Model encryption method, apparatus, device, and computer readable storage medium

Abstract

The application discloses a model encryption method and device, equipment and a computer readable storage medium, the method comprising: obtaining a data set corresponding to a to-be-learned task; determining an added network based on a multi-layer neural network and a to-be-trained model, and performing model training on the data set based on the added network to obtain a target model and a training result; determining a trigger set based on the training result and the data set; performing model training on the target model based on the trigger set to obtain a watermark model corresponding to the target model, and returning to the step of sequentially obtaining a current to-be-learned task in multiple tasks of model learning until model learning of all tasks is completed. The application performs model training on the current trained model through the trigger set, and the watermark model of the current training task, so that the watermark technology is used in the continuous learning model of batch data training, and the intellectual property right of the updated version of the model is protected.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of data processing, and particularly relates to a model encryption method and device, equipment and a computer readable storage medium. BACKGROUND

[0002] In related technologies, mainstream methods of model copyright protection technology are divided into black-box model watermarking technology, white-box model watermarking technology and black-box white-box combined model watermarking technology. The black-box model technology does not need to understand the internal structure of the model. This method implants and extracts watermark through the output result obtained by specific input, such as constructing a specific trigger set. The white-box model watermarking technology is a method that needs to operate based on the internal information of the model, such as model parameters, in the process of implanting or extracting watermark. The black-box white-box combined technology is a method that implants or extracts watermark by combining specific input and output while knowing the internal information of the model.

[0003] However, the above-mentioned model copyright protection technology cannot be used for the continuous learning model of batch data training. Therefore, how to use watermarking technology in the continuous learning model of batch data training is a problem that needs to be solved at present. SUMMARY

[0004] The main purpose of the present application is to provide a model encryption method, device, equipment and computer readable storage medium, aiming at solving the technical problem of how to use watermarking technology in the continuous learning model of batch data training.

[0005] To achieve the above-mentioned purpose, the present application provides a model encryption method, comprising:

[0006] sequentially obtaining a current to-be-learned task in a plurality of tasks of a learning model, and obtaining a data set corresponding to the to-be-learned task;

[0007] determining a new network based on a multi-layer neural network and a to-be-trained model, and performing model training on the data set based on the new network to obtain a target model and a training result;

[0008] determining a trigger set based on the training result and the data set;

[0009] performing model training on the target model based on the trigger set to obtain a watermarking model corresponding to the target model, and returning to the step of sequentially obtaining a current to-be-learned task in a plurality of tasks of a model learning until the model learning of all tasks is completed.

[0010] Further, the step of determining a trigger set based on the training result and the data set comprises:

[0011] Based on the training results and the dataset, determine the accuracy of each first data point in the dataset;

[0012] Based on the accuracy, low-accuracy data in the dataset are identified, and the trigger set is determined based on the low-accuracy data.

[0013] Further, determining the trigger set based on the low-accuracy data includes:

[0014] Based on the training results, the prediction confidence of each label corresponding to each second data in the low-accuracy data is obtained;

[0015] Based on the prediction confidence, the trigger set is determined from the low-accuracy data.

[0016] Further, determining the trigger set from the low-accuracy data based on the prediction confidence includes:

[0017] The second data in the low-accuracy data is traversed sequentially, and the maximum confidence and the second largest confidence corresponding to the currently traversed second data are determined based on the prediction confidence.

[0018] Based on the maximum confidence and the second highest confidence, determine whether to add the currently traversed second data to the trigger set until the traversal of the second data in the low accuracy data is completed.

[0019] Further, determining whether to add the currently traversed second data to the trigger set based on the maximum confidence level and the second maximum confidence level includes:

[0020] Obtain the confidence difference between the maximum confidence level and the second highest confidence level;

[0021] If the confidence difference is less than a preset threshold, the label of the currently traversed second data is updated to the label corresponding to the second highest confidence, the target trigger data is obtained, and the target trigger data is added to the trigger set.

[0022] Furthermore, the determination of the new network based on the multi-layer neural network and the model to be trained includes:

[0023] If the task to be learned is the first of multiple tasks, then the multilayer neural network is used as the newly added network.

[0024] If the task to be learned is not the first task among multiple tasks, then the new network is determined based on the trained network and multi-layer neural network in the model to be trained.

[0025] Furthermore, the method also includes:

[0026] Obtain the trigger set corresponding to each task, and obtain the watermark verification error rate threshold corresponding to each trigger set;

[0027] Each trigger set is input into the model to be verified to test the model and obtain test error results;

[0028] Each test error result is compared with the corresponding watermark verification error rate threshold to determine whether there are any target test error results that are lower than the corresponding watermark verification error rate threshold.

