Bayesian-based two-stage deep regression model copyright protection method

Abstract

The invention discloses a Bayesian-based two-stage deep regression model copyright protection method, which comprises the steps of 1, constructing and training a dropout layer-based watermark model, 2, acquiring a public model and a suspicious model, 3, selecting a key sample, 4, constructing a Bayesian network-based likelihood estimation model, 5, selecting a Bayesian network-based likelihood estimation model, 6, selecting a Bayesian network-based likelihood estimation model, and 7, selecting a Bayesian network-based likelihood estimation model. 5, calculating the infringement probability of the suspicious model by using a likelihood estimation model based on the Bayesian network; and 6, calculating the KL divergence between the suspicious model and the output of the watermark model so as to judge whether the suspicious model infringers or not. When copyright of the regression model is stolen, irrelevant models can be preliminarily excluded in the first stage, and whether the suspicious model is the pirated model or not is further judged in the second stage, so that the pirated model can be quickly identified, and intellectual property of the pirated model is protected from being infringed.

Description

Technical Field

[0001] The present invention relates to the field of artificial intelligence model security, and in particular to a copyright protection method for regression models. Background Art

[0002] In recent years, various large-scale deep learning (DL) models have developed rapidly. However, the training cost of large deep learning models is high, so these models are regarded as the intellectual property of the training party. However, due to the intrinsic value of DL models, they often become the target of malicious attackers. At present, the theft of DL models can be achieved without leaving obvious traces, and various attacks pose a major threat to the intellectual property of model owners, so companies urgently need technology to protect the intellectual property of model owners from infringement.

[0003] In recent years, there has been an increasing number of studies on copyright protection for DL ​​models. For example, the paper [Embedding watermarks into deep neural networks, 2017] proposed using a T-bit string as a watermark, then using an additional regularization loss to train the model to embed the watermark into the weights of the intermediate layer, and finally claiming ownership by detecting specific watermarks in the target layer; the paper [Robust and undetectable white-box watermarks for deep neural networks, 2019] proposed a white-box watermarking scheme based on a generative adversarial network; the paper [Watermarking in deep neural networks via error back-propagation, 2020] embeds watermarks in the original model parameters and uses an additional neural network to verify the watermark. However, these studies only target white-box scenarios, that is, they require that the internal weights of the suspicious model are available. When the attacker deploys the pirated model to the cloud and the model owner cannot access the internal weights of the pirated model, these white-box watermarking schemes become invalid.

[0004] In order to overcome the defects of white-box scenarios, it is possible to consider verifying the copyright of the model only through the model output. Recently, many studies have focused on copyright protection technology in black-box scenarios. For example, the literature [Robust watermarking of neural network with exponential weighting, 2019] randomly selects a part of the images from the training set and changes their labels as the trigger set. When the trigger set samples are used to query the suspicious model and obtain the changed labels, ownership can be claimed; the literature [Turning your weakness into a strength: watermarking deepneural networks by backdooring, 2018] uses the misclassified samples in the training set as the watermark trigger set and generates random labels for them; the literature [IPGuard: Protecting intellectual property of deep neural networks via fingerprinting the classification boundary, 2021] recommends using adversarial samples that are very close to the decision boundary to identify the decision boundary and claim ownership. However, these studies are mainly aimed at classification models and cannot be extended to other deep learning models. The LSTM model used for air pollution prediction is actually a deep regression model that outputs continuous values, so the above-mentioned method dedicated to classification models cannot be used to achieve copyright protection. Summary of the invention

[0005] In order to overcome the shortcomings of the prior art, the present invention proposes a Bayesian-based two-stage deep regression model copyright protection method, so that when the internal weights of the pirated model cannot be accessed, the pirated regression model can be effectively, quickly and accurately identified, thereby protecting the intellectual property rights of the regression model owner.

