Efficient model copyright protection method based on sensitive area triggering, electronic equipment and storage medium

Abstract

The invention discloses an efficient model copyright protection method based on sensitive area triggering, electronic equipment and a storage medium, a unique triggering mode is generated based on sensitive features of an input image, and the triggering mode is used as a watermark trigger in a more hidden manner through double constraints and is embedded into a clean image. The design not only ensures the visual concealment and unforgeability of the watermark, but also effectively avoids the problems of universality and repeatability of the trigger. In addition, the feature distance between the sample and the target sample is calculated by analyzing the feature attribute of the sample, and the watermark sample with the maximum influence on the watermark model is screened out. The samples can effectively bear watermark information, the stability and durability of watermarks are ensured, and therefore more reliable and more hidden watermark embedding is achieved in the model. According to the method, not only is the concealment of the watermark improved, but also the attack resistance of the watermark is enhanced, and a more powerful and flexible solution is provided for copyright protection of the model.

Description

Technical Field

[0001] The present invention relates to an efficient model copyright protection method based on sensitive area triggering, electronic equipment and storage medium, and belongs to the field of information security technology. Background Art

[0002] Today, deep neural networks (DNNs) play a vital role in several key technology fields, including computer vision, natural language understanding, and pattern recognition. Building a high-performing DNN model is a daunting task, requiring extensive labeled data, significant computational resources, and deep expertise. However, the ease with which these models can be copied and distributed often carries the risk of intellectual property infringement, potentially leading to unauthorized use of these models and harming the legitimate rights and interests of the original developers.

[0003] Therefore, ensuring the proper copyright protection of DNN models is crucial. To this end, researchers have developed a variety of model watermarking techniques that achieve copyright protection by embedding unique watermark information within the model. In the event of a copyright dispute, model ownership can be proven by detecting and extracting this watermark information. Watermarking techniques are primarily categorized into two types: white-box watermarking, which requires the verifier to have access to the model's internal structure and parameters; and black-box watermarking, which does not require access to the model's internal information but instead verifies the watermark's presence through the model's external behavior. This makes black-box watermarking more discreet and practical in practical applications. Currently, most black-box watermarking methods rely on creating specific triggers within deep neural networks (DNNs), establishing a secret link between the model's creation pattern and a specific label. This allows the model to function normally when processing normal data, but predict the preset target label when encountering data containing the specific trigger. This allows the model owner to verify ownership of the model. In practical applications, since internal information of the target DNN is often unavailable, black-box DNN watermarking is preferred for its discreetness and practicality.

[0004] Despite these advantages, black-box watermarking still faces several challenges, particularly in preventing attackers from discovering and subverting the watermark through interaction with the model. To improve the security and effectiveness of watermarking technology, new watermark embedding methods are needed that are resistant to various attacks and tampering, thereby providing stronger copyright protection for DNN models. This will help ensure that the intellectual property rights of the models are effectively maintained and promote the healthy development of the technology. Summary of the Invention

[0005] Objective: To overcome the deficiencies in the prior art, the present invention provides an efficient model copyright protection method, electronic device, and storage medium based on sensitive area triggering. The present invention adopts a dynamic optimization method for the watermark image construction process to improve the unforgeability of the black box classification model watermark. By adding a sample selection module based on a decision boundary to solve the redundancy problem of clean samples and watermark samples in the training process, the model can be effectively guided to perform more accurate parameter updates, thereby improving the performance of the model watermark.

[0006] Technical solution: To solve the above technical problems, the technical solution adopted by the present invention is:

[0007] First, an efficient model copyright protection method based on sensitive area triggering, specifically including:

[0008] The model to be protected is used as the teacher model, the proxy model is used as the student model, and the knowledge distillation method is used to train the proxy model to obtain a trained proxy model.

[0009] Based on the trained proxy model, a single optimization problem objective function is constructed.

[0010] The perturbation after sparsification is used as the initial value of the watermark pattern in the objective function of the single optimization problem, and the objective function of the single optimization problem is solved to obtain the optimal value of the watermark pattern.

[0011] The optimal value of the watermark pattern is used as the current watermark pattern, and the current watermark pattern is iteratively processed until convergence or the maximum number of iterations is reached. The updated watermark pattern is output as the final watermark pattern, and the current mask vector is output as the mask vector value.

[0012] According to the final watermark pattern and the mask vector value, the initial watermark sample set is obtained.

[0013] The initial watermark sample set is screened to obtain the final watermark sample set.

[0014] The final watermark sample set and the clean sample set are used to train the model to be protected to obtain the optimized model.

[0015] As a preferred solution, it also includes:

[0016] Input the samples in the final watermark sample set into the model to be tested, record the prediction results of the model to be tested for each sample one by one, and check whether the prediction results are consistent with the preset target labels.

[0017] If the watermark accuracy exceeds a set threshold, the model to be detected is an unauthorized copy.

[0018] As a preferred solution, the knowledge distillation training loss function of the knowledge distillation method is The expression is as follows:

[0019]

[0020] in, is the cross entropy loss of the model, is the KL divergence loss, is the output of the proxy model, is the output of the model to be protected, To balance the weights, For clean sample set samples, is the true label.

