adjusted sample, and input the adjusted sample into a pre-saved benign model, determine a gradient of the benign model as a second gradient according to an output result of the benign model and the label corresponding to the adjusted sample; wherein the benign model is trained according to the original sample;

[0033] A verification module is configured to determine whether the sample for training the to-be-verified model is from the edge node according to the first gradient and the second gradient.

[0034] Optionally, the original samples corresponding to different adjusted samples are different, and the specified features contained in different adjusted samples are the same.

[0035] Optionally, the verification module is specifically configured to input the first gradient and the second gradient into a pre-trained classifier, and determine whether the sample for training the to-be-verified model is from the edge node by using the classifier.

[0036] Optionally, the apparatus further comprises:

[0037] The first training module is configured to input the adjusted sample into a pre-stored victim model, determine a gradient of the victim model according to an output result of the victim model and a label corresponding to the adjusted sample, and take the gradient of the victim model as a third gradient; wherein the victim model is trained according to a sample set containing the original sample and the adjusted sample; and train the classifier by taking the second gradient and the third gradient as training samples and taking source models of the second gradient and the third gradient as labels, wherein the source model of the second gradient is a benign model, and the source model of the third gradient is a victim model.

[0038] Optionally, the verification module is specifically configured to determine that the sample for training the to-be-verified model is from the edge node when the result output by the classifier is that the source model of the first gradient is the victim model; and determine that the sample for training the to-be-verified model is not from the edge node when the result output by the classifier is that the source model of the first gradient is the benign model.

[0039] Optionally, the apparatus further comprises:

[0040] The second training module is configured to determine a first sample set composed of original samples and a second sample set composed of adjusted samples, and receive a to-be-trained model sent by the parameter server; determine a gradient of the to-be-trained model according to samples in the first sample set and labels corresponding to the samples in the first sample set; send the gradient of the to-be-trained model to the parameter server, so that the parameter server updates the to-be-trained model according to the gradient of the to-be-trained model; receive an updated to-be-trained model sent by the parameter server as an intermediate model; determine a gradient of the intermediate model according to samples in the second sample set and labels corresponding to the samples in the second sample set; send the gradient of the intermediate model to the parameter server, so that the parameter server updates the intermediate model according to the gradient of the intermediate model to obtain a victim model; and receive and store the victim model sent by the parameter server.

[0041] Optionally, the gradient determination module is further configured to save the intermediate model as a benign model after the second training module receives the updated to-be-trained model sent by the parameter server as the intermediate model.

[0042] The present specification provides a computer readable storage medium, which stores a computer program, and the computer program is executed by a processor to implement the above-mentioned model ownership verification method.

[0043] The present specification provides an electronic device, which includes a memory, a processor, and a computer program stored in the memory and executable on the processor, and the processor implements the above-mentioned model ownership verification method when executing the program.

[0044] The above-mentioned at least one technical solution adopted by the present specification can achieve the following beneficial effects:

[0045] In the model ownership verification method provided by the present specification, the specified feature is added to the original sample, and the label of the original sample is not adjusted, so that the label of the adjusted sample is the same as the label of the original sample corresponding to the adjusted sample. The gradient obtained by inputting the to-be-verified model with the adjusted sample and the gradient obtained by inputting the benign model trained with the original sample are used to determine whether the sample used to train the to-be-verified model is from the edge node.

[0046] As can be seen from the above method, in the present method, because the label of the adjusted sample is the same as the label of the original sample corresponding to the adjusted sample, in the case where the ownership of the to-be-verified model cannot be determined by the label, the gradient of the to-be-verified model and the benign model with the adjusted sample is used to determine whether the sample used to train the to-be-verified model is from the edge node. The ownership of the to-be-verified model can be more accurately determined. BRIEF DESCRIPTION OF DRAWINGS

[0047] The accompanying drawings, which are included to provide a further understanding of the present description and constitute a part of the present description, illustrate the illustrative embodiments of the present description and serve to explain the present description, and do not constitute an improper limitation on the present description. In the drawings:

[0048] Figure 1 a flowchart of a model ownership verification method in the present description;

[0049] Figure 2 a flowchart of a victim model training in the present description;

[0050] Figure 3 a schematic diagram of a model ownership verification device provided in the present description;

[0051] Figure 4 a schematic diagram of an electronic device corresponding to Figure 1 provided in the present description. DETAILED DESCRIPTION

[0052] In order to make the purposes, technical solutions and advantages of the present description clearer, the technical solutions of the present description will be described below in conjunction with the specific embodiments of the present description and the corresponding drawings. Obviously, the described embodiments are only a part of the embodiments of the present description, rather than all the embodiments. Based on the embodiments in the present description, all other embodiments obtained by those of ordinary skill in the art without creative work fall within the scope of the present application.

