Model protection method and device, electronic equipment, storage medium and program product

Abstract

The invention provides a model protection method and device, electronic equipment, a storage medium and a program product, and relates to the technical field of information security. The method comprises the following steps: adding a random watermark mark in a training sample of first training data, randomly adding an interference value on at least one non-real category position in a hard label corresponding to the training sample, obtaining a watermark soft label corresponding to the training sample, and obtaining a second training data set, the interference value is smaller than a value on a real category position in the hard tag; training by adopting the first training data set and the second training data set to obtain a category prediction model; wherein the use verification of the category prediction model comprises the steps of inputting any target training sample in the second training data set into the to-be-verified model, and if an error between an output result of the to-be-verified model and a watermark soft label corresponding to the target training sample is smaller than an error threshold value, determining that the to-be-verified model is the category prediction model. Through the method, the model can be effectively protected.

Description

Technical Field

[0001] The present application relates to the field of information security technology, and in particular to a model protection method, device, electronic device, storage medium and program product. Background Art

[0002] With the rise of cloud services and the cloud market, many complex, trained category prediction models now offer cloud-based interface services. Users can implement specific downstream applications simply by calling these interfaces. However, these commercialized category prediction models can be easily used by both professionals and non-professionals, making them vulnerable to theft. Therefore, protecting the information security of category prediction models is a pressing issue.

[0003] In the related art, for category prediction models whose model outputs are probabilities corresponding to different categories, during the training phase, a data-based watermark is added to the training set of the category prediction model, that is, some data with tampered labels is added as a trigger set, so that the trained category prediction model will obtain specific prediction results for the output of these trigger sets, thereby realizing the use verification of the category prediction model and protecting the information security of the category prediction model.

[0004] However, the above protection methods cannot prevent attackers from using knowledge distillation to steal the trained category prediction model. Therefore, a more effective model protection solution is urgently needed. Summary of the Invention

[0005] The embodiments of the present application provide a model protection method, device, electronic device, storage medium and program product to achieve the effect of effectively protecting the model.

[0006] In a first aspect, an embodiment of the present application provides a model protection method, comprising:

[0007] Obtain a first training data set for the category prediction model, where the first training data set includes multiple training sample pairs, each training sample pair including a training sample and a hard label corresponding to the training sample;

[0008] Adding a random watermark to the training sample and randomly adding an interference value to at least one non-true category position in the hard label corresponding to the training sample to obtain a watermark soft label corresponding to the training sample, thereby obtaining a second training data set, wherein the interference value is smaller than the value at the true category position in the hard label;

[0009] Using the first training data set and the second training data set, training to obtain a category prediction model;

[0010] Among them, the use verification of the category prediction model includes: inputting any target training sample in the second training data set into the model to be verified. If the error between the output result of the model to be verified and the watermark soft label corresponding to the target training sample is less than the error threshold, the model to be verified is determined to be a category prediction model.

[0011] In one possible implementation, using the first training data set and the second training data set to train a category prediction model includes:

[0012] Using the first training data set and the second training data set to perform model training to obtain an intermediate model;

[0013] Based on the intermediate model, the second training data set is used to perform model training to obtain a category prediction model.

[0014] In one possible implementation, model training is performed using the first training data set and the second training data set to obtain an intermediate model, including:

[0015] For any first training sample in the first training data set, input the first training sample into the category prediction model, obtain a first predicted category vector for the first training sample output by the category prediction model, and determine a first loss value of the first predicted category vector relative to a hard label corresponding to the first training sample;

[0016] In the second training data set, a second training sample corresponding to the first training sample is determined, the second training sample is input into the category prediction model, a second predicted category vector corresponding to the second training sample is obtained as output by the category prediction model, and a second loss value of the second predicted category vector relative to the watermark soft label corresponding to the second training sample is determined;

[0017] determining a combined loss value based on the first loss value and the second loss value;

[0018] Adjust model parameters based on the joint loss value;

[0019] When the category prediction model after adjusting the model parameters meets the convergence condition, an intermediate model is obtained.

[0020] In one possible implementation, determining a joint loss value according to the first loss value and the second loss value includes:

[0021] The following loss function is used to determine the joint loss value:

[0022] L M =(1-λ)L1+λT 2 L2

[0023] Among them, λ represents the relative weight hyperparameter, T represents the probability distribution smoothness hyperparameter, L1 represents the first loss value, L2 represents the second loss value, and the calculation formulas of L1 and L2 are as follows:

[0024]

[0025] Where M represents the number of categories contained in the hard label or watermark soft label;

[0026] N represents the number of training samples in the first training data set;

[0027] y1(i,c) represents the value of the cth category in the hard label corresponding to the first training sample when the i-th training sample is input;

[0028] p1(i,c) represents the value of the cth category in the first prediction vector when the i-th training sample is input;

[0029] y2(i,c) represents the value of the c-th category of the watermark soft label corresponding to the second training sample when the i-th training sample is input;

[0030] p2(i,c) represents the value of the cth category in the second prediction vector when the i-th training sample is input.

[0031] In one possible implementation, based on the intermediate model, a second training dataset is used to perform model training to obtain a category prediction model, including:

[0032] Based on the intermediate model, for any third training sample in the second training data set, the third training sample is input into the category prediction model to obtain a third predicted category vector for the third training sample output by the category prediction model;

[0033] Determining a third loss value according to the third predicted category vector and the watermark soft label corresponding to the third training sample;

[0034] Adjust model parameters according to the third loss value;

[0035] When the category prediction model after adjusting the model parameters meets the convergence condition, the category prediction model is obtained.

