Neural network authentication method and device based on semi-fragile model watermark and medium

Abstract

The invention relates to a neural network authentication method and device based on a semi-fragile model watermark and a medium, and the method comprises the following steps: selecting images from a standard image library as semi-fragile samples, and meanwhile, selecting the same number of images as target label samples; keeping the neural network model unchanged, and adding disturbance to the semi-fragile sample; adjusting disturbance, reducing a difference value between a prediction probability of the neural network model on the semi-fragile sample and a prediction probability of the neural network model on the target sample until an output result of the neural network model on the semi-fragile sample is a label of the target sample, and generating a corresponding semi-fragile authentication sample; and testing the to-be-detected neural network model by using the semi-fragile authentication sample, and judging whether the to-be-detected neural network model is a benign modification model or a malicious tampering model according to an output result. Compared with the prior art, the method can realize function-level authentication, and has the advantages of robustness, safety and the like.

Description

Technical Field

[0001] The present invention relates to the field of data security, and in particular to a semi-fragile model watermark method, device and medium for resisting model tampering. Background Art

[0002] In recent years, with the rapid development of Internet technology, artificial intelligence technologies represented by neural networks have been widely used. Building an AI model with excellent performance requires a lot of resources. However, during use, AI models are easy to be stolen, tampered with, and sold. Therefore, how to protect the intellectual property rights of AI models has significant academic significance and industrial needs.

[0003] The authentication of neural network models should include two levels: full level and functional level. Although there are many neural network watermarking technologies for the authentication of neural network models, most of them focus on full-level authentication. In the prior art, the sensitive sample generation method realizes privacy protection verification by combining homomorphic encryption, and can verify the integrity of the model parameters outsourced to the server with high precision. The lossless fragile watermarking algorithm based on the trigger set trains the trigger image generator to make the trigger image continuously move closer to the decision boundary edge of the target model without retraining or any adjustment to the target model, thereby achieving lossless authentication.

[0004] In real-world applications, AI models are very vulnerable to data poisoning and backdoor attacks, which can seriously damage the performance of the model. Therefore, neural network watermarks need to be sensitive to similar attacks. However, neural network fine-tuning that can better suit the target task, pruning, quantization and other neural network modification methods used for neural network compression, need to have a certain resistance. We should pay more attention to and implement functional-level certification of neural network models. Summary of the invention

[0005] The purpose of the present invention is to provide a neural network authentication method, device and medium based on semi-fragile model watermark in order to overcome the defect of the above-mentioned prior art that lacks function-level authentication.

[0006] The purpose of the present invention can be achieved by the following technical solutions:

[0007] A neural network authentication method based on a semi-fragile model watermark comprises the following steps:

[0008] S1: Select a certain number of images from the standard image library as semi-fragile samples, and at the same time, select the same number of images as target label samples;

[0009] S2: Keep the neural network model unchanged and add perturbations to the semi-fragile samples;

[0010] S3: Adjust the disturbance to reduce the difference between the predicted probability of the neural network model for the semi-fragile sample and the predicted probability for the target sample, until the output result of the neural network model for the semi-fragile sample is the label of the target sample, and the corresponding semi-fragile authentication sample is generated;

[0011] S4: Use the semi-fragile authentication sample to test the neural network model to be tested, and determine whether the neural network model to be tested is a benign modification model or a malicious tampering model based on the output results.

[0012] Furthermore, the expression for adding disturbance is:

[0013] S'=S+η

[0014] Where S' represents the image after disturbance, S represents the image before disturbance, and η is the disturbance.

[0015] Further, step S3 includes the following steps:

[0016] S31: Input the perturbed image into the neural network model to obtain the predicted label result L and logits vector G;

[0017] S32: Use the predicted label result L and the logits vector G to adjust the perturbations in the semi-fragile authentication sample.

[0018] Furthermore, the expressions of the label result L and logits vector G are:

[0019] L(S')=argmax i M(S',θ);

[0020] G(S')=M(S',θ)

[0021] Where L(S') is the label result, G(S') is the logits vector G, θ is the neural network model parameter, and M is the neural network model.

