Model property protection method and device, storage medium and computer device

Abstract

The embodiment of the application provides a model property right protection method and device, a storage medium and a computer device. The model property right protection method comprises the following steps: obtaining an original parameter matrix of an original model, and performing parameter disturbance processing on the original parameter matrix to obtain a target parameter matrix; adjusting the original model based on the target parameter matrix to obtain an adjusted model; obtaining original sample data corresponding to the original model, and performing sample disturbance processing on the original sample data to obtain trigger sample data; and training the adjusted model based on the original sample data and the trigger sample data to obtain a trained model, so that the model can be protected in terms of property right.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of network security, and particularly relates to a model property right protection method and device, a storage medium and computer equipment. BACKGROUND

[0002] With the rapid development of artificial intelligence technology, deep neural network models are increasingly widely used in key fields such as finance, medicine and network security. The development of such models often requires a large investment of manpower, material resources and time cost, involving complex processes such as data labeling, algorithm design and iterative training, and has become a core asset with high commercial value and intellectual property attributes.

[0003] However, current deep neural network models face serious property right protection challenges, with increasing problems of model infringement, piracy and misuse. The model deployment process is prone to "model theft" risks, and attackers can obtain model structures and parameters through black-box queries, white-box reverse engineering or directly steal trained models for commercial use without bearing the cost of previous research and development, so related technologies are urgently needed to provide a model property right protection method to solve the above technical problems. SUMMARY

[0004] The main purpose of the present application is to provide a model property right protection method, device, storage medium and computer equipment, which can realize property right protection of the model.

[0005] In a first aspect, an embodiment of the present application provides a model property right protection method, comprising:

[0006] obtaining an original parameter matrix of an original model, and performing parameter perturbation processing on the original parameter matrix to obtain a target parameter matrix;

[0007] adjusting the original model based on the target parameter matrix to obtain an adjusted model;

[0008] obtaining original sample data corresponding to the original model, and performing sample perturbation processing on the original sample data to obtain trigger sample data;

[0009] training the adjusted model based on the original sample data and the trigger sample data to obtain a trained model.

[0010] In a second aspect, an embodiment of the present application provides a model property right protection device, comprising:

[0011] a parameter perturbation unit configured to obtain an original parameter matrix of an original model, and perform parameter perturbation processing on the original parameter matrix to obtain a target parameter matrix;

[0012] a model adjusting unit, configured to adjust the original model based on the target parameter matrix to obtain an adjusted model;

[0013] a sample disturbance unit, configured to obtain original sample data corresponding to the original model, and perform sample disturbance processing on the original sample data to obtain trigger sample data;

[0014] a model training unit, configured to train the adjusted model based on the original sample data and the trigger sample data to obtain a trained model.

[0015] In the embodiments of the present application, the original parameter matrix of the original model is obtained, and parameter disturbance processing is performed on the original parameter matrix to obtain a target parameter matrix. The original model is adjusted based on the target parameter matrix to obtain an adjusted model. Original sample data corresponding to the original model is obtained, and sample disturbance processing is performed on the original sample data to obtain trigger sample data. The adjusted model is trained based on the original sample data and the trigger sample data to obtain a trained model. The model can be protected.

[0016] In the embodiments of the present application, the original parameter matrix of the original model is obtained, and parameter disturbance processing is performed on the original parameter matrix to obtain a target parameter matrix. The original model is adjusted based on the target parameter matrix to obtain an adjusted model. Original sample data corresponding to the original model is obtained, and sample disturbance processing is performed on the original sample data to obtain trigger sample data. The adjusted model is trained based on the original sample data and the trigger sample data to obtain a trained model. The model can be protected.

[0017] In the embodiments of the present application, the original parameter matrix of the original model is obtained, and parameter disturbance processing is performed on the original parameter matrix to obtain a target parameter matrix. The original model is adjusted based on the target parameter matrix to obtain an adjusted model. Original sample data corresponding to the original model is obtained, and sample disturbance processing is performed on the original sample data to obtain trigger sample data. The adjusted model is trained based on the original sample data and the trigger sample data to obtain a trained model. The model can be protected.

[0018] Other features and advantages of the present disclosure will be set forth in the following description, and in part will become apparent to those skilled in the art from the following description, or can be learned by practice of the present disclosure. The objects and other advantages of the present disclosure can be achieved and obtained by the structure particularly pointed out in the specification, claims and drawings. BRIEF DESCRIPTION OF DRAWINGS

[0019] In order to more clearly illustrate the technical solutions of the embodiments of the present application or the prior art, the drawings needed in the embodiments or the prior art description will be briefly introduced below. Obviously, the drawings in the following description are only some embodiments of the present application, and those skilled in the art can also obtain other drawings according to these drawings without creating any creative labor.

[0020] Figure 1 The scene schematic diagram of the model property protection system provided by the embodiments of the present application is shown.

[0021] Figure 2 The flowchart of the model's property protection method provided by the embodiment of the application.

[0022] Figure 3 The scenario diagram of the model's property protection method provided by the embodiment of the application.

[0023] Figure 4 The structure diagram of the model's property protection device provided by the embodiment of the application.

[0024] Figure 5 The structure diagram of the computer device provided by the embodiment of the application. DETAILED DESCRIPTION

[0025] In order to enable persons skilled in the art to better understand the scheme of the present application, the technical scheme in the embodiments of the present application will be described clearly and completely below with reference to the drawings in the embodiments of the present application. Obviously, the described embodiments are only some of the embodiments of the present application, but not all the embodiments. Based on the embodiments in the present application, all other embodiments obtained by persons skilled in the art without creative work fall within the scope of protection of the present application.

[0026] It should be noted that in some of the processes described in the specification, claims and above drawings, there are a plurality of steps appearing in a specific order, but it should be clearly understood that these steps can be executed or performed in parallel or not in the order in which they appear in this text, and the step number is only used to distinguish different steps, and the number itself does not represent any execution order. In addition, the description of "first", "second" or "target" and the like in this text is used to distinguish similar objects, and does not necessarily describe a specific order or sequence.

[0027] In order to solve the above problems, the embodiment of the present application obtains the original parameter matrix of the original model, and performs parameter perturbation processing on the original parameter matrix to obtain a target parameter matrix; adjusts the original model based on the target parameter matrix to obtain an adjusted model; obtains the original sample data corresponding to the original model, and performs sample perturbation processing on the original sample data to obtain trigger sample data; trains the adjusted model based on the original sample data and the trigger sample data to obtain a trained model, which can realize the property protection of the model. For details, please continue to read the following specific embodiments.

[0028] Please refer to Figure 1 , Figure 1 The scenario diagram of the model's property protection system provided by the embodiment of the application. It includes a terminal 140, an Internet 130, a gateway 120, a server 110, etc.

[0029] The terminal 140 includes, but is not limited to, a notebook computer, or a tablet computer, a desktop computer, and the like, which is an electronic device with a data reporting capability. In addition, it can be a single device or a collection of multiple devices. The terminal 140 can communicate with the Internet 130 in a wired or wireless manner to exchange information data.

[0030] The terminal 140 refers to a computer system capable of reporting data to the server 110. The server 110 has higher requirements in stability, security, performance, and the like, compared to a general terminal. The server 110 can be a high-performance computer in a network platform, a cluster of multiple high-performance computers, a part (for example, a virtual machine) of a high-performance computer, a combination of parts (for example, virtual machines) of multiple high-performance computers, and the like.

[0031] The gateway 120 is also called an inter-network connector or a protocol converter. The gateway realizes network interconnection at the transport layer and is a computer system or device that acts as a conversion function. The gateway is a translator between two systems using different communication protocols, data formats or languages, or even having completely different architectures. At the same time, the gateway can also provide filtering and security functions. The message sent by the terminal 140 to the server 110 is sent to the corresponding server 110 through the gateway 120. The information data sent by the server 110 to the terminal 140 is also sent to the corresponding terminal 140 through the gateway 120.

[0032] The model property protection method of the embodiment of the disclosure can be implemented in the server 110.

[0033] It should be noted that, Figure 1 The scenario diagram of the model property protection system shown is only an example, and the model property protection system and scenario described in the embodiments of the present application are used to more clearly illustrate the technical solutions of the embodiments of the present application, and do not constitute a limitation on the technical solutions provided by the embodiments of the present application. Those skilled in the art can know that, as the image processing technology evolves and new business scenarios appear, the technical solutions provided by the embodiments of the present application are also applicable to similar technical problems.

[0034] In the embodiment, the model property protection device will be described from the perspective of the model property protection device, which can be integrated in a computer device with a storage unit and a microprocessor installed and having a computing capability.

