Model copyright verification method and apparatus focusing on global model similarity

Abstract

This invention discloses a model copyright verification method that focuses on global model similarity, specifically including the following steps: Step 1: Prepare the source model M v Pirated model M s With the same origin model M h and the required dataset D v Step 2: Generate fingerprints and construct the verification fingerprint set X. v The method involves determining the decision threshold τ for judging whether a model is pirated; Step 3: Perform verification. This method addresses the problem that most existing fingerprint-based copyright protection methods only focus on the local similarity of the model and that existing copyright verification methods can only be applied to single-task scenarios.

Description

Technical Field

[0001] This invention belongs to the field of information security technology, specifically relating to a model copyright verification method that focuses on global model similarity, and also relating to a model copyright verification device that focuses on global model similarity. Background Technology

[0002] With the rapid development of deep learning, deep neural networks have demonstrated excellent performance in numerous real-world scenarios, such as facial recognition, image processing and segmentation, and autonomous driving. Training a high-performance model often requires significant financial, human, and time resources. However, some malicious companies or individuals steal these models at a relatively low cost. This behavior severely infringes on the copyright of the model owners, causing them substantial financial losses. Therefore, protecting these models is of paramount importance.

[0003] Model watermarking is a copyright protection method for deep learning models. Early model watermarking methods embedded the watermark into the model parameters, but this method is not robust to modifications of the model parameters and requires white-box access permissions to the model. [1] A black-box watermarking method using over-parameterized deep neural networks is proposed. (Zhang) [2] It predefines the prediction behavior for specific inputs and implements a remote verification mechanism for model copyright protection. (Szyller) [3] Design a proxy model copyright verification method to resist model extraction attacks. [4] This paper introduces adversarial examples into model copyright verification for the first time and implements a novel zero-position watermarking algorithm. Furthermore, Ong... [5] A protection framework based on a visible watermarking GAN model is proposed. (Zhang) [6] Deep steganography is used to hide models within watermarks to protect the copyright of image processing models. While these studies overcome the limitations of white-box permissions and achieve implementation in black-box scenarios, these model watermarking methods still require embedding watermarks by training or fine-tuning from scratch, which is not only time-consuming but may also degrade model performance.

[0004] Fingerprint-based copyright protection methods extract the intrinsic features of a model and use them as fingerprints. (Lukas) [7] The paper proposes leveraging the transferability of adversarial examples as fingerprints. [8] Wang argues that pirated models share private knowledge with the original models and proposes a dataset reasoning method. [9] Limiting the model's generalization ability and verifying ownership by triggering misclassifications thus protects the model's copyright. Chen

[10] This paper proposes a copyright protection testing framework that combines multiple evaluation metrics to determine model copyright. Classic adversarial instance generation algorithms such as FGSM, PGD, and CW are based on a single model and specific samples, failing to achieve effectiveness across the entire dataset. Existing fingerprint-based copyright protection methods mostly focus only on local model similarity, lacking consideration of global similarity. Furthermore, existing standard general adversarial instance generation algorithms are cross-model in nature, not limited to specific models. Summary of the Invention

[0005] The first objective of this invention is to provide a model copyright verification method that focuses on the global similarity of the model, which solves the problems that most existing fingerprint-based copyright protection methods only focus on the local similarity of the model and that existing copyright verification methods can only be applied to single task scenarios.

[0006] The second objective of this invention is to provide a model copyright verification device that focuses on the global similarity of models.

[0007] The first technical solution adopted in this invention is a model copyright verification method that focuses on global model similarity, specifically including the following steps:

[0008] Step 1: Prepare the source model M v Pirated model M s With the same origin model M h and the required dataset D v ;

[0009] Step 2: Generate fingerprints and construct the verification fingerprint set X v And determine the decision threshold τ for judging whether a model is pirated;

[0010] Step 3: Perform verification.

[0011] The invention is further characterized in that,

[0012] Step 1 is as follows:

[0013] Step 1.1: Prepare the source model M v and training source model M v Dataset D v ;

[0014] Step 1.2: Fine-tune and prune the image classification model or image processing model to generate the source model M. v Pirated model M s Using source model M v The same network structure, but with different random initialization methods and optimizer settings, is used in dataset D. v Training was performed on the model to obtain the homologous model M. h The pirated model M obtained through trainings and the homology model M h This is used for fingerprint generation in step 2.4.

