Method, device, equipment, storage medium and program product for model watermark adding

Abstract

The application discloses a model watermark adding method, device, equipment, storage medium and program product, and specific technical solutions comprise: obtaining model watermark information and a to-be-processed model; generating a plurality of effective operators corresponding to each operator in the to-be-processed model according to the model watermark information, each effective operator corresponds to a watermark code number, and the effective operator and the calculation logic of the operator included in the to-be-processed model are the same; determining a to-be-replaced operator in the operator included in the to-be-processed model according to the model watermark information; determining a replacement operator corresponding to the to-be-replaced operator in the effective operator according to the model watermark information and the watermark code number corresponding to the effective operator; and replacing the to-be-replaced operator with the replacement operator to obtain a target model. In this way, the model watermark information is added to the operator, the model watermark information has high modification resistance, and it is convenient to check the to-be-processed model subsequently.

Description

TECHNICAL FIELD

[0001] The application belongs to the technical field of machine learning, and particularly relates to a model watermark adding method and device, equipment, a storage medium and a program product. BACKGROUND

[0002] With the development of artificial intelligence technology, data-driven machine learning technology has high accuracy in identification tasks and classification tasks. However, the training of a machine learning model requires years of investment to obtain a high-efficiency and stable finished product model.

[0003] To protect the intellectual property rights of a machine learning model developer, a watermark is added to the model during the development and training phases of the model. Subsequently, when the model is to be evidenced, the watermark is extracted from the model to be evidenced, and the extracted watermark is compared with the watermark implanted by the model developer, so as to determine whether the model to be evidenced infringes on the intellectual property rights.

[0004] Currently, a model developer can embed a watermark in the weights of a model. Subsequently, during the evidence stage, the weights of the model to be evidenced are compared with the weights of the model trained by the model developer, so as to determine whether the model to be evidenced infringes on the intellectual property rights.

[0005] However, a thief can modify the weights of the model while hardly changing the performance of the model by fine-tuning or model distillation. In this way, the watermark of the model is changed, and the weights of the model cannot be used to effectively determine whether the model to be evidenced is an infringing model. SUMMARY

[0006] Embodiments of the application provide a model watermark adding method, device, equipment, storage medium and program product, which add model watermark information to an operator, so that the model watermark information has high modification resistance and is convenient for subsequent verification of a model to be evidenced.

[0007] In a first aspect, embodiments of the application provide a model watermark adding method, comprising:

[0008] obtaining model watermark information and a model to be processed;

[0009] generating a plurality of effective operators corresponding to each operator in the model to be processed according to the model watermark information, each effective operator corresponding to a watermark code number, and the effective operator and the operator included in the model to be processed having the same calculation logic;

[0010] determining a to-be-replaced operator in the operator included in the model to be processed according to the model watermark information;

[0011] According to the model watermark information and the watermark encoding number corresponding to the effective operator, a replacement operator corresponding to the to-be-replaced operator is determined in the effective operator;

[0012] The to-be-replaced operator is replaced by the replacement operator to obtain a target model.

[0013] In a possible implementation, the method further includes:

[0014] A preset numeral system and a model identifier corresponding to the to-be-processed model are obtained.

[0015] The model identifier is converted into the preset numeral system to obtain the model watermark information.

[0016] In a possible implementation, the model identifier is converted into the preset numeral system to obtain the model watermark information, and the method further includes:

[0017] The model identifier is converted into a preset numeral system to obtain watermark encoding.

[0018] The watermark encoding is subjected to redundancy error correction coding to obtain the model watermark information.

[0019] In a possible implementation, the method further includes:

[0020] For an operator included in the to-be-processed model, a plurality of effective operators corresponding to the operator are generated according to the preset numeral system.

[0021] For each effective operator, a corresponding relationship between an operator name of the effective operator and a watermark encoding number is constructed.

[0022] In a possible implementation, the method further includes:

[0023] Based on the operators included in the to-be-processed model, a first directed acyclic graph corresponding to the to-be-processed model is constructed.

[0024] The first directed acyclic graph is traversed to obtain a first arrangement order of the operators included in the to-be-processed model.

[0025] According to a number of encoding bits of the model watermark information and the first arrangement order, the to-be-replaced operator is selected from the operators included in the to-be-processed model.

[0026] In a possible implementation, the method further includes:

[0027] For the operator included in the to-be-processed model, a plurality of invalid operators corresponding to the operator are generated, and the invalid operators have the same calculation logic as the operator.

[0028] In a possible implementation, the determining, according to the model watermark information, of the to-be-replaced operator in the operators included in the to-be-processed model includes:

[0029] The preset replacement operator in the to-be-processed model is replaced by an invalid operator corresponding to the preset replacement operator, to obtain a first model;

[0030] A second directed acyclic graph corresponding to the first model is constructed based on the invalid operators in the first model.

[0031] The second directed acyclic graph is traversed to obtain a second arrangement order of the invalid operators included in the first model.

[0032] According to the number of encoding bits of the model watermark information and the second arrangement order, the to-be-replaced operator is selected from the invalid operators included in the first model.

[0033] In a possible implementation, the determining, according to the model watermark information and the watermark encoding number corresponding to the valid operator, of the replacement operator corresponding to the to-be-replaced operator in the valid operator includes:

[0034] For each to-be-replaced operator, the valid operator corresponding to the to-be-replaced operator is obtained.

[0035] According to the bit order of the number encoding in the model watermark information, the target watermark encoding number corresponding to each to-be-replaced operator is determined.

[0036] For each to-be-replaced operator, according to the correspondence between the valid operator and the watermark encoding number, the target valid operator corresponding to the target watermark encoding number is determined.

[0037] For each to-be-replaced operator, the target valid operator is taken as the replacement operator corresponding to the to-be-replaced operator.

[0038] In a possible implementation, the determining, according to the bit order of the number encoding in the model watermark information and the first arrangement order, of the target watermark encoding number corresponding to each to-be-replaced operator includes:

[0039] According to the first arrangement order, the operator sequence of the to-be-processed model is obtained.

