Watermark processing method, electronic device and computer program product

Abstract

The embodiment of the invention provides a method for processing a watermark of a neural network model, electronic equipment and a computer program product. The method comprises the steps of generating a second parameter of a neural network model by embedding a parameter component watermark into a first parameter of the neural network model; generating a second input of the neural network model by embedding the input component watermark into the first input of the neural network model; generating a second model gradient of the neural network model by embedding the gradient component watermark into the first model gradient of the neural network model; and training the neural network model based on the second parameter, the second input and the second model gradient to generate a trained neural network model. Through the method, the anti-attack capability of the neural network model can be effectively improved, and the processing flexibility and adaptability of the watermark of the neural network model can be remarkably improved.

Description

Technical Field

[0001] Embodiments of the present disclosure relate to the field of computer processing, and more particularly, to a method for processing watermarks of neural network models, an electronic device, and a computer program product. Background Art

[0002] Currently, in the field of artificial intelligence, neural network models have been widely applied in various fields. Correspondingly, neural network models provide good application value and even commercial value for their owners. In this case, there is an urgent need to provide a mechanism for protecting the intellectual property rights of neural network models, so that when the neural network model is attacked, an effective model verification solution can be provided for the model owner, so as to take appropriate measures to deal with the attacker's attack. Summary of the Invention

[0003] Embodiments of the present disclosure provide a method for processing watermarks of a neural network model, an electronic device, and a computer program product.

[0004] According to a first aspect of the present disclosure, there is provided a method for processing watermarks of a neural network model, the method including generating second parameters of the neural network model by embedding parameter component watermarks into first parameters of the neural network model. The method further includes generating second inputs of the neural network model by embedding input component watermarks into first inputs of the neural network model. The method further includes generating second model gradients of the neural network model by embedding gradient component watermarks into first model gradients of the neural network model. The method further includes training the neural network model based on the second parameters, the second inputs, and the second model gradients to generate a trained neural network model.

[0005] According to a second aspect of the present disclosure, there is provided an electronic device. The electronic device includes at least one processor; and a memory coupled to the at least one processor and having instructions stored thereon that, when executed by the at least one processor, cause the device to perform operations, the operations including: generating second parameters of the neural network model by embedding parameter component watermarks into first parameters of the neural network model; generating second inputs of the neural network model by embedding input component watermarks into the first inputs of the neural network model; generating second model gradients of the neural network model by embedding gradient component watermarks into first model gradients of the neural network model; and training the neural network model based on the second parameters, the second inputs, and the second model gradients to generate a trained neural network model.

[0006] According to a third aspect of the present disclosure, there is provided a computer program product tangibly stored on a non - volatile computer - readable medium and including machine - executable instructions which, when executed, cause a machine to perform the steps of the method in the first aspect of the present disclosure. BRIEF DESCRIPTION OF THE DRAWINGS

[0007] The above and other objects, features, and advantages of the present disclosure will become more apparent by describing the exemplary embodiments of the present disclosure in more detail in conjunction with the accompanying drawings, wherein in the exemplary embodiments of the present disclosure, the same reference numerals generally represent the same components.

[0008] Figure 1 FIG. is a schematic diagram of an example system in which an apparatus and / or method according to an embodiment of the present disclosure may be implemented;

[0009] Figure 2 FIG. is a flowchart of a method for processing a watermark of a neural network model according to an embodiment of the present disclosure;

[0010] Figure 3 FIG. is a schematic block diagram of determining a verification mode by adopting an adaptive controller according to an embodiment of the present disclosure;

[0011] Figure 4 FIG. is a flowchart of a method for extracting a watermark in a neural network model to be verified as extraction data according to an embodiment of the present disclosure;

[0012] Figure 5 FIG. is a flowchart of a method for verifying a neural network model according to an embodiment of the present disclosure; and

[0013] Figure 6 FIG. is a schematic block diagram of an example apparatus suitable for implementing the embodiments of the present disclosure.

[0014] In each of the drawings, the same or corresponding reference numerals indicate the same or corresponding parts. DETAILED DESCRIPTION OF THE EMBODIMENTS

[0015] Embodiments of the present disclosure will be described in more detail below with reference to the accompanying drawings. Although some embodiments of the present disclosure are shown in the drawings, it should be understood that the present disclosure can be implemented in various forms and should not be construed as limited to the embodiments set forth herein. Instead, these embodiments are provided to more thoroughly and completely understand the present disclosure. It should be understood that the drawings and embodiments of the present disclosure are only for exemplary purposes and are not used to limit the protection scope of the present disclosure.

[0016] In the description of the embodiments of the present disclosure, the term "including" and its like shall be understood as an open inclusion, that is, "including but not limited to". The term "based on" shall be understood as "at least partially based on". The term "an embodiment" or "the embodiment" shall be understood as "at least one embodiment". The terms "first", "second", etc. may refer to different or the same objects. There may also be other explicit and implicit definitions hereinafter.

[0017] In the field of artificial intelligence, with the widespread application of neural network models, the intellectual property protection of neural network models has received more and more attention and research. Neural network model watermarking technology has been proposed and has become the main technology for protecting the intellectual property of neural network models in the current field of deep learning.

[0018] Model watermarking is a technology for protecting the intellectual property of neural network models by embedding a secret signature in the parameters of the neural network model or the input / output of the model, and can be used to verify the ownership of the neural network model. Currently, model watermarking technology is mainly divided into two types: black-box model watermarking technology and white-box model watermarking technology. Black-box model watermarking technology does not require access to the parameters of the model, but is applicable to the input and output of the model. Different from this, white-box watermarking technology requires access to the parameters of the model and directly or indirectly modifies the parameters of the model to embed the watermark.

[0019] Black-box model watermarking technology can be further divided into two types: input-based type and output-based type. Input-based technology is a technology for embedding a watermark into input data by adding noise to the input data (e.g., images or texts) or modifying pixels or characters. Output-based technology embeds the watermark into the output labels or predictions by changing or adding some labels or values. Input-based technology is more robust against model extraction attacks, where an attacker can try to clone the model by using a large number of input queries and collecting the corresponding outputs. Output-based technology is more robust against model fine-tuning attacks, where an attacker tries to erase or change the watermark by retraining the model with new data.

[0020] White-box model watermarking technology can also be divided into two types: parameter-based technology and gradient-based technology. Parameter-based technology embeds the watermark into the parameters of the model by adding noise to the parameters of the model (e.g., weights or biases) or by modifying the parameter values of the model. Gradient-based technology embeds the watermark into the gradients of the model by changing or increasing the gradients of the model. Parameter-based technology is more robust against model compression attacks, where an attacker tries to reduce the size of the model or lower the complexity of the model by pruning or quantizing the parameters of the model. Gradient-based technology is more robust against model inversion attacks, where an attacker tries to recover the training data from the model by calculating the inverse gradients.

