Model authentication method and device for generative adversarial network

Abstract

This invention provides a model authentication method and device for Generative Adversarial Networks (GANs), comprising: Step 1, after the GAN is trained, a discriminator D and a generator G are obtained. The generator G is deployed on a server to provide services, while the discriminator D cannot be publicly disclosed; Step 2, the discriminator D is converted into a single classifier D0, and a batch of images is generated using the generator G as a training set; Step 3, the parameters of the discriminator D are loaded into the single classifier D0 as initialization, and the single classifier D0 is trained on the training set generated by the generator G by optimizing the loss function L, and the training is saved after completion; Step 4, when a suspicious model G' similar to the generator G is found, the single classifier D0 is used for authentication: if the single classifier D0 determines that the suspicious model G' is the same as the generator G, then the suspicious model G' is determined to be obtained by stealing or copying the generator G; otherwise, the suspicious model G' is determined to be legitimate. This invention has the characteristics of strong robustness.

Description

Technical Field

[0001] This invention relates to the field of information security technology, and in particular to a model authentication method and device for generative adversarial networks. Background Technology

[0002] In recent years, deep learning has developed rapidly, and neural network models have been widely applied in various fields. Generative Adversarial Networks (GANs) are a representative branch of neural networks, achieving excellent performance in tasks such as realistic image generation, image segmentation, and image style transfer. A GAN consists of two networks: a discriminator and a generator, which are trained together in a game-like interaction. After training, the discriminator is typically discarded, while the generator is saved and used.

[0003] Typically, businesses or individuals deploy a trained model to a cloud server and provide related services through its API. However, deployed models can be maliciously stolen, copied, and redeployed by third parties for illicit profit. Training a neural network model requires significant computing resources and time, and such actions can cause substantial losses to the model owner. Therefore, model ownership authentication is a crucial technology for protecting the rights of the owner.

[0004] Currently, the main authentication method involves embedding specific identity information into the model as proof of ownership. However, existing methods are primarily geared towards discriminative models such as classifiers, and most cannot be directly applied to GANs. Methods applicable to GANs typically lack robustness to model modifications such as fine-tuning and pruning, and are vulnerable to fuzzy attacks. A fuzzy attack occurs when an attacker, knowing the model authentication method, can embed a new identity using the same method. With two identities, the model's ownership cannot be determined. Therefore, developing a model authentication method and device specifically for Generative Adversarial Networks (GANs) to effectively overcome the shortcomings of the aforementioned technologies has become a pressing technical problem in the industry. Summary of the Invention

[0005] To address the aforementioned problems in the existing technology, embodiments of the present invention provide a model authentication method and device for generative adversarial networks.

[0006] In a first aspect, embodiments of the present invention provide a model authentication method for generative adversarial networks (GANs), comprising: Step 1, after the GAN is trained, a discriminator D and a generator G are obtained. The generator G is deployed on a server to provide services, while the discriminator D cannot be made public; Step 2, the discriminator D is converted into a single classifier D0, and a batch of images is generated using the generator G as a training set; Step 3, the parameters of the discriminator D are loaded onto the single classifier D0 as initialization, and the single classifier D0 is trained on the training set generated by the generator G by optimizing the loss function L, and the training is saved after completion; Step 4, when a suspicious model G' similar to the generator G is found, the single classifier D0 is used for authentication: if the single classifier D0 determines that the suspicious model G' is the same as the generator G, then the suspicious model G' is determined to be obtained by stealing or copying the generator G; otherwise, the suspicious model G' is determined to be without problems.

[0007] Based on the above method embodiments, the model authentication method for generative adversarial networks provided in this embodiment of the invention specifically includes the following steps in step 1: For generative adversarial networks (GANs) with an additional classifier and whose input and output are both images, the training process does not require modification; for generative adversarial networks (GANs) that generate realistic images, an additional loss function is added to the original loss functions of the discriminator D and the generator G.

