Method for watermarking machine learning model

Abstract

A method for watermarking a machine learning model is provided. A bit sequence is generated. The bit sequence may be a text character divided into a number of tiles. A selected plurality of input samples from training data are divided into input sample subsets. All of the input samples in each of the subsets of input samples are tagged with a same first tag in a problem domain of an ML model. Each tile is combined with a subset of the marked subsets to produce a plurality of marked trigger samples. Each trigger sample of each of the plurality of sets is re-tagged to have a second tag different from the first tag and in the problem domain to produce a re-tagged set of trigger samples. The ML model is trained with the training data and the re-marked trigger sample to produce a watermarked ML model.

Description

Technical Field

[0001] The present disclosure relates generally to machine learning, and more particularly, to a method for watermarking a machine learning (ML) model. Background Art

[0002] More and more functions are being implemented via machine learning (ML). Some of the nice features of ML include flexibility, the ability to process large amounts of data, ease of customization, and the ability to solve problems that may be difficult to solve with non-machine learning algorithms. Machine learning models can be classified by how they are trained, such as supervised learning, unsupervised learning, semi-supervised learning, and reinforcement learning. In supervised learning, the ML model is trained using data that gives the desired output. This training data includes labels on each sample of the training data. For classification problems, the labels can be categories or classes. For regression problems, the labels can be values.

[0003] The effectiveness of an ML model is determined by, for example, its accuracy, execution time, storage requirements, and the quality (as well as quantity) of the training data. Access to specific training data can distinguish an ML model from other ML models and make the ML model a valuable asset. However, it has been shown that even when the ML model is securely stored, for example, in a server in the cloud or securely stored by having platform security, the ML model may still be vulnerable to attackers attempting to steal the ML model. For example, it has been shown that only black-box access to the input / output behavior of the ML model via the ML model's application programming interface (API) is sufficient to obtain a nearly exact copy or clone of the ML model. Once a copy of the machine learning model is obtained in this way, the adversary can cash in on the copy. Since the adversary does not have to invest in the development of the ML model, the adversary can do this at a much lower cost.

[0004] Watermarks are often used to mark and prove ownership of documents. Embedding a watermark into an ML model may require training the model with information about the watermark, which may change the model's functionality. Additionally, the watermark needs to be hidden from attackers. The watermark also needs to be detectable while being difficult to remove or modify when the ML model is copied. Effectively implementing solutions to these problems can be difficult and expensive.

[0005] Therefore, there is a need for a method to watermark ML models without at least some of the problems described above. Summary of the invention

[0006] According to an embodiment, a method for watermarking a machine learning model (ML) is provided, the method comprising: selecting a plurality of input samples from a training data set for embedding a watermark into the ML model; generating a bit sequence; dividing the bit sequence into a set of bit blocks; dividing the selected plurality of input samples into input sample subsets, wherein all of the input samples in each subset of the input sample subsets are labeled with the same first label in the problem domain of the ML model; combining each block in the set of blocks with a subset in the labeled input sample subsets to generate a plurality of labeled trigger samples; re-labeling each trigger sample in each set of the plurality of labeled trigger sample sets to have a second label different from the first label and in the problem domain of the ML model to generate a re-labeled trigger sample set; and training the ML model using the labeled training input sample set and the re-labeled trigger sample set to generate a watermarked ML model. The bit sequence may be determined based on a text character sequence. The text character sequence may include at least 100 text characters. The ML model may include a neural network. The method may further include applying a reversible affine mapping function from a first vector space to a second vector space to the labeled input sample subset before the combining of each block in the set of blocks with the subset in the labeled input sample subset. The method may further include applying an inverse of the reversible affine mapping function to the relabeled trigger sample set before the training of the ML model using the labeled training input sample set and the relabeled trigger sample set. Combining each block in the set of blocks with the subset in the labeled input sample subset may further include creating a labeled trigger sample, wherein the labeled trigger sample includes a first portion of entries and a second portion of entries, wherein the first portion of entries may include blocks in the set of blocks, and wherein at least one of the second portion of entries may be filled with samples of a subset of the labeled input sample subset, and all other entries of the second portion may be set to zero. The bit sequence is determined from a text character sequence, wherein each text character block is created by establishing an interval between a lower limit and an upper limit to encode a character of an alphabet, and wherein the lower limit and upper limit of the interval are determined by a series of equally spaced values ​​of the plurality of input samples, and each character has an assigned position in the interval. The re-labeling of each of the trigger samples may include shuffling the first label between each of the plurality of labeled trigger sample sets. The labeled ML training sample set may include sensor data collected from a plurality of sensors.