[0006] In order to achieve the above-mentioned purpose, the present invention adopts the following technical scheme:

[0007] The copyright protection method based on the Bayesian two-stage deep regression model of the present invention is characterized in that it is carried out according to the following steps:

[0008] Step 1: Build and train a watermark model based on the dropout layer;

[0009] Step 2, obtaining K air pollution prediction models including dropout layers as K public models;

[0010] Obtain a pirated air pollution prediction model that the copyright owner believes infringes the copyright of the watermark model and use it as a suspicious model;

[0011] Step 3. Select the watermark model The air pollution data of the first M time steps with the smallest loss are respectively used as M key samples;

[0012] Step 4: Take the i-th key sample Input the suspicious model for processing to obtain the i-th key sample Predicted air pollution levels ;

[0013] make The binary indicator variable is ,and It follows Bernoulli distribution;

[0014] like , indicating that the suspicious model is a copy of the watermarked model;

[0015] like , indicating that the suspicious model is a copy of the kth public model;

[0016] Step 5: Use the likelihood estimation model based on the Bayesian network to calculate the infringement probability of the suspicious model ;

[0017] Step 5.1: If , then iterative calculation Gaussian distribution The optimal mean and optimal variance :

[0018] Step 5.2: If , then iterative calculation Gaussian distribution The optimal mean and optimal variance ;

[0019] Step 5.3: Based on and as well as and , calculate the infringement probability of the suspicious model :

[0020] Step 5.4: If If the probability is less than the threshold, the suspicious model is initially considered to be a copy of the public model; otherwise, the suspicious model is initially considered to be a copy of the watermark model.

[0021] Step 6: Calculate the KL divergence mean L between the output of the suspicious model and the watermark model; if L is greater than the divergence threshold, the suspicious model is considered to be non-infringing; otherwise, the suspicious model is considered to be infringing.

[0022] The copyright protection method based on the Bayesian two-stage deep regression model described in the present invention is also characterized in that the step 1 is performed as follows:

[0023] Step 1.1: Obtain historical air pollution dataset ,in, represents the air pollution data at the e-th time step; E represents the total number of time steps;

[0024] Step 1.2: Build an LSTM model that includes an LSTM layer, a linear layer, and a dropout layer;

[0025] Use a random generator to generate the parameters of the dropout layer and use it as a watermark;

[0026] Will Input into the LSTM model for training to obtain the trained watermark model.

[0027] Further, the step 5.1 is performed as follows:

[0028] Step 5.1.1. Calculate the mean using formula (1) Gaussian distribution Variance ;

[0029] (1)

[0030] In formula (1), and for The two hyperparameters of the conjugate prior of ; T represents the transpose; Indicates that the dropout layer is turned on Repeated input into the watermark model for processing, and the average value of the predicted air pollution amount is obtained;

[0031] Step 5.1.2: Variance After initialization, use formula (2) to calculate Gaussian distribution The mean ;

[0032] (2)

[0033] Step 5.1.3: Use formula (3) to get Gaussian distribution Variance :

[0034] (3)

[0035] Step 5.1.4: Use equation (2) and equation (3) to and Perform iterative alternating updates until convergence, thus obtaining Gaussian distribution The optimal mean and optimal variance .

[0036] Further, the step 5.2 is performed as follows:

[0037] Step 5.2.1. Calculate the mean using formula (4) Gaussian distribution Variance ;

[0038] (4)

[0039] In formula (8), Indicates that the dropout layer is turned on Repeated input into the kth public model for processing, the average of the predicted air pollution obtained is, for 2 hyperparameters of the conjugate prior of ;

[0040] Step 5.2.2: Variance After initialization, we can use formula (5) to get Gaussian distribution The mean :

[0041] (5)

[0042] Step 5.2.3: Use formula (6) to get Gaussian distribution Variance :

[0043] (6)

[0044] Step 5.2.4: Use equations (5) and (6) to and Iterate and update alternately until convergence, thus obtaining Gaussian distribution The optimal mean and optimal variance .

[0045] Further, the step 5.3 is performed as follows:

[0046] Step 5.3.1: Calculate using formula (7) In Gaussian distribution The probability density on :

[0047] (7)

[0048] Step 5.3.2: Calculate using formula (8) hour, The probability density of :

[0049] (8)

[0050] Calculate using formula (9) hour, The probability density of :

[0051] (9)

[0052] Step 5.3.3, if , then it means A copy from the watermark model; otherwise, Copies from public models;

[0053] Step 5.3.4: Use formula (10) to calculate the infringement probability of the suspicious model :

[0054] (10)

[0055] In formula (10), and express The conjugate priors of the two hyperparameters are: express The number of times express The number of times; when season ,make ;when season ,make .