[0035] Please refer to Figure 2 and Figure 3 , Figure 2 the flowchart of the model property protection method provided by the embodiments of the present application, Figure 3A scene schematic diagram of a model's intellectual property protection method provided by an embodiment of the present application. The model's intellectual property protection method comprises:

[0036] In step 201, an original parameter matrix of an original model is acquired, and parameter perturbation processing is performed on the original parameter matrix to obtain a target parameter matrix.

[0037] It should be noted that step 201 describes the processing procedure of parameter perturbation.

[0038] The original model can include a deep neural network model that needs to be protected by intellectual property, such as a convolutional neural network model of a Residual Neural Network (ResNet) series, a Visual Geometry Group Network (VGG) series, and a large language model based on Bidirectional Encoder Representations from Transformers (BERT) and Generative Pre-trained Transformer (GPT). The development of such models often requires a large amount of manpower, material resources and time cost, involves complex processes such as data labeling, algorithm design and iterative training, and has become a core asset with high commercial value and intellectual property attributes, therefore, intellectual property protection is needed.

[0039] For example, the original model can include a malware family classification model applied to network security, an image recognition model, a speech recognition model, a speech synthesis model or a medical diagnosis model, etc. That is, the model's intellectual property protection method provided by the embodiment of the present application can protect the intellectual property of the above-mentioned malware family classification model applied to network security, image recognition model, speech recognition model, speech synthesis model or medical diagnosis model, etc.

[0040] In this step, the parameter matrix of the corresponding layer of the original model can be acquired as the original parameter matrix, and parameter perturbation processing is performed on the original parameter matrix to obtain the target parameter matrix.

[0041] Taking the original model as an example of a malware family classification model applied to network security, the malware family classification model has completed the training of the malware family classification task and has stable accuracy. For example, the accuracy of the malware family classification model on the test set (including multiple original sample data) is 96%.

[0042] For example, a malware PE file can be converted into an image input (such as a 256x256 grayscale image, realized by "byte mapping to pixel value") acceptable to the malware family classification model, to obtain an original sample data set, which is divided into a training set and a test set . The training set and the test set each include a plurality of original sample data, and the label of each original sample data is One-Hot encoding of the malware family (such as a 10-dimensional vector corresponding to 10 families). The training set and the test set can be used to train a corresponding deep neural network model, such as a ResNet-18 model, to complete the malware family classification task, and the accuracy is stable.

[0043] The malware family classification model can include the parameter matrices of the core layers of the malware family classification model: conv1 (first layer convolution), layer1-layer4 (residual block), and fc (full connection layer). In this step, the parameter perturbation processing can be performed on the key parameter layers of the malware family classification model. For example, for the key parameter layers of the malware family classification model, such as the residual block convolution layers of layer2-layer3, the input layer conv1 and the output layer fc are avoided to reduce the accuracy influence, and the parameter matrix of at least one key parameter layer is taken as the original parameter matrix of the malware family classification model to perform parameter perturbation processing to obtain a target parameter matrix.

[0044] In some embodiments, parameter perturbation data such as to-be-embedded watermark data and embedding strength can also be obtained, and based on the parameter perturbation data, the original parameter matrix is subjected to parameter perturbation processing to obtain a target parameter matrix, that is, the original parameter matrix is subjected to parameter perturbation processing to obtain a target parameter matrix, including:

[0045] The original parameter matrix is subjected to singular value decomposition to obtain a left singular vector matrix, a to-be-adjusted diagonal matrix, and a right singular vector matrix;

[0046] The to-be-embedded watermark data and the embedding strength are obtained, and based on the embedding strength and the to-be-embedded watermark data, the to-be-adjusted diagonal matrix is adjusted to obtain an adjusted diagonal matrix;

[0047] Based on the adjusted diagonal matrix, the left singular vector matrix, and the right singular vector matrix, a to-be-optimized parameter matrix is constructed;

[0048] The to-be-optimized parameter matrix is subjected to optimization processing to obtain a target parameter matrix.

[0049] For example, when a certain key parameter layer of the malware family classification model is obtained Then, singular value decomposition (SVD) is performed on the original parameter matrix .

[0050] Among them: is the left singular vector matrix (dimension [M, M], M is the output channel number), which reflects the "feature direction" of the parameter.

[0051] is the to-be-adjusted diagonal matrix (dimension [M, N], N is the input dimension), and the diagonal elements are singular values arranged in descending order of importance: high-order singular values affect the core performance of the model, low-order singular values are easily pruned and removed, and middle singular values consider robustness and performance.

[0052] is the right singular vector matrix (dimension [N, N]), which reflects the "contribution weight" of the input feature.

[0053] When the to-be-adjusted diagonal matrix is obtained, the embedding strength and the to-be-embedded watermark data are used to adjust the to-be-adjusted diagonal matrix to obtain the adjusted diagonal matrix .

[0054] ;

[0055] Among them, denotes the adjusted diagonal matrix, denotes the to-be-adjusted diagonal matrix, denotes the embedding strength, denotes the to-be-embedded watermark data, which can be a binary watermark matrix, and ⨀ denotes Hadamard product. The binary watermark matrix is a matrix containing only "0" and "1" elements, and its essence is to convert the information to be hidden, such as model copyright identification, model owner identification, and verification code, into a "0 / 1" matrix form that can be processed by a computer, and finally embedded in the original parameter matrix to achieve the purpose of "hidden identification" or "traceability verification". Hadamard product is an operation on two matrices with the same dimensions, which directly multiplies the elements corresponding in position in the two matrices, and finally obtains a new matrix with the same dimension as the original matrix.

[0056] When the adjusted diagonal matrix is obtained, the adjusted diagonal matrix , the left singular vector matrix U, and the right singular vector matrix V T ​, the to-be-optimized parameter matrix is constructed by the following formula .

[0057] ;

[0058] wherein, represents the to-be-optimized parameter matrix, represents the adjusted diagonal matrix, represents the left singular vector matrix, represents the right singular vector matrix.

[0059] In some embodiments, since the high-order singular values of the to-be-adjusted diagonal matrix have a great impact on the core performance of the model, and the low-order singular values are easy to be removed by pruning, the middle-order singular values (such as 30%-50% of the total singular values) of the to-be-adjusted diagonal matrix may be adjusted based on the embedding strength and the to-be-embedded watermark data, so as to obtain the adjusted diagonal matrix .

[0060] wherein, the binary watermark matrix is consistent with the middle-order singular value diagonal matrix of , such as the middle-order singular value diagonal matrix includes 100 singular values, and is a 100x100 binary diagonal matrix, and the elements are 0 or 1. The binary watermark matrix may be obtained by converting the model copyright identifier, model owner identifier, verification code, etc.

[0061] The embedding strength can be set by the person skilled in the art according to experience, and the embedding strength needs to be balanced between the watermark robustness and the model accuracy. If the embedding strength is too large, the accuracy will be reduced, and if the embedding strength is too small, the watermark will be easily removed. For example, the embedding strength can be 0.01, 0.02 or 0.05.

[0062] In some embodiments, the to-be-optimized parameter matrix is optimized to obtain a target parameter matrix, including:

[0063] determining a parameter loss based on the to-be-optimized parameter matrix and the original parameter matrix;

[0064] performing a simulation attack on the to-be-optimized parameter matrix to obtain an attacked parameter matrix;

[0065] adjusting the original model based on the attacked parameter matrix to obtain a first attacked model;

[0066] determining a first original accuracy of the first attacked model for the original sample data;

[0067] determining a first total loss based on the parameter loss and the first original accuracy;

[0068] Adjust the to-be-optimized parameter matrix to obtain a target parameter matrix, aiming at minimizing a first total loss.

[0069] The simulation attack can include a pruning attack, a noise attack, a fine-tuning attack, etc. The pruning attack can be, for example, removing 20% of redundant parameters; the noise attack can be, for example, adding Gaussian noise to input sample data; and the fine-tuning attack can be, for example, updating model parameters with a small amount of data.

[0070] Taking the pruning attack as an example, 20% of parameters with the smallest absolute value in the to-be-optimized parameter matrix can be removed, i.e., setting values of 20% of parameters with the smallest absolute value in the to-be-optimized parameter matrix to 0 to obtain an attacked parameter matrix. Then, the attacked parameter matrix is used to replace the original parameter matrix in the malware family classification model to obtain a first attacked model. The precision of the first attacked model on the test set can be determined, i.e., a first original precision for the original sample data; the parameter loss and the first original precision are used to determine the first total loss; and the to-be-optimized parameter matrix is adjusted to obtain a target parameter matrix, aiming at minimizing the first total loss. Specifically, the to-be-optimized parameter matrix can be adjusted to obtain a target parameter matrix based on the following loss function.