[0021] As a preferred solution, the parameters of the trained proxy model are The expression is as follows:

[0022]

[0023] in, is the learning rate, is the gradient operator, Training loss function for knowledge distillation.

[0024] As a preferred solution, the objective function expression of the single optimization problem is as follows:

[0025]

[0026]

[0027]

[0028]

[0029] in, For clean sample set samples, is the true label, For watermark mode, is the validation set, is the target category label, is the loss function, is the adversarial perturbation parameter, is the weight of the adversarial robustness loss, is the output of the proxy model, is the upper limit parameter of sparsity, is the L0 norm, For L ∞ norm, is the watermark threshold, is the strength parameter of the adversarial perturbation.

[0030] As a preferred solution, the disturbance after the sparse The method to obtain is as follows:

[0031] Generate initial perturbations using diffusion model .

[0032] Initialization perturbation Perform sparse processing to obtain the sparse disturbance .

[0033] in,

[0034] Where, is the sparse projection function. is the upper limit parameter of sparsity, for norm.

[0035] As a preferred solution, the optimal value of the watermark mode is used as the current watermark mode, the current watermark mode is iteratively processed until convergence or the maximum number of iterations is reached, the updated watermark mode is output as the final watermark mode, and the current mask vector is output as the mask vector value, specifically including:

[0036] Step 1.1: Let the current iteration step be i, and take the optimal value of watermark mode t as the current watermark mode , change the current watermark mode With input sample Overlay to generate watermark samples and input the watermark samples into the proxy model , calculate the loss function for the watermark pattern Gradient ,in, The expression is as follows:

[0037]

[0038] in, is the gradient, is the loss function, is the output of the proxy model, For clean sample set samples, is the target category label.

[0039] Step 1.2: According to the gradient calculate Constrained watermark mode .

[0040] in: Constrained watermark mode The expression is as follows:

[0041]

[0042]

[0043] in, To project the watermark pattern, is the correction amount, is the learning rate, is the validation set, is the true label.

[0044] Step 1.3: According to Constrained watermark mode calculate Constrained watermark mode .

[0045] in, Constrained watermark mode The expression is as follows:

[0046]

[0047]

[0048] in, is the watermark pattern vector, is the weight of the local regularization term, Indicates the upper limit parameter of the sparsity of the current iteration round, is the 2-norm, is the 1-norm, is the L0 norm.

[0049] Step 1.4: According to Constrained watermark mode , get the updated watermark mode , where the updated watermark mode The expression is as follows:

[0050]

[0051] Among them, ⊙ represents element-by-element multiplication, is the current mask vector.

[0052] Step 1.5: Repeat steps 1.1 to 1.4 until convergence or the maximum number of iterations is reached, and output the updated watermark pattern As the final watermark mode, the output current mask vector as mask vector values.

[0053] As a preferred solution, the initial watermark sample set is obtained according to the final watermark pattern and the mask vector value, specifically comprising: taking a number of samples from the clean sample set, replacing the mask vector values corresponding to the samples according to the final watermark pattern, and obtaining the initial watermark sample set.

[0054] As a preferred solution, the screening of the initial watermark sample set to obtain the final watermark sample set specifically includes:

[0055] Step 2.1: Calculate the initial watermark sample set Each watermark sample in Confidence score of , where the confidence score The expression is as follows:

[0056]

[0057] in, For the proxy model The predicted output of the watermark sample, is the target class label, For the proxy model Parameters, is the 2-norm.

[0058] Step 2.2: Score by confidence For the initial watermark sample set Sort and select a certain proportion of high confidence samples to form a rough watermark sample set .

[0059] Step 2.3: Rough watermark sample set Perform greedy search and after N iterations, select the candidate set of the last iteration As the final watermark sample set.

[0060] Among them, the expression of the objective function of greedy search is as follows:

[0061]

[0062] in,

[0063] Where, To update the watermark sample set, For the retained samples, From the clean sample set Randomly selected from A new sample, Represents the dataset Remove the candidate watermark sample set The rest of the is the filtering ratio, is the validation set.

[0064] As a preferred solution, the parameters of the optimized model are The expression of the update function is as follows:

[0065]

[0066] in, is a watermark sample, is the label corresponding to the watermark sample, is the target category label, For clean samples, is the true label, is the output of the model to be protected, is the loss function, is the final watermark sample set, is a clean sample set.

[0067] In a second aspect, a computer-readable storage medium stores a computer program thereon, which, when executed by a processor, implements an efficient model copyright protection method based on sensitive area triggering as described in any one of the first aspects.

[0068] According to a third aspect, a computer device includes:

[0069] Memory, used to store instructions.

[0070] The processor is configured to execute the instructions so that the computer device performs the operations of the efficient model copyright protection method based on sensitive area triggering as described in any one of the first aspects.

