Data set verification method and device for backdoor watermarking technology

Abstract

The invention discloses a data set verification method and device for a backdoor watermarking technology. The data set verification method comprises the steps that a sample data set is divided into a target sample data set and a benign sample data set; embedding the watermark information into the target sample data set, and determining a watermark sample data set; performing first verification on the watermark information to obtain a first verification result; the first verification result is used for determining whether the data set functions of the watermark sample data set and the target sample data set are the same; performing second verification according to the benign sample data set and the watermark sample data set to obtain a second verification result; or, according to the watermark sample data set, carrying out third verification to obtain a third verification result; the second verification result and the third verification result are used for determining whether the watermark sample data set is infringed or not. According to the method, the third verification for verification based on the prediction label is provided, so that the third verification can detect the black box model, and the problem that detection of the black box model is not considered in the prior art is solved.

Description

Technical Field

[0001] The present invention relates to the field of backdoor watermark technology and data copyright verification technology, and in particular to a data set verification method and device using backdoor watermark technology. Background Art

[0002] Deep learning, especially deep neural networks (DNNs), has been widely and successfully adopted in many key applications, such as image recognition and driverless cars, due to its effectiveness and efficiency. The rapid development of DNNs is due to the existence of some high-quality datasets (such as ImageNet and Cifar), which enable researchers and developers to easily verify the performance of their methods; however, almost all existing open source datasets require that they can only be used for academic or educational purposes without permission and cannot be used for commercial purposes; the protection of published datasets is to verify whether they are used to train third-party models (i.e., illegally used for commercial purposes), where defenders can only query the models but cannot understand their parameters and training details, i.e., black-box models.

[0003] However, black-box model testing usually involves additional resource and time costs because the internal mechanisms of the model cannot be directly accessed. This requires comprehensive external verification methods such as fuzz testing, reverse engineering, or using alternative models to simulate and evaluate model behavior. These techniques are more complex and time-consuming than direct analysis, which can be verified more directly and efficiently with internal access. In addition, ensuring compliance and verifying dataset copyright in black-box testing frameworks also requires the integration of strong encryption measures, which further increases the overall operational and computational costs.

[0004] Therefore, the dataset protection strategy in the prior art does not consider the problem of black box model detection, which will increase the cost of dataset copyright verification. Summary of the invention

[0005] In order to overcome the deficiencies of the prior art, the object of the present invention is to provide a data set verification method and device for backdoor watermark technology, which can detect black box models.

[0006] In order to solve the above problems, the present invention is implemented according to the following scheme:

[0007] A data set verification method for backdoor watermark technology is provided, including:

[0008] Divide the sample data set into a target sample data set and a benign sample data set;

[0009] Embedding watermark information into the target sample data set to determine the watermark sample data set;

[0010] Performing a first verification on the watermark information to obtain a first verification result; the first verification result is used to determine whether the data set functions of the watermark sample data set and the target sample data set are the same;

[0011] A second verification is performed based on the benign sample data set and the watermark sample data set to obtain a second verification result; or a third verification is performed based on the watermark sample data set to obtain a third verification result; the second verification result and the third verification result are used to determine whether the watermark sample data set is infringed.

[0012] Compared with the prior art, the beneficial effects of a data set verification method of a backdoor watermark technology provided by the present invention are as follows: by providing two verification methods, namely the second verification and the third verification, the watermark sample data set is verified, wherein the second verification is based on the prediction probability, so the second verification is suitable for the verification of open source data sets; and the third verification is based on the prediction label, so the third verification is suitable for the situation where only the model can be queried but the model parameters and training details cannot be understood, that is, the black box model is detected, thereby solving the problem of black box model detection that is not considered in the prior art.

[0013] Optionally, before dividing the sample data set into the target sample data set and the benign sample data set, the method further includes: determining a data protection party and a data infringing party;

[0014] The data protection party is used to:

[0015] Embedding the watermark information into the target sample data set;

[0016] When the data infringer infringes the watermark sample data set, the watermark sample data set is verified.

[0017] Optionally, performing a first verification on the watermark information to obtain a first verification result includes:

[0018] Determining a model trained on the benign sample data set as a benign model;

[0019] Determine a model trained on the watermark sample data set as a watermark model;

[0020] The first verification result is determined according to the benign model and the watermark model.