[0056] Further, the step 6 is performed as follows:

[0057] Step 6.1: When the dropout layer is turned on, the i-th key sample Repeatedly input the suspicious model for processing, obtain several predicted air pollution values ​​and take their average and variance ;

[0058] Step 6.2: When the dropout layer is turned on, the i-th key sample Repeatedly input the watermark model for processing to obtain several predicted air pollution values ​​and take their average and variance ;

[0059] Step 6.3: Use formula (11) to calculate the suspicious model and watermark model for key samples The KL divergence between the outputs of :

[0060] (11)

[0061] Step 6.4: Use formula (12) to calculate the mean of the output KL divergence between the suspicious model and the watermark model. : (12).

[0062] An electronic device of the present invention includes a memory and a processor, wherein the memory is used to store a program that supports the processor to execute the two-stage deep regression model copyright protection method, and the processor is configured to execute the program stored in the memory.

[0063] The present invention provides a computer-readable storage medium, and the computer-readable storage medium stores a computer program, which is characterized in that when the computer program is executed by a processor, the steps of the two-stage deep regression model copyright protection method are executed.

[0064] Compared with the prior art, the present invention has the following beneficial effects:

[0065] 1. This invention introduces a two-stage copyright verification framework of black box + white box, which is different from the previous copyright protection technology that only targets white box scenarios or only targets black box scenarios, and is more suitable for situations where it is difficult to obtain the internal weights of suspicious models. At the same time, this two-stage copyright verification framework is conducive to quickly eliminating irrelevant models and focusing more resources on judging suspicious models with a higher probability of infringement.

[0066] 2. The present invention proposes to use the parameters of the dropout layer as a watermark, which can not only verify the identity of the model, but also improve the performance of the model to a certain extent. This method effectively solves the defect that most watermark effects are at the expense of model accuracy.

[0067] 3. The present invention designs a likelihood estimation model based on a Bayesian network and a KL divergence model comparison method, so that the application scenarios of watermarks can be expanded to regression models, which helps to provide protection for more diverse models. BRIEF DESCRIPTION OF THE DRAWINGS

[0068] Figure 1 A probability graph model diagram of the likelihood estimation model based on the Bayesian network proposed by the present invention;

[0069] Figure 2 Flow chart of the method of the present invention. DETAILED DESCRIPTION

[0070] In this embodiment, a Bayesian two-stage deep regression model copyright protection method involves two different but sequential stages. In the first stage, the model owner is aware of potential suspicious models, but is not sure whether these models are indeed pirated models. Therefore, they will initiate a secret investigation to estimate the possibility of copyright infringement. The model owner inputs key samples to the suspicious model through the API, and then observes the response behavior of the suspicious model. Using the likelihood estimation model based on the Bayesian network, the owner can estimate the probability of copyright infringement. If the estimated probability exceeds a certain critical value, the process will enter the second stage, which is the public investigation stage. In the second stage, the model details are available, and the white-box watermark embedding technology can be used to further confirm whether there is infringement. The model owner can calculate the KL divergence between the watermark model and the suspicious model output and other existing indicators to make a more reliable judgment. Specifically, if Figure 2 As shown, the steps are as follows:

[0071] Step 1: Build and train a watermark model based on the dropout layer;

[0072] Step 1.1: Obtain historical air pollution dataset ,in, represents the air pollution data at the e-th time step; E represents the total number of time steps;

[0073] Step 1.2: Build an LSTM model that includes an LSTM layer, a linear layer, and a dropout layer;

[0074] Use a random generator to generate the parameters of the dropout layer and use it as a watermark; (The default state of the dropout layer in the prediction stage is off. At this time, the model will only produce a fixed prediction value when repeatedly predicting the same sample. If the dropout layer is set to on, the model will produce a set of different prediction values ​​when repeatedly predicting the same sample. At this time, the model's repeated prediction values ​​for the same sample can be regarded as obeying a Gaussian distribution. If the suspicious model is a copy of the watermark model, the parameters of their Gaussian distributions should be similar. At this time, the model ownership can be claimed by comparing the two Gaussian distributions. In order to distinguish it from the common parameter values ​​of the dropout layer, it is hoped that the generated parameter value is an uncommon value like 0.2769 that makes the model perform well)

[0075] Will Input into the LSTM model for training to obtain the trained watermark model.