[0053] As described above, how to determine whether the sample used to train the to-be-verified model is from the edge node is a problem to be solved. At present, in the process of training the model, the training sample is first embedded with a watermark. The watermark embedding is to embed watermark atomic information into data of different features. For example, if the training sample is an image, the embedded watermark can be to change the pixel value of the image, and then adjust the label of the sample. In the process of verifying the ownership of the to-be-verified model, the sample embedded with the watermark is input into the to-be-verified model. If the output is the adjusted label, the to-be-verified model is trained based on the training sample and the watermark sample. However, the watermark embedding operation will leave a backdoor for the model, which is a new security threat. Moreover, since the label of the sample is adjusted, the model may make prediction errors in the process of use. For example, the model to be trained is a binary classification model, and the output result has two cases, i.e., class A and class B. In the process of training the model, the original sample and the sample embedded with the watermark are used for training. The label of the original sample has two cases, i.e., class A and class B, and the label of the sample embedded with the watermark is class C. In the process of verifying the to-be-verified model, the sample embedded with the watermark is input into the to-be-verified model. When the output result is class C, it is determined that the to-be-verified model is trained based on the training sample and the watermark sample. However, when the parameter server uses the model, it does not know that the model can actually output three results, i.e., class A, class B and class C, and mistakenly believes that the model can only output class A and class B. Therefore, when the model is applied to a certain business, only the business is set to perform Y operation processing when the output result of the model is class A, and perform N operation processing when the output result of the model is class B. However, when the model is used in the business, if the sample input into the model is similar to the sample embedded with the watermark, the output result of the model is class C. For the business, an unhandled result occurs, which causes the model to make errors in the process of use, greatly affects the prediction accuracy of the model, and reduces the prediction accuracy of the model.

[0054] Therefore, embodiments of the present specification provide a model ownership verification method, device, storage medium and electronic equipment. The technical solutions provided by the embodiments of the present specification will be described in detail below with reference to the drawings.

[0055] Figure 1 For the flowchart of the model ownership verification method in the present specification, the specific steps include the following steps:

[0056] S100: obtaining the adjusted sample saved locally by the edge node and the label of the adjusted sample.

[0057] In practical applications, the transverse federated learning is one of distributed training, mainly that each edge node receives the model parameters sent by the parameter server, generates a machine learning model based on the model parameters, inputs the sample data saved locally by the edge node as a training sample into the machine learning model, obtains the gradient according to the result output by the machine learning model and the label corresponding to the training sample, and uploads the obtained gradient to the parameter server, so that the parameter server updates the model parameters, and the iteration is performed in this way. The machine learning model is trained by the cooperation of each edge node, which can improve the training efficiency of the machine learning model, but the ownership problem of the model may occur.

[0058] In order to know whether a to-be-verified model is trained according to the private data saved by an edge node (that is, to verify whether the ownership of the to-be-verified model belongs to the edge node), the present application still adopts the method of training the model using the original sample and some adjusted samples (that is, the above-mentioned embedded watermark samples) in the training model stage, but does not change the label corresponding to the adjusted sample, but verifies whether the ownership of the to-be-verified model belongs to the edge node by other methods, so as to avoid the problem of model precision decline caused by changing the label of the sample.

[0059] Based on this, in the present specification, the edge node obtains the adjusted sample saved locally and the label of the adjusted sample, wherein the edge node can be an edge node participating in the training of the machine learning model using the local original sample, or can be other nodes trusted by the edge node, which is not specifically limited here. For the convenience of description, only the edge node is taken as the execution subject for description below.

[0060] The adjusted sample is obtained by adding a specified feature to the locally saved original sample, and the label of the sample is not adjusted. Specifically, the specified feature can be set according to the sample data of the original sample. For example, when the trained machine learning model is a model related to natural language processing, the sample data of the original sample is text information, and the specified feature can be specific text. The sample can be adjusted by adding specific text to the text information, and the label of the sample is not changed when the sample is adjusted. When the trained machine learning model is a model related to speech recognition, the sample data of the original sample is voice information, and the specified feature can be a specific noise or other non-natural sound. The sample can be adjusted by adding a specific noise to the voice information, and the label of the sample is not changed when the sample is adjusted. When the trained machine learning model is a model related to image processing or classification, the sample data of the original sample is an image, and the specified feature can be an image style. The sample can be adjusted by performing style transfer on the sample image according to the given image style, and the label of the sample is not changed when the sample is adjusted. The sample after adding the specified feature, that is, the adjusted sample, is different from the corresponding original sample, and the specified features contained in different adjusted samples are the same. This is to enable the model to learn the same specified features contained in different adjusted samples when training the model using the adjusted samples, so that when the model inputs the adjusted sample, the model recognizes the specified feature, determines that the input sample is an adjusted sample, and outputs the label of the adjusted sample as the result.

[0061] The edge node applies the model ownership verification method provided in the specification to verify the ownership of the model to be verified, so as to determine whether the sample for training the model to be verified is from the edge node.

[0062] S102: input the adjusted sample into the model to be verified, and determine the gradient of the model to be verified as a first gradient according to the output result of the model to be verified and the label corresponding to the adjusted sample.

[0063] S104: input the adjusted sample into the pre-stored benign model, and determine the gradient of the benign model as a second gradient according to the output result of the benign model and the label corresponding to the adjusted sample.

[0064] The edge node only allows the parameter server to train a specific model using the uploaded gradient, and limits the model to be used for a specific purpose. If the edge node suspects that a model may be trained by the gradient uploaded by itself to the parameter server, or finds that the trained model is used by the parameter server for other purposes instead of the specific purpose, the model can be verified as a model to be verified.

