Artificial intelligence model parameter protection method, device, equipment and storage medium

Abstract

The present invention discloses an artificial intelligence model parameter protection method, device, equipment and storage medium, which belongs to the field of information security technology. The present invention generates a watermark based on the parameter information of the model to be protected to obtain a model parameter watermark; embeds the model parameter watermark into the model to be protected to obtain a watermark model; obtains the watermark model to be detected, and performs tamper detection on the watermark model to be detected to obtain a model tamper detection result; if the model tamper detection result is that tampering exists, the tampered watermark model is tamper-recovered to obtain a watermark model. The present invention first embeds the model parameter watermark generated based on the parameter information of the model to be protected into the model to be protected, and then performs tamper detection on the acquired watermark model to be detected, and finally performs tamper recovery on the tampered watermark model, thereby realizing tamper detection and tamper recovery of the model parameters, and improving the security and integrity of the model parameters.

Description

Technical Field

[0001] The present invention relates to the field of information security technology, and in particular to an artificial intelligence model parameter protection method, device, equipment and storage medium. Background Art

[0002] In today's increasingly complex information security environment, especially in the field of artificial intelligence, effective protection of model parameters is crucial. With the rapid development of AI technology, deep learning models have become a core component of various intelligent systems. However, due to the inadequacy of current protection mechanisms, deep learning models and their parameters have become a coveted target for criminals.

[0003] However, mainstream model watermarking methods are currently mostly applied to model copyright protection, while research on model parameter protection is rarely mentioned. While existing model watermarking technologies can detect whether a model has been tampered with, most cannot accurately locate the tampered area. Furthermore, once a model is attacked, its original value is often lost, and retraining the model requires a large amount of data and time resources.

[0004] In view of this, there is an urgent need to obtain an artificial intelligence model parameter protection method to effectively protect the model, accurately detect whether the model parameters have been tampered with, and restore the tampered model.

[0005] The above content is only used to assist in understanding the technical solution of the present invention and does not constitute an admission that the above content is prior art. Summary of the Invention

[0006] The main purpose of the present invention is to provide an artificial intelligence model parameter protection method, device, equipment and storage medium, aiming to solve the technical problems in the prior art of how to effectively protect model parameters and accurately detect and recover tampered parameters.

[0007] To achieve the above objectives, the present invention provides an artificial intelligence model parameter protection method, which includes the following steps:

[0008] Generate a watermark based on the parameter information of the model to be protected to obtain a model parameter watermark;

[0009] Embedding the model parameter watermark into the model to be protected to obtain a watermark model;

[0010] Obtaining a watermark model to be detected, and performing tamper detection on the watermark model to be detected to obtain a model tamper detection result;

[0011] If the model tampering detection result indicates that tampering has occurred, tampering recovery is performed on the tampered watermark model to obtain the watermark model.

[0012] Optionally, watermark generation is performed based on the model parameter information to be protected to obtain a model parameter watermark, specifically including:

[0013] Obtain parameter information of the model to be protected;

[0014] Generate a watermark based on the parameter information of the model to be protected to obtain watermark recovery bit data;

[0015] Performing data encryption based on the watermark recovery bit data to obtain a watermark ciphertext;

[0016] Generating a verification probe based on the parameter information of the model to be protected to obtain a watermark verification probe;

[0017] The watermark recovery bit data, the watermark ciphertext and the watermark verification probe are integrated to obtain the model parameter watermark.

[0018] Optionally, generating a watermark based on the parameter information of the model to be protected to obtain watermark recovery bit data specifically includes:

[0019] Reshape the model parameters based on the model parameter information to be protected to obtain the reshaped model parameters;

[0020] performing data compression on the reshaped model parameters to obtain compressed model parameters;

[0021] Format matching is performed on the compressed model parameters to obtain the watermark recovery bit data.

[0022] Optionally, data encryption is performed based on the watermark recovery bit data to obtain watermark ciphertext, specifically including:

[0023] Performing group encryption on the watermark recovery bit data to obtain the watermark ciphertext;

[0024] The encryption formula of the block encryption is:

[0025] G_W C {i}=K×G_W R {i}

[0026] Where G_W R is the recovery information after grouping, G_W C is the watermark ciphertext information generated corresponding to each group of recovery information, i is the group number corresponding to each group, and K is the key parameter.