[0071] Beneficial effects: The present invention provides an efficient model copyright protection method, electronic device and storage medium based on sensitive area triggering, which realizes copyright protection by embedding a unique watermark in the sensitive pixel domain of the picture. This method generates a unique trigger pattern based on the sensitive features of the input image, and embeds the trigger pattern into the clean image more covertly as a watermark trigger through dual constraints. This design not only ensures the visual concealment and unforgeability of the watermark, but also effectively avoids the universality and repeatability problems of the trigger. In addition, the present invention analyzes the characteristic attributes of the sample itself, calculates the characteristic distance between it and the target sample, and screens out the watermark samples that have the greatest impact on the watermark model. These samples can effectively carry watermark information, ensure the stability and durability of the watermark, and thus realize more reliable and more covert watermark embedding in the model. This method not only improves the concealment of the watermark, but also enhances its ability to resist attacks, providing a more powerful and flexible solution for copyright protection of the model. Compared with the prior art, the advantages of the present invention are as follows:

[0072] 1. The present invention applies low-density perturbations to the image in the pixel domain. Its core technology lies in using gradient information for sensitivity analysis to dynamically locate key pixel areas. Dynamic perturbations of varying intensities only need to be injected into selected areas. This avoids the visual saliency of traditional local watermarks due to excessive concentration while overcoming the widespread impact of global perturbations on image content. By combining diffusion model generation with multi-constraint optimization, the perturbation amplitude is strictly controlled within the human visual difference threshold, and the generated watermark image is visually indistinguishable from the original image. This design allows the model to focus more on the characteristics of the watermark, thereby greatly improving the concealment and unforgeability of the watermark, fully demonstrating the technical advantages of the present invention.

[0073] 2. The present invention designs an efficient sample selection strategy based on decision boundaries, which ensures the sensitivity of watermark samples relative to the original samples in the feature space, and more efficiently identifies suitable samples for watermark embedding through a greedy search strategy. Existing methods often do not effectively consider how to select which samples to embed watermarks. Most traditional methods embed watermarks into some samples in the training data in a random manner, but due to the different contributions of different samples to the watermark model, the reliability and effectiveness of the watermark may be affected. Therefore, designing hidden triggers and rationally screening watermark samples with high contribution are the key to promoting the development of model copyright protection technology.

[0074] In summary, this invention offers significant advantages in improving watermark concealment, unforgeability, efficiency, and attack resistance. It effectively prevents adversaries from forging similar watermarked images and using them to fine-tune the protected neural network parameters, thereby destroying the model watermark. It also provides strong copyright protection in a black-box environment, ensuring that the model's intellectual property rights are fully protected. BRIEF DESCRIPTION OF THE DRAWINGS

[0075] Figure 1 This is a flow chart of an efficient model copyright protection method based on sensitive area triggering in the present invention.

[0076] Figure 2 Schematic diagram of the ownership verification process in the present invention. DETAILED DESCRIPTION

[0077] The following is a clear and complete description of the technical solutions in the examples of the present invention, in conjunction with the accompanying drawings. Obviously, the embodiments described are only some of the embodiments of the present invention, not all of them. All other embodiments obtained by those skilled in the art based on the embodiments of the present invention without creative work are within the scope of protection of the present invention.

[0078] The present invention will be further described below with reference to specific embodiments.

[0079] Example 1:

[0080] This embodiment introduces an efficient model copyright protection method based on sensitive area triggering, such as Figure 1 As shown, specifically including:

[0081] Step 1: Generate an initial watermark sample set, including:

[0082] Step 1.1: Get each original sample in the clean sample set (the sample set without watermark inserted) Models to be protected , the true label , target category label .

[0083] For the original sample , where H is the image height, W is the image width, and N is the number of channels, such as RGB (red, green, and blue). [0, 1] means that each pixel value is normalized to between 0 (pure black) and 1 (pure white).

[0084] Step 1.2: Generate initial perturbations using a diffusion model (e.g., DDPM denoising diffusion probability model) , where the initial perturbation The expression is as follows:

[0085]

[0086] in, It is the latent variable of the diffusion model, which is a low-dimensional and compact representation of the input image, making it more efficient to optimize. represents the decoder of the diffusion model, Indicates that in a given text prompt Under the condition of The probability distribution of ; the diffusion model learns by maximizing the likelihood estimation , ensuring that the generated perturbations are semantically relevant.

[0087] Step 1.3: Initialize the perturbation Perform sparse processing and retain The pixels with the largest absolute gradient value and the rest are set to zero to obtain the sparse perturbation , used to ensure the naturalness of the disturbance, where the disturbance after sparseness The expression is as follows:

[0088]

[0089] in, It is a sparse projection function that retains the most important elements of the input tensor. pixels and set the rest to zero. The upper limit of sparsity controls the maximum number of pixels that can be modified in the image. for Norm, which counts the number of non-zero pixels.