[0036] In a possible implementation, determining the third loss value according to the third predicted category vector and the watermark soft label corresponding to the third training sample includes:

[0037] The following loss function is used to determine the third loss value:

[0038]

[0039] Where M represents the number of categories contained in the hard label or watermark soft label;

[0040] N represents the number of training samples in the first training data set;

[0041] y3(i,c) represents the value of the c-th category in the watermark soft label corresponding to the third training sample when the i-th training sample is input;

[0042] p3(i,c) represents the value of the cth category in the third prediction vector when the i-th training sample is input.

[0043] In a second aspect, an embodiment of the present application provides a model protection device, comprising:

[0044] An acquisition module is used to acquire a first training data set of a category prediction model, where the first training data set includes multiple training sample pairs, each training sample pair includes a training sample and a hard label corresponding to the training sample;

[0045] a watermark adding module, configured to add a random watermark to the training sample and randomly add an interference value to at least one non-true category position in the hard label corresponding to the training sample to obtain a watermark soft label corresponding to the training sample, thereby obtaining a second training data set, wherein the interference value is smaller than the value at the true category position in the hard label;

[0046] A model training module, configured to train a category prediction model using the first training data set and the second training data set;

[0047] Among them, the use verification of the category prediction model includes: inputting any target training sample in the second training data set into the model to be verified. If the error between the output result of the model to be verified and the watermark soft label corresponding to the target training sample is less than the error threshold, the model to be verified is determined to be a category prediction model.

[0048] In a third aspect, an embodiment of the present application provides a model protection device, comprising: a memory, a processor;

[0049] The memory stores computer-executable instructions;

[0050] The processor executes the computer-executable instructions stored in the memory, so that the processor executes the above first aspect and / or various possible implementations of the first aspect.

[0051] In a fourth aspect, an embodiment of the present application provides a computer-readable storage medium, in which computer-executable instructions are stored. When the computer-executable instructions are executed, they are used to implement the first aspect and / or various possible implementation methods of the first aspect as described above.

[0052] In a fifth aspect, an embodiment of the present application provides a computer program product, including a computer program, which, when executed by a processor, implements the above first aspect and / or various possible implementation methods of the first aspect.

[0053] The model protection method, electronic device, storage medium, and program product provided by the embodiments of the present application are based on a first training data set of a category prediction model. Watermarks are added to training samples in the first training data set, and interference values are randomly added to the hard labels corresponding to the training samples in the first training data set to obtain watermark soft labels. The interference values are smaller than the values at the true category positions in the hard labels. In this way, the watermark soft labels disrupt the associations between other categories while ensuring the maximum value of the true category. A second training data set is composed of the watermarked training samples and the watermark soft labels. The category prediction model is trained using the first and second training data sets. The category prediction model obtained by this training method can ensure the accuracy of the output category while not reflecting the associations between the categories, effectively preventing it from being misused through knowledge distillation. When verifying the use of the category prediction model, any target training sample in the second training data set can be input into the model to be verified. If the error between the output result of the model to be verified and the watermark soft label corresponding to the target training sample is less than an error threshold, the model to be verified is determined to be a category prediction model, increasing the difficulty for attackers to misuse the category prediction model, thereby more effectively protecting the model. BRIEF DESCRIPTION OF THE DRAWINGS

[0054] The accompanying drawings, which are incorporated in and constitute a part of this specification, illustrate embodiments consistent with the present application and, together with the description, serve to explain the principles of the present application.

[0055] Figure 1 A schematic diagram of a scenario of model misappropriation provided in an embodiment of the present application;

[0056] Figure 2 Schematic diagram of the process of the model protection method provided in the embodiment of this application Figure 1 ;

[0057] Figure 3 Schematic diagram of the model training framework provided in the embodiment of the present application;

[0058] Figure 4 Schematic diagram of the process of the model protection method provided in the embodiment of this application Figure 2 ;

[0059] Figure 5 Schematic diagram of the process of the model protection method provided in the embodiment of this application Figure 3 ;

[0060] Figure 6A schematic diagram of the structure of a model protection device provided in an embodiment of the present application;

[0061] Figure 7 A schematic diagram of the structure of the model protection device provided in an embodiment of the present application.

[0062] The above drawings illustrate specific embodiments of the present application, which will be described in more detail below. These drawings and the textual description are not intended to limit the scope of the present application in any way, but rather to illustrate the concepts of the present application to those skilled in the art by reference to specific embodiments. DETAILED DESCRIPTION

[0063] Exemplary embodiments will be described in detail herein, with examples illustrated in the accompanying drawings. In the following description, when referring to the drawings, identical numerals in different figures represent identical or similar elements, unless otherwise indicated. The embodiments described in the following exemplary embodiments are not intended to represent all embodiments consistent with the present application. Rather, they are merely examples of apparatus and methods consistent with certain aspects of the present application, as detailed in the appended claims.

[0064] First, let’s explain the terms involved in this application:

[0065] Knowledge distillation: Knowledge distillation refers to using the output of a trained large model as part of the supervisory signal to assist in the training of another small model.

[0066] Digital watermark: Traditional digital watermarking refers to embedding specific information into digital signals, which may be audio, pictures or videos.

[0067] Hard label: used in single classification tasks, for a category, only belongs to or does not belong to.

[0068] Soft label: Use probability distribution to represent the probability of belonging to a certain category.

[0069] Teacher Model / Student Model: In knowledge distillation technology, the model provided with knowledge is called the student model, and the model providing knowledge is called the teacher model.

[0070] Attacker: An individual or organization that steals the intellectual property of another person's model.