[0027] Optionally, generating a verification probe based on the parameter information of the model to be protected to obtain a watermark verification probe specifically includes:

[0028] Extracting data features based on the parameter information of the model to be protected, and obtaining parameter data feature sets;

[0029] Inputting the parameter data feature set into a hash algorithm to generate a verification probe to obtain a hash probe;

[0030] Obtaining matrix eigenvalues ​​based on the parameter data feature set, and generating eigenvalue probes according to the matrix eigenvalues;

[0031] Obtaining a corresponding marker probe based on the parameter data feature set;

[0032] The hash probe, the eigenvalue probe and the marker probe are integrated to obtain the watermark verification probe.

[0033] Optionally, obtaining a watermark model to be detected and performing tamper detection on the watermark model to be detected to obtain a model tampering detection result specifically includes:

[0034] Acquire a watermark model to be detected, and extract a verification probe from the watermark model to be detected to obtain an actual watermark verification probe;

[0035] Acquiring model parameter information based on the watermark model to be detected to obtain the model parameter information to be detected;

[0036] Generate a theoretical watermark based on the parameter information of the model to be detected to obtain a theoretical watermark verification probe;

[0037] The actual watermark verification probe and the theoretical watermark verification probe are subjected to tamper detection to obtain the model tamper detection result.

[0038] Optionally, if the model tampering detection result indicates that tampering has occurred, performing tamper recovery on the tampered watermark model to obtain the watermark model specifically includes:

[0039] If the model tampering detection result indicates that tampering has occurred, model parameters of the tampered watermark model are extracted to obtain a set of model parameters to be restored;

[0040] Performing data purification on the set of model parameters to be restored to obtain a purified set of model parameters to be restored;

[0041] Performing tampering identification on the purified set of model parameters to be restored to obtain a model parameter tampering identification result;

[0042] The tampered watermark model is tampered recovered based on the model parameter tampering identification result to obtain the watermark model.

[0043] In addition, to achieve the above-mentioned purpose, the present invention also proposes an artificial intelligence model parameter protection device, the model parameter protection device comprising:

[0044] Watermark generation module: generates watermark based on the parameter information of the model to be protected to obtain the model parameter watermark;

[0045] Watermark embedding module: embeds the model parameter watermark into the model to be protected to obtain a watermark model;

[0046] Tamper detection module: obtains the watermark model to be detected, and performs tamper detection on the watermark model to be detected to obtain the model tamper detection result;

[0047] Tamper recovery module: If the model tamper detection result is that tampering has occurred, tamper recovery is performed on the tampered watermark model to obtain the watermark model.

[0048] In addition, to achieve the above-mentioned purpose, the present invention also proposes an artificial intelligence model parameter protection device, which includes: a memory, a processor, and a model parameter protection program stored on the memory and runnable on the processor, and the model parameter protection program is configured to implement the steps of the artificial intelligence model parameter protection method described above.

[0049] In addition, to achieve the above-mentioned purpose, the present invention also proposes a computer-readable storage medium storing a computer program, wherein a model parameter protection program is stored on the storage medium, and when the model parameter protection program is executed by the processor, the steps of the artificial intelligence model parameter protection method described above are implemented.

[0050] The present invention generates a watermark based on the parameter information of the model to be protected to obtain a model parameter watermark; embeds the model parameter watermark into the model to be protected to obtain a watermark model; obtains the watermark model to be detected, and performs tamper detection on the watermark model to be detected to obtain a model tamper detection result; if the model tamper detection result indicates that tampering has occurred, tamper recovery is performed on the tampered watermark model to obtain a watermark model. The present invention first embeds the model parameter watermark generated based on the parameter information of the model to be protected into the model to be protected, then performs tamper detection on the obtained watermark model to be detected, and finally performs tamper recovery on the tampered watermark model, thereby achieving tamper detection and tamper recovery of the model parameters and improving the security and integrity of the model parameters. BRIEF DESCRIPTION OF THE DRAWINGS

[0051] Figure 1 Schematic diagram of the structure of a model parameter protection device for a hardware operating environment according to an embodiment of the present invention;

[0052] Figure 2 This is a flow chart of a first embodiment of the model parameter protection method of the present invention;

[0053] Figure 3 This is a flow chart of a second embodiment of the model parameter protection method of the present invention;

[0054] Figure 4 This is a flow chart of a third embodiment of the model parameter protection method of the present invention;

[0055] Figure 5 This is a structural block diagram of the first embodiment of the model parameter protection device of the present invention.