[0007] In another embodiment, a computer program stored on a non-transitory medium is provided, the computer program comprising executable instructions that, when executed by a processor, provide watermarking for a machine learning (ML) model, the instructions comprising: instructions for selecting a plurality of input samples for training the ML model; instructions for generating a bit sequence; instructions for partitioning the bit sequence into a set of chunks of bits; instructions for partitioning the selected plurality of input samples into input sample subsets, wherein all of the input samples in each of the input sample subsets are labeled with the same first label in a problem domain of the ML model; instructions for combining each chunk in the set of chunks with a subset in the labeled input sample subsets to generate a plurality of labeled triggering samples; instructions for re-labeling each triggering sample in each of the plurality of labeled triggering sample sets to have a second label different from the first label and in the problem domain of the ML model to generate a re-labeled triggering sample set; and instructions for training the ML model using the labeled training input sample set and the re-labeled triggering sample set to generate a watermarked ML model. The bit sequence may be determined based on a text character sequence. The text character sequence may include at least 100 characters. The ML model may include a neural network for analyzing sensor data. The computer program may also include instructions for applying a reversible affine mapping of the labeled input sample subset from a first vector space to a second vector space before the combination of each block in the block set with a subset in the labeled input sample subset. The computer program may also include instructions for applying the inverse of the reversible affine mapping of the relabeled trigger sample set before the training of the ML model using the labeled training input sample set and the relabeled trigger sample set. The instructions for combining each text character block in the block set with a subset in the labeled input sample subset may also include instructions for creating a labeled trigger sample, wherein the labeled trigger sample includes a first part entry and a second part entry, wherein the first part entry includes a text character block in the block set, and wherein at least one entry in the second part entry is filled with samples of a subset of the labeled input sample subset, and all other entries in the second part are set to zero. The ML model also includes a dropout layer. Each text character block may be created by establishing an interval between a lower limit and an upper limit to encode characters of an alphabet, wherein the lower limit and the upper limit of the interval are determined by a series of equally spaced values ​​of the plurality of input samples, and each character has an assigned position in the interval. The instructions for re-labeling each of the trigger samples include shuffling the first label between each of the plurality of labeled trigger sample sets. The labeled ML training sample set includes sensor data collected from a plurality of sensors. BRIEF DESCRIPTION OF THE DRAWINGS

[0008] The present invention is illustrated by way of example and not limitation in the accompanying drawings, in which like reference numerals indicate like elements. The elements in the drawings are illustrated for simplicity and clarity and are not necessarily drawn to scale.

[0009] Figure 1 A simplified system for watermarking an ML model according to an embodiment is shown.

[0010] Figure 2 A method for creating a trigger sample according to an embodiment is shown.

[0011] Figure 3 A method for combining text character chunks with input samples according to an embodiment is shown.

[0012] Figure 4 A flow chart showing a method for watermarking an ML model according to an embodiment is shown.

[0013] Figure 5 Shown in more detail Figure 4 Flowchart of a portion of a method.

[0014] Figure 6 The present invention is suitable for implementing Figure 1 system's processor.