[0040] In the operator sequence, the to-be-replaced operator corresponding to each number encoding is selected, and the arrangement order of the to-be-replaced operator is the same as the bit order of the number encoding.

[0041] In a possible implementation, after the replacing the to-be-replaced operator with the replacement operator, the method further includes:

[0042] randomly selecting an invalid operator in the to-be-processed model to obtain a target invalid operator;

[0043] modifying the target invalid operator to obtain an updated invalid operator, wherein an output of the updated invalid operator is a target value when an input of the updated invalid operator is a preset value.

[0044] In a second aspect, an embodiment of the present application provides a device for adding model watermark, comprising:

[0045] an obtaining module configured to obtain model watermark information and a to-be-processed model;

[0046] a generating module configured to generate a plurality of valid operators corresponding to operators included in the to-be-processed model according to the model watermark information, each valid operator corresponding to a watermark code number, and the valid operators and the to-be-replaced operators having the same calculation logic;

[0047] a determining module configured to determine a to-be-replaced operator from the operators included in the to-be-processed model according to the model watermark information;

[0048] the determining module is further configured to determine a replacement operator corresponding to the to-be-replaced operator from the valid operators according to the model watermark information and the watermark code numbers corresponding to the valid operators;

[0049] a replacing module configured to replace the to-be-replaced operator with the replacement operator.

[0050] In a third aspect, an embodiment of the present application provides an electronic device, comprising a processor and a memory storing computer program instructions;

[0051] the processor, when executing the computer program instructions, implements the method for adding model watermark according to any one of the first aspect.

[0052] In a fourth aspect, an embodiment of the present application provides a computer readable storage medium, which stores computer program instructions, and the computer program instructions, when executed by a processor, implement the method for adding model watermark according to any one of the first aspect.

[0053] In a fifth aspect, an embodiment of the present application provides a computer program product, and instructions in the computer program product are executed by a processor of an electronic device, so that the electronic device executes the method for adding model watermark according to any one of the first aspect.

[0054] The model watermark adding method, device, equipment, storage medium and program product provided by the embodiment of the present application, after obtaining model watermark information and a to-be-processed model, generate an effective operator corresponding to each operator in the to-be-processed model according to the model watermark information, wherein each effective operator corresponds to a watermark encoding number. After determining the to-be-replaced operator according to the model watermark information, the watermark encoding number corresponding to the to-be-replaced operator is determined according to the encoding information in the model watermark information, and then the replacement operator corresponding to the to-be-replaced operator is determined. In this way, by constructing the corresponding relationship between the effective operator and the watermark encoding number, the effective operator with the watermark encoding number can be implanted by replacing the operator in the to-be-processed model, so as to realize the watermark adding of the model. Since the operator used by the model is not easy to be modified, the model watermark information is added to the operator, so that the model watermark information has high modification resistance, and it is convenient to check the to-be-proved model subsequently. BRIEF DESCRIPTION OF DRAWINGS

[0055] In order to more clearly illustrate the technical solutions of the embodiments of the present application, the drawings required to be used in the embodiments of the present application will be briefly introduced. Those skilled in the art can obtain other drawings according to these drawings without creating any creative labor.

[0056] Figure 1 is an exemplary schematic diagram of a method for providing a black box verification by the prior art;

[0057] Figure 2 is a flowchart of a model watermark adding method provided by the embodiment of the present application;

[0058] Figure 3 is an exemplary schematic diagram of an operator provided by the embodiment of the present application;

[0059] Figure 4 is a flowchart of a to-be-replaced operator determination method provided by the embodiment of the present application;

[0060] Figure 5 is a flowchart of another to-be-replaced operator determination method provided by the embodiment of the present application;

[0061] Figure 6 is an exemplary schematic diagram of a model watermark adding method provided by the embodiment of the present application;

[0062] Figure 7 is a flowchart of a white box verification method provided by the embodiment of the present application;

[0063] Figure 8 is a structural schematic diagram of a model watermark adding device provided by the embodiment of the present application;

[0064] Figure 9This is a schematic diagram of the structure of an electronic device provided in another embodiment of this application. Detailed Implementation

[0065] The features and exemplary embodiments of various aspects of this application will be described in detail below. To make the objectives, technical solutions, and advantages of this application clearer, the application will be further described in detail below with reference to the accompanying drawings and specific embodiments. It should be understood that the specific embodiments described herein are only intended to explain this application and not to limit it. For those skilled in the art, this application can be implemented without some of these specific details. The following description of the embodiments is merely to provide a better understanding of this application by illustrating examples.

[0066] It should be noted that, in this document, relational terms such as "first" and "second" are used merely to distinguish one entity or operation from another, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Furthermore, the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such a process, method, article, or apparatus. Without further limitations, an element defined by the phrase "comprising..." does not exclude the presence of additional identical elements in the process, method, article, or apparatus that includes said element.

[0067] Currently, the following two methods are mainly used to determine whether a model to be proven infringes on copyright:

[0068] Method 1: Use the original input to superimpose an imperceptible perturbation as an adversarial example to train the model so that the model can identify the adversarial example as a special category.

[0069] like Figure 1 As shown, Figure 1 The panda image on the left is overlaid with a perturbation input model, which identifies the image as a gibbon with a confidence level of 99.3%.

[0070] Thus, adversarial examples and the model's misclassifications are recorded. After obtaining the model to be proven, the recorded adversarial examples are input into the model to be proven, and the model's identification result is observed to see if it is a misclassification of the record. If the model's identification result is a misclassification of the record, then the model to be proven is an infringing model.

[0071] The verification method provided by the above method 1 can determine whether the to-be-proved model is an infringing model. However, in the case that the model developer authorizes the trained model to be used by multiple third parties, each third party has the possibility of leaking the model. To accurately determine the third party that leaks the model, the model developer can train a model for each third party and record the corresponding adversarial sample and error classification of each model. In this way, the development cost of the model is huge, and when the model is upgraded, the model needs to be trained and verified multiple times.

[0072] Method 2, the model developer can embed a watermark in the weight of the model. Subsequently, in the proof stage, by comparing the weight of the to-be-proved model and the weight of the model trained by the model developer, it can be determined whether the to-be-proved model infringes.

