Watermark-based model security distribution and authentication method and system

Abstract

The invention provides a watermark-based model security distribution and authentication method and system, and relates to the technical field of data processing, and the method comprises the steps: distributing a watermark-containing model which is verified to be qualified to a requester authorization device through an encryption channel, the watermark generation parameters, the distribution context information and the timestamps are used as evidence storage data to be written into a secure evidence storage library; running the distributed watermark-containing model on authorized equipment, and obtaining a watermark bearing signal from output data of the model in a model running process; the watermark bearing signal is analyzed, watermark information is extracted, and an original feature vector is recovered through an inverse mapping algorithm; similarity matching and legality verification are carried out on the recovered feature vectors and records of the security evidence storage library, and model source authentication, use permission control and accurate source tracing of infringement behaviors are achieved according to verification results. According to the invention, the comprehensiveness and accuracy of anomaly detection are improved.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of data processing, in particular to a model security distribution and authentication method and system based on watermark. BACKGROUND

[0002] With the rapid development of artificial intelligence technology, the protection demand of model as core intellectual property right is also continuously improving. In the aspect of multi-source information fusion, the existing technology lacks the integration ability of model whole life cycle characteristics. Model distribution involves architecture design, training process, hardware environment and other multi-dimensional information. The traditional method only generates watermark based on a single dimension, which may exist the problems of difficult to realize fine-grained permission control and traceability analysis. For example, only by adjusting the word probability distribution to generate watermark, the model deployment environment key information cannot be associated, which leads to difficult to track the propagation path after infringement.

[0003] The existing technology only generates watermark based on a single dimension, and fails to fuse key information such as architecture fingerprint and hardware identifier. For example, the infringer can completely strip the watermark by pruning and fine-tuning. Since the watermark is not bound with the hospital equipment identifier, the source of model leakage cannot be tracked. The traceability ability will be completely lost after the watermark generated by multi-source fusion is propagated for many times. SUMMARY

[0004] The technical problem to be solved by the present application is to provide a model security distribution and authentication method and system based on watermark, which improves the comprehensiveness and accuracy of anomaly detection.

[0005] To solve the above technical problems, the technical scheme of the present application is as follows: In a first aspect, a model security distribution and authentication method based on watermark, the method comprises: Step 1, obtaining the architecture fingerprint of the target base model, the key value of the fine-tuning process, the digital certificate of the distribution party, the institution identifier of the request party and the hardware identifier of the target equipment, and generating multi-source feature information; Step 2, fusing the multi-source feature information, processing through a weighted fusion algorithm to generate a high-dimensional global feature vector; Step 3, inputting the global feature vector and a random key into a multi-level neural network watermark generator to generate a dynamic digital watermark after processing; Step 4, using the dynamic digital watermark, embedding it into the output layer feature mapping of the target base model through a watermark embedding algorithm based on gradient reservation to generate a watermark-containing derived model; Step 5, quality evaluation and testing of the derived model to obtain a verified watermark-containing model; distributing the verified watermark-containing model to the authorized equipment of the request party through an encrypted channel, and writing the watermark generation parameters, distribution context information and timestamp as evidence data into a secure evidence library; Step 6, running the distributed watermark model on the authorized device, and obtaining a watermark-bearing signal from the output data of the model during the model running; analyzing the watermark-bearing signal to extract watermark information, and recovering the original feature vector through an inverse mapping algorithm; Step 7, similarity matching and legality verification of the recovered feature vector with the record of the secure evidence library, and realizing model source authentication, usage permission control and accurate traceability of infringement behavior according to the verification result.