[0022] Furthermore, the calculation expression of the adjustment process is:

[0023]

[0024] Where X is the target label sample, D1 is the cross entropy loss function, and D2 is the L2 norm.

[0025] Further, step S4 includes the following steps:

[0026] The semi-fragile authentication samples are input into the neural network model to be detected, and the proportion of samples that can be correctly output in the semi-fragile authentication samples is counted. According to whether the sample proportion index reaches the threshold, it is judged whether the neural network model to be detected is a benign modification model or a malicious tampering model.

[0027] Furthermore, the calculation expression of the sample proportion index is:

[0028]

[0029] In the formula, Acc is the sample proportion indicator, is the predicted label of the i-th sample, L i is the predefined label of the i-th sample, if The count function records 1, otherwise it records 0.

[0030] Furthermore, the threshold of the sample proportion index is 0.9. The neural network model whose sample proportion index is higher than the threshold is a benign modification model, and the neural network model whose sample proportion index is less than or equal to the threshold is a malicious tampering model.

[0031] The second aspect of the present invention is a neural network authentication device based on a semi-fragile model watermark, comprising a memory, a processor, and a program stored in the memory. When the processor executes the program, it implements any of the above neural network authentication methods based on a semi-fragile model watermark.

[0032] A third aspect of the present invention is a storage medium having a program stored thereon, which, when executed, implements any of the above neural network authentication methods based on semi-fragile model watermarks.

[0033] Compared with the prior art, the present invention has the following beneficial effects:

[0034] 1) The present invention adds disturbances, uses the prediction probability as a mandatory constraint, and outputs the modification of the label. The semi-fragile authentication samples obtained can accurately detect malicious tampering of the model. At the same time, the semi-fragile authentication samples are used as trigger sets for pre-defense strategies, which are difficult to detect and remove, and can reliably detect model tampering, protecting the neural network model without significantly affecting the prediction performance of the model.

[0035] 2) The present invention can support fine-tuning of the neural network and is suitable for benign modification operations such as pruning and quantization. At the same time, it can identify the impact of tampering methods such as backdoor attacks and data poisoning on the neural network. It is robust and secure at the same time. BRIEF DESCRIPTION OF THE DRAWINGS

[0036] Figure 1 It is a flow chart of the present invention.

[0037] Figure 2 A schematic diagram was generated for the semi-fragile sample of the present invention.

[0038] Figure 3 This is a schematic diagram of semi-fragile sample authentication according to the present invention.

[0039] Figure 4 This is a diagram showing the output results of the method of the present invention on different neural network operations. DETAILED DESCRIPTION

[0040] The present invention is described in detail below in conjunction with the accompanying drawings and specific embodiments. This embodiment is implemented based on the technical solution of the present invention, and provides a detailed implementation method and specific operation process, but the protection scope of the present invention is not limited to the following embodiments.

[0041] Example 1

[0042] The present invention is a neural network authentication method, device and medium based on semi-fragile model watermark, such as Figure 1 As shown, the method comprises the following steps:

[0043] S1: Select a certain number of images from the standard image library as semi-fragile samples, and at the same time, select the same number of images as target label samples;

[0044] In this embodiment, the standard image library is CIFAR10; 20 images in CIFAR10 are used as semi-fragile samples, and 20 samples with labels different from the semi-fragile samples are randomly selected as target label samples.

[0045] The number of semi-fragile certification samples selected can be set according to actual conditions.