[0073] However, the thief can modify the weight of the model by fine-tuning the model or model distillation technology, etc. In this way, the watermark of the model is changed, and the watermark of the model cannot be used to effectively determine whether the to-be-proved model is an infringing model.

[0074] To solve the problems in the prior art, the embodiments of the present application provide a model watermark adding method, device, equipment, storage medium and program product. First, based on Figure 1 A model watermark adding method provided by the embodiments of the present application is introduced, as shown in the method applied to an electronic device, the method comprises: Figure 2

[0075] S201, obtaining model watermark information and a to-be-processed model.

[0076] The model watermark information can be character information or digital code information. In the case that the model watermark information is character information, the electronic device can convert the character information into digital code information. The conversion method of the digital code information is not limited by the embodiments of the present application.

[0077] S202, generating a plurality of effective operators corresponding to each operator in the to-be-processed model according to the model watermark information.

[0078] Each effective operator corresponds to a watermark code number, and the effective operator and the operator included in the to-be-processed model have the same calculation logic.

[0079] Specifically, the electronic device can generate a new operator by the following two methods:

[0080] The first method: for the operator in the to-be-processed model, the electronic device copies the operator to generate a new operator, and generates an operator name of the new operator.

[0081] ​The second method: The electronic device generates a new operator by imitating the calculation logic of the operator in the model to be processed, and generates the operator name of the new operator.

[0082] Furthermore, electronic devices can combine the computational logic of multiple operators to generate a new operator.

[0083] After generating the new operator as described above, the correspondence between the operator name and the watermark code number is constructed to obtain the effective operator.

[0084] The number of valid operators is determined based on the model watermark information. Specifically, the model watermark information is digital encoding information, and the watermark encoding numbers of the valid operators need to cover all the digital encodings in the model watermark information.

[0085] In one example, such as Figure 3 As shown, Figure 3 The example illustrates a local graph within a machine learning model, with directed arrows indicating the data flow. The model includes operators such as an activation function (ReLU), a convolution function (Conv), and a normalization function (BatchNormalization). The ReLU activation function is used as an example. Figure 3 This example demonstrates a ReLU activation function of type ReLU; module ai.onnx v6, name mobilenetv20_features_linearbottleneck10_relu0_fwd. Inputs are x, named mobilenetv20_features_linearbottleneck10_batchnc, and outputs are y, named mobilenetv20_features_linearbottleneck10_relu0_fwd.

[0086] S203. Based on the model watermark information, determine the operator to be replaced among the operators included in the model to be processed.

[0087] Understandably, model watermark information is digitally encoded information, which typically includes multiple digital codes. Each valid operator corresponds to a watermark code number. Therefore, the electronic device determines the operator to be replaced in the model to be processed based on the number and order of the digital codes in the model watermark information.

[0088] S204. Based on the model watermark information and the watermark code number corresponding to the valid operator, determine the replacement operator corresponding to the operator to be replaced among the valid operators.

[0089] It can be understood that each operator in the to-be-processed model corresponds to a plurality of valid operators, and each valid operator corresponds to a watermark encoded number. Therefore, by selecting a replacement operator corresponding to the to-be-replaced operator in the valid operator, the watermark encoded number corresponding to the to-be-replaced operator can be determined. In this way, the watermark encoded number of the replacement operator in the to-be-processed model can construct a digital encoding information, that is, the above-mentioned model watermark information.

[0090] S205, replacing the to-be-replaced operator with the replacement operator to obtain a target model.

[0091] By using the above method, after obtaining the model watermark information and the to-be-processed model, the valid operator corresponding to each operator in the to-be-processed model is generated according to the model watermark information, wherein each valid operator corresponds to a watermark encoded number. After determining the to-be-replaced operator according to the model watermark information, the watermark encoded number corresponding to the to-be-replaced operator is determined according to the encoding information in the model watermark information, and then the replacement operator corresponding to the to-be-replaced operator is determined. In this way, by constructing the correspondence between the valid operator and the watermark encoded number, the valid operator with the watermark encoded number can be implanted by replacing the operator in the to-be-processed model, so as to realize the watermark adding of the model. Since the operators used by the model are not easy to be modified, the model watermark information is added to the operators, so that the model watermark information has high modification resistance, and is convenient for subsequent verification of the to-be-processed model.

[0092] The electronic device can obtain the model identification of the to-be-processed model, and generate the model watermark information according to the model identification. Specifically, for the above S201, obtaining the model watermark information and the to-be-processed model, it can be specifically implemented as:

[0093] The preset radix number and the model identification corresponding to the to-be-processed model are obtained. The model identification is converted into the preset radix number to obtain the model watermark information.

[0094] The preset radix number is set according to experience, and the model identification is an identification pre-allocated by a model developer to a third party authorized to use the model.

[0095] Specifically, after obtaining the model identification, the electronic device can convert the model identification into a digital encoding information of a preset radix number according to the preset radix number. For example, the model identification is 9, and the preset radix number is 8. The electronic device converts the model identification into an octal number to obtain the model watermark information as 11.

[0096] In order to improve the reliability of the model watermark, the electronic device can perform redundant error correction coding on the watermark encoding after converting the model identification into the preset radix number to obtain the watermark encoding, and obtain the model watermark information. In this way, the error correction capability of the model watermark information is increased by redundant error correction coding, and the damaged watermark can be recovered to a certain extent.

[0097] In one example, the redundancy error correction code is a Hamming code, and the Hamming code corresponding to the watermark code is 227 when the watermark code is 11.

[0098] By converting the model identifier into a preset numeral system, the method provided in the embodiments of the present application can construct a corresponding relationship between the model watermark information and the model identifier, where the model identifier is used to distinguish different models and can also be used to trace the model developer. Therefore, the model watermark information is generated by using the model identifier, and the model leaker can be traced based on the model watermark information.

[0099] Based on the electronic device obtaining the preset numeral system, the electronic device can construct a corresponding relationship between the effective operator and the watermark code number according to the model watermark information generated in S202.