[0006] The second aspect is a watermark-based model security distribution and authentication system, comprising: The collection module is configured to obtain network traffic data of a target server, divide the network traffic data in units of sessions, and obtain a plurality of session flows. The extraction module is configured to extract multi-modal features from the traffic records in each session flow, and obtain feature data of at least two different modalities. The fusion module is configured to input the feature data of at least two different modalities into a cross-modal feature fusion module, perform weighted fusion, and obtain a fused multi-modal feature representation. The processing module is configured to capture long-distance dependency relationships between traffic records using a time-domain convolution network based on the multi-modal feature representation, and obtain time-series features. The classification module is configured to combine the fused multi-modal feature representation and the time-series features, and classify the combined features to obtain a preliminary anomaly detection result. The evaluation module is configured to calculate an inter-class discriminability weight of the session flow fusion features based on the preliminary anomaly detection result, and evaluate a quality coefficient of the fused multi-modal features and a consistency coefficient of the time-series features respectively, to obtain a dynamic adjustment factor. The output module is configured to perform weighted fusion of the dynamic adjustment factor and the preliminary anomaly detection result to generate a final anomaly detection result, and generate a risk assessment level based on the final anomaly detection result in combination with protocol type and target port activity context information of the traffic.

[0007] The third aspect is a computing device, comprising: One or more processors; A storage device configured to store one or more programs, when the one or more programs are executed by the one or more processors, the one or more processors implement the method.

[0008] The fourth aspect is a computer-readable storage medium, the computer-readable storage medium stores a program, and the program is executed by a processor to implement the method.

[0009] The above-mentioned scheme of the present application at least has the following beneficial effects: When the dynamic watermark is embedded into the model output layer feature mapping, the gradient information of the model is retained to avoid the problems of prediction accuracy decline and inference speed slowing down caused by the destruction of the correlation of model parameters in the traditional watermark embedding.

[0010] Compared with the traditional fixed watermark, the dynamic watermark can be adaptively adjusted with the change of multi-source features, effectively resist model compression, pruning, and other attack means, reduce the risk of watermark removal or damage, and build a core security barrier for model intellectual property rights. BRIEF DESCRIPTION OF DRAWINGS

[0011] Figure 1 is a watermark-based model security distribution and authentication method flowchart provided by an embodiment of the present application.

[0012] Figure 2 is a watermark-based model security distribution and authentication system diagram provided by an embodiment of the present application. DETAILED DESCRIPTION

[0013] Exemplary embodiments of the present disclosure will be described in greater detail below with reference to the accompanying drawings. Although exemplary embodiments of the present disclosure are shown in the drawings, it should be understood that the present disclosure can be implemented in various forms and should not be limited by the embodiments set forth herein. On the contrary, the embodiments are provided so that the present disclosure can be more thoroughly understood and the scope of the present disclosure can be accurately conveyed to those skilled in the art.

[0014] As shown in Figure 1 An embodiment of the present application proposes a watermark-based model security distribution and authentication method, which comprises the following steps: Step 1, obtain the architecture fingerprint of the target base model, the key value of the fine-tuning process, the digital certificate of the distributor, the agency identification of the requester, and the hardware identification of the target device, and generate multi-source feature information; Step 2, fuse the multi-source feature information, process it through a weighted fusion algorithm, and generate a high-dimensional global feature vector; Step 3, input the global feature vector and the random key into the multi-level neural network watermark generator, and generate a dynamic digital watermark after processing; Step 4, use the dynamic digital watermark to embed it into the output layer feature mapping of the target base model through a watermark embedding algorithm based on gradient retention, and generate a derivative model containing the watermark; Step 5, quality evaluation and testing are performed on the derived model to obtain a qualified watermark-containing model; the qualified watermark-containing model is distributed to the authorized equipment of the requestor through an encrypted channel, and the watermark generation parameters, distribution context information and timestamp are written into the secure evidence library as evidence data; Step 6, the distributed watermark-containing model is run on the authorized equipment, and a watermark-bearing signal is obtained from the output data of the model during the running of the model; the watermark-bearing signal is analyzed to extract the watermark information, and the original feature vector is recovered through an inverse mapping algorithm; Step 7, similarity matching and legality verification are performed between the recovered feature vector and the record in the secure evidence library, and model source authentication, use permission control and precise tracing of infringement are realized according to the verification result.