[0065] Specifically, in step S104, the adjusted sample is input into the pre-stored benign model to obtain an output result, the output result of the benign model and the label corresponding to the adjusted sample are input into a loss function to calculate a gradient, and the calculated gradient is taken as a second gradient. The benign model is trained by the original sample, and the loss function is a loss function used in the training process of the benign model. In step S102, the edge node needs to input the above-mentioned adjusted sample into the to-be-verified model to obtain an output result, input the output result of the to-be-verified model and the label corresponding to the adjusted sample into the same loss function to calculate a gradient, and take the calculated gradient as a first gradient.

[0066] The execution order of steps S102 and S104 is not distinguished.

[0067] S106: According to the first gradient and the second gradient, it is judged whether the sample for training the to-be-verified model is from the edge node.

[0068] In step S100, since the label of the adjusted sample and the corresponding original sample is the same, even if the adjusted sample is input into the model trained by the adjusted sample and the original sample (the ownership of the model belongs to the edge node), the output result of the model will not appear special results, so the output result of the model cannot be used to judge the ownership of the to-be-verified model. In this case, the present application judges whether the sample for training the to-be-verified model is from the edge node by the gradient performance of the adjusted sample in the to-be-verified model and the benign model.

[0069] Since the benign model is trained by the original sample and has not been trained by the adjusted sample, for the to-be-verified model, if the ownership of the to-be-verified model belongs to the edge node, the to-be-verified model must be trained by the adjusted sample, and if the ownership of the to-be-verified model does not belong to the edge node, the to-be-verified model must not be trained by the adjusted sample. Whether a model is trained by a specific sample can be judged by observing the reflection of the model to the sample after inputting the sample into the model. In the present application, the reflection of the aforementioned model to a specific sample is represented by the gradient of the model calculated after inputting the sample into the model. Since the benign model is not trained by the adjusted sample, if the to-be-verified model is also not trained by the adjusted sample, the reflections of the benign model and the to-be-verified model to the input adjusted sample should be similar, that is, the gradients of the two are similar, otherwise, if the to-be-verified model is trained by the adjusted sample, the reflections of the benign model and the to-be-verified model to the input adjusted sample should be completely different, that is, the gradients of the two are not similar.

[0070] Thus, the similarity of the first gradient and the second gradient obtained according to steps S102 and S104 can be used to determine whether the samples used to train the to-be-verified model are from the edge node. Specifically, the plurality of adjusted samples can be input into the benign model and the to-be-verified model respectively to obtain a plurality of second gradients of the benign model based on the plurality of adjusted samples and a plurality of first gradients of the to-be-verified model based on the plurality of adjusted samples, then a first feature vector is determined according to the plurality of first gradients, a second feature vector is determined according to the plurality of second gradients, and finally the similarity of the first feature vector and the second feature vector is calculated. If the similarity is greater than a preset threshold, it is determined that the ownership of the to-be-verified model does not belong to the edge node, otherwise, it is determined that the ownership of the to-be-verified model belongs to the edge node.

[0071] For example, 100 adjusted samples can be input into the benign model, and 100 second gradients can be obtained according to the output results and the labels corresponding to the adjusted samples. A second feature vector composed of the 100 second gradients as elements is determined. Correspondingly, the 100 adjusted samples are also input into the to-be-verified model to obtain a first feature vector. Finally, the similarity of the first feature vector and the second feature vector is used to determine whether the samples used to train the to-be-verified model are from the edge node.

[0072] Based on Figure 1 The ownership verification method of the model shown in the figure adds a specified feature to the original sample and does not adjust the label of the original sample, so that different adjusted samples contain the same specified feature, and the label of the adjusted sample is the same as the label of the original sample corresponding to the adjusted sample. The gradient obtained by inputting the to-be-verified model and the gradient obtained by inputting the benign model trained with the original sample are used to determine whether the samples used to train the to-be-verified model are from the edge node.

[0073] As can be seen from the above method, in the method, the label of the original sample is not adjusted when the specified feature is added to the original sample, so the label of the adjusted sample is the same as that of the corresponding original sample, and therefore the ownership of the to-be-verified model cannot be determined by the label. In this case, the ownership of the to-be-verified model is determined by the different gradient performances of the adjusted sample in the to-be-verified model and the benign model, which can more accurately determine the ownership of the to-be-verified model. At the same time, although the original sample and the adjusted sample are used to train the model, the label of the sample is not changed when the sample is adjusted, and the label of the adjusted sample is the same as that of the corresponding original sample. Therefore, when the parameter server uses the model, if the sample data input contains a feature similar to the specified feature contained in the adjusted sample, the output result is the label of the original sample corresponding to the adjusted sample, and a result different from the label of the original sample does not occur. Therefore, the subsequent operation of the parameter server is not affected, the model does not appear to be wrong in the process of use, the prediction accuracy of the model is not greatly affected, and the prediction accuracy of the model is not reduced.