[0076] Step 2, obtaining K air pollution prediction models including dropout layers as K public models;

[0077] The pirated air pollution prediction model that the copyright owner believes infringes the copyright of the watermark model is obtained and regarded as a suspicious model.

[0078] Step 3. Select the watermark model The air pollution data of the first M time steps with the smallest loss are taken as M key samples.

[0079] Step 4: Construct a likelihood estimation model based on Bayesian network;

[0080] Step 4.1: Take the i-th key sample Input into the suspicious model for processing to obtain the i-th key sample Predicted air pollution levels In the first stage, the internal parameters of the suspicious model cannot be obtained, so the dropout layer is not turned on in the test stage, and the prediction value of the suspicious model for the i-th key sample has only a fixed value .

[0081] make The binary indicator variable is ,and It follows Bernoulli distribution;

[0082] like , indicating that the suspicious model is a copy of the watermarked model;

[0083] like , indicating that the suspicious model is a copy of the kth public model;

[0084] Step 4.2, order The probability of coming from a copy of the watermark model, i.e. The infringement probability of the suspicious model is ,and It follows the Beta distribution. and It is the conjugate of the Beta distribution and the Bernoulli distribution.

[0085] Step 5: Calculate the infringement probability of the suspicious model using the likelihood estimation model based on the Bayesian network;

[0086] Step 5.1: If , then iterative calculation Gaussian distribution The mean and variance :

[0087] Step 5.1.1: Calculate using formula (1) Gaussian distribution Variance ;

[0088] (1)

[0089] In formula (1), and for The two hyperparameters of the conjugate prior of ; T represents the transpose; Indicates that the dropout layer is turned on Repeated input into the watermark model for processing, and the average value of the predicted air pollution amount is obtained;

[0090] The reasoning process of formula (1) is as follows:

[0091] The likelihood function of is (1a):

[0092] (1a)

[0093] In formula (1a), represent The observed value of the suspicious model is the air pollution prediction of the i-th key sample. ; The parameters are and The probability density function of the Gaussian distribution. The likelihood function of can be obtained by applying the maximum likelihood estimation formula (1).

[0094] Step 5.1.2: After initialization, use formula (2) to calculate Gaussian distribution The mean ;

[0095] (2)

[0096] The reasoning process of formula (2) is as follows:

[0097] Known ,about The log-likelihood function of is (2a):

[0098] (2a)

[0099] In formula (2a), The parameters are and The probability density function of the Gaussian distribution; The parameters are and The probability density function of the Gaussian distribution. Applying the maximum likelihood estimation to the log-likelihood function of can obtain equation (2).

[0100] Step 5.1.3: Use formula (3) to get Gaussian distribution Variance :

[0101] (3)

[0102] The reasoning process of formula (3) is as follows:

[0103] Known ,about The log-likelihood function of is (3a):

[0104] (3a)

[0105] In formula (3a), The parameters are and The probability density function of the Gaussian distribution. Applying the maximum likelihood estimation to the log-likelihood function of can obtain equation (3).

[0106] Step 5.1.4: Use equation (2) and equation (3) to and Perform iterative alternating updates until convergence, thus obtaining Gaussian distribution The optimal mean and optimal variance ;

[0107] Step 5.2: If , then iterative calculation Gaussian distribution The mean and variance ;

[0108] Step 5.2.1: Calculate using formula (4) Gaussian distribution Variance ;

[0109] (4)

[0110] The reasoning process of formula (4) is similar to that of formula (1).

[0111] In formula (8), Indicates that the dropout layer is turned on Repeated input into the kth public model for processing, the average of the predicted air pollution obtained is, for The conjugate priors for the 2 hyperparameters.

[0112] Step 5.2.2: After initialization, we can use formula (5) to get Gaussian distribution The mean :

[0113] (5)

[0114] The reasoning process of formula (5) is similar to that of formula (2).

[0115] Step 5.2.3: Use formula (6) to get Gaussian distribution Variance :

[0116] (6)

[0117] The reasoning process of formula (6) is similar to that of formula (3).

