Model-fingerprint-based semi-fragile watermarking tamper localization method

Abstract

The application discloses a semi-fragile watermark tamper localization method based on model fingerprints, which comprises the following steps: initializing semi-fragile samples; generating target labels; selecting standard images; designing loss functions; updating semi-fragile samples; verifying and iterating; extracting and grouping model parameters; compressing each group of model weights and generating model fingerprints; embedding model fingerprints in generated semi-fragile samples; initializing a counter; verifying each semi-fragile sample in a loop; comparing predicted results with target labels; calculating authentication accuracy and determining whether the model is unauthorized; extracting and grouping suspicious model parameters; compressing each group of suspicious model weights and generating a suspicious feature vector; extracting embedded model fingerprints in semi-fragile samples; converting a binary sequence into a hexadecimal sequence; comparing feature sequences and determining a tamper location. The method improves the accuracy of model content authentication, realizes accurate tamper localization, keeps the model performance unaffected, enhances the model security, and promotes the sustainable development of technology.

Description

Technical Field

[0001] This invention relates to the fields of artificial intelligence and cybersecurity, and in particular to a semi-fragile watermark tampering location method based on model fingerprints. Background Technology

[0002] In the wave of artificial intelligence, deep neural network models, with their powerful learning capabilities and generalization performance, have rapidly become a core engine driving technological innovation. They have demonstrated enormous potential and value in multiple fields such as image recognition, speech processing, and natural language processing, greatly promoting technological progress and application development. However, with the increasingly widespread commercial application of these models, deep neural network models are also facing unprecedented security challenges.

[0003] On the one hand, when models are uploaded to public environments such as cloud platforms and open-source communities, the risk of malicious tampering increases significantly due to the lack of strict security controls and monitoring mechanisms in these environments. Malicious attackers may compromise the integrity of the model by tampering with its parameters or inserting malicious code, thereby affecting its performance and accuracy. Such tampering may not only cause errors in practical applications but also lead to serious security and legal issues, such as privacy breaches and data manipulation.

[0004] On the other hand, traditional model protection methods, such as digital watermarking, while capable of verifying model integrity to some extent, have numerous limitations. These methods are often overly sensitive to minor changes in the model, making it difficult to distinguish between normal model updates and malicious tampering. Once the model has been tampered with, these methods often only provide simple integrity verification results, failing to provide effective tamper location information. This means that even if model tampering is detected, the exact location and extent of the tampering cannot be accurately determined, posing significant challenges to model repair and maintenance.

[0005] To address this challenge, this invention proposes an innovative semi-fragile neural network watermarking method. This method generates a set of special semi-fragile samples. These samples maintain stable and accurate output under normal model processing, but exhibit obvious anomalies in maliciously tampered models. By analyzing the model's output on these semi-fragile samples, rapid determination of model tampering can be achieved. More importantly, this method can further pinpoint the specific location of the tampering, providing strong support for model repair and maintenance. This semi-fragile neural network watermarking method not only effectively improves model security but also ensures the reliability and stability of the model in commercial applications. Summary of the Invention

[0006] In view of this, the present invention provides a semi-fragile watermark tampering location method based on model fingerprints.

[0007] To solve the above-mentioned technical problems, the present invention adopts the following technical solution:

[0008] The semi-fragile watermark tampering localization method based on model fingerprinting includes the following steps:

[0009] Step 1: Initialize the semi-fragile sample

[0010] A subset of samples is randomly selected from the standard sample set and initialized as semi-fragile samples.

[0011] Step 2: Generate target tags

[0012] For the initialized semi-fragile sample, a target label different from its original label is randomly assigned using a key;

[0013] Step 3: Standard Image Selection

[0014] Based on the generated target labels, randomly select standard images with corresponding labels from the standard sample set;

[0015] Step 4: Design the loss function

[0016] Ensure that the model output is consistent with the target label and improve the transferability of semi-fragile samples;

[0017] Step 5: Update the semi-fragile sample

[0018] The total loss function is minimized by gradient descent, and the semi-fragile samples are updated so that they both conform to the target label and have high transferability.

[0019] Step 6: Verification and Iteration

[0020] Verify whether the updated sample meets the conditions. If it does, the prediction result is consistent with the target label and the similarity is less than the threshold. If it does not meet the conditions, continue the iteration.

[0021] Step 7: Model Parameter Extraction and Grouping

[0022] Extract the weight information of the deep neural network model and group it in order;

[0023] Step 8: Compress the weights of each model group and generate model fingerprints

[0024] Each set of weights is compressed and a feature vector is generated. Finally, it is converted into a binary sequence to generate the model fingerprint.