[0015] Figure 7 An example encoding of a plurality of text characters according to an embodiment is shown. DETAILED DESCRIPTION

[0016] In general, a method for watermarking an ML model is provided. A watermark is embedded in the model by training the ML model using a trigger sample created from a plurality of labeled training input samples using supervised learning, the plurality of labeled training input samples being a small portion of the training data used to train the ML model. The label may be a class in the case of a classification problem, or a value in the case of a regression problem. The training data may include, for example, sensor data from a plurality of sensors. In one embodiment, a plurality of trigger samples are created using a bit sequence. In one example, the bit sequence is determined based on a sequence of text characters. The text characters are independent of the problem domain of the training data. The sequence of text characters may be derived from a phrase such as a poem. In another embodiment, any plurality of text characters may be used to generate a watermark. The plurality of text characters are then divided into a set of text character chunks, each chunk having an equal number of text characters. In addition, a plurality of labeled input samples are selected from the training data. The plurality of labeled input samples are divided into labeled input sample subsets. The number of labeled input sample subsets corresponds to the number of chunks. All labeled input samples having the same first label in each subset of the labeled input sample subsets are selected for training the ML model in the problem domain. These labels are the same for each sample of the subset, but different between subsets. In one embodiment, there may be more blocks than labels. In this case, labels can be reused. That is, different blocks may have the same label. Each text character block in the block set is combined with each sample of the subset in the labeled input sample subset to produce a plurality of labeled trigger samples. Each trigger sample of each set in the plurality of labeled trigger sample sets is relabeled to have a second label different from the first label but still in the problem domain of the ML model to produce a relabeled trigger sample set. In one embodiment, before combining the blocks and the training data subset, the input sample is transformed from the first vector space to the second vector space using a reversible affine function. After the combination, the trigger sample is transformed back to the first vector space. The ML model is trained using the labeled training data and the relabeled trigger sample set to produce a watermarked ML model. After training, the trained ML model will provide a predetermined output with high confidence in response to receiving the trigger sample. Another ML model copied from the ML model will also likely provide an expected output in response to the received trigger sample. If most or all of the trigger samples produce the expected output in the other model, then it can be assumed that the other ML model is replicated. Training ML models with multiple trigger samples helps prevent erroneous conclusions about replication.

[0017] In one embodiment, the ML model is based on a neural network (NN) algorithm. In other embodiments, the ML model may be different. For example, the ML model may be a support vector machine (SVM) or a Bayesian classifier. The watermarking method is applicable to both visual and non-visual problems. Examples of non-visual problems may be based on, for example, sensor data or audio. The watermark may be verified even when only the input and output of the model are accessed.

[0018] Figure 1 A system 10 for watermarking an ML model 20 according to an embodiment is shown. The system 10 includes a labeled ML training data set 12, a training data subset preparation block 14, a watermark training subset 16, a model training block 18, and a resulting watermarked ML model 20. One example embodiment includes a neural network (NN) algorithm trained to classify sensor data or audio using the training data set 12 and the watermark training subset 16. Depending on the problem to be solved by the trained ML model 20, the sensor data may come from multiple sensors for sensing, for example, temperature, acceleration, signal strength, decibels (dB), frequency, etc. Another embodiment may train on visual training data such as images or videos. The ML model is trained using training data 12 including multiple classifications or categories. The NN algorithm of the ML model 20 is trained in the model training 18 so that during inference operations, input data from, for example, multiple sensors is correctly analyzed by the trained ML model 20. In the case of a suspected copy of the ML model 20, trigger data may be provided to the input of the suspected copy. If the suspected duplicate provides the expected output classification, then replication of the ML model 20 may be assumed. In one embodiment, the system 10 is implemented as a computer program stored on a non-transitory medium including instructions executable by a processor.

[0019] Figure 2A method 30 for creating trigger samples for training an ML model according to an embodiment is shown. As an example, the method for creating trigger samples will be discussed in the context of an ML model that is trained to determine from which of 18 rooms on a floor of a building a device is sending a signal. The device may be, for example, an RFID tag attached to an object. Other embodiments may use, for example, a WiFi or ultra-wideband (UWB) device. The RFID tag has a transmitter for sending a signal. There are 24 antennas distributed around the floor, and at least one of the 24 antennas is present in each of the 18 rooms. In another embodiment, there may be 3 antenna positions on the floor, wherein each antenna position includes 8 antennas. Other embodiments may use different settings for the number of antennas and antenna positions. Each of the 24 antennas may have a sensor configured to receive a signal from the RFID tag and calculate a signal characteristic such as signal strength. Using the received signal strength from each of the 24 antennas, the ML model is trained to determine the location of the device. For discussion purposes, it is desirable to determine that watermarking the ML model using a trigger input according to an embodiment is desirable.