[0046] S2: Keep the neural network model unchanged and add perturbations to the semi-fragile samples;

[0047] In order to verify the functional integrity of the neural network, the neural network model is not allowed to be modified. In the embodiment of the present invention, the semi-fragile authentication sample needs to be modified according to the output result of the model on the semi-fragile authentication sample. The main process is as follows:

[0048] For each semi-fragile sample, noise perturbation is added, and the expression for adding perturbation is:

[0049] S'=S+η

[0050] Where S' represents the image after disturbance, S represents the image before disturbance, and η is the disturbance;

[0051] S3: Adjust the disturbance to reduce the difference between the predicted probability of the neural network model for the semi-fragile sample and the predicted probability for the target sample, until the output result of the neural network model for the semi-fragile sample is the label of the target sample, and the corresponding semi-fragile authentication sample is generated;

[0052] S31: Input the perturbed image into the neural network model to obtain the predicted label result L and logits vector G; the expressions of the label result L and logits vector G are:

[0053] L(S')=argmax i M(S',θ);

[0054] G(S')=M(S',θ)

[0055] Where L(S') is the label result, G(S') is the logits vector G, θ is the neural network model parameter, and M is the neural network model;

[0056] S32: Use the predicted label result L and the logits vector G to adjust the disturbance in the semi-fragile authentication sample. The calculation expression of the adjustment process is:

[0057]

[0058] Where X is the target label sample, D1 is the cross entropy loss function, and D2 is the L2 norm.

[0059] like Figure 2 As shown, the generated semi-fragile authentication samples are robust to benign modifications and fragile to malicious tampering, and can be used for function-level authentication of neural network models.

[0060] S4: Use the semi-fragile authentication sample to test the neural network model to be tested, and determine whether the neural network model to be tested is a benign modification model or a malicious tampering model based on the output results.

[0061] like Figure 3 As shown in the figure, by comparing the output results of the semi-fragile authentication samples by the suspicious model with the predefined label results, it is possible to determine whether the neural network has been maliciously tampered with. The authentication index is defined as the proportion of samples with correct output in the semi-fragile authentication sample set. The calculation expression of the sample proportion index is:

[0062]

[0063] In the formula, Acc is the sample proportion indicator, is the predicted label of the i-th sample, L i is the predefined label of the i-th sample, if The count function records 1, otherwise it records 0.

[0064] In this embodiment, the authentication index is used as the functional level authentication index; the higher the Acc, the better the functional integrity of the neural network model. When Acc>0.9, it proves that the network model has not been maliciously tampered with.

[0065] Table 1 shows the authentication accuracy results on different neural network models provided by the embodiments of the present invention. Table 1 is to illustrate that the method is universal for different neural network models. That is, different neural network models are selected for experiments, but the number of selected semi-fragile authentication samples and target label samples is guaranteed to be consistent. The authentication results Acc are tested on neural network models that have undergone different types of modifications. The results show that the present invention has high authentication accuracy and universality, and can effectively perform functional-level authentication of various neural network models.

[0066] Table 1 Certification accuracy results on different neural network models

[0067]

[0068] Figure 4 Specific experimental results provided for the embodiments of the present invention. Different numbers of semi-fragile authentication samples were selected for the experiment, and the authentication results were compared with those of ordinary adversarial samples. 1 semi-fragile authentication sample / ordinary adversarial sample, 5 semi-fragile authentication samples / ordinary adversarial samples, 10 semi-fragile authentication samples / ordinary adversarial samples, 15 semi-fragile authentication samples / ordinary adversarial samples, and 20 semi-fragile authentication samples / ordinary adversarial samples were selected to obtain the authentication results Acc on the fine-tuning, pruning, quantization, backdoor attack, and data poisoning models. The results show that the present invention has a very high authentication accuracy, can effectively identify malicious tampering of the model, and complete the functional-level authentication of the neural network model.

[0069] The program code for implementing the method of the present invention can be written in any combination of one or more programming languages. These program codes can be provided to a processor or controller of a general-purpose computer, a special-purpose computer or other programmable data processing device, so that the program code, when executed by the processor or controller, enables the functions / operations specified in the flow chart and / or block diagram to be implemented. The program code can be executed entirely on the machine, partially on the machine, partially on the machine as a stand-alone software package and partially on a remote machine, or entirely on a remote machine or server.