[0056] The purpose, features and advantages of the present invention will be further described with reference to the accompanying drawings and in conjunction with the embodiments. DETAILED DESCRIPTION

[0057] It should be understood that the specific embodiments described herein are only used to explain the present invention and are not intended to limit the present invention.

[0058] Reference Figure 1 , Figure 1 This is a schematic diagram of the structure of a model parameter protection device for a hardware operating environment according to an embodiment of the present invention.

[0059] like Figure 1 As shown, the model parameter protection device may include: a processor 1001, such as a central processing unit (CPU), a communication bus 1002, a user interface 1003, a network interface 1004, and a memory 1005. The communication bus 1002 is used to realize the connection and communication between these components. The user interface 1003 may include a display screen (Display), an input unit such as a keyboard (Keyboard), and the user interface 1003 may optionally include a standard wired interface and a wireless interface. The network interface 1004 may optionally include a standard wired interface and a wireless interface (such as a wireless fidelity (Wi-Fi) interface). The memory 1005 may be a high-speed random access memory (Random Access Memory, RAM) or a stable non-volatile memory (Non-Volatile Memory, NVM), such as a disk storage. The memory 1005 may also be a storage device independent of the aforementioned processor 1001.

[0060] Those skilled in the art will understand that Figure 1 The structure shown in the figure does not constitute a limitation on the model parameter protection device, and may include more or fewer components than shown in the figure, or combine certain components, or arrange the components differently.

[0061] like Figure 1As shown, the memory 1005 as a storage medium may include an operating system, a network communication module, a user interface module, and a model parameter protection program.

[0062] exist Figure 1 In the model parameter protection device shown, the network interface 1004 is mainly used for data communication with the network server; the user interface 1003 is mainly used for data interaction with the user; the processor 1001 and the memory 1005 in the model parameter protection device of the present invention can be set in the model parameter protection device, and the model parameter protection device calls the model parameter protection program stored in the memory 1005 through the processor 1001, and executes the model parameter protection method provided by the embodiment of the present invention.

[0063] The embodiment of the present invention provides an artificial intelligence model parameter protection method, referring to Figure 2 , Figure 2 This is a flow chart of the first embodiment of an artificial intelligence model parameter protection method of the present invention.

[0064] In this embodiment, the model parameter protection method includes the following steps:

[0065] Step S10: Generate a watermark based on the model parameter information to be protected to obtain a model parameter watermark;

[0066] It should be noted that, in the specific implementation, the model parameter information to be protected specifically refers to the weight parameter data information of the artificial intelligence model to be protected, etc.

[0067] Step S20: embedding the model parameter watermark into the model to be protected to obtain a watermark model;

[0068] It should be noted that, in the specific implementation, embedding the model parameter watermark into the model to be protected specifically refers to embedding the watermark information (model parameter watermark) into the parameters of the original model (model to be protected), thereby finally obtaining a watermark model, wherein the embedding of the watermark does not affect the performance of the model to be protected.

[0069] It should also be noted that, in the specific implementation, in order to reduce the negative impact of the watermark embedding process on the model performance while maintaining high sensitivity to data tampering, only the LSB part of the model parameters will be replaced with the generated watermark.

[0070] Step S30: obtaining a watermark model to be detected, and performing tampering detection on the watermark model to be detected to obtain a model tampering detection result;

[0071] It is understandable that in actual use, the watermark model may be subject to malicious tampering attacks, which may cause the watermark model parameters to change. Therefore, tampering detection of the watermark model to be detected is essentially tampering location of the model parameters.

[0072] Step S40: If the model tampering detection result is that tampering has occurred, the tampered watermark model is restored to obtain a watermark model.

[0073] It should be noted that, in a specific implementation, the tampering recovery of the tampered watermark model is specifically to restore the tampered model parameters based on the recovery watermark, so as to finally obtain the watermark model.

