Model watermark adding method and device, equipment, storage medium and program product

Abstract

The invention discloses a model watermark adding method and device, equipment, a storage medium and a program product. According to the specific technical scheme, the method comprises the steps of obtaining model watermark information and a to-be-processed model; a plurality of effective operators corresponding to each operator in the to-be-processed model are generated according to the model watermark information, each effective operator corresponds to one watermark code number, and the effective operators and the operators included in the to-be-processed model have the same computational logic; determining an operator to be replaced in operators included in the model to be processed according to the model watermark information; according to the model watermark information and the watermark coding digits corresponding to the effective operators, determining a replacement operator corresponding to the operator to be replaced in the effective operators; and replacing the operator to be replaced with the replacement operator to obtain a target model. Therefore, the model watermark information is added into the operator, so that the model watermark information has relatively high modification resistance, and the to-be-verified model is conveniently verified subsequently.

Description

Technical Field

[0001] The present application belongs to the field of machine learning technology, and in particular, relates to a method, device, equipment, storage medium and program product for adding a model watermark. Background Art

[0002] With the development of artificial intelligence technology, data-driven machine learning technology has a higher accuracy in recognition and classification tasks. However, the training of machine learning models requires years of investment to obtain an efficient and stable finished model.

[0003] In order to protect the intellectual property rights of machine learning model developers, watermarks are added to the model during the development and training stages of the model. When the model is subsequently used for evidence, the watermark can be extracted from the model to be used for evidence, and the extracted watermark can be compared with the watermark implanted by the model developer to determine whether the model to be used for evidence is infringing.

[0004] Currently, model developers can embed watermarks into the weights of the model. Later in the evidence presentation stage, by comparing the weights of the model to be presented with the weights of the model trained by the model developers, it can be determined whether the model to be presented is infringing.

[0005] However, the thief can modify the model weights without changing the model performance by fine-tuning the model or model distillation. In this way, the model watermark is changed, and the model weights cannot be used to effectively determine whether the model to be proved is an infringing model. Summary of the invention

[0006] The embodiments of the present application provide a method, apparatus, device, storage medium and program product for adding a model watermark, which adds model watermark information to an operator so that the model watermark information has a high resistance to modification, facilitating subsequent verification of the model to be verified.

[0007] In a first aspect, an embodiment of the present application provides a method for adding a model watermark, comprising:

[0008] Get model watermark information and the model to be processed;

[0009] Generating multiple valid operators corresponding to each operator in the model to be processed according to the model watermark information, each valid operator corresponds to a watermark coding number, and the calculation logic of the valid operator is the same as that of the operator included in the model to be processed;

[0010] Determining, according to the model watermark information, an operator to be replaced among operators included in the model to be processed;

[0011] According to the model watermark information and the watermark coding number corresponding to the valid operator, determining the replacement operator corresponding to the operator to be replaced in the valid operators;

[0012] The operator to be replaced is replaced with the replacement operator to obtain a target model.

[0013] In a possible implementation, the step of obtaining model watermark information and a model to be processed includes:

[0014] Obtaining a preset base number and a model identifier corresponding to the model to be processed;

[0015] The model identifier is converted into the preset base number to obtain the model watermark information.

[0016] In a possible implementation, converting the model identifier into the preset base number to obtain the model watermark information includes:

[0017] Convert the model identifier into a preset base number to obtain a watermark code;

[0018] Redundant error correction coding is performed on the watermark code to obtain the model watermark information.

[0019] In a possible implementation, the step of generating, according to the model watermark information, a plurality of valid operators corresponding to each operator in the to-be-processed model includes:

[0020] For the operators included in the model to be processed, generating multiple valid operators corresponding to the operators according to the preset base number;

[0021] For each valid operator, a correspondence between the operator name of the valid operator and the watermark encoding number is constructed.

[0022] In a possible implementation manner, determining the operator to be replaced from the operators included in the model to be processed according to the model watermark information includes:

[0023] Based on the operators included in the model to be processed, construct a first directed acyclic graph corresponding to the model to be processed;

[0024] Traversing the first directed acyclic graph to obtain a first arrangement order of operators included in the model to be processed;

[0025] The operator to be replaced is selected from the operators included in the model to be processed according to the number of encoding bits of the model watermark information and the first arrangement order.

[0026] In a possible implementation, the method further includes:

[0027] For the operators included in the model to be processed, multiple invalid operators corresponding to the operators are generated, and the calculation logic of the invalid operators is the same as that of the operators.

[0028] In a possible implementation manner, determining the operator to be replaced from the operators included in the model to be processed according to the model watermark information includes:

[0029] Replacing the preset replacement operator in the to-be-processed model with an invalid operator corresponding to the preset replacement operator to obtain a first model;

[0030] Based on the invalid operators in the first model, construct a second directed acyclic graph corresponding to the first model;

[0031] Traversing the second directed acyclic graph to obtain a second arrangement order of invalid operators included in the first model;

[0032] The operator to be replaced is selected from the invalid operators included in the first model according to the number of encoding bits of the model watermark information and the second arrangement order.

[0033] In a possible implementation, determining, in the valid operators, a replacement operator corresponding to the operator to be replaced according to the model watermark information and the watermark code number corresponding to the valid operators, includes:

[0034] For each operator to be replaced, obtain a valid operator corresponding to the operator to be replaced;

[0035] Determine the target watermark code number corresponding to each to-be-replaced operator according to the order of the digital codes in the model watermark information;

[0036] For each operator to be replaced, according to the correspondence between the valid operator and the watermark coding number, determine the target valid operator corresponding to the target watermark coding number;

[0037] For each operator to be replaced, the target valid operator is used as the replacement operator corresponding to the operator to be replaced.

[0038] In a possible implementation, determining the target watermark code number corresponding to each to-be-replaced operator according to the order of the digital codes in the model watermark information and the first arrangement order includes:

[0039] Obtaining an operator sequence of the model to be processed according to the first arrangement order;

[0040] An operator to be replaced corresponding to each digital code is selected from the operator sequence, and the arrangement order of the operators to be replaced is the same as the order of the digital codes.