[0008] Based on the above method embodiments, the model authentication method for generative adversarial networks provided in this embodiment of the invention adds the following to the original loss functions of the discriminator D and the generator G: include:

[0009]

[0010] in, Here, z represents the Pearson coefficient, and z represents the input noise. These are the output values ​​of the penultimate layer of discriminator D, all of which are of dimension n. z The tensor, z i and Let be the i-th element; avg and std represent the mean and standard deviation, respectively.

[0011] Based on the above method embodiments, the model authentication method for generative adversarial networks provided in this embodiment of the invention includes step 2, which specifically includes: the original discriminator D has an output dimension of 1, and is replaced by a fully connected layer with an output dimension of 1 / 2 power of the image length and width; the number of training sets generated by the generator G is any value between 10,000 and 15,000.

[0012] Based on the above method embodiments, the model authentication method for generative adversarial networks provided in this embodiment of the invention specifically includes step 3: the loss function L is specifically:

[0013]

[0014] Where R is a value initialized to 0, updated along with the parameters of the single classifier D0; v is the training hyperparameter, taking any number between (0,1); n is the number of data points, x i This represents the i-th data; |||| 2 It is in the second normal form; c is a tensor with the same dimension as the output of the single classifier D0, which is determined before training begins, and max is the maximum value.

[0015] Based on the above method embodiments, the model authentication method for generative adversarial networks provided in this embodiment of the invention, wherein c is a tensor with the same dimension as the output of a single classifier D0, determined before training begins, includes:

[0016]

[0017] Where, D0(x) i ) represents the output of a single classifier D0.

[0018] Based on the above method embodiments, the model authentication method for generative adversarial networks provided in this embodiment of the invention specifically includes step 4 as follows: When a suspicious model G' similar to the generator G is found, two batches of images X and X' are generated using the two models respectively, where the values ​​of X and X' are any numbers between 500 and 1000. The data labels in X are set to 0, and those in X' are set to 1. A single classifier D0 is used to calculate a score for each data point. Specifically:

[0019] score=||D0(x)-c|| 2 -R 2

[0020] Based on the scores and labels, the AUC value is calculated. When the AUC value is below 60%, the generator G and the suspicious model G' are the same model, and the suspicious model G' was illegally copied or stolen from the generator G. Conversely, the generator G and the suspicious model G' are not the same model. The basis for model authentication is to determine whether there is a difference between X and X'. The magnitude of the difference is proportional to the AUC value. The single classifier D0 identifies the difference between the images generated by the two different models. When there is almost no difference, the generator G and the suspicious model G' are determined.

[0021] Secondly, embodiments of the present invention provide a model authentication device for generative adversarial networks (GANs), comprising: a first main module for implementing step 1, whereby after training a GAN, a discriminator D and a generator G are obtained, and the generator G is deployed on a server to provide services, while the discriminator D cannot be made public; a second main module for implementing step 2, whereby the discriminator D is converted into a single classifier D0, and a batch of images is generated using the generator G as a training set; a third main module for implementing step 3, whereby the parameters of the discriminator D are loaded onto the single classifier D0 as initialization, and the single classifier D0 is trained on the training set generated by the generator G by optimizing the loss function L, and the training is saved after completion; and a fourth main module for implementing step 4, whereby when a suspicious model G' similar to the generator G is found, the single classifier D0 is used for authentication: if the single classifier D0 determines that the suspicious model G' is the same as the generator G, then the suspicious model G' is determined to be obtained by stealing or copying the generator G; otherwise, the suspicious model G' is determined to be without problems.

[0022] Thirdly, embodiments of the present invention provide an electronic device, comprising:

[0023] At least one processor; and

[0024] At least one memory communicatively connected to the processor, wherein:

[0025] The memory stores program instructions that can be executed by the processor. The processor can call the program instructions to execute the model authentication method for generative adversarial networks provided by any of the various implementations of the first aspect.