[0029] If the target test error result exists, then the model to be verified is determined to be the watermark model corresponding to the target test error result.

[0030] Furthermore, to achieve the above objectives, this application also provides a model encryption device, the model encryption device comprising:

[0031] The acquisition module is used to sequentially acquire the current task to be learned among multiple tasks of the learning model, and to acquire the dataset corresponding to the task to be learned;

[0032] The first training module is used to determine the new network based on the multi-layer neural network and the model to be trained, and to train the model on the dataset based on the new network to obtain the target model and training results.

[0033] The determination module is used to determine the trigger set based on the training results and the dataset;

[0034] The second training module is used to train the target model based on the trigger set, obtain the watermark model corresponding to the target model, and return to the step of sequentially obtaining the current task to be learned in multiple tasks of model learning until the model learning of all tasks is completed.

[0035] In addition, to achieve the above objectives, this application also provides a model encryption device, which includes: a memory, a processor, and a model encryption program stored in the memory and executable on the processor. When the model encryption program is executed by the processor, it implements the steps of the aforementioned model encryption method.

[0036] In addition, to achieve the above objectives, this application also provides a computer-readable storage medium storing a model encryption program, which, when executed by a processor, implements the steps of the aforementioned model encryption method.

[0037] This application achieves the following: First, it sequentially obtains the current learning task and its corresponding dataset from multiple tasks in the learning model. Then, it determines a new network based on a multi-layer neural network and the model to be trained, and trains the model on the dataset using the new network to obtain the target model and training results. Next, it determines a trigger set based on the training results and the dataset. Then, it trains the target model using the trigger set to obtain the watermark model corresponding to the target model. Finally, it returns to the previous step of sequentially obtaining the current learning task from multiple tasks in the model learning process until all tasks are completed. By determining the trigger set using the training results and training data of each training task in batch data training, and then training the currently trained model using the trigger set, the watermark model for the current training task is obtained. This enables the use of watermarking technology in a continuously learning model trained with batch data to protect the intellectual property rights of updated model versions. Attached Figure Description

[0038] The accompanying drawings, which are incorporated in and form part of this specification, illustrate embodiments consistent with this application and, together with the description, serve to explain the principles of this application.

[0039] To more clearly illustrate the technical solutions in the embodiments of this application or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, for those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0040] Figure 1 This is a flowchart illustrating an embodiment of the encryption method for the model in this application.

[0041] Figure 2 This is a schematic diagram of a model verification scenario in one embodiment of the model encryption method of this application;

[0042] Figure 3 This is a schematic diagram of the module structure of the model encryption device in an embodiment of this application;

[0043] Figure 4 This is a schematic diagram of the module structure of the encryption device in the embodiment of this application.

[0044] The realization of the purpose, functional features and advantages of this application will be further explained in conjunction with the embodiments and with reference to the accompanying drawings. Detailed Implementation

[0045] It should be understood that the specific embodiments described herein are merely illustrative of this application and are not intended to limit this application.

[0046] To better understand the technical solution of this application, a detailed description will be provided below in conjunction with the accompanying drawings and specific implementation methods.

[0047] The main solution of this application is as follows: In the learning model, the current task to be learned is obtained sequentially among multiple tasks, and the dataset corresponding to the task to be learned is obtained; a new network is determined based on the multi-layer neural network and the model to be trained, and the model is trained on the dataset based on the new network to obtain the target model and the training results; a trigger set is determined based on the training results and the dataset; the target model is trained based on the trigger set to obtain the watermark model corresponding to the target model, and the process of sequentially obtaining the current task to be learned among multiple tasks in the model learning is repeated until the model learning of all tasks is completed.

[0048] Currently, the mainstream methods for model copyright protection in related technologies are divided into black-box model watermarking technology, white-box model watermarking technology, and a combination of black-box and white-box model watermarking technology. Black-box model watermarking technology does not require knowledge of the model's internal structure; this method implants and extracts watermarks based on the output results obtained from specific inputs, such as constructing a specific trigger set. White-box model watermarking technology, on the other hand, requires knowledge of the model's internal information, such as model parameters, and operates based on this internal information during watermark implantation or extraction. The combination of black-box and white-box technology, however, involves knowing the model's internal information while combining specific inputs and outputs to implant or extract watermarks.