[0021] Optionally, determining the first verification result according to the benign model and the watermark model includes:

[0022] Determining the benign accuracy rate of the benign model as a first benign accuracy rate;

[0023] Determining the benign accuracy rate of the watermark model as a second benign accuracy rate;

[0024] According to the first benign accuracy rate and the second benign accuracy rate, it is determined whether the watermark information damages the target sample data set.

[0025] Optionally, the determining the first verification result according to the benign model and the watermark model further includes:

[0026] When the watermark information does not damage the target sample data set, determining the prediction behavior of the benign model as the first prediction behavior, and determining the prediction behavior of the watermark model as the second prediction behavior;

[0027] Determining whether the watermark information is detected on the watermark sample data set according to the first prediction behavior and the second prediction behavior;

[0028] When the watermark information damages the target sample data set, the first verification result is that the data set functions of the watermark sample data set and the target sample data set are different.

[0029] Optionally, the determining the first verification result according to the benign model and the watermark model further includes:

[0030] When the watermark information is not detected on the watermark sample data set, determining a watermark rate according to the benign sample data set and the watermark sample data set;

[0031] Determining whether the watermark information is hidden on the target sample data set according to the watermark rate;

[0032] When the watermark information is detected on the watermark sample data set, the first verification result is that the data set functions of the watermark sample data set and the target sample data set are different;

[0033] When the watermark rate is greater than a preset watermark rate, the first verification result is that the data set functions of the watermark sample data set and the target sample data set are different;

[0034] When the watermark rate is less than or equal to the preset watermark rate, the first verification result is that the data set functions of the watermark sample data set and the target sample data set are the same.

[0035] Optionally, before performing the second verification or the third verification, the method further includes:

[0036] Determine the target data and data type for the data protection party to obtain the model to be verified;

[0037] When the data type is the first data type, performing the second verification on the model to be verified, and determining the second verification result;

[0038] When the data type is the second data type, the third verification is performed on the model to be verified to determine the third verification result.

[0039] Optionally, when the data type is the first data type, performing the second verification on the model to be verified and determining the second verification result includes:

[0040] Determining the predicted probability of the benign sample data set on the target label as a first predicted probability;

[0041] Determining the predicted probability of the watermark sample data set on the target label as a second predicted probability;

[0042] When the first prediction probability is less than or equal to the second prediction probability, the model to be verified is obtained by training on the watermark sample data set, and the second verification result is that the watermark sample data set is not infringed;

[0043] When the first prediction probability is greater than the second prediction probability, the model to be verified is not trained on the watermark sample data set, and the second verification result is that the watermark sample data set is infringed.

[0044] Optionally, when the data type is the second data type, performing the third verification on the model to be verified and determining the third verification result includes:

[0045] Determine the predicted label of the data set for generating the model to be verified as the first predicted label;

[0046] Determining the predicted label of the watermark sample data set as a second predicted label;

[0047] When the first predicted label is the same as the second predicted label, the model to be verified is trained on the watermark sample data set, and the third verification result is that the watermark sample data set is not infringed;

[0048] When the first predicted label is different from the second predicted label, the model to be verified is not trained on the watermark sample data set, and the third verification result is that the watermark sample data set is infringed.

[0049] A computer device is also provided, comprising a processor and a memory, wherein the memory stores at least one instruction, at least one program, code set or instruction set, and the at least one instruction, at least one program, code set or instruction set is loaded and executed by the processor to implement the data set verification method. BRIEF DESCRIPTION OF THE DRAWINGS

[0050] Figure 1 Flow chart of the data set verification method in the present invention. DETAILED DESCRIPTION

[0051] The preferred embodiments of the present invention are described below in conjunction with the accompanying drawings. It should be understood that the preferred embodiments described herein are only used to illustrate and explain the present invention, and are not used to limit the present invention.

[0052] When the following description refers to the drawings, unless otherwise indicated, the same numbers in different drawings represent the same or similar elements. The embodiments described in the following exemplary embodiments do not represent all embodiments consistent with the present application. On the contrary, they are merely examples of devices and methods consistent with some aspects of the present application as detailed in the attached claims. In the description of the present application, it should be understood that the terms "first", "second", "third", etc. are only used to distinguish similar objects, and do not have to be used to describe a specific order or sequence, nor can they be understood as indicating or implying relative importance. For those of ordinary skill in the art, the specific meanings of the above terms in the present application can be understood according to the specific circumstances.