[0074] This embodiment generates a watermark based on the parameter information of the model to be protected to obtain a model parameter watermark; embeds the model parameter watermark into the model to be protected to obtain a watermark model; obtains the watermark model to be detected, and performs tamper detection on the watermark model to be detected to obtain a model tamper detection result; if the model tamper detection result indicates that tampering has occurred, tamper recovery is performed on the tampered watermark model to obtain a watermark model. This embodiment first embeds the model parameter watermark generated based on the parameter information of the model to be protected into the model to be protected, then performs tamper detection on the obtained watermark model to be detected, and finally performs tamper recovery on the tampered watermark model, thereby achieving tamper detection and tamper recovery of the model parameters and improving the security and integrity of the model parameters.

[0075] refer to Figure 3 , Figure 3 This is a flow chart of the second embodiment of an artificial intelligence model parameter protection method of the present invention.

[0076] Based on the above first embodiment, in this embodiment, step S10 specifically includes:

[0077] Step S11: Obtain parameter information of the model to be protected;

[0078] It should be noted that, in the specific implementation, the model parameter information to be protected specifically refers to the weight data information learned by the model, which requires the model parameters to be represented as 32-bit floating-point numbers, including 1 sign bit for indicating positive and negative; 8 exponent bits for indicating the size range of the value; and 23 mantissa bits for indicating the decimal part.

[0079] It should also be noted that in the specific implementation, if the model parameter to be protected is a 32-bit floating-point number, the x consecutive bits at one end of the data can be regarded as the most significant bit (MSB) with the highest data weight, and the remaining (32-x) bits are the least significant bits (LSB) and can be used to embed subsequent watermark information.

[0080] Step S12: Generate a watermark based on the parameter information of the model to be protected to obtain watermark recovery bit data;

[0081] It should be noted that, in a specific implementation, the model parameter watermark generated based on the model parameter information to be protected is specifically composed of three parts, including the first part, the recovery bit W R 、Second part of the ciphertext W C And the third part verifies the probe W A , these three parts can satisfy the following formula relationship:

[0082] ((k+1)×z+y)=32–x

[0083] Where x is the number of the most important bits of the model parameter, z is the number of recovered bits W R The number of data bits, y is the verification probe W A The size of k*z is the ciphertext W C size.

[0084] It should also be noted that in the specific implementation, the watermark recovery bit data actually refers to the recovery bit W R , which can be achieved through a high-fidelity technology suitable for model compression. The specific process is as follows: assuming that each model layer has N parameters, each parameter data is initially amplified by 100 times to protect the two decimal places of the parameter; then the model layer is reshaped into a 2n*(N / 2n) matrix form; then, the SPIHT (Set Partitioning in HierarchicalTrees) algorithm is applied to the reshaped parameters for compression; finally, the output of the SPIHT algorithm is truncated to a size of z*N to match W R (Recovery bit) required size (to ensure the generated W R Compatible with watermarking systems and meeting specific data format requirements). The purpose of model layer reshaping is to make the structure of model parameters more consistent with the SPIHT algorithm's processing of images or data blocks. The SPIHT algorithm is an efficient image compression method based on wavelet transform. By adjusting the SPIHT algorithm's parameters, the compression quality and output data size can be controlled.

[0085] Step S13: encrypting data based on the watermark recovery bit data to obtain watermark ciphertext;

[0086] It should be noted that, in the specific implementation, in order to protect the recovery information W R , it needs to be linearly encrypted to generate the ciphertext Wc. In order to further improve the operation efficiency and security, W R Divided into m groups G_W R , each group contains (N / m)*z bits; then, each group of recovery information G_W is encrypted using the ciphertext encryption formulaR Encryption generates ciphertext G_Wc, where the ciphertext encryption formula is:

[0087] G_W C {i}=K×G_W R {i}

[0088] Where, GW R is the group recovery information, G_Wc is the group ciphertext, and i is the group sequence number.

[0089] Step S14: Generate a verification probe based on the parameter information of the model to be protected to obtain a watermark verification probe;

[0090] It should be noted that in the specific implementation, the watermark verification probe is specifically used for subsequent data verification. The specific process is to first extract the most significant bit (x bits) from the parameter data; then input the extracted x-MSB into the hash algorithm to generate a hash value as a hash probe. Secondly, the eigenvalue probe is obtained by calculating the parameter data to enhance the security verification of the data. The process can be to first extract the first nine bits of the most significant bit (MSB) from the model parameters and construct a 3×3 matrix. Then, the eigenvalue probe is obtained by calculating the eigenvalue of the matrix. If the calculated eigenvalue is a complex number, their real parts are added together as the eigenvalue probe; if the eigenvalue is a real number, the eigenvalue probe is directly added together. Finally, a flag probe is required to add an additional layer of security.