[0021] Although significant progress has been made in current model watermarking, there are still some problems. For example, current model watermarking techniques only adopt black-box model watermarking techniques or white-box model watermarking techniques, resulting in the lack of flexibility and adaptability of current model watermarking techniques. For example, if an attacker focuses on specific weaknesses of a specific method, current model watermarking techniques are difficult to cope with. In addition, current model watermarking techniques usually embed the watermark completely into a model component of the neural network model, so they cannot effectively enhance the anti-attack ability of the model.

[0022] To address at least the above and other potential problems, embodiments of the present disclosure propose a watermark processing method for a neural network model. The method includes: generating a second parameter of the neural network model by embedding a parameter component watermark into a first parameter of the neural network model. The method further includes: generating a second input of the neural network model by embedding an input component watermark into a first input of the neural network model. The method also includes: generating a second model gradient of the neural network model by embedding a gradient component watermark into a first model gradient of the neural network model. The method further includes: training the neural network model based on the second parameter, the second input, and the second model gradient to generate a trained neural network model. By this method, the anti-attack ability of the neural network model can be effectively enhanced, and the flexibility and adaptability of processing the watermark of the neural network model can also be significantly improved.

[0023] Embodiments of the present disclosure will be described in further detail below with reference to the accompanying drawings, where Figure 1 FIG. shows a schematic diagram of an example system 100 in which embodiments of the present disclosure can be implemented.

[0024] In the example system 100, there is a computing device 120, and the computing device 120 includes a neural network model 122, which can be a trained neural network model obtained after training. The trained neural network model 122 according to the embodiments of the present disclosure can be used to implement various tasks, and the present disclosure does not limit the structure of the neural network model and the specific tasks implemented.

[0025] The computing device 120 may include, but is not limited to, a personal computer, a server computer, a handheld or laptop device, a mobile device (such as a mobile phone, a personal digital assistant (PDA), a media player, etc.), a multiprocessor system, a consumer electronic product, a wearable electronic device, a smart home device, a small computer, a large computer, an edge computing device, a distributed computing environment including any one of the above systems or devices, etc.

[0026] In some embodiments, the computing device 120 can obtain the trained neural network model 122 by training the neural network model to be trained. During the training process, the computing device 120 can add the watermark 110 to the neural network model to be trained, and then train the neural network model to be trained after adding the watermark 110, so as to obtain the trained neural network model 122. Thus, the trained neural network model 122 obtained by the computing device 120 is a neural network model embedded with the watermark 110. Therefore, when the neural network model 122 is attacked by the attacker 160 (e.g., tampered with, stolen, etc.), an effective model ownership verification scheme can be provided for the owner 170 of the neural network model 122, so that the owner 170 of the model can take appropriate measures to deal with the attack of the attacker 160, thereby realizing the intellectual property protection of the trained neural network model 122.

[0027] In some embodiments, the watermark 110 according to the embodiments of the present disclosure includes split watermarking. The split watermark 110 may include a parameter component watermark, an input component watermark, and a gradient component watermark. In some embodiments, the split watermark 110 may further include a parameter component watermark, an input component watermark, a gradient component watermark, and an output component watermark. The computing device 120 can embed the parameter component watermark into the first parameters of the neural network model to be trained to generate the second parameters of the neural network model to be trained, embed the input component watermark into the first input of the neural network model to be trained to generate the second input of the neural network model to be trained, and embed the gradient component watermark into the first model gradient of the neural network model to be trained to generate the second model gradient of the neural network model to be trained. The computing device 120 further trains the neural network model to be trained based on the second parameters, the second input, and the second model gradient to generate the trained neural network model 122.

[0028] By grading the watermark 110 into three levels of components (e.g., a parameter component watermark, an input component watermark, and a gradient component watermark), and embedding the three levels of component watermarks into the corresponding components of the neural network model to be trained respectively, it is necessary to verify by extracting the watermarks of multiple components during verification, thereby increasing the security and robustness of the watermark. In addition, this method effectively uses complementary technologies to protect various parts of the model, such as parameters, inputs, and gradients. Therefore, this method can effectively improve the anti-attack ability of the neural network model, and can also significantly improve the flexibility and adaptability of processing the watermark of the neural network model.

[0029] In addition, in some embodiments, the method for processing watermarks according to the embodiments of the present disclosure may further extract watermarks from the neural network model 126 to be verified to verify the neural network model 126 to be verified. For example, verification of ownership is performed to verify whether the owner of the neural network model 126 to be verified is the owner 170 of the trained neural network model 122.

[0030] In some embodiments, as Figure 1 shown, the computing device 120 may further include an adaptive controller 124, and the adaptive controller 124 is configured to determine a verification mode based on information from the neural network model 126 to be verified. As Figure 1 shown, the attacker 160 attacks the neural network model (the trained neural network model 122 or other network models), for example, tampers with the model or steals the model, etc., and generates the neural network model 126 to be verified. To implement the verification of the neural network model 126 to be verified, the computing device 120 may determine the verification mode by receiving the output data, network parameters, and attack indicator of the neural network model 126 to be verified and using the adaptive controller 124 in the computing device 120.

[0031] The computing device 120 may further extract watermarks from the input data, output data, and network parameters of the neural network model 126 to be verified, and respectively generate extraction data corresponding to the input data, output data, and network parameters. The computing device 120 may further select, according to the determined verification mode, the extraction data corresponding to the determined verification mode, and compare the selected extraction data with the physically unclonable function PUF in the device where the neural network model to be trained is located (for example, Figure 1 in this case, it is the computing device 120) to generate a verification result. The computing device 120 may further determine the ownership of the neural network model 126 to be verified according to the verification result, for example, whether the ownership of the neural network model 126 to be verified belongs to the owner of the trained neural network model 122. For example, when the extracted data is equal to the physically unclonable function PUF in the computing device 120, the computing device 120 may determine that the ownership of the neural network model 126 to be verified belongs to the owner of the trained neural network model 122.

[0032] The above Figure 1 describes the block diagram of the example system 100 in which the embodiments of the present disclosure can be implemented. The following Figure 2 describes a method for processing watermarks of a neural network model according to an embodiment of the present disclosure. Figure 2 FIG. shows a flowchart of a method 200 for processing watermarks of a neural network model according to an embodiment of the present disclosure. The method 200 may be performed in Figure 1Execute at the computing device 120 and any suitable computing device. In addition, the numbers in the flowchart do not indicate the order in which these steps are executed. Some or all of these steps may be executed in parallel, or the execution order may be interchanged. The present disclosure does not limit this.