[0100] For the operator included in the to-be-processed model, the electronic device generates a plurality of effective operators corresponding to the operator according to the preset numeral system. For each effective operator, the electronic device constructs a corresponding relationship between the operator name of the effective operator and the watermark code number.

[0101] It can be understood that after the electronic device converts the model identifier according to the preset numeral system, the maximum value of the digital code information in the model watermark information is the preset numeral system minus 1, that is, in the case of the preset numeral system being 8, the maximum value of the digital code in the model watermark information is 7. To ensure that the watermark code number corresponding to the effective operator can cover the digital code in the model watermark information, the electronic device generates the same number of effective operators as the value of the preset numeral system, and each effective operator corresponds to a watermark code number.

[0102] In one example, the preset numeral system is 8, and after the electronic device converts the model identifier according to the preset numeral system, the digital code included in the model watermark information can be 0 to 7. To ensure that the watermark code corresponding to the effective operator can cover the digital code 0 to 7, the electronic device generates 8 effective operators for each operator in the to-be-processed model, and each effective operator corresponds to a watermark code number, that is, effective operator 1 corresponds to watermark code number 0, effective operator 2 corresponds to watermark code number 1, effective operator 3 corresponds to watermark code number 2, effective operator 4 corresponds to watermark code number 3, effective operator 5 corresponds to watermark code number 4, effective operator 6 corresponds to watermark code number 5, effective operator 7 corresponds to watermark code number 6, and effective operator 8 corresponds to watermark code number 7.

[0103] It should be noted that the correspondence between the operator name of the effective operator and the watermark encoding number is stored separately, and the specific storage location is determined by the model developer according to actual needs.

[0104] By using the method provided in the embodiments of the present application, the effective operator is generated according to the preset numeral system, and the number of the effective operator can cover the digital information in the model watermark information, which facilitates subsequent implantation of the model watermark information in the model by using the correspondence between the operator name and the watermark encoding number.

[0105] In some embodiments of the present application, for S203 described above, the to-be-replaced operator is determined from the operators included in the to-be-processed model according to the model watermark information. The to-be-replaced operator can be determined by using a directed acyclic graph, for example, as shown in the following table: Figure 4 As shown in the table, the specific implementation can be as follows:

[0106] S2031, based on the operators included in the to-be-processed model, a first directed acyclic graph corresponding to the to-be-processed model is constructed.

[0107] S2032, the first directed acyclic graph is traversed to obtain a first arrangement order of the operators included in the to-be-processed model.

[0108] Specifically, the first directed acyclic graph can be traversed by using a depth-first traversal method or a breadth-first traversal method, and the operators in the to-be-processed model can be sorted.

[0109] S2033, according to the encoding bit number of the model watermark information and the first arrangement order, the to-be-replaced operator is selected from the operators included in the to-be-processed model.

[0110] Wherein, after obtaining the first arrangement order, the electronic device randomly selects the same number of to-be-replaced operators as the encoding bit number according to the first arrangement order of the operators.

[0111] In one example, after the operators of the to-be-processed model are arranged according to the first arrangement order, the order of the operators is operator A, operator C, operator F, operator B, operator E and operator D, the model watermark information is 227, and the encoding bit number is 3. Then, the electronic device randomly selects three operators as to-be-replaced operators according to the arrangement order of the above operators.

[0112] By using the method provided in the embodiments of the present application, the directed acyclic graph is constructed according to the operators in the to-be-processed model, the operators in the to-be-processed model can be sorted to obtain the first arrangement order, and then the to-be-replaced operator is selected by using the encoding bit number in the model watermark information. In this way, the operators are sorted by using the directed acyclic graph, which can avoid repeated selection of the same to-be-replaced operator.

[0113] It should be noted that the electronic device can also generate a plurality of invalid operators corresponding to the operator included in the to-be-processed model, where the invalid operators have the same calculation logic as the operator.

[0114] The number of invalid operators corresponding to each operator can be pre-set according to experience.

[0115] Further, on the basis that the electronic device generates the invalid operators, as shown in Figure 5 S203, determining the to-be-replaced operator from the operators included in the to-be-processed model according to the model watermark information, can be implemented as follows:

[0116] S501, replacing a preset replacement operator in the to-be-processed model with an invalid operator corresponding to the preset replacement operator to obtain a first model.

[0117] The preset replacement operator is pre-set according to experience.

[0118] Specifically, the electronic device randomly selects one invalid operator from the invalid operators corresponding to the preset replacement operator, and replaces the preset replacement operator with the randomly selected invalid operator.

[0119] S502, constructing a second directed acyclic graph corresponding to the first model based on the invalid operators in the first model.

[0120] S503, traversing the second directed acyclic graph to obtain a second arrangement order of the invalid operators included in the first model.

[0121] S504, selecting the to-be-replaced operator from the invalid operators included in the first model according to the number of encoding bits of the model watermark information and the second arrangement order.

[0122] After obtaining the second arrangement order, the electronic device randomly selects the same number of to-be-replaced operators as the number of encoding bits from the invalid operators according to the second arrangement order of the invalid operators.

[0123] In one example, the electronic device first replaces the preset replacement operator in the to-be-processed model to obtain a first model, and the first model includes operators A to F, where operators B, C, D, and E are invalid operators.

[0124] After arranging the invalid operators of the first model according to the second arrangement order, the order of the invalid operators is operator C, operator E, operator B, and operator D, the model watermark information is 227, and the number of encoding bits is 3. Then, the electronic device randomly selects three invalid operators as to-be-replaced operators according to the arrangement order of the invalid operators.

[0125] The method provided in the embodiment of the application first replaces the preset replacement operator in the to-be-processed model with a corresponding invalid operator, then sorts the invalid operators in the first model using a directed acyclic graph to obtain a second arrangement order. In this way, the electronic device determines the to-be-replaced operator according to the second arrangement order, which is obtained on the basis of replacing the invalid operator in the to-be-processed model. The invalid operator can increase the difficulty of cracking the model watermark information for a thief, thereby improving the security of the model watermark information.