[0026] Fourthly, embodiments of the present invention provide a non-transitory computer-readable storage medium storing computer instructions that cause a computer to execute a model authentication method for generative adversarial networks provided by any of the various implementations of the first aspect.

[0027] The model authentication method and device for generative adversarial networks provided in this invention only require the output of the suspicious model without operating on the model itself. It can still maintain stable performance even in the face of possible modifications made by attackers after stealing the model, and can resist fuzzy attacks. It can be applied to GANs for different tasks and has the characteristics of simple authentication method, strong robustness and good generalization. Attached Figure Description

[0028] To more clearly illustrate the technical solutions in the embodiments of the present invention or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0029] Figure 1 A flowchart of a model authentication method for generative adversarial networks provided in an embodiment of the present invention;

[0030] Figure 2 This is a schematic diagram of the structure of a model authentication device for generative adversarial networks provided in an embodiment of the present invention;

[0031] Figure 3 This is a schematic diagram of the physical structure of an electronic device provided in an embodiment of the present invention. Detailed Implementation

[0032] To make the objectives, technical solutions, and advantages of the embodiments of the present invention clearer, the technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention. In addition, the technical features of the various embodiments or individual embodiments provided by the present invention can be arbitrarily combined with each other to form feasible technical solutions. Such combinations are not constrained by the order of steps and / or structural composition patterns, but must be based on the ability of those skilled in the art to implement them. When the combination of technical solutions is contradictory or cannot be implemented, it should be considered that such a combination of technical solutions does not exist and is not within the scope of protection claimed by the present invention.

[0033] This invention provides a model authentication method for generative adversarial networks (GANs), see [link to relevant documentation]. Figure 1The method includes: Step 1: After training the Generative Adversarial Network (GAN), a discriminator D and a generator G are obtained. The generator G is deployed on a server to provide services, while the discriminator D cannot be made public; Step 2: The discriminator D is converted into a single classifier D0, and a batch of images is generated using the generator G as a training set; Step 3: The parameters of the discriminator D are loaded into the single classifier D0 as initialization, and the single classifier D0 is trained on the training set generated by the generator G by optimizing the loss function L. After training, the data is saved; Step 4: When a suspicious model G' similar to the generator G is found, the single classifier D0 is used for authentication: if the single classifier D0 determines that the suspicious model G' is the same as the generator G, then the suspicious model G' is determined to be obtained by stealing or copying the generator G; otherwise, the suspicious model G' is determined to be without problems.

[0034] Based on the above method embodiments, as an optional embodiment, the model authentication method for generative adversarial networks provided in this embodiment of the invention specifically includes the following steps in step 1: For generative adversarial networks (GANs) with an additional classifier and whose input and output are both images, the training process does not require modification; for generative adversarial networks (GANs) that generate realistic images, an additional loss function is added to the original loss functions of the discriminator D and the generator G.

[0035] Based on the above method embodiments, as an optional embodiment, the model authentication method for generative adversarial networks provided in this embodiment of the invention adds to the original loss functions of the discriminator D and the generator G... include:

[0036]

[0037] in, Here, z represents the Pearson coefficient, and z represents the input noise. These are the output values ​​of the penultimate layer of discriminator D, all of which are of dimension n. z The tensor, z i and Let be the i-th element; avg and std represent the mean and standard deviation, respectively.

[0038] Based on the above method embodiments, as an optional embodiment, the model authentication method for generative adversarial networks provided in this embodiment of the invention specifically includes step 2: the original discriminator D has an output dimension of 1, which is replaced by a fully connected layer with an output dimension of 1 / 2 power of the image length and width; the number of training sets generated by the generator G is any value between 10,000 and 15,000.

[0039] Based on the above method embodiments, as an optional embodiment, the model authentication method for generative adversarial networks provided in this embodiment of the invention specifically includes step 3: the loss function L is specifically:

[0040]

[0041] Where R is a value initialized to 0, updated along with the parameters of the single classifier D0; v is the training hyperparameter, taking any number between (0,1); n is the number of data points, x i This represents the i-th data; |||| 2 It is in the second normal form; c is a tensor with the same dimension as the output of the single classifier D0, which is determined before training begins, and max is the maximum value.

