A self-supervisory model copyright protection method based on double-layer optimization, electronic device and storage medium

Abstract

The present invention discloses a self-supervised model copyright protection method, electronic device and storage medium based on double-layer optimization, which are used to enhance the model copyright protection security in self-supervised learning scenarios. Internal optimization designs a watermark optimization strategy to strongly associate watermark samples with target labels, and obtains dynamic weights based on the feature similarity loss between the watermark sample and other non-target samples to optimize the effect of the watermark on each category of data, thereby avoiding interference between the watermark sample features and the features of other category samples; external optimization refers to the use of a joint loss function in the encoder feature space to retain the normal classification function of the model and the copyright protection goal of the model watermark, thereby ensuring the effectiveness, utility and concealment of the watermark. The present invention can effectively prevent the failure of the watermark on a specific category through a double-layer optimization strategy, thereby ensuring the stability and robustness of the model watermark in practical applications.

Description

Technical Field

[0001] The present invention relates to a self-supervisory model copyright protection method based on double-layer optimization, electronic equipment and storage medium, and belongs to the technical field of information security. Background Art

[0002] Self-supervised learning (SSL) models employ a pre-task to obtain a high-performing encoder, allowing the encoder to automatically learn key features from unlabeled data. Self-supervised learning model owners then build downstream classifiers based on the encoder, forming a deep neural network (DNN) model. Currently, there are two scenarios for using SSL pre-trained encoders: one is to directly deploy the encoder as a paid cloud service, and the other is to use the pre-trained encoder as a general feature extractor, allowing users to train classifiers for various downstream tasks to obtain high-performing network models. Due to the encoder's powerful feature extraction capabilities and applicability, self-supervised learning models have been widely used in fields such as computer vision and natural language processing. However, since training a well-trained encoder model typically requires significant time, data, and computing resources, intellectual property protection for SSL models has become increasingly prominent. With the widespread use of SSL models, piracy has enabled SSL model pirates to illegally obtain and copy the models through reverse engineering or stealing model outputs, thereby infringing on their copyrights. Therefore, establishing effective copyright protection mechanisms for self-supervised models is crucial to prevent unauthorized copying, modification, and misuse of SSL models.

[0003] In the context of self-supervised learning, the owner of a self-supervised learning model embeds a watermark into a clean encoder (typically downloaded from a third-party platform) and publishes it on these platforms. This watermark can be transferred to any downstream model built based on the encoder. However, pirates of self-supervised learning models steal these valuable encoders and train a classifier for downstream tasks, thereby infringing the owner's intellectual property rights. To address this issue, model watermarking technology has emerged, which verifies the ownership of SSL models by embedding hidden identifying information in them. Specifically, by mapping watermark samples into the feature space of the watermark encoder, downstream classifiers predict the target label for the watermarked samples, thereby protecting intellectual property rights. Existing watermarking technologies typically focus only on overall extraction accuracy without considering significant differences across categories. This results in poor watermark verification performance in some categories, thus affecting overall extraction performance. This puts watermarking technologies, originally intended to protect model copyright, at risk of being bypassed by model pirates and makes it difficult to achieve stable and effective copyright protection across all categories. Summary of the Invention

[0004] Purpose: To overcome the deficiencies in the prior art, the present invention provides a self-supervisory model copyright protection method based on double-layer optimization, an electronic device, and a storage medium.

[0005] Technical solution: To solve the above technical problems, the technical solution adopted by the present invention is:

[0006] First, a self-supervisory model copyright protection method based on two-layer optimization, specifically including:

[0007] According to the watermark trigger and the clean sample, the watermark sample is obtained.

[0008] The watermark sample, the reference sample of the target class and the reference sample of the non-target class are respectively used to train the encoder to be protected to obtain a first target loss function and a second target loss function.

[0009] Substitute the first objective loss function and the second objective loss function into the total loss optimization objective function, solve the total loss optimization objective function, and obtain the optimized watermark trigger.

[0010] According to the optimized watermark trigger, the optimized watermark sample and the initial watermark encoder are obtained.

[0011] The optimized watermark samples, clean samples and reference samples of the target class are used to train the initial watermark encoder respectively to obtain the watermark validity loss function, watermark utility loss function and watermark concealment loss function.

[0012] The watermark validity loss function, watermark utility loss function and watermark concealment loss function are substituted into the joint loss optimization objective function, the joint loss optimization objective function is solved, and the optimized watermark encoder is obtained.