[0091] Step S15: Integrate the watermark recovery bit data, the watermark ciphertext and the watermark verification probe to obtain the model parameter watermark.

[0092] It should be noted that in the specific implementation, the model parameter watermark is obtained by integrating the watermark recovery bit data, the watermark ciphertext and the watermark verification probe, and can simultaneously have the functions of the three probes.

[0093] This embodiment first obtains the model parameter information to be protected, and then obtains the watermark recovery bit data, watermark ciphertext and watermark verification probe in sequence based on the model parameter information to be protected, and finally integrates them to obtain the model parameter watermark, which provides a basis for subsequent watermark embedding.

[0094] refer to Figure 4 , Figure 4 This is a flow chart of the third embodiment of an artificial intelligence model parameter protection method of the present invention.

[0095] Based on the above second embodiment, in this embodiment, step S12 specifically includes:

[0096] Step S121: reshape the model parameters based on the model parameter information to be protected to obtain the reshaped model parameters;

[0097] It should be noted that, in a specific implementation, model parameter reshaping specifically refers to reshaping the model parameter structure into a form suitable for the SPIHT algorithm. For example, the model parameters can be reshaped into a 2n*(N / 2n) matrix form.

[0098] Step S122: performing data compression on the reshaped model parameters to obtain compressed model parameters;

[0099] It should be noted that, in the specific implementation, data compression is achieved by adjusting the parameters of the SPIHT algorithm to control the compression quality of the reshaped model parameters and the size of the output data.

[0100] Step S123: Perform format matching on the compressed model parameters to obtain watermark recovery bit data.

[0101] It should be noted that, in a specific implementation, format matching essentially refers to resizing the compressed model parameters so that the final watermark recovery bit information can achieve watermark system compatibility and meet specific data format requirements.

[0102] This embodiment first reshapes the model parameters based on the model parameter information to be protected to obtain the reshaped model parameters, then performs data compression on the reshaped model parameters to obtain compressed model parameters, and finally performs format matching on the compressed model parameters to obtain watermark recovery bit data, which provides a basis for the subsequent generation of watermark ciphertext.

[0103] Furthermore, data encryption is performed based on the watermark recovery bit data to obtain watermark ciphertext, specifically including: performing block encryption on the watermark recovery bit data to obtain watermark ciphertext; the encryption formula of the block encryption is:

[0104] G_W C {i}=K×G_W R {i}

[0105] Where G_W R is the recovery information after grouping, G_W C is the watermark ciphertext information generated corresponding to each group of recovery information, i is the group number corresponding to each group, and K is the key parameter.

[0106] It should be noted that, in a specific implementation, encrypting the watermark recovery bit data is a necessary step to protect data integrity and security, and grouping the watermark recovery bit data is to further improve operational efficiency and security.

[0107] Furthermore, a verification probe is generated based on the parameter information of the model to be protected to obtain a watermark verification probe, which specifically includes: extracting data features and a parameter data feature set based on the parameter information of the model to be protected; inputting the parameter data feature set into a hash algorithm to generate a verification probe to obtain a hash probe; obtaining matrix eigenvalues ​​based on the parameter data feature set, and generating eigenvalue probes based on the matrix eigenvalues; obtaining corresponding marker probes based on the parameter data feature set; and integrating the hash probe, eigenvalue probe, and marker probe to obtain a watermark verification probe.

[0108] Furthermore, a watermark model to be detected is obtained, and tampering detection is performed on the watermark model to be detected to obtain a model tampering detection result, specifically including: obtaining the watermark model to be detected, and extracting a verification probe on the watermark model to be detected to obtain an actual watermark verification probe; obtaining model parameter information based on the watermark model to be detected to obtain parameter information of the model to be detected; generating a theoretical watermark according to the parameter information of the model to be detected to obtain a theoretical watermark verification probe; and performing tampering detection on the actual watermark verification probe and the theoretical watermark verification probe to obtain a model tampering detection result.