[0025] Step 9: Embed the model fingerprint in the generated semi-fragile samples

[0026] Discrete wavelet transform is performed on semi-fragile samples to embed model fingerprints into the frequency domain coefficients, and the final samples are generated through inverse transform.

[0027] Step 10: Initialize the counter

[0028] Initialize the counter to 0 to record the number of samples whose model output matches the expected label;

[0029] Step 11: Validate each semi-fragile sample in a loop

[0030] The suspicious model is used to predict the semi-fragile samples and obtain the output labels;

[0031] Step 12: Compare the prediction results with the target labels

[0032] Compare the model's output label with the expected label of the semi-fragile sample; if they match, increment the counter by 1.

[0033] Step 13: Calculate authentication accuracy and determine if the model is unauthorized.

[0034] The authentication accuracy is calculated based on the counter value and compared with a preset threshold to determine whether the model has been maliciously tampered with.

[0035] Step 14: Extraction and grouping of suspicious model parameters

[0036] Extract the parameters of the suspicious models and group them in the same way as the original models;

[0037] Step 15: Compress the weights of each suspicious model group and generate suspicious feature vectors.

[0038] Compress the weights of each suspicious model group and generate feature vectors, then concatenate them to form a suspicious feature vector;

[0039] Step 16: Extract the model fingerprint embedded in the semi-fragile samples

[0040] The embedded model fingerprint is extracted from each semi-fragile sample, and the sequence that appears most frequently is selected as the final model fingerprint by applying the majority principle.

[0041] Step 17: Convert binary sequence to hexadecimal

[0042] The extracted model fingerprint is converted into a hexadecimal feature sequence;

[0043] Step 18: Compare the feature sequences and determine the tampering location.

[0044] Compare the feature sequences of the suspected model with those of the original model, record the mismatch locations, calculate the index, and determine the approximate area of ​​tampering.

[0045] Preferably, in step 2, the loss function is defined using the confidence interval parameter and the logit vector difference.

[0046] Preferably, in steps 8 and 15, each weight sequence is compressed using the Brotli compression method, and a feature vector is generated using the BLAKE2 hash function.

[0047] Preferably, in step 4, the loss L1 that ensures the model output matches the target label is...

[0048]

[0049] Where τ represents the confidence interval parameter, the larger τ is, the greater the confidence of the model in predicting that the semi-fragile sample X is labeled T, and vice versa; the deep neural network model is denoted as M.

[0050] Preferably, it also includes the difference between the logits vector of the semi-fragile sample X and the logits vector of the standard image I, the mathematical expression of which is L2 loss.

[0051]

[0052] Where S(X) and S(I) are the logits vectors of model M for semi-fragile sample X and standard image I, respectively.

[0053] Preferably, in step 5, the total loss L t for

[0054] L t =L1 + α·L2,

[0055] Where α<0 is a weighting factor that adjusts the ratio of the two loss components;

[0056] Next, the total loss L is minimized using gradient descent. t The mathematical expression for updating semi-fragile samples is:

[0057]

[0058] Among them, l r It's the learning rate. It is the direction of the gradient of the loss function with respect to X.

[0059] Preferably, in step 6, the mathematical expressions for the two conditions are as follows:

[0060]

[0061] Where argmaxM(X) = T is used to ensure that the updated semi-fragile sample X is consistent with its assigned target label T; D(O,X) represents the mean square error between the original sample O and the updated semi-fragile sample X.

[0062] Preferably, in step 8, the process of compressing the i-th weight sequence can be represented as follows:

[0063] Z i =Brotli(P i ),

[0064] Where Brotli(·) represents Brotli compression, Z i This represents the compression result of the i-th weight sequence;

[0065] For each set of compressed parameters Z i The BLAKE2 hash function is used to generate the model feature vector, where the feature vector of the i-th group of compression parameters can be represented as:

[0066] r i =BLAKE2(Z i )

[0067] =BLAKE2(Brotli(P i )),

[0068] Where BLAKE2(·) represents the BLAKE2 hash function;

[0069] Next, the feature vectors of each set of compression parameters are concatenated to generate the model's feature vector R = [r1, r2, ..., r]. m Finally, the feature vector R is converted into a binary sequence to generate the model fingerprint F, which is mathematically expressed as follows:

[0070] F = hextobin(R),

[0071] Here, hextobin(·) is a function that converts a hexadecimal feature vector into a binary sequence.

