Model encryption method, device and equipment and computer readable storage medium

Abstract

The invention discloses a model encryption method, apparatus and device, and a computer readable storage medium. The method comprises the steps of obtaining a data set corresponding to a to-be-learned task; determining a newly added network based on the multilayer neural network and the to-be-trained model, and performing model training on the data set based on the newly added network to obtain a target model and a training result; determining a trigger set based on the training result and the data set; and performing model training on the target model based on the trigger set to obtain a watermark model corresponding to the target model, and returning to execute the step of sequentially obtaining the current to-be-learned task in the plurality of tasks of model learning until the model learning of all the tasks is completed. According to the method, model training is carried out on the currently trained model through the trigger set, and the watermark model of the current training task realizes that a watermark technology is used in a continuous learning model trained by batch data, and intellectual property protection is carried out on the updated version of the model.

Description

Technical Field

[0001] The present application relates to the field of data processing technology, and in particular to a model encryption method, device, equipment and computer-readable storage medium. Background Art

[0002] In the related technologies, the mainstream methods of model copyright protection technology are divided into black box model watermark technology, white box model watermark technology and black box and white box combined model watermark technology. Black box model technology does not need to understand the internal structure of the model. This method uses the output results obtained through specific inputs to implant and extract watermarks, such as constructing a specific trigger set; white box model watermark technology is a method that understands the internal information of the model, such as model parameters, and needs to operate based on the internal information of the model during the implantation or extraction of watermarks; black box and white box combined technology is a method that knows the internal information of the model and combines specific inputs and outputs to implant or extract watermarks.

[0003] However, the above-mentioned model copyright protection technology cannot be used in continuous learning models trained with batch data. Therefore, how to use watermark technology in continuous learning models trained with batch data is a problem that needs to be solved urgently. Summary of the invention

[0004] The main purpose of this application is to provide a model encryption method, device, equipment and computer-readable storage medium, aiming to solve the technical problem of how to use watermark technology in a continuous learning model trained with batch data.

[0005] To achieve the above objectives, the present application provides a model encryption method, comprising:

[0006] Sequentially obtain the current task to be learned from multiple tasks of the learning model, and obtain the data set corresponding to the task to be learned;

[0007] Determine a new network based on the multi-layer neural network and the model to be trained, and perform model training on the data set based on the new network to obtain the target model and training results;

[0008] Determining a trigger set based on the training result and the data set;

[0009] Model training is performed on the target model based on the trigger set to obtain a watermark model corresponding to the target model, and the step of sequentially obtaining the current task to be learned in multiple tasks of model learning is returned to be executed until the model learning of all tasks is completed.

[0010] Further, the determining a trigger set based on the training result and the data set includes:

[0011] Based on the training result and the data set, determining the accuracy of each first data in the data set;

[0012] Based on the accuracy, low-accuracy data in the data set is determined, and the trigger set is determined based on the low-accuracy data.

[0013] Further, the determining the trigger set based on the low-accuracy data includes:

[0014] Based on the training result, obtaining the prediction confidence of each label corresponding to each second data in the low-accuracy data;

[0015] Based on the prediction confidence, the trigger set is determined in the low accuracy data.

[0016] Further, the determining the trigger set in the low-accuracy data based on the prediction confidence includes:

[0017] Sequentially traverse the second data in the low-accuracy data, and determine the maximum confidence and the second largest confidence corresponding to the currently traversed second data based on the prediction confidence;

[0018] Based on the maximum confidence and the second maximum confidence, it is determined whether to add the second data currently traversed to the trigger set until the traversal of the second data in the low-accuracy data is completed.

[0019] Further, the determining whether to add the second data currently traversed to the trigger set based on the maximum confidence and the second maximum confidence includes:

[0020] Obtaining a confidence difference between the maximum confidence and the second maximum confidence;

[0021] If the confidence difference is less than a preset threshold, the label of the second data currently traversed is updated to the label corresponding to the second largest confidence, target trigger data is obtained, and the target trigger data is added to the trigger set.

[0022] Furthermore, the determining of a new network based on the multi-layer neural network and the model to be trained includes:

[0023] If the task to be learned is the first task among multiple tasks, the multi-layer neural network is used as the newly added network;

[0024] If the task to be learned is not the first task among multiple tasks, the newly added network is determined based on the trained network and the multi-layer neural network in the model to be trained.