[0033] At block 202, the computing device 120 may generate a second parameter of the neural network model by embedding a parameter component watermark into a first parameter of the neural network model (e.g., the neural network model to be trained).

[0034] As described above, according to the watermark processing method of the embodiments of the present disclosure, the watermark can be classified into three levels of components: parameter component watermark, input component watermark, and gradient component watermark. The parameter component watermark is used to be embedded into the parameters of the neural network model to be trained (e.g., initial parameters or intermediate parameters during the training process), the input component watermark is used to be embedded into the input of the neural network model to be trained, and the gradient component watermark is used to be embedded into the model gradient of the neural network model to be trained. Thus, the three levels of components can be respectively embedded into the corresponding components of the neural network model to be trained. Correspondingly, when the computing device 120 verifies the neural network model to be verified, watermarks of multiple components need to be extracted, thereby increasing the security and robustness of the watermark.

[0035] In block 202, the computing device 120 may generate a second parameter of the neural network model (e.g., the neural network model to be trained) by embedding a parameter component watermark into a first parameter of the neural network model (e.g., the neural network model to be trained). In some embodiments, the first parameter includes the parameters of the neural network model to be trained, e.g., initial parameters or intermediate parameters obtained during the training process. By embedding the parameter component watermark into the first parameter, a second parameter of the neural network model to be trained can be obtained, and this second parameter is the parameter after embedding the watermark. For example, the second parameter may include the model parameters of the neural network with added noise. In some embodiments, the model parameters of the neural network may include the weights and / or biases of the neural network model (e.g., the neural network model to be trained).

[0036] In some embodiments, the computing device 120 may use a parameter-based watermarking technique to embed the parameter component watermark into the first parameter to generate a second parameter, that is, the parameter embedded with the parameter component watermark. It can be understood that the computing device 120 may also adopt any other suitable technique to embed the parameter component watermark into the first parameter to generate a second parameter. The present disclosure does not limit the watermark embedding technique adopted.

[0037] At block 204, the computing device 120 can generate a second input of the neural network model by embedding an input component watermark into a first input of the neural network model. In some embodiments, the first input may include training input data for training the neural network model, such as an image training set or a text training set, etc., and the present disclosure does not limit this. The computing device 120 can embed the input component watermark into the first input of the neural network model, thereby generating a second input of the neural network model. This second input is the input data after embedding the input component watermark, such as the input training data with the watermark added.

[0038] In some embodiments, the computing device 120 can embed the input component watermark into the first input by adopting an input-based watermarking technique, thereby generating a second input, that is, the input with the input component watermark embedded. It can be understood that the computing device 120 can also adopt any other suitable technique to embed the input component watermark into the first input to generate the second input, and the present disclosure does not limit the watermark embedding technique adopted.

[0039] At block 206, the computing device 120 can generate a second model gradient of the neural network model (e.g., the neural network model to be trained) by embedding a gradient component watermark into a first model gradient of the neural network model (e.g., the neural network model to be trained). The first model gradient of the neural network model can include a set of gradients for the trained neural network model. Correspondingly, the second model gradient can include the set of gradients after embedding the gradient component watermark.

[0040] In some embodiments, the computing device 120 can embed the gradient component watermark into the first model gradient by adopting a gradient-based watermarking technique, thereby generating a second model gradient, that is, the model gradient with the input gradient watermark embedded. It can be understood that the computing device 120 can also adopt any other suitable technique to embed the gradient component watermark into the first model gradient to generate the second model gradient, and the present disclosure does not limit the watermark embedding technique adopted.

[0041] At block 208, the computing device 120 can train the neural network model based on the second parameter obtained at block 202, the second input obtained at block 204, and the second model gradient obtained at block 206 to generate a trained neural network model 122. In some embodiments, the computing device 120 can select a suitable training method to train the neural network model to be trained according to the task to be achieved by the neural network model to be trained, and the present disclosure does not limit the specific training method.

[0042] Advantageously, in the method for processing the watermark of a neural network model according to an embodiment of the present disclosure, by respectively embedding three levels of components into corresponding components of the neural network model to be trained, it is necessary to verify by extracting the watermarks of multiple components during verification, thereby increasing the security and robustness of the watermark. This method can also effectively improve the anti-attack ability of the neural network model, and can also significantly improve the flexibility and adaptability of processing the watermark of the neural network model.

[0043] In addition, although the watermark processing of the neural network model is described above by taking three levels of components as an example, in some embodiments, the number of component watermarks can be greater than or less than three, for example, it can be two or four or more than four. For example, when the number of component watermarks is two, any combination of two of the parameter component watermark, the input component watermark, and the gradient component watermark can be adopted, and the present disclosure does not limit this. Another example is that when the number of component watermarks is four, the component watermark can further include an output component watermark. Correspondingly, the computing device 120 can generate a second output of the neural network model to be trained by embedding the output component watermark into the first output of the neural network model to be trained. In some embodiments, the first output can include target output data corresponding to the input training data for training the neural network model. The computing device 120 can embed the output component watermark into the first output of the neural network model to be trained, thereby generating a second output of the neural network model to be trained. This second output is the output after embedding the output component watermark, for example, the target output data for training the neural network model with the watermark added.

[0044] Those skilled in the art can understand that, in the method for processing the watermark of a neural network model according to an embodiment of the present disclosure, various other types of component watermarks can also be adopted, and are not limited to the component watermarks described in the above examples, and the present disclosure does not limit this.

[0045] The above combines Figure 2 The flowchart of the method 200 for processing the watermark of a neural network model according to an embodiment of the present disclosure is described. The following will specifically describe the example generation methods of the hierarchical component watermarks, namely the parameter component watermark, the input component watermark, and the gradient component watermark.

[0046] In some embodiments, parameters characterizing hardware security functions, such as, for example, Physically Unclonable Function (PUF) responses, can be combined to generate parameter component watermarks, input component watermarks, and gradient component watermarks. The PUF responses can be unique and unpredictable responses generated based on hardware-based physical characteristics and variations. The PUF responses can be used to generate hardware signatures, which can be used as additional functions to assist in generating parameter component watermarks, input component watermarks, and gradient component watermarks, and to verify the watermarks.

[0047] In some embodiments, the computing device 120 can determine a random seed based on the Physically Unclonable Function (PUF) response in the device where the neural network model to be trained is located. In some embodiments, this random seed is used to generate parameter component watermarks, input component watermarks, and gradient component watermarks. When the neural network model to be trained is arranged on the computing device 120 (as Figure 1 illustrated) for local training, the PUF response can be the PUF response in the computing device 120. When the neural network model to be trained is arranged on a remote device R (for example, the computing device 120 performs remote training on the neural network model to be trained), the PUF response can be the PUF response of the remote device R.