[0041] In a possible implementation manner, after replacing the to-be-replaced operator with the replacement operator, the method further includes:

[0042] Randomly selecting an invalid operator in the model to be processed to obtain a target invalid operator;

[0043] The target invalidation operator is modified to obtain an update invalidation operator, wherein the update invalidation operator is used for outputting a target value when the input of the update invalidation operator is a preset value.

[0044] In a second aspect, an embodiment of the present application provides a device for adding a model watermark, including:

[0045] An acquisition module is used to obtain model watermark information and the model to be processed;

[0046] A generating module, used for generating a plurality of valid operators corresponding to the operators included in the model to be processed according to the model watermark information, each valid operator corresponds to a watermark coding number, and the calculation logic of the valid operator is the same as that of the operator to be replaced;

[0047] A determination module, configured to determine an operator to be replaced from among operators included in the model to be processed according to the model watermark information;

[0048] The determination module is further configured to determine a replacement operator corresponding to the operator to be replaced from among the valid operators according to the model watermark information and the watermark coding number corresponding to the valid operator;

[0049] A replacement module is used to replace the operator to be replaced with the replacement operator.

[0050] In a third aspect, an embodiment of the present application provides an electronic device, the device comprising: a processor and a memory storing computer program instructions;

[0051] When the processor executes the computer program instructions, the method for adding a model watermark as described in any one of the first aspects is implemented.

[0052] In a fourth aspect, an embodiment of the present application provides a computer-readable storage medium, on which computer program instructions are stored. When the computer program instructions are executed by a processor, the method for adding a model watermark as described in any one of the first aspects is implemented.

[0053] In a fifth aspect, an embodiment of the present application provides a computer program product. When instructions in the computer program product are executed by a processor of an electronic device, the electronic device executes the method for adding a model watermark as described in any one of the first aspects.

[0054] The embodiment of the present application provides a method, device, equipment, storage medium and program product for adding a model watermark. After obtaining the model watermark information and the model to be processed, the valid operator corresponding to each operator in the model to be processed is generated according to the model watermark information, wherein each valid operator corresponds to a watermark coding number. After determining the operator to be replaced according to the model watermark information, the watermark coding number corresponding to the operator to be replaced is determined according to the coding information in the model watermark information, and then the replacement operator corresponding to the operator to be replaced is determined. In this way, by constructing a corresponding relationship between valid operators and watermark coding numbers, the valid operator with the watermark coding number can be implanted by replacing the operator in the model to be processed, thereby realizing the watermarking of the model. Since the operator used by the model is not easy to be modified, the model watermark information is added to the operator, so that the model watermark information has a high degree of resistance to modification, which is convenient for the subsequent verification of the model to be proved. BRIEF DESCRIPTION OF THE DRAWINGS

[0055] In order to more clearly illustrate the technical solution of the embodiments of the present application, the following is a brief introduction to the drawings required for use in the embodiments of the present application. For ordinary technicians in this field, other drawings can be obtained based on these drawings without any creative work.

[0056] Figure 1 It is an exemplary schematic diagram of a black box verification method provided by the prior art;

[0057] Figure 2 It is a flowchart of a method for adding a model watermark provided in an embodiment of the present application;

[0058] Figure 3 is an exemplary schematic diagram of an operator provided in an embodiment of the present application;

[0059] Figure 4 is a flowchart of a method for determining an operator to be replaced provided in an embodiment of the present application;

[0060] Figure 5 is a flowchart of another method for determining an operator to be replaced provided in an embodiment of the present application;

[0061] Figure 6 is an exemplary schematic diagram of a method for adding a model watermark provided in an embodiment of the present application;

[0062] Figure 7 It is a flowchart of a white box verification method provided by an embodiment of the present application;

[0063] Figure 8 It is a structural schematic diagram of a device for adding a watermark provided in an embodiment of the present application;

[0064] Fig. 9It is a structural schematic diagram of an electronic device provided in yet another embodiment of the present application. DETAILED DESCRIPTION

[0065] The features and exemplary embodiments of various aspects of the present application will be described in detail below. In order to make the purpose, technical solutions and advantages of the present application clearer, the present application will be further described in detail below in conjunction with the accompanying drawings and specific embodiments. It should be understood that the specific embodiments described herein are only intended to explain the present application, rather than to limit the present application. For those skilled in the art, the present application can be implemented without the need for some of these specific details. The following description of the embodiments is only to provide a better understanding of the present application by illustrating the examples of the present application.

[0066] It should be noted that, in this article, relational terms such as first and second, etc. are only used to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Moreover, the terms "include", "comprise" or any other variants thereof are intended to cover non-exclusive inclusion, so that a process, method, article or device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, article or device. In the absence of further restrictions, the elements defined by the statement "include..." do not exclude the presence of other identical elements in the process, method, article or device including the elements.

[0067] At present, there are two main ways to use model watermarks to determine whether the model to be proved is infringing:

[0068] Method 1: Use the original input to superimpose a human-imperceptible perturbation as an adversarial sample, and train the model so that the model can recognize the adversarial sample as a special category.

[0069] like Figure 1 As shown, Figure 1 The panda image on the left is superimposed with a perturbed input model, which identifies the image as a gibbon with 99.3% confidence.

[0070] In this way, the adversarial sample and the model's misclassification are recorded. After obtaining the model to be proved, the recorded adversarial sample is input into the model to be proved, and it is observed whether the recognition result of the model to be proved is the recorded misclassification. If the recognition result of the model to be proved is the recorded misclassification, the model to be proved is an infringing model.

[0071] The inspection method provided in the above method 1 can be used to determine whether the model to be proved is an infringing model. However, when the model developer authorizes the trained model to multiple third parties for use, each third party may leak the model. In order to accurately determine the third party that leaked the model, the model developer can train a model for each third party and record the adversarial samples and misclassifications corresponding to each model. In this way, the development cost of the model is huge, and when the model is upgraded, the model needs to be trained multiple times and the adversarial samples need to be verified.