[0013] As a preferred solution, the optimized watermark samples are fed one by one into a DNN model built based on the suspected SSL encoder to verify whether the labels predicted by the DNN model are the same as the watermark target labels. If the accuracy of classification as the watermark target label exceeds a certain threshold, the suspected SSL model is determined to be a pirated model.

[0014] As a preferred solution, the size of the watermark trigger is consistent with the clean sample, and the initial pixel value of the watermark trigger is randomly generated by uniform distribution, and the range is set to [-1, 1].

[0015] As a preferred solution, the expression of the watermark sample is as follows:

[0016]

[0017] in, represents the watermark sample, represents pixel-by-pixel multiplication operation, Represents a cropping operation that limits the range of a tensor or value, cropping the final result to the image range [0,255]. The trigger mask representing the embedding position in the input sample, represents the watermark trigger, Indicates a clean sample.

[0018] As a preferred solution, the first objective loss function is expressed as follows:

[0019]

[0020]

[0021] in, represents the first objective loss function, represents the distance metric method, represents a clean dataset, is the number of samples in the clean dataset, represents a clean sample, represents the reference sample of the target class, represents the reference sample set of the target class, Indicates the encoder to be protected, Represents the watermark feature, represents the target class reference embedding feature, represents the watermark trigger, Represents the control watermark trigger The maximum amplitude of the disturbance, represents the infinity norm.

[0022] The second objective loss function expression is as follows:

[0023]

[0024] in, represents the second objective loss function, Indicates the Reference samples of non-target classes, represents the reference sample set of non-target classes, Indicates the number of categories of non-target classes, Represents the reference embedding features of non-target classes.

[0025] As a preferred solution, the total loss optimization objective function expression is as follows:

[0026]

[0027] in, represents the watermark trigger, represents the total loss optimization objective function, k represents the number of non-target classes, represents the first objective loss function, represents the second objective loss function, represents the hyperparameter, Indicates the Dynamic weights for non-target classes.

[0028] As a preferred solution, the watermark validity loss function is expressed as follows:

[0029]

[0030] in, represents the watermark validity loss function, is the number of clean datasets, represents a clean sample, represents a clean dataset, represents the reference sample of the target class, represents the reference sample set of the target class, represents the distance metric method, Represents the characteristics of the optimized watermark sample corresponding to the initial watermark encoder, represents the target class reference embedding feature corresponding to the initial watermark encoder, Indicates the optimized watermark sample.

[0031] The watermark utility loss function The expression is as follows:

[0032]

[0033] in, represents the watermark utility loss function, Represents the features of the clean samples corresponding to the encoder to be protected.

[0034] The watermark concealment loss function is expressed as follows:

[0035]

[0036] in, represents the watermark concealment loss function, Represents the characteristics of the clean sample corresponding to the initial watermark encoder.

[0037] As a preferred solution, the joint loss optimization objective function expression is as follows:

[0038]

[0039] in, represents the joint loss optimization objective function, represents the watermark concealment loss function, represents the watermark utility loss function, represents the watermark validity loss function, represents the optimized watermark encoder, represents the first penalty factor, Represents the second penalty factor.

[0040] As a preferred solution, when solving the joint loss optimization objective function, when the value of the watermark concealment loss function meets the preset threshold, the first penalty factor is gradually increased. The setting value of the first penalty factor is gradually reduced. The setting value of

[0041] In a second aspect, a computer-readable storage medium stores a computer program thereon, which, when executed by a processor, implements a self-supervisory model copyright protection method based on double-layer optimization as described in any one of the first aspects.

[0042] According to a third aspect, a computer device includes:

[0043] Memory, used to store instructions.

[0044] The processor is configured to execute the instructions so that the computer device performs the operations of the self-supervised model copyright protection method based on double-layer optimization as described in any one of the first aspects.

[0045] Beneficial effects: The present invention provides a self-supervised model copyright protection method, electronic device and storage medium based on double-layer optimization to enhance the model copyright protection security in self-supervised learning scenarios. Internal optimization designs a watermark optimization strategy to strongly associate watermark samples with target labels, and obtains dynamic weights based on the feature similarity loss between watermark samples and other non-target samples to optimize the effect of watermarks on each category of data, thereby avoiding interference between watermark sample features and features of other categories of samples; external optimization refers to the use of a joint loss function in the encoder feature space to retain the normal classification function of the model and the copyright protection goal of the model watermark, so as to ensure the effectiveness, utility and concealment of the watermark. Through the double-layer optimization strategy, the present invention can effectively prevent the failure of watermarks in specific categories, and ensure the stability and robustness of model watermarks in practical applications.