[0020] In one embodiment, the device location is determined using a NN having an input layer with 24 nodes (one node for each antenna signal), 3 hidden layers of 192 nodes each, and an output layer of 18 nodes (one node for each output class (room)). In one embodiment, a dropout layer with a dropout ratio of 45% may be added after the first and second hidden layers. In other embodiments, the dropout ratio may be different, or the dropout layer may be excluded. Additional layers typically present in NNs, such as pooling layers and flattening layers, may be included. In an example implementation, to train this NN, a training set of 15,528 samples is compiled. Each sample in the training set is labeled by one of the 18 room numbers. Using the 15,528 labeled samples as input to the training NN, the NN learns a model for predicting which space a new sample belongs to for the new sample. Each training sample may be represented by an array y=(S1, S2, ..., S 24 ) is limited, where S i is the signal strength received by one of the antennas. For each of the antennas, the lower and upper limits of the signal strength can be given by l i 、u i As an example, each signal strength in the training set will have a value from l i =0 to u i =10 signal strength range.

[0021] First, a sequence of text characters 31 is derived from a text, such as a text string C. The text may include creative elements. For example, the first 112 characters of the famous Old Dutch poem "jantje zag eens pruimen hangen o alseieren zo groot t scheen dat jantje wou gaan plukken schoon zijn vader t he". It has been determined that the best results can be obtained using at least 100 text characters. In other embodiments, the number of text characters may be between 100 and 150. In another embodiment, there may be a different number of text characters. The text string C is divided into k = 7 text blocks c1, c2, ..., c7 of equal size from the poem, so that each block includes 112 / 7 = 16 characters. Blocks 1 to k are in Figure 2 32. In another embodiment, the text character sequence 31 may originate from elsewhere.

[0022] The 16 characters of the block are embedded into a 24-dimensional input sample vector with 24 entries from the training sample subset 33, for a basis different from the base of the ML model. As an example, a random reversible 24×24 matrix M has the property that the first 16 columns only include non-negative entries. To transpose the training sample subset 33, an affine function A is defined as A(z)=M·z. Therefore, the inverse of the affine function A transforms the sample from the standard basis of the model to the new basis. In Figure 3 The transpose is shown in . Note that the addition term in the affine function A of the random matrix M is set to 0. The text block from block 32 is embedded into a 24-dimensional vector The first 16 entries of . Note that the hat (^) on the variable name indicates that the variable is defined for a different basis (with the hat) than the standard basis (without the hat). This vector via The signal strength vector x with antenna values ​​having indices 1-24 = (S1, S2, ..., S 24 Applying the discussed affine function makes it more difficult for a copier to identify whether certain inputs are triggering inputs, and thus makes the watermarking scheme more secure.

[0023] To create trigger samples, the text blocks are embedded into a 24-entry training sample vector corresponding to the antenna signal strength values ​​of the 24 antennas. By using linear programming and making the first 16 columns of the matrix M only include non-negative entries, the lower limit value L and the upper limit value U with the following properties are derived. Making the last 8 entries equal to zero makes the trigger sample vector And each signal strength vector Between low signal strength L and high signal strength U, and Each signal strength S j Comply with the boundary value l i 、u i That is, for the standard basis, l i ≤S j ≤u i , where j is a selected signal strength value in the signal strength values. The values ​​L and U are derived so that if each of the first 16 vector entries remains between L and U in the new basis, then the vector obtained by returning to the standard basis complies with l i ≤S j ≤u i Similarly, the L and U bounds can be derived where the last 8 entries are not necessarily zero but are taken from a set of non-zero values.