[0042] Based on the above method embodiments, as an optional embodiment, the model authentication method for generative adversarial networks provided in this embodiment of the invention, wherein c is a tensor with the same dimension as the output of a single classifier D0, determined before training begins, includes:

[0043]

[0044] Where, D0(x) i ) represents the output of a single classifier D0.

[0045] Based on the above method embodiments, as an optional embodiment, the model authentication method for generative adversarial networks provided in this embodiment of the invention specifically includes step 4 as follows: When a suspicious model G' similar to the generator G is found, two batches of images X and X' are generated using the two models respectively, where the values ​​of X and X' are any numbers between 500 and 1000. The data labels in X are set to 0, and those in X' are set to 1. A single classifier D0 is used to calculate a score for each data point. Specifically:

[0046] score=||D0(x)-c|| 2 -R 2

[0047] Based on the scores and labels, the AUC value is calculated. When the AUC value is below 60%, the generator G and the suspicious model G' are the same model, and the suspicious model G' was illegally copied or stolen from the generator G. Conversely, the generator G and the suspicious model G' are not the same model. The basis for model authentication is to determine whether there is a difference between X and X'. The magnitude of the difference is proportional to the AUC value. The single classifier D0 identifies the difference between the images generated by the two different models. When there is almost no difference, the generator G and the suspicious model G' are determined.

[0048] The model authentication method for generative adversarial networks provided in this invention only requires the output of the suspicious model without operating on the model itself. It can still maintain stable performance even in the face of possible modifications made by attackers after stealing the model, and it can resist fuzzy attacks. It can be applied to GANs for different tasks and has the characteristics of simple authentication method, strong robustness and good generalization.

[0049] The various embodiments of this invention are implemented through programmed processing using a device with processor functionality. Therefore, in practical engineering, the technical solutions and functions of the various embodiments of this invention can be encapsulated into various modules. Based on this reality, and building upon the above embodiments, this invention provides a model authentication device for generative adversarial networks (GANs), which executes the model authentication method for GANs in the above method embodiments. See also... Figure 2 The device includes: a first main module for implementing step 1, whereby after the Generative Adversarial Network (GAN) is trained, a discriminator D and a generator G are obtained. The generator G is deployed to a server to provide services, while the discriminator D cannot be made public; a second main module for implementing step 2, whereby the discriminator D is converted into a single classifier D0, and a batch of images is generated using the generator G as a training set; a third main module for implementing step 3, whereby the parameters of the discriminator D are loaded onto the single classifier D0 as initialization, and the single classifier D0 is trained on the training set generated by the generator G by optimizing the loss function L, and the training is saved after completion; and a fourth main module for implementing step 4, whereby when a suspicious model G' similar to the generator G is found, the single classifier D0 is used for authentication: if the single classifier D0 determines that the suspicious model G' is the same as the generator G, then the suspicious model G' is determined to be obtained by stealing or copying the generator G; otherwise, the suspicious model G' is determined to be without problems.

[0050] The model authentication device for generative adversarial networks provided in this embodiment of the invention employs... Figure 2 Several modules in the model only need to use the output of the suspicious model without operating on the model itself. It can still maintain stable performance even if the attacker steals the model and makes modifications. It can also resist fuzzy attacks and can be applied to GANs for different tasks. It has the characteristics of simple authentication method, strong robustness and good generalization.

