A DNN model backdoor watermarking method without third-party authentication

Abstract

The application discloses a DNN model backdoor watermarking method without third-party authentication, which is a deep learning as a service (DLaaS) enterprise, and is a deep neural network DNN model backdoor watermarking scheme without third-party authentication. The application takes an enterprise logo with uniqueness, intuitiveness and cognitive degree as the "identity card" of the enterprise, and adopts a linear embedding mode to ensure that the logo can be restored from the image. Further, in order to ensure that the logo is more visually intuitive, the application uses an RGB format logo. Meanwhile, in order to generate high-quality trigger samples to meet the DNN model watermarking security requirements, the application embeds the logo in the image frequency domain, and designs a new encoding algorithm, SA-Algorithm, which fully utilizes the frequency domain space information and the amplitude information. Finally, the watermark is injected into the DNN model in the form of a backdoor, so as to protect the copyright of the DNN model.

Description

Technical Field

[0001] This invention belongs to the field of neural network watermarking technology, and particularly relates to the field of backdoor watermarking technology, especially a DNN model backdoor watermarking method that does not require third-party authentication. Background Technology

[0002] Deep neural networks (DNNs) are currently being widely used in the Industrial Internet with unprecedented performance, bringing tremendous changes to society, from computer vision to natural language processing. However, training a high-quality DNN model requires not only powerful computing power but also specialized knowledge, incurring significant financial and time costs for the trainer. Therefore, training a high-quality, practical DNN model is a significant challenge for ordinary people. Consequently, the market for Deep Learning as a Service (DLaaS) has emerged. Compared to purchasing hardware, the service fee for accessing well-trained models through APIs provided by DLaaS companies is negligible. However, recent studies have demonstrated that DLaaS faces a serious threat of model theft attacks: attackers repeatedly query public APIs and steal meticulously trained models from DLaaS companies based on their outputs, thus creating almost identical or nearly identical copies. Attackers can then resell these stolen models, leading to model abuse and severely impacting the interests of DLaaS companies. In essence, the core issue is protecting the copyright of DNN models. These meticulously designed and trained DNN models embody the intellectual property of enterprises and should be protected by copyright, just like books and other products.

[0003] Inspired by the application of digital watermarking in digital media, model watermarking is often used to protect model copyrights. Among these, backdoor watermarking is the most prominent method. Currently, existing backdoor watermarking methods can be broadly categorized into two types: explicit watermarking and implicit watermarking.

[0004] Explicit watermarks are vulnerable to evasion attacks and fraudulent ownership claims, failing to meet the security requirements of model watermarks. Furthermore, they are often random, meaning they are not unique, can be used by anyone, and are not intuitive, failing to directly determine copyright ownership. Some methods use random, unrelated images and logos as watermarks. Implicit watermarks emerged, addressing the threats of evasion attacks and fraudulent ownership claims, as well as the uniqueness issue, but the intuitiveness problem remains. For example, some methods use unique logos as watermarks, but these are based on autoencoders and generative adversarial networks, which are non-linear, making it impossible to extract the embedded watermark. Therefore, copyright ownership can only be determined based on trigger samples, which are still not intuitive. Other methods use the model trainer's fingerprint as a watermark, embedding it using the LSB algorithm, but the fingerprint format is also not intuitive. Therefore, existing solutions require the assistance of a third-party authoritative institution. The model trainer must be verified with this institution, obtaining a unique watermark or submitting a trigger sample set to establish a one-to-one correspondence between the watermark or trigger sample set and the model trainer's real identity, and this correspondence must be verifiable. In reality, this is complex and unrealistic, because there is no such authoritative body at present. Summary of the Invention

[0005] The purpose of this invention is to address the problems existing in the prior art by proposing an implicit backdoor watermarking scheme for DNN models that does not require certification from a third-party authoritative institution, thereby protecting the copyright of the models trained by DLaaS companies. This method utilizes the recognizability and uniqueness of the company logo as the "identity card" of the DLaaS company, directly linking the DNN model to the company. Simultaneously, the scheme employs a linear embedding method to ensure that the logo can be reconstructed from the image; users only need to observe the logo decoded from the trigger sample to understand the model's copyright ownership. To make the logo more visually intuitive, the scheme uses an RGB format logo, but this greatly increases the amount of information in the logo. How then can high-quality, highly concealed trigger samples be generated to better meet the security requirements of DNN model watermarking? To solve this problem, this invention embeds the logo in the image frequency domain and designs a novel encoding algorithm—SA-Algorithm—that fully utilizes the spatial and amplification information of the frequency domain. This algorithm balances the two requirements mentioned above, which is the most important innovative part of this invention.