[0025] Furthermore, the method further comprises:

[0026] Obtain the trigger set corresponding to each task, and obtain the watermark verification error rate threshold corresponding to each trigger set;

[0027] Input each trigger set into the model to be verified to perform model testing and obtain the test error result;

[0028] Compare each test error result with the corresponding watermark verification error rate threshold to determine whether there is a target test error result that is less than the corresponding watermark verification error rate threshold;

[0029] If there is an error result of the target test, it is determined that the model to be verified is the watermark model corresponding to the error result of the target test.

[0030] In addition, to achieve the above-mentioned purpose, the present application also provides a model encryption device, the model encryption device comprising:

[0031] An acquisition module is used to sequentially acquire the current task to be learned from multiple tasks of the learning model, and acquire the data set corresponding to the task to be learned;

[0032] The first training module is used to determine a new network based on the multi-layer neural network and the model to be trained, and perform model training on the data set based on the new network to obtain a target model and training results;

[0033] A determination module, configured to determine a trigger set based on the training result and the data set;

[0034] The second training module is used to perform model training on the target model based on the trigger set, obtain the watermark model corresponding to the target model, and return to execute the step of sequentially obtaining the current task to be learned in multiple tasks of model learning until the model learning of all tasks is completed.

[0035] In addition, to achieve the above-mentioned purpose, the present application also provides a model encryption device, which includes: a memory, a processor, and a model encryption program stored in the memory and executable on the processor, and the model encryption program implements the steps of the aforementioned model encryption method when executed by the processor.

[0036] In addition, to achieve the above-mentioned purpose, the present application also provides a computer-readable storage medium, on which a model encryption program is stored, and when the model encryption program is executed by a processor, the steps of the aforementioned model encryption method are implemented.

[0037] The present application sequentially obtains the current task to be learned from multiple tasks of the learning model, and obtains the data set corresponding to the task to be learned; then determines a new network based on the multi-layer neural network and the model to be trained, and performs model training on the data set based on the new network to obtain the target model and the training result, and then determines a trigger set based on the training result and the data set; then performs model training on the target model based on the trigger set to obtain the watermark model corresponding to the target model, and returns to execute the step of sequentially obtaining the current task to be learned from multiple tasks of model learning until the model learning of all tasks is completed, determines the trigger set through the training results and training data of each training task in batch data training, performs model training on the currently trained model through the trigger set, and uses the watermark model of the current training task to implement the use of watermark technology in the continuous learning model of batch data training, and provides intellectual property protection for the updated version of the model. BRIEF DESCRIPTION OF THE DRAWINGS

[0038] The accompanying drawings, which are incorporated in and constitute a part of this specification, illustrate embodiments consistent with the present application and, together with the description, serve to explain the principles of the present application.

[0039] In order to more clearly illustrate the embodiments of the present application or the technical solutions in the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, for ordinary technicians in this field, other drawings can be obtained based on these drawings without paying any creative labor.

[0040] Figure 1 A schematic diagram of a flow chart provided for the first embodiment of the model encryption method of the present application;

[0041] Figure 2 This is a schematic diagram of a scenario of model verification in an embodiment of the model encryption method of this application;

[0042] Figure 3 This is a schematic diagram of the module structure of the model encryption device according to an embodiment of the present application;

[0043] Figure 4 This is a schematic diagram of the module structure of the model encryption device of the embodiment of the present application.

[0044] The realization of the purpose, functional features and advantages of this application will be further explained in conjunction with embodiments and with reference to the accompanying drawings. DETAILED DESCRIPTION

[0045] It should be understood that the specific embodiments described herein are only used to explain the present application and are not used to limit the present application.

[0046] In order to better understand the technical solution of the present application, a detailed description will be given below in conjunction with the accompanying drawings and specific implementation methods.

[0047] The main solution of the present application is: obtaining the current task to be learned in multiple tasks of the learning model in sequence, and obtaining the data set corresponding to the task to be learned; determining a new network based on the multi-layer neural network and the model to be trained, and performing model training on the data set based on the new network to obtain the target model and the training results, and determining a trigger set based on the training results and the data set; performing model training on the target model based on the trigger set to obtain the watermark model corresponding to the target model, and returning to execute the step of obtaining the current task to be learned in multiple tasks of model learning in sequence until the model learning of all tasks is completed.

[0048] At present, in the related technologies, the mainstream methods of model copyright protection technology are divided into black box model watermark technology, white box model watermark technology and black box and white box combined model watermark technology. Black box model technology does not need to understand the internal structure of the model. This method uses the output results obtained through specific inputs to implant and extract watermarks, such as constructing a specific trigger set; white box model watermark technology is a method that understands the internal information of the model, such as model parameters, and needs to operate based on the internal information of the model during the implantation or extraction of watermarks; black box and white box combined technology is a method that knows the internal information of the model and combines specific inputs and outputs to implant or extract watermarks.