[0109] It should be noted that, in the specific implementation, the tampering detection of the watermark model to be detected includes the following steps: first, extracting the verification probe W from the least significant bit (LSB) of the parameter. A _E; then generate the original verification probe W according to A In the same way, the verification probe W is recalculated from the MSB (most significant bit) of the model parameters and possibly other parts (depending on the watermark embedding strategy) A _C. Among them, if W A _E and W A _C are equal, the model parameters have not been tampered with since the watermark was embedded, so the model tampering detection result can be marked as not tampered with; if W A _E and W A _C are not equal, the model parameters have been illegally modified since the watermark was embedded. Therefore, the model tampering detection result can be marked as tampered, and the tampered parameters can be located to obtain the tampering identification result.

[0110] Furthermore, if the model tampering detection result is that tampering has occurred, the tampered watermark model is tamper-recovered to obtain the watermark model, specifically including: if the model tampering detection result is that tampering has occurred, model parameters of the tampered watermark model are extracted to obtain a set of model parameters to be recovered; data purification is performed on the set of model parameters to be recovered to obtain a purified set of model parameters to be recovered; tampering identification is performed on the purified set of model parameters to be recovered to obtain a model parameter tampering identification result; tampering recovery is performed on the tampered watermark model based on the model parameter tampering identification result to obtain a watermark model.

[0111] It should be noted that, in the specific implementation, the tampered watermark model is restored by first calculating and restoring the restored bits of each group of model parameters that have been tampered with by column, and then recovering the restored W R The SPIHT (Set Partitioning in Hierarchical Trees) decompression algorithm is applied to recover the parameters, thereby ultimately recovering all model parameters.

[0112] It should also be noted that, in the specific implementation, the specific process of tamper recovery of the recovery bits of each column that has been tampered includes: 1. Data purification: First refer to the marked ciphertext column C_W C The labels in are used to identify which ciphertexts are invalid; then, according to the position of these invalid ciphertexts in the ciphertext column, the corresponding rows in the key K are marked as invalid (where the key K is the coefficient matrix of the linear equation, so this correspondence is crucial for the accuracy of the decryption process); finally, data purification is performed to convert the ciphertext column C_W C The invalid ciphertext in the key K and the corresponding invalid rows in the key K are deleted together, and a column C_W containing only valid ciphertext is obtained. c valid and a corresponding effective key K valid , and the two can be used in the subsequent decryption and data processing process to ensure the correctness and security of the data. 2. Tamper mark: According to the position of the tampered parameter detected in step S30, mark the recovery bit C_WR, and similarly set K valid The corresponding column in is also marked as tampered; finally, the marked recovery bit column C_W R Decomposed into two parts: Untampered recovery bit column C_W R _ut (contains all unmodified recovery bits) and the tampered recovery bit column C_W R _t (including all tampered recovery bits); at the same time, K valid Decompose and obtain the untampered key K valid _ut (containing all columns corresponding to the unmodified recovery bits) and the tampered key K valid _t (contains all columns corresponding to the tampered recovery bits). 3. Tamper recovery: When the valid ciphertext C_W is obtained C valid and the corresponding key K valid When the two data are used to construct a linear equation system, the final solution is to obtain the recovery sequence C_W R The value in, where C_W C valid It appears as a constant term in this linear equation system, and its solution formula is:

[0113] C_W C valid {i}=K valid _t×C_W R _t{i}+K valid _ut×C_W R _ut{i}

[0114] Where C_W c valid is the column of valid ciphertext, K valid _t is the tampered key, C_W R _t is the tampered recovery bit column, C_W R _ut is the unmodified recovery bit column, K valid _ut is the untampered key, i is the ciphertext column number, ranging from 1 to z;

[0115] If the recovery position is C_W R When some bits (i.e., some columns) in the data are tampered, these tampered bit columns can be represented as C_W R _t, and then in order to recover these tampered bits, Gaussian-Jordan elimination can be used to solve the linear equations. The solution formula is:

[0116] C_W R _t{i}=K valid _t -1 ×(C_W C valid {i}-K valid _ut×C_W R _ut{i})

[0117] Where C_W c valid is the column of valid ciphertext, K valid _t is the tampered key, C_W R _t is the tampered recovery bit column, C_W R _ut is the unmodified recovery bit column, K valid _ut is the untampered key, and i is the ciphertext column number, ranging from 1 to z.

[0118] It is understandable that, in a specific implementation, after restoring all the columns, the restored W R The SPIHT decompression algorithm is applied to restore the parameters, and finally the restored parameters are scaled down by a factor of 100.