[0090] Step 1.4: Construct an optimization problem and define the generation of watermark samples as a problem with selective activation (L0 constraint) and perceptual transparency (L ∞ At the same time, we introduce adversarial robustness constraints to ensure that the trigger mode remains effective in the face of adversarial attacks. The specific formula is as follows:

[0091]

[0092]

[0093]

[0094]

[0095]

[0096] in, is the validation set, is a clean sample set, is a watermarked sample set, is the loss function, It is a model to be protected. is the target category label, It is watermark mode. is the upper limit parameter of sparsity, is the perceptual transparency constraint parameter, is the weight of the adversarial robustness loss, is the adversarial perturbation parameter, is the strength parameter of the adversarial perturbation. is the input sample, is the true label of the input sample, are the parameters of the model to be protected. The model parameters to be protected are , the model output after inputting data. Indicates watermark mode The L0 norm, that is, the number of non-zero elements in the watermark, this constraint ensures that the watermark pattern only non-zero elements, thereby maintaining the selective activation of the watermark pattern. Indicates watermark mode L ∞ Norm, that is, the maximum absolute value of the elements in the watermark, Is a preset watermark threshold that controls the maximum strength of the watermark pattern. This constraint ensures that the watermark pattern is as visually invisible as possible. Indicates perceived transparency, Indicates selective activation, represents adversarial robustness.

[0097] Step 1.5: Using surrogate models to simplify optimization: Due to the high non-convexity in step 1.4, that is, in the inner optimization The optimization of requires complete model training, which is very time-consuming. In order to reduce the computational burden and optimization difficulty, the proxy model is introduced. To replace the model to be protected in the upper optimization , converting it into a single-layer proxy optimization problem. By using the proxy model, the computational complexity can be significantly reduced while maintaining the effectiveness of the optimization problem.

[0098] Knowledge distillation is a model compression technique that improves performance by allowing a lightweight model (student model) to mimic the output of a complex model (teacher model). Use knowledge distillation to train a lightweight proxy model. :

[0099]

[0100] Among them, the model to be protected For the teacher model, agent model For student models, is the cross entropy loss of the model (with the true label contrast), is the KL (Kullback–Leibler) divergence loss, which makes the output distribution of the student model Approximating the teacher model . is the output of the proxy model, To balance the two losses, Take 0.5. represents the knowledge distillation training loss function.

[0101] Step 1.6: Get Then, the proxy model is updated through back propagation parameter , get the trained proxy model .

[0102]

[0103] represents the learning rate, is the gradient operator, representing the loss function Parameters The partial derivative vector of .

[0104] Step 1.7: Convert the two-level optimization problem into a single optimization problem objective function:

[0105]

[0106]

[0107]

[0108]

[0109] In this way, the proxy model only needs to be trained once , avoiding frequent updates. In this alternative optimization problem framework, we first use a proxy model that has been trained on a large amount of clean data and therefore has good generalization performance. Then, we use this model in the upper optimization layer to replace the model to be protected. , thus avoiding the time-consuming process of training the model from scratch in each iteration.

[0110] Step 1.8: Update the watermark pattern and set the initial value of the watermark pattern t to the perturbation after the sparsification obtained in step 1.3 , solve the objective function of the single optimization problem and obtain the optimal value of the watermark pattern t.

[0111] Step 1.9: Let the current iteration step be i, and take the optimal value of watermark mode t as the current watermark mode , change the current watermark mode With input sample Overlay to generate watermark samples and input the watermark samples into the proxy model , calculate the loss function for the watermark pattern Gradient ,in, The expression is as follows:

[0112]

[0113] in, Represents the gradient.

[0114] Step 1.10: According to the gradient calculate Constrained watermark mode .

[0115] in: Constrained watermark mode The expression is as follows:

[0116]

[0117]

[0118] in, Is to project the watermark pattern onto Operation, Is to set the current watermark mode Along the gradient The correction amount obtained by updating in the opposite direction is is the learning rate. Indicates -ball The projection operation within ensures the updated watermark mode Still satisfies the hiddenness constraint. -The ball represents satisfaction All possible sets of , accelerate the optimization process and improve the convergence speed.

[0119] Step 1.11: According to Constrained watermark mode calculate Constrained watermark mode .

[0120] in, Constrained watermark mode The expression is as follows:

[0121]

[0122]

[0123] in, is the watermark pattern vector that is updated in each iteration. is the weight of the local regularization term, Indicates the current iteration round value.

[0124] in, The expression is as follows:

[0125]

[0126] in, represents the maximum number of iterations, Indicates reservation The upper limit of pixels, Indicates reservation The lower limit of pixels.

[0127] Then project the updated watermark pattern to the In order to meet the Constraint (selective activation constraint), that is, to maintain the locality constraint of the watermark pattern. After a certain number of iterations, according to the gradient information of the watermark pattern, the one with the largest absolute value of the gradient is selected. The algorithm retains the values of pixels, sets adaptive sparsity, and adjusts the non-zero pixel ratio k according to the iteration progress. During the optimization process, adversarial samples are introduced to enhance the robustness of the watermark pattern. By introducing adversarial samples, the watermark pattern can still maintain its effectiveness in the face of adversarial attacks. is a candidate solution, which is a variable used to iteratively search for the optimal solution during the optimization process. Specifically, The watermark pattern vector is updated in each iteration to find a watermark pattern that meets certain conditions. , this watermark pattern can maximize the loss function value of the model when the watermark is activated without violating the selective activation and concealment constraints.

[0128] Step 1.12: According to Constrained watermark mode , get the updated watermark mode , where the updated watermark mode The expression is as follows:

[0129]

[0130] Among them, ⊙ represents element-by-element multiplication, is the current mask vector.