[0046] Based on the observation that watermarking techniques in self-supervised scenarios exhibit significant differences in extraction accuracy across different categories, this paper proposes a dual-layer optimized self-supervised model copyright protection method. Compared to existing watermarking techniques, this method not only considers the overall watermark extraction effect but also further considers the extraction accuracy across multiple categories of data. This effectively avoids extraction instability caused by category differences, thereby enhancing the stability of watermarks in complex and diverse data scenarios. BRIEF DESCRIPTION OF THE DRAWINGS

[0047] Figure 1 Schematic diagram of watermark trigger optimization in the present invention.

[0048] Figure 2 Schematic diagram of watermark embedding and optimization of the encoder in the present invention.

[0049] Figure 3 Schematic diagram of SSL model ownership verification in the present invention. DETAILED DESCRIPTION

[0050] The following is a clear and complete description of the technical solutions in the examples of the present invention, in conjunction with the accompanying drawings. Obviously, the embodiments described are only some of the embodiments of the present invention, not all of them. All other embodiments obtained by those skilled in the art based on the embodiments of the present invention without creative work are within the scope of protection of the present invention.

[0051] The present invention will be further described below with reference to specific embodiments.

[0052] Example 1:

[0053] This embodiment introduces a self-supervisory model copyright protection method based on two-layer optimization, which specifically includes:

[0054] Step 1: Optimize the watermark trigger to obtain the optimized watermark trigger, such as Figure 1 As shown, specifically including:

[0055] Step 1.1: Get a clean, unlabeled dataset ,The reference sample set belonging to the target class in the downstream task and the encoder to be protected ,in: express The clean samples in , express Middle Reference samples, is the number of reference samples.

[0056] Step 1.2: Prepare a clean sample The size of the image is H×W×C, which represents the height (number of pixels), width (number of pixels), and number of channels of the image (for example, the sample size in the CIFAR-10 dataset is 32×32×3). Size initialization and clean samples Consistent, watermark trigger The initial pixel value is randomly generated by uniform distribution, and the range is set to [-1, 1]. By setting the requires_grad=True attribute of the trigger tensor, it means that the gradient information of the trigger tensor is automatically calculated and stored during the backpropagation process, and the gradient will be updated later, where:

[0057] .

[0058] Step 1.3: Create a watermark trigger for boot Towards a representation distribution for a specific category, selecting a reference sample set belonging to the target class in the downstream task By applying predefined image transformations to the reference samples, such as adjusting the image size and normalization, and then inputting the transformed reference samples into the encoder to be protected Extract the feature vector of each image. Use the channel dimension average strategy to aggregate the representations of multiple reference samples to obtain a unified target class reference embedding as the target for subsequent optimization triggers, where the target class reference embedding feature The expression is as follows:

[0059]

[0060] in, is the reference sample set of the target class The number of samples, is the reference sample set of the target class No. Reference samples, This is the feature extraction operation of the encoder to be protected.

[0061] Step 1.4: From unlabeled clean dataset Randomly sample several clean samples from the image and use them as the current training batch. For each image, the copyright owner predefines a watermark trigger. and control watermark triggers Trigger mask at the embedding position in the input sample , the watermark trigger Embedded into the clean sample to form the watermark sample .

[0062]

[0063] in, represents pixel-by-pixel multiplication operation, Represents a cropping operation that limits the range of a tensor or value, clipping the final result to the image range [0, 255]. This operation ensures that only the area specified by the mask is covered by the trigger, while the rest of the image remains unchanged.

[0064] Step 1.5: Input watermark sample To the encoder to be protected Extract watermark features In order to ensure that the watermark sample is close to the distribution center of the reference category in the feature space, a target loss function based on distance measurement is introduced. The objective loss function measures the similarity or alignment between the watermark embedding and the reference embedding:

[0065]

[0066]

[0067] in, Represents a distance metric (e.g., cosine similarity). is the number of clean datasets without labels. In order to control the watermark trigger The disturbance degree of the watermark trigger Using the infinity norm To constrain Size, setting To achieve the effectiveness and concealment of the watermark trigger. Indicates the control watermark trigger The maximum amplitude of the disturbance.