[0006] The technical solution to achieve the purpose of this invention is: a DNN model backdoor watermarking method that does not require third-party authentication, the method comprising:

[0007] Image spatial domain to frequency domain conversion stage: The image is converted from RGB format to YUV format, and then the image is converted from spatial pixel representation to frequency domain representation;

[0008] Frequency domain logo embedding stage: Embed the user logo in RGB format into the frequency domain image while making it hidden;

[0009] Image frequency domain to spatial domain conversion stage: The frequency domain image with the embedded logo is converted into a spatial domain image and then converted back into an RGB format image to generate trigger samples;

[0010] DNN model training watermark injection stage: Trigger samples containing user logos and trigger samples containing noisy logos are used together with ordinary samples as training datasets to train the DNN model, thereby injecting watermarks into the DNN model;

[0011] Watermark authentication stage: The user sends a query request to the suspected DNN model using a trigger sample set containing their own logo. Based on the results returned by the model, it is determined whether the model contains the user's watermark, i.e., the user's logo.

[0012] Furthermore, in the image spatial domain to frequency domain conversion stage, discrete cosine transform is used to convert the image into a frequency domain representation.

[0013] Furthermore, the image spatial-to-frequency domain conversion stage further includes: before converting the image from spatial pixel representation to frequency domain representation, performing:

[0014] (1) Transform and crop the image to a square size w*w;

[0015] (2) Set the image block size:

[0016] block_size = 8px * 8px

[0017] The image is divided into blocks according to the image block size. If the length and width of the image are not multiples of 8, the remaining part after the block division is treated as a separate block, and no logo information will be injected into this block.

[0018] Furthermore, the image spatial-to-frequency domain conversion stage also includes:

[0019] Adjust the user logo size p*p according to the image size, where p should meet the following conditions:

[0020]

[0021] Furthermore, in the frequency domain logo embedding stage, the SA-Algorithm encoding algorithm is used to embed the RGB format user logo into the frequency domain image. The SA-Algorithm encoding algorithm embeds the user logo pixel-by-pixel into each 8*8 DCT frequency map, specifically including:

[0022] For each 8x8 DCT frequency diagram, perform the following operations on its U and V channels respectively:

[0023] Step 1-1: Select candidate frequency bands from the frequency domain graph;

[0024] Steps 1-2: Select the embedding frequency band from the candidate frequency bands based on the Logo pixel value;

[0025] Steps 1-3 allocate increments for the embedded frequency band.

[0026] Further, step 1-1, which involves selecting candidate frequency bands from the frequency domain graph, specifically includes:

[0027] The intermediate frequency bands (k1, k2) in the 8*8 DCT frequency diagram are selected as candidate frequency bands for embedding the logo pixel information, where k1 and k2 should meet the following conditions:

[0028] (0≤k1≤6∩k1+k2=6)∪(0≤k1≤7∩k1+k2=7)∪(1≤k1≤7∩k1+k2=8)

[0029] k1, k2∈N

[0030] From the above formula, we can see that there are m choices for (k1, k2), which means there are m candidate frequency bands.

[0031] In the formula, N represents a natural number.

[0032] Further, step 1-2, selecting the embedding frequency band from the candidate frequency bands, specifically includes:

[0033] Selecting embedding bands from candidate frequency bands and assigning them two different amplification values ​​requires the ability to represent 12 bits of binary information. The formula for calculating the number of embedding bands, n, selected from the candidate frequency bands is:

[0034]

[0035] Furthermore, steps 1-3, which involve increasing the embedded frequency band allocation, specifically include:

[0036] Assign an increment to each embedded frequency band to represent n bits of binary information following the first bit of binary information;

[0037] The increase includes two types: m1 and m2, either of which can be selected; if it is m1, the corresponding binary number is 1, and if it is m2, the corresponding binary number is 0.

[0038] The m1 and m2 satisfy:

[0039] |m1|>0,|m2|>0

[0040] m1≠m2.