[0024] To encode text characters, let Λ be an alphabet consisting of the 26 lowercase letters 'a' to 'z' plus spaces. In another embodiment, the numbers 0 to 9 and / or uppercase letters may be included. It should be noted that in this example, block C only includes characters from the alphabet Λ. The characters in the alphabet Λ can be encoded using signal strength values ​​in the interval [L, U] by encoding the letter 'a' as L, encoding the space as U, and encoding the other 25 characters as 25 equally spaced values ​​between L and U. That is, the encoding function enc is defined as follows

[0025] enc('a')=L

[0026]

[0027] …

[0028]

[0029] enc(”)=U

[0030] Figure 7 An example encoding of characters between the boundaries L and U is shown in FIG. Using the above encoding function, the trigger sample vector Chunking of text in c i 16 characters of c i,1 、c i,2 ,…,c i,16 By limiting Encode, where like Figure 3 As shown in 8 values is a non-text character value that can be arbitrarily selected or set to zero, as shown above. In one embodiment, one of the non-text character values ​​is set to The value of the corresponding entry in is a training sample in the new base, and the other 7 The value is set to zero (0). Trigger Sample Vector Set 35 is defined as a set of input training samples in different bases, where the trigger sample vector Collection and text chunking c i Associated. Take the trigger sample vector where for all j, Where j is equal to 8 in the described example, the trigger sample vector is set 35 only a single element Given a trigger sample vector Set, trigger sample vector V i The set is defined as contain A collection of .

[0031] Initially, it is used to create a trigger sample vector set V i The training samples 33 are labeled by class labels 34. For the example provided, there are 18 classes, one for each room. The number of chunks is equal to 7, and therefore there are also 7 subsets of trigger samples. If two trigger samples are from the same subset, this means that the two training samples embedded in it also have the same label. Each subset has a different label, but all labels are in the problem domain in which the ML model is being trained. In one embodiment, if there are more chunks than classes, labels can be reused. Figure 2 As shown in , subset 1 of training samples 33 has label "class 1". Subset 2 of training samples 33 has label "class 2". Subset k of training samples 33 has label "class 3". As shown, each subset 33 is combined with a chunk of the text character sequence. For example, chunk 1 in chunk 32 is combined with subset 1 in subset 33 to produce trigger sample 1 in the relabeled trigger samples. As shown, trigger sample 35 is then relabeled 36 with class labels in the problem domain of the ML model. In another embodiment, the labels on training samples 33 may be removed before being combined with chunk 32 to produce trigger sample 35. In Figure 2 In the example, the label is changed from the original trigger sample to a different trigger sample. In other embodiments, any of the class labels of the problem domain can be used for re-labeling. Together, the re-labeled trigger samples 35 form a trigger sample set 37, which can be used to Figure 1 As shown in , the watermark is embedded into the ML model by training the ML model with a trigger sample set and a training data set.

[0032] Figure 31 shows a method for combining text character blocks with input samples according to an embodiment. The left side of the vertical dashed line includes a subset of training vectors in the standard basis of the ML model. That is, the training sample vector y of class i+1 = (y1, y2, ..., y 24 ) and the trigger sample vector x of class i = (S1, S2, …, S 24 ) in the standard basis. The trigger sample vector x = (S1, S2, ..., S 24 ) is the trigger sample vector after transformation back to the standard basis It should be noted that the samples S1, S2, ..., S associated with the trigger sample x 24 Instead of real sensor signal samples, they are created using text character blocks. The right side of the vertical dashed line includes a subset of training samples at a basis different from the standard basis. and trigger sample vector Trigger Sample Vector By block and input sample subset The bitstream is formed by combining the input samples of The signal lower and upper limits and As defined above.

[0033] In this example, the trigger sample vector With the training sample subset By triggering the sample collection The last 8 items in One of them is composed of the training sample set That is, for the selected l=1,2,…,8, one of the latter entries If in the training set subset and for a fixed l, this is done for m samples, where m is the number of trigger samples per text block, this results in a set of trigger sample vectors consisting of m samples And thus also generates a trigger sample set V consisting of m samples i .