[0049] However, the above-mentioned model copyright protection technology cannot be used in continuous learning models trained with batch data. Therefore, how to use watermark technology in continuous learning models trained with batch data is a problem that needs to be solved urgently.

[0050] This application determines the trigger set through the training results and training data of each training task in batch data training, and uses the trigger set to train the current training model and the watermark model of the current training task, so as to realize the use of watermark technology in the continuous learning model of batch data training and provide intellectual property protection for the updated version of the model.

[0051] It should be noted that the execution subject of this embodiment can be a model encryption device, or a computing service device with data processing, network communication and program running functions, such as a tablet computer, a personal computer, a mobile phone, etc., or a model encryption device capable of realizing the above functions, etc., and this embodiment does not specifically limit this. The following takes the model encryption device as the execution subject as an example to illustrate this embodiment and the following embodiments.

[0052] Based on this, this application proposes a model encryption method of the first embodiment, please refer to Figure 1The model encryption method includes steps S101 to S104:

[0053] Step S101, sequentially obtaining a current task to be learned from multiple tasks of the learning model, and obtaining a data set corresponding to the task to be learned;

[0054] In this embodiment, the continuous learning model includes multiple tasks, such as Task1, Task2, ...Task N N tasks, the data sets of each task are D1, D2, ...D N .

[0055] In the continuous learning process, determine the current task to be learned in turn. i , and obtain the data set D corresponding to the task to be learned i , the dataset length of the dataset is |D i |=L i , the number of labels is n i , if it is the first initial task, i=1.

[0056] Step S102, determining a new network based on the multi-layer neural network and the model to be trained, and performing model training on the data set based on the new network to obtain a target model and training results;

[0057] In this embodiment, a multi-layer neural network is constructed, and a new network is determined based on the multi-layer neural network and the model to be trained. Further, in a feasible implementation, step S102 may include steps S1021 to S1022:

[0058] Step S1021, if the task to be learned is the first task among multiple tasks, the multi-layer neural network is used as the newly added network;

[0059] Step S1022: If the task to be learned is not the first task among multiple tasks, the newly added network is determined based on the trained network and the multi-layer neural network in the model to be trained.

[0060] In this embodiment, if the task to be learned is the first task among multiple tasks, that is, i=1, the multilayer neural network is used as the newly added network; if the task to be learned is not the first task among multiple tasks, that is, i≠1, the newly added network is determined based on the trained network and the multilayer neural network in the model to be trained, that is, the trained network and the multilayer neural network in the model to be trained corresponding to the task before the task to be learned are connected to obtain the newly added network, and the specific formula is:

[0061]

[0062] Among them, hi (k) is the output of the i-th network on the k-th column of the newly added network, W i (k) ∈R ni×ni-1 is the weight of the i-th network on the k-th column (k represents the k-th task), U i (k:j) ∈R ni×nj is the weight of the i-1th lateral connection from the jth column. f represents a nonlinear element, f(x) = max(0, x), h i-1 (k) is the output of the i-1th network on the kth column.

[0063] After the new network is determined, the data set is trained based on the new network to obtain the target model and training results. During the training process, according to the output formula of the new network, each layer of the neural network adds the input of the corresponding layer of the neural network processed by the above formula in addition to the original input.

[0064] Step S103, determining a trigger set based on the training result and the data set;

[0065] In this embodiment, after obtaining the target model and the training results, the trigger set is determined based on the target model and the training results. Specifically, based on the training results and the data set, the accuracy of each first data in the data set is determined, that is, the accuracy of each first data in the data set is determined according to the training result of each first data and the label of each first data in the data set, and the low-accuracy data in the data set is determined according to the accuracy, wherein the label of the low-accuracy data is less than 50% of the number of all labels corresponding to the data set. For example, the accuracy of each first data is sorted, and the top 30% to 50% of the low accuracy of the sorted results are selected. Of course, for binary classification tasks, the category data with the highest error rate is selected.

[0066] A trigger set is determined based on the low-accuracy data. Specifically, according to the prediction confidence of each second data corresponding to each label in the low-accuracy data, the label of each second data is updated to obtain the trigger set.

