A copyright protection method based on Bayesian two-stage deep regression model

Abstract

This invention discloses a two-stage deep regression model copyright protection method based on Bayesian principles, comprising: 1. constructing and training a watermarking model based on a dropout layer; 2. obtaining public and suspicious models; 3. selecting key samples; 4. constructing a likelihood estimation model based on a Bayesian network; 5. calculating the infringement probability of the suspicious model using the likelihood estimation model based on the Bayesian network; and 6. calculating the KL divergence between the outputs of the suspicious model and the watermarking model to determine whether the suspicious model infringes copyright. This invention, when dealing with the theft of regression model copyright, can initially exclude irrelevant models in the first stage and further determine whether the suspicious model is a pirated model in the second stage, which is beneficial for quickly identifying pirated models and protecting their intellectual property rights from infringement.

Description

Technical Field

[0001] This invention relates to the field of artificial intelligence model security, specifically to a copyright protection method for regression models. Background Technology

[0002] In recent years, various large-scale deep learning (DL) models have developed rapidly. However, the training cost of large-scale deep learning models is very high, thus these models are considered the intellectual property of the trainer. However, due to the inherent value of DL models, they frequently become targets for malicious attackers. Currently, the theft of DL models can be achieved without leaving obvious traces, and various attacks pose a significant threat to the intellectual property rights of model owners. Therefore, companies urgently need technologies to protect the intellectual property rights of model owners from infringement.

[0003] In recent years, research on copyright protection for deep neural networks (DL) models has increased significantly. For example, the paper [Embedding watermarks into deep neural networks, 2017] proposes using a T-bit string as a watermark, then training the model with additional regularization loss to embed the watermark into the weights of intermediate layers, and finally claiming ownership by detecting specific watermarks in the target layer; the paper [Robust and undetectable white-box watermarks for deep neural networks, 2019] proposes a white-box watermarking scheme based on generative adversarial networks; and the paper [Watermarking in deep neural networks via error back-propagation, 2020] embeds watermarks into the original model parameters and uses additional neural networks to verify the watermarks. However, these studies only target white-box scenarios, meaning they require the internal weights of the suspected model to be accessible. When attackers deploy pirated models to the cloud, and the model owner cannot access the internal weights of the pirated model, these white-box watermarking schemes become ineffective.

[0004] To overcome the limitations of white-box scenarios, it's possible to verify model copyright solely through model output. Recent research has also focused on copyright protection techniques in black-box scenarios. For example, the paper [Robust watermarking of neural network with exponential weighting, 2019] randomly selects a subset of images from the training set and changes their labels as a trigger set. When a suspicious model is queried using samples from this trigger set and the changed labels are obtained, ownership can be claimed. The paper [Turning your weakness into a strength: watermarking deep neural networks by backdooring, 2018] uses misclassified samples from the training set as a watermark trigger set and generates random labels for them. The paper [IPGuard: Protecting intellectual property of deep neural networks via fingerprinting the classification boundary, 2021] suggests using adversarial examples very close to the decision boundary to identify the decision boundary and thus claim ownership. However, these studies primarily target classification models and cannot be extended to other deep learning models. LSTM models used for air pollution prediction are actually deep regression models that output continuous numerical values; therefore, the methods described above, specifically for classification models, cannot be used for copyright protection. Summary of the Invention

[0005] To overcome the shortcomings of existing technologies, this invention proposes a copyright protection method for a two-stage deep regression model based on Bayesian principles. This method aims to effectively, quickly, and accurately identify pirated regression models when the internal weights of the pirated model cannot be accessed, thereby protecting the intellectual property rights of the regression model owner.

[0006] To achieve the above-mentioned objectives, the present invention adopts the following technical solution:

[0007] The copyright protection method based on a two-stage deep regression model of Bayes in this invention is characterized by the following steps:

[0008] Step 1: Build and train a watermarking model based on the dropout layer;

[0009] Step 2: Obtain K air pollution prediction models that include dropout layers as K common models;

[0010] Obtain pirated air pollution prediction models that the copyright owners believe infringe on the copyright of watermarked models and treat them as suspicious models;

[0011] Step 3: Select the watermark model in The air pollution data at the M time steps with the least loss were used as the M key samples.