[0048] In some embodiments, the computing device 120 can generate parameter component watermarks based on the first parameters of the neural network model (e.g., the neural network model to be trained) and the random seed determined based on the PUF response in the device where the neural network model is located. The computing device 120 can adopt various suitable methods to generate parameter component watermarks based on the first parameters and the random seed. The present disclosure does not limit the specific generation method of the parameter component watermarks.

[0049] In some embodiments, the computing device 120 can generate input component watermarks based on the first input of the neural network model (e.g., the input training dataset for training the neural network model to be trained) and the random seed determined based on the PUF response in the device where the neural network model (e.g., the neural network model to be trained) is located. Similarly, the computing device 120 can adopt various suitable methods to generate input component watermarks based on the first input and the random seed. The present disclosure does not limit the specific generation method of the input component watermarks.

[0050] In some embodiments, the computing device 120 may generate a gradient component watermark based on a first model gradient of a neural network model (e.g., a neural network model to be trained), such as a set of gradients for training the neural network model to be trained, and a random seed determined based on a PUF response in the device where the neural network model to be trained is located. Similarly, the computing device 120 may adopt various suitable methods to generate a gradient component watermark based on the first model gradient and the random seed, and the present disclosure does not limit the specific generation method of the gradient component watermark.

[0051] After generating the parameter component watermark, the input component watermark, and the gradient component watermark, the computing device 120 may, according to the method 200 in the flowchart illustrated in Figure 2 , embed the generated parameter component watermark, input component watermark, and gradient component watermark into the first parameter, the first input, and the first model gradient of the neural network model to be trained, respectively, to generate a second parameter, a second input, and a second model gradient. The computing device 120 may further train the neural network model based on the generated second parameter, second input, and second model gradient, thereby generating a trained neural network model 122. Thus, a hierarchical component watermark is embedded in the generated trained neural network model 122, enabling the protection of the neural network model 122.

[0052] The following will describe an exemplary implementation of the computing device 120 extracting a watermark from the model 126 to be verified for verifying the model 126.

[0053] As Figure 1 shown, the attacker 160 attacks a neural network model (the trained neural network model 122 or other network models), for example, tampers with the model or steals the model, etc., and generates a neural network model 126 to be verified. In some embodiments, the computing device 120 may receive an attack indicator, as well as output data and network parameters of the neural network model 126 to be verified (e.g., as network parameters to be verified), and use the adaptive controller 124 in the computing device 120 to determine a verification mode. In some embodiments, the output data includes a predicted output generated by the neural network model 126 to be verified for given input data. The network parameters include model parameters of the neural network model 126 to be verified, such as weights and biases. The attack indicator indicates whether there is an attack and the type of attack in the case of an attack.

[0054] The following will describe the specific implementation process of determining the verification mode according to the adaptive controller 124 in combination with Figure 3 . Figure 3FIG. 300 is a schematic diagram showing the determination of a verification mode by adopting an adaptive controller 124 according to an embodiment of the present disclosure. In one embodiment, the adaptive controller 124 may be located in the computing device 120. In some embodiments, the computing device 160 may receive the output data predicted by the neural network model 126 to be verified for the input data, and input the output data into the adaptive controller 124. The output data may be the output data obtained by inputting the input data into the neural network model 126 to be verified. The computing device 120 may also receive the network parameters of the neural network model 126 to be verified as the network parameters to be verified, and input the received network parameters into the adaptive controller 124. In addition, the computing device 120 may also receive an attack indicator and input the received attack indicator into the adaptive controller 124. In some embodiments, the attack indicator indicates whether there is an attack and the type of attack in the case of an attack. Examples of the type of attack may include, but are not limited to, model inversion attack, model compression attack, model fine-tuning attack, and model cloning attack, etc.

[0055] In some embodiments, the adaptive controller 124 may generate a decision vector based on the received attack indicator and the output data and network parameters of the neural network model 126 to be verified, so that the computing device 120 can determine the verification mode. The determined verification mode is used to verify the ownership of the model 126 by verifying the watermark of the neural network model 126 to be verified. In some embodiments, as Figure 3 shown, the verification mode includes at least one of the following items: input-based verification mode, output-based verification mode, parameter-based verification mode, or gradient-based verification mode. The decision vector output by the adaptive controller 124 is used to indicate the verification mode that can be adopted during the process of verifying the watermark. Taking Figure 3 the verification mode shown in FIG. as an example, the decision vector may include 4 elements, respectively representing the input-based verification mode, output-based verification mode, parameter-based verification mode, or gradient-based verification mode. The adaptive controller 124 may generate a confidence level representing the adoption of each element, and represent it with a numerical value between 0 and 1.

[0056] The computing device 120 may obtain the decision vector output by the adaptive controller 124 and determine the verification mode according to the values of the elements in the decision vector. For example, the computing device 120 may select the element with the maximum value and determine the verification mode corresponding to the element as the verification mode adopted when verifying the neural network model to be verified.

[0057] In some embodiments, the adaptive controller 124 can be implemented by adopting a recurrent neural network (RNN). For the adaptive controller 124, a reinforcement learning method can be used for training. Among them, the reward function can be defined as a combination of a security metric and a performance metric. The security metric can measure the ability of the watermark to resist different types of attacks (model inversion attacks, model compression attacks, model fine-tuning attacks, and model cloning attacks). The performance metric can be used to measure the ability of the model to maintain its original functions and accuracy. The reward function aims to balance these two aspects to maximize the protection of the integrity of the model.

[0058] During the training process, the RNN decision-making function is adjusted according to the feedback of the reward. For example, if the RNN detects a model inversion attack, when the RNN switches to the gradient-based watermark technology verification mode, the maximum reward, for example, +1, can be given to the RNN. If the RNN detects a model compression attack, when the RNN switches to the parameter-based watermark technology verification mode, the maximum reward, for example, +1, can be given to the RNN. If the RNN detects a model fine-tuning attack, when the RNN switches to the output-based watermark technology verification mode, the maximum reward, for example, +1, can be given to the RNN. If the RNN detects a model cloning attack, when the RNN switches to the input-based watermark technology verification mode, the maximum reward, for example, +1, can be given to the RNN. By training the RNN through the above-mentioned reinforcement learning method, the adaptive controller 124 can be obtained. Thus, the adaptive controller 124 can generate a decision vector according to the received attack indicator and the output data and network parameters of the neural network model 126 to be verified. The decision vector is used to determine the verification mode that can be adopted during the verification of the model 126 to be verified.