[0119] In addition, an embodiment of the present invention also proposes a computer-readable storage medium storing a computer program, wherein a model parameter protection program is stored on the storage medium, and when the model parameter protection program is executed by the processor, the steps of the artificial intelligence model parameter protection method described above are implemented.

[0120] Since the storage medium adopts all the technical solutions of all the above embodiments, it has at least all the beneficial effects brought about by the technical solutions of the above embodiments, which will not be described one by one here.

[0121] Reference Figure 5 , Figure 5 This is a structural block diagram of the first embodiment of the model parameter protection device of the present invention.

[0122] like Figure 5 As shown, the model parameter protection device proposed in the embodiment of the present invention includes:

[0123] Watermark generation module 10: generates a watermark based on the model parameter information to be protected to obtain a model parameter watermark;

[0124] Watermark embedding module 20: embeds the model parameter watermark into the model to be protected to obtain a watermark model;

[0125] Tamper detection module 30: obtains a watermark model to be detected, performs tamper detection on the watermark model to be detected, and obtains a model tamper detection result;

[0126] Tamper recovery module 40: If the model tampering detection result is that tampering has occurred, tamper recovery is performed on the tampered watermark model to obtain a watermark model.

[0127] This embodiment generates a watermark based on the parameter information of the model to be protected to obtain a model parameter watermark; embeds the model parameter watermark into the model to be protected to obtain a watermark model; obtains the watermark model to be detected, and performs tamper detection on the watermark model to be detected to obtain a model tamper detection result; if the model tamper detection result indicates that tampering has occurred, tamper recovery is performed on the tampered watermark model to obtain a watermark model. This embodiment first embeds the model parameter watermark generated based on the parameter information of the model to be protected into the model to be protected, then performs tamper detection on the obtained watermark model to be detected, and finally performs tamper recovery on the tampered watermark model, thereby achieving tamper detection and tamper recovery of the model parameters and improving the security and integrity of the model parameters.

[0128] It should be understood that the above is only an example and does not constitute any limitation to the technical solution of the present invention. In specific applications, those skilled in the art can make settings as needed, and the present invention does not impose any limitation on this.

[0129] It should be noted that the workflow described above is merely illustrative and does not limit the scope of protection of the present invention. In practical applications, technicians in this field can select part or all of it according to actual needs to achieve the purpose of the embodiment scheme, and no limitation is made here.

[0130] In addition, for technical details not fully described in this embodiment, please refer to the model parameter protection method provided in any embodiment of the present invention, and will not be repeated here.

[0131] In addition, it should be noted that, in this document, the terms "comprises," "includes," or any other variations thereof are intended to encompass non-exclusive inclusion, such that a process, method, article, or system comprising a series of elements includes not only those elements but also other elements not explicitly listed, or elements inherent to such process, method, article, or system. In the absence of further limitations, an element defined by the phrase "comprising a ..." does not exclude the presence of other identical elements in the process, method, article, or system comprising the element.

[0132] The serial numbers of the above embodiments of the present invention are for description only and do not represent the advantages or disadvantages of the embodiments.

[0133] Through the description of the above embodiments, those skilled in the art can clearly understand that the above-mentioned embodiment methods can be implemented by means of software plus the necessary general hardware platform, or of course by hardware, but in many cases the former is a better embodiment. Based on this understanding, the technical solution of the present invention, or the part that contributes to the prior art, can be embodied in the form of a software product. The computer software product is stored in a storage medium (such as a read-only memory (ROM) / RAM, a magnetic disk, or an optical disk), and includes a number of instructions for enabling a terminal device (which can be a mobile phone, a computer, a server, or a network device, etc.) to execute the methods described in each embodiment of the present invention.

[0134] The above are only preferred embodiments of the present invention and are not intended to limit the patent scope of the present invention. Any equivalent structure or equivalent process transformation made using the contents of the present invention description and drawings, or directly or indirectly applied in other related technical fields, are also included in the patent protection scope of the present invention.