[0049] However, the aforementioned copyright protection techniques cannot be used for continuous learning models trained on batch data. Therefore, how to use watermarking technology in continuous learning models trained on batch data is a problem that urgently needs to be solved.

[0050] This application determines the trigger set by using the training results and training data of each training task in batch data training, and trains the model currently being trained using the trigger set. The watermarked model of the current training task realizes the use of watermarking technology in the continuous learning model trained in batch data training, and protects the intellectual property rights of the updated version of the model.

[0051] It should be noted that the execution subject in this embodiment can be a model encryption device, or a computing service device with data processing, network communication, and program execution functions, such as a tablet computer, personal computer, or mobile phone, or a model encryption device capable of performing the above functions. This embodiment does not specifically limit it in this regard. The following uses a model encryption device as the execution subject as an example to describe this embodiment and the following embodiments.

[0052] Based on this, this application proposes a model encryption method according to the first embodiment, please refer to... Figure 1The model encryption method includes steps S101 to S104:

[0053] Step S101: Sequentially obtain the current task to be learned from multiple tasks of the learning model, and obtain the dataset corresponding to the task to be learned;

[0054] In this embodiment, the continuous learning model includes multiple tasks, such as Task1, Task2, ... Task3. N There are N tasks, and the datasets for each task are D1, D2, ..., D. N .

[0055] During the continuous learning process, the current learning tasks are determined sequentially. i And obtain the dataset D corresponding to the task to be learned. i The dataset has a length of |D|. i |=L i The number of tags is n i If it is the first task initially, then i = 1.

[0056] Step S102: Determine the new network based on the multi-layer neural network and the model to be trained, and train the model on the dataset based on the new network to obtain the target model and training results.

[0057] In this embodiment, a multi-layer neural network is constructed, and a new network is determined based on the multi-layer neural network and the model to be trained. Further, in a feasible implementation, step S102 may include steps S1021 to S1022:

[0058] Step S1021: If the task to be learned is the first task among multiple tasks, then the multilayer neural network is used as the newly added network.

[0059] Step S1022: If the task to be learned is not the first task among multiple tasks, then the newly added network is determined based on the trained network and multi-layer neural network in the model to be trained.

[0060] In this embodiment, if the task to be learned is the first task among multiple tasks, i.e., i = 1, then the multilayer neural network is used as the new network; if the task to be learned is not the first task among multiple tasks, i.e., i ≠ 1, then the new network is determined based on the trained network and multilayer neural network in the model to be trained, that is, the new network is obtained by connecting the trained network and multilayer neural network in the model to be trained corresponding to the tasks before the task to be learned, and the specific formula is as follows:

[0061]

[0062] Among them, hi (k) W represents the output of the i-th network in the k-th column of the newly added network. i (k) ∈R ni×ni-1 For the weights of the i-th network in the k-th column (where k represents the k-th task), U i (k:j) ∈R ni×nj Let f be the weight of the (i-1)th horizontal connection from the j-th column. Let f represent a non-linear element, f(x) = max(0,x), h i-1 (k) This is the output of the (i-1)th network in the k-th column.

[0063] After the new network is determined, the model is trained on the dataset based on the new network to obtain the target model and training results. During the training process, according to the output formula of the new network, each layer of the neural network adds the input of the corresponding layer of the neural network after processing by the above formula in addition to the original input.

[0064] Step S103: Determine the trigger set based on the training results and the dataset;

[0065] In this embodiment, after obtaining the target model and training results, a trigger set is determined based on the target model and training results. Specifically, based on the training results and the dataset, the accuracy of each first data point in the dataset is determined. That is, based on the training results of each first data point and the label of each first data point in the dataset, the accuracy of each first data point in the dataset is determined. Based on the accuracy, low-accuracy data in the dataset is determined. The label of the low-accuracy data is less than 50% of the total number of labels in the dataset. For example, the accuracy of each first data point is sorted, and the top 30% to 50% of the low accuracy points in the sorted results are selected. Of course, for binary classification tasks, the class data with the highest error rate is selected.

[0066] The trigger set is determined based on low-accuracy data. Specifically, the labels of each second data point are updated according to the prediction confidence of each label corresponding to each second data point in the low-accuracy data to obtain the trigger set.

[0067] Step S104: Train the target model based on the trigger set to obtain the watermark model corresponding to the target model, and return to the step of sequentially obtaining the current task to be learned in multiple tasks of model learning until the model learning of all tasks is completed.

