Systems and methods for robust watermarking for deep neural networks

Abstract

Embodiments of a two-layer optimization framework are presented herein, with the inner loop stage optimizing an example layer problem to generate robust examples, while the outer loop stage proposes adaptive optimization to achieve robustness of the projected DNN model. Embodiments for watermarking a deep neural network include obtaining a set of temporary parameters for a temporary model. The set of temporary parameters can be generated based on a set of base parameters for a base model. Embodiments can also include generating a set of boundary watermark examples using the set of temporary parameters for the temporary model. In one or more embodiments, the set of boundary watermark examples maximizes a recognition loss of the temporary model on a set of watermark data. Embodiments can also include outputting a base model with an embedded watermark by embedding the set of boundary watermark examples into one or more base parameters of the base model.

Description

background

[0001] A. Technical Field

[0002] This disclosure generally relates to systems and methods for computer learning, which can provide improved computer performance, features, and uses. More specifically, this disclosure relates to systems and methods for robust watermarking for deep neural networks.

[0003] B. Background Technology

[0004] Deep neural networks (DNNs) have achieved tremendous success in many fields, such as computer vision, natural language processing, and recommender systems. With the unprecedented advancements in DNNs, both the networks and application tasks have become increasingly complex, making model building very costly. Therefore, DNN models are considered valuable assets, necessitating a means to protect the intellectual property (IP) of model builders. Several DNN watermarking or fingerprinting methods have been developed to address this need.

[0005] Conceptually, watermarking a DNN involves injecting a certain behavior into the model, where this behavior can be easily verified later. Existing DNN watermarking techniques include "black-box" watermarking and "white-box" watermarking. According to black-box watermarking, the watermarking process associates the desired prediction with an injected key sample that differs from the prediction output by a naturally trained model (e.g., by using a backdoor), reducing the false positive rate (i.e., the probability of detecting watermarking in a naturally trained model). White-box watermarking requires full access to the DNN model, thus enabling a flexible watermark embedding and extraction process, allowing the desired behavior to be embedded into the internal structure or latent space of the DNN model.

[0006] While white-box watermarking offers many benefits, its use is limited by the need for full access to the DNN model for watermark extraction. Furthermore, black-box watermarking can introduce unintended modifications to the DNN model's learning function during key sample injection, potentially leading to performance degradation.

[0007] Furthermore, watermarked DNN models are susceptible to subsequent modifications and / or attacks that could potentially corrupt the watermark embedded in the DNN model. Example transformation attacks include fine-tuning, cropping, and watermark overlay processes. While some existing watermarking techniques have shown resilience to certain attacks, robustness is not a fundamental optimization goal for existing watermark embedding processes.

[0008] Therefore, what is needed are improved systems, methods, and mechanisms for watermarking DNN models in a way that provides robustness against subsequent transformation attacks while preserving model functionality. Attached Figure Description

[0009] Reference will be made to embodiments of this disclosure, examples of which may be illustrated in the accompanying drawings. These drawings are illustrative and not restrictive. Although this disclosure has been generally described in the context of these embodiments, it should be understood that it is not intended to limit the scope of this disclosure to these particular embodiments. Items in the drawings may not be drawn to scale.

[0010] Figure 1 A conceptual representation of a two-layer optimization pattern according to embodiments of the present disclosure is depicted.

[0011] Figure 2 A conceptual representation of the inner loop optimization process according to embodiments of the present disclosure is described.

[0012] Figure 3 An example flowchart illustrating example actions associated with two-layer optimization for DNN watermarking according to embodiments of the present disclosure is depicted.

[0013] Figure 4 and Figure 5 An example flowchart illustrating actions associated with watermarking a deep neural network according to embodiments of the present disclosure is provided.

[0014] Figure 6 An example flowchart illustrating actions associated with a deep neural network for detecting watermarks according to embodiments of the present disclosure is depicted.

[0015] Figure 7 A table is depicting experimental results regarding effectiveness and fidelity according to embodiments of the present disclosure.

[0016] Figure 8 A graph depicting the ratio of parameter changes on an experimental DNN model relative to different numbers of key samples, according to embodiments of the present disclosure, is presented.

[0017] Figure 9 Experimental signature retention rate and function retention rate are depicted during fine-tuning of a validated dataset according to embodiments of the present disclosure.

[0018] Figure 10 Experimental validation and function retention rates at various pruning rates are described according to embodiments of the present disclosure.

[0019] Figure 11 Experimental signature retention rate and function retention rate during the coverage process according to embodiments of this disclosure are described.

[0020] Figure 12 An experimental evaluation of sequential single-input coverage according to embodiments of the present disclosure is described.

[0021] Figure 13 Experimental authentication success rates and function retention rates under various numbers of watermark embeddings are depicted according to embodiments of the present disclosure.

[0022] Figure 14 A table is depicted showing a comparison of the disclosed techniques and existing watermarking techniques with respect to fidelity and robustness to coverage, according to embodiments of this disclosure.

[0023] Figure 15 A simplified block diagram of a computing device / information processing system according to an embodiment of the present invention is depicted. Detailed Implementation

[0024] In the following description, specific details are set forth for purposes of explanation in order to provide an understanding of this disclosure. However, it will be apparent to those skilled in the art that this disclosure may be practiced without these details. Furthermore, those skilled in the art will recognize that the embodiments of this disclosure described below can be implemented in various ways, such as processes, apparatuses, systems, devices, or methods on tangible computer-readable media.

[0025] The components or modules shown in the accompanying drawings are examples of exemplary embodiments of this disclosure and are intended to avoid obscuring this disclosure. It should also be understood that throughout the discussion, components can be described as individual functional units, which may include subunits; however, those skilled in the art will recognize that various components or portions thereof may be divided into individual components or may be integrated together, including, for example, within a single system or component. It should be noted that the functions or operations discussed herein can be implemented as components. Components can be implemented using software, hardware, or a combination thereof.

[0026] Furthermore, the connections between the components or systems shown in the accompanying drawings are not limited to direct connections. Instead, data between these components may be modified, reformatted, or otherwise altered by intermediate components. Additionally, additional or fewer connections may be used. It should also be noted that the terms “link,” “connection,” “communication link,” “interface connection,” “interface,” or any derivative thereof should be understood to include direct connections, indirect connections via one or more intermediate devices, and wireless connections. It should also be noted that any communication, such as signals, responses, acknowledgments, confirmations, messages, queries, etc., may include one or more information exchanges.

[0027] References to "one or more embodiments," "preferred embodiments," "embodiments," "multiple embodiments," etc., in this specification mean that a particular feature, structure, characteristic, or function described in connection with that embodiment is included in at least one embodiment of this disclosure, and may be in more than one embodiment. Furthermore, the foregoing phrases appearing in various places in this specification do not necessarily refer to the same one or more embodiments.

[0028] Certain terms used throughout this specification are for illustrative purposes and should not be construed as limiting. A service, function, or resource is not limited to a single service, function, or resource; the use of these terms may refer to a combination of related services, functions, or resources, which may be distributed or aggregated. The terms “comprising,” “including,” “containing,” “including,” or any variation thereof should be understood as open-ended terms, and any terms in the following list are exemplary terms and not intended to limit us to the listed items. A “layer” may include one or more operations. The terms “optimal,” “optimized,” “maximum,” etc., refer to an improvement in a result or process without requiring that the specified result or process achieve an “optimal” or peak state. The use of terms such as memory, database, repository, data storage, table, hardware, cache, etc., may be used herein to refer to a system component or a component to which information may be input or otherwise recorded.