[0118] Step 5.2.4: Use equations (5) and (6) to and Iterate and update alternately until convergence, thus obtaining Gaussian distribution The optimal mean and optimal variance .

[0119] Step 5.3: Calculate the infringement probability of the suspected model :

[0120] Step 5.3.1: Calculate using formula (7) In Gaussian distribution The probability density on :

[0121] (7)

[0122] Step 5.3.2: Calculate using formula (8) hour, The probability density of :

[0123] (8)

[0124] Calculate using formula (9) hour, The probability density of :

[0125] (9)

[0126] Step 5.3.3, if , then it means A copy from the watermark model; otherwise, Copies from public models;

[0127] Step 5.3.4: Use formula (10) to calculate the infringement probability of the suspicious model :

[0128] (10)

[0129] In formula (10), and express The conjugate priors of the two hyperparameters are: express The number of times express The number of times; when season ,make ;when season ,make .

[0130] The reasoning process of formula (10) is as follows:

[0131] Bernoulli distribution . Indicates for The infringement probability of the suspicious model, given its conjugate prior , where the initial , , using the maximum a posteriori estimation, we can get The posterior probability distribution of is (10a):

[0132] (10a)

[0133] use The posterior probability distribution of The conjugate prior of is formula (10b):

[0134] (10b)

[0135] Using maximum a posteriori estimation, we can get The posterior probability distribution of is (10c):

[0136] (10c)

[0137] By calculating to the last key sample in this way, the final posterior probability distribution can be obtained as formula (10d):

[0138] (10d)

[0139] At this time, the infringement probability of the suspicious model can be calculated using formula (10): .

[0140] Step 5.4: If If the probability is less than the threshold, the suspicious model is initially considered to be a copy of the public model; otherwise, the suspicious model is initially considered to be a copy of the watermark model.

[0141] Step 6: Calculate the KL divergence between the suspicious model and the watermark model output;

[0142] Step 6.1: When the dropout layer is turned on, the i-th key sample Repeatedly input the suspicious model for processing, obtain several predicted air pollution values ​​and take their average and variance ;

[0143] Step 6.2: When the dropout layer is turned on, the i-th key sample Repeatedly input the watermark model for processing to obtain several predicted air pollution values ​​and take their average and variance .

[0144] Step 6.3: Use formula (11) to calculate the suspicious model and watermark model for key samples The KL divergence between the outputs of :

[0145] (11)

[0146] Step 6.4: Use formula (12) to calculate the mean of the output KL divergence between the suspicious model and the watermark model. :

[0147] (12).

[0148] Step 6.5: If L is greater than the divergence threshold, the suspicious model is considered not to infringe, otherwise, the suspicious model is considered to infringe.

[0149] In this embodiment, an electronic device includes a memory and a processor, wherein the memory is used to store a program that supports the processor to execute the above method, and the processor is configured to execute the program stored in the memory.

[0150] In this embodiment, a computer-readable storage medium stores a computer program on the computer-readable storage medium, and the computer program executes the steps of the above method when executed by a processor.

Claims

1. A copyright protection method based on a Bayesian two-stage deep regression model, characterized in that: The steps are as follows: Step 1: Build and train a watermark model based on the dropout layer; Step 2, obtaining K air pollution prediction models including dropout layers as K public models; Obtain a pirated air pollution prediction model that the copyright owner believes infringes the copyright of the watermark model and use it as a suspicious model; Step 3. Select the watermark model The air pollution data of the first M time steps with the smallest loss are respectively used as M key samples; Step 4: Take the i-th key sample Input the suspicious model for processing to obtain the i-th key sample Predicted air pollution levels ; make The binary indicator variable is ,and It follows Bernoulli distribution; like , indicating that the suspicious model is a copy of the watermarked model; like , indicating that the suspicious model is a copy of the kth public model; Step 5: Use the likelihood estimation model based on the Bayesian network to calculate the infringement probability of the suspicious model ; Step 5.1: If , then iterative calculation Gaussian distribution The optimal mean and optimal variance : Step 5.2: If , then iterative calculation Gaussian distribution The optimal mean and optimal variance ; Step 5.3: Based on and as well as and , calculate the infringement probability of the suspicious model : Step 5.4: If If the probability is less than the threshold, the suspicious model is initially considered to be a copy of the public model; otherwise, the suspicious model is initially considered to be a copy of the watermark model. Step 6: Calculate the KL divergence mean L between the output of the suspicious model and the watermark model; if L is greater than the divergence threshold, the suspicious model is considered to be non-infringing; otherwise, the suspicious model is considered to be infringing.

