A model watermark-based machine learning model copyright protection method

Abstract

This invention discloses a model watermarking-based method for copyright protection of machine learning models. This method embeds an invisible, secret watermark into the machine learning model to meet the needs of model traceability and copyright protection, reducing the risk of intellectual property infringement. This invention regularizes the original machine learning model by training a new "implanted model," making the watermark implantation more closely coupled to the model's main classification task. Compared to previous model watermarking methods, this method's implanted watermark exhibits stronger robustness against watermark removal attacks, especially distillation attacks, where it demonstrates better resistance.

Description

Technical Field

[0001] This invention relates to the fields of AI security, machine learning, and digital watermarking, and in particular to a method for protecting the copyright of machine learning models based on model watermarking. Background Technology

[0002] With the continuous development of artificial intelligence technology, machine learning models have become increasingly powerful, achieving great success in various fields such as image classification, speech recognition, and natural language processing. However, training a high-performing machine learning model often requires a large amount of high-quality data, expensive computing resources, and expert knowledge. Therefore, Machine Learning as a Service (MLAS) has emerged, with third parties such as Google, Amazon, and Microsoft providing cloud services to developers, allowing users to quickly implement tasks using machine learning models. Machine learning models can be sold or licensed, becoming traditional commercial software with not only high commercial value but also intellectual property protection. However, attackers can use model theft attacks to steal most of the model's functionality, causing economic losses to the model provider and infringing on its intellectual property rights. Consequently, the need for model traceability and copyright protection is growing.

[0003] Researchers have discovered that a series of secret information can be implanted into a model during the training phase to achieve the purpose of adding a "watermark" to the model. When the same or similar watermarks are extracted from suspicious models, the ownership of the model can be verified. Currently, watermarking technology is mainly divided into two categories: one is to embed the watermark directly into the model's weight parameters, and the other is to embed the watermark in the model's prediction information.

[0004] However, current model watermarking technology has a key flaw:

[0005] Attackers can remove watermarks through fine-tuning, pruning, distillation, and other watermark removal attacks, rendering the watermark ineffective. Especially when facing model distillation attacks, watermarks generated by existing methods can be completely removed. Summary of the Invention

[0006] The purpose of this invention is to address the shortcomings of existing model watermarking technologies by providing a method for copyright protection of machine learning models based on model watermarking. This invention is achieved through the following technical solution:

[0007] This invention discloses a method for copyright protection of machine learning models based on model watermarking, comprising the following steps:

[0008] S1, Obtain the watermark-carrying dataset: Randomly generate data points and construct an image by using a pseudo-random number generator based on a random seed, and randomly select a category as the label from the categories of the main classification task to obtain the watermark-carrying dataset.

[0009] S2, Construct and train the implantation model: Construct an implantation model with the same network structure as the main classification task model. Train the implantation model using the watermark-carrying dataset from S1. The parameters of the implantation model will implicitly carry the model watermark information. When the training set of the main classification task model passes through the implantation model, the prediction results will implicitly contain the watermark information.

[0010] S3, Training the main classification task model: Use the implantation model to deregulate the training of the main classification task model, forcing the main classification task model to learn both the main classification task and the watermark implantation task at the same time, reducing the independence between the two tasks, thereby achieving better robustness.

[0011] S4, Extract watermark and verify model copyright: The main classification task model obtained through S3 is the original model after watermark protection. Input the watermark-carrying dataset into the suspicious model to obtain the number of successfully extracted watermarked images. Compare it with the set threshold. If the number is greater than or equal to the set threshold, it means that the suspicious model is similar to the original model and is likely a derivative model of the original model. It is believed that the model has been stolen and the copyright has been threatened. In order to better select the threshold to verify the model copyright, evaluation index 1 - classification accuracy of the main task and evaluation index 2 - watermark extraction rate are set.

[0012] As a further improvement, in step S1 of this invention, the random walk algorithm is used to randomly generate data points to form the image. Starting from the center of the blank image, the algorithm moves one random pixel in a random direction, and this step is iterated multiple times to finally obtain the watermark-carrying dataset D. S .

[0013] As a further improvement, in step S2 of this invention, constructing an implantation model with the same network structure as the main classification task model specifically involves: constructing a neural network with the same network structure as the main classification task model, where θ is the network parameter; training this neural network on the watermark-carrying dataset using stochastic gradient descent; and finally obtaining the implantation model H. θ The training loss function is as follows:

[0014]

[0015] Among them, D S It is a watermark that carries the dataset, x s It is D S The image in the image, y s It is its corresponding real label. It is the cross-entropy function.