[0126] On the basis of determining the to-be-replaced operator, the electronic device can determine the replacement operator in each valid operator corresponding to the to-be-replaced operator according to the watermark encoding number corresponding to the valid operator and the model watermark information, which can be specifically implemented as follows:

[0127] Step 1: For each to-be-replaced operator, the corresponding valid operator of the to-be-replaced operator is obtained.

[0128] Step 2: According to the bit order of the number encoding in the model watermark information, the target watermark encoding number corresponding to each to-be-replaced operator is determined.

[0129] Specifically, the electronic device obtains the operator sequence of the to-be-processed model according to the first arrangement order, and selects the to-be-replaced operator corresponding to each number encoding in the operator sequence.

[0130] The arrangement order of the to-be-replaced operator is the same as the bit order of the number encoding.

[0131] In one example, after the electronic device arranges the operators of the to-be-processed model according to the first arrangement order, the operator sequence is obtained, the order of the operators in the operator sequence is operator C, operator E, operator B, operator D and operator A, the model watermark information is 227, and the number of encoding bits is 3. Then, the electronic device selects three operators as to-be-replaced operators according to the arrangement order in the above operator sequence.

[0132] The to-be-replaced operator itself is the same as the arrangement order of the operator sequence, and the arrangement order of the three to-be-replaced operators is the same as the bit order of the number encoding of the model watermark information. Specifically, the electronic device randomly selects the to-be-replaced operators as operator C, operator E and operator A, and the arrangement order of operator C, operator E and operator A is the same as the arrangement order of the number encoding 227 in the model watermark information, that is, operator C corresponds to the number encoding 2, operator E corresponds to the number encoding 2, and operator A corresponds to the number encoding 7.

[0133] Step 3: For each to-be-replaced operator, the target valid operator corresponding to the target watermark encoding number is determined according to the correspondence between the valid operator and the watermark encoding number.

[0134] Step 4: For each to-be-replaced operator, the target valid operator is taken as the replacement operator corresponding to the to-be-replaced operator.

[0135] Using the method provided in this application, since the operators to be replaced are obtained by sorting the operators in the model to be processed based on a directed acyclic graph, the operators to be replaced have an arrangement order. Therefore, according to the positional order of the encoded numbers in the model watermark information, the target watermark encoded number corresponding to each operator to be replaced can be determined. Thus, according to the correspondence between valid operators and watermark encoded numbers, the replacement operator corresponding to each operator to be replaced can be obtained. In this way, by implanting valid operators into the model to be processed and implanting the watermark encoded numbers corresponding to the valid operators into the model to be processed, the watermark information of the model is implanted. Because the operators have anti-modification properties, the difficulty of cracking the model watermark is increased.

[0136] The following combination Figure 6 This describes the process of replacing the model to be processed to obtain the target model, such as... Figure 6 As shown:

[0137] Figure 6 Figure a shows the operators and data flow of the model to be processed, which includes operators A, B, C, D, E, and F.

[0138] Then the electronic device replaces the preset replacement operators in the model to be processed with invalid operators, wherein the preset replacement operators are the combination operations of operators B, operators F, and operators A and C.

[0139] Specifically, the electronic device randomly selects an invalid operator Xm from the invalid operators corresponding to operator B and replaces operator B with invalid operator Xm; it randomly selects an invalid operator Zm from the invalid operators corresponding to operator F and replaces operator F with invalid operator Zm; it randomly selects an invalid operator Ym from the invalid operators corresponding to the combined operation of operators A and C and replaces the combined operation of operators A and C with invalid operator Ym, resulting in the following... Figure 6 The first model is shown in Figure b.

[0140] Finally, the electronic device uses a directed acyclic graph traversal algorithm to sort the invalid operators in the first model to obtain a second sorting order. Then, according to the second sorting order, it randomly selects the operator to be replaced from the invalid operators in the first model.

[0141] Specifically, such as Figure 6 As shown in Figure c, the electronic device replaces the invalid operator Ym with the corresponding Y2, replaces the invalid operator Xm with X2, and replaces the invalid operator Zm with Z7.

[0142] The electronic device determines the order of each to-be-replaced operator according to the order of each to-be-replaced operator in the second arrangement order, and then determines the target digital code corresponding to each to-be-replaced operator according to the order of the to-be-replaced operator and the order of the digital code in the model watermark information. In the valid operator corresponding to the to-be-replaced operator, the operator name same as the target digital code is found, and the valid operator corresponding to the operator name is taken as the replacement operator of the to-be-replaced operator. Finally, the electronic device replaces the to-be-replaced operator with the replacement operator.

[0143] For example, the digital code information in the model watermark information is 227, the order of the to-be-replaced operator selected by the electronic device is invalid operator Ym, invalid operator Xm, and invalid operator Zm, and then the digital code corresponding to the invalid operator Ym is determined to be 2, the digital code corresponding to the invalid operator Xm is determined to be 2, and the digital code corresponding to the invalid operator Zm is determined to be 7 according to the order of the digital code in the order of the to-be-replaced operator. The electronic device determines the operator name Y2 corresponding to the watermark digital code 2 in the valid operator corresponding to the invalid operator Ym, obtains the valid operator Y2, and replaces the invalid operator Ym with the valid operator Y2 as the replacement operator; determines the operator name X2 corresponding to the watermark digital code 2 in the valid operator corresponding to the invalid operator Xm, obtains the valid operator X2, and replaces the invalid operator Xm with the valid operator X2 as the replacement operator; determines the operator name Z7 corresponding to the watermark digital code 7 in the valid operator corresponding to the invalid operator Zm, obtains the valid operator Z7, and replaces the invalid operator Zm with the valid operator Z7 as the replacement operator.

[0144] After the above replacement of the invalid operator is completed, in order to reduce the difficulty of evidence, the electronic device can also randomly select an invalid operator in the to-be-processed model to obtain a target invalid operator; and modify the target invalid operator to obtain an updated invalid operator.

[0145] The updated invalid operator is used to update the output of the invalid operator to a target value in a case where the input of the updated invalid operator is a preset value.

