Weight-based neural network watermarking method, system, device and medium

Abstract

The present invention relates to the field of artificial intelligence model watermark technology, and provides a weight-based neural network watermark method, system, device and medium. The method comprises: constructing a hash map to generate a hash watermark vector; using the hash watermark vector as a filter to filter the weight of the neural network model, obtaining a weight subset and embedding the watermark vector after performing an average pooling operation; jointly optimizing the main task of the joint neural network and the hash watermark vector embedding task, and embedding the watermark vector into the weight subset without affecting the model performance. When the host computer identifies an unknown neural network model, the unknown network model is watermark verified to determine whether the unknown network model infringes on the copyright. The present invention designs a hash watermark filter that can simultaneously resist watermark forgery and watermark rewriting attacks, and can resist model fine-tuning and model pruning attacks through average pooling operations, thereby enhancing the robustness of the artificial intelligence model watermark.

Description

Technical Field

[0001] The present invention relates to the technical field of artificial intelligence model watermarking, and provides a weight-based neural network watermarking method, system, device and medium. Background Art

[0002] In recent years, neural network technology has made significant progress and is widely used in fields such as natural language processing, computer vision, and speech processing. Current technological trends focus on building ultra-large-scale deep neural network models, relying on massive amounts of data and high-performance computing resources for training. This training process typically requires significant investment in capital, computing resources, and specialized personnel, making neural network models extremely valuable digital assets. However, the unauthorized copying, misuse, and illegal trading of neural network models are becoming increasingly serious problems. Protecting the ownership of neural network models and preventing their illegal use has become a critical issue that needs to be addressed.

[0003] Existing neural network model watermarking techniques based on weight parameters still have significant shortcomings in defending against watermark forgery and rewriting attacks. A common approach involves embedding predefined watermark information into the parameters of the neural network model during model training by introducing an additional weight regularization term. However, such methods typically fail to explicitly model and constrain the mapping relationship between the key matrix and the watermark vector. This allows attackers to forge a matching set of key matrices and watermark vectors through reverse engineering, thereby verifying the watermark's forgery through legitimate watermark verification processes without modifying the model parameters. Furthermore, such methods typically lack a confidential mechanism for selecting the embedding parameters, i.e., they do not use a specific strategy to select the weight subset used for watermark embedding. Therefore, once an attacker obtains the watermark embedding parameter information through analysis, they can use the same embedding technique to embed a new watermark, thereby destroying or even completely overwriting the original watermark information and successfully carrying out a watermark rewriting attack.

[0004] In summary, existing methods still lack effective defense mechanisms against active attacks on watermarks, such as watermark forgery and watermark rewriting. There is an urgent need for more robust and secure design strategies to improve the robustness of neural network model watermarks. Summary of the Invention

[0005] The present invention aims to solve at least one of the technical problems existing in the related art. To this end, the present invention provides a weighted neural network watermarking method, system, device and medium that can effectively resist watermark forgery, watermark rewriting, model fine-tuning and model pruning attacks.

[0006] The present invention provides a weight-based neural network watermarking method, comprising:

[0007] S1: Build a hash map and generate a hash watermark vector;

[0008] S2: Use the hash watermark vector as a filter to filter the weights of the neural network model to obtain a weight subset, and perform an average pooling operation on the weight subset to obtain a weight vector;

[0009] S3: Jointly optimize the main task of the neural network and the hash watermark vector embedding task to embed the hash watermark vector into the neural network model;

[0010] S4: When the host computer identifies an unknown neural network model, it performs watermark authentication on the unknown neural network model to determine whether the unknown neural network model infringes upon copyright.

[0011] According to a weight-based neural network watermarking method provided by the present invention, step S1 includes:

[0012] S11: Randomly generate a key matrix , ,in, is the set of real numbers, is the length of the weight vector, is the length of the hash watermark vector;

[0013] S12: Perform hash mapping on the key matrix

[0014]

[0015] in, is the hash watermark vector, is a hash function.

