CNN image classification model similarity calculation method based on multi-dimensional feature fingerprints

Abstract

The invention discloses a CNN image classification model similarity calculation method based on multi-dimensional feature fingerprints, and the method comprises the steps: extracting static parameter fingerprint features (weight matrixes and bias vectors) and dynamic output fingerprint features (convolution kernel output, convolution layer output and model output) of an original CNN image classification model and a pirated CNN image classification model; a unique CNN image classification model fingerprint is formed, and a CNN image classification model similarity judgment mechanism is provided according to the fingerprint and can be used for CNN image classification model traceability comparison analysis. According to the method, the fingerprints of the CNN image classification model can be extracted through a CNN image classification model fingerprint extraction technology, and whether the pirated CNN image classification model plagiarizes the original CNN image classification model or not is judged based on the extracted fingerprints, so that a reliable method is provided for intellectual property protection of the CNN image classification model.

Description

Technical Field

[0001] The present invention belongs to the field of artificial intelligence model security, and specifically relates to a method for calculating the similarity of a CNN image classification model based on multi-dimensional feature fingerprints. Background Art

[0002] Convolutional Neural Network (CNN) is an artificial intelligence model designed for processing grid-structured data (such as images). CNN uses local perception, weight sharing and downsampling characteristics to automatically extract effective features from data and is widely used in tasks such as image classification and target detection. CNN image classification models, especially those with large parameter scale and excellent performance, are usually costly and require a large amount of data, advanced algorithms and powerful computing power. Once these models are leaked or stolen, they may cause huge economic losses to the model owners. Therefore, studying the traceability algorithm of CNN image classification models and evaluating the credibility of their sources is one of the key steps to ensure the security of artificial intelligence. Tracing technology can effectively solve problems such as model abuse, theft, responsibility tracking and compliance. By tracking the source and use of the model, it can ensure that intellectual property rights are not infringed. Current traceability technologies mainly include feature fingerprinting and watermarking methods. However, existing model traceability technologies still face many challenges in practical applications.

[0003] The existing model traceability technology has the following problems:

[0004] 1. It is difficult to select appropriate model features and express them.

[0005] 2. It has poor robustness against various existing model attacks.

[0006] 3. The evaluation dimension of model features is too single. Summary of the invention

[0007] The present invention aims to solve the deficiencies of the above-mentioned prior art and proposes a method for calculating the similarity of CNN image classification models based on multi-dimensional feature fingerprints, so as to effectively measure the similarity between two CNN image classification models while protecting the performance of the CNN image classification model, and identify the infringement of the original CNN image classification model by the attacker, thereby providing a reliable method for the intellectual property protection of the CNN image classification model.

[0008] In order to achieve the above-mentioned purpose, the present invention adopts the following technical scheme:

[0009] The method for calculating the similarity of a CNN image classification model based on multi-dimensional feature fingerprints of the present invention is characterized in that it is performed according to the following steps:

[0010] Step 1: Obtain the original CNN image classification model M1 provided by the copyright owner; obtain the pirated CNN image classification model M2 that the copyright owner believes infringes the copyright of the original CNN image classification model M1;

[0011] Step 2: Extract static feature fingerprints of M1 and M2 respectively;

[0012] Step 2.1: Record the original CNN image classification model M1 Layer weight matrix and the bias vector , There are no weights or biases in the layer, so or is 0, thus obtaining the weight matrix sequence of M1 and the bias vector sequence ;in, Indicates the total number of layers of M1;

[0013] Step 2.2: Follow the process of step 2.1 to get the weight matrix sequence of M2 and the bias vector sequence ;in, Indicates the first The layer weight matrix, Indicates the first layer bias vector;

[0014] Step 2.3: Calculation and The mean square error between , Reverse Euclidean distance , cosine similarity , JS divergence ;

[0015] Step 2.4: Calculation and The mean square error between , Reverse Euclidean distance , cosine similarity , JS divergence ;

[0016] Step 3: Extract dynamic feature fingerprints of M1 and M2;

[0017] Step 3.1: Get a set of preprocessed image samples ,in, After preprocessing image samples; J represents the total number of image samples; let The category label is recorded as ;