[0012] Step 4: Select the i-th key sample The input is processed in the suspicious model to obtain the i-th key sample. Predicted air pollution levels ;

[0013] make The binary indicator variable is ,and Follows a Bernoulli distribution;

[0014] like This indicates that the suspicious model is a copy of the watermark model;

[0015] like , indicating that the suspicious model is a copy of the k-th public model;

[0016] Step 5: Calculate the infringement probability of the suspected model using a Bayesian network-based likelihood estimation model. ;

[0017] Step 5.1, if Then iterative calculation Follows a Gaussian distribution optimal mean and optimal variance :

[0018] Step 5.2, if Then iterative calculation Follows a Gaussian distribution optimal mean and optimal variance ;

[0019] Step 5.3, based on and as well as and Calculate the infringement probability of the suspicious model. :

[0020] Step 5.4, if If the probability is less than the probability threshold, the suspicious model is initially considered to be a copy of the public model; otherwise, the suspicious model is initially considered to be a copy of the watermark model.

[0021] Step 6: Calculate the mean KL divergence L between the outputs of the suspicious model and the watermarked model; if L is greater than the divergence threshold, the suspicious model is considered not to infringe; otherwise, the suspicious model is considered to infringe.

[0022] The copyright protection method based on a two-stage deep regression model of Bayes as described in this invention is characterized in that step 1 is performed as follows:

[0023] Step 1.1: Obtain historical air pollution data set ,in, This represents the air pollution level data at the e-th time step; E represents the total number of time steps.

[0024] Step 1.2: Construct an LSTM model containing an LSTM layer, a linear layer, and a dropout layer;

[0025] Use a random generator to generate parameters for the dropout layer and use them as a watermark;

[0026] Will The LSTM model is input for training to obtain the trained watermark model.

[0027] Furthermore, step 5.1 is performed as follows:

[0028] Step 5.1.1: Calculate the mean using equation (1). Follows a Gaussian distribution variance ;

[0029] (1)

[0030] In equation (1), and for The two hyperparameters of the conjugate prior; T denotes transpose; Indicates when the dropout layer is enabled The average of the predicted air pollution levels is obtained by repeatedly inputting the watermark into the model for processing.

[0031] Step 5.1.2, Counterparts After initialization, calculate using equation (2). Follows a Gaussian distribution mean ;

[0032] (2)

[0033] Step 5.1.3, using equation (3) to obtain Follows a Gaussian distribution variance :

[0034] (3)

[0035] Step 5.1.4, using equations (2) and (3) to... and Perform iterative alternating updates until convergence, thereby obtaining... Follows a Gaussian distribution optimal mean and optimal variance .

[0036] Furthermore, step 5.2 is performed as follows:

[0037] Step 5.2.1: Calculate the mean using equation (4). Follows a Gaussian distribution variance ;

[0038] (4)

[0039] In equation (8), Indicates when the dropout layer is enabled The data is repeatedly input into the k-th common model for processing, and the mean of the predicted air pollution levels is obtained. for The two hyperparameters of the conjugate prior;

[0040] Step 5.2.2, Calculate the difference After initialization, equation (5) is used to obtain Follows a Gaussian distribution mean :

[0041] (5)

[0042] Step 5.2.3, using equation (6) to obtain Follows a Gaussian distribution variance :

[0043] (6)

[0044] Step 5.2.4, using equations (5) and (6) to... and Perform iterative alternating updates until convergence is achieved, thereby obtaining... Follows a Gaussian distribution optimal mean and optimal variance .

[0045] Furthermore, step 5.3 is performed as follows:

[0046] Step 5.3.1, calculate using equation (7) Gaussian distribution probability density on :

[0047] (7)

[0048] Step 5.3.2: Calculate using equation (8) hour, probability density :

[0049] (8)

[0050] Calculate using equation (9) hour, probability density :

[0051] (9)

[0052] Step 5.3.3, if , then it means A copy from the watermark model; otherwise, it indicates... A copy from a public model;

[0053] Step 5.3.4: Calculate the infringement probability of the suspicious model using equation (10). :

[0054] (10)

[0055] In equation (10), and express The two hyperparameters of the conjugate prior, express Number of times, express The number of times; when season ,make ;when season ,make .