[0059] As described above, the computing device 120 can obtain the decision vector output by the adaptive controller 124 and determine the verification mode according to the values of the elements in the decision vector. The computing device 120 can further extract the watermark in the neural network model 126 to be verified as extraction data. The computing device 120 can further select the extraction data corresponding to the determined verification mode according to the determined verification mode, and compare the selected extraction data with the physical unclonable function (PUF) in the device where the neural network model 122 to be trained is located (for example, Figure 1 in this case, it is the computing device 120) to generate a verification result.

[0060] Figure 4 The flowchart of method 400 for extracting the watermark in the neural network model 126 to be verified as extraction data according to an embodiment of the present disclosure is shown. Method 400 can be performed in Figure 1Execute at the computing device 120 and any suitable computing device. In addition, the numbers in the flowchart do not indicate the order in which these steps are executed. Some or all of these steps can be executed in parallel, or the order of execution can be interchanged, and the present disclosure does not limit this.

[0061] At block 402, the computing device 120 can restore the third parameter of the neural network model 126 to be verified to a fourth parameter to obtain first extraction data based on the third parameter and the restored fourth parameter. In some embodiments, the third parameter of the neural network model 126 to be verified can include the network parameters of the neural network model 126 to be verified. The computing device 120 can restore the third parameter of the neural network model 126 to be verified to a fourth parameter by adopting the inverse operation of the parameter-based watermarking technique used when embedding parameter component watermarks in the neural network model to be trained. The computing device 120 can obtain first extraction data based on the third parameter and the restored fourth parameter. This first extraction data can be used to characterize the parameter component watermark embedded in the parameters.

[0062] For example, assume that the third parameter of the neural network model 126 to be verified can be represented as P3. By performing the inverse operation of the parameter-based watermarking technique on the third parameter P3, the computing device 120 can obtain the restored fourth parameter P4 of the neural network model 126 to be verified. The computing device 120 can determine the difference ΔP between the third parameter and the fourth parameter and use this difference as the first extraction data D1 to represent the parameter component watermark embedded in the network parameters of the neural network model 126 to be verified.

[0063] At block 404, the computing device 120 can restore the third input of the neural network model 126 to be verified to a fourth input to obtain second extraction data based on the third input and the restored fourth input. In some embodiments, the third input of the neural network model 126 to be verified can include the input data of the neural network model 126 to be verified. The computing device 120 can restore the third input of the neural network model 126 to be verified to a fourth input by adopting the inverse operation of the input-based watermarking technique used when embedding input component watermarks in the neural network model to be trained. The computing device 120 can obtain second extraction data based on the input parameters and the restored fourth input. This second extraction data can be used to characterize the input component watermark embedded in the input.

[0064] For example, assume that the third input of the neural network model 126 to be verified can be represented as I3. By performing an inverse operation of the input-based watermarking technique on the third input I3, the computing device 120 can obtain the restored fourth input I4 of the neural network model 126 to be verified. The computing device 120 can determine the difference ΔI between the third input and the fourth input, and use this difference as the second extraction data D2 to represent the input component watermark embedded in the input data of the neural network model 126 to be verified.

[0065] In block 406, the computing device 120 can also restore the third model gradient of the neural network model 126 to be verified to a fourth model gradient to obtain third extraction data based on the third model gradient and the restored fourth model gradient. In some embodiments, the third model gradient of the neural network model 126 to be verified can include the model gradient of the neural network model 126 to be verified. The computing device 120 can restore the third model gradient of the neural network model 126 to be verified to a fourth model gradient by adopting an inverse operation of the gradient-based watermarking technique used when embedding the gradient component watermark in the neural network model to be trained. The computing device 120 can obtain the third extraction data based on the model gradient parameter and the restored fourth model gradient. This third extraction data can be used to characterize the gradient component watermark embedded in the model gradient.

[0066] For example, assume that the third model gradient of the neural network model 126 to be verified can be represented as G3. By performing an inverse operation of the gradient-based watermarking technique on the third model gradient G3, the computing device 120 can obtain the restored fourth model gradient G4 of the neural network model 126 to be verified. The computing device 120 can determine the difference ΔG between the third model gradient and the fourth model gradient, and use this difference as the third extraction data D3 to represent the gradient component watermark embedded in the model gradient data of the neural network model 126 to be verified.

[0067] In addition, it can be understood that in the case where the hierarchical component watermark includes an output component watermark, the computing device 120 can also restore the third output of the neural network model 126 to be verified to a fourth output to obtain fourth extraction data based on the third output and the restored fourth output. In some embodiments, the third output of the neural network model 126 to be verified can include the predicted output of the neural network model 126 to be verified under given input data. The computing device 120 can restore the third output of the neural network model 126 to be verified to a fourth output by adopting an inverse operation of the output-based watermarking technique used when embedding the output component watermark in the neural network model to be trained. The computing device 120 can obtain the fourth extraction data based on the output parameter and the restored fourth output. This fourth extraction data can be used to characterize the output component watermark embedded in the output.

[0068] For example, assume that the third output of the neural network model 126 to be verified can be represented as U3. By performing an inverse operation of the output-based watermarking technique on the third output U3, the computing device 120 can obtain the restored fourth output U4 of the neural network model 126 to be verified. The computing device 120 can determine the difference ΔU between the third output and the fourth output, and use this difference as the fourth extraction data U3 to represent the output component watermark embedded in the output data of the neural network model 126 to be verified.

[0069] In some embodiments, after determining the verification mode according to the decision vector of the adaptive controller 124, the computing device 120 can further select the extraction data corresponding to the determined verification mode from the first extraction data, the second extraction data, and the third extraction data based on the determined verification mode. For example, when the computing device 120 determines that the verification mode is the parameter-based verification mode, the computing device 120 can select the first extraction data D1. When the computing device 120 determines that the verification mode is the input-based verification mode, the computing device 120 can select the second extraction data D2. When the computing device 120 determines that the verification mode is the gradient-based verification mode, the computing device 120 can select the third extraction data D3. In addition, it can be understood that when the computing device 120 determines that the verification mode is the output-based verification mode, the computing device 120 can select the fourth extraction data D4.

[0070] After selecting the extraction data (i.e., the corresponding component watermark), the computing device 120 can compare the selected extraction data with the response of the physically unclonable function PUF in the device where the neural network model to be trained is located (e.g., Figure 1 the computing device 120 in this case) to verify the neural network model 126 to be verified. For example, to confirm whether the ownership of the neural network model 126 to be verified belongs to the owner of the neural network model 122. In some embodiments, when the computing device 120 determines that the extraction data matches the response of the physically unclonable function PUF, the computing device 120 can determine that the ownership of the neural network model 126 to be verified belongs to the owner of the neural network model 122. Correspondingly, the computing device 120 can determine that the neural network model 122 has been attacked, and then can take corresponding measures. When the computing device 120 determines that the extraction data does not match the response of the physically unclonable function PUF, the computing device 120 can determine that the ownership of the neural network model 126 to be verified does not belong to the owner of the neural network model 122.