[0071] Figure 1 This is a schematic diagram of a scenario where a model is misappropriated, as provided in the embodiment of this application. Figure 1As shown, training a category prediction model requires significant computing resources, expert design, and the support of relevant distributed systems. Once trained, the category prediction model can be applied to fields such as smart finance, smart healthcare, intelligent driving, and intelligent voice, significantly improving the quality and efficiency of corresponding functions in these areas. For example, in the field of smart finance, the trained category prediction model can be used to determine the user's financial risk level based on the transaction flow data of bank customers and recommend corresponding financial services based on the financial risk level. The application of category prediction models greatly improves the processing efficiency of massive amounts of financial data, facilitating the efficient operation of financial services.

[0072] However, as category prediction models are widely used across various fields, the problem of model theft has become increasingly serious. Some malicious attackers simply repackage the interfaces and resell them for profit, or they gain reputation by claiming to have created superior neural network models that achieve high accuracy on downstream tasks. Therefore, it is crucial to protect the information security of category prediction models.

[0073] The related technology adds data-based watermarks to the training set of the category prediction model, so that the trained category prediction model will obtain specific prediction results for the output of these trigger sets, thereby verifying the use of the category prediction model and protecting the information security of the category prediction model. The model trained in this way retains the correlation between different categories in its output. Attackers can easily achieve model theft by using the category prediction model as the teacher model in the knowledge distillation technology and using its output results to train an infringing student model. Combined with the above scenarios, it can be seen that the related technology has a technical problem that cannot effectively protect the model.

[0074] In response to the above technical problems, an embodiment of the present application provides a model protection method, whose main technical concepts include: adding watermarks to all training samples in a first training data set of a category prediction model, and randomly adding interference values to the hard labels corresponding to the training samples in the first training data set to obtain watermark soft labels, where the interference value is smaller than the value at the true category position in the hard label. In this way, the watermark soft label disrupts the association between other categories while ensuring that the value of the true category is maximized; a second training data set is obtained from the training samples with the watermark and the watermark soft labels, and the category prediction model is obtained by jointly training the first training data set and the second training data set.

[0075] The category prediction model obtained by the above training method can not only ensure the accuracy of the output category, but also does not reflect the correlation between the categories, and can effectively avoid being stolen through knowledge distillation; when verifying the use of the category prediction model, any target training sample in the second training data set is input into the model to be verified. If the error between the output result of the model to be verified and the watermark soft label corresponding to the target training sample is less than the error threshold, the model to be verified is determined to be a category prediction model, which increases the difficulty for attackers to steal the category prediction model by tampering with the watermark data, thereby achieving the effect of effectively protecting the model.

[0076] The following specific embodiments describe in detail the technical solution of the present application and how the technical solution of the present application solves the above-mentioned technical problems. The following specific embodiments can be combined with each other, and the same or similar concepts or processes may not be repeated in some embodiments. The embodiments of the present application will be described below in conjunction with the accompanying drawings.

[0077] Figure 2 Schematic diagram of the process of the model protection method provided in the embodiment of this application Figure 1 .like Figure 2 As shown, the method includes:

[0078] S201: Obtain a first training data set for a category prediction model. The first training data set includes multiple training sample pairs. Each training sample pair includes a training sample and a hard label corresponding to the training sample.

[0079] Figure 3 Schematic diagram of the model training framework provided for the embodiment of the present application. Usually, when training a category prediction model, the raw materials required are training data sets consisting of training sample pairs, that is, training samples and labels corresponding to the training samples. Among them, the label is in the form of a vector, each bit of the vector represents a category, and the value of each bit represents the probability that the training sample belongs to that category. Label types include hard labels and soft labels. The content of hard labels is only 0 and 1. The value of the correct category position is 1, and the rest of the positions are 0; the value of each position of the soft label is the probability that the training sample belongs to the category corresponding to that position, and the value is between 0 and 1.

[0080] like Figure 3 As shown, the first training data set consists of training samples and hard labels corresponding to the training samples, which can be obtained through manual labeling or other methods.

[0081] S202. Add a random watermark to the training sample and randomly add an interference value to at least one non-real category position in the hard label corresponding to the training sample to obtain a watermark soft label corresponding to the training sample, thereby obtaining a second training data set, wherein the interference value is smaller than the value at the real category position in the hard label.

[0082] Since data of the same category have similar low-order features, directly setting different watermark soft labels for the same training sample will bring huge noise and cause the model training to fail to converge. Therefore, different watermark labels are added to the training samples to distinguish different watermark soft labels.

[0083] A random watermark is added to the training sample to obtain a labeled training sample. Specifically, the watermark can be a small amount of random data added to the training mark. For example, for image-type training samples, noise pixels can be added to the pixel distribution of the training sample as a watermark to obtain the labeled training sample. Alternatively, for data-type training samples, such as financial data of bank users, a small amount of random numbers that do not affect the distribution of the original sample data can be added to the training sample as a watermark.

[0084] When adding watermarks to training samples and generating new training samples, the watermark soft labels corresponding to the new training samples are generated according to the hard labels corresponding to the training samples. Figure 3 In the training framework, the hard labels corresponding to the training samples in the first training dataset are [0,0,0,0,0,1,0,0,0,0], where the category represented by the sixth bit is the true category of the training sample. While retaining the true category value in the hard label, random interference values are added to the non-true category positions to generate watermark soft labels.

[0085] For example, as shown in 3, a random watermark mark 1 is added to the training sample of the first training data set to obtain training sample A. On the basis of the hard label [0,0,0,0,0,1,0,0,0,0], the value of the sixth true category is retained, and interference values are randomly added to the non-true category position to obtain the watermark soft label WM corresponding to the training sample A. A [0,0,V3,V 2, V1,1,0,0,0,0]; add a random watermark mark 2 to the training sample of the first training data set to obtain training sample B. On the basis of the hard label [0,0,0,0,0,1,0,0,0,0], retain the value of the sixth true category and randomly add interference values to the non-true category position to obtain the watermark soft label WM corresponding to training sample B. B [V 2, V1, 0, 0, 0, 1, 0, 0, 0, V3]; add a random watermark mark 3 to the training sample of the first training data set to obtain the training sample C. On the basis of the hard label [0, 0, 0, 0, 0, 1, 0, 0, 0, 0], retain the value of the sixth true category and randomly add interference values to the non-true category position to obtain the watermark soft label WM corresponding to the training sample C. B [V 2,V1,0,0,0,1,0,0,0,V3]. Among them, WM A 、WM B and WM C The categories, positions and values of the interference values added are different and are set randomly.