[0051] It should be noted that the apparatus in the device embodiments provided by the present invention can be used not only to implement the methods in the above method embodiments, but also to implement the methods in other method embodiments provided by the present invention. The difference lies only in the setting of corresponding functional modules. Its principle is basically the same as that of the above device embodiments provided by the present invention. As long as those skilled in the art, based on the above device embodiments and referring to the specific technical solutions in other method embodiments, obtain corresponding technical means and technical solutions composed of these technical means by combining technical features, and improve the apparatus in the above device embodiments while ensuring the practicality of the technical solutions, they can obtain corresponding device-type embodiments for implementing the methods in other method-type embodiments. For example:

[0052] Based on the above-described device embodiments, as an optional embodiment, the model authentication device for generative adversarial networks provided in this embodiment of the invention further includes: a first submodule, used to implement step 1, specifically including: for generative adversarial networks (GANs) with an additional classifier and whose input and output are both images, the training process does not need to be modified; for generative adversarial networks (GANs) that generate realistic images, an additional loss function is added to the original loss functions of the discriminator D and the generator G.

[0053] Based on the above-described device embodiments, as an optional embodiment, the model authentication device for generative adversarial networks provided in this embodiment of the invention further includes: a second submodule, used to implement the addition of [the following] to the original loss functions of the discriminator D and the generator G. include:

[0054]

[0055] in, Here, z represents the Pearson coefficient, and z represents the input noise. These are the output values ​​of the penultimate layer of discriminator D, all of which are of dimension n. z The tensor, z i and Let be the i-th element; avg and std represent the mean and standard deviation, respectively.

[0056] Based on the above device embodiments, as an optional embodiment, the model authentication device for generative adversarial networks provided in this embodiment of the invention further includes: a third sub-module, used to implement step 2, specifically including: the original discriminator D has an output dimension of 1, which is replaced by a fully connected layer with an output dimension of 1 / 2 power of the image length and width; the number of training sets generated by the generator G is any value between 10000 and 15000.

[0057] Based on the above-described device embodiments, as an optional embodiment, the model authentication device for generative adversarial networks provided in this embodiment of the invention further includes: a fourth sub-module, used to implement step 3, specifically including: the loss function L specifically being:

[0058]

[0059] Where R is a value initialized to 0, updated along with the parameters of the single classifier D0; v is the training hyperparameter, taking any number between (0,1); n is the number of data points, x i This represents the i-th data; |||| 2 It is in the second normal form; c is a tensor with the same dimension as the output of the single classifier D0, which is determined before training begins, and max is the maximum value.

[0060] Based on the above-described device embodiments, as an optional embodiment, the model authentication device for generative adversarial networks provided in this embodiment of the invention further includes: a fifth submodule, used to determine that c is a tensor with the same dimension as the output of a single classifier D0 before training begins, including:

[0061]

[0062] Where, D0(x) i ) represents the output of a single classifier D0.

[0063] Based on the above-described device embodiments, as an optional embodiment, the model authentication device for generative adversarial networks provided in this embodiment of the invention further includes: a sixth submodule, used to implement step 4, specifically including: when a suspicious model G' similar to the generator G is discovered, generating two batches of images X and X' using the two models respectively, where the values ​​of X and X' are any numbers between 500 and 1000, setting the data labels in X to 0 and those in X' to 1, and using a single classifier D0 to calculate a score for each data point, specifically:

[0064] score=||D0(x)-c|| 2 -R 2

[0065] Based on the scores and labels, the AUC value is calculated. When the AUC value is below 60%, the generator G and the suspicious model G' are the same model, and the suspicious model G' was illegally copied or stolen from the generator G. Conversely, the generator G and the suspicious model G' are not the same model. The basis for model authentication is to determine whether there is a difference between X and X'. The magnitude of the difference is proportional to the AUC value. The single classifier D0 identifies the difference between the images generated by the two different models. When there is almost no difference, the generator G and the suspicious model G' are determined.

[0066] The method in this embodiment of the invention is implemented using an electronic device; therefore, it is necessary to introduce the relevant electronic device. For this purpose, this embodiment of the invention provides an electronic device, such as... Figure 3 As shown, the electronic device includes at least one processor, a communications interface, at least one memory, and a communications bus, wherein the at least one processor, the communications interface, and the at least one memory communicate with each other via the communications bus. The at least one processor can invoke logical instructions stored in the at least one memory to execute all or part of the steps of the methods provided in the foregoing method embodiments.