2. According to claim 1, a copyright protection method based on a Bayesian two-stage deep regression model is characterized in that: The step 1 is carried out as follows: Step 1.1: Obtain historical air pollution dataset ,in, represents the air pollution data at the e-th time step; E represents the total number of time steps; Step 1.2: Build an LSTM model that includes an LSTM layer, a linear layer, and a dropout layer; Use a random generator to generate the parameters of the dropout layer and use it as a watermark; Will Input into the LSTM model for training to obtain the trained watermark model.

3. The copyright protection method based on the Bayesian two-stage deep regression model according to claim 2 is characterized in that: The step 5.1 is carried out as follows: Step 5.1.

1. Calculate the mean using formula (1) Gaussian distribution Variance ; (1) In formula (1), and for The two hyperparameters of the conjugate prior of ; T represents the transpose; Indicates that the dropout layer is turned on Repeated input into the watermark model for processing, and the average value of the predicted air pollution amount is obtained; Step 5.1.2: Variance After initialization, use formula (2) to calculate Gaussian distribution The mean ; (2) Step 5.1.3: Use formula (3) to get Gaussian distribution Variance : (3) Step 5.1.4: Use equation (2) and equation (3) to and Perform iterative alternating updates until convergence, thus obtaining Gaussian distribution The optimal mean and optimal variance .

4. The copyright protection method based on the Bayesian two-stage deep regression model according to claim 3 is characterized in that: The step 5.2 is carried out as follows: Step 5.2.

1. Calculate the mean using formula (4) Gaussian distribution Variance ; (4) In formula (8), Indicates that the dropout layer is turned on Repeated input into the kth public model for processing, the average of the predicted air pollution obtained is, for 2 hyperparameters of the conjugate prior of ; Step 5.2.2: Variance After initialization, we use formula (5) to get Gaussian distribution The mean : (5) Step 5.2.3: Use formula (6) to get Gaussian distribution Variance : (6) Step 5.2.4: Use equations (5) and (6) to and Iterate and update alternately until convergence, thus obtaining Gaussian distribution The optimal mean and optimal variance .

5. The copyright protection method based on the Bayesian two-stage deep regression model according to claim 4 is characterized in that: The step 5.3 is carried out as follows: Step 5.3.1: Calculate using formula (7) In Gaussian distribution The probability density on : (7) Step 5.3.2: Calculate using formula (8) hour, The probability density of : (8) Calculate using formula (9) hour, The probability density of : (9) Step 5.3.3, if , then it means A copy from the watermark model; otherwise, Copies from public models; Step 5.3.4: Use formula (10) to calculate the infringement probability of the suspicious model : (10) In formula (10), and express The conjugate priors of the two hyperparameters are: express The number of times, express The number of times; when season ,make ;when season ,make .

6. The copyright protection method based on the Bayesian two-stage deep regression model according to claim 5 is characterized in that: The step 6 is carried out as follows: Step 6.1: When the dropout layer is turned on, the i-th key sample Repeatedly input the suspicious model for processing, obtain several predicted air pollution values ​​and take their average and variance ; Step 6.2: When the dropout layer is turned on, the i-th key sample Repeatedly input the watermark model for processing to obtain several predicted air pollution values ​​and take their average and variance ; Step 6.3: Use formula (11) to calculate the suspicious model and watermark model for key samples The KL divergence between the outputs of : (11) Step 6.4: Use formula (12) to calculate the mean of the output KL divergence between the suspicious model and the watermark model. : (12)。 7. An electronic device, comprising a memory and a processor, characterized in that: The memory is used to store a program that supports the processor to execute the two-stage deep regression model copyright protection method described in any one of claims 1-6, and the processor is configured to execute the program stored in the memory.

8. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the steps of the two-stage deep regression model copyright protection method described in any one of claims 1 to 6 are executed.

Images