[0018] Step 3.2: They are input into the original CNN image classification model M1 and the pirated CNN image classification model M2 for processing, and the corresponding M1 In the convolutional layer The image feature map output by the convolution kernel , Image Activation Map and M2 In the convolutional layer The image feature map output by the convolution kernel , Image Activation Map , thus obtaining the first The image feature map sequence output by the convolutional layer , Image Activation Map Sequence and M2 The image feature map sequence output by the convolutional layer , Image Activation Map Sequence ; Then we get the category probability distribution of the output layer of M1 And the category probability distribution of the output layer of M2 ; Finally, we get the predicted category label output by M1 and the predicted category label output by M2 ;in, Indicates the output of M1 The predicted class label of Indicates the output of M2 The predicted class label of

[0019] Step 3.3: Calculation and The convolution kernel feature distance between as well as and The convolution kernel activation distance between , thus obtaining M1 and M2 The mean distance between convolutional kernel features And the mean activation distance of the convolution kernel ; The total mean of the convolution kernel feature distance between M1 and M2 And the total mean of the convolution kernel activation distance ;

[0020] calculate and The convolutional layer feature distance between as well as and The convolutional layer activation distance between , thus obtaining the mean convolutional layer feature distance between M1 and M2 And the mean activation distance of the convolutional layer ;

[0021] calculate and Output JS divergence between ;

[0022] Step 3.4: Conduct adversarial attacks and generate adversarial image sample sets ;in, Indicates Zhang adversarial image samples;

[0023] Step 3.5: Input into M1 and M2 for processing respectively, and finally obtain the adversarial prediction category label output by M1 And the adversarial prediction category label output by M2 ;in, Indicates the output of M1 The adversarial predicted class label of Indicates the output of M2 Adversarial prediction class labels of

[0024] Step 3.6: Compare and , we get the robustness representation of M1 ;

[0025] Compare and , we get the robustness representation of M2 ;

[0026] Step 4: Calculate static feature similarity ;

[0027] Step 5: Calculate dynamic feature similarity ;

[0028] Step 6: Use formula (8) to calculate the total similarity representation :

[0029] (8)

[0030] In formula (8), 'and They are and The corresponding weights, and ;

[0031] Step 7: If , then it is considered that M2 is derived from the original CNN image classification model M1 and infringes the copyright of M1 of the copyright owner; otherwise, it means that the copyright of M1 of the copyright owner is not infringed.

[0032] The method for calculating the similarity of a CNN image classification model based on multi-dimensional feature fingerprints described in the present invention is also characterized in that the step four is performed according to the following steps:

[0033] Step 4.1: Use formula (1) to calculate the weight matrix similarity of M1 and M2 :

[0034] (1)

[0035] In formula (1), , , and They are , , and The corresponding weights, and , is to take the larger value;

[0036] Step 4.2: Use formula (2) to calculate the bias vector similarity between M1 and M2 :

[0037] (2)

[0038] In formula (2), , , and They are , , and The corresponding weights, and ;

[0039] Step 4.3: Use formula (3) to calculate the total similarity of static feature fingerprints of M1 and M2 :

[0040] (3)

[0041] In formula (3), and They are and The corresponding weights, and .

[0042] Further, the step 5 is performed as follows:

[0043] Step 5.1: Construct indicator vector , and then use formula (4) to calculate the dynamic feature similarity between M1 and M2 :

[0044] (4)

[0045] In formula (4), Represents the index tensor Euclidean distance to a tensor of all zeros;

[0046] Step 5.2: Use equation (5) to calculate the model output JS divergence similarity between M1 and M2 :

[0047] (5)

[0048] Step 5.3: Calculate the robust similarity between M1 and M2 using equation (6) :

[0049] (6)

[0050] In formula (6), Represents the absolute value of the difference between the two;

[0051] Step 5.4: Use formula (7) to calculate the total similarity of dynamic feature fingerprints of M1 and M2 :

[0052] (7).

[0053] An electronic device of the present invention includes a memory and a processor, wherein the memory is used to store a program that supports the processor to execute the calculation method, and the processor is configured to execute the program stored in the memory.

[0054] The present invention provides a computer-readable storage medium, wherein a computer program is stored on the computer-readable storage medium, and the computer program executes the steps of the calculation method when executed by a processor.

[0055] Compared with the prior art, the beneficial effects of the present invention are as follows:

[0056] 1. The present invention utilizes model fingerprint technology, which better preserves the original performance of the CNN image classification model than the model watermark technology.

[0057] 2. Starting from the static parameters of the CNN image classification model, the present invention proposes to compare the similarity of the static parameters of the CNN image classification model by combining four indicators: mean square error, cosine similarity, JS divergence and inverse Euclidean distance, so as to comprehensively capture the differences between the model parameters and avoid the limitations brought by a single measurement indicator.

