Security verification method based on federated learning watermark model and related components
By embedding a backdoor watermark and performing dual verification in the federated learning model, the problems of external attacks and non-honest client ownership generalization in the federated learning model are solved, and the trusted ownership authentication and copyright protection of the model are realized.
Patent Information
- Authority / Receiving Office
- CN · China
- Patent Type
- Patents(China)
- Current Assignee / Owner
- BEIJING UNIV OF POSTS & TELECOMM
- Filing Date
- 2023-11-07
- Publication Date
- 2026-07-21
Smart Images
Figure CN117609744B_ABST
Abstract
Description
Technical Field
[0001] This invention relates to the field of federated learning technology, and in particular to a verification method and related components based on a federated learning watermarking model for security. Background Technology
[0002] With the widespread application of artificial intelligence-related technologies and the development of distributed learning and big data empowerment, the federated learning framework, which emphasizes "data remaining still while the model moves," has gradually become a new paradigm for multi-party collaborative model training. It has successfully broken down data silos and protected data privacy, finding wide application in privacy-sensitive industries such as healthcare, finance, and personalized recommendation systems. Although federated learning has improved data privacy compared to centralized learning, intermediate model parameters (such as gradients, weights, and biases) can still leak customer privacy. Some malicious actors can deduce users' original data, leading to privacy breaches and model theft. Therefore, from a model security perspective, further preventing the illegal copying or misuse of federated learning models has become even more urgent.
[0003] Digital watermarking was originally used to embed digital signals into data that needed protection without affecting the usability of the original data. Watermarking technology can be used for copyright protection and data tracking. Current technology embeds watermarks into federated learning models that need protection, thus protecting the model. When a client (model owner) discovers a model that is suspected of being stolen, they can activate the hidden watermark in the model to address copyright disputes and protect their rights. However, the potential threats can be mainly categorized into two types: one is external nodes attacking the model through parameter fine-tuning, pruning, etc., attempting to remove the watermark and gain access to the model; the other is untrustworthy client ownership generalization, where such clients use local trigger sets as watermarks embedded in other pre-trained models, attempting to exploit the watermark generalization capability of the federated model to pass ownership verification.
[0004] Therefore, how to defend against the above two types of threats and design a reliable federal model security verification scheme has become an urgent problem to be solved. Summary of the Invention
[0005] This invention provides a secure verification method and related components based on a federated learning watermarking model to address the problems of external attacks on the model and the generalization of ownership by dishonest clients in existing technologies. This invention can further improve the credibility of ownership authentication results through dual verification by the client and the server, resisting both external watermark erasure attacks and preventing the generalization of ownership by dishonest clients, thereby improving the robustness of the model.
[0006] This invention provides a security verification method based on a federated learning watermarking model, applied to a server of a security verification system based on a federated learning watermarking model. The system includes a server and multiple clients. The method includes: determining a watermark trigger set and distributing the watermark trigger set to the multiple clients; each client locally stores a local trigger set; when a client detects a suspicious API as an illegal copy of the federated learning watermarking model, receiving an ownership verification request from the client, the ownership verification request including the local trigger set; performing preliminary ownership verification of the suspicious API based on the local trigger set; and, if the preliminary ownership verification passes, performing multi-level ownership verification of the suspicious API based on the watermark trigger set.
[0007] According to a security verification method based on a federated learning watermarking model provided by the present invention, the step of determining the watermark trigger set includes: receiving multiple local trigger sets from the clients; performing watermark preprocessing on the multiple local trigger sets to generate a watermark trigger set; the watermark preprocessing includes conflict-removing watermarking and watermark hierarchical processing.
[0008] According to a security verification method based on a federated learning watermarking model provided by the present invention, the step of distributing the watermark trigger set to multiple clients includes: sequentially extracting several trigger samples from the watermark trigger set without replacement to form multiple watermark trigger subsets; dividing the multiple watermark trigger subsets into multiple levels; and distributing the multiple watermark trigger subsets to multiple clients based on a preset distribution strategy.
[0009] According to the present invention, a security verification method based on a federated learning watermarking model is provided, wherein the data concatenated by the watermark trigger set and the local trigger set is used to train the federated learning watermarking model to complete the federated watermark embedding.