[0070] In the context of the present invention, a machine-readable medium may be a tangible medium that may contain or store a program for use by or in conjunction with an instruction execution system, device, or equipment. A machine-readable medium may be a machine-readable signal medium or a machine-readable storage medium. A machine-readable medium may include, but is not limited to, electronic, magnetic, optical, electromagnetic, infrared, or semiconductor systems, devices, or equipment, or any suitable combination of the foregoing. A more specific example of a machine-readable storage medium may include an electrical connection based on one or more lines, a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the foregoing.

[0071] The preferred specific embodiments of the present invention are described in detail above. It should be understood that a person skilled in the art can make many modifications and changes based on the concept of the present invention without creative work. Therefore, any technical solution that can be obtained by a person skilled in the art through logical analysis, reasoning or limited experiments based on the concept of the present invention on the basis of the prior art should be within the scope of protection determined by the claims.

Claims

1. A neural network authentication method based on semi-fragile model watermark, characterized in that: The following steps are involved: S1: Select a certain number of images from the standard image library as semi-fragile samples, and at the same time, select the same number of images as target label samples; S2: Keep the neural network model unchanged and add perturbations to the semi-fragile samples; S3: Adjust the disturbance to reduce the difference between the predicted probability of the neural network model for the semi-fragile sample and the predicted probability for the target sample, until the output result of the neural network model for the semi-fragile sample is the label of the target sample, and the corresponding semi-fragile authentication sample is generated; S4: Use the semi-fragile authentication sample to test the neural network model to be tested, and determine whether the neural network model to be tested is a benign modification model or a malicious tampering model based on the output results.

2. According to claim 1, a neural network authentication method based on semi-fragile model watermark is characterized in that: The expression for adding disturbance is: S'=S+η Where S' represents the image after disturbance, S represents the image before disturbance, and η is the disturbance.

3. According to claim 1, a neural network authentication method based on semi-fragile model watermark is characterized in that: Step S3 includes the following steps: S31: Input the perturbed image into the neural network model to obtain the predicted label result L and logits vector G; S32: Use the predicted label result L and the logits vector G to adjust the perturbations in the semi-fragile authentication sample.

4. According to claim 3, a neural network authentication method based on semi-fragile model watermark is characterized in that: The expressions of the label result L and logits vector G are: L(S')=argmax i M(S',θ); G(S')=M(S',θ) Where L(S') is the label result, G(S') is the logits vector G, θ is the neural network model parameter, and M is the neural network model.

5. A neural network authentication method based on semi-fragile model watermark according to claim 4, characterized in that: The calculation expression of the adjustment process is: Where X is the target label sample, D1 is the cross entropy loss function, and D2 is the L2 norm.

6. A neural network authentication method based on semi-fragile model watermark according to claim 1, characterized in that: Step S4 includes the following steps: The semi-fragile authentication samples are input into the neural network model to be detected, and the proportion of samples that can be correctly output in the semi-fragile authentication samples is counted. According to whether the sample proportion index reaches the threshold, it is judged whether the neural network model to be detected is a benign modification model or a malicious tampering model.

7. A neural network authentication method based on semi-fragile model watermark according to claim 6, characterized in that: The calculation expression of the sample proportion index is: In the formula, Acc is the sample proportion indicator, is the predicted label of the i-th sample, L i is the predefined label of the i-th sample, if The count function records 1, otherwise it records 0.

8. A neural network authentication method based on semi-fragile model watermark according to claim 7, characterized in that: The threshold of the sample proportion index is 0.

9. The neural network model whose sample proportion index is higher than the threshold is a benign modification model, and the neural network model whose sample proportion index is less than or equal to the threshold is a malicious tampering model.

9. A neural network authentication device based on a semi-fragile model watermark, comprising a memory, a processor, and a program stored in the memory, characterized in that: When the processor executes the program, the neural network authentication method based on semi-fragile model watermark as described in any one of claims 1-8 is implemented.

10. A storage medium having a program stored thereon, characterized in that: When the program is executed, a neural network authentication method based on a semi-fragile model watermark as described in any one of claims 1 to 8 is implemented.

Images