[0053] See also Figure 1 As shown, the present invention provides a data set verification method of a backdoor watermark technology, comprising:

[0054] S1: Divide the sample data set into a target sample data set and a benign sample data set.

[0055] The target sample data set is used to embed specific watermark information. The watermark information can be used to detect the model to be detected to determine whether the model to be detected is trained on the data set with the watermark information, that is, to determine whether the target sample data set with the watermark information is infringed.

[0056] The benign sample dataset is not embedded with watermark information. Therefore, when verifying the watermark information, the benign sample dataset is used for comparative analysis with the target sample dataset with watermark information to determine whether the watermark information changes the dataset function of the target sample dataset. When determining whether the target sample dataset with watermark information is infringed, the determination is made by comparing the performance of the model to be tested on the benign sample dataset with the performance of the model to be tested on the target sample dataset with watermark information.

[0057] Before dividing the sample data set into the target sample data set and the benign sample data set, it is necessary to first identify the data protection party and the data infringement party.

[0058] Data protection parties publish their datasets and want to protect the copyright of the published datasets; therefore, the goal of the data protection party is to "steal" the published datasets to train their commercial models without the permission of the data protection party.

[0059] Let D represent a protected dataset containing K different classes, and S represent the model to be detected. We express dataset protection as a verification problem. The data protection party aims to identify whether the model to be detected S is trained on the protected dataset D under a black-box setting; that is, the data protection party embeds the watermark information into the target sample dataset, obtains the watermarked sample dataset and publishes it, and verifies the watermarked sample dataset when the data infringer infringes the watermarked sample dataset.

[0060] S2: embedding the watermark information into the target sample data set, and determining the watermark sample data set, including:

[0061] Select and generate watermark information and templates, determine the embedded information content and design the template; then, select the data points (data of the target sample data set) to which watermark information needs to be added and perform minor transformations, such as numerical adjustment, adding noise, etc., to ensure that the data function is not significantly affected after the watermark information is embedded in the target sample data set; finally, embed the watermark information into the selected data points (data of the target sample data set) according to the generated template, to ensure that the watermark information has minimal impact on the data function of the target sample data set and maintain the naturalness and effectiveness of the target sample data set; through these steps, the watermark information can be effectively embedded into the target sample data set, thereby realizing the copyright protection and source tracing functions of the data set.

[0062] S3: Performing a first verification on the watermark information to obtain a first verification result; the first verification result is used to determine whether the data set functions of the watermark sample data set and the target sample data set are the same, including:

[0063] The models are trained on the benign sample data set and the watermark sample data set respectively, the model trained on the benign sample data set is determined as the benign model, and the model trained on the watermark sample data set is determined as the watermark model.

[0064] Determine the harmlessness of watermark information:

[0065] Determine the benign accuracy rates of the benign model and the watermark model respectively, determine the benign accuracy rate of the benign model as the first benign accuracy rate, and determine the benign accuracy rate of the watermark model as the second benign accuracy rate; compare the first benign accuracy rate with the second benign accuracy rate, and when the first benign accuracy rate and the second benign accuracy rate meet When , it means that the watermark information will not have a significant impact on the target sample data set, that is, it is harmless, that is, the watermark information will not cause damage to the target sample data set, where BA(f) is the first benign accuracy rate, is the second benign accuracy rate, ζ is the first threshold, which is used to judge whether the watermark information is harmless. The specific value of ζ is usually determined based on experimental data or statistical analysis results to ensure its rationality and applicability. The threshold can be determined through experimental verification or model performance evaluation to ensure that it can accurately distinguish harmful and harmless watermark information in different situations. , it indicates that the watermark information is not harmless, that is, the watermark information will cause damage to the target sample data set. At this time, it can be directly determined that the first verification result is that the data set functions of the watermark sample data set and the benign sample data set are different, while the target sample data set and the benign sample data set belong to the same sample data set, that is, the data set functions of the target sample data set and the benign sample data set are the same, that is, the first verification result is that the data set functions of the watermark sample data set and the target sample data set are different.