[0068] In this embodiment, after obtaining the trigger set, the target model is trained based on the trigger set to obtain the watermark model corresponding to the target model, and the process returns to step S101 to obtain the target model and watermark model corresponding to each task. Thus, each task corresponds to a watermarked model version (watermark model). Copyright protection and version control can be performed based on the watermark models trained at each stage of the learning model, so as to protect the copyright of the stage versions of the learning model.

[0069] It should be noted that the learning model in this embodiment can be a continuous learning model or a progressive learning model.

[0070] The model encryption method proposed in this embodiment involves sequentially acquiring the current learning task and its corresponding dataset across multiple tasks in the learning model; then determining a new network based on a multi-layer neural network and the model to be trained, and training the model on the dataset using the new network to obtain the target model and training results; subsequently, determining a trigger set based on the training results and the dataset; then training the target model on the trigger set to obtain the watermark model corresponding to the target model, and returning to the previous step of sequentially acquiring the current learning task across multiple tasks in the model learning process until all tasks have been completed. The trigger set is determined using the training results and training data of each training task in batch data training, and the model is trained on the current training model using the trigger set. This watermark model for the current training task enables the use of watermarking technology in a continuously learning model trained on batch data, thus protecting the intellectual property rights of updated models.

[0071] At the same time, copyright protection and version control can be implemented based on the watermark model trained at each stage of the learning model, so as to protect the copyright of the model at each stage.

[0072] In one feasible implementation, step S103 may include steps S1031 to S1032:

[0073] Step S1031: Based on the training results and the dataset, determine the accuracy of each first data point in the dataset;

[0074] Step S1032: Based on the accuracy, identify low-accuracy data in the dataset, and determine the trigger set based on the low-accuracy data.

[0075] In this embodiment, after obtaining the target model and training results, the accuracy of each first data point in the dataset is determined based on the training results and the dataset. That is, the accuracy of each first data point in the dataset is determined based on the training results of each first data point and the label of each first data point in the dataset.

[0076] After obtaining the accuracy of each first data point, the low-accuracy data in the dataset is determined based on the accuracy. The label of the low-accuracy data is less than 50% of the total number of labels in the dataset. For example, the accuracy of each first data point is sorted, and the top 30% to 50% of the low accuracy in the sorted results are selected. Of course, for binary classification tasks, the class with the highest error rate is selected.

[0077] After obtaining the various low-accuracy data, a trigger set is determined based on the low-accuracy data. Specifically, according to the prediction confidence of each label corresponding to each second data in the low-accuracy data, the labels of each second data are updated to obtain the trigger set. Specifically, in a feasible implementation, step S1032 may include steps a to b:

[0078] Step a: Based on the training results, obtain the prediction confidence of each label corresponding to each second data in the low-accuracy data;

[0079] Step b: Based on the prediction confidence, determine the trigger set in the low accuracy data.

[0080] In this embodiment, after obtaining each low-accuracy data point, based on the training results, the prediction confidence of each label corresponding to each second data point in the low-accuracy data is obtained, forming a prediction confidence space. For example, the prediction confidence space is:

[0081]

[0082] in, For the Lth i The prediction confidence between the second data point and the nth label.

[0083] After obtaining the prediction confidence level, the trigger set is determined in the low-accuracy data based on the prediction confidence level. Specifically, in one feasible implementation, step b may include steps b1 to b2:

[0084] Step b1: Iterate through the second data in the low-accuracy data, and determine the maximum confidence and the second largest confidence corresponding to the currently traversed second data based on the prediction confidence.

[0085] Step b2: Based on the maximum confidence and the second maximum confidence, determine whether to add the currently traversed second data to the trigger set until the traversal of the second data in the low accuracy data is completed.

[0086] In this embodiment, the second data in the low-accuracy data is traversed sequentially. Based on the prediction confidence, the maximum confidence and the second largest confidence corresponding to the currently traversed second data are determined. For example, for the i-th second data, its maximum confidence is p. ij And the second highest confidence level is p ik p ij p represents the prediction confidence between the i-th second data point and the j-th label. ik Let be the prediction confidence between the i-th second data point and the k-th label.

[0087] After obtaining the maximum confidence level and the second largest confidence level, based on the maximum confidence level and the second largest confidence level, it is determined whether to add the currently traversed second data to the trigger set. In one feasible implementation, step b2 may include steps b21 to b22:

[0088] Step b21: Obtain the confidence difference between the maximum confidence level and the second highest confidence level;

[0089] Step b22: If the confidence difference is less than a preset threshold, then update the label of the currently traversed second data to the label corresponding to the second largest confidence, obtain the target trigger data, and add the target trigger data to the trigger set.