[0072] Method 2: Model developers can embed watermarks into the weight of the model. Later in the evidence presentation stage, by comparing the weight of the model to be presented with the weight of the model trained by the model developer, it can be determined whether the model to be presented is infringing.

[0073] However, the thief can modify the model weights without changing the model performance by fine-tuning the model or model distillation. In this way, the model watermark is changed, and the model watermark cannot be used to effectively determine whether the model to be proved is an infringing model.

[0074] In order to solve the problems existing in the prior art, the embodiments of the present application provide a method, device, equipment, storage medium and program product for adding a model watermark. Figure 1 A method for adding a model watermark provided in an embodiment of the present application is introduced, such as Figure 2 As shown, the method is applied to an electronic device, and the method includes:

[0075] S201. Obtain model watermark information and the model to be processed.

[0076] The model watermark information may be character information or digital code information. When the model watermark information is character information, the electronic device may convert the character information into digital code information. The specific method for converting the digital code information is not limited in the embodiment of the present application.

[0077] S202. Generate multiple valid operators corresponding to each operator in the model to be processed according to the model watermark information.

[0078] Each valid operator corresponds to a watermark coding number, and the calculation logic of the valid operator is the same as that of the operator included in the model to be processed.

[0079] Specifically, electronic devices can generate new operators in the following two ways:

[0080] The first method: for the operator in the model to be processed, the electronic device copies the operator, generates a new operator, and generates an operator name for the new operator.

[0081] The second method: the electronic device imitates the calculation logic of the operator in the model to be processed, generates a new operator, and generates an operator name for the new operator.

[0082] In addition, electronic devices can combine the computational logic of multiple operators to generate a new operator.

[0083] After the new operator is generated as described above, a corresponding relationship between the operator name of the new operator and the watermark coding number is constructed to obtain a valid operator.

[0084] The number of valid operators is determined according to the model watermark information. Specifically, the model watermark information is digital coding information, and the watermark coding numbers of the valid operators need to cover all the digital coding in the model watermark information.

[0085] In one example, if Figure 3 As shown, Figure 3 The figure shows a local graph in a machine learning model. The directed arrows indicate the direction of data flow. The operators included in the machine learning model are activation function (Relu), convolution function (Conv) and normalization function (BatchNormalization). Taking the Relu activation function as an example, Figure 3 The example shows that the type of the Relu activation function is Relu; the module is ai.onnx v6, and the name is mobilenetv20_features_linearbottleneck10_relu0_fwd. The input is x, the name of x is mobilenetv20_features_linearbottleneck10_batchnc, and the output is y, and the name of y is mobilenetv20_features_linearbottleneck10_relu0_fwd.

[0086] S203: Determine the operator to be replaced from the operators included in the model to be processed according to the model watermark information.

[0087] It can be understood that the model watermark information is digital coding information, which usually includes multiple digital codes, and each valid operator corresponds to a watermark coding number. Therefore, the electronic device determines the operator to be replaced in the model to be processed based on the number and order of digital codes in the model watermark information.

[0088] S204: Determine a replacement operator corresponding to the operator to be replaced in the valid operators according to the model watermark information and the watermark coding numbers corresponding to the valid operators.

[0089] It can be understood that each operator in the model to be processed corresponds to multiple valid operators, and each valid operator corresponds to a watermark coding number. Therefore, by selecting the replacement operator corresponding to the operator to be replaced from the valid operators, the watermark coding number corresponding to the operator to be replaced can be determined. In this way, the watermark coding number of the replacement operator in the model to be processed can construct a digital coding information, that is, the above-mentioned model watermark information.

[0090] S205: Replace the operator to be replaced with the replacement operator to obtain a target model.

[0091] According to the above method, after obtaining the model watermark information and the model to be processed, the valid operator corresponding to each operator in the model to be processed is generated according to the model watermark information, wherein each valid operator corresponds to a watermark coding number. After determining the operator to be replaced according to the model watermark information, the watermark coding number corresponding to the operator to be replaced is determined according to the coding information in the model watermark information, and then the replacement operator corresponding to the operator to be replaced is determined. In this way, by constructing the corresponding relationship between the valid operator and the watermark coding number, the valid operator with the watermark coding number can be implanted by replacing the operator in the model to be processed, thereby realizing the watermarking of the model. Since the operator used by the model is not easy to be modified, the model watermark information is added to the operator, so that the model watermark information has a high resistance to modification, which is convenient for the subsequent verification of the model to be proved.

[0092] The electronic device may obtain the model identifier of the model to be processed, and generate the model watermark information according to the model identifier. Specifically, with respect to the above S201, obtaining the model watermark information and the model to be processed may be implemented as follows:

[0093] Obtain the preset base number and the model identifier corresponding to the model to be processed. Convert the model identifier into the preset base number to obtain the model watermark information.

[0094] Among them, the preset base number is set based on experience, and the model identifier is an identifier pre-allocated by the model developer to a third party authorized to use the model.

[0095] Specifically, after obtaining the model identifier, the electronic device can convert the model identifier into digital code information of the preset base number. For example, if the model identifier is 9 and the preset base number is 8, the electronic device converts the model identifier into an octal number, and the obtained model watermark information is 11.

[0096] Among them, in order to improve the reliability of the model watermark, the electronic device can convert the model identifier into a preset base number to obtain the watermark code, and then perform redundant error correction coding on the watermark code to obtain the model watermark information. In this way, the error correction capability of the model watermark information is increased through redundant error correction coding, and the damaged watermark can be restored to a certain extent.

[0097] In an example, the redundant error correction code is a Hamming code. When the watermark code is 11, the Hamming code corresponding to the watermark code is 227.

[0098] By adopting the method provided in the embodiment of the present application, by converting the model identifier into a preset base number, a corresponding relationship between the model watermark information and the model identifier can be established, wherein the model identifier is used to distinguish different models and can also be used to trace the model developer. Therefore, the model watermark information is generated using the model identifier, and the model leaker is subsequently traced based on the model watermark information.