[0086] S203: Using the first training data set and the second training data set, train a class prediction model. Verifying the use of the class prediction model includes: inputting any target training sample in the second training data set into the model to be verified. If the error between the output of the model to be verified and the watermark soft label corresponding to the target training sample is less than an error threshold, then determining that the model to be verified is a class prediction model.

[0087] It can be understood that because the first training dataset contains the hard labels corresponding to the training samples, using the first training dataset to train the category prediction model can ensure the accuracy of the category prediction model's output. Because the second training dataset contains watermarked soft labels with added interference values, using the second training dataset to train the category prediction model can disrupt the associations between the categories in the soft labels output by the model, effectively preventing the model from being stolen through knowledge distillation. Using the first and second training datasets to jointly train the category prediction model ensures the accuracy of the category prediction model's output while also eliminating any associations between the output categories, making it impossible for attackers to steal the model through knowledge distillation.

[0088] The following is an example of using the model protection method provided in this embodiment to train a category prediction model in a smart finance scenario.

[0089] The transaction data of bank users is used as training samples in the first training dataset. These samples are labeled to obtain hard labels corresponding to the training samples. The hard labels indicate whether the bank user is a low-risk user, a medium-risk user, or a high-risk user. For example, the hard label corresponding to training sample 1 in the first training dataset is [0, 1, 0], indicating that the training sample is a medium-risk user.

[0090] Taking training sample 1 as an example, an example of watermarking the training data in the first training data set is as follows: noise data that does not affect the distribution of the original transaction data is randomly added to the transaction data contained in training sample 1 to obtain watermark training sample 2, and based on the hard label corresponding to training sample 1, a watermark soft label [A, 1, B] corresponding to watermark training sample 2 is generated, where A and B are random values less than 1.

[0091] Following the above example, the other training samples and hard labels in the first training dataset are modified to obtain the watermark training samples and watermark soft labels in the second training dataset. The class prediction model is trained using both the first and second training datasets. When used, the resulting class prediction model outputs results that maximize the probability of the correct class without reflecting correlations between classes, effectively preventing knowledge distillation.

[0092] The model protection method provided in the embodiments of this application uses a watermark to add watermarks to all training data. During verification, any data in the second training data set can be used as verification data to calculate the similarity with the set watermark soft label. This means that if an attacker wants to forge the watermark, they need to retrain the model and cannot carry out an ambiguous attack. Specifically, watermark verification can be performed in the following way:

[0093] l(Y pt ,S)≤ε

[0094] Among them, S is the watermark soft label corresponding to any target training sample in the second training data set, Y pt is the output of the target training sample input to the model to be verified, l is the similarity calculation function, and ε is the error threshold. If the output of the model to be verified satisfies the above formula, the model to be verified is determined to be a category prediction model trained using the model protection method described above.

[0095] The model protection method provided by the embodiment of the present application adds a watermark to the training samples in the first training dataset based on the first training dataset of the category prediction model, and randomly adds interference values to the hard labels corresponding to the training samples in the first training dataset to obtain a watermark soft label. The interference value is less than the value at the true category position in the hard label. In this way, the watermark soft label disrupts the association between other categories while ensuring the maximum value of the true category. The second training dataset is composed of the watermarked training samples and the watermark soft label. The category prediction model is trained using the first training dataset and the second training dataset. The category prediction model obtained by this training method can not only ensure the accuracy of the output category, but also does not reflect the association between different categories, which can effectively prevent the theft through knowledge distillation. When verifying the use of the category prediction model, any target training sample in the second training dataset can be input into the model to be verified. If the error between the output result of the model to be verified and the watermark soft label corresponding to the target training sample is less than the error threshold, the model to be verified is determined to be a category prediction model. This makes it more difficult for an attacker to steal the category prediction model by tampering with the watermark data, thereby achieving a more effective protection effect on the model.

[0096] In one possible implementation, using the first training data set and the second training data set to train a category prediction model includes:

[0097] The first training data set and the second training data set are used to perform model training to obtain an intermediate model; based on the intermediate model, the second training data set is used to perform model training to obtain a category prediction model.

[0098] The training of the category prediction model is divided into two stages: in the first stage, the first training dataset and the second training dataset are used together for model training. Because the first training dataset containing hard labels is used in the training process, the trained intermediate model can accurately output category prediction results. At the same time, because the second training dataset containing watermark soft labels is used, the association between each category in the output results of the trained intermediate model is disrupted; in the second stage, the second training dataset is used alone for model training, so that the association between each category in the output results of the trained category prediction model is further disrupted, which can effectively prevent knowledge distillation.

[0099] The model protection method provided in the embodiment of the present application is through a two-stage training process. In the first stage, the model is trained using a first training data set containing hard labels to ensure the accuracy of the output results, and the model is trained using a second training data set containing watermark soft labels to preliminarily disrupt the association between individual categories in the output results of the category prediction model; in the second stage, the model is trained only using the second training data set containing watermark soft labels to further disrupt the association between individual categories in the output results of the category prediction model, so that attackers cannot exploit the association between the categories in the model output results to steal the model through knowledge distillation, thereby ensuring the information security of the model.