[0066] Determine the saliency of the watermark information:

[0067] When it is determined that the watermark information is harmless, that is, the watermark information will not cause damage to the target sample data set, the benign model and the watermark model are predicted respectively, and the behavior predicted by the benign model is determined as the first predicted behavior, and the behavior predicted by the watermark model is determined as the second predicted behavior; when the first predicted behavior and the second predicted behavior meet , it means that the watermark information is significant, that is, the watermark information can be detected on the watermark sample data set, where W is the watermark sample data set, x′ is the predicted behavior, d is the distance metric, f(x′) is the first predicted behavior, is the second prediction behavior, is the second threshold, which is used to measure the difference between the watermark sample data set and the benign sample data set. The specific value of η is usually determined through experimental testing and statistical analysis to ensure that it can effectively distinguish different situations in practical applications. When It means that the watermark information is not significant, that is, the watermark cannot be detected through the difference, that is, the watermark information cannot be detected on the watermark sample data set. At this time, it can be directly determined that the first verification result is that the data set functions of the watermark sample data set and the benign sample data set are different, and the target sample data set and the benign sample data set belong to the same sample data set, that is, the data set functions of the target sample data set and the benign sample data set are the same, that is, the first verification result is that the data set functions of the watermark sample data set and the target sample data set are different.

[0068] Determine the anonymity of the watermark information:

[0069] The watermark rate is determined according to the benign sample data set and the watermark sample data set. Since the target sample data set and the benign sample data set belong to the same sample data set, that is, the target sample data set and the benign sample data set have the same data set function, that is, the watermark rate is used to indicate the proportion of data containing watermark information in the target sample data set. The smaller the watermark rate, the more hidden the watermark information is in the target sample data set.

[0070] Anonymity is used to indicate the degree of concealment of watermark information on the target sample data set. When the watermark rate satisfies γ<γ′, it indicates that the watermark information is sufficiently anonymized on the target sample data set and is not easily detected. At this time, it can be determined that the first verification result is that the data set functions of the watermark sample data and the target sample data set are the same, that is, the watermark information is successfully hidden in the target sample data set, where γ is the watermark rate and γ′ is the preset watermark rate; when the watermark rate does not satisfy γ<γ′, that is, γ≥γ′, it indicates that the watermark information is not sufficiently anonymized on the target sample data set and is easily detected. At this time, it is determined that the first verification result is that the data set functions of the watermark sample data and the target sample data set are different; therefore, this judgment standard can effectively distinguish whether the watermark information is sufficiently anonymized on the target sample data set. .

[0071] S4: Perform a second verification based on the benign sample data set and the watermark sample data set to obtain a second verification result; or perform a third verification based on the watermark sample data set to obtain a third verification result; the second verification result and the third verification result are used to determine whether the watermark sample data set is infringed, including:

[0072] Before conducting the second or third verification, it is also necessary to determine the target data and data type of the model to be verified by the data protection party. The model to be verified is for the data protection party to confirm whether the model is trained using the infringed data set, that is, to determine whether the watermark sample data set is infringed.

[0073] When the data type is the first data type, it means that the data protection party can obtain the predicted probability vector of the input sample, that is, the predicted probability vector of the model to be detected. At this time, in order to check whether there is a hidden backdoor, the data protection party only needs to verify whether the posterior probability of the watermark sample data set on the target category is significantly higher than that of the benign sample data set. Therefore, the second verification is performed on the model to be verified. The specific process is as follows:

[0074] Assume the target label is y t , variable X does not have the target label y t The benign sample data set, variable X′ is a variable with target label y t The watermark sample dataset, where the target label y tis the label that identifies the watermark information; the posterior probabilities of the benign sample data set X and the watermark sample data set X′ on the target label are predicted respectively, and the benign sample data set X on the target label y t The predicted probability on is determined as the first predicted probability The watermark sample dataset X′ is placed on the target label y t The predicted probability on is determined as the second predicted probability

[0075] Given the null hypothesis When the null hypothesis H 0 When established, the first predicted probability Less than or equal to the second predicted probability At this time, the model to be verified is trained on the watermark sample data set, that is, the second verification result is that the watermark sample data set is not infringed; when the null hypothesis H 0 When it is not true, the first predicted probability Greater than the second predicted probability At this time, the model to be verified is not trained on the watermark sample data set, that is, the second verification result is that the watermark sample data set is infringed.

[0076] When performing the second verification on the model to be tested, the data protection party randomly selects m samples without the target label y t The benign sample data set is subjected to a one-tailed paired T test and its p-value is calculated; if the p-value is less than the significance level α, the null hypothesis H 0 Established; further, the data protection party also calculates the confidence score, the calculation formula of which is: Wherein Δ is the confidence score; the confidence score is used to indicate the confidence level of the second verification of the model to be detected. The larger the confidence score, the more credible the second verification result.