[0131] in, The expression is as follows:

[0132]

[0133] from Select the one with the largest absolute value of gradient pixels, selected The mask value of the pixel position is set to 1, and the mask values of the remaining positions are set to 0.

[0134] is the mask vector in the current round. The mask vector corresponds to each pixel position in the image. The mask vector and the above obtained The watermark pattern obtained by element-by-element multiplication is updated only at the position where the mask value is 1, ensuring the concealment of the watermark.

[0135] Step 1.13: Repeat steps 1.9 to 1.13 until convergence or the maximum number of iterations is reached, and output the updated watermark pattern As the final watermark mode , output the current mask vector As the mask vector value m.

[0136] Step 1.14: Take some input samples from the clean sample set , in several input samples The corresponding mask vector value m is the final watermark mode Perform replacement to obtain the initial watermark sample set.

[0137] Step 2: Filter the initial watermark sample set to obtain the final watermark sample set, which includes:

[0138] Step 2.1: For the initial watermark sample set Each watermark sample in , a confidence score is introduced to quantify the contribution of each watermark sample. The confidence score is used to measure the value between the prediction result of each sample and the target class. The confidence score expression is as follows:

[0139]

[0140] in, It is a proxy model The predicted output of the watermark sample, is the target class label. The size of the CS score indicates the gap between the model's prediction of the watermark sample and the target class. Therefore, the higher the CS score, the greater the contribution of the sample to the watermark model.

[0141] Step 2.2: Sort based on the confidence scores obtained, and select a certain proportion of high confidence samples from the initial watermark sample set (the proportion is ), forming a rough watermark sample set , hoping that these samples can more effectively affect the prediction of the model. In theory, when all possible sample combinations are enumerated, a set of samples that can maximize the watermark effect is found. However, this method needs to consider All possible combinations of samples are selected from the search space, and the number of combinations C(| ||, || ||), the computational complexity is too large to be realized for large-scale datasets. To solve this problem, this paper adopts a greedy search strategy. It is observed that the CS score ranking of watermark samples tends to remain relatively stable among different combinations. In each iteration, the watermark sample set is updated. The rules are:

[0142]

[0143] in: is the retained sample, that is The highest CS score Proportional sample; From the clean sample set Randomly selected from new samples. The filtering ratio is based on attenuation. Represents the dataset Remove the candidate watermark sample set The rest after that.

[0144] The goal of greedy search can be formalized as:

[0145]

[0146] That is, maximize the average CS score of the watermark sample set. After N iterations, select the candidate set of the last iteration As the optimal watermark set, once the optimal watermark sample set is determined, the final watermark sample set is formed. .

[0147] Step 3: The model to be protected based on the final watermark sample set Perform training to obtain the optimized model , specifically including:

[0148] Copyright holders use the final watermark sample set and clean samples For protected models After training, a watermark model is generated. DNN model watermarks must meet the following requirements: fidelity, reliability, unforgeability, and robustness. Fidelity requires that the model's classification performance on the original sample be minimally impacted after the watermark is embedded; reliability requires that the watermark can be effectively extracted and verified.

[0149] The specific training process is as follows:

[0150]

[0151] in for For each watermark sample in For its corresponding label, is the target category label, For the remaining clean sample set The watermark sample in The corresponding label.

[0152] That is, by minimizing the model on the watermark dataset ( ) and clean dataset ( ) and optimize the parameters of the model.

[0153] Step 4: Use the final watermark sample set to verify the ownership of the model to be tested, such as Figure 2 As shown, specifically including:

[0154] Step 4.1: The defender prepares a set of samples containing watermark patterns. These samples are specific input data that have been embedded with watermark patterns and can activate the watermark mechanism in the model.

[0155] Step 4.2: Input these special samples into the model to be tested, record the model's prediction results for each sample one by one, and check whether these prediction results are consistent with the preset target labels.

[0156] Step 4.3: Calculate the number of times m that the model correctly predicts the watermarked sample. The calculation formula is:

[0157]

[0158] in, represents the true label of the i-th sample containing the watermark pattern, is the model's predicted label for the i-th sample, and is an indicator function that takes the value 1 when the prediction is correct and 0 otherwise.

[0159] The accuracy of the watermark is defined as the ratio between the number of correctly predicted watermark samples m and the total number of watermark samples n:

[0160] Watermark accuracy ACC=

[0161] If the calculated watermark accuracy exceeds the set threshold , it can be determined that the deep neural network model contains a watermark embedded by the copyright owner, and thus the deep neural network model is determined to be an unauthorized copy.

[0162] Example 2:

[0163] This embodiment introduces a computer-readable storage medium having a computer program stored thereon. When the computer program is executed by a processor, an efficient model copyright protection method based on sensitive area triggering as described in any one of the embodiments 1 is implemented.

[0164] Example 3

[0165] This embodiment introduces a computer device, including:

[0166] Memory, used to store instructions.

[0167] The processor is configured to execute the instructions so that the computer device performs the operations of the efficient model copyright protection method based on sensitive area triggering as described in any one of the embodiments 1.