[0090] In this embodiment, after obtaining the maximum confidence level and the second largest confidence level, the confidence difference between the maximum confidence level and the second largest confidence level is calculated. This confidence difference = p ij -p ik .

[0091] When the confidence difference is obtained, the preset threshold corresponding to the second data point being traversed is obtained. Specifically, a preset threshold is set for each first data point in the dataset, and it is determined whether the confidence difference is less than the preset threshold. If the confidence difference is less than the preset threshold, the label of the second data point being traversed is updated to the label corresponding to the second highest confidence level, thus obtaining the target trigger data. For example, the maximum confidence level is p. ij And the second highest confidence level is p ik When the confidence difference is less than a preset threshold, the label of the currently traversed second data is replaced with the label of the second largest confidence level p. ik The corresponding label (k) is updated, and the target trigger data obtained after updating the label is added to the trigger set. Of course, if the confidence difference is greater than or equal to the preset threshold, the second data currently being traversed will not be added to the trigger set. Then, the execution of step b1 is returned until the second data in the low accuracy data is traversed and the trigger set is obtained.

[0092] Since the difference between sample confidence levels is less than the preset value, ensuring that the model's decision boundary for the sample is more ambiguous, the label of the sample is changed from the label with the highest confidence level to the label with the second highest confidence level. Furthermore, the selected sample is a class dataset with low classification accuracy. Thus, the trigger set obtained in this step may improve the prediction accuracy of some samples by changing the label to the label with the second highest confidence level, and it can also reduce the interference of the model's learning of the trigger set on the original network's classification function when embedding watermarks in the future.

[0093] The model encryption method proposed in this embodiment determines the accuracy of each first data point in the dataset based on the training results and the dataset; then, based on the accuracy, it identifies low-accuracy data in the dataset and determines the trigger set based on the low-accuracy data. The trigger set is formed by filtering the category data with high classification error rate in the original dataset using the model itself and changing the labels, so that watermarks can be implanted through the trigger set. This enables the use of watermarking technology in a continuously learning model trained with batch data to protect the intellectual property rights of the updated version of the model.

[0094] In one feasible implementation, the model encryption method may further include steps S201 to S204:

[0095] Step S201: Obtain the trigger set corresponding to each task, and obtain the watermark verification error rate threshold corresponding to each trigger set;

[0096] Step S202: Input each trigger set into the model to be verified to test the model and obtain the test error results;

[0097] Step S203: Compare each test error result with the corresponding watermark verification error rate threshold to determine whether there is a target test error result that is less than the corresponding watermark verification error rate threshold.

[0098] Step S204: If the target test error result exists, then the model to be verified is determined to be the watermark model corresponding to the target test error result.

[0099] It's important to note that each task in the progressive learning model has its own unique network architecture. Therefore, when predicting each task's dataset, a specific task ID is required, and different network architectures are invoked for different task IDs. The task IDs for the validation datasets can be manually labeled, and different model modules are called based on these task IDs.

[0100] In this embodiment, before model verification, the watermark verification error rate threshold corresponding to each trigger set is preset. During the process of obtaining the watermark model of each task, the trigger set corresponding to each task is obtained at the same time. When performing model verification, the trigger set corresponding to each task is obtained, and the watermark verification error rate threshold corresponding to each trigger set is obtained.

[0101] After obtaining the trigger sets, each trigger set is input into the model to be verified for model testing, and the test error results corresponding to each trigger set are obtained. Each test error result is compared with the corresponding watermark verification error rate threshold to determine whether there is a target test error result that is less than the corresponding watermark verification error rate threshold. Specifically, for each trigger set, the test error result of the trigger set is compared with the watermark verification error rate threshold to determine whether the test error result of the trigger set is less than the watermark verification error rate threshold. If so, the test error result corresponding to the trigger set is the target test error result.

[0102] If the target test error result exists, then the model to be verified is determined to be the watermark model corresponding to the target test error result, such as... Figure 2 As shown.

[0103] The model encryption method proposed in this embodiment obtains the trigger set corresponding to each task and the watermark verification error rate threshold corresponding to each trigger set. Then, each trigger set is input into the model to be verified for model testing to obtain test error results. Next, each test error result is compared with the corresponding watermark verification error rate threshold to determine whether there is a target test error result that is lower than the corresponding watermark verification error rate threshold. If the target test error result exists, the model to be verified is determined to be the watermark model corresponding to the target test error result. Model verification is performed based on the trigger set, which can accurately identify whether the model to be verified matches the watermark model, thereby realizing intellectual property protection for the updated version of the model.