[0067] Step S104, performing model training on the target model based on the trigger set, obtaining a watermark model corresponding to the target model, and returning to the step of sequentially obtaining the current task to be learned in multiple tasks of model learning until the model learning of all tasks is completed.

[0068] In this embodiment, after obtaining the trigger set, the target model is trained based on the trigger set to obtain the watermark model corresponding to the target model, and the process returns to step S101 to obtain the target model and watermark model corresponding to each task. Each task corresponds to a model version with a watermark (watermark model). Copyright protection and version control can be performed based on the watermark models trained at each stage in the learning model, so as to facilitate model copyright protection for the phased versions of the learning model.

[0069] It should be noted that the learning model of this embodiment may be a continuous learning model or a progressive learning model.

[0070] The model encryption method proposed in this embodiment obtains the current task to be learned in multiple tasks of the learning model in sequence, and obtains the data set corresponding to the task to be learned; then determines a new network based on the multi-layer neural network and the model to be trained, and performs model training on the data set based on the new network to obtain the target model and the training result, and then determines a trigger set based on the training result and the data set; then performs model training on the target model based on the trigger set to obtain the watermark model corresponding to the target model, and returns to execute the step of sequentially obtaining the current task to be learned in multiple tasks of model learning until the model learning of all tasks is completed, determines the trigger set through the training results and training data of each training task in batch data training, performs model training on the currently trained model through the trigger set, and uses the watermark model of the current training task to realize the use of watermark technology in the continuous learning model of batch data training to protect the intellectual property rights of the updated version of the model.

[0071] At the same time, copyright protection and version control can be performed based on the watermark model trained at each stage in the learning model, so as to facilitate model copyright protection for the phased version of the learning model.

[0072] In a feasible implementation, step S103 may include steps S1031 to S1032:

[0073] Step S1031, determining the accuracy of each first data in the data set based on the training result and the data set;

[0074] Step S1032: determining low-accuracy data in the data set based on the accuracy, and determining the trigger set based on the low-accuracy data.

[0075] In this embodiment, after obtaining the target model and training results, the accuracy of each first data in the data set is determined based on the training results and the data set, that is, the accuracy of each first data in the data set is determined according to the training results of each first data and the label of each first data in the data set.

[0076] After obtaining the accuracy of each first data, the low-accuracy data in the data set is determined according to the accuracy, wherein the label of the low-accuracy data is less than 50% of all the labels corresponding to the data set. For example, the accuracy of each first data is sorted, and the top 30% to 50% of the low accuracy of the sorting results are selected. Of course, for the binary classification task, the category data with the highest error rate is selected.

[0077] After acquiring each low-accuracy data, a trigger set is determined based on the low-accuracy data. Specifically, according to the prediction confidence of each second data corresponding to each label in the low-accuracy data, the label of each second data is updated to obtain the trigger set. Specifically, in a feasible implementation, step S1032 may include steps a to b:

[0078] Step a, based on the training result, obtaining the prediction confidence of each label corresponding to each second data in the low-accuracy data;

[0079] Step b: determining the trigger set in the low-accuracy data based on the prediction confidence.

[0080] In this embodiment, after obtaining each low-accuracy data, based on the training result, the prediction confidence of each second data corresponding to each label in the low-accuracy data is obtained to form a prediction confidence space. For example, the prediction confidence space is:

[0081]

[0082] in, For L i The prediction confidence between the second data and the nth label.

[0083] After the prediction confidence is obtained, a trigger set is determined in the low-accuracy data based on the prediction confidence. Specifically, in a feasible implementation, step b may include steps b1 to b2:

[0084] Step b1, sequentially traversing the second data in the low-accuracy data, and determining the maximum confidence and the second largest confidence corresponding to the currently traversed second data based on the prediction confidence;

[0085] Step b2, based on the maximum confidence and the second maximum confidence, determine whether to add the second data currently traversed to the trigger set until the traversal of the second data in the low-accuracy data is completed.

[0086] In this embodiment, the second data in the low-accuracy data are traversed in sequence, and based on the prediction confidence, the maximum confidence and the second largest confidence corresponding to the currently traversed second data are determined. For example, for the i-th second data, its maximum confidence is p ij And the second largest confidence level is p ik , p ij is the prediction confidence between the i-th second data and the j-th label, p ik is the prediction confidence between the i-th second data and the k-th label.