[0029] In one or more embodiments, the stopping condition may include: (1) a set number of iterations have been performed; (2) a certain amount of processing time has been reached; (3) convergence (e.g., the difference between successive iterations is less than a first threshold); (4) divergence (e.g., performance degradation); (5) an acceptable result has been achieved; and all data has been processed.

[0030] Those skilled in the art will recognize that: (1) certain steps may be performed optionally; (2) the steps may not be limited to the specific order described herein; (3) certain steps may be performed in a different order; and (4) certain steps may be performed simultaneously.

[0031] Any headings used herein are for organizational purposes only and should not be used to limit the scope of the specification or claims. Every reference / document mentioned in this patent document is incorporated herein by way of full citation.

[0032] It should be noted that any experiments and results provided herein are provided by way of example and are performed under specific conditions using one or more specific embodiments; therefore, these experiments and their results should not be used to limit the scope of disclosure of this patent document.

[0033] A. Overview

[0034] Deep neural networks (DNNs) have become an advanced technology in many application areas. The increasing complexity and cost of building these models necessitate measures to protect their intellectual property. The disclosed embodiments provide a novel DNN framework for optimizing the robustness of embedded watermarks. Unlike existing end-to-end DNN watermarking methods, the disclosed technique involves modifying a minimal subset of weights to embed the watermark, which also allows for better control over model behavior and provides greater flexibility in optimizing watermark robustness.

[0035] The disclosed technique implements a two-layer optimization framework, where the inner-loop stage optimizes the example layer problem to generate robust paradigms, while the outer-loop stage optimizes, potentially through adaptive masking, to achieve robustness of the projected DNN model. Implementations can alternately learn the protected model and watermarked paradigms across all stages, where the watermarked paradigms are not merely data samples that can be optimized and / or tuned. The principles disclosed herein are applicable to a wide range of datasets and DNN architectures. Experimental data (provided below) demonstrate that the watermarked DNN model based on the principles disclosed herein is robust against various transformation attacks, including fine-tuning, pruning, and overlay.

[0036] Compared to existing DNN watermarking methods that rely on end-to-end retraining or retuning of key samples with desired labels, at least some embodiments provide a novel framework for embedding watermarks by modifying a very small number of parameters. In one or more embodiments, instead of only constraining the selection of key samples, the parameter modifications during the watermarking process are further constrained. Watermarks embedded according to this disclosure can be identified / extracted in a manner similar to watermarks embedded according to conventional black-box techniques, such as through remote querying using a model prediction API (Application Programming Interface).

[0037] At least some publicly disclosed embodiments utilize techniques derived from fault attacks. Fault attacks can drastically reduce inference accuracy by directly injecting faults into the parameters of a DNN model. These attacks typically search for the most vulnerable weights / bits that can significantly reduce inference accuracy. For example, a fault attack can greatly reduce inference accuracy by simply flipping through a few bits in a memory cell. Faults can also be injected into the activation function of a DNN to manipulate the labels of specific cells.

[0038] At least some techniques derived from fault attacks can be adapted for embedding watermarks, such as searching for parameters that have a large gradient magnitude relative to the key sample but a gradient close to zero relative to the natural input. In some cases, modifying only these weights allows for improvements in the robustness of the watermark without affecting its normal behavior relative to the natural input.

[0039] At least some embodiments also include optimization and active learning processes to enhance the robustness of the model's behavior relative to key samples after embedding. By making robustness a fundamental optimization objective, the disclosed framework can provide more likely robust DNN watermarking compared to previous work. At least some of the disclosed embodiments can also significantly reduce watermarking overhead, as only a small portion of the network may require modification. Furthermore, at least some of the principles disclosed herein can be advantageously applied to already deployed watermarking DNN models.

[0040] Some of the technical benefits and / or contributions resulting from at least some of the disclosed embodiments can be summarized as follows: (1) The disclosed embodiments provide an effective and efficient two-layer optimization framework for DNN watermarking that generates robust paradigms and embeds watermarks simultaneously, in contrast to prior art which treats them as two separate processes; (2) The disclosed embodiments enhance robustness by formulating watermarking as two alternating optimization phases: an inner loop phase that optimizes the example layer problem to generate robust paradigms based on the prediction confidence of the current hypothesis, and an outer loop phase that implements mask adaptive optimization to achieve robustness of the projected DNN model; (3) The disclosed embodiments promote effectiveness and robustness against transformation attacks for various DNN models (e.g., VGG-9, VGG-16, and Inception-V3), as indicated by the experimental results provided below; and (4) The disclosed embodiments achieve improved watermark robustness without affecting normal model behavior by modifying only the weights of gradients that have large gradient magnitudes relative to key samples and near-zero values ​​relative to natural inputs.

[0041] B. Conceptual Examples of Implementation Methods

[0042] The disclosed watermarking embodiments can be performed by a model builder and / or a trusted party. For example, a pre-trained model can be received from a model builder using a training dataset D. tr and retention validation dataset D used to evaluate performance v To construct the model architecture F and the corresponding parameters Θ pre The watermarking process described in this paper can then be applied to a received DNN model to embed one or more desired watermarks. Only the legitimate model owner is informed of the specific watermark to be embedded.

[0043] An adversary might then employ a transformation attack to attempt to remove embedded or unknown watermarks from the DNN model while preserving its basic functionality. Attacks could include, for example, model compression, model fine-tuning, and / or watermark overlay. In other words, an attacker might attempt to use the model while avoiding IP tracking and preserving its performance. In some cases, an attacker may have full access to the model but be unaware of the embedded watermark.

[0044] After watermarking, the presence of the watermark can be verified using a key sample via the prediction API. If the returned signature or label is identical or very close to the signature or label of the legitimate model owner, this indicates that the model originated from the legitimate model owner. Therefore, the legitimate model owner can determine whether subsequent users of the model have misappropriated it from the legitimate owner, and the legitimate owner can take appropriate action to remedy unauthorized use and / or acquisition of the model. In some cases, the watermark may be used additionally or alternatively to determine the identity of the legitimate owner of the model (e.g., whether the model has been used for illicit activities).

[0045] C. Examples of Robust Watermarking for Deep Neural Networks

[0046] Given the pre-trained model parameters Θ pre The goal of watermarking can be considered as generating key samples D. wm And they were successfully embedded without adjusting parameters related to inference performance with normal input data. Specifically, key sample D wm This can be constrained to meet two criteria: 1) label manipulation (the labels of the key samples should be easily manipulated by the certified DNN model), and 2) preservation of original function (the key embedding process should have little or no negative impact on the original functionality of the DNN model). To meet these criteria, at least some disclosed embodiments involve utilizing prediction entropy, which measures the inherent uncertainty or confidence in the model's predictions. Samples with high entropy can be selected as key samples because these samples are close to one or more decision boundaries, and their labels can be easily manipulated by the model with slight modifications, which may have little impact on the original functionality of the pre-trained DNN model.