[0099] On the basis of the electronic device obtaining the preset base number, for the above S202, generating multiple valid operators corresponding to each operator in the model to be processed according to the model watermark information, the electronic device can construct a corresponding relationship between the valid operators and the watermark coded numbers. Based on this, the above S202, generating multiple valid operators corresponding to each operator in the model to be processed according to the model watermark information, can be implemented as follows:

[0100] For operators included in the model to be processed, multiple valid operators corresponding to the operators are generated according to the preset base number. For each valid operator, a corresponding relationship between the operator name of the valid operator and the watermark encoding number is constructed.

[0101] It can be understood that after the electronic device converts the model identifier according to the preset base number, the maximum value of the digital code information in the model watermark information is the preset base number minus 1, that is, when the preset base number is 8, the maximum value of the digital code in the model watermark information is 7. To ensure that the watermark digital code corresponding to the valid operator can cover the digital code in the model watermark information, the electronic device generates the same number of valid operators as the value of the preset base number, and each valid operator corresponds to a watermark code number.

[0102] In one example, the preset base number is 8. After the electronic device converts the model identifier according to the preset base number, the digital code included in the model watermark information can be 0 to 7. In order to ensure that the watermark code corresponding to the valid operator can cover the numbers 0 to 7, the electronic device generates 8 valid operators for each operator in the model to be processed, and each valid operator corresponds to a watermark code number, that is, valid operator 1 corresponds to watermark code number 0, valid operator 2 corresponds to watermark code number 1, valid operator 3 corresponds to watermark code number 2, valid operator 4 corresponds to watermark code number 3, valid operator 5 corresponds to watermark code number 4, valid operator 6 corresponds to watermark code number 5, valid operator 7 corresponds to watermark code number 6, and valid operator 8 corresponds to watermark code number 7.

[0103] It should be noted that the correspondence between the operator names of the above-mentioned valid operators and the watermark coding numbers is stored separately, and the specific storage location is determined by the model developer according to actual needs.

[0104] By adopting the method provided in the embodiment of the present application, valid operators are generated according to preset base numbers. The number of valid operators can cover the digital information in the model watermark information, which facilitates the subsequent use of the correspondence between the operator name and the watermark encoding number to implant the model watermark information in the model.

[0105] In some embodiments of the present application, with respect to the above S203, according to the model watermark information, the operator to be replaced is determined in the operators included in the model to be processed, and the operator to be replaced can be determined using a directed acyclic graph, such as Figure 4 As shown, it can be implemented as follows:

[0106] S2031. Based on the operators included in the model to be processed, construct a first directed acyclic graph corresponding to the model to be processed.

[0107] S2032. Traverse the first directed acyclic graph to obtain a first arrangement order of operators included in the model to be processed.

[0108] Specifically, the first directed acyclic graph may be traversed by a depth traversal or a breadth traversal method to sort the operators in the model to be processed.

[0109] S2033. Select an operator to be replaced from operators included in the model to be processed according to the number of encoding bits of the model watermark information and the first arrangement order.

[0110] After obtaining the first arrangement order, the electronic device randomly selects operators to be replaced with the same number of encoding bits according to the first arrangement order of the operators.

[0111] In one example, after arranging the operators of the model to be processed according to the first arrangement order, the order of the operators is operator A, operator C, operator F, operator B, operator E and operator D, the model watermark information is 227, and the number of encoding bits is 3. The electronic device randomly selects three operators as operators to be replaced according to the arrangement order of the above operators.

[0112] By using the method provided in the embodiment of the application, a directed acyclic graph is constructed according to the operators in the model to be processed, and the operators in the model to be processed can be sorted to obtain a first arrangement order. On the basis of the first arrangement order, the number of encoding bits in the model watermark information is further used to select the operator to be replaced. In this way, by sorting the operators using a directed acyclic graph, repeated selection of the same operator to be replaced can be avoided.

[0113] It should be noted that, for the operators included in the model to be processed, the electronic device can also generate multiple invalid operators corresponding to the operators, wherein the invalid operators have the same calculation logic as the operator.

[0114] The number of invalid operators corresponding to each operator may be preset based on experience.

[0115] Furthermore, based on the electronic device generating the invalid operator, such as Figure 5 As shown, the above S203, determining the operator to be replaced from the operators included in the model to be processed according to the model watermark information, can be implemented as follows:

[0116] S501: Replace a preset replacement operator in a model to be processed with an invalid operator corresponding to the preset replacement operator to obtain a first model.

[0117] Among them, the preset replacement operator is preset based on experience.

[0118] Specifically, the electronic device randomly selects an invalid operator from the invalid operators corresponding to the preset replacement operator, and replaces the preset replacement operator with the randomly selected invalid operator.

[0119] S502: Based on the invalid operators in the first model, construct a second directed acyclic graph corresponding to the first model.

[0120] S503: traverse the second directed acyclic graph to obtain a second arrangement order of invalid operators included in the first model.

[0121] S504: Select an operator to be replaced from the invalid operators included in the first model according to the number of encoding bits of the model watermark information and the second arrangement order.

[0122] After obtaining the second arrangement order, the electronic device randomly selects operators to be replaced with the same number of encoding bits from the invalid operators according to the second arrangement order of the invalid operators.

[0123] In one example, the electronic device first replaces a preset replacement operator in a model to be processed to obtain a first model, wherein the first model includes operators A to F, wherein operators B, C, D, and E are invalid operators.

[0124] After arranging the invalid operators of the first model according to the second arrangement order, the order of the invalid operators is operator C, operator E, operator B and operator D, the model watermark information is 227, and the number of encoding bits is 3. The electronic device randomly selects three invalid operators as operators to be replaced according to the above arrangement order of the invalid operators.