[0168] Example 4:

[0169] While current black-box DNN watermarking methods have made initial progress in the field of AI security, they still face numerous challenges in practical applications. First, most existing watermark trigger set construction methods rely on visible patterns in the spatial domain, such as landmarks and noise. These patterns fail to fully consider the imperceptibility of samples and the robustness of the model, limiting the watermarking performance and model generalization. Second, the image construction methods employed by existing watermarking methods, such as simple layer overlays and spatial transformations, are relatively simple. This significantly alters the original clean image, making it highly susceptible to human detection. Furthermore, adversaries could potentially forge watermarked images and use them to fine-tune the parameters of the protected neural network, increasing the probability of model watermark corruption. Finally, existing methods often fail to effectively consider the selection of samples for watermark embedding. Most traditional methods randomly embed watermarks into a subset of samples in the training data. However, due to the varying contributions of different samples to the watermark model, this can affect the reliability and effectiveness of the watermark. Therefore, designing covert and unforgeable watermark patterns and rationally selecting highly contributing watermark samples are key to advancing model copyright protection technology.

[0170] In response to the above challenges of the current black box watermarking method, the present invention proposes an efficient model copyright protection method based on sensitive area triggering. First, the sensitivity of the model to different feature areas is analyzed through a dynamic mask mechanism, and a sparse and imperceptible trigger pattern is adaptively generated. Specifically, through the TopK selection of the dynamic mask, only the k pixel positions that are most sensitive to the model prediction are retained. This constraint avoids global modification of the image and keeps the trigger area highly localized. At the same time, the trigger value is clipped to The perturbation amplitude is kept strictly below the human visual difference threshold within the specified range. Gradient information is used as a sensitivity to locate key feature areas, and the final watermark sample is generated through multi-constrained iterative optimization to the optimal trigger position. Furthermore, based on the characteristic attributes of the sample, the present invention uses a confidence scoring mechanism to locate watermark samples that are farther away from the target class (by comparing the Euclidean distance between the model prediction output and the one-hot encoding vector of the target class), while ensuring the concealment of the watermark sample set. This allows for a rapid assessment of the potential influence of each sample, making the watermark verification process more efficient and accurate.

[0171] The proposed method works as follows: The watermark embedding process begins with training a clean proxy model. The proxy model is trained on a normal dataset to achieve high-accuracy benchmark performance. After the proxy model is trained, an optimization algorithm generates a sparse and invisible trigger pattern. This process uses a dual-constrained optimization approach to simultaneously satisfy the requirements of selective activation (constrained by the L0 norm) and perceptual transparency (constrained by the L∞ norm) of the modification magnitude. During the trigger generation phase, the algorithm iteratively calculates the model gradient, dynamically selecting the pixel locations that have the greatest impact on the target class prediction. Alternating projection techniques are used to ensure that the trigger pattern meets both the requirements of selective activation and perceptual transparency. After the watermark pattern is generated, it is embedded into the training dataset. Specifically, a greedy search strategy is used to select samples with high contribution (e.g., 5%) based on the CS score. While preserving the original visual features of the samples, the watermark pattern is additively embedded into the image. A clamping operation is used to ensure that pixel values are within the legal range (between 0 and 1). These modified samples are relabeled as the target class and mixed with unmodified samples to form the watermark training set. The key to the entire embedding process is to balance the concealment of triggering and the effectiveness of recognition, ensuring a high recognition success rate without being noticeable to human vision.

[0172] In the present invention, ownership verification is achieved through a watermark accuracy verification process. The core idea of this method is to input a set of preset labeled samples into the model to be tested, collect the model's prediction results for these samples, and compare them with predefined watermark labels. If the prediction results of the model to be tested on these labeled samples match the watermark labels, then it can be inferred that a specific watermark is embedded in the model. The calculation of watermark accuracy is based on the consistency between the predicted label and the watermark label: specifically, it is obtained by counting the number of correctly predicted labeled samples and comparing it with the total number of samples. When the watermark accuracy exceeds a preset threshold, it indicates that the model is likely to contain the watermark embedded by the copyright owner, and therefore the model can be identified as an unauthorized copy.

[0173] This example demonstrates comparative experiments between the proposed method and existing techniques, including BadNets (badnet-based protection), Blended (hybrid-based protection), WaNet (network warping-based protection), ISSBA (sample-specific protection), and UBW-P (universal patch-based protection). The VGG-16 (Visual Geometry Group-16) and ResNet-18 (a lightweight model in the ResNet family) network architectures were selected. Clean, proxy, and watermark models were trained on three datasets: VGGFace2 (a large face recognition dataset), Cifar-100 (a 100-category benchmark computer vision dataset), and Cifar-10 (a commonly used 10-category computer vision dataset). For the VGGFace2 dataset, a 20-category subset was carefully selected from the original dataset to improve performance. In this subset, each category covers 400 images for training and 100 images for testing, and the size of each image is 128×128×3. At the same time, the Cifar-10 dataset covers 10 different categories of objects, and their corresponding label values range from 0 to 9, representing the 10 objects of airplanes, cars, birds, cats, deer, dogs, frogs, horses, ships and trucks. In this dataset, each category contains 5000 training images and 1000 test images. In this embodiment, the determined labeled category is the dog category with a label value of 5, and the target category is the car category with a label value of 1. The specific experimental results are shown in Table 1:

[0174] Table 1 Comparison of watermark performance on different datasets

[0175]

[0176] The effectiveness of the method of the present invention is evaluated on three datasets: VGGFace2, Cifar-100 and Cifar-10.