[0067] Furthermore, when the logical instructions in at least one of the aforementioned memories can be implemented as software functional units and sold or used as independent products, they can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present invention, in essence, or the part that contributes to the prior art, or a part of the technical solution, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute all or part of the steps of the methods described in the various method embodiments of the present invention. The aforementioned storage medium includes various media capable of storing program code, such as USB flash drives, portable hard drives, read-only memory (ROM), random access memory (RAM), magnetic disks, or optical disks.

[0068] The device embodiments described above are merely illustrative. The units described as separate components may or may not be physically separate. The components shown as units may or may not be physical units; that is, they may be located in one place or distributed across multiple network units. Some or all of the modules can be selected to achieve the purpose of this embodiment according to actual needs. Those skilled in the art can understand and implement this without any creative effort.

[0069] Through the above description of the embodiments, those skilled in the art can clearly understand that each embodiment can be implemented by means of software plus necessary general-purpose hardware platforms, and of course, it can also be implemented by hardware. Based on this understanding, the above technical solutions, in essence or the part that contributes to the prior art, can be embodied in the form of a software product. This computer software product can be stored in a computer-readable storage medium, such as ROM / RAM, magnetic disk, optical disk, etc., and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute the methods described in the various embodiments or some parts of the embodiments.

[0070] The flowcharts and block diagrams in the accompanying drawings illustrate the architecture, functionality, and operation of possible implementations of systems, methods, and computer program products according to various embodiments of the present invention. Based on this understanding, each block in a flowchart or block diagram may represent a module, segment, or portion of code containing one or more executable instructions for implementing a specified logical function. It should also be noted that in some alternative implementations, the functions marked in the blocks may occur in a different order than those shown in the drawings. For example, two consecutive blocks may actually be executed substantially in parallel, or sometimes in reverse order, depending on the functions involved. It should also be noted that each block in the block diagrams and / or flowcharts, and combinations of blocks in the block diagrams and / or flowcharts, can be implemented using a dedicated hardware-based system that performs the specified function or action, or using a combination of dedicated hardware and computer instructions.

[0071] It should be noted that the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such process, method, article, or apparatus. Unless otherwise specified, an element defined by the phrase "comprising..." does not exclude the presence of other identical elements in the process, method, article, or apparatus that includes said element.

[0072] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention, and not to limit them; although the present invention has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that modifications can still be made to the technical solutions described in the foregoing embodiments, or equivalent substitutions can be made to some of the technical features; and these modifications or substitutions do not cause the essence of the corresponding technical solutions to deviate from the spirit and scope of the technical solutions of the embodiments of the present invention.

Claims

1. A model authentication method for generative adversarial networks, characterized in that, include: Step 1: After training the Generative Adversarial Network (GAN), a discriminator D and a generator G are obtained. Generator G is deployed on a server to provide services, while discriminator D cannot be publicly disclosed. Step 2: The discriminator D is converted into a single classifier D0, and a batch of images is generated using generator G as the training set. Step 3: The parameters of discriminator D are loaded into single classifier D0 as initialization. Single classifier D0 is trained on the training set generated by generator G by optimizing the loss function L. After training, the data is saved. Step 4: Suspicious models similar to generator G are detected. At that time, a single classifier D0 is used for authentication: if the single classifier D0 determines the model to be suspicious... If the generator G is the same as the model, then the model is identified as suspicious. It was obtained by stealing or copying the generator G; otherwise, a suspicious model is identified. No problem; The loss function L used in step 3 is as follows: Where R is a value initialized to 0, updated along with the parameters of the single classifier D0; v is the training hyperparameter, taking any number in (0,1); and n is the number of data points. This represents the i-th data element. It is in the second normal form; c is a tensor with the same dimension as the output of the single classifier D0, which is determined before training begins, and max is the maximum value. The c is a tensor with the same dimension as the output of the single classifier D0, determined before training begins, including: in, This is the output of a single classifier, D0.