[0010] According to a security verification method based on a federated learning watermarking model provided by the present invention, the preliminary ownership verification of a suspicious API based on the local trigger set includes: inputting the local trigger set into the suspicious API to obtain an output watermark label; determining a watermark detection rate and hypothesis testing result parameters based on the output watermark label and the real label of the trigger set; if the watermark detection rate and the hypothesis testing result parameters meet preset conditions, the preliminary ownership verification passes; if the watermark detection rate and the hypothesis testing result parameters do not meet preset conditions, the preliminary ownership verification fails.
[0011] According to a security verification method based on a federated learning watermarking model provided by the present invention, the multi-level ownership verification of the suspicious API based on the watermark trigger set includes: determining a verification watermark set based on the watermark trigger set, wherein the verification watermark set is used as input to the suspicious API, and the verification watermark set is a preset number of watermark trigger subsets selected from the watermark trigger set; inputting the verification watermark set into the suspicious API in a preset level order, and calculating the watermark detection rate and the hypothesis testing result parameters to obtain the ownership verification level, thereby completing the multi-level ownership verification.
[0012] This invention also provides a security verification device based on a federated learning watermarking model, applied to a server of a security verification system based on a federated learning watermarking model. The system includes a server and multiple clients. The device includes: a watermark trigger set preprocessing module, used to determine a watermark trigger set and distribute the watermark trigger set to multiple clients; each client locally stores a local trigger set; a request receiving module, used to receive an ownership verification request from the client when the client detects that a suspicious API is an illegal copy of the federated learning watermarking model, the ownership verification request including the local trigger set; a preliminary verification module, used to perform preliminary ownership verification of the suspicious API based on the local trigger set; and a multi-level verification module, used to perform multi-level ownership verification of the suspicious API based on the watermark trigger set if the preliminary ownership verification passes.
[0013] The present invention also provides an electronic device, including a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor executes the program to implement the security verification method based on the federated learning watermarking model as described above.
[0014] The present invention also provides a non-transitory computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, implements the security verification method based on the federated learning watermarking model as described above.
[0015] The present invention also provides a computer program product, including a computer program that, when executed by a processor, implements the security verification method based on the federated learning watermarking model as described above.
[0016] This invention provides a secure verification method and related components based on a federated learning watermarking model. The secure verification system based on the federated learning watermarking model includes a server and multiple clients. First, the server determines a watermark trigger set and distributes it to multiple clients. Each client stores its own local trigger set. When a client detects a suspicious API as an illegal copy of the federated learning watermarking model, the server receives an ownership verification request from the client, which includes the local trigger set. Preliminary ownership verification of the suspicious API is performed based on the local trigger set. If the preliminary ownership verification passes, multi-level ownership verification of the suspicious API is performed based on the watermark trigger set. This invention, through dual verification by both the client and server, further improves the credibility of ownership authentication results, resisting external watermark erasure attacks and preventing ownership generalization by dishonest clients, thus improving the robustness of the model. Attached Figure Description
[0017] To more clearly illustrate the technical solutions in this invention or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are some embodiments of this invention. For those skilled in the art, other drawings can be obtained from these drawings without creative effort.
[0018] Figure 1 This is a flowchart illustrating the verification method based on federated learning watermarking model security provided by the present invention.
[0019] Figure 2 This is a schematic diagram of the specific process of the verification method based on federated learning watermarking model security provided by the present invention;
[0020] Figure 3 This is a schematic diagram of the ownership authentication process provided by the present invention;
[0021] Figure 4 This is a graph showing the results of a fidelity experiment on AlexNet;
[0022] Figure 5 This is a graph showing the results of a fidelity experiment on ResNet.
[0023] Figure 6 This is a graph showing the results of the robustness test;
[0024] Figure 7 This is a schematic diagram of the structure of the verification device based on the federated learning watermarking model provided by the present invention;
[0025] Figure 8 This is a schematic diagram of the structure of the electronic device provided by the present invention. Detailed Implementation
[0026] To make the objectives, technical solutions, and advantages of this invention clearer, the technical solutions of this invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some, not all, of the embodiments of this invention. All other embodiments obtained by those skilled in the art based on the embodiments of this invention without creative effort are within the scope of protection of this invention.