Claims

1. A method for protecting artificial intelligence model parameters, characterized in that: include: Generate a watermark based on the parameter information of the model to be protected to obtain a model parameter watermark; Embedding the model parameter watermark into the model to be protected to obtain a watermark model; Obtaining a watermark model to be detected, and performing tamper detection on the watermark model to be detected to obtain a model tamper detection result; If the model tampering detection result indicates that tampering has occurred, the tampered watermark model is tampered recovered to obtain the watermark model; Generate a watermark based on the model parameter information to be protected to obtain a model parameter watermark, specifically including: Obtain parameter information of the model to be protected; Generate a watermark based on the parameter information of the model to be protected to obtain watermark recovery bit data; Performing data encryption based on the watermark recovery bit data to obtain a watermark ciphertext; Generating a verification probe based on the parameter information of the model to be protected to obtain a watermark verification probe; Integrating the watermark recovery bit data, the watermark ciphertext and the watermark verification probe to obtain the model parameter watermark; Obtaining a watermark model to be detected, and performing tamper detection on the watermark model to be detected to obtain a model tamper detection result, specifically including: Acquire a watermark model to be detected, and extract a verification probe from the watermark model to be detected to obtain an actual watermark verification probe; Acquiring model parameter information based on the watermark model to be detected to obtain the model parameter information to be detected; Generate a theoretical watermark based on the parameter information of the model to be detected to obtain a theoretical watermark verification probe; Performing tamper detection on the actual watermark verification probe and the theoretical watermark verification probe to obtain the model tamper detection result; If the model tampering detection result indicates that tampering has occurred, tamper recovery is performed on the tampered watermark model to obtain the watermark model, specifically including: If the model tampering detection result indicates that tampering has occurred, model parameters of the tampered watermark model are extracted to obtain a set of model parameters to be restored; Performing data purification on the set of model parameters to be restored to obtain a purified set of model parameters to be restored; Performing tampering identification on the purified set of model parameters to be restored to obtain a model parameter tampering identification result; The tampered watermark model is tampered recovered based on the model parameter tampering identification result to obtain the watermark model.

2. The artificial intelligence model parameter protection method according to claim 1, characterized in that: Generating a watermark based on the parameter information of the model to be protected to obtain watermark recovery bit data specifically includes: Reshape the model parameters based on the model parameter information to be protected to obtain the reshaped model parameters; performing data compression on the reshaped model parameters to obtain compressed model parameters; Format matching is performed on the compressed model parameters to obtain the watermark recovery bit data.

3. The artificial intelligence model parameter protection method according to claim 1, characterized in that: Data encryption is performed based on the watermark recovery bit data to obtain watermark ciphertext, specifically including: Performing group encryption on the watermark recovery bit data to obtain the watermark ciphertext; The encryption formula of the block encryption is: ； Where, is the recovery information after grouping, The watermark ciphertext information generated for each set of recovery information, is the group number corresponding to each group, is the key parameter.

4. The artificial intelligence model parameter protection method according to claim 1, characterized in that: Generating a verification probe based on the parameter information of the model to be protected to obtain a watermark verification probe specifically includes: Extracting data features based on the parameter information of the model to be protected, and obtaining parameter data feature sets; Inputting the parameter data feature set into a hash algorithm to generate a verification probe to obtain a hash probe; Obtaining matrix eigenvalues ​​based on the parameter data feature set, and generating eigenvalue probes according to the matrix eigenvalues; Obtaining a corresponding marker probe based on the parameter data feature set; The hash probe, the eigenvalue probe and the marker probe are integrated to obtain the watermark verification probe.

5. An artificial intelligence model parameter protection device, used to execute the artificial intelligence model parameter protection method according to any one of claims 1 to 4, characterized in that: The model parameter protection device includes: Watermark generation module: generates watermark based on the parameter information of the model to be protected to obtain the model parameter watermark; Watermark embedding module: embeds the model parameter watermark into the model to be protected to obtain a watermark model; Tamper detection module: obtains the watermark model to be detected, and performs tamper detection on the watermark model to be detected to obtain the model tamper detection result; Tamper recovery module: If the model tamper detection result is that tampering has occurred, tamper recovery is performed on the tampered watermark model to obtain the watermark model.

6. An artificial intelligence model parameter protection device, characterized in that: The model parameter protection device includes: a memory, a processor, and a model parameter protection program stored in the memory and capable of running on the processor, wherein the model parameter protection program is configured to implement the artificial intelligence model parameter protection method according to any one of claims 1 to 4.

7. A computer-readable storage medium storing a computer program, characterized in that: When the computer program is executed by a processor, it can implement the steps in the artificial intelligence model parameter protection method described in any one of claims 1 to 4.

Images