[0058] 3. The present invention proposes to compare the similarity of the CNN image classification model in the dynamic output process by comparing the convolution kernel of the CNN image classification model and the image feature map and image activation map output by the convolution layer, so as to quantify the differences between different image classification CNN models in their most core convolution operations.

[0059] 4. The present invention proposes a method based on the combination of static fingerprint and dynamic fingerprint of CNN image classification model, which performs a comprehensive similarity evaluation on the static feature fingerprint and dynamic feature fingerprint of the model, and quantifies the similarity results through a judgment mechanism, thereby performing a more comprehensive evaluation of the similarity of the CNN image classification model.

[0060] 5. The present invention proposes a CNN image classification model similarity determination mechanism, which can quantify the static feature similarity, dynamic feature similarity and total similarity of the CNN image classification model, and more intuitively show the similarity between the original CNN image classification model and the pirated CNN image classification model.

[0061] 6. The present invention demonstrates high accuracy and robustness in the face of various model attacks such as model fine-tuning, model pruning and model stealing. BRIEF DESCRIPTION OF THE DRAWINGS

[0062] Figure 1 is a flow chart of the method of the present invention;

[0063] Figure 2 This is a graph of experimental results of calculating the similarity of ResNet18 related models in the present invention. DETAILED DESCRIPTION

[0064] In this embodiment, a method for calculating the similarity of a CNN image classification model based on a multi-dimensional feature fingerprint is to extract the static parameter fingerprint features (weights, biases) and dynamic output fingerprint features (convolution kernel output, convolution layer output, model output) of the CNN image classification model to obtain a unique CNN image classification model fingerprint, and then use a model similarity determination mechanism to quantify the model similarity for CNN image classification model copyright protection. Specifically, Figure 1 As shown, the method is performed in the following steps:

[0065] Step 1: Obtain the original CNN image classification model M1 provided by the copyright owner; obtain the pirated CNN image classification model M2 that the copyright owner believes infringes the copyright of the original CNN image classification model M1; Figure 1 As shown in the figure, the pirated CNN image classification model M2 may be obtained by the attacker after fine-tuning, pruning or stealing the original CNN image classification model M1. These three methods are currently the most common methods to threaten model copyright.

[0066] Step 2: Extract the static feature fingerprints of M1 and M2 respectively; Figure 1 As shown, after the model is input, feature extraction is performed, wherein the steps for extracting static feature fingerprints are as follows:

[0067] Step 2.1: Record the original CNN image classification model M1 Layer weight matrix and the bias vector , There are no weights or biases in the layer, so or is 0, thus obtaining the weight matrix sequence of M1 and the bias vector sequence ;in, Indicates the total number of layers of M1, Indicates the first The layer weight matrix, Indicates the first layer bias vector;

[0068] Step 2.2: Follow the process of step 2.1 to get the weight matrix sequence of M2 and the bias vector sequence ;in, Indicates the first The layer weight matrix, Indicates the first layer bias vector;

[0069] Step 2.3: Calculation and The mean square error between , Reverse Euclidean distance , cosine similarity , JS divergence In this embodiment, formula (9) is used to calculate and The mean square error between , using formula (10) to calculate and The inverse Euclidean distance between , using formula (11) to calculate and The cosine similarity between ; (These characters do not correspond to the characters at the beginning of the formula) (Solved)

[0070] (9)

[0071] (10)

[0072] (11)

[0073] In formula (9), formula (10) and formula (11), and Represents the first layer weight matrix;

[0074] Will and Convert to the corresponding probability distribution. Softmax is a commonly used method to convert vectors into probability distributions. It is integrated into Python's SciPy library and can be called directly. Then use formula (12) to calculate and JS divergence between corresponding probability distributions :

[0075] (12)

[0076] In formula (12), yes The corresponding probability distribution is, yes The corresponding probability distribution is, yes and The average distribution of (,) is the KL divergence calculation formula.

[0077] Step 2.4: Calculate according to the process of step 2.3 and The mean square error between , Reverse Euclidean distance , cosine similarity , JS divergence In this embodiment, according to formula (9) and The mean square error between , calculated according to formula (10) and The inverse Euclidean distance between , calculated according to formula (11) and The cosine similarity between ;

[0078] Will and After being converted into the corresponding probability distribution, it is calculated according to formula (12) and JS divergence between corresponding probability distributions ;

[0079] Step 3: Extract dynamic feature fingerprints of M1 and M2;

[0080] Step 3.1: Get a set of preprocessed image samples ,in, After preprocessing image samples; J represents the total number of image samples; let The category label is recorded as ; In this example, 100 images are randomly selected from CIFAR-10 to construct input samples. First, these 100 images are converted from unit8 type to float32 type, then the pixel values ​​are normalized from [0, 255] to [0, 1], and finally the 10 labels in CIFAR-10 are converted to one-hot encoding.