[0087] After obtaining the maximum confidence and the second maximum confidence, based on the maximum confidence and the second maximum confidence, it is determined whether to add the second data currently traversed to the trigger set. In a feasible implementation, step b2 may include steps b21 to b22:

[0088] Step b21, obtaining a confidence difference between the maximum confidence and the second maximum confidence;

[0089] Step b22: if the confidence difference is less than a preset threshold, the label of the second data currently traversed is updated to the label corresponding to the second largest confidence, target trigger data is obtained, and the target trigger data is added to the trigger set.

[0090] In this embodiment, after obtaining the maximum confidence and the second largest confidence, the confidence difference between the maximum confidence and the second largest confidence is calculated, and the confidence difference = p ij -p ik .

[0091] When the confidence difference is obtained, the preset threshold corresponding to the second data currently traversed is obtained, wherein the preset threshold of each first data in the data set is preset, and it is determined whether the confidence difference is less than the preset threshold. If the confidence difference is less than the preset threshold, the label of the second data currently traversed is updated to the label corresponding to the second largest confidence, and the target trigger data is obtained. For example, the maximum confidence is p ij And the second largest confidence level is p ik , when the confidence difference is less than the preset threshold, the label of the second data currently traversed is replaced with the label with the second largest confidence p ik The corresponding label (k) is obtained, and the target trigger data obtained after updating the label is added to the trigger set. Of course, if the confidence difference is greater than or equal to the preset threshold, the second data currently traversed is not added to the trigger set, and then the process returns to execute step b1 until the traversal of the second data in the low-accuracy data is completed and the trigger set is obtained.

[0092] Since the difference between the sample confidences is less than the preset value, the decision boundary of the model for the sample is more blurred, and the label of the sample is changed from the label with the highest confidence to the label with the second highest confidence. The selected sample is a category data set with a lower classification accuracy. Therefore, the trigger set obtained in this step may improve the prediction accuracy of certain samples by changing it to the label with the second highest confidence, and reduce the interference of the model learning the trigger set on the classification function of the original network when the watermark is subsequently embedded.

[0093] The model encryption method proposed in this embodiment determines the accuracy of each first data in the data set based on the training results and the data set; then determines the low-accuracy data in the data set based on the accuracy, and determines the trigger set based on the low-accuracy data. The model itself is used to filter the category data with a higher classification error rate in the original data set and then the trigger set is formed after the label is changed, so that the watermark can be implanted through the trigger set, thereby realizing the use of watermark technology in the continuous learning model of batch data training and protecting the intellectual property rights of the updated version of the model.

[0094] In a feasible implementation manner, the model encryption method may further include steps S201 to S204:

[0095] Step S201, obtaining a trigger set corresponding to each task, and obtaining a watermark verification error rate threshold corresponding to each trigger set;

[0096] Step S202, inputting each trigger set into the model to be verified to perform model testing and obtain a test error result;

[0097] Step S203, comparing each test error result with the corresponding watermark verification error rate threshold, to determine whether there is a target test error result that is less than the corresponding watermark verification error rate threshold;

[0098] Step S204: if there is an error result of the target test, determine that the model to be verified is the watermark model corresponding to the error result of the target test.

[0099] It should be noted that each task based on the continuous learning of the progressive network has its own network structure. Therefore, when predicting each task data set, it is necessary to provide a clear task id and call different network structures for different task ids. The task id corresponding to the validation data set used can be manually labeled, and different model modules can be called according to the task id.

[0100] In this embodiment, before performing model verification, the watermark verification error rate threshold corresponding to each trigger set is pre-set. In the process of obtaining the watermark model of each task, the trigger set corresponding to each task is also obtained. When performing model verification, the trigger set corresponding to each task is obtained, and the watermark verification error rate threshold corresponding to each trigger set is obtained.

[0101] After the trigger set is obtained, each trigger set is input into the model to be verified for model testing to obtain the test error result corresponding to each trigger set. Each test error result is compared with the corresponding watermark verification error rate threshold to determine whether there is a target test error result less than the corresponding watermark verification error rate threshold. Specifically, for each trigger set, the test error result of the trigger set is compared with the watermark verification error rate threshold to determine whether the test error result of the trigger set is less than the watermark verification error rate threshold. If so, the test error result corresponding to the trigger set is the target test error result.

[0102] If there is an error result of the target test, the model to be verified is determined to be the watermark model corresponding to the error result of the target test, such as Figure 2 shown.