[0015] In the embodiment of the application, a watermark embedding algorithm based on gradient reservation is used to embed dynamic watermark in the model output layer feature mapping, and by reserving the model gradient information, the problems of prediction accuracy decline and reasoning speed slowing down caused by the destruction of model parameter correlation in traditional watermark embedding are avoided. This design balances the security of the watermark and the functionality of the model, ensuring that the watermark-containing derived model can still stably output the original business performance while carrying the watermark, meeting the practical needs of the model in actual scenarios.

[0016] Through the dynamic watermark generation design of the multi-level neural network, compared with the traditional fixed watermark, the dynamic watermark can adaptively adjust with the change of multi-source features, effectively resist model compression, pruning, and other attack means, reduce the risk of watermark removal or damage, and build a core security barrier for model intellectual property rights.

[0017] In a preferred embodiment of the application, in step 1, the architecture fingerprint of the target base model, the key value of the fine-tuning process, the digital certificate of the distributor, the institution identifier of the requestor and the hardware identifier of the target device are obtained to generate multi-source feature information, including: For the target base model to be distributed, the architecture fingerprint reflecting the unique architecture of the model is extracted, which can reflect the network structure design features of the model; secondly, the key value generated in the fine-tuning process of the target base model is collected, which can represent the core parameter change of the model in the fine-tuning stage; thirdly, the digital certificate of the distributor is obtained, which is used to confirm the legal identity of the model distribution subject; at the same time, the institution identifier of the requestor is collected to clarify the institution information of the model receiving subject; in addition, the hardware identifier of the target device is extracted, which can uniquely correspond to the device used for the final deployment of the model; finally, the architecture fingerprint, the key value of the fine-tuning process, the digital certificate of the distributor, the institution identifier of the requestor and the hardware identifier of the target device are integrated to form multi-source feature information covering model attributes, participant identity and use device features.

[0018] In a preferred embodiment of the present application, in step 2, the multi-source feature information is fused by a weighted fusion algorithm to generate a high-dimensional global feature vector, including: Step 21, convert the architecture fingerprint into a structure encoding vector reflecting the network hierarchy and connection relationship, convert the fine-tuning process key value into a process parameter vector recording the hyperparameters and training state, and separately parse and convert the distribution party digital certificate, the request party organization identifier and the target device hardware identifier into fixed-length digital identifier vectors; according to each type of feature vector, assign a corresponding weight coefficient to each type of feature vector, specifically including: Traverse the complete network structure of the target base model, and identify all network layer types contained in the model in turn, including convolution layers (such as 2D convolution layer Conv2d, 3D convolution layer Conv3d), fully connected layers (Dense layers), activation function layers (such as ReLU layer, Sigmoid layer, Tanh layer, GELU layer, Softmax layer), pooling layers (such as maximum pooling layer MaxPooling2d, average pooling layer AveragePooling2d), normalization layers (such as batch normalization layer BatchNorm2d, layer normalization layer LayerNorm), dropout layers, etc.; for each network layer identified, record its structure parameters one by one, wherein the convolution layer needs to record the input channel number, the output channel number, the convolution kernel size (such as 3x3, 5x5), the step (such as 1x1, 2x2), the padding value (such as SamePadding, ValidPadding), and whether to use the bias term; the fully connected layer needs to record the input neuron number, the output neuron number, and whether to use the bias term; the activation function layer needs to specify the specific type of activation function and related parameters (such as the negative slope coefficient of LeakyReLU); the pooling layer needs to record the pooling kernel size, the step, the padding value, and the pooling method; the normalization layer needs to record the normalization dimension, the momentum parameter, and the epsilon value; the dropout layer needs to record the dropout probability.

[0019] Network layer connection relationship record: comb the forward propagation path between each network layer, and clearly define the input source layer and output target layer of each layer; record the dimension change (including height, width, channel number) of the feature map when passing between layers, if there is a branch structure (such as the residual branch of ResNet, the multi-branch structure of Inception), the network layer composition, feature map dimension and branch fusion method (such as element addition, channel splicing) of each branch need to be recorded respectively.