[0041] Furthermore, in the watermark injection stage of the DNN model training, the noisy logo is a logo that has not been used by any user; the ordinary sample is an image without any logo.

[0042] Furthermore, in the watermark authentication stage, determining whether the model contains the user's watermark, i.e., the user's logo, based on the result returned by the model specifically includes:

[0043] Judge the following two conditions:

[0044] (1) The probability of the model returning the target label is greater than the set threshold T;

[0045] (2) Decode the user's logo from the trigger sample that initiated the request by reversing the SA-Algorithm process;

[0046] If both of the above conditions are met, it indicates that the suspected DNN model contains a user watermark.

[0047] Compared with the prior art, the significant advantages of this invention are:

[0048] (1) This invention proposes a novel backdoor watermarking scheme for DNN models targeting DLaaS enterprises. This scheme leverages the uniqueness, intuitiveness, and queryability of the enterprise logo to enable DNN model copyright protection without the need for third-party authoritative certification. Furthermore, unlike existing schemes, the logo embedded in the frequency domain is extractable. This invention is the first to propose such a DNN model backdoor watermarking scheme that does not require the involvement of a third-party authoritative institution, filling a gap in this field.

[0049] (2) In order to embed the more intuitive RGB format logo into the image while ensuring its concealment, and to generate high-quality trigger samples to better meet the security requirements of the DNN model watermark index, this invention first converts the RGB format image into YUV format, then embeds the logo into the image frequency domain, and innovatively designs an encoding algorithm that makes full use of the spatial information and amplification information of the image frequency domain—SA-Algorithm.

[0050] (3) The proposed solution almost satisfies all the requirements of DNN model watermarking, including seven aspects: fidelity, reliability, integrity, robustness, security, efficiency, and capacity. In particular, it meets the requirement of unique identification in terms of integrity.

[0051] The present invention will now be described in further detail with reference to the accompanying drawings. Attached Figure Description

[0052] Figure 1 This is the overall architecture diagram of the DNN model backdoor watermarking scheme that does not require third-party certification according to the present invention.

[0053] Figure 2 This is a flowchart of the SA-Algorithm encoding algorithm for frequency domain logo embedding in this invention.

[0054] Figure 3 (a) in the image is the original image. Figure 3 (b) in the figure is the trigger sample image generated after embedding the logo using the present invention.

[0055] Figure 4 This is a diagram illustrating the watermark verification method of the present invention. Detailed Implementation

[0056] To make the objectives, technical solutions, and advantages of this application clearer, the following detailed description is provided in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are merely illustrative and not intended to limit the scope of this application.

[0057] It should be noted that, in this invention, "user" refers to, but is not limited to, enterprises.

[0058] Combination Figure 1 This paper presents a DNN model backdoor watermarking method that does not require third-party certification. This solution primarily addresses the issue that current backdoor watermarking methods either fail to guarantee the uniqueness of copyright ownership or are not intuitive, thus necessitating certification by an authoritative third-party organization. The method includes:

[0059] Image spatial domain to frequency domain conversion stage: The image is converted from RGB format to YUV format, and then the image is converted from spatial pixel representation to frequency domain representation.

[0060] It's important to note that typical backdoor watermarking methods embed the watermark in the spatial domain. However, directly adding perturbations in the spatial domain is not truly concealed and can even be visually recognized. This is detrimental to the security metrics of DNN model watermarks. Furthermore, embedded watermarks are not stable enough during model training. Therefore, directly embedding the logo into the image's spatial domain is not feasible. This invention leverages the high concealment and robustness of frequency domain information by embedding the logo into the image's frequency domain. Existing research has demonstrated that although frequency domain perturbations are distributed throughout the image, they can still be recognized and learned by CNNs. Compared to the common method of directly embedding backdoor watermarks in the spatial domain, this is a more secure approach.

[0061] Furthermore, this invention does not directly convert the image to RGB format. Instead, it adopts the approach of the JPEG compression coding algorithm, first converting the RGB format to YUV format and then performing frequency domain conversion. One advantage of this approach is that it further improves the concealment of frequency domain perturbations, because the UV channels of the YUV format do not contain color information that is sensitive to the human eye, unlike the RGB format. Simultaneously, when performing the image to frequency domain conversion, this invention uses the Discrete Cosine Transform (DCT) instead of the Discrete Fourier Transform (DFT) because DCT performs better in terms of energy concentration, which is beneficial for the subsequent selection of the logo embedding frequency band.