[0104] This application also provides a model encryption device; please refer to... Figure 3 The model encryption device includes:

[0105] The acquisition module 10 is used to sequentially acquire the current task to be learned among multiple tasks of the learning model, and acquire the dataset corresponding to the task to be learned;

[0106] The first training module 20 is used to determine the new network based on the multi-layer neural network and the model to be trained, and to train the model on the dataset based on the new network to obtain the target model and training results.

[0107] The determination module 30 is used to determine the trigger set based on the training results and the dataset;

[0108] The second training module 40 is used to train the target model based on the trigger set, obtain the watermark model corresponding to the target model, and return to execute the step of sequentially obtaining the current task to be learned in multiple tasks of model learning, until the model learning of all tasks is completed.

[0109] The model encryption device provided in this application, employing the model encryption method described in the above embodiments, can solve the technical problem of how to use watermarking technology in a continuous learning model trained with batch data. Compared with the prior art, the beneficial effects of the model encryption device provided in this application are the same as those of the model encryption method provided in the above embodiments, and other technical features in the model encryption device are the same as those disclosed in the methods of the above embodiments, and will not be repeated here.

[0110] This application provides a model encryption device, which includes: at least one processor; and a memory communicatively connected to the at least one processor; wherein the memory stores instructions executable by the at least one processor, which are executed by the at least one processor to enable the at least one processor to perform the model encryption method in Embodiment 1 above.

[0111] The following is for reference. Figure 4 The diagram illustrates a structural schematic suitable for implementing the model encryption device in the embodiments of this application. The model encryption device in the embodiments of this application may include, but is not limited to, mobile terminals such as mobile phones, laptops, digital broadcast receivers, PDAs (Personal Digital Assistants), PADs (Portable Application Description), PMPs (Portable Media Players), in-vehicle terminals (e.g., in-vehicle navigation terminals), and fixed terminals such as digital TVs and desktop computers. Figure 4 The model encryption device shown is merely an example and should not impose any limitations on the functionality and scope of use of the embodiments of this application.

[0112] like Figure 4As shown, the model encryption device may include a processing unit 1001 (e.g., a central processing unit, a graphics processing unit, etc.), which can perform various appropriate actions and processes according to a program stored in a read-only memory (ROM) 1002 or a program loaded from a storage device 1003 into a random access memory (RAM) 1004. The RAM 1004 also stores various programs and data required for the operation of the model encryption device. The processing unit 1001, ROM 1002, and RAM 1004 are interconnected via a bus 1005. An input / output (I / O) interface 1006 is also connected to the bus. Typically, the following systems can be connected to the I / O interface 1006: input devices 1007 including, for example, a touchscreen, touchpad, keyboard, mouse, image sensor, microphone, accelerometer, gyroscope, etc.; output devices 1008 including, for example, a liquid crystal display (LCD), speaker, vibrator, etc.; storage devices 1003 including, for example, magnetic tape, hard disk, etc.; and communication devices 1009. Communication device 1009 allows the model encryption device to communicate wirelessly or wiredly with other devices to exchange data. While the figure shows model encryption devices with various systems, it should be understood that implementation or possession of all the systems shown is not required. More or fewer systems may be implemented alternatively.

[0113] Specifically, according to the embodiments disclosed in this application, the processes described above with reference to the flowcharts can be implemented as computer software programs. For example, embodiments disclosed in this application include a computer program product comprising a computer program carried on a computer-readable medium, the computer program containing program code for performing the methods shown in the flowcharts. In such embodiments, the computer program can be downloaded and installed from a network via a communication device, or installed from storage device 1003, or installed from ROM 1002. When the computer program is executed by processing device 1001, it performs the functions defined in the methods of the embodiments disclosed in this application.

[0114] The model encryption device provided in this application, employing the model encryption method described in the above embodiments, can solve the technical problem of how to use watermarking technology in a continuous learning model trained with batch data. Compared with the prior art, the beneficial effects of the model encryption device provided in this application are the same as those of the model encryption method provided in the above embodiments, and other technical features in this model encryption device are the same as those disclosed in the previous embodiment method, and will not be repeated here.

[0115] It should be understood that the various parts disclosed in this application can be implemented using hardware, software, firmware, or a combination thereof. In the description of the above embodiments, specific features, structures, materials, or characteristics can be combined in any suitable manner in one or more embodiments or examples.