[0034] A class label is applied to each trigger sample. In this embodiment, class i is associated with room i. In one embodiment, the trigger samples are re-labeled to the previous class / room, e.g. Figure 2 That is, room i+1 becomes room i (e.g., room 2 becomes room 1, room 3 becomes room 2, and so on). In another embodiment, the trigger samples may be relabeled in a different manner. and trigger sample x∈V i They are related to each other by the basis transpose defined by the affine function A. Triggering samples The new basis of is only used to create the trigger sample x. In one embodiment, the trigger sample Depends on the source from different trigger samples x∈V i The class label of the class of the problem domain data. For example, the trigger sample Combined with training sample 33 having label 34. After block 32 is combined with training sample 33, combination 35 is as follows Figure 2 The training set is relabeled from class i+1 as shown in relabeling 36 in FIG. In one embodiment, the labels of the training samples used to create the triggering samples are removed and new labels different from the labels used for the training samples are assigned. This subset of the training set is denoted as T i+1 In addition, by reversing the affine function A -1 Applied to a subset T from the training set i+1 The sample set obtained by all samples of

[0035] As indicated above, linear programming can be used to derive the sample The bounds L and U of the first 16 entries of , such that the corresponding sample x = All entries in respect to the sensor boundary value l i 、u i In one embodiment, the bounds L and U are derived such that for A sufficient number of choices, among which The bounds are valid bounds where for j≠i, To build a trigger set V i , select from samples that respect the sensor boundary l i 、u i of the sample.

[0036] After completion, the marked trigger sample set V i Added to the labeled training set. Using this extended training set for training the ML model results in a model with an embedded watermark function that is i The trigger sample x is taken as input and the label i is returned, where the trigger sample x comes from the text block c i The probability that independently trained machine learning models will have this same embedded watermark feature is negligible.

[0037] Figure 4A flow chart of a method 40 for watermarking an ML model according to an embodiment is shown. The ML model may be trained on a set of non-visual input samples, such as sensor data or audio data. The method 40 starts at box 41. At box 41, a bit string is created. The bit string may be created using a text string, which is then encoded using a series of values ​​derived from lower and upper bounds of the input sample. At box 42, the bit string is divided into a plurality of text chunks. In one embodiment, all chunks have an equal number of text characters. At box 43, a reversible affine function is generated. At box 44, a subset of samples to be watermarked is selected from the problem domain of the ML model. At box 45, the sample subset is marked as having a new label from the problem domain class that is different from the label that the sample subset has. At box 46, a set of labeled trigger samples is generated from the chunks and the trigger sample subset. Figure 5 Additional details of how trigger samples may be generated are provided in . At box 47, the labeled trigger samples are added to the training data set used to train the ML model. At box 48, the ML model is trained using the training data set and the labeled trigger samples. The result of the training is that the ML model is trained to classify input samples in the problem domain. In addition, the ML model is trained to exhibit specific behavior when provided with the trigger samples created above (without labels). Copies of the ML model will also replicate the specific behavior, so that when provided with the same trigger signal, the behavior of the copy will be similar to the trained ML model, thereby providing evidence of replication.

[0038] Figure 5 Shown in more detail Figure 4 Flowchart of block 46 of method 40. At block 51, the reversible affine function A -1 Applied to the subset of sample vectors that will be used to create trigger samples. Affine function A -1 The sample vector subset is transformed from a standard basis to a basis different from the standard basis. Each sample vector in the sample vector subset is multi-dimensional. For example, in the example, for each sample vector having an index value between 1 and 24, the sample vector is 24-dimensional to include 24 signal strength values. At block 52, the sample vectors are One of is selected from the training data set that will occupy the corresponding position in the trigger sample. At box 53, the text character is encoded using a range of possible signal strength values ​​from a lower limit L to an upper limit U. At box 54, for each sample in the selected sample subset from the problem domain (in Figure 4 The value at the selected index is combined with the encoded character value to obtain a trigger sample. At box 55, the affine function A is applied to the trigger sample to transform the trigger sample back to the standard basis. After box 55, the method returns to Figure 4 47 in the box.