[0027] With the widespread application of artificial intelligence technologies and the development of distributed learning and big data empowerment, the federated learning framework, which emphasizes "data remaining still while the model moves," has gradually become a new paradigm for multi-party collaborative model training. It has successfully broken down data silos and protected data privacy, finding wide application in privacy-sensitive industries such as healthcare, finance, and personalized recommendation systems. Although federated learning has improved data privacy compared to centralized learning, intermediate model parameters (gradients, weights, and biases) can still leak customer privacy. Some malicious actors can deduce users' original data, leading to privacy breaches and model theft. Therefore, from a model security perspective, further preventing the illegal copying or misuse of federated models has become even more urgent.
[0028] After investigation, the threats that federated models may encounter can be mainly categorized into two types: one is external nodes launching external attacks on the model through parameter fine-tuning, pruning, and other means, attempting to remove the watermark and thus gain the right to use the model; the other is the generalization of ownership by dishonest clients, where such clients use local trigger sets as watermarks to embed into other pre-trained models, attempting to use the watermark generalization capability of the federated model to pass ownership verification.
[0029] To address the technical problems existing in the prior art, this invention provides a secure verification method based on a federated learning watermark model, which can resist external watermark erasure attacks and prevent the generalization of ownership by dishonest clients. When suspicious model theft occurs outside the federated system, this method allows the client (model owner) to perform trusted ownership authentication by accessing a remote black-box API (Application Programming Interface) with the intervention of a trusted central server and using embedded model watermark information.
[0030] Backdoor watermarking is an effective solution to the copyright protection problem of federated models. It leverages the over-parameterization characteristic of neural networks to provide model owners with a means to prove their ownership of the model: using a mislabeled trigger set as a backdoor watermark, the federated model is trained together with the original training dataset. The watermark is then embedded into the model through local model updates and aggregation by a central server. When model plagiarism is suspected, the model owner can access a remote API to identify the watermark and thus verify ownership. In client-server federated scenarios, the trusted server can embed the backdoor watermark by introducing a retraining step during the training phase.
[0031] This invention proposes a model security verification method for federated learning watermarking, integrating the technical features of federated model training and black-box backdoor watermarking. It allows participating clients to embed backdoor watermarks and claim ownership of their models, achieving model watermark embedding and trusted ownership authentication while resolving watermark conflict issues. This ensures trusted authentication of model ownership without affecting the original task performance. First, the invention uses a trigger set preprocessing algorithm to remove conflicting items and perform hierarchical processing on the watermark trigger set samples. Watermarks at each level are distributed to clients and then embedded and aggregated into the federated learning watermarked model during the training phase. If the watermarked model is found to be copied and reused, the client (model owner) can perform black-box detection by accessing the suspicious API and request server arbitration to claim ownership, thus effectively protecting the copyright of the federated model.
[0032] Please refer to Figure 1 , Figure 1 This is a flowchart illustrating the verification method based on the federated learning watermarking model provided by the present invention.
[0033] Please refer to Figure 2 , Figure 2 This is a schematic diagram illustrating the specific process of the verification method based on the federated learning watermarking model provided by the present invention.
[0034] This invention provides a security verification method based on a federated learning watermarking model, applied to the server of a security verification system based on a federated learning watermarking model. The system includes a server and multiple clients; the method includes:
[0035] 101: Determine the watermark trigger set and distribute it to multiple clients; each client stores its own local trigger set.
[0036] As a preferred embodiment, determining the watermark trigger set includes: receiving local trigger sets from multiple clients; performing watermark preprocessing on the multiple local trigger sets to generate a watermark trigger set; the watermark preprocessing includes conflict-removing watermarking and watermark hierarchical processing.
[0037] To address the performance degradation caused by watermark conflicts and further explore the factors affecting watermark performance, this invention proposes a trigger preprocessing algorithm. The lifecycle of the trigger set can be described as: watermark generation and uploading, watermark deduplication and hierarchical processing, watermark distribution, and local training.
[0038] Specifically, each client i uses a predefined watermark generation algorithm Gen() to generate M incorrect data-tag pairs as a local trigger set {T}. local i}, and then each client i will trigger the local set {T}. local 1} to {T local K Upload to a trusted central server.
[0039] When the trusted central server receives {T local 1} to {T local K After all local trigger sets are processed, these MK trigger samples will be reviewed, and conflicting items will be identified and deleted. After deleting conflicting items, the trusted central server will reshuffle all trigger samples to form a watermarked trigger set {T}. Global}; then the central server randomly selects from {T Global In the process of drawing N trigger samples without replacement, {T} is formed by sequentially drawing N trigger samples to form {T}. level 1}, {T level 2},…,{T levrl L The number of watermark levels L and the number of trigger samples N for each level are determined by the central server.