[0015] In step 1.2, the image classification model is GoogLeNet, VGG, or ResNet; the image processing model is StarGAN or CycleGAN.

[0016] In step 1.2, for the image classification model, the fine-tuning method used is FTLL, FTAL, RTLL, or RTAL; for the image processing model, in dataset D... v Randomly select 5% to 50% of the data, and fine-tune the image processing model based on the parameters of the source model. The number of iterations is approximately M, which is the same as the number of iterations used to train the source model. v 50% of the iterations.

[0017] In step 1.2, the pruning rates are 10%, 20%, 30%, 40%, 50%, or 60%, respectively.

[0018] Step 2 specifically includes: Step 2.1, Parameter initialization: Randomly initialize the disturbance v and the disturbance amplitude l. p The step size ε of the perturbation amplitude change, the initial value of the decision threshold τ is set to 0, and the similarity threshold λ of a single image;

[0019] Step 2.2, from dataset D v A batch of samples with a size smaller than dataset D is randomly selected from the dataset. v The samples are taken as dataset X, and sample x is a sample in dataset X. The perturbation v is added to sample x, and the perturbation is calculated by the function isValidSample() based on model M. v The output results are used to filter out samples that significantly contribute to the perturbation optimization;

[0020] Step 2.3: Add the generated perturbation v to the dataset X to generate the candidate fingerprint set X. c ;

[0021] Step 2.4: Using the homology model M h And pirated model M s In candidate fingerprint set X c In this context, filtering can only be performed from the source model M. v Migration to pirated model M s However, it cannot be transferred to the same model M. h Adversarial examples are used as verification fingerprint set X. v The validation sample x' is the validation dataset X. v The samples in;

[0022] Step 2.5: Calculate the pirated model M s Homogeneous model Mh Output and source models M v The similarity of the outputs is used to calculate the piracy model M according to formula (1) for image classification models. s With source model M v Similarity, where x' is the validation sample set X v The validation samples are used to calculate the homology model M according to formula (2). h With source model M v Similarity, where x' is the validation sample set X v For the verification samples in the image processing model, the piracy model M is calculated according to formula (3). s With source model M v Similarity, where x' is the validation sample set X v The validation samples are used to calculate the homology model M according to formula (4). h With source model M v Similarity, where x' is the validation sample set X v The validation samples in the data were used to statistically analyze the piracy model M. s With source model M v Similarity and common origin model M h With source model M v The similarity is used to select an appropriate value as the decision threshold τ, such that a similarity value greater than the decision threshold τ is considered a piracy model M. s If the value is less than the decision threshold τ, it is considered to be a homogeneous model M. h The formulas involved are as follows:

[0023]

[0024]

[0025]

[0026]

[0027] Step 3 specifically involves: the model that needs to be verified is the suspected model M. d The fingerprint set X will be verified. c Input suspicious model M d Calculate its output and the source model M v The similarity between the outputs is calculated according to formula (5) for image classification models, where x' is the validation sample set X. v For the validation samples in the image processing model, the similarity is calculated according to formula (6), where x' is the validation sample set X. v The verification samples involved the following formulas:

[0028]

[0029]

[0030] If the similarity is greater than the decision threshold τ, then the suspicious model is judged to be a pirated model;

[0031] If the similarity is less than the decision threshold τ, then the suspicious model is judged to be a homologous model.

[0032] The second technical solution adopted in this invention is a model copyright verification device that focuses on global model similarity, comprising:

[0033] The model and dataset preparation module is used to prepare the source model M. v Pirated model M s With the same origin model M h and the required dataset D v ;

[0034] The fingerprint generation module is used to generate fingerprints and construct the verification fingerprint set X. v And determine the decision threshold τ for judging whether a model is pirated;

[0035] The execution verification module is used to perform verification.

[0036] The beneficial effects of this invention are:

[0037] (1) It overcomes the characteristic that existing general adversarial samples are cross-model, while the adversarial samples generated by the method of this invention only work on specific models and do not have cross-model properties.

[0038] (2) It solves the problem that most existing fingerprint-based copyright protection methods only focus on the local similarity of models. It considers the global similarity of specific models, can construct more robust model fingerprints, and has extremely high concealment.