[0125] By using the method provided in the embodiment of the present application, the preset replacement operator in the model to be processed is first replaced with the corresponding invalid operator, and then the invalid operators in the first model are sorted using a directed acyclic graph to obtain a second arrangement order. In this way, the electronic device determines the operator to be replaced according to the second arrangement order, which is obtained on the basis of replacing the invalid operator in the model to be processed. The invalid operator can increase the difficulty for the thief to crack the model watermark information, thereby improving the security of the model watermark information.

[0126] On the basis of the above determination of the operator to be replaced, the electronic device can determine the replacement operator from the valid operators corresponding to each operator according to the watermark coding number and the model watermark information corresponding to the valid operator, which can be specifically implemented as follows:

[0127] Step 1: For each operator to be replaced, obtain the valid operator corresponding to the operator to be replaced.

[0128] Step 2: Determine the target watermark code number corresponding to each operator to be replaced according to the order of the digital codes in the model watermark information.

[0129] Specifically, the electronic device obtains the operator sequence of the model to be processed according to the first arrangement order; and selects the operator to be replaced corresponding to each digital code in the operator sequence.

[0130] The arrangement order of the operators to be replaced is the same as the order of the digital codes.

[0131] In an example, the electronic device arranges the operators of the model to be processed according to a first arrangement order to obtain an operator sequence. The order of the operators in the operator sequence is operator C, operator E, operator B, operator D and operator A. The model watermark information is 227, and the number of encoding bits is 3. The electronic device selects three operators as operators to be replaced according to the arrangement order in the above operator sequence.

[0132] The operator to be replaced is the same as the operator sequence, and the order of the three operators to be replaced is the same as the order of the digital code of the model watermark information. Specifically, the operators to be replaced randomly selected by the electronic device are operator C, operator E and operator A, and the order of operator C, operator E and operator A is the same as the order of the digital code 227 in the model watermark information, that is, operator C corresponds to digital code 2, operator E corresponds to digital code 2, and operator A corresponds to digital code 7.

[0133] Step 3: For each operator to be replaced, determine the target valid operator corresponding to the target watermark coding number according to the corresponding relationship between the valid operator and the watermark coding number.

[0134] Step 4: For each operator to be replaced, use the target valid operator as the replacement operator corresponding to the operator to be replaced.

[0135] According to the method provided in the embodiment of the present application, since the operators to be replaced are obtained by sorting the operators in the model to be processed based on a directed acyclic graph, there is an arrangement order for the operators to be replaced, and then according to the order of the coded numbers in the model watermark information, the target watermark coded numbers corresponding to each operator to be replaced can be determined, so that according to the correspondence between the valid operator and the watermark coded numbers, the replacement operator corresponding to each operator to be replaced is obtained. In this way, by implanting valid operators in the model to be processed, the watermark coded numbers corresponding to the valid operators are implanted into the model to be processed, thereby realizing the implantation of model watermark information. Since the operators are resistant to modification, the difficulty of cracking the model watermark is increased.

[0136] The following combination Figure 6 Introduce the process of replacing the model to be processed to obtain the target model, such as Figure 6 As shown:

[0137] Figure 6 Figure a shows the operators and data flow included in the model to be processed, where the model to be processed includes operator A, operator B, operator C, operator D, operator E and operator F.

[0138] Then the electronic device replaces the preset replacement operator in the model to be processed with an invalid operator, wherein the preset replacement operator is operator B, operator F, and a combination operation of operator A and operator C.

[0139] Specifically, the electronic device randomly selects an invalid operator Xm from the invalid operators corresponding to operator B, and replaces operator B with the invalid operator Xm; randomly selects an invalid operator Zm from the invalid operators corresponding to operator F, and replaces operator F with the invalid operator Zm; randomly selects an invalid operator Ym from the invalid operators corresponding to the combined operation of operator A and operator C, and replaces the combined operation of operator A and operator C with the invalid operator Ym, and obtains the following: Figure 6 The first model is shown in Figure b.

[0140] Finally, the electronic device uses a directed acyclic graph traversal algorithm to sort the invalid operators in the first model to obtain a second arrangement order, and then randomly selects an operator to be replaced from the invalid operators in the first model according to the second arrangement order.

[0141] Specifically, Figure 6 As shown in Figure c, the electronic device replaces the invalid operator Ym with the corresponding Y2, replaces the invalid operator Xm with X2, and replaces the invalid operator Zm with Z7.

[0142] Among them, after the electronic device determines the operator to be replaced, for each operator to be replaced, according to the order of each operator to be replaced in the second arrangement order, determines the order of each operator to be replaced, and then determines the target digital code corresponding to each operator to be replaced according to the order of the operators to be replaced and the order of the digital codes in the model watermark information, and searches for the operator name that is the same as the target digital code among the valid operators corresponding to the operator to be replaced, and uses the valid operator corresponding to the operator name as the replacement operator of the operator to be replaced, and finally the electronic device replaces the operator to be replaced with the replacement operator.

[0143] For example, the digital coding information in the model watermark information is 227, and the order of operators to be replaced selected by the electronic device is invalid operator Ym, invalid operator Xm and invalid operator Zm. Then, according to the order of digital codes in the digital coding information of the order of operators to be replaced, it is determined that the watermark coding number corresponding to the invalid operator Ym is 2, the watermark coding number corresponding to the invalid operator Xm is 2, and the watermark coding number corresponding to the invalid operator Zm is 7. The electronic device determines the operator name Y2 with the watermark digital code of 2 in the valid operators corresponding to the invalid operator Ym, obtains the valid operator Y2, and replaces the invalid operator Ym with the valid operator Y2 as a replacement operator; determines the operator name X2 with the watermark digital code of 2 in the valid operators corresponding to the invalid operator Xm, obtains the valid operator X2, and replaces the invalid operator Xm with the valid operator X2 as a replacement operator; determines the operator name Z7 with the watermark digital code of 7 in the valid operators corresponding to the invalid operator Zm, obtains the valid operator Z7, and replaces the invalid operator Zm with the valid operator Z7 as a replacement operator.