[0016] According to a weight-based neural network watermarking method provided by the present invention, step S1 further includes: if there is fusion auxiliary information in the hash map When , the hash map in step S12 becomes:

[0017]

[0018] in, For splicing operation.

[0019] According to a weight-based neural network watermarking method provided by the present invention, step S2 includes:

[0020] S21: Randomly extracting weights from a layer in a neural network , ,in, represents the size of the convolution kernel, Indicates the number of input channels, Indicates the number of output channels and saves the position index of the weight for extracting the corresponding weight during verification;

[0021] S22: Use the hash watermark vector to filter the weights using a hash watermark filter to obtain a weight subset;

[0022] S23: Perform average pooling on the weight subset to obtain a weight vector .

[0023] According to a weight-based neural network watermarking method provided by the present invention, step S22 includes:

[0024] S221: The weight Expand to a one-dimensional vector

[0025]

[0026]

[0027] in, is the length of a one-dimensional vector;

[0028] S222: Periodically extend the hash watermark vector until the length of the hash watermark vector is greater than or equal to , and then cut off the excess The redundant part makes the expanded hash watermark vector consistent with Equal length, get the extended vector ;

[0029] S223: According to In the , the position index of the element value 1, from Extract the corresponding weights to form a subset of relevant weights filtered by the hash watermark vector;

[0030] S224: The relevant weight subset is Perform hash watermark filtering several times to obtain a weight subset.

[0031] According to a weight-based neural network watermarking method provided by the present invention, step S3 includes:

[0032] Jointly optimize the total loss function :

[0033]

[0034]

[0035]

[0036]

[0037] in, Used to indicate that the parameter The mathematical notation for minimizing the objective function is are all the weights of the neural network, is the main task loss function, is the embedding loss function, is the hash watermark vector elements, is the element ordinal number, , is the watermark vector extracted from the weights, for No. elements, is the Sigmoid function.

[0038] According to a weight-based neural network watermarking method provided by the present invention, step S4 includes:

[0039] S41: Extracting watermark vectors for unknown neural network models ;

[0040] S42: Based on the hash watermark vector and To match:

[0041]

[0042] in, is the watermark detection rate, is the indicator function, is the threshold function, for No. elements;

[0043] S43: When both

[0044]

[0045]

[0046] If both conditions are met, watermark verification succeeds. If both conditions are not met, watermark verification fails. is the watermark detection rate threshold.

[0047] The present invention also provides a weight-based neural network watermarking system, comprising:

[0048] Neural network watermark generation module: build hash map and generate hash watermark vector;

[0049] Neural network watermark embedding module: uses the hash watermark vector as a filter to filter the weights of the neural network model to obtain a weight subset, and then performs an average pooling operation on the weight subset to obtain a weight vector;

[0050] Joint optimization module: Jointly optimizes the main task of the neural network and the hash watermark vector embedding task, and embeds the hash watermark vector into the neural network model;

[0051] Watermark recognition module: When the host computer recognizes an unknown neural network model, it performs watermark authentication on the unknown neural network model to determine whether the unknown neural network model infringes on copyright.

[0052] The present invention also provides an electronic device, comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein when the processor executes the program, the steps of any of the weight-based neural network watermarking methods described above are implemented.

[0053] The present invention also provides a non-transitory computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, implements the steps of any of the weight-based neural network watermarking methods described above.

[0054] The above one or more technical solutions in the embodiments of the present invention have at least one of the following technical effects:

[0055] The weighted neural network watermarking method, system, device, and medium provided by this invention introduce a hash watermark filter designed to effectively resist watermark forgery, watermark rewriting, model fine-tuning, and model pruning attacks, thereby enhancing the robustness of artificial intelligence model watermarks. This filter also minimizes the impact on model performance.

[0056] Additional aspects and advantages of the present invention will be set forth in part in the description which follows and, in part, will be obvious from the description which follows, or may be learned by practice of the present invention. BRIEF DESCRIPTION OF THE DRAWINGS

[0057] In order to more clearly illustrate the technical solutions in the present invention or the prior art, the following briefly introduces the drawings required for use in the embodiments or the description of the prior art. Obviously, the drawings described below are some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying any creative work.