[0040] As a preferred embodiment, distributing the watermark trigger set to multiple clients includes: sequentially extracting several trigger samples from the watermark trigger set without replacement to form multiple watermark trigger subsets; dividing the multiple watermark trigger subsets into multiple levels; and distributing the multiple watermark trigger subsets to multiple clients based on a preset distribution strategy.
[0041] Specifically, the central server distributes tiered watermarks, assigning the i-th level watermark to i clients. In this way, the highest level watermark is distributed to all clients, while the lowest level watermark is distributed to only one client, resulting in different numbers of watermarks received by each client. This distribution rule does not raise fairness issues because during the ownership verification phase, the client sends a verification request, and the trusted central server verifies the ownership using global watermark information. This ensures that the ownership authentication results for each client are equally reliable. The watermark label, its level, and the allocation result are all recorded in the central server's backdoor dictionary.
[0042] As a preferred embodiment, the data concatenated from the watermark trigger set and the local trigger set is used to train the federated learning watermarking model to complete the federated watermark embedding.
[0043] The client receives the hierarchical watermark, then concatenates the watermark trigger set with the local training set to jointly train the model. The training goal is to enable the global model to achieve:
[0044]
[0045] Among them, X T and X D These represent the trigger sample and the local data sample, respectively; Y * This is the model output, where Y^ is the predefined watermark label. T and Y D They are X T and X D The true label. In other words, this backdoor federated learning watermarking model can not only perform the original classification task well, but also correctly identify the embedded watermark. This feature will be used in the ownership verification stage.
[0046] 102: If the client detects that a suspicious API is an illegal copy of the federated learning watermarking model, receive the client's ownership verification request, which includes a local trigger set;
[0047] The ownership authentication process consists of two parts: client-side detection and server arbitration. The trained global model contains all watermark information.
[0048] Dual authentication is necessary because dishonest clients may use local trigger sets as watermarks embedded in other pre-trained models, attempting to pass ownership verification by only training the watermarks without contributing data, thus leveraging the watermark generalization ability of the federated model. Therefore, client authentication alone cannot guarantee the credibility of the verification results. Thus, a trusted third-party server is needed to participate in further authentication. By inputting watermarks of various levels from high to low into the API, a definite ownership level is obtained to eliminate the authentication bias caused by client ownership generalization.
[0049] When verifying ownership, two important metrics need to be considered: watermark detection rate η. T And the corresponding p-value.
[0050] Watermark detection rate η T The ratio of correctly classified backdoor samples to received trigger set samples measures the similarity between the output watermark label and the real label embedded with the watermark.
[0051]
[0052] Federated models trained on trigger sets have the ability to correctly classify watermarks, while federated models not trained on trigger sets do not. Therefore, the watermark detection rate η for suspicious APIs... TThe closer it is to 1, the more reason the model owner has to believe it is an illegal copy of the federal model;
[0053] The p-value is a parameter used in statistics to determine the result of a hypothesis test. Statistically, a null hypothesis is rejected when p ≤ 0.05. For a data sample X ~ B(N, p), the formula for calculating the p-value is:
[0054]
[0055] In ownership authentication, the null hypothesis H0 is: the remote API is not an illegal copy of the federated model. If p ≤ 0.05, then the null hypothesis H0 is rejected, indicating that illegal theft of the federated model has occurred.
[0056] Ownership authentication results are determined using the following formula:
[0057]
[0058] Please refer to Figure 3 , Figure 3 A schematic diagram of the ownership authentication process provided by this invention.
[0059] 103: Perform preliminary verification of ownership of suspicious APIs based on local trigger sets;
[0060] As a preferred embodiment, preliminary ownership verification of a suspicious API based on a local trigger set includes: inputting the local trigger set into the suspicious API to obtain the output watermark label; determining the watermark detection rate and hypothesis testing result parameters based on the output watermark label and the real label of the trigger set; if the watermark detection rate and hypothesis testing result parameters meet preset conditions, the preliminary ownership verification passes; if the watermark detection rate and hypothesis testing result parameters do not meet preset conditions, the preliminary ownership verification fails.
[0061] Specifically, the client (model owner) first inputs the local watermark set into a remote API outside the federated system for testing. If the API output highly matches the real label of the trigger set, there is reason to suspect that the API is a copy of the federated model.