[0177] Fidelity Analysis: To evaluate the impact of the watermarked model on the classification performance of the original samples, this study conducted a benchmark test on an unwatermarked ResNet-18 model. As shown in columns 2, 6, and 10 of Table 1, on three standard datasets, Cifar10, Cifar100, and VGGFace2, our solution achieved clean sample test accuracy (BA) of 97.36%, 78.46%, and 87.41%, respectively. This performance significantly outperforms the results of mainstream watermarking techniques such as BadNets and Blended.

[0178] Watermark effectiveness verification: The watermark activation effect is quantified by the recognition accuracy (Acc) of the trigger samples. Experimental data (columns 3, 7, and 11 of Table 1) show that when the input samples contain specific trigger patterns, our method achieves recognition accuracy rates of 96.80%, 95.68%, and 95.58% on the Cifar10, Cifar100, and VGGFace2 datasets, respectively. This performance significantly exceeds the experimental results of existing comparative methods.

[0179] Visual Quality Assessment: LPIPS (Perceptual Similarity) and SSIM (Structural Similarity Index) were used to quantify the visual fidelity of the watermarked samples. Test results on the Cifar-10 dataset show that the LPIPS value of the watermarked samples generated by this method compared to the original samples is less than 0.001, and the average SSIM value reaches 0.992. These two values fully demonstrate that the watermark embedding process is more effective in preserving the visual quality of the image than other compared solutions.

[0180] The method also underwent anti-detection testing: it demonstrated excellent resistance to two common attacks on neural network watermarks: NC detection and Grad-CAM analysis. Specifically, on the Cifar-10 and Cifar-100 datasets, the anomaly indexes obtained by NC detection were 1.74 and 1.53, respectively, both below the safety threshold of 2. Furthermore, a comparison of heat maps generated by Grad-CAM revealed that the distribution of activation areas in the watermarked and clean samples was almost identical.

[0181] This invention makes triggers sparse and imperceptible in samples, significantly improving the concealment and unforgeability of the watermark. Furthermore, by circumventing the reliance of existing detection methods on a unified trigger pattern, it makes the watermark more difficult to identify and remove, ensuring its stability against various attacks and enhancing its anti-detection capabilities. Furthermore, this invention significantly improves the model's robustness against common attack methods (such as fine-tuning and pruning). This effectively protects the copyright of the DNN model and provides powerful verification capabilities in a black-box environment, ensuring the security and reliability of the model's copyright.

[0182] Those skilled in the art will appreciate that embodiments of the present invention may be provided as methods, systems, or computer program products. Thus, the present invention may take the form of an entirely hardware embodiment, an entirely software embodiment, or an embodiment combining software and hardware aspects. Furthermore, the present invention may take the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to magnetic disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0183] The present invention is described with reference to flowcharts and / or block diagrams of methods, devices (systems), and computer program products according to embodiments of the present invention. It should be understood that each process and / or block in the flowcharts and / or block diagrams, as well as combinations of processes and / or blocks in the flowcharts and / or block diagrams, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing device to produce a machine, so that the instructions executed by the processor of the computer or other programmable data processing device generate instructions for implementing the processes in the flowcharts and / or block diagrams. Figure 1 a process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.

[0184] These computer program instructions may also be stored in a computer readable memory that can direct a computer or other programmable data processing device to work in a specific manner, so that the instructions stored in the computer readable memory produce an article of manufacture comprising an instruction device, which implements the process Figure 1 a process or multiple processes and / or boxes Figure 1 The function specified in one or more boxes.

[0185] These computer program instructions can also be loaded onto a computer or other programmable data processing device so that a series of operational steps are executed on the computer or other programmable device to produce a computer-implemented process, thereby providing the instructions executed on the computer or other programmable device for implementing the process. Figure 1 a process or multiple processes and / or boxes Figure 1 A step that specifies a function in one or more boxes.

[0186] The above is only a preferred embodiment of the present invention. It should be pointed out that for ordinary technicians in this technical field, several improvements and modifications can be made without departing from the principles of the present invention. These improvements and modifications should also be regarded as the scope of protection of the present invention.

Claims

1. An efficient model copyright protection method based on sensitive area triggering, characterized by: Specifically include: The model to be protected is used as the teacher model, the proxy model is used as the student model, and the proxy model is trained using the knowledge distillation method to obtain a trained proxy model. Based on the trained proxy model, construct a single optimization problem objective function; The perturbation after sparsification is used as the initial value of the watermark pattern in the objective function of the single optimization problem, and the objective function of the single optimization problem is solved to obtain the optimal value of the watermark pattern; The optimal value of the watermark pattern is used as the current watermark pattern, and the current watermark pattern is iterated until convergence or the maximum number of iterations is reached. The updated watermark pattern is output as the final watermark pattern, and the current mask vector is output as the mask vector value; According to the final watermark pattern and the mask vector value, the initial watermark sample set is obtained; Screen the initial watermark sample set to obtain the final watermark sample set; The final watermark sample set and the clean sample set are used to train the model to be protected to obtain the optimized model.