[0100] Figure 4 Schematic diagram of the process of the model protection method provided in the embodiment of this application Figure 2 .like Figure 4 As shown, in one possible implementation, the first training data set and the second training data set are used to perform model training to obtain an intermediate model, including:

[0101] S401. For any first training sample in the first training data set, input the first training sample into a category prediction model, obtain a first predicted category vector for the first training sample output by the category prediction model, and determine a first loss value of the first predicted category vector relative to a hard label corresponding to the first training sample.

[0102] During model training, it's necessary to determine the model's loss. Loss refers to the error between the model's output and the true label for the same training example. The model parameters are adjusted continuously, with the minimum loss calculated as the criterion, until the model parameters are optimal.

[0103] In the model protection method provided in the embodiment of the present application, the training of the model is divided into two stages. In the first stage of training, the model is trained together using the first training data set and the second training data set. At this time, the loss function of the model training needs to consider the joint loss value of the first training data set and the second training data set during the training process.

[0104] For the first training data set, its loss value during the model training process refers to the error between the category prediction vector output by the model and the hard label corresponding to the training sample when the training sample in the first training data set is input into the category prediction model, that is, the first loss value.

[0105] S402. In the second training data set, determine a second training sample corresponding to the first training sample, input the second training sample into the category prediction model, obtain a second predicted category vector corresponding to the second training sample output by the category prediction model, and determine a second loss value of the second predicted category vector relative to the watermark soft label corresponding to the second training sample.

[0106] For the second training data set, its loss during the model training process refers to the error between the category prediction vector output by the model and the watermark soft label corresponding to the training sample when the training sample in the second training data set is input into the category prediction model, that is, the second loss value.

[0107] S403: Determine a combined loss value according to the first loss value and the second loss value.

[0108] The first loss value is weighted with the second loss value to obtain the joint loss value.

[0109] In some implementations, the desired training effect can be achieved by adjusting the weights of the first loss value and the second loss value.

[0110] For example, if the weight of the first loss value is set to be larger and the weight of the second loss value is set to be smaller in the joint loss value, the prediction results of the trained model will be more accurate, but there will be a certain correlation between the categories; if the weight of the first loss value is set to be smaller and the weight of the second loss value is set to be larger in the joint loss value, the prediction results of the trained model will lack accuracy, but the correlation between the categories will be very weak.

[0111] S404. Adjust model parameters according to the joint loss value.

[0112] With the goal of minimizing the joint loss value, the model parameters are continuously adjusted so that the first predicted category vector output by the category prediction model is as close as possible to the hard label corresponding to the first training sample, and the second predicted category vector is as close as possible to the watermark soft label corresponding to the second training sample.

[0113] S405. When the category prediction model after adjusting the model parameters meets the convergence condition, an intermediate model is obtained.

[0114] For example, the convergence condition of the category prediction model may be that the joint loss value is less than a preset loss threshold. When the joint loss value is less than the loss threshold, parameter adjustment and training iteration of the category prediction model are stopped to obtain an intermediate model.

[0115] The model protection method provided in the embodiment of the present application divides the training of the model into two stages. In the first stage of training, the loss values of the first training data set and the second training data set during the training process are calculated respectively, and a joint loss value is obtained based on the loss values of the two. The model parameters are adjusted according to the joint loss value, so that the model can fully combine the advantages of using the first training data set to train accurate prediction results and the advantages of using the second training data set to train without correlation between categories.

[0116] In one possible implementation, determining a joint loss value according to the first loss value and the second loss value includes:

[0117] The following loss function is used to determine the joint loss value:

[0118] L M =(1-λ)L1+λT 2 L2

[0119] Among them, λ represents the relative weight hyperparameter, T represents the probability distribution smoothness hyperparameter, L1 represents the first loss value, L2 represents the second loss value, and the calculation formulas of L1 and L2 are as follows:

[0120]

[0121] Where M represents the number of categories contained in the hard label or watermark soft label;

[0122] N represents the number of training samples in the first training data set;

[0123] y1(i,c) represents the value of the cth category in the hard label corresponding to the first training sample when the i-th training sample is input;

[0124] p1(i,c) represents the value of the cth category in the first prediction vector when the i-th training sample is input;

[0125] y2(i,c) represents the value of the c-th category of the watermark soft label corresponding to the second training sample when the i-th training sample is input;

[0126] p2(i,c) represents the value of the cth category in the second prediction vector when the i-th training sample is input.

[0127] Joint loss value L M The first loss value L1 and the second loss value L2 are weighted together. By adjusting the relative weight hyperparameter λ, the first loss value L1 and the second loss value L2 can be adjusted in the joint loss value L M The first loss value L1 and the second loss value L2 are calculated based on the cross-entropy loss function. The parameter T is used to adjust the smoothing degree in the probability estimation to avoid a large difference in the magnitude of the loss values in the two stages.

[0128] The cross entropy loss function is a commonly used loss function in machine learning and deep learning, especially in classification problems. It is used to measure the difference between the model output and the true label, thereby guiding model optimization.

[0129] The model protection method provided in the embodiment of the present application provides a calculation formula for the joint loss value based on the first loss value and the second loss value. By adjusting the relative weight hyperparameter, the proportion of the first loss value and the second loss value in the joint loss value can be adjusted, and the first loss value and the second loss value are obtained by the cross-entropy loss function calculation method, so as to achieve accurate and efficient calculation of the model training loss value and realize the effect of efficient training of the model.

[0130] Figure 5 Schematic diagram of the process of the model protection method provided in the embodiment of this application Figure 3 In one possible implementation, based on the intermediate model, a second training data set is used to perform model training to obtain a category prediction model, including:

[0131] S501. Based on the intermediate model, for any third training sample in the second training data set, the third training sample is input into the category prediction model to obtain a third predicted category vector for the third training sample output by the category prediction model.