[0016] As a further improvement, in step S3 of this invention, the deregularization of the main classification task model training using the implanted model specifically involves: inputting the main classification task training set into the implanted model H. θ The predicted result, which contains implicit watermark information, is used to assist in the training of the main classification task model. This enables the model to learn two tasks simultaneously. ω An additional regularization term needs to be added during training, and the training loss function is as follows:

[0017]

[0018] Where D is the training set for the main classification task, x is an image in D, y is its corresponding ground truth label, λ is the regularization coefficient, T is the temperature coefficient in the softmax function, and M... ω，T This indicates that the temperature coefficient of the softmax layer in this model is T;

[0019] The final training loss function for the main classification task model is:

[0020]

[0021]

[0022] As a further improvement, the evaluation index 1—classification accuracy of the main task—is used to measure the performance of the original model after watermark implantation; the evaluation index 2—watermark extraction rate—is used to measure the watermark implantation effect. To better compare the effects of watermark implantation using different methods, the watermark extraction rate is standardized as follows:

[0023]

[0024] Where, P, represents the watermark extraction rate before and after standardization, respectively, where c is the number of categories in the dataset carried by the watermark. This represents the probability of a random guess being correct.

[0025] In the model copyright protection process, the number of successfully extracted watermarked images from a suspicious model is compared with a set threshold to determine whether the model has been stolen. The threshold is selected with the help of ROC curve, and the ROC curve is obtained with the help of evaluation index 1 and evaluation index 2.

[0026] The beneficial effects of this invention are as follows:

[0027] The method of this invention addresses the needs of model traceability and copyright protection by embedding an invisible secret watermark into a machine learning model, thereby reducing the risk of intellectual property infringement. By training a new "implanted model" to regularize the original machine learning model, the watermark implantation is more closely coupled to the model's main classification task. Compared to previous model watermark implantation methods, this method provides stronger robustness against watermark removal attacks, especially distillation attacks, where it offers better protection.

[0028] This invention trains an additional "implantation model" to make the watermark embedding process independent of the model's classification task, increasing their relevance. The watermark embedding model trained in this way can effectively resist watermark removal attacks such as model fine-tuning, pruning, and distillation, thereby enabling better protection of model copyright. Attached Figure Description

[0029] Figure 1 This is a schematic diagram illustrating the principle of embedding watermarks into the model using the method of this invention.

[0030] Figure 2 The ROC curves are for the CIFAR-10 classification model (after distillation) with different amounts of watermark implantation. Detailed Implementation

[0031] To make the above-mentioned objects, features and advantages of the present invention more apparent and understandable, the specific embodiments of the present invention will be described in detail below with reference to the accompanying drawings.

[0032] Many specific details are set forth in the following description in order to provide a full understanding of the invention. However, the invention may also be practiced in other ways different from those described herein, and those skilled in the art can make similar extensions without departing from the spirit of the invention. Therefore, the invention is not limited to the specific embodiments disclosed below.

[0033] The copyright protection method for machine learning models based on model watermarking provided in this invention includes the following steps:

[0034] Step 1: Obtain the training set for the main classification task and the watermark-carrying dataset.

[0035] In this embodiment, the training sets for the main classification task are the MNIST and CIFAR-10 datasets. The watermark carries the images in the dataset and generates data points through random walks. The labels are randomly generated from the image categories in MNIST or CIFAR-10.

[0036] The corresponding dataset may have the following possibilities:

[0037] a: The training set for the main classification task is MNIST, and the watermark carries a dataset label that is a random one of the categories in the MNIST dataset.

[0038] b: The training set for the main classification task is CIFAR-10, and the watermark carries a dataset label that is a random one of the categories in the CIFAR-10 dataset.

[0039] Step 2: Training the implantation model

[0040] The choice of the initial network for the model varies depending on the dataset selected.

[0041] When selecting dataset classification a, a fully connected neural network with two hidden layers and 1200 neurons in each hidden layer is chosen as the initial network of the model;

[0042] When selecting dataset class b, a convolutional neural network with two convolutional layers, one pooling layer, and two fully connected layers (containing 256 neurons) is selected as the initial network of the model.

[0043] The model training set is a watermark-carrying dataset. As the loss function, the implanted model H is obtained through training with stochastic gradient descent. θ .