[0039] (3) This invention solves the problem that existing copyright verification methods can only be applied in a single task scenario. This invention can perform copyright verification of models in multiple task application scenarios. The method of this invention is a black box copyright verification method, which is suitable for multi-task application scenarios. Attached Figure Description

[0040] Figure 1 This is a flowchart illustrating the implementation of the method of the present invention;

[0041] Figure 2 The impact of PGD-based fingerprint generation algorithms on distinguishing between pirated and homologous models;

[0042] Figure 3 The impact of UAP-based fingerprint generation algorithms on distinguishing between pirated and homologous models;

[0043] Figure 4 The model fingerprint generated by this invention and its impact on distinguishing pirated models from homologous models;

[0044] Figure 5 The SSIM similarity between the source model, the pirated model, and the homologous model on StarGAN using the method of this invention;

[0045] Figure 6 The SSIM similarity between the source model, the pirated model, and the homologous model on CycleGAN using the method of this invention. Detailed Implementation

[0046] The present invention will now be described in detail with reference to the accompanying drawings and specific embodiments.

[0047] This invention provides a model copyright verification method that focuses on global model similarity, and the implementation flowchart is attached. Figure 1 As shown, the entire method is divided into two parts: fingerprint generation and copyright verification, specifically including the following steps:

[0048] Step 1: Prepare the source model M v Pirated model M s With the same origin model M h and the required dataset D v ;

[0049] Step 1 is as follows:

[0050] Step 1.1: Prepare the source model M v and training source model M v Dataset D v ;

[0051] Step 1.2: Fine-tune the image classification model or image processing model (for image classification models, the fine-tuning methods used are FTLL, FTAL, RTLL, or RTAL; for image processing models, fine-tuning is performed on dataset D). v Randomly select 5% to 50% of the data, and fine-tune the image processing model based on the parameters of the source model. The number of iterations is approximately M, which is the same as the number of iterations used to train the source model. v 50% of the iterations) and pruning (pruning rates of 10%, 20%, 30%, 40%, 50%, or 60%) generate the source model M. v Pirated model M s Using source model M v The same network structure, but with different random initialization methods and optimizer settings, is used in dataset D. v Training was performed on the model to obtain the homologous model M. h The pirated model M obtained through training s and the homology model M h, used for fingerprint generation in step 2.4;

[0052] Step 2: Generate fingerprints and construct the verification fingerprint set X v And to determine whether it is a pirated model M s The decision threshold τ;

[0053] Step 2 is as follows:

[0054] Step 2.1, Parameter Initialization: Randomly initialize the disturbance v and the disturbance amplitude l. p The step size ε of the perturbation amplitude change, the initial value of the decision threshold τ is set to 0, and the similarity threshold λ of a single image;

[0055] Step 2.2, from dataset D v A batch of samples with a size smaller than dataset D is randomly selected from the dataset. v The samples are taken as dataset X, and sample x is a sample in dataset X. The perturbation v is added to sample x, and the perturbation is calculated by the function isValidSample() based on model M. v The output results are used to filter out samples that significantly contribute to the perturbation optimization, thereby accelerating the optimization process. Cross-data iteration is performed so that the perturbation v is not limited to specific samples, and is based on the perturbation amplitude l. p The magnitude of the perturbation v is limited to ensure its concealment. Since the adversarial perturbation generated by optimizing gradient information is only effective for specific models, the perturbation is updated using gradient information to obtain a perturbation v that does not have cross-model properties and focuses on the global similarity of models.

[0056] Step 2.3: Add the generated perturbation v to the dataset X to generate the candidate fingerprint set X. c ;

[0057] Step 2.4: Using the homology model M h And pirated model M s In candidate fingerprint set X c In this context, filtering can only be performed from the source model M. v Migration to pirated model M s However, it cannot be transferred to the same model M. h Adversarial examples are used as verification fingerprint set X. v The validation sample x' is the validation dataset X. v The samples in;

[0058] Step 2.5: Calculate the pirated model M s Homogeneous model M h Output and source models M v The similarity of the outputs is calculated for image classification models (GoogLeNet, VGG, ResNet) according to formula (1) to determine the piracy model M.s With source model M v Similarity, where x' is the validation sample set X v The validation samples are used to calculate the homology model M according to formula (2). h With source model M v Similarity, where x' is the validation sample set X v For the validation samples in the image processing model (StarGAN, CycleGAN), the piracy model M is calculated according to formula (3). s With source model M v Similarity, where x' is the validation sample set X v The validation samples are used to calculate the homology model M according to formula (4). h With source model M v Similarity, where x' is the validation sample set X v The validation samples in the data were used to statistically analyze the piracy model M. s With source model M v Similarity, homology model M h With source model M v The similarity is used to select an appropriate value as the decision threshold τ, such that a similarity value greater than the decision threshold τ is considered a piracy model M. s If the value is less than the decision threshold τ, it is considered to be a homogeneous model M. h The formulas involved are as follows:

[0059]

[0060]

[0061]

[0062]

[0063] Step 3: Perform verification;

[0064] Step 3 specifically involves: the model that needs to be verified is the suspected model M. d The fingerprint set X will be verified. c Input suspicious model M d Calculate its output and the source model M v The similarity between the outputs is calculated according to formula (5) for image classification models, where x' is the validation sample set X. v For the validation samples in the image processing model, the similarity is calculated according to formula (6), where x' is the validation sample set X. v The verification samples involved the following formulas:

[0065]

[0066]

[0067] If the similarity is greater than the decision threshold τ, then the suspicious model is judged to be a pirated model;

[0068] If the similarity is less than the decision threshold τ, then the suspicious model is judged to be a homologous model;

[0069] Principle Explanation: This invention first uses a general adversarial perturbation applicable to a specific model as a model fingerprint. When the model owner observes suspicious infringement, verification is performed in a black-box setting to confirm copyright. Before verification, a verification sample set is constructed by selecting fingerprints that can only be transferred from the source model to the pirated model but not to the same-source model, and the decision threshold is carefully determined. During the verification phase, the model owner inputs the verification sample set into the suspicious model and calculates the similarity between its output and the output of the source model.

[0070] This invention is a model copyright verification method focusing on global model similarity. The protected objects are not limited to image classification models but also include other models that use images as input. Furthermore, this invention only requires black-box access permissions and does not need model parameters or other information to make a decision on whether a suspected model is a pirated model. Regarding fingerprint generation, this invention uses a general adversarial action as a unique fingerprint for the model. Compared to other methods that only focus on local similarity, this invention can focus on the global similarity of the model, achieving a more robust fingerprint. In model copyright verification, a binary classification model is used as an example. The red solid line represents the decision boundary of the same model, the black solid line represents the decision boundary of the source model, and the black dashed line represents the decision boundary of the pirated model. The PGD-based model fingerprint recognition method is highly sensitive to parameter changes, leading to the misclassification of pirated models as non-pirated models, as shown in the attached diagram. Figure 2 As shown in the attached figure, UAP-based model fingerprinting methods often incorrectly classify homologous models as pirated models. Figure 3 As shown, the fingerprint recognition method of this invention effectively balances the differences between pirated and homologous models. The generated adversarial examples can only be transferred from the source model to the pirated model, but not to the homologous model, as illustrated in the appendix. Figure 4 As shown; the Dist(·) function in formula (6) is based on SSIM (structural similarity) metric. SSIM similarity is used to evaluate the similarity between the source model, the pirated model, and the original model. The threshold λ in formula (6) is set to 0.65. The experimental results on StarGAN using the CelebA dataset are shown in the appendix. Figure 5 As shown in the attached figure, the experimental results on CycleGAN using the Cityscapes dataset are as follows. Figure 6As shown in the figures, the experimental results demonstrate that this invention improves the differentiation between pirated and non-pirated models. For classification tasks, the ResNet20 model was trained using the CIFAR10 dataset, and WideResNet was trained using the CIFAR100 dataset. The experimental results are shown in Table 1, which summarizes the similarity between representative suspected models and the source models. The results clearly show that the similarity between the ResNet20 model and the source model is approximately 0.173, while the similarity between the pirated model and the source model reaches a maximum of 0.946, with a clear boundary between the two. The similarity between the WideResNet model and the source model is approximately 0.156, while the similarity between the pirated model and the source model is as high as 0.973, with a clear boundary between the two. Furthermore, compared with the FTAL, FTLL, and P-50% settings, the experimental settings of RTLL, RTAL, and P-60% allow for greater modification of model parameters. Although the similarity between the pirated model and the original model decreased under these experimental settings, there was still a clear distinction threshold between the pirated model and the original model, indicating that the present invention improves the tolerance for model parameter modifications and has excellent model copyright verification capabilities.