[0146] On the basis of the above modification of the invalid operator, in the evidence stage, the electronic device can verify the to-be-evidenced model by a black box verification method. Specifically, the electronic device inputs a preset value to the to-be-evidenced model, the updated invalid operator in the model can input a specific value, and then triggers the model to realize printing, error reporting or output of a specific value. In the case that the model is in the above abnormal condition, it is determined that the model is a infringing model.

[0147] In this way, in the evidence stage of the to-be-evidenced model, a specific preset value can be input, and whether the to-be-evidenced model is an infringing model can be determined by judging whether the output of the invalid operator is a target value, thereby reducing the difficulty of evidence.

[0148] After the model watermark information is implanted into the to-be-processed model, in the evidence presentation of the to-be-identified model, in addition to the black-box verification method, a white-box verification method can also be used to present the evidence of the to-be-identified model. Specifically, the method of presenting the evidence of the to-be-identified model by using the white-box verification method is as follows, as shown in Figure 7

[0149] S701, obtaining an operator included in the to-be-identified model.

[0150] S702, constructing a third directed acyclic graph based on the operator included in the to-be-identified model.

[0151] S703, obtaining the to-be-identified model watermark information corresponding to the to-be-identified model according to the third directed acyclic graph and the correspondence between the valid operator and the watermark code number.

[0152] Among them, the electronic device can call the correspondence between the operator name of the valid operator and the watermark code number, then compare the operator name in the model, get the watermark code number corresponding to each operator, and finally determine the order of each operator according to the third directed acyclic graph, get the model watermark information composed of the watermark code number.

[0153] S704, in the case that the to-be-identified model watermark information and the model watermark information are the same, determining that the to-be-identified model is the target model.

[0154] It should be noted that in the case that the model watermark information is a redundant error correction code, since the redundant error correction code can realize automatic error correction, in the case that the electronic device based on the model watermark information composed of the watermark code number exists error, the electronic device can correct the model watermark information based on the redundant error correction code to obtain the to-be-identified model watermark information. And based on the redundant error correction code, it can be judged whether the model structure is changed.

[0155] By using the method provided in the embodiment of the application, after obtaining the to-be-identified model, the corresponding directed acyclic graph is constructed for the operator in the to-be-identified model, so that the arrangement order of the operator in the to-be-identified model can be obtained, and then the model watermark information of the to-be-identified model is obtained according to the correspondence between the valid operator and the watermark code number. The model watermark information can be used to accurately judge whether the to-be-identified model is an infringing model.

[0156] Based on the same idea, the embodiment of the application provides a model watermark adding device, as shown in Figure 8 The device comprises:

[0157] The obtaining module 801 is configured to obtain model watermark information and a to-be-processed model.

[0158] ​The generating module 802 is configured to generate a plurality of effective operators corresponding to the operators included in the to-be-processed model according to the model watermark information, and each effective operator corresponds to a watermark encoding number, and the effective operator and the to-be-replaced operator have the same calculation logic.

[0159] The determining module 803 is configured to determine the to-be-replaced operator from the operators included in the to-be-processed model according to the model watermark information.

[0160] The determining module 803 is further configured to determine, according to the model watermark information and the watermark encoding number corresponding to the effective operator, the replacement operator corresponding to the to-be-replaced operator from the effective operators.

[0161] The replacing module 804 is configured to replace the to-be-replaced operator with the replacement operator.

[0162] In a possible implementation, the obtaining module 801 is specifically configured to:

[0163] obtain a preset numeral system and a model identifier corresponding to the to-be-processed model;

[0164] convert the model identifier into the preset numeral system to obtain the model watermark information.

[0165] In a possible implementation, the obtaining module 801 is specifically configured to:

[0166] convert the model identifier into a preset numeral system to obtain a watermark encoding;

[0167] perform redundancy error correction coding on the watermark encoding to obtain the model watermark information.

[0168] In a possible implementation, the generating module 802 is specifically configured to:

[0169] generate, according to the preset numeral system, a plurality of effective operators corresponding to the operators included in the to-be-processed model;

[0170] construct, for each effective operator, a corresponding relationship between an operator name of the effective operator and a watermark encoding number.

[0171] In a possible implementation, the determining module 803 is specifically configured to:

[0172] construct a first directed acyclic graph corresponding to the to-be-processed model based on the operators included in the to-be-processed model;

[0173] perform traversal on the first directed acyclic graph to obtain a first arrangement order of the operators included in the to-be-processed model;

[0174] According to the number of encoding bits of the model watermark information and the first arrangement order, the to-be-replaced operator is selected from operators included in the to-be-processed model.

[0175] In a possible implementation, the generating module 802 is further configured to:

[0176] For an operator included in the to-be-processed model, a plurality of invalid operators corresponding to the operator are generated, and the invalid operators have the same calculation logic as the operator.

[0177] In a possible implementation, the determining module 803 is configured to:

[0178] The preset replacement operator in the to-be-processed model is replaced by an invalid operator corresponding to the preset replacement operator, to obtain a first model;

[0179] Based on the invalid operators in the first model, a second directed acyclic graph corresponding to the first model is constructed;

[0180] The second directed acyclic graph is traversed, to obtain a second arrangement order of the invalid operators included in the first model;

[0181] According to the number of encoding bits of the model watermark information and the second arrangement order, the to-be-replaced operator is selected from the invalid operators included in the first model.

[0182] In a possible implementation, the determining module 803 is configured to:

[0183] For each to-be-replaced operator, an effective operator corresponding to the to-be-replaced operator is obtained;

[0184] According to a bit order of a digital code in the model watermark information, a target watermark code number corresponding to each to-be-replaced operator is determined;

[0185] For each to-be-replaced operator, according to a corresponding relationship between the effective operator and the watermark code number, a target effective operator corresponding to the target watermark code number is determined;

[0186] For each to-be-replaced operator, the target effective operator is taken as the replacement operator corresponding to the to-be-replaced operator.

[0187] In a possible implementation, the determining module 803 is specifically configured to:

[0188] According to the first arrangement order, an operator sequence of the to-be-processed model is obtained;

[0189] In the operator sequence, a to-be-replaced operator corresponding to each digital code is selected, and an arrangement order of the to-be-replaced operator is the same as a bit order of the digital code.