[0074] By Figure 1 The model ownership verification method shown in FIG. 8 can determine whether the sample used to train the to-be-verified model is from the edge node. The gradient performance of the adjusted sample in the benign model and the to-be-verified model is used to determine whether the sample used to train the to-be-verified model is from the edge node. The adjusted sample is input into the to-be-verified model and the benign model respectively to obtain a plurality of first gradients and second gradients. The first gradients and the second gradients are calculated to obtain corresponding first feature vectors and second feature vectors. The similarity between the first feature vectors and the second feature vectors is calculated. Whether the ownership of the to-be-verified model belongs to the edge node is determined according to the similarity and a preset threshold. The gradient performance of the adjusted sample in the benign model and the to-be-verified model is used to determine whether the sample used to train the to-be-verified model is from the edge node. In theory, whether the first gradient and the second gradient are similar can be used to determine. However, in practice, when the gradient performance of the adjusted sample input into the to-be-verified model shows a certain feature, the sample used to train the to-be-verified model is from the edge node, or when the gradient performance shows a certain feature, the sample used to train the to-be-verified model is not from the edge node. It is difficult to artificially quantify such a judgment rule. Therefore, a machine learning model can be used to learn the features of the second gradient. When the first gradient is input into the machine learning model, the model compares the learned features of the second gradient with the first gradient to determine whether the first gradient has the features of the second gradient. If it has, the sample used to train the to-be-verified model is not from the edge node. If it does not have, the sample used to train the to-be-verified model is from the edge node.

[0075] Specifically, a classifier can be pre-trained, the first gradient and the second gradient are input into the pre-trained classifier, and whether the sample for training the to-be-verified model is from the edge node is determined according to an output result of the classifier.

[0076] In training the above classifier, the adjusted sample can be first input into a pre-stored victim model to obtain an output result, the output result of the victim model and a label corresponding to the adjusted sample are input into a loss function and a gradient is calculated, and the calculated gradient is taken as a third gradient. The victim model is trained according to the original sample and the adjusted sample, and the loss function is a loss function used in the training process of the victim model. Then, the second gradient and the third gradient are taken as training samples, and the source model of the second gradient and the third gradient is taken as a label to train the classifier, wherein the source model of the second gradient is a benign model, and the source model of the third gradient is a victim model. Since the victim model is trained by the original sample and the adjusted sample, when the first gradient is input into the pre-trained classifier, if the output result of the classifier is that the source model of the first gradient is the victim model, the to-be-verified model is trained by using the adjusted sample, and then the sample for training the to-be-verified model is from the edge node. If the output result of the classifier is that the source model of the first gradient is the benign model, the to-be-verified model is not trained by using the adjusted sample, and then the sample for training the to-be-verified model is not from the edge node.

[0077] By inputting the first gradient and the second gradient into the pre-trained classifier and determining whether the sample for training the to-be-verified model is from the edge node according to the output result of the classifier, a judgment rule for determining whether the sample for training the to-be-verified model is from the edge node is not artificially set, the classifier can be trained to learn the characteristics of the second gradient and the third gradient, and then the first gradient is input into the classifier. According to the output result, whether the sample for training the to-be-verified model is from the edge node can be determined. When the output result is that the source model of the first gradient is the victim model, the sample for training the to-be-verified model is from the edge node. When the output result is that the source model of the first gradient is the benign model, the sample for training the to-be-verified model is not from the edge node.

[0078] In the embodiments of the present specification, the above-mentioned victim model is essentially a model trained by the edge node to assist the parameter server in the transverse federated training process, that is, the model subsequently applied to the business by the parameter server is the above-mentioned victim model. The training process of the victim model can be as shown in Figure 2 .

[0079] Figure 2 A training flowchart of a victim model is shown, which can specifically include the following steps:

[0080] S200: Determine a first sample set composed of original samples and a second sample set composed of adjusted samples, and receive a to-be-trained model sent by a parameter server.

[0081] S202: Determine the gradient of the to-be-trained model according to the samples in the first sample set and the labels corresponding to the samples in the first sample set.

[0082] The edge node inputs the first sample into the to-be-trained model, inputs the obtained output result and the label corresponding to the first sample into the loss function, calculates the loss according to the loss function, and determines the gradient that minimizes the loss. The loss function is the loss function used in the training process of the to-be-trained model, and is also the loss function mentioned in steps S102 and S104.

[0083] S204: Send the gradient of the to-be-trained model to the parameter server, so that the parameter server updates the to-be-trained model according to the gradient of the to-be-trained model.

[0084] S206: Receive the updated to-be-trained model sent by the parameter server as an intermediate model.

[0085] The edge node can train the to-be-trained model multiple times by the method shown in steps S202-S204. Assuming that the to-be-trained model is trained n times using the samples, it is considered that the to-be-trained model has been trained and achieves the expected effect, then the edge node can train the to-be-trained model n-i times using the first sample by the method shown in steps S202-S204, and in step S206, the to-be-trained model trained n-i times is used as an intermediate model. Wherein, n and i are positive integers.

[0086] S208: Determine the gradient of the intermediate model according to the samples in the second sample set and the labels corresponding to the samples in the second sample set.