[0058] Figure 1 It is a flow chart of the weight-based neural network watermarking method provided by the present invention.

[0059] Figure 2This is a watermark generation flow chart of the weight-based neural network watermarking method provided by the present invention.

[0060] Figure 3 This is a watermark embedding flow chart of the weight-based neural network watermarking method provided by the present invention.

[0061] Figure 4 This is a watermark verification flow chart of the weight-based neural network watermark method provided by the present invention.

[0062] Figure 5 It is a structural diagram of the weight-based neural network watermarking device provided by the present invention.

[0063] Figure 6 It is a structural schematic diagram of the electronic device provided by the present invention.

[0064] Reference numerals:

[0065] 101. Neural network watermark generation module; 102. Neural network watermark embedding module; 103. Joint optimization module; 104. Watermark recognition module; 810. Processor; 820. Communication interface; 830. Memory; 840. Communication bus. DETAILED DESCRIPTION

[0066] To make the purpose, technical solutions and advantages of the present invention clearer, the technical solutions in the present invention will be clearly and completely described below. Obviously, the embodiments described are part of the embodiments of the present invention, rather than all the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without making creative work are within the scope of protection of the present invention. The following embodiments are used to illustrate the present invention, but are not used to limit the scope of the present invention.

[0067] In the description of this specification, the reference terms "one embodiment", "some embodiments", "example", "specific example", or "some examples" mean that the specific features, structures, materials or characteristics described in conjunction with the embodiment or example are included in at least one embodiment or example of the embodiment of the present invention. In this specification, the schematic representations of the above terms do not necessarily refer to the same embodiment or example. Moreover, the specific features, structures, materials or characteristics described can be combined in any one or more embodiments or examples in a suitable manner. In addition, those skilled in the art can combine and combine different embodiments or examples described in this specification and features of different embodiments or examples without contradiction.

[0068] Example

[0069] The following combination Figures 1 to 6 The present invention is described.

[0070] like Figure 1 As shown, Figure 1 This is a flow chart of the weighted neural network watermarking method provided by the present invention. Specifically, it includes:

[0071] S1: Build a hash map and generate a hash watermark vector;

[0072] S2: Use the hash watermark vector as a filter to filter the weights of the neural network model to obtain a weight subset, and perform an average pooling operation on the weight subset to obtain a weight vector;

[0073] S3: Jointly optimize the main task of the neural network and the hash watermark vector embedding task to embed the hash watermark vector into the neural network model;

[0074] S4: When the host computer identifies an unknown neural network model, it performs watermark authentication on the unknown neural network model to determine whether the unknown neural network model infringes upon copyright.

[0075] This paper proposes a hash watermark filter. The core concept of this method is to use an irreversible binary watermark as a private filter, thereby restricting watermark embedding to a secret subset of model parameters. Specifically, the method first generates a sequence of irreversible binary watermark vectors using a hash function based on a key matrix. This watermark is then used as a filter to select model parameters for embedding. This design cleverly interweaves the watermark embedding parameter selection process with the hash function mechanism, endowing the method with two key properties:

[0076] (1) Gradient obfuscation: The avalanche effect of the hash function ensures that even if the input is slightly perturbed, its output will undergo drastic and unpredictable changes, which effectively hinders the calculation of the gradient and makes watermark forgery attacks based on reverse engineering computationally infeasible.

[0077] (2) Embedding isolation: Since the hash watermark vectors generated by the model owner and the attacker are different from each other, the overlap rate of the selected parameters can be significantly reduced when used as a private filter, especially in the case of multiple rounds of filtering. Moreover, even if the attacker attempts to cover the original watermark by enhancing the embedding strength of his own watermark, it is difficult to identify and tamper with the model owner's embedded parameters, thereby effectively protecting the integrity of the original watermark and resisting watermark rewriting attacks.