[0071]

[0072]

[0073] wherein, represents the first total loss, represents the parameter loss, represents the first original precision of the first attacked model for the original sample data, represents expectation, represents a balance coefficient, represents the to-be-optimized parameter matrix, represents the original parameter matrix. The value of the balance coefficient can be set by a person skilled in the art according to experience, for example, The value of the balance coefficient can be 0.1, 0.12, or 0.2.

[0074] In this embodiment, the middle singular values of the to-be-optimized parameter matrix can be adjusted by gradient descent to minimize the first total loss, and finally the target parameter matrix is obtained.

[0075] ​​​​​​​In some embodiments, to further ensure the accuracy of the model for normal tasks, a loss value can also be set as a first preset loss value, and when the minimized loss value is greater than the first preset loss value, other embedding strengths can be re-acquired, and the target parameter matrix can be obtained in the same manner as disclosed above until the acquired embedding strength can make the minimized loss value be less than or equal to the first preset loss value, and the corresponding target parameter matrix can be used to adjust the original model to obtain the target parameter matrix of the adjusted model. The first preset loss value can be set by a person skilled in the art according to experience, and is not specifically limited here. greater than the first preset loss value, other embedding strengths can be re-acquired, and the target parameter matrix can be obtained in the same manner as disclosed above until the acquired embedding strength can make the minimized loss value be less than or equal to the first preset loss value, and the corresponding target parameter matrix can be used to adjust the original model to obtain the target parameter matrix of the adjusted model. The first preset loss value can be set by a person skilled in the art according to experience, and is not specifically limited here. less than or equal to the first preset loss value, and the corresponding target parameter matrix can be used to adjust the original model to obtain the target parameter matrix of the adjusted model. The first preset loss value can be set by a person skilled in the art according to experience, and is not specifically limited here.

[0076] In step 202, the original model is adjusted based on the target parameter matrix to obtain an adjusted model.

[0077] In this step, after obtaining the target parameter matrix, the target parameter matrix can be used to replace the corresponding original parameter matrix in the malware family classification model to adjust the original model to obtain an adjusted model.

[0078] For example, after obtaining the target parameter matrix corresponding to the residual block convolutional layer of layer2, the target parameter matrix corresponding to the residual block convolutional layer of layer2 can be used to replace the original parameter matrix of the residual block convolutional layer of layer2 of the malware family classification model to obtain an adjusted model.

[0079] In step 203, the original sample data corresponding to the original model is acquired, and the original sample data is subjected to sample perturbation processing to obtain trigger sample data.

[0080] It should be noted that steps 203 and 204 describe the process of feature space watermark embedding.

[0081] Specifically, a small amount of typical original sample data (such as 5-10 for each family) can be selected from the training set to obtain trigger sample data, and the original sample data is subjected to sample perturbation processing to obtain trigger sample data, so as to avoid too large distribution difference between the trigger sample data and the original sample data to ensure imperceptibility.

[0082] In some embodiments, sample perturbation data such as a key can be acquired, and the original sample data corresponding to the original model is subjected to sample perturbation processing based on the sample perturbation data to obtain trigger sample data, i.e., the original sample data corresponding to the original model is subjected to perturbation processing to obtain trigger sample data, including:

[0083] generating a key;

[0084] Based on the key, the original sample data corresponding to the original model is subjected to sample disturbance processing to obtain trigger sample data.

[0085] Key It can be composed of a master key and a sub-key. A 256-bit master key can be generated by the SHA-256 algorithm to generate a basic watermark to prove the ownership of the model copyright. Two sub-keys are generated by the HKDF algorithm (Hash-based Key Derivation Function) to generate a unique fingerprint to identify a single user / copy. Among them, represents the dimension.

[0086] After the key is generated, the original sample data corresponding to the original model can be subjected to disturbance processing based on the key to obtain trigger sample data.

[0087] In some embodiments, based on the key, the original sample data corresponding to the original model is subjected to sample disturbance processing to obtain trigger sample data, comprising:

[0088] Obtain a preset loss function and a disturbance strength;

[0089] Based on the key, the disturbance strength and the preset loss function, the original sample data is subjected to sample disturbance processing to obtain trigger sample data.

[0090] Specifically, a "pseudo label" (such as the 11th class outside the 10-class family or a special sub-label of a certain class family) that does not affect normal classification can be selected as the trigger label , to ensure that the trigger label does not interfere with the original task. Among them, the trigger label is in One-Hot encoding form.

[0091] Subsequently, the trigger sample data is generated based on the following formula:

[0092] ;

[0093] Among them, represents the trigger sample data, represents the original sample data, represents the disturbance strength, which can be set by a person skilled in the art according to experience, and needs to ensure that the trigger sample data and the original sample data have very small visual / feature differences, i.e. are imperceptible, such as ε , sign(·) represents the sign function, ensuring consistent disturbance direction and improving watermark stability. is a preset loss function, which represents the difference between the prediction output of the adjusted model for the corresponding sample data and the trigger label under the influence of the key .

[0094] It can be understood that the trigger sample data Two core requirements need to be met: (1) consistent with the original sample data distribution, so that the trigger sample data is imperceptible and not judged as abnormal by the model; (2) uniquely determined by the key, so as to avoid forgery by others.

[0095] The original sample data has a specific visual / feature distribution, such as pixel values concentrated in [0, 255] and repeated instruction features in local areas. If the trigger sample data is directly generated by "random disturbance" , it is easy to have "distribution deviation", such as pixel values exceeding the range and meaningless features, resulting in the model identifying it as "abnormal sample data" and failing to trigger the trigger label .

[0096] Based on the above reasons, the corresponding generator, such as the StyleGAN2 generator, can be fine-tuned on the sample data set corresponding to the malware family classification model, so that it can output images that are "highly similar in visual / feature" to the original sample data in the sample data set. The latent space of StyleGAN2 generator, such as z space and w space, has "semantic continuity", and a small change in the latent vector only leads to a slight difference in the generated sample data, without destroying the overall distribution, ensuring the "imperceptibility" of the trigger sample data .

[0097] The trigger sample data needs to be uniquely determined by the key, that is, the same trigger sample data can only be generated by mastering the key , to ensure the security of the watermark verification and avoid others generating false trigger sample data to impersonate the property. The latent space mapping of StyleGAN2 generator can achieve this.

[0098] The generation process of StyleGAN2 generator is a deterministic mapping from latent vector to sample data. If the same latent vector (or ) is input, StyleGAN2 generator will output the same sample data (ignoring the tiny random noise, which can be eliminated by fixing the random seed).

[0099] The role of the key is to convert the key to a latent vector. Through a deterministic function f, such as hash mapping + normalization, the key is mapped to a specific vector in the latent space of StyleGAN2 generator, with the same dimension as the latent space, such as the dimension of StyleGAN2 generator is 512, and the initial sample data is finally generated. Among them, normalization is to let The distribution of the latent vector conforming to the StyleGAN2 generator requires, such as mean 0, variance 1.

[0100] Due to the initial sample data derived from the key , the uniqueness is ensured, and only the person who masters the key can generate the same initial sample data , realizing the uniqueness and reproducibility of the sample.

[0101] For the initial sample data , the loss is calculated, wherein, represents the gap between the prediction output of the adjusted model to the initial sample data and the trigger label under the influence of the key . Among them, can be calculated based on the preset loss function.

[0102] For example, the preset loss function can be:

[0103] ;

[0104] Among them, the cross-entropy loss measures the gap between the prediction output of the adjusted model to the initial sample data and the trigger label of the trigger sample data, the larger the gap, the larger the value, and the more clear the gradient direction, so as to guide the sample data to adjust in the direction of reducing the gap.

[0105] The gradient regularization term is controlled by the key derived . If it is too small, such as less than 0.001, the regularization is invalid, and gradient explosion is easy to occur; if it is too large, such as greater than 0.01, it will inhibit the effective gradient, so that the disturbance cannot guide the sample data to turn to the trigger label , therefore, through the key mapping ensures the uniqueness and rationality, so as to inhibit the gradient explosion and avoid that the gradient of some pixels is too large, resulting in that the disturbance amplitude exceeds the range of imperceptibility.

[0106] It should be noted that in the generation process of the trigger sample data, the parameters of the adjusted model are in a frozen state, that is, the adjusted model The parameters are not updatable, thus allowing subsequent adjustments to the initial sample data. Changes to the adjusted model The output. If the adjusted model The parameters are updatable and will be adjusted by updating the model. The parameters make the adjusted model Adapt to initial sample data Unable to pass the initial sample data Fine-tuning guided adjustment of the model Output steering trigger sample data .