[0132] After training obtains an intermediate model that meets the convergence criteria, model training enters the second phase. This second phase uses a second training dataset to further train the intermediate model to obtain a category prediction model. This aims to further disrupt the relationships between categories in the category prediction model's output, preventing the model from being stolen through knowledge distillation.

[0133] S502: Determine a third loss value according to the third predicted category vector and the watermark soft label corresponding to the third training sample.

[0134] The third loss value refers to the error between the third category prediction vector and the watermark soft label corresponding to the third training sample. The smaller the third loss value, the more accurate the model training.

[0135] S503: Adjust model parameters according to the third loss value.

[0136] Specifically, the model parameters are continuously adjusted to minimize the third loss value.

[0137] S504: When the category prediction model after adjusting the model parameters meets the convergence condition, a category prediction model is obtained.

[0138] For example, the convergence condition of the category prediction model may be that the third loss value is less than a preset loss threshold. When the third loss value is less than the loss threshold, parameter adjustment and training iteration of the model are stopped to obtain the category prediction model.

[0139] The model protection method provided in the embodiment of the present application uses a second training data set to strengthen the association between the categories of the disruption model output results in the second stage of training of the model, inputs any training sample in the second data set into the category prediction model, and adjusts the model parameters based on the loss value between the output of the category prediction model and the watermark soft label corresponding to the training sample, so that the model output is more consistent with the characteristics of the training data in the second training data set, that is, there is no association between the categories in the label, which can effectively prevent the model from being stolen through knowledge distillation.

[0140] In a possible implementation, determining the third loss value according to the third predicted category vector and the watermark soft label corresponding to the third training sample includes:

[0141] The following loss function is used to determine the third loss value:

[0142]

[0143] Where M represents the number of categories contained in the hard label or watermark soft label;

[0144] N represents the number of training samples in the first training data set;

[0145] y3(i,c) represents the value of the c-th category in the watermark soft label corresponding to the third training sample when the i-th training sample is input;

[0146] p3(i,c) represents the value of the cth category in the third prediction vector when the i-th training sample is input.

[0147] The third loss value, in the form of a cross-entropy loss function, intuitively reflects the accuracy of the model's predictions. The smaller the cross-entropy loss, the closer the model's predictions are to the true labels. The cross-entropy loss function is equivalent to the negative log-likelihood of the maximum likelihood estimate. By minimizing the cross-entropy loss, the probability of the predictions can be maximized, thereby optimizing the model parameters. Furthermore, the derivative of the cross-entropy loss function during backpropagation is relatively stable, which facilitates rapid convergence of model training. The cross-entropy loss function is well-suited for multi-class classification problems. By calculating the loss for each class separately and summing the losses to obtain the total loss, it is widely used in multi-classification tasks.

[0148] The model protection method provided in the embodiment of the present application performs two-stage training on the model. In the second stage of training, the model is trained using a second training data set containing a watermark soft label, and a cross-entropy loss function is used to determine the loss value between the model output category vector and the watermark soft label. The model parameters are adjusted according to the loss value to accelerate model convergence and achieve an efficient training model.

[0149] Figure 6 This is a schematic diagram of the structure of the model protection device provided in the embodiment of the present application. Figure 6 As shown, the model protection device 60 provided in the embodiment of the present application includes:

[0150] An acquisition module 601 is configured to acquire a first training data set of a category prediction model, where the first training data set includes a plurality of training sample pairs, each training sample pair including a training sample and a hard label corresponding to the training sample;

[0151] The watermark adding module 602 is configured to add a random watermark to the training sample and randomly add an interference value to at least one non-true category position in the hard label corresponding to the training sample to obtain a watermark soft label corresponding to the training sample, thereby obtaining a second training data set, wherein the interference value is smaller than the value at the true category position in the hard label;

[0152] The model training module 603 is used to use the first training data set and the second training data set to train a category prediction model; wherein, the use verification of the category prediction model includes: inputting any target training sample in the second training data set into the model to be verified, and if the error between the output result of the model to be verified and the watermark soft label corresponding to the target training sample is less than the error threshold, then the model to be verified is determined to be a category prediction model.

[0153] In a possible implementation, the model training module 603 is specifically configured to:

[0154] Using the first training data set and the second training data set to perform model training to obtain an intermediate model;

[0155] Based on the intermediate model, the second training data set is used to perform model training to obtain a category prediction model.

[0156] In one possible implementation, the model training module 603 is further configured to:

[0157] For any first training sample in the first training data set, input the first training sample into the category prediction model, obtain a first predicted category vector for the first training sample output by the category prediction model, and determine a first loss value of the first predicted category vector relative to a hard label corresponding to the first training sample;

[0158] In the second training data set, a second training sample corresponding to the first training sample is determined, the second training sample is input into the category prediction model, a second predicted category vector corresponding to the second training sample is obtained as output by the category prediction model, and a second loss value of the second predicted category vector relative to the watermark soft label corresponding to the second training sample is determined;

[0159] determining a combined loss value based on the first loss value and the second loss value;

[0160] Adjust model parameters based on the joint loss value;

[0161] When the category prediction model after adjusting the model parameters meets the convergence condition, an intermediate model is obtained.

[0162] In one possible implementation, the model training module 603 is further configured to:

[0163] The following loss function is used to determine the joint loss value:

[0164] L M =(1-λ)L1+λT 2 L2

[0165] Among them, λ represents the relative weight hyperparameter, T represents the probability distribution smoothness hyperparameter, L1 represents the first loss value, L2 represents the second loss value, and the calculation formulas of L1 and L2 are as follows:

[0166]

[0167] Where M represents the number of categories contained in the hard label or watermark soft label;

[0168] N represents the number of training samples in the first training data set;

[0169] y1(i,c) represents the value of the cth category in the hard label corresponding to the first training sample when the i-th training sample is input;

[0170] p1(i,c) represents the value of the cth category in the first prediction vector when the i-th training sample is input;

[0171] y2(i,c) represents the value of the c-th category of the watermark soft label corresponding to the second training sample when the i-th training sample is input;

[0172] p2(i,c) represents the value of the cth category in the second prediction vector when the i-th training sample is input.