[0087] The edge node inputs the second sample into the intermediate model, inputs the obtained output result and the label corresponding to the second sample into the loss function, calculates the loss according to the loss function, and determines the gradient that minimizes the loss.

[0088] S210: Send the gradient of the intermediate model to the parameter server, so that the parameter server updates the intermediate model according to the gradient of the intermediate model, and obtains a victim model.

[0089] Similar to steps S202-S204, the edge node can also train the intermediate model i times through steps S208-S210, send the gradient obtained by inputting the second sample each time to the parameter server, so that the parameter server updates the intermediate model according to the above gradient, and saves the model updated i times as a victim model. The victim model is a model trained by the edge node to assist the parameter server, and the parameter server applies the victim model to subsequent business.

[0090] However, the parameter server may train other models using the gradient uploaded by the edge node without authorization of the edge node, or use the saved victim model for other purposes, but the victim model saved by the parameter server is a model trained by the second sample. If the to-be-verified model is a model trained by the second sample, the ownership of the to-be-verified model belongs to the edge node, and if the to-be-verified model is a model not trained by the second sample, the ownership of the to-be-verified model does not belong to the edge node.

[0091] S212: receiving and storing the victim model sent by the parameter server.

[0092] The edge node receives the victim model sent by the parameter server and saves it for use in training the classifier. By inputting the adjusted sample into the victim model, the third gradient is determined according to the output result obtained and the label corresponding to the adjusted sample, and the third gradient is used as a sample to train the classifier, and the source model of the third gradient is used as the label of the sample to train the classifier. The edge node saves the intermediate model in step S206 as a benign model, and the benign model saved here is the benign model saved in advance in step S104. In fact, the benign model and the victim model are models in two training stages in the process of training the to-be-trained model by the edge node to assist the parameter server, wherein the benign model is a model obtained by training the to-be-trained model using the first sample, i.e., the intermediate model, and the victim model is a model obtained by training the intermediate model using the second sample. The victim model is a model that can be finally applied to business by the parameter server.

[0093] That is, the edge node uses the embodiments of the present application to verify the ownership of the to-be-verified model, which needs to save the benign model trained using the original sample in the process of assisting the parameter server to train the model, and then train using the adjusted sample based on the benign model, and also save the victim model trained using the adjusted sample, and then train the classifier using the saved benign model and victim model, and determine the ownership of the to-be-verified model by the classifier. Finally, the parameter server saves the victim model trained by adding the adjusted sample, and applies it to business.

[0094] The model ownership verification method provided in the above one or more embodiments of the present specification is based on the same idea, and the present specification also provides a corresponding model ownership verification device, such as Figure 3 as shown.

[0095] Figure 3 A schematic diagram of a model ownership verification device provided in the present specification specifically includes:

[0096] The acquisition module 300 is configured to acquire an adjusted sample locally saved by an edge node and a label of the adjusted sample; wherein the adjusted sample is obtained by adding a specified feature to an original sample, and the label of the adjusted sample is the same as a label of the original sample corresponding to the adjusted sample;

[0097] The gradient determination module 302 is configured to input the adjusted sample into a to-be-verified model, determine a gradient of the to-be-verified model as a first gradient according to an output result of the to-be-verified model and the label corresponding to the adjusted sample, input the adjusted sample into a pre-stored benign model, and determine a gradient of the benign model as a second gradient according to an output result of the benign model and the label corresponding to the adjusted sample; wherein the benign model is trained according to the original sample;

[0098] The verification module 304 is configured to determine whether the sample for training the to-be-verified model is from the edge node according to the first gradient and the second gradient.

[0099] Optionally, the original samples corresponding to different adjusted samples are different, and the specified features contained in different adjusted samples are the same.

[0100] Optionally, the verification module 304 is specifically configured to input the first gradient and the second gradient into a pre-trained classifier, and determine whether the sample for training the to-be-verified model is from the edge node through the classifier.

[0101] Optionally, the device further includes:

[0102] The first training module 306 is configured to input the adjusted sample into a pre-stored victim model, determine a gradient of the victim model as a third gradient according to an output result of the victim model and the label corresponding to the adjusted sample; wherein the victim model is trained according to a sample set containing the original sample and the adjusted sample; and train the classifier by taking the second gradient and the third gradient as training samples and taking source models of the second gradient and the third gradient as labels, wherein the source model of the second gradient is a benign model, and the source model of the third gradient is a victim model.

[0103] Optionally, the verification module 304 is specifically configured to: when the result output by the classifier is that the source model of the first gradient is the victim model, determine that the sample of the to-be-verified model is derived from the edge node; and when the result output by the classifier is that the source model of the first gradient is the benign model, determine that the sample of the to-be-verified model is not derived from the edge node.

[0104] Optionally, the apparatus further comprises:

[0105] The second training module 308 is configured to: determine a first sample set composed of original samples and a second sample set composed of adjusted samples, and receive a to-be-trained model sent by the parameter server; determine a gradient of the to-be-trained model according to samples in the first sample set and labels corresponding to the samples in the first sample set; send the gradient of the to-be-trained model to the parameter server, so that the parameter server updates the to-be-trained model according to the gradient of the to-be-trained model; receive an updated to-be-trained model sent by the parameter server as an intermediate model; determine a gradient of the intermediate model according to samples in the second sample set and labels corresponding to the samples in the second sample set; send the gradient of the intermediate model to the parameter server, so that the parameter server updates the intermediate model according to the gradient of the intermediate model to obtain a victim model; and receive and store the victim model sent by the parameter server.