[0072] Preferably, step 9 specifically involves: performing a discrete wavelet transform on the semi-fragile sample X to obtain frequency domain coefficients X′, and then embedding a model fingerprint into its frequency domain coefficients; the model fingerprint is embedded using a spread spectrum method, the mathematical expression of which is...

[0073]

[0074] Where β is a parameter that controls the fingerprint embedding strength of the model;

[0075] Finally, the frequency domain coefficients X′ containing the model fingerprint are subjected to inverse discrete wavelet transform to generate the final semi-fragile sample X. This process is expressed as follows:

[0076]

[0077] Where IDWT(·) represents the inverse discrete wavelet transform function.

[0078] Preferably, in step 13, the authentication accuracy is calculated as follows:

[0079]

[0080] Finally, based on the comparison between the authentication accuracy Acc and the preset threshold δ, it is determined whether the model has been maliciously tampered with. If Acc exceeds the threshold δ, the model is determined to be normal or has not been modified; otherwise, the model is determined to have been maliciously tampered with.

[0081] The present invention achieves the following technical effects compared to the prior art:

[0082] (1) This invention improves the accuracy of model content authentication:

[0083] This invention achieves accurate authentication of model content by generating semi-fragile samples that remain stable under normal operation but exhibit vulnerability when maliciously tampered with.

[0084] Compared to traditional methods, this method can more accurately distinguish between normal model updates and malicious tampering, effectively reducing false positives and false negatives.

[0085] (2) This invention achieves precise tamper location:

[0086] By embedding model fingerprints into the model and combining them with tamper location technology, this invention can accurately identify which parts of the model have been tampered with. The location accuracy is higher than that of existing technologies, which provides strong support for the rapid repair and maintenance of the model and reduces the potential losses caused by tampering.

[0087] (3) The present invention keeps the model performance unaffected:

[0088] While achieving model content authentication and tamper location, this invention also ensures the stability of model performance.

[0089] Compared to some protective measures that may affect model performance, this invention is more suitable for practical application scenarios and ensures the normal operation of the model.

[0090] (4) This invention enhances the safety of the model:

[0091] This invention significantly improves the security of the model by providing a new security protection mechanism. It can effectively prevent malicious attackers from damaging the model performance or stealing sensitive information by tampering with the model parameters, thereby protecting the intellectual property rights and security of the model.

[0092] (5) This invention promotes the sustainable development of technology:

[0093] The implementation of this invention provides technical support for the legal use and commercialization of the model, and helps to promote the sustainable development of artificial intelligence technology; at the same time, it also promotes the formulation of relevant laws and policies, and provides a guarantee for the healthy development of the field of artificial intelligence. Attached Figure Description

[0094] Figure 1 This is an application scenario diagram of the present invention;

[0095] Figure 2 This is a flowchart of the semi-fragile sample generation process of the present invention;

[0096] Figure 3 This is a flowchart of the content authentication process for the model of this invention;

[0097] Figure 4 This is a flowchart illustrating the model tampering and location process of the present invention. Detailed Implementation

[0098] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0099] This invention discloses a semi-fragile watermark tampering location method based on model fingerprints, comprising the following steps:

[0100] Module 1: Generation of Semi-Fragile Samples

[0101] The goal of Module 1 is to generate a set of semi-fragile samples. These samples are robust to normal model operations but vulnerable to maliciously modified models. The following are the detailed steps for generating semi-fragile samples:

[0102] Step 1: Initialize semi-fragile samples. The model owner randomly selects a subset of samples from the standard sample set O and initializes these samples as semi-fragile samples X. In other words, the semi-fragile samples in this invention are generated through variations of a portion of the standard samples.

[0103] Step 2: Generate target label. For the initial semi-fragile sample generated in Step 1, a target label T is randomly assigned using the key k. The target label T is different from the original label of the semi-fragile sample.

[0104] Step 3: Standard Image Selection. Based on the target label T in Step 2, randomly select an image labeled T from the standard sample set O, denoted as the standard image I.