[0062] The client then sends an ownership authentication request to the trusted central server, providing the model ID (IdentityDocument) and a local watermark set;
[0063] The trusted central server calculates the watermark detection rate η based on the local watermark set provided by the test client and the backdoor watermark record. T Preliminary ownership verification was performed using the corresponding p-value.
[0064] 104: If the initial ownership verification passes, perform multi-level ownership verification of the suspicious API based on the watermark trigger set.
[0065] As a preferred embodiment, multi-level ownership verification of a suspicious API based on a watermark trigger set includes: determining a verification watermark set based on the watermark trigger set, using the verification watermark set as input to the suspicious API, and the verification watermark set being a preset number of watermark trigger subsets selected from the watermark trigger set; inputting the verification watermark set into the suspicious API in a preset level order, and calculating the watermark detection rate and hypothesis testing result parameters to obtain the ownership verification level, thereby completing the multi-level ownership verification.
[0066] If the initial verification passes, the trusted central server will perform a "challenge-style verification" to conduct step-by-step checks. Specifically, the server starts from {T} level1} to {T levelL A subset of samples is randomly and equally selected to form a verification watermark set σ{T} level1} to σ{T levelL}(0<σ≤1) is used as input to the remote API, and then the highest level watermark σ{T} is used as input. levelL} to the lowest level watermark σ{T level1} Detection rate η is performed sequentially T The p-value is then used to calculate a specific ownership level, which can be numerically equal to the level of a continuously verified watermark. A higher ownership level indicates a more reliable ownership authentication result and a stronger ability to prove that the remote API is an illegal copy of the federated model.
[0067] In summary, the present invention designs a trigger set preprocessing method in which the client and server jointly execute the trigger sample aggregation, deduplication, and classification process: the server records the watermark sample label and its level, and formulates a distribution strategy to distribute the classified watermarks to each client.
[0068] This invention designs a trusted ownership authentication method. First, the client tests its local watermark set. Upon detecting anomalies, the client submits the model ID and local watermark set to the central server and sends an ownership authentication request. Then, the server performs a detection rate η. T The p-value is calculated to initially test the local watermark set submitted by the client. If the verification passes, a "challenge-style verification" process is used to conduct step-by-step testing to obtain a definite ownership level, which is used to determine the credibility of the verification result.
[0069] This invention, from the perspective of federated model security, integrates the technical characteristics of black-box backdoor watermarking and designs a model security verification method based on federated learning watermarking, achieving copyright protection for the model on the client side. In this backdoor watermarking method, a trigger set preprocessing method is designed to address potential watermark conflicts, reducing the impact on model accuracy by eliminating conflicting terms; while the trusted ownership authentication method, with dual verification by the client and server, further enhances the credibility of the ownership authentication results. Simulation experiments show that this invention can reliably support ownership verification results with negligible impact on the original classification task. It is also applicable to various federated training settings and robust to various model attacks.
[0070] The effectiveness of the method and its robustness under specific attack types were verified through experiments. The specific experimental setup is as follows:
[0071] The programming language used in the experiment was Python, and the programming software was VS Code. To improve the running speed, a 3080ti GPU (Graphics Processing Unit) was selected.
[0072] The experiment used two different DNN (Deep Neural Networks) architectures: AlexNet and ResNet-18. AlexNet was used as the default architecture, consisting of 8 convolutional neural network layers, of which 5 were convolutional layers and 3 were fully connected layers.
[0073] The experiment focuses on image classification tasks, using the Cifar10 dataset for performance evaluation. This dataset contains 60,000 32x32 pixel RGB images, divided into 10 classes, with 6,000 images per class. There are 50,000 training images and 10,000 test images.
[0074] To simulate a Federated Learning (FL) scenario, the program initializes the number of clients to 20, the watermark level to 10, and the number of diversity watermark samples to 10. The training data is uniformly sampled and preprocessed through random pruning, horizontal flipping, and normalization. The backdoor clients process the training data in batches, updating their local models by minimizing the loss function. FedAvg is chosen as the federated aggregation algorithm, with the weight of each client determined by the amount of data it contributes.
[0075] An ideal watermarking scheme should provide reliable ownership verification without affecting the performance of the main task, and should be resistant to various attacks. Based on this goal, three evaluation metrics—fidelity, significance, and robustness—were selected for simulation experiments.
[0076] Please refer to Figure 4 , Figure 4 The figure shows the results of the fidelity experiment on AlexNet.