[0071] Through the method for processing the watermark of the neural network model described above, the anti-attack ability of the neural network model is effectively improved, and the flexibility and adaptability of processing the watermark of the neural network model are significantly improved.

[0072] According to an embodiment of the present disclosure, there is also provided a method for verifying a model by verifying a watermark of a neural network model. The following will be described in conjunction with Figure 5 a method for verifying a watermark of a neural network model according to an embodiment of the present disclosure. Figure 5 FIG. 500 is a flowchart showing a method for verifying a watermark of a neural network model according to an embodiment of the present disclosure. The method 500 can be executed at the computing device 120 in Figure 1 and any suitable computing device. In addition, the numbers in the flowchart do not indicate the order in which these steps are executed. Some or all of these steps can be executed in parallel, or the execution order can be interchanged, and the present disclosure does not limit this.

[0073] At block 502, the computing device 120 can obtain first extraction data, second extraction data, and third extraction data corresponding to the network parameters, input data, and gradients of the neural network model 126 to be verified, respectively. In some embodiments, the computing device 120 can adopt the method 400 for extracting the watermark in the neural network model 126 to be verified as extraction data described in conjunction with Figure 4 to respectively obtain the first extraction data D1, the second extraction data D2, and the third extraction data D3.

[0074] For example, the computing device 120 can restore the third parameter of the neural network model 126 to be verified to a fourth parameter to obtain the first extraction data D1 based on the third parameter and the restored fourth parameter, and the first extraction data D1 represents the parameter component watermark. The computing device 120 can restore the third input of the neural network model 126 to be verified to a fourth input to obtain the second extraction data D2 based on the third input and the restored fourth input, and the second extraction data D2 represents the input component watermark. The computing device 120 can also restore the third model gradient of the neural network model 126 to be verified to a fourth model gradient to obtain the third extraction data D3 based on the third model gradient and the restored fourth model gradient, and the third extraction data D3 represents the gradient component watermark. In addition, the computing device 120 can also restore the third output of the neural network model 126 to be verified to a fourth output to obtain the fourth extraction data D4 based on the third output and the restored fourth output, and the fourth extraction data D4 represents the output component watermark. The specific extraction process can be understood in conjunction with the description in Figure 4 and will not be elaborated here for the sake of brevity.

[0075] At block 504, the computing device 120 can input the attack indicator, the output data, and the network parameters of the neural network model 126 to be verified into the adaptive controller 124 to determine the verification mode according to the output of the adaptive controller.

[0076] As described above, the output data includes the predicted output data generated by the neural network model 126 to be verified for the given input data. The network parameters include the parameters of the neural network model 126 to be verified, such as weights and biases. The attack indicator indicates whether there is an attack and the type of attack in the case of an attack. Examples of similar attacks can include, but are not limited to, model inversion attacks, model compression attacks, model fine-tuning attacks, and model cloning attacks, etc.

[0077] The verification mode includes at least one of the following: an input-based verification mode, an output-based verification mode, a parameter-based verification mode, or a gradient-based verification mode. In some embodiments, the adaptive controller 124 can generate a decision vector based on the received attack indicator and the output data and network parameters of the neural network model 126 to be verified. This decision vector is used to determine the verification mode that can be adopted during the verification of the watermark. The computing device 120 can obtain the decision vector output by the adaptive controller 124 and determine the verification mode according to the values of the elements in the decision vector. The steps at block 504 can be implemented in conjunction with Figure 3 the detailed description, and for the sake of brevity, it will not be repeated here.

[0078] At block 506, the computing device 120 can select the extraction data corresponding to the determined verification mode from the first extraction data, the second extraction data, and the third extraction data according to the determined verification mode. For example, when the computing device 120 determines that the verification mode is a parameter-based verification mode, the computing device 120 selects the first extraction data D1 representing the parameter component watermark. When the computing device 120 determines that the verification mode is an input-based verification mode, the computing device 120 selects the second extraction data D2 representing the input component watermark. When the computing device 120 determines that the verification mode is a gradient-based verification mode, the computing device 120 selects the third extraction data D3 representing the gradient component watermark. In addition, it can be understood that when the computing device 120 determines that the verification mode is an output-based verification mode, the computing device 120 can select the fourth extraction data D4 representing the output component watermark.

[0079] At block 508, computing device 120 may compare the selected extracted data with a Physical Unclonable Function (PUF) response in the device to verify the neural network model to be verified. For example, to confirm whether the ownership of the neural network model 126 to be verified belongs to the owner of the neural network model 122. In some embodiments, the device may be the device where the neural network to be trained corresponding to the neural network model 122 is located. In other words, computing device 120 may compare the selected extracted data with the PUF response in the device where the neural network to be trained corresponding to the neural network model to be compared is located to verify the neural network model to be verified. In some embodiments, when computing device 120 determines that the extracted data matches the PUF response, computing device 120 may determine that the ownership of the neural network model 126 to be verified belongs to the owner of the neural network model 122. Accordingly, computing device 120 may determine that the neural network model 122 has been attacked and may then take corresponding measures. When computing device 120 determines that the extracted data does not match the PUF response, computing device 120 may determine that the ownership of the neural network model 126 to be verified does not belong to the owner of the neural network model 122.

[0080] In some embodiments, the neural network model 122 is obtained by training the neural network model to be trained. The hierarchical component watermark can be embedded into the neural network model to be trained by the following operations: generating the second parameter of the neural network model to be trained by embedding the parameter component watermark into the first parameter of the neural network model to be trained; generating the second input of the neural network model to be trained by embedding the input component watermark into the first input of the neural network model to be trained; generating the second model gradient of the neural network model to be trained by embedding the gradient component watermark into the first model gradient of the neural network model to be trained; and training the neural network model to be trained based on the second parameter, the second input, and the second model gradient to generate the trained neural network model 122.

[0081] In some embodiments, a random seed may be determined based on the PUF response in the device where the neural network model to be trained is located. In some embodiments, the random seed is used to generate the parameter component watermark, the input component watermark, and the gradient component watermark.

[0082] In some embodiments, a parameter component watermark may be generated based on the first parameters of the neural network model to be trained and the determined random seed. In some embodiments, an input component watermark may be generated based on the first input of the neural network model to be trained and the determined random seed. In some embodiments, a gradient component watermark may be generated based on the first model gradient of the neural network model to be trained and the determined random seed. Additionally, an output component watermark may be generated based on the first output of the neural network model to be trained and the random seed.