[0039] Figure 6 The method for implementing the embodiment is shown Figure 1 The data processing system 70 of the system. The data processing system 70 can be implemented on one or more integrated circuits and can be used to implement the described embodiments. The data processing system 70 includes a bus 72. Connected to the bus 72 are one or more processor cores 74, a memory 76, an ML model 78, an instruction memory 80, and an interface 82. The one or more processor cores 74 may include any hardware device capable of executing instructions stored in the memory 76 or the instruction memory 80. For example, the processor core 74 may execute a machine learning algorithm for training and operating an ML model. The processor core 74 may be, for example, a microprocessor, a field programmable gate array (FPGA), an application specific integrated circuit (ASIC), or a similar device. The processor core 74 may be implemented in a secure hardware element and may be tamper-proof.

[0040] Memory 76 may be any kind of memory, such as an L1, L2, or L3 cache or system memory. Memory 76 may include volatile memory, such as static random access memory (SRAM) or dynamic RAM (DRAM), or may include non-volatile memory, such as flash memory, read-only memory (ROM), or other volatile or non-volatile memory. In addition, memory 76 may be implemented in a secure hardware element. Alternatively, memory 76 may be a hard drive implemented external to data processing system 70. In one embodiment, memory 76 is used to store the weight matrix of ML model 78.

[0041] The machine learning model 78 may be embedded in the data processing system 70 and may include a plurality of instructions stored in a memory, such as the memory 76. In another embodiment, the ML model 78 may be stored on a server in the cloud. In one embodiment, the ML model 78 may include, for example, a neural network. Other embodiments may include, for example, support vector machines, decision trees, and regression models.

[0042] Instruction memory 80 may include one or more machine-readable storage media for storing instructions for execution by processor core 74. In other embodiments, memories 76 and 80 may each store data that processor core 74 may operate on. Memories 76 and 80 may also store, for example, encryption, decryption, authentication, and verification applications. Memories 76 and 80 may be implemented in secure hardware elements and may be tamper-resistant.

[0043] The interface 82 may be connected to one or more devices for implementing communication with other systems. For example, the interface 82 may include or be coupled to a network interface card (NIC) configured to communicate according to the Ethernet protocol. In addition, the interface 82 may implement a TCP / IP stack for communicating according to the TCP / IP protocol. Data samples for classification may be input via the interface 82 or a similar interface. Various other hardware or configurations for communication may be obtained.

[0044] Various embodiments or portions of embodiments may be implemented in hardware or as instructions on a non-transitory machine-readable storage medium, which includes any mechanism for storing information in a form readable by a machine, such as a personal computer, laptop, file server, smart phone, or other computing device. Non-transitory machine-readable storage media may include volatile and non-volatile memory, such as read-only memory (ROM), random access memory (RAM), magnetic disk storage media, optical storage media, flash memory, etc. Non-transitory machine-readable storage media do not include transitory signals.

[0045] Although the present invention is described herein with reference to specific embodiments, various modifications and changes may be made without departing from the scope of the present invention as set forth in the appended claims. Therefore, the specification and drawings should be viewed in an illustrative rather than a restrictive sense, and all such modifications are intended to be included within the scope of the present invention. It is not intended that any benefit, advantage, or solution to a problem described herein with respect to a specific embodiment be construed as a key, essential, or requisite feature or element of any or all claims.

[0046] Furthermore, as used herein, the terms "a" and "an" are defined as one or more than one. In addition, the use of introductory phrases such as "at least one" and "one or more" in the claims should not be interpreted as implying that another claim element introduced by the indefinite article "a" limits any particular claim containing the claim element so introduced to an invention containing only one such element, even when the same claim includes the introductory phrases "one or more" or "at least one" and an indefinite article such as "an". The same applies to the use of definite articles.

[0047] Unless otherwise stated, terms such as "first" and "second" are used to arbitrarily distinguish between the elements such terms describe. Therefore, these terms are not necessarily intended to indicate temporal or other prioritization of such elements.