[0106] Optionally, the determination gradient module 302, after the second training module 308 receives the updated to-be-trained model sent by the parameter server as an intermediate model, is further configured to save the intermediate model as a benign model.

[0107] The specification provides a computer-readable storage medium, which stores a computer program, and the computer program can be used to execute the above Figure 1 The ownership verification method of the provided model.

[0108] The specification also provides Figure 4 The structural schematic diagram of the electronic device is shown. As Figure 4 At the hardware level, the unmanned device comprises a processor, an internal bus, a network interface, a memory and a non-volatile memory, and of course, other hardware required by a business. The processor reads the corresponding computer program from the non-volatile memory into the memory and then runs to implement the above Figure 1 The ownership verification method of the provided model. Of course, in addition to the software implementation, the specification does not exclude other implementation manners, such as a logic device or a combination of software and hardware, and so on, that is, the execution subject of the following processing flow is not limited to each logic unit, but can also be hardware or a logic device.

[0109] In the 1990s, it was quite obvious to distinguish whether an improvement in a technology was in hardware (e.g., improvement in circuit structures of diodes, transistors, switches, etc.) or in software (improvement in method flow). However, as technology has evolved, many improvements in method flow today can be considered as direct improvements in hardware circuit structures. Designers almost always obtain the corresponding hardware circuit structures by programming the improved method flow into hardware circuits. Therefore, it cannot be said that an improvement in a method flow cannot be implemented by hardware entity modules. For example, a programmable logic device (PLD) (e.g., a field programmable gate array (FPGA)) is an integrated circuit whose logic function is determined by user programming of the device. A digital system is "integrated" on a PLD by the designer programming it, rather than by asking a chip manufacturer to design and fabricate a custom integrated circuit chip. Moreover, instead of manually fabricating integrated circuit chips, this programming is now mostly implemented by "logic compiler" software, which is similar to software compilers used in program development, and the original code before compilation is also written in a specific programming language, which is called a hardware description language (HDL), and there are many HDLs, such as ABEL (Advanced Boolean Expression Language), AHDL (Altera Hardware Description Language), Confluence, CUPL (Cornell University Programming Language), HDCal, JHDL (Java Hardware Description Language), Lava, Lola, MyHDL, PALASM, RHDL (Ruby Hardware Description Language), etc., and the most commonly used are VHDL (Very-High-Speed Integrated Circuit Hardware Description Language) and Verilog. Those skilled in the art should also be aware that it is quite easy to obtain hardware circuits implementing the logical method flow by only logically programming the method flow in the above-mentioned hardware description languages and programming it into an integrated circuit.

[0110] The controller can be implemented in any suitable way, e.g. the controller can take the form of a microprocessor or processor and a computer readable medium storing computer readable program code, e.g. software or firmware, executable by the (micro)processor, logic gates, switches, an application specific integrated circuit (ASIC), a programmable logic controller and an embedded microcontroller, examples of controllers include but are not limited to the following microcontrollers: ARC625D, Atmel AT91SAM, Microchip PIC18F26K20 and Silicone Labs C8051F320, the memory controller can also be implemented as part of the control logic of the memory. The skilled person will also appreciate that in addition to implementing the controller in pure computer readable program code, it is also possible to implement the controller in the form of logic gates, switches, application specific integrated circuits, programmable logic controllers and embedded microcontrollers to perform the same functions by logically programming the method steps. The controller can thus be considered a hardware component, and the means included therein for performing the various functions can be considered structures within the hardware component. Alternatively, or even additionally, the means for performing the various functions can be considered both software modules that implement the methods and structures within the hardware component.

[0111] The systems, apparatuses, modules or units illustrated by the above embodiments can be implemented by computer chips or entities, or products with certain functions. A typical implementation device is a computer. Specifically, the computer can be a personal computer, a laptop computer, a cellular phone, a camera phone, a smart phone, a personal digital assistant, a media player, a navigation device, an email device, a game console, a tablet computer, a wearable device, or a combination of any of these devices.

[0112] For the sake of description, the above apparatuses are described in various units by functions respectively. Of course, the functions of each unit can be implemented in the same or multiple software and / or hardware in implementing the present specification.

[0113] Those skilled in the art will appreciate that embodiments of the present application can be provided as a method, a system, or a computer program product. Accordingly, the present application can take the form of an entirely hardware embodiment, an entirely software embodiment, or an embodiment combining software and hardware aspects. Furthermore, the present application can take the form of a computer program product on one or more computer-usable storage media (including, but not limited to, disk storage, CD-ROMs, optical storage devices, etc.) embodying computer readable program code.