[0062] Frequency domain logo embedding stage: The user logo in RGB format is embedded into the frequency domain image while being hidden.

[0063] It's important to note that while embedding the logo in the frequency domain significantly improves its concealment, the RGB format logo contains a large amount of information. Embedding it in a smaller number of frequency bands presents a challenge. Fewer perturbations reduce the scope of the perturbation, thus ensuring logo concealment, improving the quality of the trigger sample, and meeting the security requirements of the DNN model's watermarking metrics. To achieve these goals, this invention proposes a novel encoding algorithm—SA-Algorithm—that fully utilizes frequency domain spatial information and amplification information. The SA-Algorithm can embed a 24-bit logo into the image frequency domain by perturbing only 6 frequency bands, ensuring that the quality evaluation metrics of the final generated trigger sample are imperceptible to the human eye.

[0064] Image frequency domain to spatial domain conversion stage: The frequency domain image with the embedded logo is converted into a spatial domain image and then converted back into an RGB format image to generate trigger samples.

[0065] The watermarking stage of DNN model training involves using trigger samples containing user logos and trigger samples containing noisy logos, along with ordinary samples, as a training dataset to train the DNN model, thereby injecting watermarks into the DNN model.

[0066] As shown in Table 1, the watermarking metrics of the DNN model will be explained first.

[0067] Table 1. Watermarking Indicators for DNN Models

[0068]

[0069] The backdoor watermark effectively addresses issues of fidelity, reliability, and robustness. Security is ensured by maintaining the logo's concealment, meeting the required metrics. Capacity is also met due to the substantial amount of embedded logo information. However, to ensure the invention meets integrity requirements, trigger samples generated by noisy logos need to be added to the model training dataset. This ensures that the model containing the relevant company's watermark does not incorrectly achieve high recognition accuracy when testing trigger samples containing other company logos. Without adding noisy logo trigger samples, the DNN's generalization ability leads to a high probability of identifying all perturbed test sets as the target label. Adding noisy logo trigger samples and training them alongside those embedding company logos allows the DNN model to learn different trigger patterns—patterns that embed different logos—achieving DNN model verification using a unique logo.

[0070] Watermark authentication stage: The user sends a query request to the suspected DNN model using a trigger sample set containing their own logo. Based on the results returned by the model, it is determined whether the model contains the user's watermark, i.e., the user's logo.

[0071] Here, when a company discovers that its trained model may be stolen and used by malicious actors, it can use a trigger sample containing its own logo to send a query request to the suspected DNN model. Based on the model's returned results, it can determine whether the model contains its own watermark. At the same time, the company must also ensure that its logo can be extracted from the trigger sample that initiated the request, thus directly demonstrating the copyright ownership of the model without requiring certification from a third-party authoritative institution. In effect, this also ensures that the copyright of the model belongs to the company identified by the logo in the trigger sample, rather than to any individual who owns the trigger sample, thus preventing the trigger sample from being stolen and the model's copyright from being illegally claimed.

[0072] In one embodiment, a DNN model backdoor watermarking method without third-party authentication is provided, which can be broadly divided into two main steps: generating a trigger sample set Tr and injecting the DNN model watermark. This can be further divided into six sub-steps, including image color model transformation, image spatial-frequency domain to frequency domain conversion, frequency domain logo embedding, image frequency-domain to spatial domain conversion, inverse image color model transformation, and DNN model training and watermark injection. These are described in detail below.

[0073] (I) Generating the trigger sample set Tr

[0074] This invention first uses the `torchvision.transforms` module to transform and crop the images in the image training dataset D, converting them into uniform squares of size w*w. Since this invention targets enterprise-trained models, theoretically, it should process large datasets, specifically:

[0075] w≥224px(1)

[0076] Then select a portion of data D from D. t First, perform the following steps to D t Transform into trigger sample set T r .