[0044] Step 3: Train the main classification task model, the principle is as follows: Figure 1 As shown;

[0045] The initial network of the main classification task model is the same as the implanted model, and the parameters of the implanted model are fixed.

[0046] (1) Calculate the watermark implantation loss

[0047] The training set D for the main classification task is input into the model to obtain the output result H. θ (x), then input the main classification task training set D into the main classification task model (the temperature coefficient of the Softmax function is T) to obtain the output result M. ω，T (x), calculate their cross-entropy function as the implantation loss;

[0048] In the process of watermark implantation, in order to preserve watermark information to the greatest extent possible, for M ω，T Set a larger T to smooth the output M. ω，T (x), this can reduce M ω，T (x) and H θ The distance between (x) makes the output of the main classification task model more relevant to the watermark information, effectively improving the watermark's resistance to distillation attacks.

[0049] (2) Calculate the loss of the main classification task

[0050] The main classification task training set D and the watermark are carried in the dataset D. SSimultaneously input into the main classification task model, and obtain the output M ω，1 (x∪x s The cross-entropy function is calculated between the actual class label and the actual class label to obtain the loss of the main classification task.

[0051] Figure 1 In the middle, M ω，T In (x), T represents the temperature coefficient of the Softmax layer, and H represents the temperature coefficient of the Softmax layer. θ，1 (x) and M ω，１ (x∪x s The subscript 1 in the text indicates that the temperature coefficient T of the Softmax layer is 1.

[0052] The main classification task loss ensures the model's accuracy in classifying the main task. The implantation loss, as a regularization term, constrains the model to learn not only the main task but also the watermark implantation task, thus integrating watermark implantation into the main task learning process. Since the model needs to learn two tasks simultaneously, the two tasks have a certain correlation. Therefore, the watermark information is less likely to be removed during model distillation (because distillation removes some structures that are not related to the main task).

[0053] The main classification task model can be trained by combining implantation loss and classification loss, and the main classification task model can be obtained through stochastic gradient descent.

[0054] Step 4: Extract the watermark and verify the model copyright.

[0055] This method determines model copyright ownership by checking if the number of watermarks extracted exceeds a threshold. Specifically, for a model without embedded watermarks, the probability of detecting a watermark is 1 / k (where k is the number of watermark categories). This gives the "false positive" of watermark extraction. On the other hand, the "true positive" corresponds to the watermark extraction rate after model distillation. Assuming independence, the properties of the binomial distribution can be used to calculate the overall false positive and true positive rates of suspicious targets, allowing for the plotting of an ROC curve to help select an appropriate threshold. Figure 2 As shown, the ROC curves of the distilled CIFAR-10 classification model are displayed under different numbers of watermarks embedded in the dataset.

[0056] As shown in the figure, when the number of images in the dataset carried by the watermark is 10,000, although the watermark extraction rate is only 0.107, this method can still effectively verify the model's copyright with an AUC of 0.948 (AUC is the area under the ROC curve). Selecting the point at the upper left corner of the ROC curve based on the ROC plot shows that this point can achieve a high "true positive" rate (i.e., good watermark extraction) and a low "false positive" rate (i.e., a low probability of incorrect recognition). When |D SWhen |=10000, the threshold is 1033. That is, when the number of watermarks extracted is greater than or equal to 1033, the suspicious model is considered to be a derivative or stolen model of the original model.

[0057] The method of this invention is compared with existing watermark embedding methods, as shown in Table 1. The watermark carries 1000 images from the MNIST dataset. Five watermark embedding methods are listed below: methods one to four embed the watermark directly into the model weight parameters, while method five and this method embed the watermark into the model prediction information.

[0058] Method 1: Embed the watermark into the least significant bit of the parameter;

[0059] Method 2: Embed the watermark into the parameter symbols;

[0060] Method 3: Embed watermarks into parameters by associating them with the watermark;

[0061] Method 4: Embed the watermark into the statistical information of the parameters;

[0062] Method 5: Embed the watermark into the model's prediction information for the watermark set through capacity abuse.

[0063] Table 1 shows two columns of data for each watermark implantation and removal attack method: the left column represents the classification accuracy of the main task, and the right column represents the watermark extraction rate (after standardization). It can be seen that after watermark implantation using this method, the model's main task classification performance only decreases by 1%. In scenarios where the model is not attacked, the model watermark can achieve a 100% extraction success rate. Even under watermark removal attacks such as pruning, approximation, and fine-tuning, the model watermark still achieves a 100% extraction success rate, indicating that the model can completely resist attacks such as pruning, approximation, and fine-tuning. In model distillation attacks, the model watermarks embedded by methods one through five are completely ineffective, while this invention can retain some watermark information, thus resisting model distillation attacks to a certain extent.