[0078] Specifically, such as Figure 2 As shown, step S1 includes:

[0079] S11: Randomly generate a key matrix , ,in, is the set of real numbers, is the length of the weight vector, is the length of the hash watermark vector;

[0080] Each element of the key matrix is ​​randomly extracted from a random distribution. In the embodiment of the present invention, each element is randomly extracted from a standard Gaussian distribution.

[0081] S12: Perform hash mapping on the key matrix:

[0082]

[0083] in, is the hash watermark vector, is the hash watermark vector elements, is the element ordinal number, , , As a hash function, the embodiment of the present invention adopts the scalable output function SHAKE-256 in the SHA-3 family, which supports dynamic adjustment of the output length of the hash function and thus supports the generation of watermarks of various lengths.

[0084] In particular, if there is fusion auxiliary information in the hash map When , a context-aware watermark vector is generated, such as a text descriptor or a unique identifier.

[0085] The hash map in step S12 becomes:

[0086]

[0087] in, For splicing operation.

[0088] Specifically, such as Figure 3 As shown, step S2 is the filtering process of the hash watermark filter, including:

[0089] S21: Randomly extracting weights from a layer in a neural network , ,in, represents the size of the convolution kernel, Indicates the number of input channels, Indicates the number of output channels and saves the position index of the weight for extracting the corresponding weight during verification;

[0090] S22: Use the hash watermark vector to filter the weights to obtain a weight subset:

[0091] S221: The weight Expand to a one-dimensional vector

[0092]

[0093]

[0094] in, is the length of a one-dimensional vector;

[0095] S222: Periodically extend the hash watermark vector until the length of the hash watermark vector is greater than or equal to , and then cut off the excess The redundant part makes the expanded hash watermark vector consistent with Equal length, get the extended vector ;

[0096] S223: According to In the , the element value is 1 position index, from Extract the corresponding weights to form a subset of relevant weights filtered by the hash watermark vector;

[0097] S224: The relevant weight subset is Perform hash watermark filtering several times to obtain a weight subset.

[0098] The weights are filtered using hash watermark filters repeatedly for multiple rounds to further enhance the confidentiality of the weight parameters.

[0099] S23: Perform average pooling on the weight subset to obtain a weight vector

[0100] After weight filtering, the present invention further applies an average pooling mechanism to the filtered weight parameters to improve the robustness of the watermark against model fine-tuning and pruning attacks. This pooling process increases the stability of the watermark against weight parameter perturbation attacks by averaging the secret subset of weights, making it less susceptible to model fine-tuning and pruning.

[0101] Specifically, step S3 includes:

[0102] Jointly optimize the total loss function :

[0103]

[0104]

[0105]

[0106]

[0107] in, Used to indicate that the parameter The mathematical notation for minimizing the objective function is are all the weights of the neural network, is the main task loss function, is the embedding loss function, is the hash watermark vector elements, is the element ordinal number, , is the watermark vector extracted from the weights, for No. elements, is the Sigmoid function.

[0108] like Figure 4 As shown, Figure 4 This is a flow chart of watermark verification using the weighted neural network watermarking method provided by the present invention. Step S4 includes:

[0109] S41: Extract the watermark vector of the unknown neural network model. The extraction process is: use the position index of the previously saved weight to extract the corresponding model weight, and perform watermark filter filtering, average pooling and Sigmoid operations on it to obtain the extracted watermark vector .

[0110] S42: Based on the hash watermark vector and To match:

[0111]

[0112] in, is the watermark detection rate, is the indicator function, is the threshold function, for No. elements;

[0113] in, The function takes the value 1 if the expression inside the brackets is true, otherwise it takes the value 0.

[0114] The function in the brackets takes the value 1 when it is greater than or equal to 0.5, otherwise it takes the value 0.

[0115] S43: When both

[0116]

[0117]

[0118] If both conditions are met, watermark verification succeeds. If both conditions are not met, watermark verification fails. is the watermark detection rate threshold.

[0119] Among them, condition 1 is to verify whether the watermark detection rate is greater than the watermark detection rate threshold ;

[0120] Condition 2 is to prove that the verified watermark vector and the key satisfy the hash mapping relationship.