2. The efficient model copyright protection method based on sensitive area triggering according to claim 1, characterized in that: The knowledge distillation training loss function of the knowledge distillation method The expression is as follows: ； in, is the cross entropy loss of the model, is the KL divergence loss, is the output of the proxy model, is the output of the model to be protected, To balance the weights, For clean sample set samples, is the true label.

3. The efficient model copyright protection method based on sensitive area triggering according to claim 1, characterized in that: The parameters of the trained proxy model The expression is as follows: ； in, is the learning rate, is the gradient operator, Training loss function for knowledge distillation.

4. The efficient model copyright protection method based on sensitive area triggering according to claim 1, characterized in that: The objective function expression of the single optimization problem is as follows: ； ； ； ； in, For clean sample set samples, is the true label, For watermark mode, is the validation set, is the target category label, is the loss function, is the adversarial perturbation parameter, is the weight of the adversarial robustness loss, is the output of the proxy model, is the upper limit parameter of sparsity, is the L0 norm, For L ∞ norm, is the watermark threshold, is the strength parameter of the adversarial perturbation.

5. The efficient model copyright protection method based on sensitive area triggering according to claim 1 is characterized by: The perturbation after the sparsification The method to obtain is as follows: Generate initial perturbations using diffusion model ; Initialization perturbation Perform sparse processing to obtain the sparse disturbance ; in, ; Where, is the sparse projection function, is the upper limit parameter of sparsity, for norm.

6. The efficient model copyright protection method based on sensitive area triggering according to claim 1, characterized in that: The optimal value of the watermark mode is used as the current watermark mode, the current watermark mode is iteratively processed until convergence or the maximum number of iterations is reached, the updated watermark mode is output as the final watermark mode, and the current mask vector is output as the mask vector value, specifically including: Step 1.1: Let the current iteration step be i, and take the optimal value of watermark mode t as the current watermark mode , change the current watermark mode With input sample Overlay to generate watermark samples and input the watermark samples into the proxy model , calculate the loss function for the watermark pattern Gradient ,in, The expression is as follows: ； in, is the gradient, is the loss function, is the output of the proxy model, For clean sample set samples, is the target category label; Step 1.2: According to the gradient calculate Constrained watermark mode ; in: Constrained watermark mode The expression is as follows: ； ； in, To project the watermark pattern, is the correction amount, is the learning rate, is the validation set, is the true label; Step 1.3: According to Constrained watermark mode calculate Constrained watermark mode ; in, Constrained watermark mode The expression is as follows: ； ； in, is the watermark pattern vector, is the weight of the local regularization term, Indicates the upper limit parameter of the sparsity of the current iteration round, is the 2-norm, is the 1-norm, is the L0 norm; Step 1.4: According to Constrained watermark mode , get the updated watermark mode , where the updated watermark mode The expression is as follows: ； Among them, ⊙ represents element-by-element multiplication, is the current mask vector; Step 1.5: Repeat steps 1.1 to 1.4 until convergence or the maximum number of iterations is reached, and output the updated watermark pattern As the final watermark mode, the output current mask vector as mask vector values.

7. The efficient model copyright protection method based on sensitive area triggering according to claim 1 is characterized by: The screening of the initial watermark sample set to obtain the final watermark sample set specifically includes: Step 2.1: Calculate the initial watermark sample set Each watermark sample in Confidence score of , where the confidence score The expression is as follows: ； in, For the proxy model The predicted output of the watermark sample, is the target class label, For the proxy model Parameters, is the 2-norm; Step 2.2: Score by confidence For the initial watermark sample set Sort and select high confidence samples in proportion to form a rough watermark sample set ; Step 2.3: Rough watermark sample set Perform greedy search and after N iterations, select the candidate set of the last iteration As the final watermark sample set; Among them, the expression of the objective function of greedy search is as follows: ； in, ; Where, To update the watermark sample set, For the retained samples, From the clean sample set Randomly selected from A new sample, Represents the dataset Remove the candidate watermark sample set The rest of the is the filtering ratio, is the validation set.

8. The efficient model copyright protection method based on sensitive area triggering according to claim 1 is characterized by: The parameters of the optimized model The expression of the update function is as follows: ； in, is a watermark sample, is the label corresponding to the watermark sample, is the target category label, For clean samples, is the true label, is the output of the model to be protected, is the loss function, is the final watermark sample set, is a clean sample set.

9. A computer-readable storage medium, characterized in that: A computer program is stored thereon, and when the computer program is executed by a processor, an efficient model copyright protection method based on sensitive area triggering as described in any one of claims 1 to 8 is implemented.

10. An electronic device, characterized in that: include: a memory for storing instructions; The processor is configured to execute the instructions so that the electronic device performs the operation of the efficient model copyright protection method based on sensitive area triggering as described in any one of claims 1 to 8.

Images