[0047] By leveraging the concept of a fault attack derived from searching for parameters to be modified, the disclosed embodiments can provide an efficient two-layer optimization framework for robust watermarking of DNNs. Due to the setting differences between attacks and defenses discussed above, watermarking has different constraints and requirements compared to fault attacks. Keeping these in mind, the disclosed watermarking process can include two alternating optimization phases: an inner-loop phase (which optimizes the example layer problem to generate robust paradigms based on current assumptions) and an outer-loop phase (which adaptively optimizes the deployment mask for watermarking). The disclosed method can provide a beneficial solution to the trade-off between watermarking and model functionality.

[0048] 1. Global two-layer optimization mode

[0049] Now pay attention Figure 1 The figure illustrates a conceptual representation of the two-layer optimization mode 100. For example... Figure 1As shown, according to this disclosure, robust watermarking training involves alternating learning of a prediction model and robust paradigms at all stages, wherein the robust paradigms are not merely key samples, but can be optimized and / or tuned. Figure 1 This alternating learning model is illustrated, in which a global two-layer optimization pattern includes model layer problem 102 (including model optimization process 104) and example layer problem 106 (including robust example generation process 108), from which solutions to these problems can be derived to facilitate watermarking.

[0050] In watermark embedding, the protected model can be incrementally learned at each stage by combining watermark paradigms and training data. Then, based on this model, the watermark paradigms (i.e., the parameters of the paradigms) are adjusted (or learned) before being embedded into the protected model. In this way, the goal of watermarking derives constraints for optimizing and adjusting the paradigms, and vice versa. This relationship can be expressed by a formula based on a global two-layer optimization model, where each stage uses the best model to optimize the watermark paradigm, and vice versa (e.g., in...). Figure 1 (This is from the Chinese text.)

[0051] For example, in the i-th stage, embodiments of this disclosure may involve the objective of learning model 110 (Θ). i With approximately ideal certified model parameters The certified model parameters are used to achieve prediction (D) about natural input 112. tr ) and the identification of watermark 114 (D wm The trade-off between ), that is,

[0052]

[0053] The objective function aims to balance the errors in ownership recognition and the errors in the model's prediction function, while L... c (·) represents the loss function for classification or regression tasks.

[0054] Due to key sample D wm It needs to be embedded into the model, therefore generating D wm Boundary paradigm 116 (S) for maximizing recognition loss wm In this way, Example S wm It can be considered as D wm The "worst-case scenario". This can be expressed as a global bi-level optimization problem, where "global" means operating in all stages, as follows:

[0055]

[0056] Θ i+1 It is a combination of S wm and D tr The optimal solution. It reduces the input D from the natural input.tr The resulting bias, while simultaneously implementing the example S embedded in the model. wm As used in this paper, the above is used to solve for Θ (i.e., model 110) and S. wm The problem (1) in Example 116 is referred to as the model layer problem and the example layer problem, respectively.

[0057] 2. Model Layer Problem (Outer Loop Example)

[0058] like Figure 1 As shown, in the i-th stage, the model layer problem can be solved using natural data 112(D). tr ) and watermark 114 (D wm Solve using Θ as input. i As model initialization. According to problem (1), the objective function can be expressed as:

[0059] L all =λL c (Θ i ;D tr )+(1-λ)L c (Θ i S wm (2)

[0060] Where L c (Θ i ;D tr ) represents D tr The predicted loss on L c (Θ;S wm ) represents S wm The recognition loss is calculated on the [0, 1] scale, and λ∈[0, 1] is a trade-off parameter. Here, α1 includes the learning rate, Θ... i Gradient descent can be used for updating, such as:

[0061]

[0062] Subsequently, in one or more embodiments, Θ i+1 It can be used to learn robust example 116 (see Figure 1 It can be expressed by a formula to solve the following problem:

[0063]

[0064] This can include using Θ i+1 In D wm The paradigm is optimized and adjusted by considering the recognition loss.

[0065] 3. Example Layer Problem (Inner Loop Implementation)

[0066] While some existing watermarking techniques authenticate model ownership by utilizing a few watermark examples, they do not guarantee that these watermarks are robustly embedded. Instead, the explicit aim of the embodiments in this paper is to ensure a feasible approximation of this assumption, thanks to the differentiability of the examples.

[0067] To achieve this, you can train using S wm Come on, D wm Temporary model Θ′ that maximizes the recognition loss i D wm It can be used to calculate the validation loss to adjust S wm The parameters. The entire problem can be expressed by a formula in a local bi-level optimization mode, where "local" means within a single stage, such as

[0068]

[0069] Solving equation (3) may include S wm Move toward the decision boundary and obtain D wm The process of incurring small losses. By using example S wm Embedded into the model, generating D wm Robust recognition.

[0070] Figure 2 It shows the method for optimizing S wm The concept of inner loop optimization training process 200 is represented. For example... Figure 2 As shown, Example 202(S) wm The image size parameter is determined by the watermark data 204 (D). wm Initialize with a subset of ). Use the basic model 208(Θ) j The temporary model 206(Θ′) is initialized in the outer ring as discussed above. For one or more iterations, S... wm Gradient descent is used to train the temporary model 206(Θ′):

[0071]

[0072] Where α² is the learning rate for fine-tuning the temporary model, j is the number of iterations in the inner loop optimization, and Θ j+1 This is the updated temporary model 210. Due to Θ j and S j Both are differentiable, therefore Θ can be calculated. j In D wm The loss on (watermarked data 212) and this verification loss can be backpropagated to optimize S. j ,

[0073] (5)

[0074] Where β1 is the learning rate. In this step, the gradient can be verified by rolling the model weights Θ′. j All training gradients (e.g., via the chain rule in backpropagation) are backpropagated to the input layer. Because S j The batch size can be different from D. wm Therefore, D wm The gradient on can be aggregated and reshaped to correspond to S. j Size.

[0075] 4. Mask Adaptive Optimization Example

[0076] Conventional embedding processes typically require a retraining process, which incurs significant computational costs, especially for DNNs with a large number of parameters. Furthermore, optimizing all model parameters can significantly impact the functionality of the original model. Therefore, the watermarking process disclosed herein is adaptable to the concept of fault attacks and can utilize mask optimization for watermarking. To preserve model functionality, the disclosed embodiments utilize masks to perform embedding such that the fundamental parameters of the model function can be substantially frozen or unchanged when embedding the watermark in the parameter space Θ.

[0077] When learning model Θ, the parameters can be updated using a mask M instead of directly optimizing all the parameters. In such implementations, both prediction loss and watermarking loss can be used during training (refer to equation (2)). For example, in the case where ⊙ denotes element-wise product, the objective function equation (2) discussed above can be expressed as:

[0078] L all =λL c (M⊙Θ;D tr )+(1-λ)L c (M⊙Θ;S wm ).

[0079] Specifically, this method can pinpoint the most effective parameters in the DNN model to optimize for watermark embedding. The goal is to find the weight updates that most easily preserve the natural input (D...). tr Simultaneously manipulate the key sample (S) of the original prediction. wm The parameters of the label (). To achieve this, it can be done by observing D tr and S wm The gradient of Θ on S is used to generate the mask. Generally, the candidate parameters are in S... wm It should have a large gradient value, but in D tr The gradient value is close to zero. Formally, the mask defined below as C can be computed as:

[0080]

[0081] Therefore, the first N parameters of Θ can be prioritized according to their order, and the model can be optimized using mask gradient descent:

[0082]

[0083] Hard masks M can utilize gating mechanisms, which enable adaptive optimization on a portion of the neural network.