[0116] The above description is merely a specific embodiment of this application, but the scope of protection of this application is not limited thereto. Any variations or substitutions that can be easily conceived by those skilled in the art within the technical scope disclosed in this application should be included within the scope of protection of this application. Therefore, the scope of protection of this application should be determined by the scope of the claims.

[0117] This application provides a computer-readable storage medium having computer-readable program instructions (i.e., a computer program) stored thereon, the computer-readable program instructions being used to execute the model encryption method in the above embodiments.

[0118] The computer-readable storage medium provided in this application may be, for example, a USB flash drive, but is not limited to, electrical, magnetic, optical, electromagnetic, infrared, or semiconductor systems, devices, or any combination thereof. More specific examples of computer-readable storage media may include, but are not limited to: electrical connections having one or more wires, portable computer disks, hard disks, random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM or flash memory), optical fiber, portable compact disk read-only memory (CD-ROM), optical storage devices, magnetic storage devices, or any suitable combination thereof. In this embodiment, the computer-readable storage medium may be any tangible medium containing or storing a program that can be used by or in conjunction with an instruction execution system, system, or device. The program code contained on the computer-readable storage medium may be transmitted using any suitable medium, including but not limited to: wires, optical cables, RF (Radio Frequency), etc., or any suitable combination thereof.

[0119] The aforementioned computer-readable storage medium may be included in the model encryption device; or it may exist independently and not assembled into the model encryption device.

[0120] The aforementioned computer-readable storage medium carries one or more programs. When the one or more programs are executed by the model encryption device, the model encryption device causes the following: in multiple tasks of learning the model, it sequentially obtains the current task to be learned and obtains the dataset corresponding to the task to be learned; it determines a new network based on a multi-layer neural network and the model to be trained, and trains the model on the dataset based on the new network to obtain a target model and training results; it determines a trigger set based on the training results and the dataset; it trains the target model based on the trigger set to obtain a watermark model corresponding to the target model, and returns to the step of sequentially obtaining the current task to be learned in multiple tasks of model learning, until the model learning of all tasks is completed.

[0121] Computer program code for performing the operations of this application can be written in one or more programming languages ​​or a combination thereof, including object-oriented programming languages ​​such as Java, Smalltalk, and C++, and conventional procedural programming languages ​​such as the "C" language or similar programming languages. The program code can be executed entirely on the user's computer, partially on the user's computer, as a standalone software package, partially on the user's computer and partially on a remote computer, or entirely on a remote computer or server. In cases involving remote computers, the remote computer can be connected to the user's computer via any type of network—including a Local Area Network (LAN) or a Wide Area Network (WAN)—or can be connected to an external computer (e.g., via the Internet using an Internet service provider).

[0122] The flowcharts and block diagrams in the accompanying drawings illustrate the architecture, functionality, and operation of possible implementations of systems, methods, and computer program products according to various embodiments of this application. In this regard, each block in a flowchart or block diagram may represent a module, segment, or portion of code containing one or more executable instructions for implementing a specified logical function. It should also be noted that in some alternative implementations, the functions indicated in the blocks may occur in a different order than those indicated in the drawings. For example, two consecutively indicated blocks may actually be executed substantially in parallel, and they may sometimes be executed in reverse order, depending on the functions involved. It should also be noted that each block in the block diagrams and / or flowcharts, and combinations of blocks in the block diagrams and / or flowcharts, can be implemented using a dedicated hardware-based system that performs the specified function or operation, or using a combination of dedicated hardware and computer instructions.

[0123] The modules described in the embodiments of this application can be implemented in software or hardware. The names of the modules do not necessarily limit the functionality of the unit itself.

[0124] The readable storage medium provided in this application is a computer-readable storage medium that stores computer-readable program instructions (i.e., a computer program) for executing the above-described model encryption method, and can solve the technical problem of how to use watermarking technology in a continuous learning model trained with batch data. Compared with the prior art, the beneficial effects of the computer-readable storage medium provided in this application are the same as the beneficial effects of the model encryption method provided in the above embodiments, and will not be repeated here.

[0125] This application provides a computer program product, including a computer program that, when executed by a processor, implements the steps of the model encryption method described above.

[0126] The computer program product provided in this application solves the technical problem of how to use watermarking technology in a continuous learning model trained with batch data. Compared with the prior art, the beneficial effects of the computer program product provided in this application are the same as the beneficial effects of the model encryption method provided in the above embodiments, and will not be repeated here.