[0083] The process of watermark embedding operation for the neural network model to be trained and the process of generating hierarchical component watermarks are substantially the same as the corresponding processes described above. For the sake of brevity, they will not be elaborated herein.

[0084] Figure 6 FIG. shows a schematic block diagram of an exemplary device 600 that may be used to implement the embodiments of the present disclosure. For example, Figure 1 the computing device 120 in may be implemented using the device 600. As shown, the device 600 includes a central processing unit (CPU) 601, which can execute various appropriate actions and processes according to the computer program instructions stored in the read-only memory (ROM) 602 or the computer program instructions loaded from the storage unit 608 into the random access memory (RAM) 603. In the RAM 603, various programs and data required for the operation of the device 500 may also be stored. The CPU 601, ROM 602, and RAM 603 are connected to each other via a bus 504. The input / output (I / O) interface 605 is also connected to the bus 604.

[0085] Multiple components in the device 600 are connected to the I / O interface 605, including: an input unit 606, such as a keyboard, mouse, etc.; an output unit 607, such as various types of displays, speakers, etc.; a storage page 608, such as a disk, optical disc, etc.; and a communication unit 609, such as a network card, modem, wireless communication transceiver, etc. The communication unit 609 allows the device 600 to exchange information / data with other devices via a computer network such as the Internet and / or various telecommunication networks.

[0086] The various processes and operations described above, such as method 200 for processing the watermark of a neural network model, method 400 for extracting the watermark in a neural network model to be verified as extraction data, and method 500 for verifying the watermark of a neural network model, can be executed by processing unit 601. For example, in some embodiments, methods 200, 400, and 500 can be implemented as computer software programs tangibly embodied in a machine-readable medium, such as storage unit 608. In some embodiments, part or all of the computer program can be loaded and / or installed onto device 600 via ROM 602 and / or communication unit 609. When the computer program is loaded into RAM 603 and executed by CPU 601, one or more actions of method 200 for processing the watermark of a neural network model, method 400 for extracting the watermark in a neural network model to be verified as extraction data, and method 500 for verifying the watermark of a neural network model described above can be performed.

[0087] The present disclosure may be a method, an apparatus, a system, and / or a computer program product. The computer program product may include a computer-readable storage medium having computer-readable program instructions thereon for performing various aspects of the present disclosure.

[0088] A computer-readable storage medium may be a tangible device that can retain and store instructions for use by an instruction execution device. A computer-readable storage medium may be, for example, but not limited to, an electrical storage device, a magnetic storage device, an optical storage device, an electromagnetic storage device, a semiconductor storage device, or any suitable combination of the foregoing. More specific examples (a non-exhaustive list) of the computer-readable storage medium include: a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or Flash memory), a static random access memory (SRAM), a portable compact disc read-only memory (CD-ROM), a digital versatile disc (DVD), a memory stick, a floppy disk, a mechanically encoded device such as a punched card or raised structures in a groove having instructions stored thereon, and any suitable combination of the foregoing. As used herein, a computer-readable storage medium is not construed to be an instantaneous signal per se, such as a radio wave or other freely propagating electromagnetic wave, an electromagnetic wave propagating through a waveguide or other transmission medium (e.g., an optical pulse through an optical fiber cable), or an electrical signal transmitted through a wire.

[0089] The computer-readable program instructions described herein can be downloaded to various computing / processing devices from a computer-readable storage medium or downloaded to an external computer or external storage device via a network, such as the Internet, a local area network, a wide area network, and / or a wireless network. The network may include copper transmission cables, optical fiber transmission, wireless transmission, routers, firewalls, switches, gateway computers, and / or edge servers. A network adapter card or network interface in each computing / processing device receives the computer-readable program instructions from the network and forwards the computer-readable program instructions for storage in a computer-readable storage medium in each computing / processing device.

[0090] The computer program instructions for performing the operations of the present disclosure may be assembly instructions, instruction set architecture (ISA) instructions, machine instructions, machine-related instructions, microcode, firmware instructions, state-setting data, or source code or object code written in any combination of one or more programming languages, including object-oriented programming languages such as Smalltalk, C++, etc., and conventional procedural programming languages such as the "C" language or similar programming languages. The computer-readable program instructions may be executed entirely on the user's computer, partially on the user's computer, executed as a stand-alone software package, partially on the user's computer and partially on a remote computer, or entirely on a remote computer or server. In the case of a remote computer, the remote computer may be connected to the user's computer through any type of network, including a local area network (LAN) or a wide area network (WAN), or may be connected to an external computer (e.g., via the Internet using an Internet service provider). In some embodiments, by using the state information of the computer-readable program instructions to customize an electronic circuit, such as a programmable logic circuit, a field-programmable gate array (FPGA), or a programmable logic array (PLA), the electronic circuit can execute the computer-readable program instructions to implement various aspects of the present disclosure.

[0091] Aspects of the present disclosure are described herein with reference to flowchart illustrations and / or block diagrams of methods, apparatus (systems), and computer program products according to embodiments of the disclosure. It should be understood that each block of the flowchart illustrations and / or block diagrams, and combinations of blocks in the flowchart illustrations and / or block diagrams, can be implemented by computer-readable program instructions.

[0092] These computer-readable program instructions can be provided to a processing unit of a general-purpose computer, a special-purpose computer, or other programmable data processing apparatus to produce a machine such that the instructions, when executed by the processing unit of the computer or other programmable data processing apparatus, result in an apparatus that implements the functions / acts specified in one or more blocks of the flowchart and / or block diagram. These computer-readable program instructions may also be stored in a computer-readable storage medium that causes a computer, a programmable data processing apparatus, and / or other devices to function in a particular manner, such that the computer-readable medium storing the instructions comprises a manufacture, including instructions that implement various aspects of the functions / acts specified in one or more blocks of the flowchart and / or block diagram.

[0093] The computer-readable program instructions may also be loaded onto a computer, other programmable data processing apparatus, or other devices, such that a series of operational steps are performed on the computer, other programmable data processing apparatus, or other devices to produce a computer-implemented process, thereby causing the instructions executed on the computer, other programmable data processing apparatus, or other devices to implement the functions / acts specified in one or more blocks of the flowchart and / or block diagram.

[0094] The flowcharts and block diagrams in the figures illustrate the architecture, functionality, and operation of possible implementations of systems, methods, and computer program products according to various embodiments of the present disclosure. In this regard, each block in the flowchart or block diagram may represent a module, a segment of a program, or a portion of an instruction, which comprises one or more executable instructions for implementing the specified logical function. In some alternative implementations, the functions noted in the blocks may occur out of the order noted in the figures. For example, two consecutive blocks may in fact be executed substantially in parallel, or they may sometimes be executed in the reverse order, depending on the functionality involved. It should also be noted that each block of the block diagrams and / or flowcharts, and combinations of blocks in the block diagrams and / or flowcharts, can be implemented by special-purpose hardware-based systems that perform the specified functions or acts, or by combinations of special-purpose hardware and computer instructions.