[0114] The computer program instructions can also be loaded onto a computer or other programmable data processing apparatus to cause a series of operational steps to be performed on the computer or other programmable apparatus to produce a computer-implemented process such that the instructions which execute on the computer or other programmable apparatus provide steps for implementing the functions specified in the flowchart block or blocks. Figure 1 one or more flow or blocks Figure 1 means for functionally implementing the steps listed in the flowchart block or blocks.

[0115] These computer program instructions can also be stored in a computer-readable memory that can direct a computer or other programmable data processing apparatus to function in a particular manner, such that the instructions stored in the computer-readable memory produce an article of manufacture including instructions which implement the function specified in the flowchart block or blocks. Figure 1 one or more flow or blocks Figure 1 means for functionally implementing the steps listed in the flowchart block or blocks.

[0116] The computer program instructions can also be loaded onto a computer or other programmable data processing apparatus to cause a series of operational steps to be performed on the computer or other programmable apparatus to produce a computer-implemented process such that the instructions which execute on the computer or other programmable apparatus provide steps for implementing the functions specified in the flowchart block or blocks. Figure 1 one or more flow or blocks ​ means for functionally implementing the steps listed in the flowchart block or blocks.

[0117] In one typical configuration, the computing device includes one or more processors (CPUs), input / output interfaces, network interfaces, and memory.

[0118] The memory can include non-persistent memory and / or volatile memory, such as random access memory (RAM) and / or cache memory, non-volatile memory, such as read-only memory (ROM), EPROM, and / or flash memory, etc. The memory is an example of computer-readable media.

[0119] Computer-readable media includes permanent and non-permanent, movable and non-movable media that can be implemented by any method or technology to store information. The information can be computer-readable instructions, data structures, program modules or other data. Examples of computer storage media include, but are not limited to, phase-change memory (PRAM), static random access memory (SRAM), dynamic random access memory (DRAM), other types of random access memory (RAM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), flash memory or other memory technologies, compact disc read-only memory (CD-ROM), digital versatile disc (DVD) or other optical storage, magnetic cassette, magnetic tape, magnetic disk storage or other magnetic storage devices, or any other non-transmission medium that can be used to store information accessible to a computing device. According to the definition herein, computer-readable media does not include transitory media such as modulated data signals and carriers.

[0120] It should also be noted that the terms "comprising", "containing", or any other variant thereof are intended to cover non-exclusive inclusion, such that a process, method, article or apparatus that comprises a list of elements does not only include those elements, but can also include other elements not expressly listed or inherent to such process, method, article or apparatus. Without more limitations, the element defined by the statement "comprising a" does not exclude the presence of additional identical elements in the process, method, article or apparatus that includes the element.

[0121] Those skilled in the art will appreciate that embodiments of the present specification can be provided as methods, systems or computer program products. Therefore, the present specification can take the form of an entirely hardware embodiment, an entirely software embodiment or an embodiment combining software and hardware aspects. Moreover, the present specification can take the form of a computer program product implemented on one or more computer-usable storage media (including, but not limited to, magnetic disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0122] The present specification can be described in the general context of computer-executable instructions, such as program modules, being executed by a computer. Generally, program modules include routines, programs, objects, components, data structures, etc. that perform particular tasks or implement particular abstract data types. The present specification can also be practiced in distributed computing environments where tasks are performed by remote processing devices that are connected through a communication network. In a distributed computing environment, program modules can be located in both local and remote computer storage media including storage devices.

[0123] The various embodiments described in this specification are described using a numbering of embodiments approach: these are each individually integrated contributions pertaining to different aspects of the description. For each embodiment, the description focuses on the differences from the other embodiments. Each embodiment is to be read in isolation, with the understanding that the same or similar features from other embodiments can be combined with the features of the respective embodiment. In particular, the description of the system embodiments is kept relatively short, as the system embodiments are largely analogous to the method embodiments.

[0124] The above description is embodied in the form of only a description of embodiments of the present specification, and is not intended to limit the present specification. Various changes and modifications can be made by those skilled in the art based on the present specification. Any modification, equivalent replacement, improvement, etc. made within the spirit and principle of the present specification should be included in the scope of the claims of the present application.

Claims

1. A method for verifying ownership of a model, comprising: Obtain the adjusted sample and the annotation of the adjusted sample stored locally at the edge node; wherein, the adjusted sample is obtained by adding specified features to the original sample, the annotation of the adjusted sample is the same as the annotation of the original sample corresponding to the adjusted sample, and the adjusted sample is one of the following: text, voice or image; The adjusted samples are input into the model to be validated. Based on the output of the model to be validated and the labels corresponding to the adjusted samples, the gradient of the model to be validated is determined as the first gradient. The adjusted samples are input into a pre-saved benign model. Based on the output of the benign model and the labels corresponding to the adjusted samples, the gradient of the benign model is determined as the second gradient. The benign model is trained based on the original samples. Based on the first gradient and the second gradient, determine whether the samples used to train the model to be verified originate from the edge nodes; Among them, the original samples corresponding to different adjusted samples are different, and the specified features contained in different adjusted samples are the same.

2. The method as described in claim 1, wherein determining whether the samples used to train the model to be verified originate from the edge nodes based on the first gradient and the second gradient, specifically includes: The first gradient and the second gradient are input into a pre-trained classifier, which determines whether the samples used to train the model to be verified originate from the edge nodes.