[0103] The model encryption method proposed in this embodiment obtains the trigger set corresponding to each task and the watermark verification error rate threshold corresponding to each trigger set; then each trigger set is input into the model to be verified for model testing to obtain a test error result; then each test error result is compared with the corresponding watermark verification error rate threshold to determine whether there is a target test error result less than the corresponding watermark verification error rate threshold; then if the target test error result exists, the model to be verified is determined to be the watermark model corresponding to the target test error result, and model verification is performed according to the trigger set, which can accurately identify whether the model to be verified matches the watermark model, thereby realizing intellectual property protection for the updated version of the model.

[0104] The present application also provides a model encryption device, please refer to Figure 3 , the model encryption device comprises:

[0105] An acquisition module 10 is used to sequentially acquire a current task to be learned from multiple tasks of the learning model, and acquire a data set corresponding to the task to be learned;

[0106] A first training module 20 is used to determine a new network based on the multi-layer neural network and the model to be trained, and perform model training on the data set based on the new network to obtain a target model and training results;

[0107] A determination module 30, configured to determine a trigger set based on the training result and the data set;

[0108] The second training module 40 is used to perform model training on the target model based on the trigger set, obtain the watermark model corresponding to the target model, and return to execute the step of sequentially obtaining the current task to be learned in multiple tasks of model learning until the model learning of all tasks is completed.

[0109] The model encryption device provided in the embodiment of the present application adopts the model encryption method in the above embodiment, which can solve the technical problem of how to use watermark technology in the continuous learning model of batch data training. Compared with the prior art, the beneficial effects of the model encryption device provided in the embodiment of the present application are the same as the beneficial effects of the model encryption method provided in the above embodiment, and the other technical features in the model encryption device are the same as the features disclosed in the above embodiment method, which will not be repeated here.

[0110] The present application provides a model encryption device, which includes: at least one processor; and a memory communicatively connected to the at least one processor; wherein the memory stores instructions executable by the at least one processor, and the instructions are executed by the at least one processor so that the at least one processor can execute the model encryption method in the above-mentioned embodiment 1.

[0111] Reference below Figure 4 , which shows a schematic diagram of the structure of a model encryption device suitable for implementing the embodiment of the present application. The model encryption device in the embodiment of the present application may include but is not limited to mobile terminals such as mobile phones, laptop computers, digital broadcast receivers, PDAs (Personal Digital Assistants), PADs (Portable Application Descriptions), PMPs (Portable Media Players), vehicle-mounted terminals (such as vehicle-mounted navigation terminals), etc., and fixed terminals such as digital TVs, desktop computers, etc. Figure 4 The model encryption device shown is merely an example and should not bring any limitation to the functions and scope of use of the embodiments of the present application.

[0112] like Figure 4As shown, the model encryption device may include a processing device 1001 (e.g., a central processing unit, a graphics processor, etc.), which can perform various appropriate actions and processes according to a program stored in a read-only memory (ROM: Read Only Memory) 1002 or a program loaded from a storage device 1003 to a random access memory (RAM: Random Access Memory) 1004. In RAM1004, various programs and data required for the operation of the model encryption device are also stored. The processing device 1001, ROM1002, and RAM1004 are connected to each other through a bus 1005. An input / output (I / O) interface 1006 is also connected to the bus. Generally, the following systems can be connected to the I / O interface 1006: an input device 1007 including, for example, a touch screen, a touch pad, a keyboard, a mouse, an image sensor, a microphone, an accelerometer, a gyroscope, etc.; an output device 1008 including, for example, a liquid crystal display (LCD: Liquid Crystal Display), a speaker, a vibrator, etc.; a storage device 1003 including, for example, a magnetic tape, a hard disk, etc.; and a communication device 1009. The communication device 1009 can allow the model encryption device to communicate with other devices wirelessly or by wire to exchange data. Although the figure shows a model encryption device with various systems, it should be understood that it is not required to implement or have all the systems shown. More or fewer systems can be implemented or have alternatively.

[0113] In particular, according to the embodiments disclosed in the present application, the process described above with reference to the flowchart can be implemented as a computer software program. For example, the embodiments disclosed in the present application include a computer program product, which includes a computer program carried on a computer-readable medium, and the computer program includes a program code for executing the method shown in the flowchart. In such an embodiment, the computer program can be downloaded and installed from a network through a communication device, or installed from a storage device 1003, or installed from a ROM 1002. When the computer program is executed by the processing device 1001, the above-mentioned functions defined in the method of the embodiment disclosed in the present application are executed.

[0114] The model encryption device provided by the present application adopts the model encryption method in the above embodiment, which can solve the technical problem of how to use watermark technology in the continuous learning model of batch data training. Compared with the prior art, the beneficial effects of the model encryption device provided by the present application are the same as the beneficial effects of the model encryption method provided by the above embodiment, and the other technical features in the model encryption device are the same as the features disclosed in the method of the previous embodiment, which will not be repeated here.