[0105] Step 4: Design the loss function. This patent considers two aspects of loss to generate semi-fragile samples that meet the conditions, namely, ensuring that the model output is consistent with the target label and improving the transferability of the semi-fragile samples. Assuming the deep neural network model is denoted as M, the loss for ensuring that the model output is consistent with the target label can be defined as follows:

[0106]

[0107] Here, τ represents the confidence interval parameter. A larger τ indicates a higher confidence level in the model predicting a semi-fragile sample X as label T, and vice versa. In addition, this patent also considers the difference between the logits vector of the semi-fragile sample X and the logits vector of the standard image I to improve the transferability of the sample. The mathematical expression of this loss is as follows:

[0108]

[0109] Here, S(X) and S(I) are the logits vectors of model M for the semi-fragile sample X and the standard image I, respectively. Introducing L2 loss allows the generated semi-fragile sample to be closer to the original standard image labeled T, thereby ensuring the transferability of the generated semi-fragile sample.

[0110] Step 5: Update the semi-fragile samples. Based on the loss function in Step 4, the total loss can be defined as...

[0111] L t =L1 + α·L2,

[0112] Here, α<0 is a weighting factor that adjusts the ratio of the two loss components. Next, the total loss L is minimized using gradient descent. t The mathematical expression for updating semi-fragile samples is:

[0113]

[0114] Among them, l r It's the learning rate. It is the direction of the gradient of the loss function with respect to X.

[0115] Step 6: Validation and Iteration. Check whether the model M's prediction for the updated sample X is consistent with the target label T, and whether the similarity between the original sample O and the updated sample X is less than the threshold ε. If the conditions are met, stop the iteration; otherwise, continue the iteration. The mathematical expressions for the two conditions are as follows:

[0116]

[0117] Here, argmaxM(X) = T is used to ensure that the updated semi-fragile sample X is consistent with its assigned target label T. D(O,X) represents the mean square error between the original sample O and the updated semi-fragile sample X, which is used to ensure that attackers cannot visually distinguish between the generated semi-fragile sample and the original sample, that is, the generated semi-fragile sample and the original sample must maintain a high degree of similarity.

[0118] Step 7: Model Parameter Extraction and Grouping. First, extract the parameter information of the deep neural network model M. Specifically, extract the weight information from all layers of the deep neural network model M and arrange these weights in order to obtain the model weight sequence P. Then, group the model weight sequence P. Specifically, divide the model weight sequence P into m groups in order, where the weight sequences in each group have the same length. Let the weight sequence of the i-th group be denoted as Pi. i .

[0119] Step 8: Compress each set of model weights and generate model fingerprints. The Brotli compression method is used to compress each set of weight sequences. The process of compressing the i-th set of weight sequences can be represented as follows:

[0120] Z i =Brotli(P i ),

[0121] Where Brotli(·) represents Brotli compression, Z i This represents the compression result of the i-th weight sequence. For each compressed set of parameters Z... i The BLAKE2 hash function is used to generate the model feature vector, where the feature vector of the i-th group of compression parameters can be represented as:

[0122] r i =BLAKE2(Z i )

[0123] =BLAKE2(Brotli(P i )),

[0124] Here, BLAKE2(·) represents the BLAKE2 hash function. Next, concatenating the feature vectors of each set of compression parameters generates the model's feature vector R = [r1, r2, ..., r...]. m Finally, the feature vector R is converted into a binary sequence to generate the model fingerprint F, which is mathematically expressed as follows:

[0125] F = hextobin(R),

[0126] Here, hextobin(·) is a function that converts a hexadecimal feature vector into a binary sequence.

[0127] Step 9: Embed the model fingerprint F in the generated semi-fragile sample. Specifically, the semi-fragile sample X is subjected to Discrete Wavelet Transform (DWT) to obtain the frequency domain coefficients X′, and then the model fingerprint is embedded in its frequency domain coefficients. In this patent, the model fingerprint is embedded using a spread spectrum method, the mathematical expression of which is as follows:

[0128]

[0129] Where β is a parameter controlling the embedding strength of the model fingerprint. Finally, the frequency domain coefficients X′ containing the model fingerprint are subjected to inverse discrete wavelet transform to generate the final semi-fragile sample X, which is expressed as follows:

[0130]

[0131] Where IDWT(·) represents the inverse discrete wavelet transform function.

[0132] Module 2: Model Content Authentication

[0133] Module 2 determines whether the model has been maliciously tampered with by comparing the consistency between the output of model M on the semi-fragile sample X and the expected label. By introducing authentication accuracy Acc and a threshold δ, the integrity of the model can be effectively identified.

[0134] Step 10: Initialize the counter. Initialize the counter to count = 0 to record the number of samples whose model output matches the expected labels.

[0135] Step 11: Iteratively validate each semi-fragile sample. For each semi-fragile sample X... i Using the questionable model M′ on the semi-fragile sample X i Perform predictions to obtain the output label results, denoted as T. pi .