[0095] The embodiments of the present disclosure have been described above. The above description is exemplary, not exhaustive, and is not limited to the disclosed embodiments. Many modifications and variations will be apparent to those of ordinary skill in the art without departing from the scope and spirit of the described embodiments. The choice of terms used herein is intended to best explain the principles of the embodiments, the practical application, or the technical improvement of the technology in the market, or to enable other ordinary skilled persons in the art to understand the embodiments disclosed herein.

Claims

1. A method for watermark processing of a neural network model, the method comprising: Generating a second parameter of the neural network model by embedding a parameter component watermark into a first parameter of the neural network model; Generating a second input of the neural network model by embedding an input component watermark into a first input of the neural network model; Generating a second model gradient of the neural network model by embedding a gradient component watermark into a first model gradient of the neural network model; and Training the neural network model based on the second parameter, the second input, and the second model gradient to generate a trained neural network model.

2. The method according to claim 1, further comprising: Determining a random seed based on a response of a physical unclonable function PUF in the device where the neural network model is located, where the random seed is used to generate the parameter component watermark, the input component watermark, and the gradient component watermark.

3. The method according to claim 2, further comprising: Generating the parameter component watermark based on the first parameter of the neural network model and the random seed; Generating the input component watermark based on the first input of the neural network model and the random seed; And Generating the gradient component watermark based on the first model gradient of the neural network model and the random seed.

4. The method according to claim 1, further comprising: Obtaining output data of a neural network model to be verified for input data.

5. The method according to claim 4, wherein the neural network model to be verified includes network parameters to be verified, and the method further comprises: Inputting the output data, the network parameters to be verified, and an attack indicator into an adaptive controller to determine a verification mode based on an output of the adaptive controller, where the verification mode is used to verify the neural network model to be verified.

6. The method according to claim 5, wherein the adaptive controller is implemented using a recurrent neural network RNN.

7. The method according to claim 5, wherein the verification mode includes at least one of the following items: A verification mode based on input, a verification mode based on output, a verification mode based on parameters, or a verification mode based on gradients.

8. The method according to claim 5, further comprising: Restoring a third parameter of the neural network model to be verified to a fourth parameter to obtain first extraction data based on the third parameter and the restored fourth parameter; Restoring a third input of the neural network model to be verified to a fourth input to obtain second extraction data based on the third input and the restored fourth input; And Restoring a third model gradient of the neural network model to be verified to a fourth model gradient to obtain third extraction data based on the third model gradient and the restored fourth model gradient.

9. The method according to claim 8, further comprising: Selecting extraction data corresponding to the determined verification mode from the first extraction data, the second extraction data, and the third extraction data based on the determined verification mode; and comparing the selected extracted data with a physical unclonable function (PUF) response in the device where the neural network model is located to verify the neural network model to be verified.

10. The method according to claim 5, wherein the attack indicator is used to indicate whether an attack exists and the type of attack in the case of an existing attack.

11. An electronic device, the electronic device comprising: at least one processor; and a memory coupled to the at least one processor and having instructions stored thereon, the instructions, when executed by the at least one processor, cause the electronic device to perform operations, the operations including: generating second parameters of the neural network model by embedding parameter component watermarks into first parameters of the neural network model; generating second inputs of the neural network model by embedding input component watermarks into first inputs of the neural network model; generating second model gradients of the neural network model by embedding gradient component watermarks into first model gradients of the neural network model; and training the neural network model based on the second parameters, the second inputs, and the second model gradients to generate a trained neural network model.

12. The electronic device according to claim 11, wherein the instructions, when executed by the at least one processor, further cause the electronic device to perform operations, the operations including: determining a random seed based on a physical unclonable function (PUF) response in the device where the neural network model is located, wherein the random seed is used to generate the parameter component watermark, the input component watermark, and the gradient component watermark.

13. The electronic device according to claim 12, wherein the instructions, when executed by the at least one processor, further cause the electronic device to perform operations, the operations including: generating the parameter component watermark based on the first parameters of the neural network model and the random seed; generating the input component watermark based on the first inputs of the neural network model and the random seed; and generating the gradient component watermark based on the first model gradients of the neural network model and the random seed.

14. The electronic device according to claim 11, wherein the instructions, when executed by the at least one processor, further cause the electronic device to perform operations, the operations including: obtaining output data of the neural network model to be verified for input data.

15. The electronic device according to claim 14, wherein the neural network model to be verified includes network parameters to be verified, and wherein the instructions, when executed by the at least one processor, further cause the electronic device to perform operations, the operations including: inputting the output data, the network parameters to be verified, and an attack indicator into an adaptive controller to determine a verification mode based on an output of the adaptive controller, wherein the verification mode is used to verify the neural network model to be verified.

16. The electronic device according to claim 15, wherein the adaptive controller is implemented using a recurrent neural network (RNN).

17. The electronic device according to claim 15, wherein the verification mode includes at least one of the following items: a verification mode based on an input, a verification mode based on an output, a verification mode based on a parameter, or a verification mode based on a gradient.

18. The electronic device according to claim 15, wherein the instruction further causes the electronic device to perform an action when executed by the at least one processor, and the action includes: restoring a third parameter of the neural network model to be verified to a fourth parameter to obtain first extraction data based on the third parameter and the restored fourth parameter; restoring a third input of the neural network model to be verified to a fourth input to obtain second extraction data based on the third input and the restored fourth input; and restoring a third model gradient of the neural network model to be verified to a fourth model gradient to obtain third extraction data based on the third model gradient and the restored fourth model gradient.

19. The electronic device according to claim 18, wherein the instruction further causes the electronic device to perform an action when executed by the at least one processor, and the action includes: selecting, based on the determined verification mode, extraction data corresponding to the determined verification mode from the first extraction data, the second extraction data, and the third extraction data; and comparing the selected extraction data with a physical unclonable function (PUF) response in the device where the neural network model is located to verify the neural network model to be verified.

20. A computer program product, the computer program product being tangibly stored on a non-transitory computer-readable medium and including machine-executable instructions that, when executed, cause a machine to: generate a second parameter of the neural network model by embedding a parameter component watermark into a first parameter of the neural network model; generate a second input of the neural network model by embedding an input component watermark into a first input of the neural network model; generate a second model gradient of the neural network model by embedding a gradient component watermark into a first model gradient of the neural network model; and train the neural network model based on the second parameter, the second input, and the second model gradient to generate a trained neural network model.

Images