[0115] It should be understood that the various parts disclosed in this application can be implemented by hardware, software, firmware or a combination thereof. In the description of the above embodiments, specific features, structures, materials or characteristics can be combined in any one or more embodiments or examples in a suitable manner.

[0116] The above is only a specific implementation of the present application, but the protection scope of the present application is not limited thereto. Any person skilled in the art who is familiar with the present technical field can easily think of changes or substitutions within the technical scope disclosed in the present application, which should be included in the protection scope of the present application. Therefore, the protection scope of the present application should be based on the protection scope of the claims.

[0117] The present application provides a computer-readable storage medium having computer-readable program instructions (ie, computer programs) stored thereon, and the computer-readable program instructions are used to execute the model encryption method in the above-mentioned embodiment.

[0118] The computer-readable storage medium provided in the present application may be, for example, a USB flash drive, but is not limited to electrical, magnetic, optical, electromagnetic, infrared, or semiconductor systems, systems or devices, or any combination of the above. More specific examples of computer-readable storage media may include, but are not limited to: an electrical connection with one or more wires, a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the above. In this embodiment, the computer-readable storage medium may be any tangible medium containing or storing a program that can be used by or in combination with an instruction execution system, system or device. The program code contained on the computer-readable storage medium may be transmitted using any appropriate medium, including but not limited to: wires, optical cables, RF (Radio Frequency), etc., or any suitable combination of the above.

[0119] The computer-readable storage medium may be included in the model encryption device; or may exist independently without being assembled into the model encryption device.

[0120] The above-mentioned computer-readable storage medium carries one or more programs. When the above-mentioned one or more programs are executed by the model encryption device, the model encryption device: sequentially obtains the current task to be learned from multiple tasks of the learning model, and obtains the data set corresponding to the task to be learned; determines a new network based on the multi-layer neural network and the model to be trained, and performs model training on the data set based on the new network to obtain a target model and training results; determines a trigger set based on the training results and the data set; performs model training on the target model based on the trigger set to obtain a watermark model corresponding to the target model, and returns to the step of sequentially obtaining the current task to be learned from multiple tasks of model learning until the model learning of all tasks is completed.

[0121] Computer program code for performing the operations of the present application may be written in one or more programming languages ​​or a combination thereof, including object-oriented programming languages ​​such as Java, Smalltalk, C++, and conventional procedural programming languages ​​such as "C" or similar programming languages. The program code may be executed entirely on the user's computer, partially on the user's computer, as a separate software package, partially on the user's computer and partially on a remote computer, or entirely on a remote computer or server. In the case of a remote computer, the remote computer may be connected to the user's computer through any type of network, including a local area network (LAN) or a wide area network (WAN), or may be connected to an external computer (e.g., via the Internet using an Internet service provider).

[0122] The flow chart and block diagram in the accompanying drawings illustrate the possible architecture, function and operation of the system, method and computer program product according to various embodiments of the present application. In this regard, each square box in the flow chart or block diagram can represent a module, a program segment or a part of a code, and the module, the program segment or a part of the code contains one or more executable instructions for realizing the specified logical function. It should also be noted that in some alternative implementations, the functions marked in the square box can also occur in a sequence different from that marked in the accompanying drawings. For example, two square boxes represented in succession can actually be executed substantially in parallel, and they can sometimes be executed in the opposite order, depending on the functions involved. It should also be noted that each square box in the block diagram and / or flow chart, and the combination of the square boxes in the block diagram and / or flow chart can be implemented with a dedicated hardware-based system that performs a specified function or operation, or can be implemented with a combination of dedicated hardware and computer instructions.

[0123] The modules involved in the embodiments described in this application may be implemented by software or hardware, wherein the name of the module does not constitute a limitation on the unit itself in some cases.

[0124] The readable storage medium provided in this application is a computer-readable storage medium, which stores computer-readable program instructions (i.e., computer programs) for executing the above-mentioned model encryption method, and can solve the technical problem of how to use watermark technology in a continuous learning model trained with batch data. Compared with the prior art, the beneficial effects of the computer-readable storage medium provided in this application are the same as the beneficial effects of the model encryption method provided in the above-mentioned embodiment, and will not be repeated here.

[0125] An embodiment of the present application provides a computer program product, including a computer program, which implements the steps of the above-mentioned model encryption method when executed by a processor.