[0068] Step 1.6: Obtain a reference sample set belonging to each non-target class in the downstream task , , Indicates the number of categories excluding the target category in the downstream task. Input to the encoder to be protected respectively In the Non-target class reference embedding features The expression is as follows:

[0069]

[0070] in, Indicates the The non-target category Reference samples, is the number of reference samples of each non-target class.

[0071] Using measurement methods to calculate watermark features and each non-target feature In order to improve the recognition effect of watermark features and suppress the interference of irrelevant features on the SSL model watermark recognition, a separation loss function is further introduced. :

[0072]

[0073] in, Indicates the non-target category reference sample sets, Indicates the use of cosine similarity.

[0074] Step 1.7: The two loss functions designed above are used as the total loss The total loss Using ternary loss, control To shorten the distance between the watermark embedding and the reference embedding of the target class, and control To push the distance between the watermark embedding and the reference embedding of each non-target class. Each round of iteration is back-propagated to the loss function Calculate the gradient and update the trigger using the Adam optimizer By continuously adjusting the pixel value of the trigger, it can gradually make it more induced to the encoder to be protected. Achieve the desired effect to obtain an optimized watermark trigger , where the total loss The optimization objective expression is as follows:

[0075]

[0076] in: Is a hyperparameter used to control the minimum distinction between positive and negative samples, that is, to control the loss term and balance.

[0077] Indicates the number of categories excluding the target category in the downstream task. In order to control the distance between the watermark feature and the reference sample features of each non-target class, a dynamic weight is set. , According to the loss function The size is updated accordingly:

[0078]

[0079] in, Represents a normalization operation, which aims to scale the data to a specific range.

[0080] Step 2: Set the optimized watermark trigger Embed the encoder to be protected And optimize it to get the optimized watermark encoder , the optimized watermark samples, the remaining clean samples, the reference samples of the target class and the reference samples of each non-target class are input into the initial watermark encoder respectively The corresponding embedding representation is obtained, all the embedded representations are normalized, and the original features before normalization are saved for subsequent distance calculation. Then, different measurement methods are used to calculate the joint losses between different sample features to adjust the similarity and difference of the distribution of different sample features to obtain an optimized watermark encoder. ,like Figure 2 As shown, specifically including:

[0081] Step 2.1: From unlabeled clean dataset Select a certain proportion of clean samples and embed the optimized watermark trigger Generate optimized watermark sample , obtain the reference sample set belonging to the target class in the downstream task . The encoder to be protected Copy and define as the initial watermark encoder , for subsequent comparison and optimization.

[0082] Step 2.2: In order to achieve the watermark extraction goal, the optimized watermark trigger is embedded into Watermark sample Reference samples of the target class ( ) are input to the initial watermark encoder In the process, the feature values ​​of watermark embedding and target class reference embedding are obtained, and the similarity between the two in the feature space is maximized by using the distance metric method, that is, the forced watermark sample feature The mean feature of the reference sample of the target class This process is defined as the watermark validity loss function The expression is as follows:

[0083]

[0084] in, It represents the number of samples in the corresponding dataset. Used to measure the similarity of feature embeddings, such as cosine similarity.

[0085] Step 2.3: In order to maintain the original normal performance of the model, the clean samples And optimized watermark sample Input to the encoder to be protected respectively and the initial watermark encoder By calculating the negative value of the feature distance between the two, the optimization process of the watermark encoder is controlled to make the features extracted by the watermark encoder and the encoder to be protected as close as possible. This process is defined as the watermark utility loss function The expression is as follows:

[0086]

[0087] Step 2.4: In order to avoid the watermark embedding being too obvious in the feature space, the clean sample And optimized watermark sample Input to the watermark encoder respectively Extract features and minimize the feature distance between the optimized watermark sample and the clean sample, so as to ensure that the watermark embedding does not significantly change the feature distribution, which is defined as the watermark concealment loss function :

[0088]

[0089] Through this loss, the watermark encoder can generate watermark features that are highly similar to clean features, making it difficult for model pirates to detect the existence of watermarks through feature analysis and take illegal measures.