[0071] Table 1 Experimental results on different datasets

[0072]

[0073] Example 1

[0074] A model copyright verification method that focuses on global model similarity includes the following steps:

[0075] Step 1: Prepare the source model M v Pirated model M s With the same origin model M h and the required dataset D v ;

[0076] Step 2: Generate fingerprints and construct the verification fingerprint set X v And determine the decision threshold τ for judging whether a model is pirated;

[0077] Step 3: Perform verification.

[0078] Example 2

[0079] A model copyright verification method that focuses on global model similarity includes the following steps:

[0080] Step 1: Prepare the source model M v Pirated model M s With the same origin model M h and the required dataset D v ;

[0081] Step 1 is as follows:

[0082] Step 1.1: Prepare the source model M v and training source model M v Dataset D v ;

[0083] Step 1.2: Fine-tune and prune the image classification model or image processing model to generate the source model M. v Pirated model M s Using source model M v The same network structure, but with different random initialization methods and optimizer settings, is used in dataset D. v Training was performed on the model to obtain the homologous model M. h The pirated model M obtained through training s and the homology model M h This is used for fingerprint generation in step 2.4.

[0084] Step 2: Generate fingerprints and construct the verification fingerprint set X v And determine the decision threshold τ for judging whether a model is pirated;

[0085] Step 3: Perform verification.

[0086] Example 3

[0087] Model copyright verification devices that focus on global model similarity include:

[0088] The model and dataset preparation module is used to prepare the source model M. v Pirated model M s With the same origin model M h and the required dataset D v ;

[0089] The fingerprint generation module is used to generate fingerprints and construct the verification fingerprint set X. v And determine the decision threshold τ for judging whether a model is pirated;

[0090] The execution verification module is used to perform verification.

[0091] See references [1]

[0092] Yossi Adi,Carsten Baum,Moustapha Cisse,Benny Pinkas,and JosephKeshet.2018.Turning your weakness into a strength:Watermarking deep neuralnet works by backdooring.In 27th{USENIX}Security Symposium({USENIX}Security18).1615–1631.

[0093] [1] Jialong Zhang,Zhongshu Gu,Jiyong Jang,Hui Wu,Marc Ph Stoecklin,Heqing Huang,and Ian Molloy.2018.Protecting intellectual property of deepneural networks with watermarking.In Proceedings of the 2018 on AsiaConference on Computer and Communications Security.159–172.

[0094] [1] Sebastian Szyller,Buse Gul Atli,Samuel Marchal,and NAsokan.2021.Dawn:Dynamic adversarial watermarking of neural networks.InProceedings of the 29th ACM International Conference on Multimedia.4417–4425.

[0095] [1] Erwan Le Merrer,Patrick Perez,and Gilles Trédan.2020.Adversarialfrontier stitching for remote neural network watermarking.Neural Computingand Applications 32(2020),9233–9244.

[0096] [1] Ding Sheng Ong,Chee Seng Chan,Kam Woh Ng,Lixin Fan,and QiangYang.2021.Protecting intellectual property of generative adversarial networksfrom ambiguity attacks.In Proceedings of the IEEE / CVF Conference on ComputerVision and Pattern Recognition.3630–3639.

[0097] [1] Jie Zhang,Dongdong Chen,Jing Liao,Han Fang,Weiming Zhang,WenboZhou,Hao Cui,and Nenghai Yu.2020.Model watermarking for image processingnetworks.In Proceedings of the AAAI conference on artificial intelligence,Vol.34.12805–12812.

[0098] [1] Nils Lukas,Yuxuan Zhang,and Florian Kerschbaum.2019.Deep neuralnetwork fingerprinting by conferrable adversarial examples.arXiv preprintarXiv:1912.00888(2019).

[0099] [1] Pratyush Maini,Mohammad Yaghini,and Nicolas Papernot.2021.Datasetinfer ence:Ownership resolution in machine learning.arXiv preprint arXiv:2104.10706(2021).

[0100] [1]Lixu Wang,Shichao Xu,Ruiqi Xu,Xiao Wang,and Qi Zhu.2021.Non-transferable learning:A new approach for model ownership verification andapplicability authorization.arXiv preprint arXiv:2106.06916(2021).

[0101] [1] Jialuo Chen,Jingyi Wang,Tinglan Peng,Youcheng Sun,Peng Cheng,Shouling Ji,Xingjun Ma,Bo Li,and Dawn Song.2022.Copy,right?A testingframework for copyright protection of deep learning models.In 2022 IEEESymposium on Security and Privacy(SP).IEEE,824–841.