[0173] In one possible implementation, the model training module 603 is further configured to:

[0174] Based on the intermediate model, for any third training sample in the second training data set, the third training sample is input into the category prediction model to obtain a third predicted category vector for the third training sample output by the category prediction model;

[0175] Determining a third loss value according to the third predicted category vector and the watermark soft label corresponding to the third training sample;

[0176] Adjust model parameters according to the third loss value;

[0177] When the category prediction model after adjusting the model parameters meets the convergence condition, the category prediction model is obtained.

[0178] In one possible implementation, the model training module 603 is further configured to:

[0179] The following loss function is used to determine the third loss value:

[0180]

[0181] Where M represents the number of categories contained in the hard label or watermark soft label;

[0182] N represents the number of training samples in the first training data set;

[0183] y3(i,c) represents the value of the c-th category in the watermark soft label corresponding to the third training sample when the i-th training sample is input;

[0184] p3(i,c) represents the value of the cth category in the third prediction vector when the i-th training sample is input.

[0185] The model protection device provided in this embodiment can execute the method provided in the above method embodiment. Its implementation principle and technical effects are similar, and are not described in detail in this embodiment.

[0186] Figure 7 This is a schematic diagram of the structure of the model protection device provided in the embodiment of the present application. Figure 7As shown, the model protection device 70 provided in the embodiment of the present application includes: at least one processor 701 and a memory 702. Optionally, the model protection device 70 also includes a communication interface 703. The processor 701, the memory 702 and the communication component 703 are connected via a communication bus 704.

[0187] During the specific implementation process, at least one processor 701 executes the computer-executable instructions stored in the memory 702, so that the at least one processor 701 performs the above method.

[0188] The specific implementation process of the processor 701 can be found in the above method embodiment. Its implementation principle and technical effects are similar and will not be repeated here in this embodiment.

[0189] In the above embodiments, it should be understood that the processor may be a central processing unit (CPU), or other general-purpose processors, a digital signal processor (DSP), an application-specific integrated circuit (ASIC), etc. The general-purpose processor may be a microprocessor or any conventional processor. The steps of the method disclosed in the present invention may be directly implemented by a hardware processor or implemented by a combination of hardware and software modules in the processor.

[0190] The memory may include a high-speed memory (Random Access Memory, RAM), and may also include a non-volatile memory (NVM), such as at least one disk memory.

[0191] The bus can be an Industry Standard Architecture (ISA) bus, a Peripheral Component Interconnect (PCI) bus, or an Extended Industry Standard Architecture (EISA) bus. Buses can be classified into address buses, data buses, and control buses. For ease of illustration, the buses in the drawings of this application are not limited to just one bus or just one type of bus.

[0192] An embodiment of the present application also provides a computer program product, including a computer program, which implements the above method when executed by a processor.

[0193] An embodiment of the present application further provides a computer-readable storage medium, in which computer-executable instructions are stored. When a processor executes the computer-executable instructions, the above-mentioned method is implemented.

[0194] The above-mentioned readable storage medium can be implemented by any type of volatile or non-volatile memory device or a combination thereof, such as static random access memory (SRAM), electrically erasable programmable read-only memory (EEPROM), erasable programmable read-only memory (EPROM), programmable read-only memory (PROM), read-only memory (ROM), magnetic memory, flash memory, magnetic disk or optical disk. The readable storage medium can be any available medium that can be accessed by a general-purpose or special-purpose computer.

[0195] An exemplary readable storage medium is coupled to a processor so that the processor can read information from the readable storage medium and write information to the readable storage medium. Of course, the readable storage medium can also be an integral part of the processor. The processor and the readable storage medium can be located in an application specific integrated circuit (ASIC). Of course, the processor and the readable storage medium can also exist in a device as discrete components.

[0196] The division of units is merely a logical functional division; actual implementations may employ alternative divisions, such as combining or integrating multiple units or components into another system, or omitting or disabling certain features. Furthermore, any direct coupling or communication connection shown or discussed may be an indirect coupling or communication connection between devices or units, either through an interface, electrical, mechanical, or other means.

[0197] Units described as separate components may or may not be physically separate, and components shown as units may or may not be physical units, that is, they may be located in one place or distributed across multiple network units. Some or all of these units may be selected to achieve the purpose of this embodiment according to actual needs.

[0198] In addition, each functional unit in each embodiment of the present invention may be integrated into one processing unit, or each unit may exist physically separately, or two or more units may be integrated into one unit.

[0199] If the function is implemented in the form of a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present invention, or the part that contributes to the existing technology, or the part of the technical solution, can be embodied in the form of a software product. The computer software product is stored in a storage medium and includes a number of instructions for enabling a computer device (which can be a personal computer, server, or network device, etc.) to execute all or part of the steps of the various embodiments of the method of the present invention. The aforementioned storage medium includes: U disk, mobile hard disk, read-only memory (ROM), random access memory (RAM), magnetic disk or optical disk, and other media that can store program code.

[0200] Those skilled in the art will appreciate that all or part of the steps in the above-described method embodiments can be implemented using hardware associated with program instructions. The aforementioned program can be stored in a computer-readable storage medium. When executed, the program performs the steps of the above-described method embodiments. The aforementioned storage medium includes various media capable of storing program code, such as ROM, RAM, magnetic disks, or optical disks.