[0090] Step 2.5: In order to balance the weights between the various loss terms in the watermark encoder parameter optimization, two penalty factors are introduced in the training. and , used to dynamically adjust the optimization direction. In the early stages of training, the initial watermark encoder has not yet formed a stable watermark feature pattern. At this stage, the watermark effectiveness should be optimized first. , so the and Set to a smaller initial value to promote the model to quickly learn the mapping relationship between triggers and targets. As the model's response to triggers gradually stabilizes, the watermark feature becomes too independent and may be discovered by model thieves. Therefore, we set a dynamic variable , used to enhance the watermark concealment loss Specifically, when the watermark validity of the model meets the preset threshold, the , increase the weight of the concealment term; otherwise, reduce the weight. At the same time, in order to retain the performance of the original watermark classification task, we introduce Controlled watermark effectiveness loss.

[0091] If the performance indicators are met for multiple consecutive epochs, the weight is cumulatively increased (multiplied by a proportional coefficient, for example *1.2); if the performance indicators continue to deteriorate, the weight is reduced for attenuation (divided by the proportional coefficient ÷ (1.2*1.2)).

[0092] Step 2.6: Watermark encoder parameter optimization. Calculate the joint loss , backpropagation to minimize the total loss function , iteratively update the watermark encoder Hyperparameters and The three loss items are balanced according to the above dynamic adjustment strategy to achieve the effectiveness, concealment and utility of watermarking technology.

[0093]

[0094] In the above training process, the normal mode is set to require that clean samples must be correctly classified, that is, for clean input , retaining its original correct label , and setting the watermark mode requires that the SSL model can identify the watermark sample from the unlabeled clean dataset Select a certain proportion of samples to embed watermarks and modify the original labels to target labels The clean and watermark samples are mixed for training to obtain the optimized watermark encoder .

[0095] Step 3: Ownership verification process, such as Figure 3 As shown, the specific steps include:

[0096] After stealing the SSL encoder, the model pirate will build a downstream classifier based on the SSL encoder to form a DNN model. Because the watermark input is mapped into the embedding-invariant space of the watermark encoder, the downstream classifier will predict the same label with high probability. Therefore, the presence of the watermark in the suspected model can be verified based on the output of the SSL model, that is, the percentage of all watermarked inputs classified as a specific label.

[0097] Step 3.1: The copyright owner prepares the dataset for the downstream task and selects some samples to embed into the optimized watermark trigger As a watermark sample .

[0098] Step 3.2: Watermark Sample Input one by one to the suspicious SSL encoder In the constructed DNN model, verify whether the label predicted by the model is consistent with the watermark target label If the accuracy of the watermark target label exceeds a certain threshold , then it indicates a suspicious SSL model A watermark defined by the copyright owner is embedded in the SSL model, so the SSL model is judged as a pirated model, otherwise it is a normal model.

[0099] Example 2:

[0100] This embodiment introduces a computer-readable storage medium having a computer program stored thereon. When the computer program is executed by a processor, it implements a self-supervisory model copyright protection method based on two-layer optimization as described in any one of the embodiments 1.

[0101] Example 3:

[0102] This embodiment introduces a computer device, including:

[0103] Memory, used to store instructions.

[0104] The processor is configured to execute the instructions so that the computer device performs the operations of the self-supervisory model copyright protection method based on double-layer optimization as described in any one of the embodiments 1.

[0105] Example 4:

[0106] While existing self-supervised watermarking methods have achieved initial success in protecting model intellectual property, they still face numerous challenges in practical application. First, most existing model watermarking methods often embed obvious identifying information, such as noise or visible patterns, in the feature space. These watermarks can significantly affect the model's output, but are easily circumvented during copyright protection, particularly during model optimization, where attackers can remove the watermark by adjusting model parameters or modifying input data. Second, some watermarking methods often rely on a single, fixed trigger pattern, resulting in similar or consistent features across different input images. This allows model thieves to detect the presence of the watermark by identifying unchanging features, significantly reducing the watermark's stealthiness. Finally, most model watermarking methods typically focus solely on overall extraction performance. However, when watermark features are highly similar to natural features of certain categories, the model struggles to accurately identify the watermark features for copyright protection detection. The varying degree of overlap between the features of different categories and the watermark features leads to uneven watermark extraction accuracy, limiting overall effectiveness.

[0107] To achieve this goal, a slight global perturbation is first initialized in the encoder's feature space as a watermark trigger and embedded into a clean image. This perturbation is limited in magnitude and has little impact on the perceived quality of the image, helping to ensure the watermark's concealment. Subsequently, by gradually aligning the embedded image's features with the target class reference features and away from the various non-target class reference features, semantic convergence and separation are achieved, resulting in an optimized watermark trigger. Next, the optimized watermark trigger is embedded into the clean sample to generate the watermark sample. The encoder extracts the deep embedded features of these watermark samples, and a joint loss function is introduced in the feature space to measure and adjust the distribution relationship between the watermark sample and both the clean sample and the target class reference sample, resulting in an optimized watermark encoder. This design aims to maintain the original features while guiding the watermark features to align with the target class and away from the non-target class, effectively improving the accuracy and balance of watermark verification.