[0121] Table 1 Comparison of classification accuracy performance of combined models

[0122]

[0123] Table 1 shows the model performance in two cases: without adding a watermark and adding a watermark using the method proposed in the present invention. The data in the table is the classification accuracy of the model. CIFAR-10, CIFAR-100, Caltech-101, Caltech-256, and TinyImageNet are public data sets, of which AlexNet and ResNet-18 are the two neural network models used. The experimental results show that after the watermark information is embedded in the model weight using the method proposed in the present invention, the impact on the model performance is minimal. At the same time, under all experimental settings, the detection rate of the watermark reaches 100%. This result verifies that the method proposed in the present invention can achieve effective embedding and extraction of watermarks without almost affecting the model performance.

[0124] like Figure 5 As shown, the present invention also provides a weight-based neural network watermarking system, comprising:

[0125] Neural network watermark generation module 101: constructs a hash map and generates a hash watermark vector;

[0126] Neural network watermark embedding module 102: uses the hash watermark vector as a filter to filter the weights of the neural network model to obtain a weight subset, and performs an average pooling operation on the weight subset to obtain a weight vector;

[0127] Joint optimization module 103: performs joint optimization based on the main task of the neural network and the hash watermark vector embedding task, and embeds the hash watermark vector into the neural network model;

[0128] Watermark recognition module 104: When the host computer recognizes an unknown neural network model, it performs watermark authentication on the unknown neural network model to determine whether the unknown neural network model infringes on copyright.

[0129] Figure 6 An example of a physical structure diagram of an electronic device is shown below. Figure 6 As shown, the electronic device may include: a processor 810, a communication interface 820, a memory 830 and a communication bus 840, wherein the processor 810, the communication interface 820, and the memory 830 communicate with each other via the communication bus 840. The processor 810 may call the logic instructions in the memory 830 to execute the weight-based neural network watermarking method, which includes:

[0130] S1: Build a hash map and generate a hash watermark vector;

[0131] S2: Use the hash watermark vector as a filter to filter the weights of the neural network model to obtain a weight subset, and perform an average pooling operation on the weight subset to obtain a weight vector;

[0132] S3: Jointly optimize the main task of the neural network and the hash watermark vector embedding task to embed the hash watermark vector into the neural network model;

[0133] S4: When the host computer identifies an unknown neural network model, it performs watermark authentication on the unknown neural network model to determine whether the unknown neural network model infringes upon copyright.

[0134] Furthermore, the logic instructions in the aforementioned memory 830 can be implemented as software functional units and, when sold or used as independent products, can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present invention, or the portion that contributes to the prior art, or a portion of the technical solution, can be embodied in the form of a software product. This computer software product, stored in a storage medium, includes instructions for enabling a computer device (which can be a personal computer, server, or network device, etc.) to perform all or part of the steps of the methods described in various embodiments of the present invention. The aforementioned storage medium includes various media capable of storing program code, such as USB flash drives, mobile hard drives, read-only memories (ROMs), random access memories (RAMs), magnetic disks, or optical disks.

[0135] On the other hand, the present invention further provides a computer program product, comprising a computer program stored on a non-transitory computer-readable storage medium, wherein the computer program comprises program instructions. When the program instructions are executed by a computer, the computer is capable of performing a weight-based neural network watermarking method provided by the above methods, the method comprising:

[0136] S1: Build a hash map and generate a hash watermark vector;

[0137] S2: Use the hash watermark vector as a filter to filter the weights of the neural network model to obtain a weight subset, and perform an average pooling operation on the weight subset to obtain a weight vector;

[0138] S3: Jointly optimize the main task of the neural network and the hash watermark vector embedding task to embed the hash watermark vector into the neural network model;

[0139] S4: When the host computer identifies an unknown neural network model, it performs watermark authentication on the unknown neural network model to determine whether the unknown neural network model infringes upon copyright.