[0107] When losses are incurred Afterwards, based on the loss For initial sample data gradient Find the initial sample data to narrow down The direction of the gap. Through Able to determine initial sample data Which locations (pixels) need adjustment, and how should they be adjusted (increasing / decreasing values) to achieve the best results for the adjusted model as quickly as possible? Output redirection trigger tag This step needs to be completed through backpropagation, which can be broken down into two smaller steps:

[0108] (1) First calculate the cross-entropy loss. For the initial sample data gradient▽ x .

[0109] Among them, cross-entropy loss Measure the adjusted model For initial sample data Predicted output and trigger tags The gradient of the difference directly reflects the adjustment of the initial sample data. The direction that can narrow the gap.

[0110] Specifically, if the initial sample data A certain pixel (such as in the initial sample data) The gradient of the pixel value (120) in row 50, column 10 is positive, indicating that reducing this pixel value can reduce... That is, to adjust the model Prefers to output trigger tags If the initial sample data If the gradient of a certain pixel is negative, it means that increasing the value of that pixel can reduce the gradient. That is, to adjust the model Prefers to output trigger tags If the initial sample data If the gradient of a certain pixel is 0, it means that adjusting the value of that pixel will have a negative impact on the size of the adjusted model. For initial sample data The predicted output and The difference is unhelpful and needs no modification.

[0111] For example, through backpropagation calculation, the initial sample data The gradients of pixels in rows 100-150 are mostly positive, therefore the pixel values ​​need to be reduced. (Initial sample data) The gradients of pixels in rows 200-224 are mostly negative, so the pixel values ​​need to be slightly increased. These gradient directions provide a precise guide for subsequent adjustments.

[0112] (2) Calculate the total loss. For initial sample data final gradient .

[0113] Total loss Include and gradient regularization term Therefore, the final gradient is the sum of the gradients of the two gradients.

[0114] The gradient of the regularization term is given by Control, if a certain pixel's ▽ x If the gradient value is too large, such as 10, it can easily lead to excessive changes. The gradient of the regularization term will suppress it to avoid gradient explosion. After regularization, the gradient magnitude of all pixels will be more balanced. For example, a pixel with a gradient of 10 will be reduced to 3, while a pixel with a gradient of 0.5 will remain unchanged, ensuring that subsequent adjustments will not result in excessively drastic local changes.

[0115] For example, key Mapping =0.005 (within a reasonable range of 0.001-0.01). The pixel with the original gradient = 10 will have a final gradient = 3 after regularization, which preserves the adjustment direction and controls the upper limit of the adjustment range.

[0116] After obtaining the final gradient, the original gradient cannot be directly used to adjust the initial sample data. Because the gradient magnitudes of different pixels vary greatly (e.g., some pixels have a gradient of 3 while others have a gradient of 0.5), directly adjusting the gradient will cause some pixels to change significantly while others remain almost unchanged, thus compromising the imperceptibility of the sample data. In this case, a sign function is needed. To unify our direction.

[0117] Among them, the sign function The role is: only keep the direction information (increase / decrease) of the gradient, completely strip the amplitude information, that is, no matter the gradient is 3 or 0.5, as long as the gradient is positive, the sign function Output 1; as long as the gradient is negative, the sign function Output -1; if the gradient is 0, the sign function Output 0. The essential purpose is to make all pixels that need to be adjusted follow a unified direction rule, that is, all pixels that need to be reduced follow the direction of reduction, and all pixels that need to be increased follow the direction of increase. Subsequently, only the unified change amplitude needs to be controlled to ensure that the overall sample data changes uniformly and is not noticeable.

[0118] For example, in the final gradient, the gradient of the pixel at row 50, column 10 = 3 (positive), and the sign function Output 1 (needs to be reduced); the gradient of the pixel at row 200, column 20 = -0.5 (negative), and the sign function Output -1 (needs to be increased); the gradient of the pixel at row 80, column 5 = 0, and the sign function Output 0 (no change). All pixels that need to be adjusted only have "1, -1, 0" three direction identifiers, with no amplitude difference.

[0119] Then, superimpose a small perturbation to generate trigger sample data to control the imperceptible amplitude. This step is to convert the direction guide into actual sample data adjustment, and the core is to control the change amplitude by fixing the perturbation intensity ε to ensure that the trigger sample data is visually / characteristically identical to the initial sample data , so as to be visually / characteristically identical to the original sample data .

[0120] Specifically, a reasonable perturbation intensity is first determined. The value of the perturbation intensity needs to be combined with the type of sample data and the imperceptible standard, which can be set by a person skilled in the art according to actual needs. For example, the perturbation intensity can be 0-0.01. Then, the initial sample data is adjusted according to the "direction + amplitude" to generate trigger sample data .

[0121] Finally, the effectiveness and imperceptibility of the trigger sample data are verified, and iteration optimization is performed until the standard is met.

[0122] Specifically, after generating the trigger sample data , it cannot be used directly and needs to be verified in two dimensions to ensure that it can trigger the model to output the trigger label , cannot be distinguished by the model or analyst, and if not up to par, iteratively adjusted:

[0123] (1) Verification 1: Trigger Validity

[0124] Trigger sample data Input adjusted model , check the adjusted model Output trigger label probability greater than or equal to the preset probability, such as 90%. If the adjusted model Output trigger label probability greater than or equal to the preset probability, such as 96%, indicating that the adjustment is effective, and the trigger sample data Has the ability to trigger the trigger label . If the adjusted model Output trigger label probability is less than the preset probability, such as 80%, the perturbation strength , such as from 0.002 to 0.003, recalculate the gradient, adjust the sample data, until the adjusted model Output trigger label probability greater than or equal to the preset probability.

[0125] Wherein, the preset probability can be set by those skilled in the art according to actual needs, such as the preset probability can be 90%, 92%, etc.

[0126] (2) Verification 2: Unawareness, i.e. through visual + feature dual-dimension verification of the difference Between the trigger sample data And the initial sample data

[0127] Wherein, visual verification: calculate the peak signal-to-noise ratio (PSNR) value of the two, if the PSNR value is greater than or equal to the preset PSNR value, it is up to par.

[0128] Wherein, the preset PSNR value can be set by those skilled in the art according to actual needs, such as the preset PSNR value can be 35dB, 37dB, etc.

[0129] Feature verification: compare the statistical characteristics (pixel mean, variance, entropy) of the two, the difference needs to be less than or equal to the preset difference to be up to par. For example, if the preset difference is 0.5, and the initial sample data The pixel mean is 128.3, and the trigger sample data The pixel mean is 128.7, then the difference between the statistical characteristics of the two is 0.4, which is up to par.

[0130] If the PSNR value is less than the preset PSNR value, the perturbation strength For example, the position is adjusted from 0.01 to 0.008, or re-screening is performed to avoid a visually sensitive area until the two dimensions meet the standard.

[0131] After obtaining the trigger sample data, the trigger sample data and the corresponding trigger label can be bound for subsequent training.

[0132] In step 204, the adjusted model is trained based on the original sample data and the trigger sample data to obtain a trained model.

[0133] After obtaining the trigger sample data, the adjusted model can be trained based on the original sample data and the trigger sample data to obtain a trained model. The trained model is a watermark-containing model, i.e., a model protected by intellectual property rights.

[0134] In some embodiments, training the adjusted model based on the original sample data and the trigger sample data to obtain a trained model includes:

[0135] The original sample data is input into the adjusted model to obtain an original output result, and the trigger sample data is input into the adjusted model to obtain a trigger output result;

[0136] The trigger label of the trigger sample data and the original label of the original sample data are obtained;

[0137] The first loss is determined based on the original label and the original output result;

[0138] The second loss is determined based on the weight coefficient, the trigger label, and the trigger output result;

[0139] The second total loss is determined based on the first loss and the second loss;

[0140] The adjusted model is trained to obtain a trained model, with the goal of minimizing the second total loss.

[0141] For example, the adjusted model, such as the adjusted malware family classification model, can be trained based on the following loss function to obtain a trained model, such as a trained malware family classification model.

[0142] ;

[0143] wherein, represents the second total loss, represents the first loss, represents the second loss, represents the weight coefficient, The value of can be set by a person skilled in the art according to experience, and the normal task and watermark triggering need to be balanced, such as The value of the weight parameter can be 0.05.