[0127] The above are merely preferred embodiments of this application and do not limit the patent scope of this application. Any equivalent structural or procedural transformations made using the content of this application's specification and drawings, or direct or indirect applications in other related technical fields, are similarly included within the patent protection scope of this application.

Claims

1. A model encryption method, characterized in that, include: In the learning model, the current task to be learned is obtained sequentially among multiple tasks, and the dataset corresponding to the task to be learned is obtained; The new network is determined based on the multi-layer neural network and the model to be trained, and the model is trained on the dataset based on the new network to obtain the target model and training results. Based on the training results and the dataset, a trigger set is determined; The target model is trained based on the trigger set to obtain the watermark model corresponding to the target model, and the process of sequentially obtaining the current task to be learned in multiple tasks of model learning is returned until the model learning of all tasks is completed. The step of determining the trigger set based on the training results and the dataset includes: Based on the training results and the dataset, determine the accuracy of each first data point in the dataset; Based on the accuracy rate, identify the low-accuracy data in the dataset; Based on the training results, the prediction confidence of each label corresponding to each second data in the low-accuracy data is obtained; The second data in the low-accuracy data is traversed sequentially, and the maximum confidence and the second largest confidence corresponding to the currently traversed second data are determined based on the prediction confidence. Based on the maximum confidence level and the second highest confidence level, it is determined whether to add the currently traversed second data to the trigger set until the traversal of the second data in the low accuracy data is completed. Specifically, the confidence difference between the maximum confidence level and the second highest confidence level is obtained. If the confidence difference is less than a preset threshold, the label of the currently traversed second data is updated to the label corresponding to the second highest confidence level, the target trigger data is obtained, and the target trigger data is added to the trigger set.

2. The model encryption method as described in claim 1, characterized in that, The process of determining the new network based on a multi-layer neural network and the model to be trained includes: If the task to be learned is the first of multiple tasks, then the multilayer neural network is used as the newly added network. If the task to be learned is not the first task among multiple tasks, then the new network is determined based on the trained network and multi-layer neural network in the model to be trained.

3. The model encryption method according to any one of claims 1 to 2, characterized in that, The method further includes: Obtain the trigger set corresponding to each task, and obtain the watermark verification error rate threshold corresponding to each trigger set; Each trigger set is input into the model to be verified to test the model and obtain test error results; Each test error result is compared with the corresponding watermark verification error rate threshold to determine whether there are any target test error results that are lower than the corresponding watermark verification error rate threshold. If the target test error result exists, then the model to be verified is determined to be the watermark model corresponding to the target test error result.

4. A model encryption device, characterized in that, The model encryption device includes: The acquisition module is used to sequentially acquire the current learning task among multiple tasks of the learning model, and acquire the dataset corresponding to the learning task. The first training module is used to determine the new network based on the multi-layer neural network and the model to be trained, and to train the model on the dataset based on the new network to obtain the target model and training results. The determination module is used to determine the trigger set based on the training results and the dataset; The second training module is used to train the target model based on the trigger set, obtain the watermark model corresponding to the target model, and return to the step of sequentially obtaining the current task to be learned in multiple tasks of model learning until the model learning of all tasks is completed. The determining module is further configured to: Based on the training results and the dataset, determine the accuracy of each first data point in the dataset; Based on the accuracy rate, identify the low-accuracy data in the dataset; Based on the training results, the prediction confidence of each label corresponding to each second data in the low-accuracy data is obtained; The second data in the low-accuracy data is traversed sequentially, and the maximum confidence and the second largest confidence corresponding to the currently traversed second data are determined based on the prediction confidence. Based on the maximum confidence level and the second highest confidence level, it is determined whether to add the currently traversed second data to the trigger set until the traversal of the second data in the low accuracy data is completed. Specifically, the confidence difference between the maximum confidence level and the second highest confidence level is obtained. If the confidence difference is less than a preset threshold, the label of the currently traversed second data is updated to the label corresponding to the second highest confidence level, the target trigger data is obtained, and the target trigger data is added to the trigger set.

5. A model encryption device, characterized in that, The model encryption device includes: a memory, a processor, and a model encryption program stored in the memory and executable on the processor, wherein the model encryption program, when executed by the processor, implements the steps of the model encryption method as described in any one of claims 1 to 3.

6. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores a model encryption program, which, when executed by a processor, implements the steps of the model encryption method as described in any one of claims 1 to 3.

Images