[0056] Furthermore, step 6 is performed as follows:

[0057] Step 6.1: When the dropout layer is enabled, the i-th key sample... The suspected data was repeatedly input into the model for processing, resulting in several predicted air pollution levels, which were then averaged. and variance ;

[0058] Step 6.2: When the dropout layer is enabled, the i-th key sample... The data is repeatedly input into the watermarking model for processing, resulting in several predicted air pollution levels, which are then averaged. and variance ;

[0059] Step 6.3: Use equation (11) to calculate the suspicious model and watermark model for key samples. KL divergence between outputs :

[0060] (11)

[0061] Step 6.4: Calculate the mean of the output KL divergence between the suspicious model and the watermark model using equation (12). : (12).

[0062] The present invention provides an electronic device, comprising a memory and a processor, wherein the memory is used to store a program that supports the processor in executing the two-stage deep regression model copyright protection method, and the processor is configured to execute the program stored in the memory.

[0063] The present invention discloses a computer-readable storage medium on which a computer program is stored, wherein the computer program, when executed by a processor, performs the steps of the copyright protection method for the two-stage deep regression model.

[0064] Compared with the prior art, the beneficial effects of the present invention are as follows:

[0065] 1. This invention introduces a two-stage copyright verification framework combining black-box and white-box methods. Unlike previous copyright protection technologies that only addressed white-box or black-box scenarios, this framework is more suitable for situations where it is difficult to obtain the internal weights of suspicious models. Furthermore, this two-stage copyright verification framework facilitates the rapid elimination of irrelevant models, allowing more resources to be focused on identifying suspicious models with a higher probability of infringement.

[0066] 2. This invention proposes using dropout layer parameters as watermarks, which can not only verify the model's identity but also improve the model's performance to a certain extent. This method effectively solves the problem that most watermarking effects come at the cost of sacrificing model accuracy.

[0067] 3. This invention designs a likelihood estimation model based on Bayesian networks and a comparison method for KL divergence models, which enables the application scenarios of watermarking to be extended to regression models, and helps to provide protection for more diverse models. Attached Figure Description

[0068] Figure 1 This is a probabilistic graphical model diagram of the likelihood estimation model based on Bayesian networks proposed in this invention.

[0069] Figure 2 Flowchart of the method of the present invention. Detailed Implementation

[0070] In this embodiment, a copyright protection method based on a two-stage deep regression model using Bayesian methods involves two distinct but sequential stages. In the first stage, the model owner becomes aware of potentially suspicious models but is unsure whether they are indeed pirated. Therefore, they initiate a covert investigation to estimate the likelihood of copyright infringement. The model owner inputs key samples into the suspicious model via an API and observes the model's response behavior. Using a likelihood estimation model based on a Bayesian network, the owner can estimate the probability of copyright infringement. If the estimated probability exceeds a certain threshold, the process proceeds to the second stage, the public investigation stage. In the second stage, when model details are available, white-box watermarking embedding technology can be used to further confirm the existence of infringement. The model owner can calculate the KL divergence between the watermarked model and the output of the suspicious model, as well as other existing indicators, to make a more reliable judgment. Specifically, such as... Figure 2 As shown, the procedure is as follows:

[0071] Step 1: Build and train a watermarking model based on the dropout layer;

[0072] Step 1.1: Obtain historical air pollution data set ,in, This represents the air pollution level data at the e-th time step; E represents the total number of time steps.

[0073] Step 1.2: Construct an LSTM model containing an LSTM layer, a linear layer, and a dropout layer;

[0074] The parameters for the dropout layer are generated using a random generator and used as a watermark. (The dropout layer is off by default during the prediction phase, meaning that repeated predictions of the same sample will only produce a single, fixed prediction. If the dropout layer is enabled, repeated predictions of the same sample will produce a set of different predictions, which can be considered as following a Gaussian distribution. If the suspected model is a copy of the watermarked model, their Gaussian distribution parameters should be similar; ownership can be claimed by comparing these two Gaussian distributions. To distinguish it from common dropout layer parameter values, the generated parameter values ​​are desired to be uncommon and conducive to good model performance, such as 0.2769.)

[0075] Will The LSTM model is input for training to obtain the trained watermark model.