[0081] Step 3.2: They are input into the original CNN image classification model M1 and the pirated CNN image classification model M2 for processing, and the corresponding M1 In the convolutional layer The image feature map output by the convolution kernel , Image Activation Map and M2 In the convolutional layer The image feature map output by the convolution kernel , Image Activation Map , thus obtaining the first The image feature map sequence output by the convolutional layer , Image Activation Map Sequence and M2 The image feature map sequence output by the convolutional layer , Image Activation Map Sequence ; Then we get the category probability distribution of the output layer of M1 And the category probability distribution of the output layer of M2 ; Finally, we get the predicted category label output by M1 and the predicted category label output by M2 ;in, Indicates the output of M1 The predicted class label of Indicates the output of M2 The predicted class label of .

[0082] Step 3.3: Calculate using formula (13) and The convolution kernel feature distance between , and use formula (14) to calculate and The convolution kernel activation distance between , thus obtaining M1 and M2 The mean distance between convolutional kernel features And the mean activation distance of the convolution kernel ; The total mean of the convolution kernel feature distance between M1 and M2 And the total mean of the convolution kernel activation distance ;:

[0083] (13)

[0084] In formula (13), and Represents input After that, M1 and M2 In the convolutional layer The image feature map output by the convolution kernel, express The Euclidean distance from a tensor of all zeros, express The Euclidean distance to the all-zero tensor; Euclidean distance is the most basic distance metric, defined as the length of a straight line between two points in n-dimensional space;

[0085] (14)

[0086] In formula (14), and Represents input After that, M1 and M2 In the convolutional layer The image activation map output by the convolution kernel; express The Euclidean distance from a tensor of all zeros, express The Euclidean distance to a tensor filled with all zeros.

[0087] Calculate using formula (15) and The convolutional layer feature distance between , and use formula (16) to calculate and The convolutional layer activation distance between , thus obtaining the mean convolutional layer feature distance between M1 and M2 And the mean activation distance of the convolutional layer ;

[0088] (15)

[0089] In formula (15), and Represents input After that, M1 and M2 The sequence of image feature maps output by the convolutional layers; express The Euclidean distance from a tensor of all zeros, express The Euclidean distance to a tensor of all zeros;

[0090] (16)

[0091] In formula (16), and Represents input After that, M1 and M2 The sequence of image activation maps output by the convolutional layers; express The Euclidean distance from a tensor of all zeros, express The Euclidean distance to a tensor filled with all zeros.

[0092] According to formula (12), and Output JS divergence between .

[0093] Step 3.4: Conduct adversarial attacks and generate adversarial image sample sets ;in, Indicates In this example, the adversarial attack method uses the FGSM method, which is a basic adversarial attack method and is widely used.

[0094] Step 3.5: Input into M1 and M2 for processing respectively, and finally obtain the adversarial prediction category label output by M1 And the adversarial prediction category label output by M2 ;in, Indicates the output of M1 The adversarial predicted class label of Indicates the output of M2 Adversarial prediction class labels of

[0095] Step 3.6: Compare and , we get the robustness representation of M1 Specifically, if and If they are not the same, the attack is considered successful. and , statistics are different and The total number, recorded as ;

[0096] Compare and , we get the robustness representation of M2 ; Statistics similar to , traverse and , statistics are different and The total number, recorded as .

[0097] Step 4: If Figure 1 As shown, after the feature fingerprint is extracted, feature processing is required, and then the model similarity calculation is performed. The specific steps for calculating the similarity of static feature fingerprints are:

[0098] Step 4.1: Use formula (17) to calculate the weight matrix similarity of M1 and M2 :

[0099] (17)

[0100] In formula (17), , , and They are , , and The corresponding weights, and , is to take a larger value; by combining multiple different similarity metrics, the differences between model parameters can be fully captured, thus avoiding the limitations of a single indicator; in this example, , , more emphasis is placed on the model weight matrix itself, reducing the error impact caused by the transformation of the weight matrix into the corresponding distribution.