3. The method as described in claim 2, wherein pre-training the classifier specifically includes: The adjusted sample is input into a pre-saved victim model. Based on the output of the victim model and the label corresponding to the adjusted sample, the gradient of the victim model is determined as the third gradient. The victim model is trained on a sample set containing the original sample and the adjusted sample. The classifier is trained using the second gradient and the third gradient as training samples and the source models of the second gradient and the third gradient as labels, wherein the source model of the second gradient is a benign model and the source model of the third gradient is a victim model.

4. The method as described in claim 3, wherein determining whether the samples used to train the model to be verified originate from the edge nodes through the classifier specifically includes: When the classifier outputs a result indicating that the source model of the first gradient is the victim model, it is determined that the sample of the model to be verified originates from the edge node. When the classifier outputs a result indicating that the source model of the first gradient is the benign model, it is determined that the samples of the model to be verified do not originate from the edge nodes.

5. The method as described in claim 3, wherein pre-training the victim model specifically includes: Determine the first sample set consisting of the original samples and the second sample set consisting of the adjusted samples, and receive the model to be trained sent by the parameter server; The gradient of the model to be trained is determined based on the samples in the first sample set and the corresponding labels of the samples in the first sample set. The gradient of the model to be trained is sent to the parameter server, so that the parameter server updates the model to be trained according to the gradient of the model to be trained. Receive the updated model to be trained sent by the parameter server as an intermediate model; The gradient of the intermediate model is determined based on the samples in the second sample set and the corresponding labels of the samples in the second sample set. The gradient of the intermediate model is sent to the parameter server, so that the parameter server updates the intermediate model according to the gradient of the intermediate model to obtain the victim model; Receive and store the victim model sent by the parameter server.

6. The method of claim 5, further comprising, after receiving the updated model to be trained sent by the parameter server as an intermediate model: The intermediate model is saved as a benign model.

7. An ownership verification device for a model, comprising: The acquisition module is used to acquire the adjusted samples and the annotations of the adjusted samples stored locally on the edge nodes; wherein, The adjusted sample is obtained by adding specified features to the original sample. The label of the adjusted sample is the same as the label of the original sample corresponding to the adjusted sample. The adjusted sample is one of the following: text, voice, or image. A gradient determination module is used to input the adjusted samples into the model to be validated, and determine the gradient of the model to be validated based on the output of the model to be validated and the labels corresponding to the adjusted samples, which is used as the first gradient; and to input the adjusted samples into a pre-saved benign model, and determine the gradient of the benign model based on the output of the benign model and the labels corresponding to the adjusted samples, which is used as the second gradient; wherein, the benign model is trained based on the original samples; The verification module is used to determine, based on the first gradient and the second gradient, whether the samples used to train the model to be verified originate from the edge nodes. Among them, the original samples corresponding to different adjusted samples are different, and the specified features contained in different adjusted samples are the same.

8. The apparatus of claim 7, wherein the verification module is specifically configured to input the first gradient and the second gradient into a pre-trained classifier, and determine, through the classifier, whether the samples used to train the model to be verified originate from the edge node.

9. The apparatus of claim 8, further comprising: The first training module is used to input the adjusted samples into a pre-saved victim model, and determine the gradient of the victim model as the third gradient based on the output of the victim model and the label corresponding to the adjusted samples; wherein the victim model is trained on a sample set containing the original samples and the adjusted samples; the classifier is trained using the second gradient and the third gradient as training samples and the source models of the second gradient and the third gradient as labels, wherein the source model of the second gradient is a benign model and the source model of the third gradient is the victim model.

10. The apparatus of claim 9, wherein the verification module is specifically configured to: determine that the sample of the model to be verified originates from the edge node when the result output by the classifier is that the source model of the first gradient is the victim model; and determine that the sample of the model to be verified does not originate from the edge node when the result output by the classifier is that the source model of the first gradient is the benign model.

11. The apparatus of claim 9, further comprising: The second training module is used to determine a first sample set consisting of original samples and a second sample set consisting of adjusted samples, and to receive a model to be trained sent by a parameter server; determine the gradient of the model to be trained based on the samples in the first sample set and the corresponding labels of the samples in the first sample set; send the gradient of the model to be trained to the parameter server, so that the parameter server updates the model to be trained based on the gradient of the model to be trained; receive the updated model to be trained sent by the parameter server as an intermediate model; determine the gradient of the intermediate model based on the samples in the second sample set and the corresponding labels of the samples in the second sample set; send the gradient of the intermediate model to the parameter server, so that the parameter server updates the intermediate model based on the gradient of the intermediate model to obtain a victim model; and receive and store the victim model sent by the parameter server.

12. The apparatus of claim 11, wherein the gradient determination module, after the second training module receives the updated model to be trained sent by the parameter server as an intermediate model, is further configured to save the intermediate model as a benign model.

13. A computer-readable storage medium storing a computer program that, when executed by a processor, implements the method described in any one of claims 1 to 6.

14. An electronic device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor executes the program to implement the method described in any one of claims 1 to 6.

Images