[0077] Please refer to Figure 5 , Figure 5 The figure shows the results of the fidelity experiment on ResNet.
[0078] Fidelity, also known as feature retention, refers to the original task performance of the federated model. To investigate the impact of FedBack on model fidelity in this invention, Accelerator was used... main As a measure of fidelity, Acc is used to evaluate the models with / without embedded watermarks. main A control experiment was conducted. The baseline was the watermark-free federated aggregation algorithm FedAvg, while the control group, FedIPR, was another FL copyright protection watermarking framework. The Acc... main Slightly lower (no more than 1%) than the baseline FedAvg, but still better than FedIPR, demonstrating that FedBack performs well in terms of fidelity.
[0079] An ideal watermarking scheme needs to have good watermark recognition capabilities, which can provide credible proof of ownership authentication results. The selected watermark detection rate η... T The significance of a watermark is evaluated using two indicators: statistical significance (p-value) and watermark detection rate (η). T The ratio of correctly classified backdoor samples to the total number of trigger set samples. Experiments were conducted using Cifar10 on the AlexNet model, with a watermark detection rate η. T The results are shown in Table 1: Under different settings of the number of samples N in the hierarchical trigger set and the total number of clients K, the watermark detection rate η T The accuracy rate remains above 99%, indicating that the federated watermarking model has a good ability to identify trigger set watermarks.
[0080] Table 1. Watermark detection rate η under different trigger set sample size N and client number K. T
[0081]
[0082] The statistical significance p-value is a measure of the validity of the results. When p ≤ 0.05, the null hypothesis is rejected. As shown in Table 2, under different settings of the number of samples N in the hierarchical trigger set and the total number of clients K, the p-value is always much smaller than the upper bound of 0.05, which provides strong evidence for the ownership verification results.
[0083] Table 2. Watermark detection rate η under different trigger set sample sizes N and client number K. T and corresponding p-value
[0084] Sample size N 5 10 15 20 Number of levels L 10 10 10 10 Detection rate 99.62％±0.31％ 99.53％±0.42％ 99.67％±0.27％ 99.76％±0.16％ p-value 4.5E-48 9E-98 1.35E-147 1.6119E-194
[0085] An ideal watermarking scheme needs to be robust against various attacks, such as trigger set forgery attacks and fine-tuning attacks. In addition, it needs to minimize the impact of the training strategy on the accuracy of the main task.
[0086] Attackers might attempt to forge a trigger set {T~} using Generative Adversarial Network (GAN) technology, hoping to gain access to the federated model by verifying ownership of the target model through this forged trigger set {T~}. This invention can identify watermark forgery and cause the model ownership verification to fail.
[0087] Since the attacker's randomly generated fake trigger set {T~} was not used in the training, the federated model does not contain such watermark information. Therefore, the probability of correct output is almost equivalent to the probability of random guessing, as shown in Table 3.
[0088] Table 3. Watermark detection rates η for genuine trigger set {T} and fake trigger set {T~} T
[0089]
[0090] The model ownership authentication needs to satisfy formula (4): the specified threshold ∈ is close to 0, but the watermark recognition error rate when using the fake trigger set is about 0.9, and the p value also exceeds the upper limit of 0.05. Therefore, ownership verification will not pass when using the fake trigger.
[0091] Please refer to Figure 6 , Figure 6 The figure shows the results of the robustness test.
[0092] Fine-tuning attacks refer to attackers retraining the model using their own dataset. The number of fine-tuning iterations was gradually increased to 30. Although the watermark detection rate decreased slightly with increasing fine-tuning iterations, it remained above 90%. Furthermore, the accuracy of the main task remained almost stable above 90%. Experimental results demonstrate the robustness of this invention against fine-tuning attacks.
[0093] The following describes the security verification device based on the federated learning watermarking model provided by the present invention. The security verification device based on the federated learning watermarking model described below can be referred to in correspondence with the security verification method based on the federated learning watermarking model described above.
[0094] Please refer to Figure 7 , Figure 7 This is a schematic diagram of the structure of the verification device based on the federated learning watermarking model provided by the present invention.