[0101] Step 4.2: Use equation (18) to calculate the bias vector similarity between M1 and M2 :

[0102] (18)

[0103] In formula (18), , , and They are , , and The corresponding weights, and In this example, , ; More emphasis is placed on the model weight matrix itself, reducing the error impact caused by the transformation of the weight matrix into the corresponding distribution.

[0104] Step 4.3: Use formula (19) to calculate the total similarity of static feature fingerprints of M1 and M2 :

[0105] (19)

[0106] In formula (19), and They are and The corresponding weights, and In this example, , The weight set by the weight matrix is ​​higher than that of the bias vector because the weight matrix is ​​the main source of the characteristics and capabilities of the CNN image classification model and has more parameters, while the bias vector is used for auxiliary purposes and has fewer parameters.

[0107] Step 5: If Figure 1 As shown, after the feature fingerprint is extracted, feature processing is required, and then the model similarity calculation is performed. The specific steps for calculating the similarity of dynamic feature fingerprints are:

[0108] Step 5.1: Construct indicator vector , and then use formula (20) to calculate the dynamic feature similarity between M1 and M2 :

[0109] (20)

[0110] In formula (20), Represents the index tensor Euclidean distance to a tensor of all zeros.

[0111] Step 5.2: Use equation (21) to calculate the model output JS divergence similarity between M1 and M2 :

[0112] (twenty one)

[0113] Step 5.3: Calculate the robust similarity between M1 and M2 using equation (22) :

[0114] (twenty two)

[0115] In formula (22), Represents the absolute value of the difference between the two.

[0116] Step 5.4: Use formula (23) to calculate the total similarity of dynamic feature fingerprints of M1 and M2 :

[0117] (twenty three)

[0118] Step 6: Use formula (24) to calculate the total similarity representation :

[0119] (twenty four)

[0120] In formula (24), 'and They are and The corresponding weights, and In this example, , ; Evenly distribute the weights of static and dynamic feature fingerprints, so as to balance the similarity of the model in both static and dynamic dimensions.

[0121] Step 7: If , then M2 is considered to be derived from the original CNN image classification model M1 and infringes the copyright of the copyright owner's M1; otherwise, it means that the copyright of the copyright owner's M1 is not infringed. Among them, It can be set according to the specific situation. In this example, Set to 60%.

[0122] In this embodiment, an electronic device includes a memory and a processor, wherein the memory is used to store a program that supports the processor to execute the above method, and the processor is configured to execute the program stored in the memory.

[0123] In this embodiment, a computer-readable storage medium stores a computer program on the computer-readable storage medium, and the computer program executes the steps of the above method when executed by a processor.

[0124] like Figure 2 As shown, It is represented by a dotted line. JBA on the horizontal axis represents the pirated model obtained by using the Jacobian-Based Augmentation method to steal the ResNet18 model. ESA represents the pirated model obtained by using the evolution strategy method to steal the ResNet18 model. FTAL represents the pirated model obtained by fine-tuning the parameters of all layers of the ResNet18 model. FTLL represents the pirated model obtained by fine-tuning the parameters of the last layer of the ResNet18 model. RTAL represents the pirated model obtained by reinitializing the parameters of the last layer of the ResNet18 model and then fine-tuning the parameters of all layers. The pirated model, Pr0.6 represents the pirated model obtained by retraining after pruning 60% of the parameters of the ResNet18 model, Pr0.2 represents the pirated model obtained by retraining after pruning 20% ​​of the parameters of the ResNet18 model, ResNet34 and ResNet50 are the same series of models proposed by researchers of the ResNet18 model, AlexNet is a milestone model of image classification CNN, the vertical axis represents the model similarity between the above models and the ResNet18 model calculated under this method, the results show that the model similarity (i.e. Figure 2 The vertical axis) exceeded 60% and was considered to be infringing; AlexNet, which has a completely different design concept from ResNet18, did not reach 60% and was considered to be non-infringing.