[0136] Step 12: Compare the predicted results with the target labels. The model's output T... pi The expected label T of the semi-fragile sample i Compare. If T pi equal to T i If the sample passes the validation, the counter count is incremented by 1. Otherwise, the counter count remains unchanged.

[0137] Step 13: Calculate authentication accuracy and determine if the model is unauthorized. Authentication accuracy is calculated as follows:

[0138]

[0139] Finally, based on the comparison between the authentication accuracy (Acc) and the preset threshold (δ), it is determined whether the model has been maliciously tampered with. If Acc exceeds the threshold (δ), the model is determined to be normal or has not been modified. Otherwise, the model is determined to have been maliciously tampered with.

[0140] Module 3: Model Tampering Location

[0141] The goal of Module 3 is to accurately determine the location of maliciously tampered parameters in the model by comparing the feature vectors of the suspicious model with the fingerprints of the original model extracted from the semi-fragile samples, thereby ensuring the integrity and security of the model.

[0142] Step 14: Extraction and Grouping of Suspicious Model Parameters. Referring to Step 7, extract the parameters of the suspicious model M′ and group these parameters in the same way, where the i-th group of suspicious model parameters is denoted as P′. i .

[0143] Step 15: Compress the weights of each suspicious model group and generate suspicious feature vectors. Referring to Step 8, first compress the weights of each suspicious model group using the Brotli compression method. Then, use the BLAKE2(·) hash function to generate suspicious model feature vectors and concatenate them to generate a suspicious feature vector R′.

[0144] Step 16: Extract the model fingerprint embedded in the semi-fragile samples. For each semi-fragile sample, extract the model fingerprint embedded within it using the spread spectrum extraction algorithm. The model fingerprint extracted from the j-th semi-fragile sample is denoted as... Then, all extracted model fingerprints Applying the majority principle, the sequence that appears most frequently is selected as the extracted model fingerprint.

[0145] Step 17: Convert the binary sequence to hexadecimal. Use the bintohex() function to convert the extracted model fingerprint. Convert to hexadecimal feature sequence To facilitate comparison and analysis.

[0146] Step 18: Compare the feature sequences and determine the tampering location. Compare the suspicious model feature sequence R′ generated in Step 15 with the original model feature sequence extracted in Step 17. Specifically, starting from the beginning of the sequence, corresponding positions in the two sequences are compared one by one. If a mismatch is found at any position, that position is recorded. The index q of the mismatch position is calculated and divided by the number of parameter sets m to determine the approximate area of ​​tampering. Finally, the tampering position information is returned, indicating which part of the parameters in the model has been tampered with.

[0147] The above description is merely a preferred embodiment of the present invention and does not constitute any limitation on the technical scope of the present invention. Therefore, any minor modifications, equivalent changes, and alterations made to the above embodiments based on the technical essence of the present invention shall still fall within the scope of the technical solution of the present invention.