[0077] (1) Image Color Model Transformation: Convert the image from RGB format to YUV format. This is because the human eye is sensitive to brightness but not to color. While all three channels of the RGB format are closely related to brightness, the YUV format is different; only the Y channel contains brightness information, while the U and V channels only contain color information. After converting the image to YUV format, embedding the logo into the U and V channels, which are not sensitive to the human eye, generates trigger samples of higher quality than those generated by directly embedding the R, G, and B channels. This increases the logo's concealment and thus better meets the security requirements of DNN model watermarking, enabling defense against evasion attacks and fraudulent ownership claims. The formula for converting RGB format to YUV format is as follows:

[0078] Y = 0.299 * R + 0.587 * G + 0.114 * B,

[0079] U = 0.596 * R - 0.272 * G - 0.321 * B,

[0080] V=0.212*R-0.523*G-0.311*B.(2)

[0081] (2) Image Spatial Domain to Frequency Domain Conversion: This invention selects the second type of two-dimensional DCT to perform image spatial domain to frequency domain conversion. That is:

[0082] F = AfA T (3)

[0083] Where F is the image frequency matrix, f is the YUV image matrix, and A is an orthogonal matrix, and:

[0084]

[0085] Where N is the width and height of the image, and:

[0086]

[0087] DCT is typically performed after dividing the image into blocks. This invention sets the image block size to be based on the JPEG compression coding algorithm:

[0088] block_size = 8px * 8px (6)

[0089] If the image's w is not a multiple of 8, the remaining portion is divided into a separate block, and no logo information is injected into this block. After image segmentation, a frequency map of the segmented region is generated using DCT. DCT has the characteristic of concentrated energy, so low-frequency signals in the frequency map are located in the upper left corner, high-frequency signals in the lower right corner, and mid-frequency signals near the sub-diagonal. This invention uses (k1, k2) to represent a frequency band in the DCT frequency map. In fact, the low-frequency signals in the DCT frequency map describe the main parts of an image, such as the background, while the high-frequency signals describe the parts of the image that change dramatically, i.e., the details, such as lines.

[0090] (3) Frequency Domain Logo Embedding: This is the most crucial step in generating the trigger sample set Tr. Assuming the embedded Logo size is p*p, p should satisfy the following conditions:

[0091]

[0092] Where w is the size of the images in the image training dataset.

[0093] To embed a logo of this size in RGB format into an image while maintaining image quality, this invention designs a novel encoding algorithm—SA-Algorithm—that fully utilizes frequency domain spatial information and amplification information. This algorithm embeds the logo pixel by pixel into each 8*8 DCT frequency map. Applying this method allows all 24 bits of binary information to be contained within the 8*8 DCT frequency map by perturbing only 6 frequency bands, controlling the perturbation range and ensuring the quality of the final generated trigger sample.

[0094] Specifically, this method utilizes color channels that the human eye is not sensitive to, namely the U and V channels, to perform the following operations:

[0095] a) Candidate frequency band selection: Select the mid-frequency bands (k1, k2) in the 8*8 DCT frequency diagram as candidate frequency bands for embedding the logo pixel information. k1 and k2 should meet the following conditions:

[0096] (0≤k1≤6∩k1+k2=6)∪(0≤k1≤7∩k1+k2=7)∪(1≤k1≤7∩k1+k2=8)

[0097] k1, k2∈N(8)

[0098] Therefore, there are a total of 22 choices for (k1, k2);

[0099] b) Embedding band selection and amplification allocation: To ensure the 24-bit logo is ultimately embedded in the image, each channel should be able to represent 12 bits of information. Assuming the number of embedding bands is n, then utilizing spatial information, the number of bits of information that can be represented is... By using amplification information and assigning two different amplifications to each of the n embedded frequency bands, the number of bits of information that can be represented is n. To ensure that n is minimized, the value of n can be determined by the following constraints:

[0100]

[0101] Finally, we can calculate n=3, which means that if we randomly select 3 frequency bands from 22 candidate frequency bands as embedding frequency bands, then there are a total of There are 1540 ways to choose from, which can represent 10 bits of binary information.

[0102] Then, two different increments are assigned to the three selected frequency bands, each representing 3 bits of binary information. For example, if the increment is m1 in the embedded frequency band (k1, k2), the 11th bit will be 1; if it is m2, the 11th bit will be 0. The other two frequency bands are similar. m1 and m2 should meet the following requirements:

[0103] |m1|>0,|m2|>0

[0104] m1≠m2(10)

[0105] Therefore, using the SA-Algorithm algorithm, three intermediate frequency bands are selected for the U and V channels, each capable of representing 13 bits of binary information, for a total of 26 bits of information. This meets the requirement that one pixel of an RGB format logo requires 24 bits of binary data. The overall encoding process is as follows: Figure 2 As shown.