[0140] In another aspect, the present invention further provides a non-transitory computer-readable storage medium having a computer program stored thereon, wherein when the computer program is executed by a processor, the computer program is implemented to perform the weight-based neural network watermarking method provided above, the method comprising:

[0141] S1: Build a hash map and generate a hash watermark vector;

[0142] S2: Use the hash watermark vector as a filter to filter the weights of the neural network model to obtain a weight subset, and perform an average pooling operation on the weight subset to obtain a weight vector;

[0143] S3: Jointly optimize the main task of the neural network and the hash watermark vector embedding task to embed the hash watermark vector into the neural network model;

[0144] S4: When the host computer identifies an unknown neural network model, it performs watermark authentication on the unknown neural network model to determine whether the unknown neural network model infringes upon copyright.

[0145] The device embodiments described above are merely illustrative. The units described as separate components may or may not be physically separate, and the components shown as units may or may not be physical units, i.e., they may be located in one location or distributed across multiple network units. Some or all of the modules may be selected based on actual needs to achieve the objectives of the present embodiment. Persons of ordinary skill in the art will be able to understand and implement the present invention without inventive effort.

[0146] Through the above description of the embodiments, those skilled in the art will clearly understand that each embodiment can be implemented using software plus a necessary general-purpose hardware platform, or of course, hardware. Based on this understanding, the essence of the above technical solution, or the portion that contributes to the prior art, can be embodied in the form of a software product. This computer software product can be stored in a computer-readable storage medium, such as ROM / RAM, a magnetic disk, or an optical disk, and includes a number of instructions for causing a computer device (such as a personal computer, server, or network device) to execute the methods described in each embodiment or certain portions of the embodiments.

[0147] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention, rather than to limit it. Although the present invention has been described in detail with reference to the aforementioned embodiments, those skilled in the art should understand that they can still modify the technical solutions described in the aforementioned embodiments, or make equivalent replacements for some of the technical features therein. However, these modifications or replacements do not deviate the essence of the corresponding technical solutions from the spirit and scope of the technical solutions of the various embodiments of the present invention.

[0148] It should be noted that the embodiments of the present disclosure can be implemented by hardware, software, or a combination of software and hardware. The hardware portion can be implemented using dedicated logic; the software portion can be stored in a memory and executed by an appropriate instruction execution system such as a microprocessor or dedicated hardware. Those skilled in the art will understand that the above-mentioned devices and methods can be implemented using computer-executable instructions and / or contained in processor control code, for example, such code is provided on a programmable memory or a data carrier such as an optical or electronic signal carrier.

[0149] In addition, although the operations of the method of the present disclosure are described in a particular order in the accompanying drawings, this does not require or imply that these operations must be performed in this particular order, or that all the operations shown must be performed to achieve the desired result. On the contrary, the steps depicted in the flow chart can change the order of execution. Additionally or alternatively, certain steps can be omitted, multiple steps can be combined into one step, and / or one step can be decomposed into multiple steps. It should also be noted that the features and functions of two or more devices according to the present disclosure can be embodied in one device. Conversely, the features and functions of a device described above can be further divided into being embodied by multiple devices.

[0150] Although the present disclosure has been described with reference to several specific embodiments, it should be understood that the present disclosure is not limited to the specific embodiments disclosed. The present disclosure is intended to cover various modifications and equivalent arrangements included within the spirit and scope of the appended claims.