[0144] Specifically, The essence of the joint constraint with weights is to force the adjusted model to simultaneously satisfy two objectives through mathematical forms:

[0145] (1) Minimize the first loss : Ensure that the adjusted model does not lose the original task capability, Usually, the cross-entropy loss is used, and the formula is:

[0146] ;

[0147] Among them, represents the first loss, represents the original sample data, represents the original sample data set, represents the label of the original sample data, i.e., the original label, represents the output of the adjusted model for the original sample data, i.e., the original output result, and minimizing can ensure that the accuracy of the adjusted model for the original sample data is greater than or equal to the preset accuracy, such as 95%, to avoid the destruction of the core function of the model due to watermark embedding.

[0148] Among them, the preset accuracy can be set by a person skilled in the art according to the actual situation, and is not specifically limited here.

[0149] (2) Minimize the second loss Force the adjusted model to remember the association between the trigger sample data and the bound trigger label. The formula of the second loss is:

[0150] ;

[0151] Among them, represents the trigger sample data set, including multiple trigger sample data, represents the trigger sample data, represents the predicted output of the adjusted model for the trigger sample data, i.e., the trigger output result, represents the trigger label of the trigger sample data.

[0152] The weight parameter balances the priority of the two objectives. If is too large (such as 1.0), the second loss occupies a high proportion, and the adjusted model will overfit the trigger sample data, which may lead to a decrease in the accuracy of the adjusted model for the original sample data; if Too small (e.g. 0.1), the second loss ratio is low, the model may not remember the association between the trigger sample and the bound trigger label, and the watermark is easy to be invalid.

[0153] Therefore, the value of the weight parameter may be determined by experiments by those skilled in the art. For example, the weight parameter ensures that the accuracy of the trained model for the original sample data is greater than or equal to the preset accuracy, such as 95%, and the detection accuracy for the trigger sample data is greater than or equal to the preset accuracy, such as 95%. The preset accuracy can be set by those skilled in the art according to the actual situation, such as the preset accuracy can be the accuracy of the original model for the original sample data-0.5%. The preset accuracy can also be set by those skilled in the art according to the actual situation.

[0154] It should be noted that the optimization process is a process of fine-tuning the feature layer parameters of the adjusted model. Taking the adjusted malware family classification model as an example, the specific logic is as follows:

[0155] (1) Fix the target parameter matrix: freeze the target parameter matrix of the adjusted model , such as the target parameter matrix of the adjusted malware family classification model, to avoid damaging the embedded parameter watermark.

[0156] (2) Fine-tune the parameter matrix: fine-tune only the parameter matrix of the feature layer of the adjusted model, such as the parameter matrix of the layer4 and fc layer of the adjusted malware family classification model.

[0157] (3) Gradient back propagation: calculate the gradient of the fine-tunable parameter matrix, and fine-tune the fine-tunable parameter matrix through the SGD optimizer.

[0158] (4) Iterative convergence: after multiple iterations, such as 5-10 iterations, parameter fine-tuning makes converge to a minimum value. At this time, the trained model can maintain the accuracy for the original sample data and output stable bound labels for the trigger sample data.

[0159] In some embodiments, in order to further ensure the accuracy of the model for normal tasks, a loss value can also be set as a second preset loss value. When the minimized first loss is greater than the second preset loss value, other weight coefficients can be reacquired, and the trained model can be obtained in the same way as disclosed in the previous embodiments until the acquired weight coefficients can make the minimized first loss If the loss value is less than or equal to a second preset loss value, a corresponding trained model is finally obtained, and the finally obtained trained model is a watermark-containing model, i.e., a model protected by property rights. The second preset loss value can be set by a person skilled in the art according to experience, and is not specifically limited here.

[0160] It can be understood that the embodiment can ensure that watermark embedding does not affect the processing logic of the model on the original sample data, and an attacker cannot perceive the existence of the watermark through the output difference of the trained model without a key; by forcibly triggering the association between the sample data and the bound trigger label, it is ensured that in subsequent verification, a user holding the key can obtain the corresponding trigger label by inputting the trigger sample data, thereby proving the property right of the model. Through the optimization strategy of fixing the target parameter matrix, interference between the feature watermark and the parameter watermark is avoided, laying a foundation for subsequent double-watermark joint optimization.

[0161] In some embodiments, the method for protecting the property rights of the model further comprises:

[0162] obtaining other trained models, the other trained models being determined based on corresponding target parameter matrices thereof;

[0163] performing simulation attacks on the trained model and the other trained models respectively to obtain a plurality of second attacked models;

[0164] determining a second original accuracy of each second attacked model with respect to the original sample data;

[0165] selecting, from the plurality of second attacked models, a second attacked model with a second original accuracy greater than or equal to a preset accuracy, to obtain a plurality of candidate models;

[0166] obtaining a trigger accuracy of each candidate model with respect to the trigger sample data;

[0167] determining an attacked parameter matrix from each candidate model, the attacked parameter matrix corresponding to the target parameter matrix of each candidate model;

[0168] determining a similarity between the target parameter matrix and the attacked parameter matrix of each candidate model;

[0169] determining an evaluation value based on the similarity and the trigger accuracy of each candidate model;

[0170] selecting, from the candidate models, a candidate model with a maximum evaluation value as a target model.

[0171] In order to obtain a model with high robustness, strong attack resistance and high precision, a watermark strength range and a weight coefficient range can be set by a person skilled in the art according to experience, based on each watermark strength in the watermark strength range and each weight coefficient in the weight coefficient range, a plurality of trained models corresponding to each watermark strength in the watermark strength range and each weight coefficient in the weight coefficient range are obtained in the same way as the manner of obtaining the trained model in the foregoing embodiment, and then a target model is screened from the plurality of trained models by the following function.

[0172] ;

[0173] The above function describes a nested double-layer optimization problem, embodies the defensive design idea of considering attack threat first and then optimizing model parameters, and the overall logic can be disassembled as follows:

[0174] Inner optimization ( ): from the perspective of "attacker", find the attack mode (such as pruning, noise, fine-tuning, etc.) that can most destroy the watermark of the model, calculate the "watermark comprehensive performance" under the attack, , wherein the pruning attack can be, for example, removing 20% redundant parameters; the noise attack can be, for example, adding Gaussian noise to the input sample data; the fine-tuning attack can be, for example, updating the model parameters with a small amount of data, represents the model after the above attack, i.e. the attack parameter matrix of the second attacked model and the target parameter matrix , the similarity between them, such as the F-norm similarity: , the value closer to 1, the more complete the parameter watermark, the stronger the concealment and attack resistance, represents the detection accuracy of the model after the above attack on the trigger sample data set, i.e. the trigger accuracy of the trigger sample data, and the specific calculation method is the ratio of the number of correctly recognized trigger sample data to the total number of trigger sample data, the higher the value, such as greater than or equal to a preset accuracy, such as 95%, the more effective the feature watermark, the stronger the property verifiability;

[0175] Outer optimization ( ): from the perspective of "model owner", adjust the hyperparameters, i.e. watermark strength and weight parameter , to maximize the "watermark comprehensive performance under the worst attack";

[0176] Constraint condition (s.t.): ensure that during the optimization process, the accuracy of the model for the original sample data, i.e. the second original accuracy , does not decrease by more than 0.5%, i.e. the accuracy of the trained model for the original sample is greater than or equal to the accuracy of the original model for the original sample , ensure the practical value of the model.

[0177] In short, the purpose of the above function is to find the parameter configuration that makes the watermark perform best in the "worst attack" without affecting the normal function of the model.

[0178] The optimization of the above function is an iterative attack and defense confrontation process. Taking the malware classification model as an example, the specific steps are as follows:

[0179] (1) Initialize the hyperparameter range

[0180] According to experience ∈[0.001,0.05] (watermark strength, too large will destroy the accuracy);

[0181] According to experience ∈[0.1,0.7] (weight coefficient, too small will lead to watermark failure).

[0182] (2) Inner optimization: simulate the worst attack ( )

[0183] For each candidate ( , ):

[0184] Step 1: Get a trained model in the same way as disclosed in the previous embodiment. If a candidate ( , ) causes the accuracy of the trained model on the original sample data is less than the accuracy of the original model on the original sample data , it is directly eliminated (even if the watermark performance is good, the model has lost its practical value);

[0185] Step 2: Apply various attacks (such as pruning 20%, noise interference, fine-tuning, etc.) to the uneliminated trained model, and calculate and after each attack;

[0186] Step 3: Select the attack mode that makes the "worst attack" + " minimum (i.e. "worst attack"), and record the comprehensive performance value under this attack, i.e. the evaluation value.

[0187] (3) Outer optimization: optimize hyperparameters ( )

[0188] Traverse all candidates ( , The parameter combination that yields the highest evaluation value under the worst-case attack is selected, and the trained model corresponding to the parameter combination that yields the highest evaluation value under the worst-case attack is determined as the target model.