[0077] When the data type is the second data type, it means that the data protection party can only obtain the predicted label. In this case, the only way to identify the hidden backdoor is to check whether the predicted label of the watermark sample dataset is the target label. The target label here is not the real label, so the third verification is performed on the verification model. The specific process is as follows:

[0078] Assume the target label is y t , variable X is the data set used for training the model to be tested, and variable X′ is the variable with target label y t The watermark sample dataset, where the target label y t is a label to identify the watermark information; the labels of the dataset X and the watermark sample dataset X′ used for training the detection model are predicted respectively, the predicted label of the benign sample dataset X is determined as the first predicted label C(X), and the predicted label of the watermark sample dataset X′= is determined as the second predicted label C(X′).

[0079] Given the null hypothesis H 0 :C(X)=C(X′), when the null hypothesis H 0 When the first predicted label C(X) is established, the first predicted label C(X) is the same as the second predicted label C(X′). At this time, the model to be verified is trained on the watermark sample data set, that is, the third verification result is that the watermark sample data set is not infringed. When the null hypothesis H 0 When it is not true, that is, the first predicted label C(X) is different from the second predicted label C(X′), the model to be verified is not trained on the watermark sample dataset, that is, the third verification result is that the watermark sample dataset is infringed.

[0080] When performing the third verification on the model to be tested, the data protection party randomly selects m samples without the target label y t The benign sample data set is subjected to Wilcoxon test and its p-value is calculated; if the p-value is less than the significance level α, the null hypothesis H 0 Established; further, due to the mechanism of the Wilcoxon test, when the data protection party can only obtain the predicted label, the data protection party needs to convert the target label y t Set it close to K / 2. If the target label y t When the watermark rate is not high enough, that is, the watermark information cannot be detected, it may be impossible to detect whether the watermark sample data set is infringed.

[0081] Here, the K / 2 position refers to an intermediate position in the data set or label value range; the target label y t is set close to this middle value to ensure a balanced distribution of labels, thus facilitating subsequent statistical tests and analysis. t If y is too small or too large, especially in the extreme value area, the accuracy of watermark detection may be affected due to sample imbalance or label distribution deviation. Therefore, in order to ensure the effectiveness of detection and the recognition ability of watermark information, the target label y t Setting it close to K / 2 can help reduce the interference of extreme values ​​on the test results.

[0082] The present invention also provides a computer device, comprising a processor and a memory, wherein the memory stores at least one instruction, at least one program, a code set or an instruction set, and the at least one instruction, at least one program, a code set or an instruction set is loaded and executed by the processor to implement the above-mentioned data set verification method.

[0083] The processor can be a central processing unit (CPU), or other general-purpose processors, digital signal processors (DSP), application-specific integrated circuits (ASIC), field-programmable gate arrays (FPGA) or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, etc.

[0084] The memory can be used to store the computer program or module, and the processor implements various functions of the data set verification method by running or executing the computer program or module stored in the memory, and calling the data stored in the memory. The memory can mainly include a program storage area and a data storage area, wherein the program storage area can store an operating system, at least one application required for a function, etc.; the data storage area can store data created according to the use of the mobile phone, etc. In addition, the memory can include a high-speed random access memory, and can also include a non-volatile memory, such as a hard disk, a memory, a plug-in hard disk, a smart memory card (Smart Media Card, SMC), a secure digital (Secure Digital, SD) card, a flash card (Flash Card), at least one disk storage device, a flash memory device, or other volatile solid-state storage devices.

[0085] The above are only preferred embodiments of the present application and are not intended to limit the present application. Any modifications, equivalent substitutions, improvements, etc. made within the spirit and principles of the present application should be included in the protection scope of the present application.

Claims

1. A data set verification method for backdoor watermark technology, characterized in that: include: Divide the sample data set into a target sample data set and a benign sample data set; Embedding watermark information into the target sample data set to determine the watermark sample data set; Performing a first verification on the watermark information to obtain a first verification result; The first verification result is used to determine whether the data set functions of the watermark sample data set and the target sample data set are the same; Performing a second verification based on the benign sample data set and the watermark sample data set to obtain a second verification result; Or, a third verification is performed based on the watermark sample data set to obtain a third verification result; the second verification result and the third verification result are used to determine whether the watermark sample data set is infringed.