Claims

1. A method for watermarking a machine learning model ML, characterized in that: The method comprises: Selecting a plurality of input samples from a training data set for embedding a watermark into the ML model; generating a bit sequence; Dividing the bit sequence into a set of blocks of bits; Dividing the selected plurality of input samples into input sample subsets, wherein all the input samples in each of the input sample subsets are labeled with the same first label in the problem domain of the ML model; combining each chunk in the set of chunks with a subset of the labeled input sample subsets to generate a plurality of labeled trigger samples; re-labeling each triggering sample of each set of a plurality of labeled triggering sample sets to have a second label different from the first label and in the problem domain of the ML model to generate a re-labeled triggering sample set; and The ML model is trained using the labeled training input sample set and the re-labeled trigger sample set to generate a watermarked ML model.

2. The method according to claim 1, characterized in that Also includes: Prior to said combining of each block in said set of blocks with a subset of said labeled input sample subsets, a reversible affine mapping function from a first vector space to a second vector space is applied to said labeled input sample subsets.

3. The method according to claim 2, characterized in that It also includes applying an inverse of the reversible affine mapping function to the relabeled trigger sample set before performing the training of the ML model using the labeled training input sample set and the relabeled trigger sample set.

4. The method according to claim 1, characterized in that Combining each chunk in the set of chunks with a subset of the marked input sample subsets further comprises creating a marked trigger sample, wherein the marked trigger sample comprises a first portion of entries and a second portion of entries, wherein the first portion of entries comprises chunks in the set of chunks, and wherein at least one entry in the second portion of entries is filled with samples of a subset of the marked input sample subsets and all other entries of the second portion are set to zero.

5. The method according to claim 1, characterized in that: The bit sequence is determined based on a text character sequence, wherein each text character block is created by establishing an interval between a lower limit and an upper limit to encode a character of an alphabet, and wherein the lower limit and upper limit of the interval are determined by a series of equally spaced values ​​of the plurality of input samples, and each character has an assigned position in the interval.

6. A computer program stored on a non-transitory medium, characterized in that The computer program comprises executable instructions which, when executed by a processor, provide watermarking for a machine learning (ML) model, the instructions comprising: Instructions for selecting a plurality of input samples for training the ML model; Instructions for generating bit sequences; instructions for dividing the bit sequence into a set of blocks of bits; instructions for partitioning a selected plurality of input samples into input sample subsets, wherein all of the input samples in each of the input sample subsets are labeled with a same first label in a problem domain of the ML model; instructions for combining each chunk in the set of chunks with a subset of the subset of labeled input samples to produce a plurality of labeled trigger samples; Instructions for re-labeling each triggering sample of each set of a plurality of labeled triggering sample sets to have a second label different from the first label and in the problem domain of the ML model to generate a re-labeled triggering sample set; and Instructions for training the ML model using the labeled set of training input samples and the re-labeled set of triggering samples to produce a watermarked ML model.

7. The computer program according to claim 6, characterized in that Also includes: Instructions for applying a reversible affine mapping of the labeled subset of input samples from a first vector space to a second vector space prior to the combining of each tile in the set of tiles with a subset of the labeled subset of input samples.

8. The computer program according to claim 7, characterized in that Also included are instructions for applying an inverse of the reversible affine mapping of the relabeled set of triggering samples prior to the training of the ML model using the labeled set of training input samples and the relabeled set of triggering samples.

9. The computer program according to claim 6, characterized in that The instructions for combining each text character block in the block set with a subset of the marked input sample subset also include instructions for creating a marked trigger sample, wherein the marked trigger sample includes a first part of entries and a second part of entries, wherein the first part entries include text character blocks in the block set, and wherein at least one entry in the second part of entries is filled with samples of a subset of the marked input sample subset, and all other entries in the second part are set to zero.

10. The computer program according to claim 6, characterized in that Each text character block is created by establishing an interval between a lower limit and an upper limit to encode characters of the alphabet, wherein the lower and upper limits of the interval are determined by a series of equally spaced values ​​of the plurality of input samples, and each character has an assigned position in the interval.

Images