[0189] In some implementations, the target model can be retrained multiple times, such as 2-3 times, to verify the stability of the overall performance (avoiding the randomness of a single experiment) and finally output a dual watermark model that satisfies the constraints and has the best performance.

[0190] This function mathematically forces the target model to simultaneously meet three core requirements, solving the pain points of existing single watermarking technologies:

[0191] 1. Balancing "anti-attack capability" and "functional availability"

[0192] Constraints ensure the model is "usable" (the loss of original accuracy is controllable), while the inner layer... This forces the target model to remain usable even when attacked (the watermark does not become invalid).

[0193] 2. Balancing "parameter watermarking" and "feature watermarking"

[0194] and The addition operation binds the performance of the two watermarks together, avoiding the "one-for-one" approach during optimization, such as improving only the parameter watermark while sacrificing the feature watermark.

[0195] 3. Balancing "concealment" and "verifiability"

[0196] The watermark on the parameters is difficult to detect (concealment). The watermark ensures that the property owner can verify it (traceability), and the combination of the two achieves the protection effect of "not being discovered but being able to prove ownership".

[0197] In the model intellectual property protection technology system, "model watermark verification" is the core link connecting "watermark embedding" and "intellectual property protection / security defense." Essentially, it verifies the existence of pre-set watermark information in the model to be verified using specific methods, and determines the validity, integrity, and ownership of the watermark, ultimately solving the three core issues of "model ownership," "whether the model has been tampered with," and "whether the watermark is effective." Therefore, it is necessary to verify the model watermark. Taking a malware family classification model to be verified as an example, the specific verification steps are as follows:

[0198] Step 1: Extraction and Consistency Verification of Parameter Watermarks (Verification of "Parameter Layer Property Identifier")

[0199] Parametric watermarking refers to the data to be embedded with a watermark, such as a binary watermark matrix. is the property identification of the model "physical layer", and the verification needs to confirm its consistency with the original watermark through parameter reverse extraction, and the specific process is as follows:

[0200] (1) Extract the model parameters and reconstruct the watermark

[0201] Derive the target parameter matrix from the model to be verified ;

[0202] Perform the same singular value decomposition on the target parameter matrix as the singular value decomposition disclosed in the foregoing embodiment: , wherein Σ' is the adjusted diagonal matrix;

[0203] Extract the perturbation information from Σ', that is, separate the embedded binary watermark matrix by the following formula:

[0204] ;

[0205] (2) Calculate the parameter watermark similarity : The similarity of the embedded binary watermark matrix and the binary watermark matrix

[0206] Compare the embedded binary watermark matrix with the binary watermark matrix , calculate the similarity, such as Hamming similarity, F-norm similarity, if the similarity is greater than or equal to the preset similarity, the parameter watermark extraction is successful, and it is proved that the model contains the original property information, such as the original property identification. The preset similarity can be set by the person skilled in the art according to experience, which is not limited here.

[0207] Step 2: Triggering and validity verification of feature space watermark (verify "feature layer property response")

[0208] The feature watermark (the association of the trigger sample data and the bound trigger label ) is the property identification of the model "function layer", and the verification needs to query whether the model "remembers" the preset association through the trigger sample data , and the specific process is as follows:

[0209] (1) Prepare the trigger sample data set and the trigger label used for verification

[0210] Use the same key as in the embedding stage, that is, the key (such as SHA-256 master key + HKDF subkey) disclosed in the foregoing embodiment to generate the trigger sample data set, so as to ensure consistency with the trigger sample data in the embedding stage, and avoid verification failure due to differences in sample data; ​

[0211] Clearly trigger sample data Bound trigger tag .

[0212] (2) Input trigger sample data and detect model output

[0213] Input all the trigger sample data in the trigger sample dataset into the model to be validated, and record the output results of the model to be validated.

[0214] Feature watermark detection accuracy The output of the model to be validated is The ratio of the number of trigger sample data to the total number of trigger sample data. If the feature watermark detection accuracy... If the accuracy is greater than or equal to the preset accuracy, such as 95%, then the feature watermark is valid, proving that the model can make a preset response to the owner's "key sample".

[0215] (3) Verify the concealment of the trigger sample data (optional but crucial)

[0216] To prevent the trigger sample data from being identified by attackers, it is necessary to verify its consistency with the distribution of the original sample data: calculate the trigger sample data. The feature distances from the original sample dataset, such as L2 distance and cosine similarity, should be used to ensure that the difference is less than or equal to a preset threshold. If the difference is too large, it indicates that the feature watermark is easily detected, and the trigger sample data needs to be regenerated. The preset threshold can be set by those skilled in the art according to the actual situation, and no specific restrictions are imposed here.

[0217] Step 3: Watermark Verification in Anti-Attack Scenarios (Verifying that "Property Rights Remain Traceable After an Attack")

[0218] The core value of watermarking lies in its ability to "remain verifiable even after an attack," requiring the simulation of common attack methods (as opposed to those used in the previous optimization phase). (Same scenario), repeat steps 1 and 2 to verify the watermark performance after the attack:

[0219] (1) Simulate typical attacks

[0220] Pruning attack: Removes 20%~30% of redundant parameters from the model;

[0221] Noise attack: Add Gaussian noise (e.g., mean 0, variance 0.01) to the input sample data (including trigger sample data and original sample data).

[0222] Fine-tuning attack: Fine-tuning the model using 10% new sample data (non-trigger sample data);

[0223] Quantization attack: Quantize the model parameters from 32-bit floating point to 16-bit or 8-bit integer (reducing precision).

[0224] (2) Re-verify the double watermark after the attack

[0225] Repeat steps 1 (parameter watermark extraction) and 2 (feature watermark triggering) on ​​the attacked model, and calculate respectively. and If after the attack Greater than or equal to a preset value, such as 90%, and If the value is greater than or equal to the preset value, such as 90%, the watermark passes the anti-attack verification, proving that the property rights can still be traced after malicious tampering.

[0226] Step 4: Performance Verification of the Original Task (Verifying that the watermark does not damage the model)

[0227] Even if the watermark is effective, it has no practical value if the model loses its original functionality (e.g., a sharp drop in accuracy when classifying malware). It is necessary to verify the model's ability to process normal samples after watermark embedding.

[0228] (1) Test the accuracy of the original task

[0229] Prepare the original test set ;

[0230] Calculate the model to be validated on the original test set On the precision and compared with the original model on the original test set. On the precision Comparison; if Greater than or equal to If so, the model's functionality meets practical requirements.

[0231] (2) Verify generalization ability (optional)

[0232] Repeat the accuracy test on cross-scenario test sets (such as malware sample data from different sources) to ensure that the watermark does not cause the model to overfit (the generalization accuracy decreases by no more than 1%).

[0233] The watermark verification of the model can only be considered successful if all four of the following conditions are met:

[0234] (1) Under normal circumstances, parameter watermark similarity Greater than or equal to 95%;

[0235] (2) Accuracy of feature watermark detection in normal scenarios Greater than or equal to 95%;

[0236] (3) Parameter watermark similarity in attack scenarios Greater than or equal to 90%, and the accuracy rate of feature watermark detection Greater than or equal to 90%;

[0237] (4) Original task accuracy Greater than or equal to .

[0238] Through multi-dimensional verification, it is ensured that the watermark not only "can be embedded", but also "can resist attacks, is traceable, and does not interfere" in actual application, and technical evidence (such as watermark extraction report, trigger verification record) is provided for model property dispute.

[0239] The model property protection method provided in the embodiment can have the following technical points:

[0240] (1) Dual-mechanism fusion watermark architecture: a collaborative protection mechanism of parameter perturbation watermark (SVD embedding) and feature space watermark (key trigger) is created, the parameter layer embeds the watermark by singular value decomposition (SVD) perturbation of the parameter matrix, and the feature layer constructs a key trigger sample to bind a label, and the watermark is implanted in the feature space. The dual-mechanism is complementary to enhance the robustness and concealment, and the single watermark cracking is easy to be removed.

[0241] (2) SVD anti-attack optimized watermark technology: a singular value interval constraint embedding method is designed, only the middle singular values are modified, the high / low order singular values affecting the model performance are avoided, and an adversarial regularization loss is added to force the watermark to be extracted after model pruning, thereby improving the watermark survival rate.

[0242] (3) Unperceivable optimization of feature space watermark: a dynamic key trigger sample generation algorithm is developed to generate adversarial sample data consistent with the original sample data distribution, i.e., trigger sample data, bind pseudo labels, i.e., trigger labels, and constrain the feature space through a corresponding loss function, so that watermark detection only needs to trigger the key sample, without modifying the model output layer, and the concealment is extremely strong.