[0106] Next, we will discuss two factors affecting the effectiveness of this invention: the selection of candidate frequency bands and the setting of the amplification magnitude. First, let's discuss the selection of candidate frequency bands. Theoretically, embedding logo information of a certain intensity in any frequency band can make the trigger sample effective. However, considering the quality and robustness of the trigger sample, this invention selects the mid-frequency range as the candidate frequency band. Because the low-frequency range represents the main part of the image, embedding in the low-frequency range will affect more pixels and is not robust to the high-pass filter; similarly, although embedding in the high-frequency range affects fewer pixels, it still cannot resist the filtering of the low-pass filter. Second, let's discuss the setting of the amplification magnitude. A larger amplification magnitude results in a more obvious logo embedding effect, makes the trigger easier for the DNN model to recognize, and improves the reliability of the watermark. However, a large amplification magnitude will produce non-negligible perturbations, affecting the quality of the trigger sample. Simultaneously, the difference between the two amplification magnitudes cannot be too small, otherwise it will affect the decoding and restoration of the logo. Therefore, after balancing various factors and conducting numerous experiments, this invention preferably sets two amplification values ​​as follows:

[0107] m1 = 12

[0108] m2=-12 (11)

[0109] (4) Image frequency domain to spatial domain: Using the IDCT algorithm, the frequency domain image after DCT is converted back into a spatial pixel image.

[0110] (5) Inverse image color model transformation: Convert the image from YUV format back to RGB format. After this step, the logo is successfully embedded in the image frequency domain, generating the trigger sample set Tr. The original image used and the trigger samples generated after embedding the logo are as follows: Figure 3 As shown in (a) and (b) in the figure.

[0111] For the sake of simplicity, the detailed calculation formulas for the two inverse operations above are omitted here.

[0112] (II) Watermark Injection into DNN Models

[0113] To achieve the requirement of "uniquely identifying the watermarked model using a relevant key" in the DNN model watermark integrity metric, this invention selects a noisy logo, i.e. a logo not used by the company in reality, and generates a noise-triggered sample set Tn different from Tr in the same way as described above. Then, different labels belonging to the original training task are assigned to the samples in Tn and Tr respectively, and they are mixed with ordinary samples to form a new training dataset D'. Finally, D' is put into the DNN model for training, that is, the watermark is successfully injected into the DNN model, and the final generated model is called the watermarked model.

[0114] These are all the steps for generating a watermark model.

[0115] The company can then deploy the watermarked model to offer paid services. If the model is stolen by an attacker, the company will need to take measures such as... Figure 4 The method shown is used to verify the suspected model.

[0116] For a company to successfully verify the existence of a watermark and claim copyright to a DNN model, two conditions must be met: First, a query request must be initiated to the suspected model using a trigger sample set containing the company's logo, and the probability that the model returns a result with the target label (different from the normal label) must be greater than a set threshold T (T is generally ≥95%). Second, the company's logo can be decoded from these trigger samples using the inverse SA-Algorithm algorithm. If both conditions are met, it means that the suspected model contains the company's watermark, i.e., the company owns the copyright to the model. The company can then use the verification results of the above two conditions as evidence to pursue the owner of the suspected model without the need for certification from a third-party authoritative institution.

[0117] It will be understood by those skilled in the art that, unless otherwise defined, all terms used herein (including technical and scientific terms) have the same meaning as commonly understood by one of ordinary skill in the art to which this invention pertains. It should also be understood that terms such as those defined in general dictionaries should be understood to have the same meaning as in the context of the prior art, and should not be interpreted in an idealized or overly formal sense unless defined as herein.

[0118] The specific embodiments described above further illustrate the purpose, technical solution, and beneficial effects of the present invention. It should be understood that the above description is only a specific embodiment of the present invention and is not intended to limit the present invention. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of the present invention should be included within the protection scope of the present invention.