[0095] This invention also provides a security verification device based on a federated learning watermarking model, applied to a server of a security verification system based on a federated learning watermarking model. The system includes a server and multiple clients. The device includes: a watermark trigger set preprocessing module for determining the watermark trigger set and distributing it to multiple clients; each client stores its own local trigger set; a request receiving module for receiving an ownership verification request from the client when the client detects a suspicious API as an illegal copy of the federated learning watermarking model, the ownership verification request including the local trigger set; a preliminary verification module for performing preliminary ownership verification of the suspicious API based on the local trigger set; and a multi-level verification module for performing multi-level ownership verification of the suspicious API based on the watermark trigger set after the preliminary ownership verification is passed.
[0096] Figure 8 An example is a schematic diagram of the physical structure of an electronic device, such as... Figure 8 As shown, the electronic device may include: a processor 801, a communication interface 802, a memory 803, and a communication bus 804. The processor 801, communication interface 802, and memory 803 communicate with each other via the communication bus 804. The processor 801 can call logical instructions in the memory 803 to execute a security verification method based on a federated learning watermarking model. This method is applied to a server in a security verification system based on a federated learning watermarking model. The system includes a server and multiple clients. The method includes: determining a watermark trigger set and distributing the watermark trigger set to multiple clients; each client storing a local trigger set; receiving an ownership verification request from a client when a client detects a suspicious API as an illegal copy of the federated learning watermarking model, the ownership verification request including the local trigger set; performing preliminary ownership verification of the suspicious API based on the local trigger set; and performing multi-level ownership verification of the suspicious API based on the watermark trigger set if the preliminary ownership verification passes.
[0097] Furthermore, the logical instructions in the aforementioned memory 803 can be implemented as software functional units and, when sold or used as independent products, can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present invention, essentially, or the part that contributes to the prior art, or a part of the technical solution, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute all or part of the steps of the methods described in the various embodiments of the present invention. The aforementioned storage medium includes various media capable of storing program code, such as USB flash drives, portable hard drives, read-only memory (ROM), random access memory (RAM), magnetic disks, or optical disks.
[0098] On the other hand, the present invention also provides a computer program product, which includes a computer program that can be stored on a non-transitory computer-readable storage medium. When the computer program is executed by a processor, the computer is able to execute the security verification method based on the federated learning watermarking model provided by the above methods, applied to a server of a security verification system based on the federated learning watermarking model. The system includes a server and multiple clients. The method includes: determining a watermark trigger set and distributing the watermark trigger set to multiple clients; each client storing a local trigger set; receiving an ownership verification request from the client when the client detects a suspicious API as an illegal copy of the federated learning watermarking model, the ownership verification request including the local trigger set; performing preliminary ownership verification of the suspicious API based on the local trigger set; and performing multi-level ownership verification of the suspicious API based on the watermark trigger set when the preliminary ownership verification passes.
[0099] In another aspect, the present invention also provides a non-transitory computer-readable storage medium storing a computer program thereon, which, when executed by a processor, implements the security verification method based on the federated learning watermarking model provided by the above methods, and is applied to a server of a security verification system based on the federated learning watermarking model. The system includes a server and multiple clients. The method includes: determining a watermark trigger set and distributing the watermark trigger set to multiple clients; each client storing a local trigger set; receiving an ownership verification request from the client when the client detects a suspicious API as an illegal copy of the federated learning watermarking model, the ownership verification request including the local trigger set; performing preliminary ownership verification of the suspicious API based on the local trigger set; and performing multi-level ownership verification of the suspicious API based on the watermark trigger set if the preliminary ownership verification passes.
[0100] The device embodiments described above are merely illustrative. The units described as separate components may or may not be physically separate. The components shown as units may or may not be physical units; that is, they may be located in one place or distributed across multiple network units. Some or all of the modules can be selected to achieve the purpose of this embodiment according to actual needs. Those skilled in the art can understand and implement this without any creative effort.
[0101] Through the above description of the embodiments, those skilled in the art can clearly understand that each embodiment can be implemented by means of software plus necessary general-purpose hardware platforms, and of course, it can also be implemented by hardware. Based on this understanding, the above technical solutions, in essence or the part that contributes to the prior art, can be embodied in the form of a software product. This computer software product can be stored in a computer-readable storage medium, such as ROM / RAM, magnetic disk, optical disk, etc., and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute the methods described in the various embodiments or some parts of the embodiments.
[0102] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention, and not to limit them; although the present invention has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that modifications can still be made to the technical solutions described in the foregoing embodiments, or equivalent substitutions can be made to some of the technical features; and these modifications or substitutions do not cause the essence of the corresponding technical solutions to deviate from the spirit and scope of the technical solutions of the embodiments of the present invention.