[0243] (4) Watermark robustness joint optimization framework: a dual-watermark collaborative loss function is constructed, and a phased training strategy is designed, wherein, in phase 1, normal task training is performed; in phase 2, the backbone network is frozen, and the watermark loss is jointly optimized, thereby reducing the model accuracy loss and improving the watermark extraction success rate.

[0244] As known from the above, the embodiment of the present application obtains an original parameter matrix of an original model, and performs parameter perturbation processing on the original parameter matrix to obtain a target parameter matrix; based on the target parameter matrix, the original model is adjusted to obtain an adjusted model; obtains original sample data corresponding to the original model, and performs sample perturbation processing on the original sample data to obtain trigger sample data; based on the original sample data and the trigger sample data, the adjusted model is trained to obtain a trained model, which can realize property protection of the model, such as property protection of the model from two dimensions of model parameters and feature space.

[0245] To facilitate better implementation of the model property protection method provided in the embodiments of the present application, the embodiments of the present application further provide a device based on the model property protection method. The meanings of the terms are the same as those in the model property protection method, and specific implementation details can be referred to the description of the method embodiments.

[0246] Please refer to Figure 4 , Figure 4 The model property protection device provided in the embodiments of the present application is applied to a computer device. The model property protection device can include a parameter perturbation unit 301, a model adjustment unit 302, a sample perturbation unit 303, and a model training unit 304.

[0247] The parameter perturbation unit 301 is configured to obtain an original parameter matrix of an original model and perform parameter perturbation processing on the original parameter matrix to obtain a target parameter matrix.

[0248] The model adjustment unit 302 is configured to adjust the original model based on the target parameter matrix to obtain an adjusted model.

[0249] The sample perturbation unit 303 is configured to obtain original sample data corresponding to the original model and perform sample perturbation processing on the original sample data to obtain trigger sample data.

[0250] The model training unit 304 is configured to train the adjusted model based on the original sample data and the trigger sample data to obtain a trained model.

[0251] In some embodiments, the parameter perturbation unit 301 is specifically configured to:

[0252] perform singular value decomposition on the original parameter matrix to obtain a left singular vector matrix, a to-be-adjusted diagonal matrix, and a right singular vector matrix;

[0253] obtain to-be-embedded watermark data and embedding strength, and adjust the to-be-adjusted diagonal matrix based on the embedding strength and the to-be-embedded watermark data to obtain an adjusted diagonal matrix;

[0254] construct a to-be-optimized parameter matrix based on the adjusted diagonal matrix, the left singular vector matrix, and the right singular vector matrix;

[0255] perform optimization processing on the to-be-optimized parameter matrix to obtain a target parameter matrix.

[0256] In some embodiments, the parameter perturbation unit 301 is specifically configured to:

[0257] determine a parameter loss based on the to-be-optimized parameter matrix and the original parameter matrix.

[0258] performing a simulation attack on the parameter matrix to be optimized to obtain an attacked parameter matrix;

[0259] adjusting the original model based on the attacked parameter matrix to obtain a first attacked model;

[0260] determining a first original accuracy of the first attacked model for the original sample data;

[0261] determining a first total loss based on the parameter loss and the first original accuracy;

[0262] adjusting the parameter matrix to be optimized to obtain a target parameter matrix, with a target of minimizing the first total loss.

[0263] In some embodiments, the sample perturbation unit 303 is specifically configured to:

[0264] generating a key;

[0265] performing sample perturbation processing on the original sample data corresponding to the original model based on the key to obtain trigger sample data.

[0266] In some embodiments, the sample perturbation unit 303 is specifically configured to:

[0267] obtaining a preset loss function and a perturbation strength;

[0268] performing sample perturbation processing on the original sample data based on the key, the perturbation strength, and the preset loss function to obtain trigger sample data.

[0269] In some embodiments, the model training unit 304 is specifically configured to:

[0270] inputting the original sample data into the adjusted model to obtain a second original output result, and inputting the trigger sample data into the adjusted model to obtain a trigger output result;

[0271] obtaining a trigger label of the trigger sample data and an original label of the original sample data;

[0272] determining a first loss based on the original label and the second original output result;

[0273] determining a second loss based on a weight coefficient, the trigger label, and the trigger output result;

[0274] determining a second total loss based on the first loss and the second loss;

[0275] train the adjusted model to obtain a trained model.

[0276] In some embodiments, the method for protecting the property right of the model further comprises a model screening unit, which is specifically configured to:

[0277] obtain other trained models, which are determined based on corresponding target parameter matrices of the other trained models;

[0278] simulate attacks on the trained model and the other trained models respectively to obtain a plurality of second attacked models;

[0279] determine a second original accuracy of each of the second attacked models with respect to the original sample data;

[0280] screen, from the plurality of second attacked models, a second attacked model with a second original accuracy greater than or equal to a preset accuracy to obtain a plurality of candidate models;

[0281] obtain a trigger accuracy of each of the candidate models with respect to the trigger sample data;

[0282] determine an attacked parameter matrix from each of the candidate models, wherein the attacked parameter matrix corresponding to each of the candidate models corresponds to the target parameter matrix corresponding to each of the candidate models;

[0283] determine a similarity between the target parameter matrix and the attacked parameter matrix corresponding to each of the candidate models;

[0284] determine an evaluation value based on the similarity and the trigger accuracy corresponding to each of the candidate models;

[0285] screen, from the candidate models, a candidate model with the largest evaluation value as a target model.

[0286] The specific implementation of each unit can be referred to the foregoing embodiments, which will not be described herein.

[0287] As described above, the parameter perturbation unit 301 obtains the original parameter matrix of the original model and performs parameter perturbation processing on the original parameter matrix to obtain the target parameter matrix. The model adjustment unit 302 adjusts the original model based on the target parameter matrix to obtain the adjusted model. The sample perturbation unit 303 obtains the original sample data corresponding to the original model and performs sample perturbation processing on the original sample data to obtain the trigger sample data. The model training unit 304 trains the adjusted model based on the original sample data and the trigger sample data to obtain the trained model, which can realize the protection of the property right of the model.

[0288] The specific implementation of each unit can refer to the foregoing embodiments, which will not be described here.

[0289] Referring to Figure 5 , Figure 5 is a structural block diagram of part of the computer device 1000 implementing the embodiments of the present disclosure. The computer device 1000 can have great differences due to different configurations or performances, and can include one or more central processing units (CPU for short, CPU) 622 (for example, one or more processors) and a memory 632, one or more storage media 630 (for example, one or more mass storage devices) storing application programs 642 or data 644. Among them, the memory 632 and the storage medium 630 can be temporary storage or persistent storage. The programs stored in the storage medium 630 can include one or more modules (not shown in the figure), and each module can include a series of instruction operations in the server 600. Further, the central processing unit 622 can be configured to communicate with the storage medium 630 and execute a series of instruction operations in the storage medium 630 on the server 600.

[0290] The computer device 1000 can also include one or more power supplies 626, one or more wired or wireless network interfaces 650, one or more input and output interfaces 658, and / or one or more operating systems 641, such as Windows Server, MacOS X, Unix, Linux, FreeBSD, etc.

[0291] The central processing unit 622 in the computer device 1000 can be used to execute the model's intellectual property protection method of the embodiments of the present disclosure, for example:

[0292] Obtaining an original parameter matrix of an original model, and performing parameter perturbation processing on the original parameter matrix to obtain a target parameter matrix;

[0293] Adjusting the original model based on the target parameter matrix to obtain an adjusted model;

[0294] Obtaining original sample data corresponding to the original model, and performing sample perturbation processing on the original sample data to obtain trigger sample data;

[0295] Training the adjusted model based on the original sample data and the trigger sample data to obtain a trained model.

[0296] The embodiments of the present disclosure also provide a computer-readable storage medium for storing program code, and the program code is used to execute the model's intellectual property protection method of the foregoing embodiments.

[0297] The embodiments of the present disclosure further provide a computer program product comprising a computer program. A processor of a computer device reads and executes the computer program, so that the computer device performs the model property protection method as described above. For example:

[0298] An original parameter matrix of an original model is obtained, and parameter perturbation processing is performed on the original parameter matrix to obtain a target parameter matrix;

[0299] The original model is adjusted based on the target parameter matrix to obtain an adjusted model;

[0300] Original sample data corresponding to the original model is obtained, and sample perturbation processing is performed on the original sample data to obtain trigger sample data;

[0301] The adjusted model is trained based on the original sample data and the trigger sample data to obtain a trained model.