Claims

1. A method for calculating the similarity of a CNN image classification model based on multi-dimensional feature fingerprints, characterized in that: Proceed as follows: Step 1: Obtain the original CNN image classification model M1 provided by the copyright owner; obtain the pirated CNN image classification model M2 that the copyright owner believes infringes the copyright of the original CNN image classification model M1; Step 2: Extract static feature fingerprints of M1 and M2 respectively; Step 2.1: Record the original CNN image classification model M1 Layer weight matrix and the bias vector , There are no weights or biases in the layer, so or is 0, thus obtaining the weight matrix sequence of M1 and the bias vector sequence ;in, Indicates the total number of layers of M1; Step 2.2: Follow the process of step 2.1 to get the weight matrix sequence of M2 and the bias vector sequence ;in, Indicates the first The layer weight matrix, Indicates the first layer bias vector; Step 2.3: Calculation and The mean square error between , Reverse Euclidean distance , cosine similarity , JS divergence ; Step 2.4: Calculation and The mean square error between , Reverse Euclidean distance , cosine similarity , JS divergence ; Step 3: Extract dynamic feature fingerprints of M1 and M2; Step 3.1: Get a set of preprocessed image samples ,in, After preprocessing image samples; J represents the total number of image samples; let The category label is recorded as ; Step 3.2: They are input into the original CNN image classification model M1 and the pirated CNN image classification model M2 for processing, and the corresponding M1 In the convolutional layer The image feature map output by the convolution kernel , Image Activation Map and M2 In the convolutional layer The image feature map output by the convolution kernel , Image Activation Map , thus obtaining the first The image feature map sequence output by the convolutional layer , Image Activation Map Sequence and M2 The image feature map sequence output by the convolutional layer , Image Activation Map Sequence ; Then we get the category probability distribution of the output layer of M1 And the category probability distribution of the output layer of M2 ; Finally, we get the predicted category label output by M1 and the predicted category label output by M2 ;in, Indicates the output of M1 The predicted class label of Indicates the output of M2 The predicted class label of Step 3.3: Calculation and The convolution kernel feature distance between as well as and The convolution kernel activation distance between , thus obtaining M1 and M2 The mean distance between convolutional kernel features And the mean activation distance of the convolution kernel ; The total mean of the convolution kernel feature distance between M1 and M2 And the total mean of the convolution kernel activation distance ; calculate and The convolutional layer feature distance between as well as and The convolutional layer activation distance between , thus obtaining the mean convolutional layer feature distance between M1 and M2 And the mean activation distance of the convolutional layer ; calculate and Output JS divergence between ; Step 3.4: Conduct adversarial attacks and generate adversarial image sample sets ;in, Indicates Zhang adversarial image samples; Step 3.5: Input into M1 and M2 for processing respectively, and finally obtain the adversarial prediction category label output by M1 And the adversarial prediction category label output by M2 ;in, Indicates the output of M1 The adversarial predicted class label of Indicates the output of M2 Adversarial prediction class labels of Step 3.6: Compare and , we get the robustness representation of M1 ; Compare and , we get the robustness representation of M2 ; Step 4: Calculate static feature similarity ; Step 5: Calculate dynamic feature similarity ; Step 6: Use formula (8) to calculate the total similarity representation : (8) In formula (8), 'and They are and The corresponding weights, and ; Step 7: If , then it is considered that M2 is derived from the original CNN image classification model M1 and infringes the copyright of M1 of the copyright owner; otherwise, it means that the copyright of M1 of the copyright owner is not infringed.

2. According to claim 1, a method for calculating the similarity of a CNN image classification model based on multi-dimensional feature fingerprints is characterized in that: The step 4 is carried out as follows: Step 4.1: Use formula (1) to calculate the weight matrix similarity of M1 and M2 : (1) In formula (1), , , and They are , , and The corresponding weights, and , is to take the larger value; Step 4.2: Use formula (2) to calculate the bias vector similarity between M1 and M2 : (2) In formula (2), , , and They are , , and The corresponding weights, and ; Step 4.3: Use formula (3) to calculate the total similarity of static feature fingerprints of M1 and M2 : (3) In formula (3), and They are and The corresponding weights, and .

3. The method for calculating the similarity of a CNN image classification model based on multi-dimensional feature fingerprint according to claim 2, characterized in that: The step five is carried out as follows: Step 5.1: Construct indicator vector , and then use formula (4) to calculate the dynamic feature similarity between M1 and M2 : (4) In formula (4), Represents the index tensor Euclidean distance to a tensor of all zeros; Step 5.2: Use equation (5) to calculate the model output JS divergence similarity between M1 and M2 : (5) Step 5.3: Calculate the robust similarity between M1 and M2 using equation (6) : (6) In formula (6), Represents the absolute value of the difference between the two; Step 5.4: Use formula (7) to calculate the total similarity of dynamic feature fingerprints of M1 and M2 : (7)。 4. An electronic device, comprising a memory and a processor, characterized in that: The memory is used to store a program that supports the processor to execute the computing method described in any one of claims 1 to 3, and the processor is configured to execute the program stored in the memory.

5. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the steps of the computing method according to any one of claims 1 to 3 are executed.

Images