[0064] Table 1. Comparison of the effects of the method of the present invention and existing watermark embedding methods.

[0065]

[0066] The above description is merely a preferred embodiment of the present invention. Although the present invention has been disclosed above with reference to preferred embodiments, it is not intended to limit the present invention. Any person skilled in the art can make many possible variations and modifications to the technical solutions of the present invention using the methods and techniques disclosed above, or modify them into equivalent embodiments with equivalent changes, without departing from the scope of the technical solutions of the present invention. Therefore, any simple modifications, equivalent changes, and modifications made to the above embodiments based on the technical essence of the present invention without departing from the content of the technical solutions of the present invention shall still fall within the protection scope of the technical solutions of the present invention.

Claims

1. A method for copyright protection of machine learning models based on model watermarking, characterized in that, Includes the following steps: S1, Obtain the watermark-carrying dataset: Randomly generate data points and construct an image by using a pseudo-random number generator based on a random seed, and randomly select a category as the label from the categories of the main classification task to obtain the watermark-carrying dataset. S2, Construct and train the implantation model: Construct an implantation model with the same network structure as the main classification task model. Train the implantation model using the watermark-carrying dataset from S1. The parameters of the implantation model will implicitly carry the model watermark information. When the training set of the main classification task model passes through the implantation model, the prediction results will implicitly contain the watermark information. S3, Training the main classification task model: Use the implantation model to deregulate the training of the main classification task model, forcing the main classification task model to learn both the main classification task and the watermark implantation task at the same time, reducing the independence between the two tasks, thereby achieving better robustness. S4, Extract watermark and verify model copyright: The main classification task model obtained through S3 is the original model after watermark protection. Input the watermark-carrying dataset into the suspicious model to obtain the number of successfully extracted watermark images. Compare it with the set threshold. If the number is greater than or equal to the set threshold, it means that the suspicious model is similar to the original model. It is believed that the model has been stolen and the copyright is threatened. In order to better select the threshold to verify the model copyright, evaluation index 1 - classification accuracy of the main task and evaluation index 2 - watermark extraction rate are set. In step S2, constructing the implantation model with the same network structure as the main classification task model specifically involves: constructing a neural network with the same network structure as the main classification task model, where θ is the network parameter, and training this neural network on the watermark-carrying dataset using stochastic gradient descent to finally obtain the implantation model H. θ The training loss function is as follows: Among them, D S It is a watermark that carries the dataset, x s It is D S The image in the image, y s It is its corresponding real label. It is the cross-entropy function; In step S3, the step of using the implanted model to deregularize the training of the main classification task model specifically involves: inputting the main classification task training set into the implanted model H. θ The predicted result, which contains implicit watermark information, is used to assist in the training of the main classification task model. This enables the model to learn two tasks simultaneously. ω An additional regularization term needs to be added during training, and the training loss function is as follows: Where D is the training set for the main classification task, x is an image in D, y is its corresponding ground truth label, λ is the regularization coefficient, T is the temperature coefficient in the softmax function, and M... ω,T This indicates that the temperature coefficient of the softmax layer in this model is T; The final training loss function for the main classification task model is:

2. The method for copyright protection of machine learning models based on model watermarking according to claim 1, characterized in that, In step S1, the random walk algorithm is used to randomly generate data points to construct the image. Starting from the center of the blank image, the algorithm moves one random pixel in a random direction. This step is iterated multiple times to finally obtain the watermark-carrying dataset D. S .

3. The method for copyright protection of machine learning models based on model watermarking according to claim 1, characterized in that, The established evaluation metric 1 – classification accuracy of the main task – is used to measure the performance of the original model after watermark implantation; the established evaluation metric 2 – watermark extraction rate – is used to measure the watermark implantation effect. To better compare the effects of watermark implantation using different methods, the watermark extraction rate is standardized as follows: Among them, P, represents the watermark extraction rate before and after standardization, respectively, where c is the number of categories in the dataset carried by the watermark. This represents the probability of a random guess being correct. In the model copyright protection process, the number of successfully extracted watermarked images from a suspicious model is compared with a set threshold to determine whether the model has been stolen. The threshold is selected with the assistance of ROC curve, and the ROC curve is obtained with the assistance of evaluation index 1 and evaluation index 2.

Images