[0076] Step 2: Obtain K air pollution prediction models that include dropout layers as K common models;

[0077] We obtained pirated air pollution prediction models that the copyright owners believed infringed on the copyright of the watermark model and treated them as suspicious models.

[0078] Step 3: Select the watermark model in The air pollution data at the M time steps with the smallest loss are used as M key samples.

[0079] Step 4: Construct a likelihood estimation model based on Bayesian networks;

[0080] Step 4.1: Select the i-th key sample The input is processed in the suspicious model to obtain the i-th key sample. Predicted air pollution levels In the first phase, the internal parameters of the suspected model could not be obtained, so the dropout layer was not enabled during the testing phase. Therefore, the suspected model's prediction for the i-th key sample had only one fixed value. .

[0081] make The binary indicator variable is ,and Follows a Bernoulli distribution;

[0082] like This indicates that the suspicious model is a copy of the watermark model;

[0083] like , indicating that the suspicious model is a copy of the k-th public model;

[0084] Step 4.2, let The probability of a copy of the watermark model, i.e., for The probability of infringement of the suspicious model is ,and Follows a Beta distribution. and It forms the conjugate of the Beta distribution and the Bernoulli distribution.

[0085] Step 5: Calculate the infringement probability of the suspicious model using a Bayesian network-based likelihood estimation model;

[0086] Step 5.1, if Then iterative calculation Follows a Gaussian distribution mean and variance :

[0087] Step 5.1.1: Calculate using formula (1) Follows a Gaussian distribution variance ;

[0088] (1)

[0089] In equation (1), and for The two hyperparameters of the conjugate prior; T denotes transpose; Indicates when the dropout layer is enabled The average of the predicted air pollution levels is obtained by repeatedly inputting the watermark into the model for processing.

[0090] The reasoning process of equation (1) is as follows:

[0091] The likelihood function is given by equation (1a):

[0092] (1a)

[0093] In equation (1a), represent The observed values, i.e., the air pollution levels predicted by the suspected model for the i-th key sample. ; For parameters and The probability density function of a Gaussian distribution. For Equation (1) can be obtained by applying the maximum likelihood estimation to the likelihood function.

[0094] Step 5.1.2, for After initialization, calculate using equation (2). Follows a Gaussian distribution mean ;

[0095] (2)

[0096] The reasoning process of equation (2) is as follows:

[0097] Known ,about The log-likelihood function is given by equation (2a):

[0098] (2a)

[0099] In equation (2a), For parameters and The probability density function of the Gaussian distribution; For parameters and The probability density function of a Gaussian distribution. For Equation (2) can be obtained by applying the maximum likelihood estimation to the log-likelihood function.

[0100] Step 5.1.3, using equation (3) to obtain Follows a Gaussian distribution variance :

[0101] (3)

[0102] The reasoning process of equation (3) is as follows:

[0103] Known ,about The log-likelihood function is given by equation (3a):

[0104] (3a)

[0105] In equation (3a), For parameters and The probability density function of a Gaussian distribution. For Equation (3) can be obtained by applying the maximum likelihood estimation to the log-likelihood function.

[0106] Step 5.1.4, using equations (2) and (3) to... and Perform iterative alternating updates until convergence, thereby obtaining... Follows a Gaussian distribution optimal mean and optimal variance ;

[0107] Step 5.2, if Then iterative calculation Follows a Gaussian distribution mean and variance ;

[0108] Step 5.2.1: Calculate using equation (4) Follows a Gaussian distribution variance ;

[0109] (4)

[0110] The reasoning process of equation (4) is similar to that of equation (1).

[0111] In equation (8), Indicates when the dropout layer is enabled The data is repeatedly input into the k-th common model for processing, and the mean of the predicted air pollution levels is obtained. for The two hyperparameters of the conjugate prior.

[0112] Step 5.2.2, for After initialization, equation (5) is used to obtain Follows a Gaussian distribution mean :

[0113] (5)

[0114] The reasoning process of equation (5) is similar to that of equation (2).

[0115] Step 5.2.3, using equation (6) to obtain Follows a Gaussian distribution variance :

[0116] (6)

[0117] The reasoning process of equation (6) is similar to that of equation (3).

[0118] Step 5.2.4, using equations (5) and (6) to... and Perform iterative alternating updates until convergence is achieved, thereby obtaining... Follows a Gaussian distribution optimal mean and optimal variance .