Claims

1. A semi-fragile watermark tampering localization method based on model fingerprints, characterized in that, Includes the following steps: Step 1: Initialize the semi-fragile sample A subset of samples is randomly selected from the standard sample set and initialized as semi-fragile samples. Step 2: Generate target tags For the initialized semi-fragile sample, a target label different from its original label is randomly assigned using a key; Step 3: Standard Image Selection Based on the generated target labels, randomly select standard images with corresponding labels from the standard sample set; Step 4: Design the loss function Ensure that the model output is consistent with the target label and improve the transferability of semi-fragile samples; Step 5: Update the semi-fragile sample The total loss function is minimized by gradient descent, and the semi-fragile samples are updated so that they both conform to the target label and have high transferability. Step 6: Verification and Iteration Verify whether the updated sample meets the conditions. If it does, the prediction result is consistent with the target label and the similarity is less than the threshold. If it does not meet the conditions, continue the iteration. Step 7: Model Parameter Extraction and Grouping Extract the weight information of the deep neural network model and group it in order; Step 8: Compress the weights of each model group and generate model fingerprints Each set of weights is compressed and a feature vector is generated. Finally, it is converted into a binary sequence to generate the model fingerprint. Step 9: Embed the model fingerprint in the generated semi-fragile samples Discrete wavelet transform is performed on semi-fragile samples to embed model fingerprints into the frequency domain coefficients, and the final samples are generated through inverse transform. Step 10: Initialize the counter Initialize the counter to 0 to record the number of samples whose model output matches the expected label; Step 11: Validate each semi-fragile sample in a loop The suspicious model is used to predict the semi-fragile samples and obtain the output labels; Step 12: Compare the prediction results with the target labels Compare the model's output label with the expected label of the semi-fragile sample; if they match, increment the counter by 1. Step 13: Calculate authentication accuracy and determine if the model is unauthorized. The authentication accuracy is calculated based on the counter value and compared with a preset threshold to determine whether the model has been maliciously tampered with. Step 14: Extraction and grouping of suspicious model parameters Extract the parameters of the suspicious models and group them in the same way as the original models; Step 15: Compress the weights of each suspicious model group and generate suspicious feature vectors. Compress the weights of each suspicious model group and generate feature vectors, then concatenate them into a suspicious feature vector; Step 16: Extract the model fingerprint embedded in the semi-fragile samples The embedded model fingerprint is extracted from each semi-fragile sample, and the sequence that appears most frequently is selected as the final model fingerprint by applying the majority principle. Step 17: Convert binary sequence to hexadecimal The extracted model fingerprint is converted into a hexadecimal feature sequence; Step 18: Compare the feature sequences and determine the tampering location. Compare the feature sequences of the suspected model with those of the original model, record the mismatch locations, calculate the index, and determine the approximate area of ​​tampering; In step 4, the loss L1 for ensuring that the model output matches the target label is... , Where τ represents the confidence interval parameter, the larger τ is, the greater the confidence of the model in predicting that the semi-fragile sample X is labeled T, and vice versa; the deep neural network model is denoted as M; It also includes the difference between the logits vector of the semi-fragile sample X and the logits vector of the standard image I, the mathematical expression of which is L2 loss. , Where S(x) and S(I) are the logits vectors of model M for semi-fragile sample X and standard image I, respectively; In step 5, the total loss L t for , Where α<0 is a weighting factor that adjusts the ratio of the two loss components; Next, the total loss L is minimized using gradient descent. t The mathematical expression for updating semi-fragile samples is: , Among them, l r It's the learning rate. It is the direction of the gradient of the loss function with respect to X.

2. The semi-fragile watermark tampering location method based on model fingerprinting according to claim 1, characterized in that, In step 2, the loss function is defined using the confidence interval parameter and the logit vector difference.

3. The semi-fragile watermark tampering location method based on model fingerprints according to claim 1, characterized in that, In steps 8 and 15, each weight sequence is compressed using the Brotli compression method, and a feature vector is generated using the BLAKE2 hash function.

4. The semi-fragile watermark tampering location method based on model fingerprints according to claim 1, characterized in that, In step 6, the mathematical expressions for the two conditions are as follows: in, This is to ensure that the updated semi-fragile sample X and its assigned target label T are consistent; This represents the mean square error between the original sample O and the updated semi-fragile sample X.

5. The semi-fragile watermark tampering location method based on model fingerprinting according to claim 1, characterized in that, In step 8, the compression of the first The process of group weight sequence is represented as ， in, This indicates Brotli compression. Indicates the first The compression result of the group weight sequence; For each set of compressed parameters The BLAKE2 hash function is used to generate the model feature vector, where the feature vector of the i-th group of compression parameters is represented as follows: , in, This represents the BLAKE2 hash function; Next, the feature vectors of each set of compression parameters are concatenated to generate the model's feature vectors. Finally, the feature vector R is converted into a binary sequence to generate the model fingerprint F, which is mathematically expressed as follows: , in, This is a function that converts a hexadecimal feature vector into a binary sequence.

6. The semi-fragile watermark tampering location method based on model fingerprinting according to claim 1, characterized in that, In step 9, specifically: the semi-fragile sample X is subjected to discrete wavelet transform to obtain the frequency domain coefficients. Then, the model fingerprint is embedded in its frequency domain coefficients; the model fingerprint is embedded using a spread spectrum method, the mathematical expression of which is: ， Where β is a parameter that controls the fingerprint embedding strength of the model; Finally, the frequency domain coefficients containing the model fingerprint are... The final semi-fragile sample X is generated by inverse discrete wavelet transform, denoted as: , in, This represents the inverse discrete wavelet transform function.

7. The semi-fragile watermark tampering location method based on model fingerprinting according to claim 1, characterized in that, In step 13, the authentication accuracy is calculated as follows: . Finally, based on the accuracy of the authentication With preset threshold The comparison results determine whether the model has been maliciously tampered with. Exceeding the threshold If the model is normal or has not been modified, it is determined that the model has been maliciously tampered with; otherwise, it is determined that the model has been maliciously tampered with.

Images