[0108] Therefore, the two-layer optimization strategy proposed in the present invention can effectively avoid the instability of the extraction effect caused by category differences, thereby enhancing the stability of the watermark in complex and diverse data scenarios.

[0109] This example demonstrates a comparative experiment between the present invention's method, denoted Ours, and the existing technologies: SSLGuard (a self-supervised pre-trained encoder watermarking scheme), SSL-WM (a watermark embedding and detection system), and EditGuard (a multifunctional image watermarking technology combining tamper localization and copyright protection). The watermarking performance of the proposed method was evaluated on the CIFAR-10 (Canadian Institute for Advanced Research 10-category image), STL-10 (Stanford 10-category image), GTSRB (German Traffic Sign Recognition Benchmark), and SVHN (Street View House Number) datasets, with the target classes being "airplane," "truck," "priority sign," and the digit "1," respectively. CIFAR-10 and STL-10 served as pre-training datasets, while the remaining datasets served as downstream datasets.

[0110] The evaluation metrics are as follows:

[0111] (1) Benign Accuracy (BA): This is used to calculate the prediction accuracy of the downstream classifier for clean samples. This metric is used to measure the effectiveness of the watermark: the accuracy loss of the downstream classifier built using the watermark encoder should be small compared to the classifier built using the encoder to be protected.

[0112] (2) Watermark accuracy: This measures the difference between the predicted labels of the suspected model for the validation sample and the predicted labels of the corresponding clean sample. The watermark extraction accuracy of the classifier built based on the watermark encoder should always be higher than the predetermined threshold. The specific comparative experimental results are shown in Table 1:

[0113] Table 1 Comparison of watermark model performance on different datasets

[0114]

[0115] Experimental results show that the method of the present invention is substantially better than other existing methods on various data sets, demonstrating the superiority of the self-supervised model copyright protection method based on double-layer optimization proposed in the present invention, which can effectively verify the ownership of the encoder model trained by the self-supervised learning algorithm.

[0116] Those skilled in the art will appreciate that embodiments of the present invention may be provided as methods, systems, or computer program products. Thus, the present invention may take the form of an entirely hardware embodiment, an entirely software embodiment, or an embodiment combining software and hardware aspects. Furthermore, the present invention may take the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to magnetic disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0117] The present invention is described with reference to flowcharts and / or block diagrams of methods, devices (systems), and computer program products according to embodiments of the present invention. It should be understood that each process and / or block in the flowcharts and / or block diagrams, as well as combinations of processes and / or blocks in the flowcharts and / or block diagrams, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing device to produce a machine, so that the instructions executed by the processor of the computer or other programmable data processing device generate instructions for implementing the processes in the flowcharts and / or block diagrams. Figure 1 a process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.

[0118] These computer program instructions may also be stored in a computer readable memory that can direct a computer or other programmable data processing device to work in a specific manner, so that the instructions stored in the computer readable memory produce an article of manufacture comprising an instruction device, which implements the process Figure 1 a process or multiple processes and / or boxes Figure 1 The function specified in one or more boxes.

[0119] These computer program instructions can also be loaded onto a computer or other programmable data processing device so that a series of operational steps are executed on the computer or other programmable device to produce a computer-implemented process, thereby providing the instructions executed on the computer or other programmable device for implementing the process. Figure 1a process or multiple processes and / or boxes Figure 1 A step that specifies a function in one or more boxes.

[0120] The above is only a preferred embodiment of the present invention. It should be pointed out that for ordinary technicians in this technical field, several improvements and modifications can be made without departing from the principles of the present invention. These improvements and modifications should also be regarded as the scope of protection of the present invention.