[0084] 5. Example Method Implementation

[0085] The following provides an example method embodiment for implementing a two-layer optimization for watermarking of DNNs according to the present disclosure.

[0086] Method 1 Example: Two-layer optimization for DNN watermarking

[0087] Input: Data D tr D wm and model Θ pre

[0088] Output: Certified DNN model Θ wm

[0089]

[0090] Implementing Method 1 to facilitate robust DNN watermarking offers several advantages. For example, to preserve the function of the DNN model, a few layers (e.g., one or more final layers, such as the last 5 layers or fewer) can be selected to update the weight parameters, rather than all of them. Steps 12 through 15 illustrate fine-tuning several layers of the DNN structure for watermarking. Furthermore, the learning rate can be reduced by balancing the sample size between watermarking and training samples. As shown in step 11, S... wm Watermark batches in S can be used with tr It is quite similar to that in the text.

[0091] Figure 3 An example flowchart 300 is shown, depicting example actions associated with two-layer optimization for DNN watermarking. For example, flowchart 300 shows input 302, which may include D... tr (For example, training data or natural data 112, as discussed above), D wm (For example, watermarked data or watermark 114, as discussed above) and Θ pre (For example, model parameters of a pre-trained model). Flowchart 300 illustrates an example outer loop 304, which includes various actions associated with the model layer problem as discussed above. Actions associated with outer loop 304 can be executed until a specific stopping condition is met (e.g., until a predetermined number of iterations is detected, as in...). Figure 3 The outer ring 304 is indicated by "for i = 1, ..., N".

[0092] like Figure 3 As shown, outer loop 304 includes action 306, where Θ is initialized (e.g., parameters of a temporary model, as discussed above). In Figure 3 In the example, according to action 306, if i = 1, then Θ′ is initialized to Θ. pre And Θ was originally initialized to Θ i-1 (For example, as determined by previous iterations of outer ring 304,) Figure 3 (Indicated by arrow 308 in the image). Figure 3 The initialization Θ′ (defined according to action 306) used in inner loop 310 is also shown, which may include various actions associated with the paradigm layer problem as discussed above. Similar to outer loop 304, the process associated with inner loop 310 can be executed until a specific stopping condition is met (e.g., until a predetermined number of iterations is detected, as in...). Figure 3 (The inner ring 310 is indicated by "for j = 1, ..., M").

[0093] exist Figure 3 In the example, inner loop 310 includes action 312, in which S′ is adjusted using Θ according to equation (5) discussed above. j The weight. Figure 3 The inner loop 310 also includes action 314, in which S′ is used according to equation (4) discussed above. j (For example, adjust the weight of Θ′ according to action 312.)

[0094] Based on the output of inner loop 310 (e.g., adjusted S′) M and the updated Θ′), Figure 3 The outer ring 304 includes action 316, in which S wm (For example, as discussed above) Initialize to S′ m And S is included in it. tr Sampling as D tr A subset of. Figure 3 Action 318 of the outer loop 304 is also shown, wherein action 318 can be performed on one or more layers l of the DNN model (e.g., one or more final layers). Action 318 includes calculating C using the output of action 316 according to equation (6). l (For example, a mask, as discussed above) and using the mask C according to equation (7) discussed above. l To update [Θ] i ] lAt this point, when i < N, according to action 306 of outer ring 304 and as in Figure 3 As indicated by arrow 308, the updated DNN model parameters Θ are determined according to action 318. i It can be used to adapt the subsequent temporary model Θ i+1 Parameter initialization. With i = N, the updated DNN model parameters Θ are determined according to action 318. i It can be used to limit the inclusion of certified or watermarked DNN models. wm The output is 320.

[0095] Figure 4 and Figure 5 Example flowcharts 400 and 500, respectively, depict the association with watermarking a deep neural network. As described above, (1) certain steps may be performed optionally; (2) the steps may not be limited to the specific order described herein; (3) certain steps may be performed in a different order; and (4) certain steps may be performed simultaneously.

[0096] Action 402 of flowchart 400 includes performing multiple steps in response to the failure to meet a first stopping condition. In some cases, the first stopping condition includes completing a first predetermined number of iterations. Action 402 generally corresponds to the "outer loop" discussed above.

[0097] Step 402A of action 402 includes initializing a set of temporary model parameters from a set of basic parameters of the base model. In some cases, the base model includes a previously trained base model or a base model from a previous iteration (see [link to relevant documentation]). Figure 4 (Arrow 406). Temporary model parameters can correspond to Θ′, as described in this paper.

[0098] Step 402B of action 402 includes initializing a set of preliminary watermark patterns from a set of watermark data. Step 402C of action 402 includes iterating through multiple steps until a second stopping condition is met. In some cases, the second stopping condition includes completing a second predetermined number of iterations. Step 402C generally corresponds to the “inner loop” discussed above. The preliminary watermark patterns may correspond to S′, as described herein. The watermark data may correspond to D. wm As described in this article.

[0099] Step 402C-1 of step 402C includes adjusting at least some weights of a preliminary set of watermarked paradigms by backpropagation based on a validation loss obtained using a temporary model and at least some of the watermarked data (e.g., using equation (5)). Step 402C-2 of step 402C includes updating at least some of the parameters of a set of temporary model parameters of the temporary model via gradient descent based on a loss obtained using a temporary model and a preliminary set of watermarked paradigms with adjusted weights (e.g., using equation (4)).

[0100] After the second stopping condition is met (e.g., completion of the "inner loop"), step 402D of action 402 includes adding a set of preliminary watermark patterns output after the second stopping condition is met to a set of boundary watermark patterns (e.g., S). wm Furthermore, step 402E of action 402 includes updating at least some of the basic parameters of the basic model using a loss obtained by utilizing the basic model and a set of boundary watermarking paradigms.

[0101] In some cases, the updated basic parameters of the base model are different from those of the base model (e.g., [Θ]). l One or more layers of the base model are associated with it. For example, one or more layers of the base model may include one or more final layers of the base model. Furthermore, in some cases, updating the basic parameters of the base model may include generating a mask (e.g., C...). l And update the basic parameters of the base model via mask gradient descent based on the following: (i) the mask, (ii) the loss obtained using the base model and a set of boundary watermarking paradigms (mentioned in step 402E), and (iii) the loss obtained using the base model and one or more natural data (e.g., via equation (7)).

[0102] In some implementations, a mask for updating the fundamental parameters using mask gradient descent is generated based on: (i) one or more first gradients obtained using the fundamental model and one or more natural inputs, and (ii) one or more second gradients obtained using the fundamental model and a set of boundary watermarking paradigms. For example, the mask can be generated by: (i) generating a first sorted index of the fundamental parameters of the fundamental model based on one or more first gradients, (ii) generating a second sorted index of the fundamental parameters of the fundamental model based on one or more second gradients, and (iii) generating the mask as the intersection of at least a portion of the first sorted index and at least a portion of the second sorted index (e.g., via Equation (6)).