[0190] In a possible implementation, the apparatus further includes:

[0191] a random selection module configured to randomly select an invalid operator in the to-be-processed model to obtain a target invalid operator;

[0192] a modification module configured to modify the target invalid operator to obtain an updated invalid operator, wherein an output of the updated invalid operator is a target value when an input of the updated invalid operator is a preset value.

[0193] It should be noted that the model watermark adding apparatus corresponds to the model watermark adding method applied to the electronic device, and all implementation manners in the method embodiments are applicable to the apparatus embodiments, and the same technical effects can be achieved.

[0194] Figure 9 A hardware structure schematic diagram of an electronic device is shown.

[0195] The electronic device can include a processor 901 and a memory 902 having computer program instructions stored therein.

[0196] Specifically, the processor 901 can include a central processing unit (CPU), or an application specific integrated circuit (ASIC), or one or more integrated circuits configured to implement one or more embodiments of the present application.

[0197] The memory 902 can include a mass storage for data or instructions. By way of example and not limitation, the memory 902 can include a hard disk drive (HDD), a floppy disk drive, a flash memory, an optical disk, a magneto-optical disk, a magnetic tape, or a universal serial bus (USB) drive or a combination of two or more of these. The memory 902 can include removable or non-removable (or fixed) media, where appropriate. The memory 902 can be integral to, or external to, the integrated gateway disaster recovery device, as appropriate. In particular embodiments, the memory 902 is non-volatile, solid-state memory.

[0198] The memory can include read-only memory (ROM), random access memory (RAM), magnetic disk storage media devices, optical storage media devices, flash memory devices, electrical, optical, or other physical / tangible memory storage devices. Thus, generally, the memory includes one or more tangible (non-transitory) computer-readable storage media (e.g., memory devices) encoded with software that, when executed (e.g., by one or more processors), is operable to perform the operations described with reference to the methods according to an aspect of the present disclosure.

[0199] The processor 901 implements the method of any one of the above-described embodiments by reading and executing computer program instructions stored in the memory 902.

[0200] In one example, the electronic device can further include a communication interface 903 and a bus 904. As shown, the processor 901, the memory 902, and the communication interface 903 are connected through the bus 904 and complete communication therebetween. Figure 9

[0201] The communication interface 903 is mainly used to realize the communication between the modules, devices, units, and / or equipment in the embodiments of the present application.

[0202] The bus 904 includes hardware, software, or both, which couples the components of the electronic device to each other. By way of example, and not limitation, the bus can include an Accelerated Graphics Port (AGP) or other graphics bus, an Enhanced Industry Standard Architecture (EISA) bus, a Front Side Bus (FSB), a HyperTransport (HT) interconnect, an Industry Standard Architecture (ISA) bus, an InfiniBand interconnect, a Low Pin Count (LPC) bus, a memory bus, a Micro Channel Architecture (MCA) bus, a Peripheral Component Interconnect (PCI) bus, a PCI-Express (PCI-X) bus, a Serial Advanced Technology Attachment (SATA) bus, a Video Electronics Standards Association Local (VLB) bus, or another suitable bus or combination of two or more of these. Where appropriate, the bus 904 can include one or more buses. Although the present application describes and illustrates a particular bus, the present application contemplates any suitable bus or interconnect.

[0203] In addition, in combination with the method of model watermark addition in the above-described embodiments, the embodiments of the present application can provide a computer storage medium to implement. The computer storage medium has computer program instructions stored thereon; the computer program instructions are executed by the processor to implement the method of model watermark addition in any one of the above-described embodiments.

[0204] ​In combination with the model watermark adding method in the above embodiments, the embodiments of the present application can provide a computer program product, instructions in the computer program product are executed by a processor of an electronic device, so that the electronic device executes any one of the model watermark adding methods in the above embodiments.

[0205] It should be noted that the present application is not limited to the specific configurations and processes described above and shown in the drawings. For the sake of brevity, detailed descriptions of well-known methods are omitted. In the above embodiments, several specific steps are described and shown as examples. However, the method processes of the present application are not limited to the specific steps described and shown, and those skilled in the art can make various changes, modifications and additions, or change the order of the steps, after understanding the spirit of the present application.

[0206] The functional blocks shown in the structural block diagrams described above can be implemented as hardware, software, firmware or a combination thereof. When implemented in hardware, it can be, for example, an electronic circuit, an application specific integrated circuit (ASIC), appropriate firmware, a plug-in, a functional card, etc. When implemented in software, the elements of the present application are program or code segments used to perform the required tasks. The program or code segments can be stored in a machine-readable medium or transmitted through a data signal carried in a carrier wave over a transmission medium or communication link. The "machine-readable medium" can include any medium capable of storing or transmitting information. Examples of the machine-readable medium include electronic circuits, semiconductor memory devices, ROM, flash memory, erasable ROM (EROM), floppy disks, CD-ROMs, optical disks, hard disks, optical fiber media, radio frequency (RF) links, etc. The code segments can be downloaded via a computer network such as the Internet, an intranet, etc.

[0207] It should also be noted that the exemplary embodiments mentioned in the present application describe some methods or systems based on a series of steps or devices. However, the present application is not limited to the order of the above steps, that is, the steps can be executed in the order mentioned in the embodiments, or in an order different from the embodiments, or several steps can be executed simultaneously.

[0208] The computer program instructions can also be loaded onto a computer, other programmable data processing apparatus, or other processing device to cause a series of operational steps to be performed on the computer, other programmable apparatus or other processing device to produce a computer implemented process such that the instructions which execute on the computer or other programmable apparatus provide processes for implementing the functions / acts specified in the flowchart and / or block diagram block or blocks.

[0209] The above description is only specific embodiments of the present application, and those skilled in the art can clearly understand that, for the convenience and brevity of description, the specific working process of the above-described system, module and unit can refer to the corresponding process in the foregoing method embodiments, which will not be described herein. It should be understood that the protection scope of the present application is not limited to this, and any person skilled in the art can easily think of various equivalent modifications or replacements within the technical range disclosed in the present application, and these modifications or replacements shall be covered within the protection scope of the present application.