[0119] Step 5.3: Calculate the infringement probability of the suspicious model. :

[0120] Step 5.3.1, calculate using equation (7) Gaussian distribution probability density on :

[0121] (7)

[0122] Step 5.3.2: Calculate using equation (8) hour, probability density :

[0123] (8)

[0124] Calculate using equation (9) hour, probability density :

[0125] (9)

[0126] Step 5.3.3, if , then it means A copy from the watermark model; otherwise, it indicates... A copy from a public model;

[0127] Step 5.3.4: Calculate the infringement probability of the suspicious model using equation (10). :

[0128] (10)

[0129] In equation (10), and express The two hyperparameters of the conjugate prior, express Number of times, express The number of times; when season ,make ;when season ,make .

[0130] The reasoning process of equation (10) is as follows:

[0131] Follows Bernoulli distribution . Indicating targeting The infringement probability of a suspicious model, given its conjugate prior. , among which. The initial , We can obtain the maximum a posteriori estimation. The posterior probability distribution is given by equation (10a):

[0132] (10a)

[0133] use The posterior probability distribution is used as The conjugate prior, i.e., equation (10b):

[0134] (10b)

[0135] We can obtain the maximum a posteriori estimation. The posterior probability distribution is given by equation (10c):

[0136] (10c)

[0137] By calculating up to the last key sample, the final posterior probability distribution can be obtained as equation (10d):

[0138] (10d)

[0139] At this point, equation (10) can be used to calculate the infringement probability of the suspected model. .

[0140] Step 5.4, if If the probability is less than the probability threshold, the suspicious model is initially considered to be a copy of the public model; otherwise, the suspicious model is initially considered to be a copy of the watermark model.

[0141] Step 6: Calculate the KL divergence between the outputs of the suspicious model and the watermark model;

[0142] Step 6.1: When the dropout layer is enabled, the i-th key sample... The suspected data was repeatedly input into the model for processing, resulting in several predicted air pollution levels, which were then averaged. and variance ;

[0143] Step 6.2: When the dropout layer is enabled, the i-th key sample... The data is repeatedly input into the watermarking model for processing, resulting in several predicted air pollution levels, which are then averaged. and variance .

[0144] Step 6.3: Use equation (11) to calculate the suspicious model and watermark model for key samples. KL divergence between outputs :

[0145] (11)

[0146] Step 6.4: Calculate the mean of the output KL divergence between the suspicious model and the watermark model using equation (12). :

[0147] (12).

[0148] Step 6.5: If L is greater than the divergence threshold, the suspected model is considered not to have infringed; otherwise, the suspected model is considered to have infringed.

[0149] In this embodiment, an electronic device includes a memory and a processor. The memory stores a program that supports the processor in executing the above-described method, and the processor is configured to execute the program stored in the memory.

[0150] In this embodiment, a computer-readable storage medium stores a computer program, which is executed by a processor to perform the steps of the above method.

Claims

1. A copyright protection method based on a two-stage deep regression model of Bayesian methods, characterized in that, The procedure is as follows: Step 1: Build and train a watermarking model based on the dropout layer; Step 1.1: Obtain historical air pollution data set ,in, This represents the air pollution level data at the e-th time step; E represents the total number of time steps. Step 1.2: Construct an LSTM model containing an LSTM layer, a linear layer, and a dropout layer; Use a random generator to generate parameters for the dropout layer and use them as a watermark; Will Input the data into the LSTM model for training to obtain the trained watermark model; Step 2: Obtain K air pollution prediction models that include dropout layers as K common models; Obtain pirated air pollution prediction models that the copyright owners believe infringe on the copyright of watermarked models and treat them as suspicious models; Step 3: Select the watermark model in The air pollution data at the M time steps with the least loss were used as the M key samples. Step 4: Select the i-th key sample The input is processed in the suspicious model to obtain the i-th key sample. Predicted air pollution levels ; make The binary indicator variable is ,and Follows a Bernoulli distribution; like This indicates that the suspicious model is a copy of the watermark model; like , indicating that the suspicious model is a copy of the k-th public model; Step 5: Calculate the infringement probability of the suspected model using a Bayesian network-based likelihood estimation model. ; Step 5.1, if Then iterative calculation Follows a Gaussian distribution optimal mean and optimal variance : Step 5.2, if Then iterative calculation Follows a Gaussian distribution optimal mean and optimal variance ; Step 5.3, based on and as well as and Calculate the infringement probability of the suspicious model. : Step 5.4, if If the probability is less than the probability threshold, the suspicious model is initially considered to be a copy of the public model; otherwise, the suspicious model is initially considered to be a copy of the watermark model. Step 6: Calculate the mean KL divergence L between the outputs of the suspicious model and the watermarked model; if L is greater than the divergence threshold, the suspicious model is considered not to infringe; otherwise, the suspicious model is considered to infringe.