[0201] Finally, it should be noted that those skilled in the art will readily identify other embodiments of the present invention after considering the specification and practicing the invention disclosed herein. The present invention is intended to cover any variations, uses, or adaptations of the present invention that follow the general principles of the present invention and include common knowledge or customary techniques in the art not disclosed herein. The present invention is not limited to the precise structure described above and illustrated in the accompanying drawings, and various modifications and variations may be made without departing from the scope thereof. The scope of the present invention is limited solely by the appended claims.

Claims

1. A model protection method, characterized in that: include: Obtain a first training data set for a category prediction model, where the first training data set includes a plurality of training sample pairs, each training sample pair including a training sample and a hard label corresponding to the training sample; Adding a random watermark to the training sample and randomly adding an interference value to at least one non-true category position in the hard label corresponding to the training sample to obtain a watermark soft label corresponding to the training sample, thereby obtaining a second training data set, wherein the interference value is smaller than the value at the true category position in the hard label; Using the first training data set and the second training data set to train a category prediction model; Among them, the verification of the use of the category prediction model includes: inputting any target training sample in the second training data set into the model to be verified, and if the error between the output result of the model to be verified and the watermark soft label corresponding to the target training sample is less than an error threshold, then determining that the model to be verified is the category prediction model.

2. The model protection method according to claim 1, characterized in that: The step of using the first training data set and the second training data set to train a category prediction model includes: Performing model training using the first training data set and the second training data set to obtain an intermediate model; Based on the intermediate model, a second training data set is used to perform model training to obtain the category prediction model.

3. The model protection method according to claim 2, characterized in that: The using the first training data set and the second training data set to perform model training to obtain an intermediate model includes: For any first training sample in the first training data set, input the first training sample into a category prediction model, obtain a first predicted category vector for the first training sample output by the category prediction model, and determine a first loss value of the first predicted category vector relative to a hard label corresponding to the first training sample; In the second training data set, determining a second training sample corresponding to the first training sample, inputting the second training sample into a category prediction model, obtaining a second predicted category vector corresponding to the second training sample output by the category prediction model, and determining a second loss value of the second predicted category vector relative to the watermark soft label corresponding to the second training sample; determining a combined loss value according to the first loss value and the second loss value; adjusting model parameters according to the joint loss value; When the category prediction model after adjusting the model parameters meets the convergence condition, the intermediate model is obtained.

4. The model protection method according to claim 3, characterized in that: The determining a combined loss value according to the first loss value and the second loss value includes: The following loss function is used to determine the joint loss value: L M =(1-λ)L1+λT 2 L2 Where λ represents the relative weight hyperparameter, T represents the probability distribution smoothness hyperparameter, L1 represents the first loss value, L2 represents the second loss value, and the calculation formulas of L1 and L2 are as follows: Wherein, M represents the number of categories contained in the hard label or the watermark soft label; N represents the number of training samples in the first training data set; y1(i,c) represents the value of the cth category in the hard label corresponding to the first training sample when the i-th training sample is input; p1(i,c) represents the value of the cth category in the first prediction vector when the i-th training sample is input; y2(i,c) represents the value of the c-th category of the watermark soft label corresponding to the second training sample when the i-th training sample is input; p2(i,c) represents the value of the cth category in the second prediction vector when the i-th training sample is input.

5. The model protection method according to any one of claims 2 to 4, characterized in that: The method of performing model training on the basis of the intermediate model using a second training data set to obtain the category prediction model includes: Based on the intermediate model, for any third training sample in the second training data set, input the third training sample into the category prediction model to obtain a third predicted category vector for the third training sample output by the category prediction model; Determining a third loss value according to the third predicted category vector and the watermark soft label corresponding to the third training sample; Adjusting model parameters according to the third loss value; When the category prediction model after adjusting the model parameters meets the convergence condition, the category prediction model is obtained.

6. The model protection method according to claim 5, characterized in that: The determining of the third loss value according to the third predicted category vector and the watermark soft label corresponding to the third training sample includes: The following loss function is used to determine the third loss value: Wherein, M represents the number of categories contained in the hard label or the watermark soft label; N represents the number of training samples in the first training data set; y3(i,c) represents the value of the c-th category in the watermark soft label corresponding to the third training sample when the i-th training sample is input; p3(i,c) represents the value of the cth category in the third prediction vector when the i-th training sample is input.

7. A model protection device, characterized in that: include: An acquisition module is configured to acquire a first training data set for a category prediction model, wherein the first training data set includes a plurality of training sample pairs, each training sample pair including a training sample and a hard label corresponding to the training sample; a watermark adding module, configured to add a random watermark to the training sample and randomly add an interference value to at least one non-true category position in the hard label corresponding to the training sample to obtain a watermark soft label corresponding to the training sample, thereby obtaining a second training data set, wherein the interference value is smaller than the value at the true category position in the hard label; A model training module, configured to train a category prediction model using the first training data set and the second training data set; Among them, the verification of the use of the category prediction model includes: inputting any target training sample in the second training data set into the model to be verified, and if the error between the output result of the model to be verified and the watermark soft label corresponding to the target training sample is less than an error threshold, then determining that the model to be verified is the category prediction model.

8. A model protection device, characterized in that: include: Memory, processor; The memory stores computer-executable instructions; The processor executes the computer-executable instructions stored in the memory, so that the processor performs the method according to any one of claims 1 to 6.

9. A computer-readable storage medium, characterized in that The computer-readable storage medium stores computer-executable instructions, which are used to implement the method according to any one of claims 1 to 6 when executed.

10. A computer program product, characterized in that The invention comprises a computer program, which implements the method according to any one of claims 1 to 6 when the computer program is executed.

Images