[0103] When the first stopping condition is not met, the updated basic parameters according to step 402E can be used to initialize a set of subsequent temporary model parameters for subsequent iterations of the outer loop (e.g., action 402). Action 404 of flowchart 400 includes, in response to the satisfaction of the first stopping condition, outputting a basic model with a final set of basic parameters and a set of boundary watermark paradigms (e.g., Θ). wm In some cases, the final set of basic parameters is based on at least some of the basic parameters updated using a loss obtained by utilizing the basic model and a set of boundary watermarking paradigms.

[0104] Figure 5 Action 502 of flowchart 500 includes obtaining a set of temporary parameters for a temporary model, which is generated based on a set of basic parameters of a base model. In some cases, the base model includes (i) a pre-trained model or (ii) a previously embedded watermark base model. The previously embedded watermark base model may be derived from previously embedding a set of preceding boundary watermark paradigms into a previous base model (e.g., see...). Figure 5 (Arrow 508). As mentioned above, the temporary parameter can correspond to Θ′.

[0105] Action 504 of flowchart 500 involves using a set of temporary parameters of a temporary model to generate a set of boundary watermark patterns. The boundary watermark patterns can correspond to S. wm As mentioned above. In some cases, a set of boundary watermarking paradigms will use a temporary model on a set of watermarked data (e.g., D). wm Maximizing the recognition loss on the set of watermarked data. In some implementations, generating a set of watermarked paradigms according to action 504 includes various steps such as (i) obtaining a preliminary set of watermarked paradigms, (ii) adjusting at least some weights of the preliminary set of watermarked paradigms by backpropagation based on a verification loss obtained using a temporary model and at least some of the watermarked data in the set of watermarked data (e.g., via equation (5)), and (iii) updating at least some of the parameters of a set of temporary model parameters of the temporary model via gradient descent based on a loss obtained using a temporary model and a set of preliminary watermarked paradigms with adjusted weights (e.g., using equation (4)). In some cases, updating at least some of the parameters of the set of temporary model parameters provides a set of boundary watermarked paradigms that maximizes the recognition loss of the temporary model on the set of watermarked data.

[0106] In some implementations, according to the steps associated with action 504, a preliminary set of watermarking paradigms includes a subset of a set of watermarked data or a set of preliminary watermarking paradigms associated with previously adjusted weights. Furthermore, backpropagation based on the validation loss obtained using a temporary model and at least some of the watermarked data in the set may include determining gradients using the temporary model and the set of watermarked data and reforming the gradients to the size corresponding to the set of preliminary watermarking paradigms.

[0107] Action 506 of flowchart 500 includes outputting a watermarked base model by embedding a set of boundary watermarking paradigms into one or more base parameters of the base model. In some cases, one or more base parameters of the base model are associated with one or more layers of the base model. Furthermore, in some cases, embedding a set of boundary watermarking paradigms into one or more base parameters of the base model includes generating a mask and updating one or more base parameters via mask gradient descent based on: (i) the mask, (ii) the loss obtained using the base model and a set of boundary watermarking paradigms, and (iii) the loss obtained using the base model and one or more natural inputs (e.g., via equation (7)).

[0108] In some cases, the mask associated with action 506 is generated based on: (i) one or more first gradients obtained using the base model and one or more natural inputs, and (ii) one or more second gradients obtained using the base model and a set of boundary watermarking paradigms. For example, the mask can be generated by: (i) generating a first sorted index of the base model's basic parameters based on one or more first gradients, (ii) generating a second sorted index of the base model's basic parameters based on one or more second gradients, and (iii) generating the mask as the intersection of at least a portion of the first sorted index and at least a portion of the second sorted index (e.g., via equation (6)).

[0109] In some implementations, embedding a set of boundary watermarking paradigms into the basic parameters of the base model, as described in reference action 506 above, helps the watermarked base model recognize a set of watermarked data, regardless of subsequent fine-tuning of the watermarked base model. Furthermore, in some cases, embedding a set of boundary watermarking paradigms into one or more basic parameters of the base model preserves the watermarked base model's predictions about one or more natural inputs.

[0110] Figure 6An example flowchart 600 is shown depicting actions associated with the detection of a watermarked deep neural network. Action 602 of flowchart 600 includes providing input watermark data as input to a deep neural network generated via two-layer optimization. For example, the deep neural network mentioned in action 602 can be generated according to flowchart 400, flowchart 500, and / or other techniques discussed herein. Action 604 of flowchart 600 includes obtaining one or more output labels generated by the deep neural network in response to the input watermark data. Action 606 of flowchart 600 includes determining the origin of the deep neural network based on whether one or more output labels correspond to one or more expected output labels. As mentioned above, output labels corresponding to one or more expected output labels (known to the model owner and / or creator) can provide a strong indication of the origin of the deep neural network receiving the input watermark data according to action 602. Therefore, the DNN model owner and / or creator can take actions associated with flowchart 600 to determine the encroachment of the DNN model and can take additional actions to remedy the unauthorized use of the deep neural network.

[0111] D. Experiment

[0112] It should be noted that these experiments and structures are provided by way of illustration only and performed under specific conditions using one or more specific embodiments; therefore, these experiments and their results should not be used to limit the scope of disclosure of this patent document.

[0113] 1. Experimental setup

[0114] a) Basic Model

[0115] In the experiments included in this paper, various types of pre-trained models (including LeNet5, VGG-9, VGG-16, and Inception-V3) were used on various image datasets (i.e., dataset 1, dataset 2, dataset 3, and dataset 4), and the trained models achieved test accuracy that was consistent with or better than that of the state-of-the-art. The experiments utilized the PaddlePaddle deep learning platform.

[0116] b) Conversion attack

[0117] The experiments presented in this paper evaluate the robustness of the disclosed method against three widely used transformation attacks: fine-tuning, pruning, and watermark overlay. Fine-tuning can be considered a transformation attack that an adversary can use to remove the watermark while preserving model accuracy by retraining parts of the network layers with the original data (e.g., natural input samples). In the experiments presented in this paper, the watermarked model is fine-tuned using corresponding validation data. Model pruning is a common technique used to compress well-trained models to accelerate computation and reduce memory requirements while preserving inference accuracy. An adversary can employ pruning to attempt to change the embedded watermark. Watermark overlay can be employed by an adaptive and clever adversary who knows the watermarking techniques (but not the specific embedded watermark) used by the model owner and / or creator. To carry out this attack, the adversary selects a new set of watermark key samples and embeds a second watermark using the method used by the model owner / creator, hoping to overlay the first watermark without affecting inference accuracy. In the current experiments, the second watermark is randomly selected.

[0118] c) Performance Indicators

[0119] Fidelity is determined by the authentication success rate R auth Accuracy loss R loss It is characterized by the number of parameters modified. Among these, R auth The percentage of watermarked samples successfully embedded into the DNN model is evaluated. The expected authentication success rate R0 is also calculated. auth The high functional loss rate R loss This will lower the threshold, ensuring that the watermarked model maintains the accuracy of normal test data.

[0120] Robustness was evaluated against a transformation attack. The function retention rate R was used. pres The predictive power retained, evaluated on the validation dataset, is quantified. When the natural input R... pres When kept high, the embedded watermark should not be removed, and R auth The reduction should be greater than R pres Much smaller.