[0126] The computer program product provided in this application can solve the technical problem of how to use watermark technology in a continuous learning model trained with batch data. Compared with the prior art, the beneficial effects of the computer program product provided in the embodiment of this application are the same as the beneficial effects of the model encryption method provided in the above embodiment, which will not be repeated here.

[0127] The above are only preferred embodiments of the present application, and are not intended to limit the patent scope of the present application. Any equivalent structure or equivalent process transformation made using the contents of the present application specification and drawings, or directly or indirectly applied in other related technical fields, are also included in the patent protection scope of the present application.

Claims

1. A model encryption method, characterized in that: include: Sequentially obtain the current task to be learned from multiple tasks of the learning model, and obtain the data set corresponding to the task to be learned; Determine a new network based on the multi-layer neural network and the model to be trained, and perform model training on the data set based on the new network to obtain the target model and training results; Determining a trigger set based on the training result and the data set; Model training is performed on the target model based on the trigger set to obtain a watermark model corresponding to the target model, and the step of sequentially obtaining the current task to be learned in multiple tasks of model learning is returned to be executed until the model learning of all tasks is completed.

2. The model encryption method according to claim 1, characterized in that: The determining a trigger set based on the training result and the data set includes: Based on the training result and the data set, determining the accuracy of each first data in the data set; Based on the accuracy, low-accuracy data in the data set is determined, and the trigger set is determined based on the low-accuracy data.

3. The model encryption method according to claim 2, characterized in that: The determining the trigger set based on the low-accuracy data comprises: Based on the training result, obtaining the prediction confidence of each label corresponding to each second data in the low-accuracy data; Based on the prediction confidence, the trigger set is determined in the low accuracy data.

4. The model encryption method according to claim 3, characterized in that: The determining the trigger set in the low-accuracy data based on the prediction confidence comprises: Sequentially traverse the second data in the low-accuracy data, and determine the maximum confidence and the second largest confidence corresponding to the currently traversed second data based on the prediction confidence; Based on the maximum confidence and the second maximum confidence, it is determined whether to add the second data currently traversed to the trigger set until the traversal of the second data in the low-accuracy data is completed.

5. The model encryption method according to claim 4, characterized in that: The determining whether to add the second data currently traversed to the trigger set based on the maximum confidence and the second maximum confidence includes: Obtaining a confidence difference between the maximum confidence and the second maximum confidence; If the confidence difference is less than a preset threshold, the label of the second data currently traversed is updated to the label corresponding to the second largest confidence, target trigger data is obtained, and the target trigger data is added to the trigger set.

6. The model encryption method according to claim 1, characterized in that: The determining of a new network based on a multi-layer neural network and a model to be trained includes: If the task to be learned is the first task among multiple tasks, the multi-layer neural network is used as the newly added network; If the task to be learned is not the first task among multiple tasks, the newly added network is determined based on the trained network and the multi-layer neural network in the model to be trained.

7. The model encryption method according to any one of claims 1 to 6, characterized in that: The method further comprises: Obtain the trigger set corresponding to each task, and obtain the watermark verification error rate threshold corresponding to each trigger set; Input each trigger set into the model to be verified to perform model testing and obtain the test error result; Compare each test error result with the corresponding watermark verification error rate threshold to determine whether there is a target test error result that is less than the corresponding watermark verification error rate threshold; If there is an error result of the target test, it is determined that the model to be verified is the watermark model corresponding to the error result of the target test.

8. A model encryption device, characterized in that: The model encryption device comprises: An acquisition module is used to sequentially acquire the current task to be learned from multiple tasks of the learning model, and acquire the data set corresponding to the task to be learned; The first training module is used to determine a new network based on the multi-layer neural network and the model to be trained, and perform model training on the data set based on the new network to obtain a target model and training results; A determination module, configured to determine a trigger set based on the training result and the data set; The second training module is used to perform model training on the target model based on the trigger set, obtain the watermark model corresponding to the target model, and return to execute the step of sequentially obtaining the current task to be learned in multiple tasks of model learning until the model learning of all tasks is completed.

9. A model encryption device, characterized in that: The model encryption device comprises: a memory, a processor, and a model encryption program stored in the memory and executable on the processor. When the model encryption program is executed by the processor, the steps of the model encryption method according to any one of claims 1 to 7 are implemented.

10. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores a model encryption program, and when the model encryption program is executed by a processor, the steps of the model encryption method according to any one of claims 1 to 7 are implemented.

Images