Claims
1. A security verification method based on a federated learning watermarking model, characterized in that, A server is used in a security verification system based on a federated learning watermarking model, the system comprising a server and multiple clients; The method includes: A watermark trigger set is determined and distributed to multiple clients; each client stores its own local trigger set. If the client detects that a suspicious API is an illegal copy of the federated learning watermarking model, the client receives an ownership verification request, which includes the local trigger set. Preliminary verification of ownership of the suspicious API is performed based on the local trigger set; If the initial ownership verification passes, multi-level ownership verification of the suspicious API is performed based on the watermark trigger set; The preliminary ownership verification of the suspicious API based on the local trigger set includes: The local trigger set is input into the suspicious API to obtain the output watermark label; The watermark detection rate and hypothesis testing result parameters are determined based on the output watermark label and the real label of the trigger set. If the watermark detection rate and the hypothesis test result parameters meet the preset conditions, the ownership verification is initially successful; If the watermark detection rate and the hypothesis test result parameters do not meet the preset conditions, the preliminary verification of ownership will fail.
2. The security verification method based on the federated learning watermarking model according to claim 1, characterized in that, The determination of the watermark trigger set includes: Receive local trigger sets from multiple clients; Multiple local trigger sets are pre-processed with watermark to generate watermark trigger sets; the watermark pre-processing includes conflict-removing watermarking and watermark hierarchical processing.
3. The security verification method based on the federated learning watermarking model according to claim 1, characterized in that, The step of distributing the watermark trigger set to multiple clients includes: Multiple watermark trigger subsets are formed by sequentially extracting several trigger samples without replacement from the watermark trigger set; the multiple watermark trigger subsets are divided into multiple levels; Based on a preset distribution strategy, multiple watermark trigger subsets are distributed to multiple clients.
4. The security verification method based on the federated learning watermarking model according to claim 1, characterized in that, The data obtained by concatenating the watermark trigger set and the local trigger set is used to train the federated learning watermark model and complete the federated watermark embedding.
5. The security verification method based on the federated learning watermarking model according to claim 1, characterized in that, The multi-level ownership verification of the suspicious API based on the watermark trigger set includes: A verification watermark set is determined based on the watermark trigger set, and the verification watermark set serves as the input to the suspicious API. The verification watermark set is a preset number of watermark trigger subsets selected from the watermark trigger set. The verification watermark set is input into the suspicious API in a preset level order, and the watermark detection rate and hypothesis testing result parameters are calculated to obtain the ownership verification level, so as to complete the multi-level ownership verification.
6. A security verification device based on a federated learning watermarking model, characterized in that, A server is used in a security verification system based on a federated learning watermarking model, the system comprising a server and multiple clients; The device includes: A watermark trigger set preprocessing module is used to determine the watermark trigger set and distribute the watermark trigger set to multiple clients; each client stores its own local trigger set. The request receiving module is configured to receive an ownership verification request from the client when the client detects that the suspicious API is an illegal copy of the federated learning watermarking model, wherein the ownership verification request includes the local trigger set; The preliminary verification module is used to perform preliminary ownership verification of the suspicious API based on the local trigger set; A multi-level verification module is used to perform multi-level ownership verification of the suspicious API based on the watermark trigger set, provided that the initial ownership verification has passed. The preliminary ownership verification of the suspicious API based on the local trigger set includes: The local trigger set is input into the suspicious API to obtain the output watermark label; The watermark detection rate and hypothesis testing result parameters are determined based on the output watermark label and the real label of the trigger set. If the watermark detection rate and the hypothesis test result parameters meet the preset conditions, the ownership verification is initially successful; If the watermark detection rate and the hypothesis test result parameters do not meet the preset conditions, the preliminary verification of ownership will fail.
7. An electronic device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, characterized in that, When the processor executes the program, it implements the security verification method based on the federated learning watermarking model as described in any one of claims 1 to 5.
8. A non-transitory computer-readable storage medium having a computer program stored thereon, characterized in that, When the computer program is executed by the processor, it implements the security verification method based on the federated learning watermarking model as described in any one of claims 1 to 5.
9. A computer program product, comprising a computer program, characterized in that, When the computer program is executed by the processor, it implements the security verification method based on the federated learning watermarking model as described in any one of claims 1 to 5.