[0144] After the replacement of the invalid operator is completed as described above, in order to reduce the difficulty of providing evidence, the electronic device can also randomly select an invalid operator in the model to be processed to obtain a target invalid operator; modify the target invalid operator to obtain an updated invalid operator.

[0145] The update invalidation operator is used to update the output of the invalidation operator to a target value when the input of the update invalidation operator is a preset value.

[0146] On the basis of the above-mentioned modification invalidation operator, at the evidence stage, the electronic device can verify the model to be proved by black box verification. Specifically, the electronic device inputs a preset value to the model to be proved, and the update invalidation operator in the model can input a specific value, and then trigger the model to print, report an error or output a specific value. When the model is in the above-mentioned abnormal situation, the model is determined to be an infringing model.

[0147] In this way, during the proof stage of the model to be proved, a specific preset value can be input, and by judging whether the output of the invalid operator is the target value, it can be determined whether the model to be proved is an infringing model, thereby reducing the difficulty of proof.

[0148] After the model watermark information is implanted into the model to be processed, when proving the model to be identified, in addition to the black box verification method, the white box verification method can also be used to prove the model to be identified. Specifically, the method of using the white box verification method to prove the model to be identified is as follows: Figure 7 As shown:

[0149] S701: Obtain operators included in the model to be identified.

[0150] S702: Construct a third directed acyclic graph based on the operators included in the model to be identified.

[0151] S703: Obtain watermark information of the model to be identified corresponding to the model to be identified according to the third directed acyclic graph and the correspondence between the valid operators and the watermark coding numbers.

[0152] Among them, the electronic device can retrieve the correspondence between the operator name of the valid operator and the watermark digital code, and then compare the operator name in the model to obtain the watermark digital code corresponding to each operator, and finally determine the order of each operator according to the third directed acyclic graph to obtain the model watermark information composed of the watermark digital code.

[0153] S704: When the watermark information of the model to be identified is the same as the model watermark information, determine that the model to be identified is the target model.

[0154] It should be noted that, in the case where the model watermark information is redundant error correction code, since the redundant error correction code can realize automatic error correction, therefore, in the case where the model watermark information formed by the electronic device based on the watermark digital code has errors, the electronic device can correct the model watermark information based on the redundant error correction code to obtain the model watermark information to be identified. Moreover, based on the redundant error correction code, it can be determined whether the model structure has been changed.

[0155] By adopting the method provided in the embodiment of the present application, after obtaining the model to be identified, a corresponding directed acyclic graph is constructed for the operators in the model to be identified. In this way, the arrangement order of the operators in the model to be identified can be obtained, and then the model watermark information of the model to be identified is obtained according to the correspondence between the valid operators and the watermark coding numbers. Through the model watermark information, it can be accurately determined whether the model to be identified is an infringing model.

[0156] Based on the same concept, the embodiment of the present application provides a device for adding a model watermark, such as Figure 8 As shown, the device comprises:

[0157] An acquisition module 801 is used to acquire model watermark information and a model to be processed;

[0158] A generating module 802 is used to generate a plurality of valid operators corresponding to the operators included in the model to be processed according to the model watermark information, each valid operator corresponds to a watermark coding number, and the calculation logic of the valid operator is the same as that of the operator to be replaced;

[0159] A determination module 803 is used to determine the operator to be replaced from the operators included in the model to be processed according to the model watermark information;

[0160] The determination module 803 is further configured to determine a replacement operator corresponding to the operator to be replaced from the valid operators according to the model watermark information and the watermark code number corresponding to the valid operators;

[0161] The replacement module 804 is configured to replace the operator to be replaced with the replacement operator.

[0162] In a possible implementation, the acquisition module 801 is specifically configured to:

[0163] Obtaining a preset base number and a model identifier corresponding to the model to be processed;

[0164] The model identifier is converted into the preset base number to obtain the model watermark information.

[0165] In a possible implementation, the acquisition module 801 is specifically configured to:

[0166] Convert the model identifier into a preset base number to obtain a watermark code;

[0167] Redundant error correction coding is performed on the watermark code to obtain the model watermark information.

[0168] In a possible implementation, the generating module 802 is specifically configured to:

[0169] For the operators included in the model to be processed, generating multiple valid operators corresponding to the operators according to the preset base number;

[0170] For each valid operator, a correspondence between the operator name of the valid operator and the watermark encoding number is constructed.

[0171] In a possible implementation, the determination module 803 is specifically configured to:

[0172] Based on the operators included in the model to be processed, construct a first directed acyclic graph corresponding to the model to be processed;

[0173] Traversing the first directed acyclic graph to obtain a first arrangement order of operators included in the model to be processed;

[0174] The operator to be replaced is selected from the operators included in the model to be processed according to the number of encoding bits of the model watermark information and the first arrangement order.

[0175] In a possible implementation, the generating module 802 is further configured to:

[0176] For the operators included in the model to be processed, multiple invalid operators corresponding to the operators are generated, and the calculation logic of the invalid operators is the same as that of the operators.

[0177] In a possible implementation, the determining module 803 is configured to:

[0178] Replacing the preset replacement operator in the to-be-processed model with an invalid operator corresponding to the preset replacement operator to obtain a first model;

[0179] Based on the invalid operators in the first model, construct a second directed acyclic graph corresponding to the first model;

[0180] Traversing the second directed acyclic graph to obtain a second arrangement order of invalid operators included in the first model;

[0181] The operator to be replaced is selected from the invalid operators included in the first model according to the number of encoding bits of the model watermark information and the second arrangement order.

[0182] In a possible implementation, the determining module 803 is configured to:

[0183] For each operator to be replaced, obtain a valid operator corresponding to the operator to be replaced;

[0184] Determine the target watermark code number corresponding to each to-be-replaced operator according to the order of the digital codes in the model watermark information;

[0185] For each operator to be replaced, according to the correspondence between the valid operator and the watermark coding number, determine the target valid operator corresponding to the target watermark coding number;

[0186] For each operator to be replaced, the target valid operator is used as the replacement operator corresponding to the operator to be replaced.