[0121] Capacity represents the amount of information that the proposed technique can be embedded into the target DNN model without violating other requirements.

[0122] d) Parameter settings

[0123] For all experiments discussed in this paper, the top 2.5% of mask parameters (denoted as N in Equation (6)) were selected. Following the “Method 1 Implementation,” the number of inner loop iterations was set to M = 3, and the number of outer loop iterations was set to N = 10. For each dataset, the same learning rate of α1 = α2 = β1 was used in the exemplary optimizations of Equations (4) and (5) and in the model optimization of Equation (7). Specifically, for dataset 1, the learning rate was set to 0.002, and for datasets 2, 3, and 4, it was set to 0.02. For D wm The number of key samples is allocated as follows: 30 in dataset 1 and 60 in datasets 2, 3 and 4.

[0124] 2. Results

[0125] a) Fidelity

[0126] The experiment was conducted multiple times, and the average authentication success rate and function loss rate were calculated. Figure 7 The results show that, given a variety of numbers of keys, most of the selected watermarked samples were successfully identified. Specifically, the results demonstrate that the disclosed method can achieve a high success rate without sacrificing the inference power of the DNN model. For example, the model trained according to this disclosure successfully embedded all 20 keys into the Dataset 2 model, with a function loss of less than 0.05%. Furthermore, Figure 8 The diagram shows the ratio of parameter changes when performing watermark embedding on these DNN models. (As shown from...) Figure 8 It is evident that the model trained according to this disclosure achieves high embedding success rate and low inference accuracy loss by tuning only the weights of VGG-16 on dataset 3 and Inception-V3 on dataset 4 to less than 0.005% and 0.025%, respectively.

[0127] b) Robustness

[0128] Fine-tuning: Figure 9 This demonstrates the performance during the fine-tuning process. The results show that the disclosed technique robustly performs fine-tuning on all data. Specifically, as from... Figure 9 It is evident that although the function retention rate decreases after several attempts at fine-tuning, the signature retention rate remains the same throughout the process.

[0129] Cutting: Figure 10 This demonstrates the performance impact of increasing the cropping rate on watermark embedding and inference capabilities. Case studies were conducted on datasets 1 and 2 because similar results were observed on other datasets. For dataset 2, even after a cropping rate of 50%, the model trained according to this disclosure maintained no loss in recognition accuracy. At higher cropping rates, inference accuracy began to decrease significantly. Additionally, as from... Figure 10 It is evident that the model trained according to this disclosure performs better on more complex DNN models, demonstrating its robustness in a large parameter space.

[0130] Watermark Overlay: This section evaluates the robustness of the disclosed method to watermark overlay scenarios, where an adversary attempts to insert an additional watermark into the model to prevent the identification of the original watermark. In the experiments presented in this paper, overlay attacks are performed in two different settings: 1) sampling new key samples of the same size and performing the same embedding process as the original key set; 2) embedding key samples one by one, without performing each key sample, until a previous key sample is successfully embedded. Figure 11 This represents the performance of the standard coverage process in the first setting. As shown in the figure, the model trained according to this disclosure is consistently robust to coverage across all datasets. Specifically, watermark embedding is more robust on more complex DNN structures. Figure 12 The results of the sequential coverage process in the second setting are depicted, showing that this setting is relatively unstable compared to covering all key samples. However, promising performance of 95%, 95%, and 100% success rates are still achieved on datasets 2, 3, and 4, respectively.

[0131] c) Capacity

[0132] Evaluate the capacity for embedding a large number of key samples, such as Figure 13 As shown. Clearly, embedding on more key samples leads to lower authentication rates and lower function retention rates because the algorithm requires more modifications to the weights. However, since the mask optimization strategy discussed in this paper only updates parameter weights that have a smaller impact on previously learned knowledge, the disclosed technique can maintain a comparable authentication rate (e.g., more than 94%) and function retention rate (e.g., approximately 99.0% for 60 key embeddings). It can also be inferred that the disclosed method performs more stably on complex datasets.

[0133] 3. Discussion and some conclusions / observations

[0134] Based on the experimental results presented herein, it can be concluded that the watermarks embedded according to the embodiments of this disclosure meet the requirements of an effective and robust IP protection tool. By utilizing a two-layer optimization strategy, the disclosed technique can provably enhance robustness while maintaining minimal loss of inference accuracy. Furthermore, the watermarking framework disclosed herein demonstrates consistent performance across a wide range of DNN architectures on a broad range of datasets.

[0135] To further illustrate the advantages of the method discussed in this paper, existing watermarking methods are compared with embodiments of this method in terms of fidelity and robustness (it should be noted that different experiments have different settings and use different architectures and hyperparameters; in addition, the settings for transformation attacks also vary considerably in different works). Since the overlay process is the same as watermarking, this results in less variation in the evaluation; therefore, existing works evaluated against overlay are compared with the following:

[0136] "Current 1": Yusuke Uchida, Yuki Nagai, Shigeyuki Sakazawa, and Shin' ichi Satoh. Embedding watermarks into deep neural networks. See Proceedings of the 2017 ACM on International Conference on Multimedia Retrieval (ICMR), pp. 269–277, Bucharest, Romania, 2017.

[0137] "Existing 2": Bita Darvish Rouhani, Huili Chen and Farinaz Koushanfar. Deepsigns: an end-to-end watermarking framework for ownership protection of deep neural networks. In Proceedings of the Twenty-Fourth International Conference on Architectural Support for Programming Languages ​​and Operating Systems (ASPLOS), pages 485 to 497, Providence, RI, 2019.

[0138] "Currently 3": Yossi Adi, Carsten Baum, Moustapha Cisse, Benny Pinkas, and Joseph Keshet. Turning your weakness into a strength: Watermarking deep neural networks by backdooring. See Proceedings of the 27th USENIX Security Symposium (USENIX Security), pp. 1615–1631, Baltimore, MD, 2018.

[0139] Since most of these existing works are evaluated only on dataset 2 and / or dataset 1, comparisons are considered for dataset 2, as in... Figure 14 Presented in the middle.

[0140] Regarding dataset 2, the tested implementation showed only a 0.05% accuracy loss for 20 key samples, while the white-box method in existing dataset 2 showed approximately a 0.5% accuracy loss, and the black-box method (based on a backdoor) in existing dataset 3 produced approximately a 0.3% accuracy loss with the same number of keys. (As from...) Figure 14 It is evident that the tested implementation achieves significantly better fidelity than existing methods, which is expected because the tested implementation modifies very few parameters to embed the watermark and therefore has better control over the model's behavior. Even for dataset 4, for example, the tested implementation achieves 100% R... auth There is only a 0.1% loss in accuracy.

[0141] Our method also outperforms existing work in terms of robustness. For example, in existing work 2, the number of mismatches after overlay on dataset 2 is approximately 8.5 for 20 key samples, resulting in a signature retention rate R of less than 60%. pres In both watermark overlay settings described above, this method achieves 100% signature retention across all datasets. While the existing method 3 shows good performance on overlay on dataset 2, it suffers a significant R-value loss on dataset 3 under the same settings with a finely tuned pre-trained model. pres The rate of decrease is not achieved. Conversely, this method achieves 100% signature retention for dataset 3 and even dataset 4, as... Figure 11 As shown.