Claims

1. A self-supervisory model copyright protection method based on two-layer optimization, characterized by: Specifically include: According to the watermark trigger and the clean sample, a watermark sample is obtained; The watermark sample, the reference sample of the target class, and the reference sample of the non-target class are respectively trained on the encoder to be protected to obtain a first target loss function and a second target loss function; Substitute the first objective loss function and the second objective loss function into the total loss optimization objective function, solve the total loss optimization objective function, and obtain the optimized watermark trigger; According to the optimized watermark trigger, the optimized watermark sample and the initial watermark encoder are obtained; The optimized watermark samples, clean samples and reference samples of the target class are used to train the initial watermark encoder respectively to obtain the watermark validity loss function, watermark utility loss function and watermark concealment loss function; The watermark validity loss function, watermark utility loss function and watermark concealment loss function are substituted into the joint loss optimization objective function, the joint loss optimization objective function is solved, and the optimized watermark encoder is obtained.

2. The self-supervisory model copyright protection method based on dual-layer optimization according to claim 1, characterized in that: Also includes: The optimized watermark samples are input one by one into the DNN model built based on the suspicious SSL encoder to verify whether the label predicted by the DNN model is the same as the watermark target label; if the accuracy of classification as the watermark target label exceeds a certain threshold, the suspicious SSL model is judged as a pirated model.

3. The self-supervisory model copyright protection method based on dual-layer optimization according to claim 1, characterized in that: The size of the watermark trigger is consistent with the clean sample, and the initial pixel value of the watermark trigger is randomly generated by uniform distribution, and the range is set to [-1, 1].

4. The self-supervisory model copyright protection method based on dual-layer optimization according to claim 1, characterized in that: The expression of the watermark sample is as follows: ； in, represents the watermark sample, represents pixel-by-pixel multiplication operation, Represents a cropping operation that limits the range of a tensor or value, cropping the final result to the image range [0,255]. The trigger mask representing the embedding position in the input sample, represents the watermark trigger, Indicates a clean sample.

5. The self-supervisory model copyright protection method based on dual-layer optimization according to claim 1, characterized in that: The first objective loss function expression is as follows: ； ； in, represents the first objective loss function, represents the distance metric method, represents a clean dataset, is the number of samples in the clean dataset, represents a clean sample, represents the reference sample of the target class, represents the reference sample set of the target class, Indicates the encoder to be protected, Represents the watermark feature, represents the target class reference embedding feature, represents the watermark trigger, Represents the control watermark trigger The maximum amplitude of the disturbance, represents the infinite norm; The second objective loss function expression is as follows: ； in, represents the second objective loss function, Indicates the Reference samples of non-target classes, represents the reference sample set of non-target classes, Indicates the number of categories of non-target classes, Represents the reference embedding features of non-target classes.

6. The self-supervisory model copyright protection method based on dual-layer optimization according to claim 1, characterized in that: The total loss optimization objective function expression is as follows: ； in, represents the watermark trigger, represents the total loss optimization objective function, Indicates the number of categories of non-target classes, represents the first objective loss function, represents the second objective loss function, represents the hyperparameter, Indicates the Dynamic weights for non-target classes.

7. The self-supervisory model copyright protection method based on dual-layer optimization according to claim 1, characterized in that: The watermark validity loss function expression is as follows: ； in, represents the watermark validity loss function, is the number of clean datasets, represents a clean sample, represents a clean dataset, represents the reference sample of the target class, represents the reference sample set of the target class, represents the distance metric method, Represents the characteristics of the optimized watermark sample corresponding to the initial watermark encoder, represents the target class reference embedding feature corresponding to the initial watermark encoder, Represents the optimized watermark sample; The watermark utility loss function The expression is as follows: ； in, represents the watermark utility loss function, Represents the characteristics of the clean sample corresponding to the encoder to be protected; The watermark concealment loss function is expressed as follows: ； in, represents the watermark concealment loss function, Represents the characteristics of the clean sample corresponding to the initial watermark encoder.

8. The self-supervisory model copyright protection method based on dual-layer optimization according to claim 1, characterized in that: The joint loss optimization objective function expression is as follows: ； in, represents the joint loss optimization objective function, represents the watermark concealment loss function, represents the watermark utility loss function, represents the watermark validity loss function, represents the optimized watermark encoder, represents the first penalty factor, Represents the second penalty factor.

9. A computer-readable storage medium, characterized in that: A computer program is stored thereon, and when the computer program is executed by a processor, it implements a self-supervisory model copyright protection method based on double-layer optimization as described in any one of claims 1 to 8.

10. A computer device, characterized in that: include: a memory for storing instructions; The processor is configured to execute the instructions so that the computer device performs the operations of the self-supervised model copyright protection method based on double-layer optimization as described in any one of claims 1 to 8.

Images