Claims

1. A method of model watermark addition, characterized by, The method comprises the following steps: obtaining model watermark information and a to-be-processed model; generating a plurality of effective operators corresponding to each operator in the to-be-processed model according to the model watermark information, each effective operator corresponding to a watermark encoding number, the effective operator and an operator included in the to-be-processed model having the same calculation logic; determining a to-be-replaced operator among the operators included in the to-be-processed model according to the model watermark information; determining a replacement operator corresponding to the to-be-replaced operator among the effective operators according to the model watermark information and the watermark encoding number corresponding to the effective operator; replacing the to-be-replaced operator with the replacement operator to obtain a target model; the step of determining the to-be-replaced operator among the operators included in the to-be-processed model according to the model watermark information comprises the following steps: constructing a first directed acyclic graph corresponding to the to-be-processed model based on the operators included in the to-be-processed model; obtaining a first arrangement sequence of the operators included in the to-be-processed model by traversing the first directed acyclic graph; selecting the to-be-replaced operator among the operators included in the to-be-processed model according to the number of encoding bits of the model watermark information and the first arrangement sequence.

2. The method of claim 1, wherein, the step of obtaining the model watermark information and the to-be-processed model comprises the following steps: obtaining a preset numeral system and a model identifier corresponding to the to-be-processed model; converting the model identifier into the preset numeral system to obtain the model watermark information.

3. The method of claim 2, wherein, the step of converting the model identifier into the preset numeral system to obtain the model watermark information comprises the following steps: converting the model identifier into a preset numeral system to obtain watermark encoding; performing redundancy error correction coding on the watermark encoding to obtain the model watermark information.

4. The method of claim 2, wherein, the step of generating a plurality of effective operators corresponding to each operator in the to-be-processed model according to the model watermark information comprises the following steps: generating a plurality of effective operators corresponding to each operator included in the to-be-processed model according to the preset numeral system; constructing a corresponding relationship between the operator name and the watermark encoding number of each effective operator.

5. The method of claim 4, wherein, the method further comprises the following steps: generating a plurality of invalid operators corresponding to each operator included in the to-be-processed model, the invalid operator having the same calculation logic as the operator.

6. The method of claim 5, wherein, the step of determining the to-be-replaced operator among the operators included in the to-be-processed model according to the model watermark information comprises the following steps: replacing a preset replacement operator in the to-be-processed model with an invalid operator corresponding to the preset replacement operator to obtain a first model; constructing a second directed acyclic graph corresponding to the first model based on the invalid operators in the first model; obtaining a second arrangement sequence of the invalid operators included in the first model by traversing the second directed acyclic graph; selecting the to-be-replaced operator among the invalid operators included in the first model according to the number of encoding bits of the model watermark information and the second arrangement sequence.

7. The method of claim 1, wherein, the step of determining a replacement operator corresponding to the to-be-replaced operator among the effective operators according to the model watermark information and the watermark encoding number corresponding to the effective operator comprises the following steps: for each to-be-replaced operator, obtaining an effective operator corresponding to the to-be-replaced operator; determine, according to the bit order of the digital encoding in the model watermark information and the first arrangement order, a target watermark encoding number corresponding to each of the to-be-replaced operators; for each of the to-be-replaced operators, determine a target effective operator corresponding to the target watermark encoding number according to the correspondence between the effective operators and the watermark encoding numbers; for each of the to-be-replaced operators, take the target effective operator as the replacement operator corresponding to the to-be-replaced operator.

8. The method of claim 7, wherein, The determining, according to the bit order of the digital encoding in the model watermark information and the first arrangement order, of a target watermark encoding number corresponding to each of the to-be-replaced operators comprises: obtaining an operator sequence of the to-be-processed model according to the first arrangement order; selecting, in the operator sequence, a to-be-replaced operator corresponding to each of the digital encodings, the arrangement order of the to-be-replaced operator being the same as the bit order of the digital encoding.

9. The method of claim 5, wherein, After the to-be-replaced operator is replaced by the replacement operator, the method further comprises: randomly selecting an invalid operator in the to-be-processed model to obtain a target invalid operator; modifying the target invalid operator to obtain an updated invalid operator, the output of the updated invalid operator being a target value when the input of the updated invalid operator is a preset value.

10. An apparatus for model watermark addition, characterized by comprise: an obtaining module configured to obtain model watermark information and a to-be-processed model; a generating module configured to generate, according to the model watermark information, a plurality of effective operators corresponding to each of the operators in the to-be-processed model, each of the effective operators corresponding to a watermark encoding number, the effective operators and the operators included in the to-be-processed model having the same calculation logic; a determining module configured to determine, according to the model watermark information, to-be-replaced operators from among the operators included in the to-be-processed model; the determining module is further configured to determine, according to the model watermark information and the watermark encoding numbers corresponding to the effective operators, replacement operators corresponding to the to-be-replaced operators from among the effective operators; a replacing module configured to replace the to-be-replaced operators by the replacement operators to obtain a target model; the determining module is specifically configured to: construct a first directed acyclic graph corresponding to the to-be-processed model based on the operators included in the to-be-processed model; perform traversal on the first directed acyclic graph to obtain a first arrangement order of the operators included in the to-be-processed model; select the to-be-replaced operators from among the operators included in the to-be-processed model according to the number of encoding bits of the model watermark information and the first arrangement order.

11. An electronic device, comprising: The device comprises a processor and a memory having stored computer program instructions; The processor executes the computer program instructions to implement the method for adding a model watermark according to any one of claims 1-9.

12. A computer-readable storage medium, characterized in that, The computer program instructions are stored on the computer readable storage medium and are executed by the processor to implement the method for adding a model watermark according to any one of claims 1-9.

13. A computer program product, characterised in that, The instructions in the computer program product are executed by the processor of the electronic device to cause the electronic device to perform the method for adding a model watermark according to any one of claims 1-9.

Images