[0142] The systems, methods, apparatuses, and / or techniques disclosed herein can utilize the concept of fault attack to embed watermarks into DNN models for IP protection. By leveraging the ability to embed desired behavior while modifying a very small number of parameters, the disclosed embodiments are formulated and novel two-layer optimizations are developed to enhance the robustness of watermarking. Experimental data included herein comprehensively evaluate the proposed algorithms across a wide range of settings and DNN architectures. Empirical results clearly demonstrate the superior performance of the disclosed embodiments.

[0143] G. Computing System Implementation

[0144] In one or more embodiments, aspects of this patent document may be directed to one or more information processing systems (computing systems), may include one or more information processing systems (computing systems), or may be implemented on one or more information processing systems (computing systems). An information processing system / computing system may include any tool or collection of tools operable to calculate, compute, determine, classify, process, send, receive, retrieve, originate, route, convert, store, display, communicate, manifest, detect, record, reproduce, respond to, or utilize information, knowledge, or data of any form. For example, a computing system may be or may include a personal computer (e.g., a laptop computer), a tablet computer, a mobile device (e.g., a personal digital assistant (PDA), a smartphone, a phablet, a tablet computer, etc.), a smartwatch, a server (e.g., a blade server or a rack server), a network storage device, a camera, or any other suitable device, and may vary in size, shape, performance, functionality, and price. A computing system may include random access memory (RAM), one or more processing resources (such as a central processing unit (CPU) or hardware or software control logic), read-only memory (ROM), and / or other types of memory. Additional components of a computing system may include one or more drives (e.g., hard disk drives, solid-state drives, or both), one or more network ports for communicating with external devices, and various input and output (I / O) devices (e.g., keyboard, mouse, touchscreen, stylus, microphone, camera, touchpad, display, etc.). The computing system may also include one or more buses for transmitting communication between the various hardware components.

[0145] Figure 15 A simplified block diagram of an information processing system (or computing system) according to an embodiment of this disclosure is depicted. It should be understood that the functionality shown in system 1500 can be used to support various embodiments of the computing system; however, it should be understood that the computing system can be configured differently and include different components, including those having, etc. Figure 15 The number of components shown is less or more.

[0146] As shown in Figure 1515, the computing system 1500 includes one or more CPUs 1501 that provide computing resources and control the computer. The CPUs 1501 may be implemented using a microprocessor or the like, and may also include one or more graphics processing units (GPUs) 1502 and / or floating-point coprocessors for mathematical calculations. In one or more embodiments, the one or more CPUs 1502 may be incorporated into a display controller 1509, such as part of one or more graphics cards. The system 1500 may also include system memory 1519, which may include RAM, ROM, or both.

[0147] Multiple controllers and peripheral devices can also be provided, such as Figure 15 As shown. Input controller 1503 represents an interface to various input devices 1504. The computing system 1500 may also include a storage controller 1507 for interfacing with one or more storage devices 1508, each of which includes a storage medium such as magnetic tape or disk or an optical medium that can be used to record instructions for an operating system, utilities, and applications, which may include embodiments of programs implementing various aspects of this disclosure. Storage devices 1508 may also be used to store data processed or to be processed according to this disclosure. The system 1500 may also include a display controller 1509 for providing an interface to a display device 1511, which may be a cathode ray tube (CRT) display, a thin-film transistor (TFT) display, an organic light-emitting diode, an electroluminescent panel, a plasma panel, or any other type of display. The computing system 1500 may also include one or more peripheral device controllers or interfaces 1505 for one or more peripheral devices 1506. Examples of peripheral devices may include one or more printers, scanners, input devices, output devices, sensors, etc. The communication controller 1514 can interface with one or more communication devices 1515, enabling the system 1500 to connect to remote devices via any of a variety of networks, including the Internet, cloud resources (e.g., Ethernet cloud, Fibre Channel over Ethernet (FCoE) / Data Center Bridge (DCB) cloud, local area network (LAN), wide area network (WAN), storage area network (SAN)), or via any suitable electromagnetic carrier signal, including infrared signals. As depicted in the illustrated embodiment, the computing system 1500 includes one or more fans or fan trays 1518 and one or more cooling subsystem controllers 1517, which monitor the thermal temperature of the system 1500 (or its components) and operate the fans / fan trays 1518 to help regulate the temperature.

[0148] In the illustrated system, all major system components can be connected to bus 1516, which may represent more than one physical bus. However, the various system components may or may not be physically close to each other. For example, input data and / or output data can be remotely transmitted from one physical location to another. Furthermore, programs implementing various aspects of this disclosure can be accessed from a remote location (e.g., a server) via a network. Such data and / or programs can be transmitted via any of a variety of machine-readable media, including, for example: magnetic media such as hard disks, floppy disks, and magnetic tapes; optical media such as optical discs (CDs) and holographic devices; magneto-optical media; and hardware devices specifically configured to store or execute program code, such as application-specific integrated circuits (ASICs), programmable logic devices (PLDs), flash memory devices, other non-volatile memory (NVM) devices (such as 3D XPoint-based devices), and ROM and RAM devices.

[0149] Various aspects of this disclosure may be encoded on one or more non-transitory computer-readable media having instructions for one or more processors or processing units to cause the steps to be performed. It should be noted that the one or more non-transitory computer-readable media may include volatile and / or non-volatile memory. It should be noted that alternative embodiments are possible, including hardware implementations or software / hardware implementations. The functionality implemented in hardware may be implemented using ASICs, programmable arrays, digital signal processing circuits, etc. Therefore, the term "means" in any claim is intended to cover both software and hardware implementations. Similarly, the term "computer-readable medium" as used herein includes software and / or hardware, or a combination thereof, on which a program of instructions is contained. In light of these implementation alternatives, it should be understood that the accompanying drawings and description provide functional information required by those skilled in the art to write program code (i.e., software) and / or manufacture circuitry (i.e., hardware) to perform the desired processing.

[0150] It should be noted that embodiments of this disclosure may also relate to computer products having a non-transitory, tangible computer-readable medium having computer code thereon for performing operations of various computer implementations. The medium and computer code may be those specifically designed and constructed for the purposes of this disclosure, or they may be of types known or available to those skilled in the art. Examples of tangible computer-readable media include, for example: magnetic media such as hard disks, floppy disks, and magnetic tapes; optical media such as CDs and holographic devices; magneto-optical media; and hardware devices specifically configured to store or execute program code, such as ASICs, PLDs, flash memory devices, other non-volatile memory devices (such as 3DXPoint-based devices), and ROM and RAM devices. Examples of computer code include, for example, machine code generated by a compiler, and files containing higher-level code executed by a computer using an interpreter. Embodiments of this disclosure may be implemented, in whole or in part, as machine-executable instructions, which may be in program modules executed by a processing device. Examples of program modules include libraries, programs, routines, objects, components, and data structures. In a distributed computing environment, program modules may be physically located in a local, remote, or both setting.

[0151] Those skilled in the art will recognize that no computing system or programming language is critical for the practice of this disclosure. They will also recognize that the various elements described above can be physically and / or functionally separated into modules and / or submodules or combined together.