2. The model authentication method for generative adversarial networks according to claim 1, characterized in that, Step 1 specifically includes: For Generative Adversarial Networks (GANs) with an additional classifier and whose input and output are both images, the training process requires no modification; for GANs that generate realistic images, add [something] to the original loss functions of the discriminator D and the generator G. .

3. The model authentication method for generative adversarial networks according to claim 2, characterized in that, The addition of the following to the original loss functions of the discriminator D and the generator G... ,include: in, Here, z represents the Pearson coefficient, and z represents the input noise. These are the output values ​​of the penultimate layer of discriminator D, all of which are of dimension 1. tensor, and Let be the i-th element; avg and std represent the mean and standard deviation, respectively.

4. The model authentication method for generative adversarial networks according to claim 3, characterized in that, Step 2 specifically includes: the original discriminator D has an output dimension of 1, which is replaced by a fully connected layer with an output dimension that is the power of 1 / 2 of the image's length and width; the generator G generates a training set with any number of values ​​between 10,000 and 15,000.

5. The model authentication method for generative adversarial networks according to claim 4, characterized in that, Step 4 specifically includes: identifying suspicious models similar to the generator G. At that time, two batches of images X and X were generated using two different models. X and The values ​​are all numbers between 500 and 1000. Set the data labels in X to 0. The value in the range is set to 1, and a single classifier D0 is used to calculate a score for each data point, specifically: Based on the scores and labels, the AUC value is calculated. When the AUC value is below 60%, the generator G is considered a suspicious model. It's the same model, a suspicious model. It was illegally copied or stolen from the generator G; otherwise, the generator G and the suspicious model... These are not the same model; their model certification is based on judging X against... The difference between the two models is determined by the magnitude of the difference, which is proportional to the AUC value. A single classifier D0 identifies the difference between images generated by two different models. When there is almost no difference, the generator G is identified as the suspected model. .

6. A model authentication device for generative adversarial networks, characterized in that, include: The first main module is used to implement step 1. After the Generative Adversarial Network (GAN) is trained, a discriminator D and a generator G will be obtained. The generator G will be deployed on the server to provide services, while the discriminator D cannot be made public. The second main module is used to implement step 2, converting the discriminator D into a single classifier D0, and generating a batch of images as a training set using the generator G; the third main module is used to implement step 3, loading the parameters of the discriminator D onto the single classifier D0 as initialization, training the single classifier D0 on the training set generated by the generator G by optimizing the loss function L, and saving the training after completion; the fourth main module is used to implement step 4, identifying suspicious models similar to the generator G. At that time, a single classifier D0 is used for authentication: if the single classifier D0 determines the model to be suspicious... If the generator G is the same as the model, then the model is identified as suspicious. It was obtained by stealing or copying the generator G; otherwise, a suspicious model is identified. No problem; The loss function L used in step 3 is as follows: Where R is a value initialized to 0, updated along with the parameters of the single classifier D0; v is the training hyperparameter, taking any number in (0,1); and n is the number of data points. This represents the i-th data element. It is in the second normal form; c is a tensor with the same dimension as the output of the single classifier D0, which is determined before training begins, and max is the maximum value. The c is a tensor with the same dimension as the output of the single classifier D0, determined before training begins, including: in, This is the output of a single classifier, D0.

7. An electronic device, characterized in that, include: At least one processor, at least one memory, and a communication interface; wherein, The processor, memory, and communication interface communicate with each other; The memory stores program instructions that can be executed by the processor, which invokes the program instructions to perform the method described in any one of claims 1 to 5.

8. A non-transitory computer-readable storage medium, characterized in that, The non-transitory computer-readable storage medium stores computer instructions that cause the computer to perform the method described in any one of claims 1 to 5.

Images