[0187] In a possible implementation, the determination module 803 is specifically configured to:

[0188] Obtaining an operator sequence of the model to be processed according to the first arrangement order;

[0189] An operator to be replaced corresponding to each digital code is selected from the operator sequence, and the arrangement order of the operators to be replaced is the same as the order of the digital codes.

[0190] In a possible implementation, the device further includes:

[0191] A random selection module, used for randomly selecting invalid operators in the model to be processed to obtain target invalid operators;

[0192] The modification module is used to modify the target invalidation operator to obtain an update invalidation operator, wherein the update invalidation operator is used to output a target value when the input of the update invalidation operator is a preset value.

[0193] It should be noted that the device for adding a model watermark is a device corresponding to the method for adding a model watermark applied to an electronic device. All implementation methods in the above method embodiments are applicable to the embodiments of the device and can achieve the same technical effects.

[0194] Fig. 9 A schematic diagram of the hardware structure of an electronic device provided in an embodiment of the present application is shown.

[0195] The electronic device may include a processor 901 and a memory 902 storing computer program instructions.

[0196] Specifically, the processor 901 may include a central processing unit (CPU), or an application specific integrated circuit (ASIC), or may be configured to implement one or more integrated circuits of the embodiments of the present application.

[0197] The memory 902 may include a large capacity memory for data or instructions. By way of example and not limitation, the memory 902 may include a hard disk drive (HDD), a floppy disk drive, a flash memory, an optical disk, a magneto-optical disk, a magnetic tape, or a universal serial bus (USB) drive or a combination of two or more of these. In appropriate cases, the memory 902 may include a removable or non-removable (or fixed) medium. In appropriate cases, the memory 902 may be inside or outside the integrated gateway disaster recovery device. In a specific embodiment, the memory 902 is a non-volatile solid-state memory.

[0198] The memory may include read-only memory (ROM), random access memory (RAM), magnetic disk storage media devices, optical storage media devices, flash memory devices, electrical, optical or other physical / tangible memory storage devices. Thus, typically, the memory includes one or more tangible (non-transitory) computer-readable storage media (e.g., memory devices) encoded with software including computer-executable instructions, and when the software is executed (e.g., by one or more processors), it is operable to perform the operations described with reference to the method according to an aspect of the present disclosure.

[0199] The processor 901 reads and executes the computer program instructions stored in the memory 902 to implement any one of the methods for adding a model watermark in the above embodiments.

[0200] In one example, the electronic device may further include a communication interface 903 and a bus 904. Fig. 9 As shown, the processor 901, the memory 902, and the communication interface 903 are connected via a bus 904 and communicate with each other.

[0201] The communication interface 903 is mainly used to implement communication between various modules, devices, units and / or equipment in the embodiments of the present application.

[0202] Bus 904 includes hardware, software or both, and the parts of electronic equipment are coupled to each other.For example, but not limitation, bus may include accelerated graphics port (AGP) or other graphics bus, enhanced industrial standard architecture (EISA) bus, front side bus (FSB), hypertransport (HT) interconnection, industrial standard architecture (ISA) bus, infinite bandwidth interconnection, low pin count (LPC) bus, memory bus, micro channel architecture (MCA) bus, peripheral component interconnection (PCI) bus, PCI-Express (PCI-X) bus, serial advanced technology attachment (SATA) bus, video electronics standard association local (VLB) bus or other suitable bus or two or more of these combinations. In suitable cases, bus 904 may include one or more buses. Although the present application embodiment describes and shows a specific bus, the application considers any suitable bus or interconnection.

[0203] In addition, in combination with the method for adding a model watermark in the above embodiment, the embodiment of the present application can provide a computer storage medium for implementation. The computer storage medium stores computer program instructions; when the computer program instructions are executed by a processor, any one of the methods for adding a model watermark in the above embodiment is implemented.

[0204] In combination with the method for adding a model watermark in the above embodiments, an embodiment of the present application may provide a computer program product. When the instructions in the computer program product are executed by a processor of an electronic device, the electronic device executes any one of the methods for adding a model watermark in the above embodiments.

[0205] It should be clear that the present application is not limited to the specific configuration and processing described above and shown in the figures. For the sake of simplicity, a detailed description of the known method is omitted here. In the above embodiments, several specific steps are described and shown as examples. However, the method process of the present application is not limited to the specific steps described and shown, and those skilled in the art can make various changes, modifications and additions, or change the order between the steps after understanding the spirit of the present application.

[0206] The functional blocks shown in the above-described block diagram can be implemented as hardware, software, firmware or a combination thereof. When implemented in hardware, it can be, for example, an electronic circuit, an application specific integrated circuit (ASIC), appropriate firmware, a plug-in, a function card, etc. When implemented in software, the elements of the present application are programs or code segments that are used to perform the required tasks. The program or code segment can be stored in a machine-readable medium, or transmitted on a transmission medium or a communication link by a data signal carried in a carrier wave. "Machine-readable medium" can include any medium capable of storing or transmitting information. Examples of machine-readable media include electronic circuits, semiconductor memory devices, ROM, flash memory, erasable ROM (EROM), floppy disks, CD-ROMs, optical disks, hard disks, optical fiber media, radio frequency (RF) links, etc. The code segment can be downloaded via a computer network such as the Internet, an intranet, etc.

[0207] It should also be noted that the exemplary embodiments mentioned in this application describe some methods or systems based on a series of steps or devices. However, this application is not limited to the order of the above steps, that is, the steps can be performed in the order mentioned in the embodiment, or in a different order from the embodiment, or several steps can be performed simultaneously.

[0208] Aspects of the present disclosure are described above with reference to the flowchart and / or block diagram of the method, device (system) and computer program product according to the embodiment of the present disclosure. It should be understood that each box in the flowchart and / or block diagram and the combination of each box in the flowchart and / or block diagram can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, or other programmable data processing device to produce a machine so that these instructions executed by the processor of the computer or other programmable data processing device enable the implementation of the function / action specified in one or more boxes of the flowchart and / or block diagram. Such a processor can be, but is not limited to, a general-purpose processor, a special-purpose processor, a special application processor, or a field programmable logic circuit. It can also be understood that each box in the block diagram and / or flowchart and the combination of boxes in the block diagram and / or flowchart can also be implemented by dedicated hardware that performs a specified function or action, or can be implemented by a combination of dedicated hardware and computer instructions.