[0152] Those skilled in the art should understand that the foregoing embodiments and implementations are exemplary and not intended to limit the scope of this disclosure. All substitutions, enhancements, equivalents, combinations, and modifications thereof that will be apparent to those skilled in the art upon reading this specification and studying the accompanying drawings are included within the true spirit and scope of this disclosure. It should also be noted that elements of any claim can be arranged differently, including having multiple dependencies, configurations, and combinations.

Claims

1. A computer-implemented method for watermarking deep neural networks, comprising: In response to the failure to meet the first stopping condition, the following steps are executed: A set of temporary model parameters is initialized from a set of basic parameters of the base model, which includes a previously trained base model or a base model from a previous iteration. Initialize a set of preliminary watermark examples from a set of watermark data; The iteration continues until the second stopping condition is met, and includes the following steps: At least some weights of the initial set of watermarking paradigms are adjusted by backpropagation based on the verification loss obtained using the temporary model and at least some of the watermarked data. as well as At least some of the set of temporary model parameters are updated via gradient descent based on the loss obtained using the temporary model and the initial set of watermarking paradigms with adjusted weights. The initial set of watermark examples output after the second stopping condition is met will be added to a set of boundary watermark examples; as well as At least some of the basic parameters of the base model are updated using a loss obtained using the base model and the set of boundary watermarking paradigms, wherein the updated basic parameters of the base model are used to initialize a set of subsequent temporary model parameters. as well as In response to the satisfaction of the first stopping condition, the basic model with a set of final basic parameters and the set of boundary watermark examples are output. Updating at least some of the basic parameters of the basic model includes generating a mask; And update at least some of the basic parameters of the base model via mask gradient descent based on: (i) the mask, (ii) the loss obtained using the base model and the set of boundary watermarking paradigms, and (iii) the loss obtained using the base model and one or more natural inputs.

2. The computer-implemented method of claim 1, wherein the final set of basic parameters is based on at least some of the basic parameters updated using the loss obtained using the basic model and the set of boundary watermarking paradigms.

3. The computer-implemented method according to claim 1, wherein the first stopping condition includes completing a first predetermined number of iterations.

4. The computer-implemented method of claim 3, wherein the second stopping condition includes completing a second predetermined number of iterations.

5. The computer-implemented method according to claim 1, wherein generating the mask comprises: The mask is generated based on: (i) one or more first gradients obtained using the base model and one or more natural inputs, and (ii) one or more second gradients obtained using the base model and the set of boundary watermarking paradigms.

6. The computer-implemented method according to claim 5, wherein generating the mask comprises: A first sorting index of the basic parameters of the basic model is generated based on the one or more first gradients; A second sorting index for the basic parameters of the basic model is generated based on the one or more second gradients; as well as The mask is generated as the intersection of at least a portion of the first sorting index and at least a portion of the second sorting index.

7. The computer-implemented method of claim 5, wherein at least some of the basic parameters of the basic model are associated with one or more layers of the basic model.

8. The computer-implemented method of claim 7, wherein the one or more layers of the basic model include one or more final layers of the basic model.

9. A computer-implemented method for watermarking deep neural networks, comprising: Obtain a set of temporary parameters for the temporary model, which is generated based on a set of basic parameters of the base model; The temporary model is used to generate a set of boundary watermarking paradigms, which maximize the recognition loss of the temporary model on a set of watermarked data. as well as The basic model with embedded watermarks is output by embedding the set of boundary watermark paradigms into one or more basic parameters of the basic model. The generation of the set of boundary watermark examples includes: Obtain a preliminary set of watermark examples; At least some weights of the initial set of watermarking paradigms are adjusted by backpropagation based on the verification loss obtained using the temporary model and at least some of the watermarked data in the set of watermarked data; and At least some of the set of temporary parameters of the temporary model are updated via gradient descent based on the loss obtained using the temporary model and the initial set of watermarking paradigms with adjusted weights. Embedding the set of boundary watermarking paradigms into one or more basic parameters of the base model includes generating a mask; and updating the one or more basic parameters via mask gradient descent based on: (i) the mask, (ii) the loss obtained using the base model and the set of boundary watermarking paradigms, and (iii) the loss obtained using the base model and one or more natural inputs.

10. The computer-implemented method of claim 9, wherein embedding the set of boundary watermark paradigms into the basic parameters of the basic model contributes to the ability of the watermark-embedded basic model to recognize the set of watermark data, regardless of subsequent fine-tuning of the watermark-embedded basic model.

11. The computer-implemented method of claim 10, wherein embedding the set of boundary watermarking paradigms into one or more basic parameters of the base model preserves the predictions of the watermarked base model with respect to one or more natural inputs.

12. The computer-implemented method of claim 9, wherein the base model comprises (i) a pre-trained model or (ii) a previously embedded watermark base model derived from previously embedding a set of preceding boundary watermark paradigms into the previous base model.

13. The computer-implemented method of claim 9, wherein the set of preliminary watermarking paradigms comprises (i) a subset of the set of watermarked data or (ii) a set of preliminary watermarking paradigms associated with previously adjusted weights.

14. The computer-implemented method of claim 9, wherein backpropagation based on the verification loss obtained using the temporary model and at least some of the watermark data from the set of watermark data comprises: The gradient is determined using the temporary model and the set of watermarked data. as well as The gradients are aggregated and reshaped to a size corresponding to the initial set of watermark paradigms.

15. The computer-implemented method of claim 9, wherein updating at least some of the set of temporary parameters of the temporary model provides the set of boundary watermark paradigms that maximize the recognition loss of the temporary model on the set of watermark data.

16. The computer-implemented method of claim 9, wherein the one or more basic parameters of the basic model are associated with one or more layers of the basic model.

17. The computer-implemented method of claim 9, wherein generating the mask comprises: The mask is generated based on: (i) one or more first gradients obtained using the base model and one or more natural inputs, and (ii) one or more second gradients obtained using the base model and the set of boundary watermarking paradigms.

18. The computer-implemented method of claim 17, wherein generating the mask comprises: A first sorting index of the basic parameters of the basic model is generated based on the one or more first gradients; A second sorting index for the basic parameters of the basic model is generated based on the one or more second gradients; as well as The mask is generated as the intersection of at least a portion of the first sorting index and at least a portion of the second sorting index.

19. A computer-implemented method for detecting a watermarked deep neural network, comprising: The input watermark data is fed into a deep neural network, which is generated through the following operations: Obtain a set of temporary parameters for the temporary model, which is generated based on a set of basic parameters of the base model; The temporary model is used to generate a set of boundary watermarking paradigms, which maximize the recognition loss of the temporary model on a set of watermarked data. as well as The deep neural network is output by embedding the set of boundary watermark paradigms into one or more basic parameters of the base model; One or more output labels generated by the deep neural network are obtained in response to the input watermark data; as well as The origin of the deep neural network is determined based on whether the one or more output labels correspond to one or more expected output labels; The method further includes: using a loss obtained using the base model and the set of boundary watermarking paradigms to update at least some of the base parameters of the base model, wherein the updated base parameters of the base model are used to initialize a set of subsequent temporary model parameters. Updating at least some of the fundamental parameters of the base model includes generating a mask; and updating at least some of the fundamental parameters of the base model via mask gradient descent based on: (i) the mask, (ii) the loss obtained using the base model and the set of boundary watermarking paradigms, and (iii) the loss obtained using the base model and one or more natural inputs.

Images