[0302] In addition, the terms "comprise" and "include" and any variations thereof are intended to cover a non-exclusive inclusion, for example, a process, method, system, product or device that includes a list of steps or units need not be limited to those clearly listed, but can include other steps or units that are not clearly listed or inherent to such processes, methods, products or devices.

[0303] It should be understood that in the present application, "at least one" refers to one or more, and "multiple" refers to two or more. "And / or" is used to describe the association relationship of the associated objects, which means that there can be three relationships, for example, "A and / or B" can represent three cases of only A, only B and A and B existing at the same time, wherein A and B can be singular or plural. The character " / " generally represents that the associated objects before and after it are in an "or" relationship. "At least one of the following" or similar expressions means any combination of these items, including any combination of single item or multiple items. For example, at least one of a, b or c can represent: a, b, c, "a and b", "a and c", "b and c", or "a and b and c", wherein a, b and c can be single or multiple.

[0304] It should be understood that in the description of the embodiments of the present application, the meaning of multiple (or multiple items) is two or more, greater than, less than, more than, etc. Understand as not including this number, above, below, etc. Understand as including this number.

[0305] In several embodiments provided in the present application, it should be understood that the disclosed system, device and method can be implemented in other manners. For example, the described device embodiments are merely schematic. For example, the division of the units is only a logical function division. There can be another division manner for the actual implementation, for example, multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed. In addition, the displayed or discussed mutual couplings or direct couplings or communication connections between different units, can be indirect couplings or communication connections through some interfaces, devices or units, and can be electrical, mechanical or in other forms.

[0306] The units described as separated components can or can not be physically separated, and the components displayed as units can or can not be physical units, i.e., can be located in one place, or can be distributed on a plurality of network units. Some or all of the units can be selected according to actual needs to achieve the purposes of the embodiments.

[0307] In addition, each functional unit in the embodiments of the present application can be integrated in a processing unit, or each unit can exist physically, or two or more units can be integrated in one unit. The integrated unit can be implemented in the form of hardware, or in the form of software function units.

[0308] When the integrated unit is implemented in the form of software function units and sold or used as an independent product, it can be stored in a computer readable storage medium. Based on such an understanding, the technical solutions of the present application essentially, or the part that contributes to the prior art, or all or a part of the technical solutions can be embodied in the form of a software product. The computer software product is stored in a storage medium, and includes several instructions for causing a computer device (which can be a personal computer, a server, or a network device, etc.) to execute all or part of the steps of the methods in the embodiments of the present application. The foregoing storage medium includes: U disk, mobile hard disk, read-only memory (ROM), random access memory (RAM), magnetic disk or optical disk, and various other media that can store program codes.

[0309] It should also be understood that the various embodiments provided in the embodiments of the present application can be combined in any manner to achieve different technical effects.

[0310] In the embodiments of the present application, the term "module" or "unit" refers to a computer program or a part of a computer program with a predetermined function, and works together with other related parts to achieve a predetermined target, and can be implemented entirely or partially by using software, hardware (such as a processing circuit or a memory), or a combination thereof. Similarly, one processor (or multiple processors or memories) can be used to implement one or more modules or units. In addition, each module or unit can be a part of an integral module or unit that includes the functions of the module or unit.

[0311] The above is a specific description of the embodiments of the present application, but the present application is not limited to the above-described embodiments, and those skilled in the art can make various equivalent modifications or replacements without departing from the spirit of the present application. These equivalent modifications or replacements are all included in the scope defined by the claims of the present application.

Claims

1. A method for protecting the intellectual property rights of a model, characterized in that, include: Obtain the original parameter matrix of the original model, and perform singular value decomposition on the original parameter matrix to obtain the left singular vector matrix, the diagonal matrix to be adjusted, and the right singular vector matrix; Obtain the watermark data to be embedded and the embedding strength, and adjust the diagonal matrix to be adjusted based on the embedding strength and the watermark data to be embedded to obtain the adjusted diagonal matrix; Based on the adjusted diagonal matrix, the left singular vector matrix, and the right singular vector matrix, construct the parameter matrix to be optimized. The parameter matrix to be optimized is then optimized to obtain the target parameter matrix; Based on the target parameter matrix, the original model is adjusted to obtain the adjusted model; Obtain the original sample data corresponding to the original model, and perform sample perturbation processing on the original sample data to obtain trigger sample data; Based on the original sample data and the trigger sample data, the adjusted model is trained to obtain the trained model.

2. The method for protecting the intellectual property rights of the model according to claim 1, characterized in that, The optimization process of the parameter matrix to be optimized to obtain the target parameter matrix includes: Based on the parameter matrix to be optimized and the original parameter matrix, determine the parameter loss; A simulated attack is performed on the parameter matrix to be optimized to obtain the parameter matrix after the attack; Based on the post-attack parameter matrix, the original model is adjusted to obtain the first post-attack model; Determine the first original accuracy of the model with respect to the original sample data after the first attack; Based on the parameter loss and the first original accuracy, the first total loss is determined; With the goal of minimizing the first total loss, the parameter matrix to be optimized is adjusted to obtain the target parameter matrix.

3. The method for protecting the intellectual property rights of the model according to claim 1, characterized in that, The step of performing sample perturbation processing on the original sample data corresponding to the original model to obtain trigger sample data includes: Generate a key; Based on the key, the original sample data corresponding to the original model is perturbed to obtain the trigger sample data.

4. The method for protecting the intellectual property rights of the model according to claim 3, characterized in that, The step of performing sample perturbation processing on the original sample data corresponding to the original model based on the key to obtain trigger sample data includes: Obtain the preset loss function and disturbance intensity; Based on the key, the perturbation strength, and the preset loss function, the original sample data is subjected to sample perturbation processing to obtain triggered sample data.

5. The method for protecting the intellectual property rights of the model according to claim 1, characterized in that, The process of training the adjusted model based on the original sample data and the trigger sample data to obtain the trained model includes: The original sample data is input into the adjusted model to obtain the original output result, and the trigger sample data is input into the adjusted model to obtain the trigger output result; Obtain the trigger label of the trigger sample data and the original label of the original sample data; Based on the original labels and the original output results, the first loss is determined; The second loss is determined based on the weighting coefficients, the triggering labels, and the triggering output results; Based on the first loss and the second loss, determine the second total loss; The adjusted model is trained with the goal of minimizing the second total loss to obtain the trained model.

6. The method for protecting the intellectual property rights of the model according to any one of claims 1 to 5, characterized in that, The method further includes: Obtain other post-trained models, which are determined based on their corresponding target parameter matrices; Simulated attacks were performed on the trained model and other trained models to obtain multiple second-attacked models. Determine the second original accuracy of the model for the original sample data after each of the second attacks; From multiple post-attack models, the second post-attack models whose original accuracy is greater than or equal to the preset accuracy are selected to obtain multiple candidate models; Obtain the triggering accuracy of each candidate model for the triggering sample data; Determine the post-attack parameter matrix from each of the candidate models, wherein the post-attack parameter matrix corresponding to each candidate model corresponds to the target parameter matrix corresponding to each candidate model; Determine the similarity between the target parameter matrix and the parameter matrix after the attack for each candidate model; The evaluation value is determined based on the similarity corresponding to each candidate model and the triggering accuracy. The candidate model with the highest evaluation value is selected from the candidate models as the target model.

7. A property rights protection device for a model, characterized in that, include: The parameter perturbation unit is used to obtain the original parameter matrix of the original model, and specifically for: Singular value decomposition is performed on the original parameter matrix to obtain the left singular vector matrix, the diagonal matrix to be adjusted, and the right singular vector matrix; Obtain the watermark data to be embedded and the embedding strength, and adjust the diagonal matrix to be adjusted based on the embedding strength and the watermark data to be embedded to obtain the adjusted diagonal matrix; Based on the adjusted diagonal matrix, the left singular vector matrix, and the right singular vector matrix, construct the parameter matrix to be optimized. The parameter matrix to be optimized is then optimized to obtain the target parameter matrix; The model adjustment unit is used to adjust the original model based on the target parameter matrix to obtain the adjusted model; The sample perturbation unit is used to acquire the original sample data corresponding to the original model and perform sample perturbation processing on the original sample data to obtain trigger sample data. The model training unit is used to train the adjusted model based on the original sample data and the trigger sample data to obtain the trained model.

8. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores a plurality of instructions adapted for loading by a processor to execute the intellectual property protection method of the model according to any one of claims 1 to 6.

9. A computer device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, characterized in that, When the processor executes the computer program, it implements the intellectual property protection method of the model according to any one of claims 1 to 6.

Images