[0209] The above is only a specific implementation of the present application. Those skilled in the art can clearly understand that for the convenience and simplicity of description, the specific working processes of the systems, modules and units described above can refer to the corresponding processes in the aforementioned method embodiments, and will not be repeated here. It should be understood that the protection scope of the present application is not limited to this. Any technician familiar with the technical field can easily think of various equivalent modifications or replacements within the technical scope disclosed in this application, and these modifications or replacements should be included in the protection scope of this application.

Claims

1. A method for adding a model watermark, characterized in that: include: Get model watermark information and the model to be processed; Generating multiple valid operators corresponding to each operator in the model to be processed according to the model watermark information, each valid operator corresponds to a watermark coding number, and the calculation logic of the valid operator is the same as that of the operator included in the model to be processed; Determining, according to the model watermark information, an operator to be replaced among operators included in the model to be processed; According to the model watermark information and the watermark coding number corresponding to the valid operator, determining the replacement operator corresponding to the operator to be replaced in the valid operators; The operator to be replaced is replaced with the replacement operator to obtain a target model.

2. The method according to claim 1, characterized in that The obtaining of model watermark information and the model to be processed includes: Obtaining a preset base number and a model identifier corresponding to the model to be processed; The model identifier is converted into the preset base number to obtain the model watermark information.

3. The method according to claim 2, characterized in that The converting the model identifier into the preset base number to obtain the model watermark information includes: Convert the model identifier into a preset base number to obtain a watermark code; Redundant error correction coding is performed on the watermark code to obtain the model watermark information.

4. The method according to claim 2, characterized in that: The step of generating a plurality of valid operators corresponding to each operator in the model to be processed according to the model watermark information includes: For the operators included in the model to be processed, generating multiple valid operators corresponding to the operators according to the preset base number; For each valid operator, a correspondence between the operator name of the valid operator and the watermark encoding number is constructed.

5. The method according to claim 1, characterized in that The step of determining the operator to be replaced from the operators included in the model to be processed according to the model watermark information comprises: Based on the operators included in the model to be processed, construct a first directed acyclic graph corresponding to the model to be processed; Traversing the first directed acyclic graph to obtain a first arrangement order of operators included in the model to be processed; The operator to be replaced is selected from the operators included in the model to be processed according to the number of encoding bits of the model watermark information and the first arrangement order.

6. The method according to claim 4, characterized in that The method further comprises: For the operators included in the model to be processed, multiple invalid operators corresponding to the operators are generated, and the calculation logic of the invalid operators is the same as that of the operators.

7. The method according to claim 6, characterized in that The step of determining the operator to be replaced from the operators included in the model to be processed according to the model watermark information comprises: Replacing the preset replacement operator in the to-be-processed model with an invalid operator corresponding to the preset replacement operator to obtain a first model; Based on the invalid operators in the first model, construct a second directed acyclic graph corresponding to the first model; Traversing the second directed acyclic graph to obtain a second arrangement order of invalid operators included in the first model; The operator to be replaced is selected from the invalid operators included in the first model according to the number of encoding bits of the model watermark information and the second arrangement order.

8. The method according to claim 5, characterized in that The step of determining, in the valid operators, a replacement operator corresponding to the operator to be replaced according to the model watermark information and the watermark code number corresponding to the valid operators, comprises: For each operator to be replaced, obtain a valid operator corresponding to the operator to be replaced; Determine the target watermark code number corresponding to each to-be-replaced operator according to the order of the digital codes in the model watermark information and the first arrangement order; For each operator to be replaced, according to the correspondence between the valid operator and the watermark coding number, determine the target valid operator corresponding to the target watermark coding number; For each operator to be replaced, the target valid operator is used as the replacement operator corresponding to the operator to be replaced.

9. The method according to claim 8, characterized in that The step of determining the target watermark code number corresponding to each to-be-replaced operator according to the order of the digital codes in the model watermark information and the first arrangement order includes: Obtaining an operator sequence of the model to be processed according to the first arrangement order; An operator to be replaced corresponding to each digital code is selected from the operator sequence, and the arrangement order of the operators to be replaced is the same as the order of the digital codes.

10. The method according to claim 6, characterized in that After replacing the operator to be replaced with the replacement operator, the method further includes: Randomly selecting an invalid operator in the model to be processed to obtain a target invalid operator; The target invalidation operator is modified to obtain an update invalidation operator, wherein the update invalidation operator is used for outputting a target value when the input of the update invalidation operator is a preset value.

11. A device for adding a model watermark, characterized in that: include: An acquisition module is used to obtain model watermark information and the model to be processed; A generating module, used for generating a plurality of valid operators corresponding to the operators included in the model to be processed according to the model watermark information, each valid operator corresponds to a watermark coding number, and the calculation logic of the valid operator is the same as that of the operator to be replaced; A determination module, configured to determine an operator to be replaced from among operators included in the model to be processed according to the model watermark information; The determination module is further configured to determine a replacement operator corresponding to the operator to be replaced from among the valid operators according to the model watermark information and the watermark coding number corresponding to the valid operator; A replacement module is used to replace the operator to be replaced with the replacement operator.

12. An electronic device, characterized in that: The device comprises: a processor and a memory storing computer program instructions; When the processor executes the computer program instructions, the method for adding a model watermark as described in any one of claims 1 to 10 is implemented.

13. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores computer program instructions, and when the computer program instructions are executed by a processor, the method for adding a model watermark according to any one of claims 1 to 10 is implemented.

14. A computer program product, characterized in that When the instructions in the computer program product are executed by a processor of an electronic device, the electronic device executes the method for adding a model watermark as described in any one of claims 1 to 10.

Images