Claims

1. A weight-based neural network watermarking method, characterized in that: include: S1: Build a hash map and generate a hash watermark vector; S2: Using the hash watermark vector as a filter to filter the weights of the neural network model to obtain a weight subset, and performing an average pooling operation on the weight subset to obtain a weight vector; step S2 includes: S21: Randomly extracting weights from a layer in a neural network , ,in, is the set of real numbers, represents the size of the convolution kernel, Indicates the number of input channels, Indicates the number of output channels and saves the position index of the weight for extracting the corresponding weight during verification; S22: Use the hash watermark vector to filter the weights using a hash watermark filter to obtain a weight subset; Step S22 includes: S221: The weight Expand to a one-dimensional vector in, is the length of a one-dimensional vector; S222: Periodically extend the hash watermark vector until the length of the hash watermark vector is greater than or equal to , and then cut off the excess The redundant part makes the expanded hash watermark vector consistent with Equal length, get the extended vector ; S223: According to In the , the position index of the element value 1, from Extract the corresponding weights to form a subset of relevant weights filtered by the hash watermark vector; S224: The relevant weight subset is Perform hash watermark filtering several times to obtain a weight subset; S23: Perform average pooling on the weight subset to obtain a weight vector ; S3: Jointly optimize the main task of the neural network and the hash watermark vector embedding task to embed the hash watermark vector into the neural network model; S4: When the host computer identifies an unknown neural network model, it performs watermark authentication on the unknown neural network model to determine whether the unknown neural network model infringes upon copyright.

2. A weight-based neural network watermarking method according to claim 1, characterized in that: Step S1 includes: S11: Randomly generate a key matrix , ,in, is the length of the weight vector, is the length of the hash watermark vector; S12: Perform hash mapping on the key matrix in, is the hash watermark vector, is a hash function.

3. A weight-based neural network watermarking method according to claim 2, characterized in that: Step S1 also includes: if there is fusion auxiliary information in the hash map When , the hash map in step S12 becomes: in, For splicing operation.

4. A weighted neural network watermarking method according to claim 2, characterized in that: Step S3 includes: Jointly optimize the total loss function : in, Used to indicate that the parameter The mathematical notation for minimizing the objective function is are all the weights of the neural network, is the main task loss function, is the embedding loss function, is the hash watermark vector elements, is the element ordinal number, , is the watermark vector extracted from the weights, for No. elements, is the Sigmoid function.

5. A weight-based neural network watermarking method according to claim 4, characterized in that: Step S4 includes: S41: Extracting watermark vectors for unknown neural network models ; S42: Based on the hash watermark vector and To match: in, is the watermark detection rate, is the indicator function, is the threshold function, for No. elements; S43: When both If both conditions are met, watermark verification succeeds. If both conditions are not met, watermark verification fails. is the watermark detection rate threshold.

6. A weight-based neural network watermarking system for executing the weight-based neural network watermarking method according to any one of claims 1 to 5, characterized in that: include: Neural network watermark generation module: build hash map and generate hash watermark vector; Neural network watermark embedding module: uses the hash watermark vector as a filter to filter the weights of the neural network model to obtain a weight subset, and then performs an average pooling operation on the weight subset to obtain a weight vector; S21: Randomly extracting weights from a layer in a neural network , ,in, represents the size of the convolution kernel, Indicates the number of input channels, Indicates the number of output channels and saves the position index of the weight for extracting the corresponding weight during verification; S22: Use the hash watermark vector to filter the weights using a hash watermark filter to obtain a weight subset; Step S22 includes: S221: The weight Expand to a one-dimensional vector in, is the length of a one-dimensional vector; S222: Periodically extend the hash watermark vector until the length of the hash watermark vector is greater than or equal to , and then cut off the excess The redundant part makes the expanded hash watermark vector consistent with Equal length, get the extended vector ; S223: According to In the , the position index of the element value 1, from Extract the corresponding weights to form a subset of relevant weights filtered by the hash watermark vector; S224: The relevant weight subset is Perform hash watermark filtering several times to obtain a weight subset; S23: Perform average pooling on the weight subset to obtain a weight vector ; Joint optimization module: Jointly optimizes the main task of the neural network and the hash watermark vector embedding task, and embeds the hash watermark vector into the neural network model; Watermark recognition module: When the host computer recognizes an unknown neural network model, it performs watermark authentication on the unknown neural network model to determine whether the unknown neural network model infringes on copyright.

7. An electronic device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein: When the processor executes the computer program, the steps of the weight-based neural network watermarking method according to any one of claims 1 to 5 are implemented.

8. A non-transitory computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the steps of the weight-based neural network watermarking method according to any one of claims 1 to 5 are implemented.

Images