2. The copyright protection method based on a two-stage deep regression model of Bayesian regression according to claim 1, characterized in that, Step 5.1 is performed as follows: Step 5.1.1: Calculate the mean using equation (1). Follows a Gaussian distribution variance ; (1) In equation (1), and for The two hyperparameters of the conjugate prior; T denotes transpose; Indicates when the dropout layer is enabled The average of the predicted air pollution levels is obtained by repeatedly inputting the watermark into the model for processing. Step 5.1.2, Counterparts After initialization, calculate using equation (2). Follows a Gaussian distribution mean ; (2) Step 5.1.3, using equation (3) to obtain Follows a Gaussian distribution variance : (3) Step 5.1.4, using equations (2) and (3) to... and Perform iterative alternating updates until convergence, thereby obtaining... Follows a Gaussian distribution optimal mean and optimal variance .

3. The copyright protection method based on a two-stage deep regression model of Bayesian regression according to claim 2, characterized in that, Step 5.2 is performed as follows: Step 5.2.1: Calculate the mean using equation (4). Follows a Gaussian distribution variance ; (4) In equation (8), Indicates when the dropout layer is enabled The data is repeatedly input into the k-th common model for processing, and the mean of the predicted air pollution levels is obtained. for The two hyperparameters of the conjugate prior; Step 5.2.2, Calculate the difference After initialization, equation (5) is used to obtain Follows a Gaussian distribution mean : (5) Step 5.2.3, using equation (6) to obtain Follows a Gaussian distribution variance : (6) Step 5.2.4, using equations (5) and (6) to... and Perform iterative alternating updates until convergence is achieved, thereby obtaining... Follows a Gaussian distribution optimal mean and optimal variance .

4. The copyright protection method based on a two-stage deep regression model of Bayesian regression according to claim 3, characterized in that, Step 5.3 is performed as follows: Step 5.3.1, calculate using equation (7) Gaussian distribution probability density on : (7) Step 5.3.2: Calculate using equation (8) hour, probability density : (8) Calculate using equation (9) hour, probability density : (9) Step 5.3.3, if , then it means A copy from the watermark model; otherwise, it indicates... A copy from a public model; Step 5.3.4: Calculate the infringement probability of the suspicious model using equation (10). : (10) In equation (10), and express The two hyperparameters of the conjugate prior, express Number of times, express The number of times; when season ,make ;when season ,make .

5. The copyright protection method based on a two-stage deep regression model of Bayesian regression according to claim 4, characterized in that, Step 6 is performed as follows: Step 6.1: When the dropout layer is enabled, the i-th key sample... The suspected data was repeatedly input into the model for processing, resulting in several predicted air pollution levels, which were then averaged. and variance ; Step 6.2: When the dropout layer is enabled, the i-th key sample... The data is repeatedly input into the watermarking model for processing, resulting in several predicted air pollution levels, which are then averaged. and variance ; Step 6.3: Use equation (11) to calculate the suspicious model and watermark model for key samples. KL divergence between outputs : (11) Step 6.4: Calculate the mean of the output KL divergence between the suspicious model and the watermark model using equation (12). : (12).

6. An electronic device, comprising a memory and a processor, characterized in that, The memory is used to store a program that supports the processor in executing the copyright protection method for the two-stage deep regression model according to any one of claims 1-5, and the processor is configured to execute the program stored in the memory.

7. A computer-readable storage medium storing a computer program thereon, characterized in that, When the computer program is run by the processor, it performs the steps of the copyright protection method for the two-stage deep regression model as described in any one of claims 1-5.

Images