Claims

1. A model copyright verification method focusing on global model similarity, characterized in that, Specifically, the following steps are included: Step 1: Prepare the source model Pirated models Homologous Model and the required dataset ; Step 2: Generate fingerprints and construct a verification fingerprint set. And determine the decision threshold for judging whether a model is pirated. ; Step 2 specifically includes: Step 2.1, Parameter Initialization: Randomly initialize the disturbance. Disturbance amplitude The step size of the perturbation amplitude change, and the decision threshold. The initial value is set to 0, which is the similarity threshold for a single image. ; Step 2.2, from the dataset A batch of samples with a size smaller than the dataset is randomly selected. The samples are used as the dataset ,sample It is a dataset The samples in the middle will be perturbed Add to sample Above, through the function According to the model The output results are used to filter out samples that significantly contribute to the perturbation optimization; Step 2.3: Generate the disturbance Add to dataset Above, generate candidate fingerprint sets. ; Step 2.4: Utilize the homology model and pirated models In the candidate fingerprint set In this context, filtering can only be performed on the source model. Migrating to pirated models However, it cannot be transferred to a homologous model. Adversarial examples are used as verification fingerprint sets. , verification samples To validate the dataset The samples in; Step 2.5: Calculate the pirated model Homologous model Output and source models The similarity of the outputs is used to calculate the piracy model according to formula (1) for image classification models. With source model Similarity, among which To validate the sample set The validation samples are used to calculate the homology model according to formula (2). With source model Similarity, among which To validate the sample set For the verification samples in the image processing model, the piracy model is calculated according to formula (3). With source model Similarity, among which To validate the sample set The validation samples are used to calculate the homology model according to formula (4). With source model Similarity, among which To validate the sample set Validation samples were used to statistically analyze the piracy model. With source model Similarity and common origin model With source model Based on the similarity, select an appropriate value as the decision threshold. This causes the similarity value to exceed the decision threshold. The model was judged to be a pirated model. less than the decision threshold The judgment is a homology model The formulas involved are as follows: (1) (2) (3) (4)； Step 3: Perform verification.

2. The model copyright verification method focusing on global model similarity according to claim 1, characterized in that, Step 1 is as follows: Step 1.1: Prepare the source model and training source model dataset ; Step 1.2: Fine-tune and prune the image classification or image processing model to generate the source model. pirated models Using source model The same network structure, but with different random initialization methods and optimizer settings, in the dataset Training is performed on the model to obtain a homologous model. The pirated model obtained through training and homology model This is used for fingerprint generation in step 2.

4.

3. The model copyright verification method focusing on global model similarity according to claim 2, characterized in that, In step 1.2, the image classification model is GoogLeNet, VGG, or ResNet; the image processing model is StarGAN or CycleGAN.

4. The model copyright verification method focusing on global model similarity according to claim 2, characterized in that, In step 1.2, for the image classification model, the fine-tuning method used is FTLL, FTAL, RTLL, or RTAL; for the image processing model, the dataset... Randomly select 5% to 50% of the data, and fine-tune the image processing model based on the parameters of the source model. The number of iterations is equal to the number of iterations used to train the source model. 50% of the iterations.

5. The model copyright verification method focusing on global model similarity according to claim 2, characterized in that, In step 1.2, the pruning rates are 10%, 20%, 30%, 40%, 50%, or 60%.

6. The model copyright verification method focusing on global model similarity according to claim 2, characterized in that, Step 3 specifically involves: the model that needs to be verified is a suspected model. The fingerprint set will be verified. Input suspicious model Calculate its output and the source model The similarity between the outputs is calculated according to formula (5) for image classification models, where... To validate the sample set For the validation samples in the image processing model, the similarity is calculated according to formula (6), where To validate the sample set The verification samples involved the following formulas: (5) (6) If the similarity is greater than the decision threshold If so, the suspicious model is determined to be a pirated model; If the similarity is less than the decision threshold If so, then the suspicious model is determined to be a homologous model.

7. A model copyright verification device that focuses on global model similarity, employing the method described in claim 1, characterized in that, Including: The model and dataset preparation module is used to prepare the source model. Pirated models Same origin model and the required dataset ; The fingerprint generation module is used to generate fingerprints and build a verification fingerprint set. And determine the decision threshold for judging whether a model is pirated. ; The execution verification module is used to perform verification.

Images