Claims

1. A backdoor watermarking method for DNN models that does not require third-party authentication, characterized in that, The method includes: Image spatial domain to frequency domain conversion stage: The image is converted from RGB format to YUV format, and then the image is converted from spatial pixel representation to frequency domain representation; Frequency domain logo embedding stage: Embed the user logo in RGB format into the frequency domain image while making it hidden; Image frequency domain to spatial domain conversion stage: The frequency domain image with the embedded logo is converted into a spatial domain image and then converted back into an RGB format image to generate trigger samples; DNN model training watermark injection stage: Trigger samples containing user logos and trigger samples containing noisy logos are used together with ordinary samples as training datasets to train the DNN model, thereby injecting watermarks into the DNN model; Watermark authentication stage: The user uses a trigger sample set containing their own logo to send a query request to the suspected DNN model. The model returns a result to determine whether it contains the user's watermark, i.e., the user's logo. In the frequency domain logo embedding stage, the SA-Algorithm encoding algorithm is used to embed the RGB format user logo into the frequency domain image. The SA-Algorithm embeds the user logo pixel-by-pixel into each 8*8 DCT frequency image, specifically including: For each 8x8 DCT frequency diagram, perform the following operations on its U and V channels respectively: Step 1-1: Select candidate frequency bands from the frequency domain graph; Steps 1-2: Select the embedding frequency band from the candidate frequency bands based on the Logo pixel value; Steps 1-3 allocate increments for the embedded frequency band; Steps 1-3 describe the increase in embedded frequency band allocation, specifically including: Assign an increment to each embedded frequency band to represent n bits of binary information following the first bit of binary information; The increase includes two types: m1 and m2, either of which can be selected; if it is m1, the corresponding binary number is 1, and if it is m2, the corresponding binary number is 0. The m1 and m2 satisfy: 。 2. The DNN model backdoor watermarking method without third-party authentication as described in claim 1, characterized in that, In the image spatial domain to frequency domain conversion stage, the discrete cosine transform is used to convert the image into a frequency domain representation.

3. The DNN model backdoor watermarking method without third-party authentication as described in claim 2, characterized in that, The image spatial-to-frequency-domain conversion stage further includes: before converting the image from spatial pixel representation to frequency domain representation, performing the following: (1) Transform and crop the image to a square size w*w; (2) Set the image block size : The image is divided into blocks according to the image block size. If the length and width of the image are not multiples of 8, the remaining part after the block division is treated as a separate block, and no logo information will be injected into this block.

4. The DNN model backdoor watermarking method without third-party authentication as described in claim 3, characterized in that, The image spatial-to-frequency domain conversion stage also includes: Adjust the user logo size p*p according to the image size, where p should meet the following conditions: 。 5. The DNN model backdoor watermarking method without third-party authentication as described in claim 1, characterized in that, Step 1-1, which involves selecting candidate frequency bands from the frequency domain graph, specifically involves: The mid-frequency bands (k1, k2) in the 8*8 DCT frequency diagram are selected as candidate frequency bands for embedding the logo pixel information, where k1 and k2 should meet the following conditions: From the above formula, we can see that there are m choices for (k1, k2), which means there are m candidate frequency bands. In the formula, N represents a natural number.

6. The DNN model backdoor watermarking method without third-party authentication as described in claim 1, characterized in that, Step 1-2, which involves selecting the embedding frequency band from the candidate frequency bands based on the Logo pixel value, specifically includes: Selecting embedding bands from candidate frequency bands and assigning them two different amplification values ​​requires the ability to represent 12 bits of binary information. The formula for calculating the number of embedding bands, n, selected from the candidate frequency bands is: 。 7. The DNN model backdoor watermarking method without third-party authentication as described in claim 1, characterized in that, During the watermarking stage of the DNN model training, the noisy logo is a logo that has not been used by any user; the normal sample is an image without any logo.

8. The DNN model backdoor watermarking method without third-party authentication as described in claim 7, characterized in that, In the watermark authentication stage, determining whether the model contains the user's watermark, i.e., the user's logo, based on the results returned by the model specifically includes: Judge the following two conditions: (1) The probability that the model returns the target label is greater than the set threshold T; (2) Decode the user's logo from the trigger sample that initiated the request by reversing the SA-Algorithm process; If both of the above conditions are met, it indicates that the suspected DNN model contains a user watermark.

Images