2. According to the data set verification method of the backdoor watermark technology of claim 1, it is characterized in that: Before dividing the sample data set into the target sample data set and the benign sample data set, the method further includes: determining a data protection party and a data infringement party; The data protection party is used to: Embedding the watermark information into the target sample data set; When the data infringer infringes the watermark sample data set, the watermark sample data set is verified.

3. According to the data set verification method of the backdoor watermark technology of claim 1, it is characterized in that: The performing a first verification on the watermark information to obtain a first verification result includes: Determining a model trained on the benign sample data set as a benign model; Determine a model trained on the watermark sample data set as a watermark model; The first verification result is determined according to the benign model and the watermark model.

4. According to the data set verification method of the backdoor watermark technology of claim 3, it is characterized in that: The determining the first verification result according to the benign model and the watermark model includes: Determining the benign accuracy rate of the benign model as a first benign accuracy rate; Determining the benign accuracy rate of the watermark model as a second benign accuracy rate; According to the first benign accuracy rate and the second benign accuracy rate, it is determined whether the watermark information damages the target sample data set.

5. According to the data set verification method of the backdoor watermark technology of claim 4, it is characterized in that: The determining the first verification result according to the benign model and the watermark model further includes: When the watermark information does not damage the target sample data set, determining the prediction behavior of the benign model as the first prediction behavior, and determining the prediction behavior of the watermark model as the second prediction behavior; Determining whether the watermark information is detected on the watermark sample data set according to the first prediction behavior and the second prediction behavior; When the watermark information damages the target sample data set, the first verification result is that the data set functions of the watermark sample data set and the target sample data set are different.

6. According to the data set verification method of the backdoor watermark technology of claim 5, it is characterized in that: The determining the first verification result according to the benign model and the watermark model further includes: When the watermark information is detected on the watermark sample data set, determining a watermark rate according to the benign sample data set and the watermark sample data set; Determining whether the watermark information is hidden on the target sample data set according to the watermark rate; When the watermark information is not detected on the watermark sample data set, the first verification result is that the data set functions of the watermark sample data set and the target sample data set are different; When the watermark rate is greater than a preset watermark rate, the first verification result is that the data set functions of the watermark sample data set and the target sample data set are different; When the watermark rate is less than or equal to the preset watermark rate, the first verification result is that the data set functions of the watermark sample data set and the target sample data set are the same.

7. The data set verification method of the backdoor watermark technology according to claim 2 is characterized in that: Before performing the second verification or the third verification, the method further includes: Determine the target data and data type for the data protection party to obtain the model to be verified; When the data type is the first data type, performing the second verification on the model to be verified, and determining the second verification result; When the data type is the second data type, the third verification is performed on the model to be verified to determine the third verification result.

8. The data set verification method of the backdoor watermark technology according to claim 7 is characterized in that: When the data type is the first data type, performing the second verification on the model to be verified and determining the second verification result includes: Determining the predicted probability of the benign sample data set on the target label as a first predicted probability; Determining the predicted probability of the watermark sample data set on the target label as a second predicted probability; When the first prediction probability is less than or equal to the second prediction probability, the model to be verified is obtained by training on the watermark sample data set, and the second verification result is that the watermark sample data set is not infringed; When the first prediction probability is greater than the second prediction probability, the model to be verified is not trained on the watermark sample data set, and the second verification result is that the watermark sample data set is infringed.

9. The data set verification method of the backdoor watermark technology according to claim 7 is characterized in that: When the data type is the second data type, performing the third verification on the model to be verified and determining the third verification result includes: Determine the predicted label of the data set for generating the model to be verified as the first predicted label; Determining the predicted label of the watermark sample data set as a second predicted label; When the first predicted label is the same as the second predicted label, the model to be verified is trained on the watermark sample data set, and the third verification result is that the watermark sample data set is not infringed; When the first predicted label is different from the second predicted label, the model to be verified is not trained on the watermark sample data set, and the third verification result is that the watermark sample data set is infringed.

10. A computer device, characterized in that: The computer device includes a processor and a memory, wherein the memory stores at least one instruction, at least one program, a code set or an instruction set, and the at least one instruction, at least one program, a code set or an instruction set is loaded and executed by the processor to implement the data set verification method as described in any one of claims 1 to 9.

Images