[0020] According to a preset encoding rule, the collected network layer type, structure parameters and connection relationship are encoded, wherein the network layer type is encoded by fixed-length binary code (for example, Conv2d corresponds to 0001, Dense corresponds to 0010, and ReLU corresponds to 0011); numerical parameters (such as convolution kernel size, step, and neuron number) are directly represented by binary numbers, if the parameter is a floating-point number (such as dropout probability and normalization momentum), the parameter is first converted into an integer of fixed precision and then encoded by binary code; the connection relationship is represented by an adjacency matrix, the matrix elements are binary (1 represents an existing connection, and 0 represents no connection), and the adjacency matrix is expanded into a binary sequence by row; all the binary sequences obtained by encoding are spliced into a complete binary string, if the length of the binary string is less than the preset fixed length, 0 is added at the end, if the length of the binary string exceeds the preset fixed length, the binary string of the preset length is truncated; finally, the processed binary string is divided according to the preset dimension, each dimension corresponds to a decimal value, and a fixed-dimension structure encoding vector is generated, which can completely and uniquely reflect the network hierarchy of the target basic model, the parameter configuration of each layer, and the connection relationship between layers.

[0021] All hyperparameters of the target basic model in the fine-tuning stage are collected, including: learning rate, such as 0.001, 0.0001, and 0.01, which can be a fixed learning rate or a dynamic learning rate, if it is a dynamic learning rate, the learning rate adjustment strategy needs to be recorded; batch size (such as 16, 32, 64, and 128); iteration number (i.e. training round, such as 50, 100, and 200); regularization coefficient, including L1 regularization coefficient (such as 0.0001 and 0.001), L2 regularization coefficient (such as 0.0001, 0.001, and 0.01), and weight decay coefficient (such as 0.0001); optimizer type, including SGD (stochastic gradient descent optimizer), Adam (adaptive moment estimation optimizer), AdamW (Adam optimizer with weight decay), and RMSprop (root mean square propagation optimizer); loss function type (such as cross-entropy loss function CrossEntropyLoss).

[0022] Training state parameter collection, collecting the training state parameters of each iteration round of the target basic model in the fine-tuning process, including: training loss value of each round (such as cross-entropy loss value of classification task and mean square error loss value of regression task), validation loss value; evaluation index value on the training set and the validation set of each round, including accuracy (Accuracy), precision (Precision), recall (Recall), F1 score (F1-Score), and AUC value (area under ROC curve) for classification tasks, and including coefficient of determination R 2The mean absolute error (MAE), the mean squared error (MSE), the root mean squared error (RMSE), the gradient update amplitude of each parameter in each round, including the L2 norm of the gradient of each convolutional layer weight, the L2 norm of the gradient of the fully connected layer weight, and the L2 norm of the gradient of the bias term.

[0023] The collected hyperparameters are classified and sorted according to the types of optimizer parameters, learning rate parameters, batch size, iteration number, regularization parameters, and loss function parameters in the order of parameter classification and standardization; the training state parameters are sorted according to the time sequence of the iteration rounds, and each round is classified according to the types of training loss, validation loss, training evaluation index, validation evaluation index, and gradient update amplitude in the order of parameter classification and standardization. The Min-Max standardization method is used to standardize all numerical parameters, and all parameters are converted to numerical values between 0 and 1; for categorical parameters (such as optimizer type and loss function type), One-Hot Encoding is used to convert them into binary vectors, and the elements in the binary vectors are used as the standardized values; the standardized hyperparameters and training state parameters are sequentially concatenated into a one-dimensional array of fixed length according to the above classification and sorting order, and a process parameter vector of fixed dimension is generated, which can completely record the hyperparameter configuration details, the dynamic state of each round of training, and the model performance change trend in the fine-tuning stage of the target basic model.

[0024] Key information is extracted from the digital certificate of the distribution party, including: public key information (such as the modulus value and exponent value of the RSA public key, or the curve parameter and public key coordinate value of the ECC public key); certificate authority (CA) name (such as the name of a third-party CA institution recognized by the state, and the unique identifier of the institution); certificate validity period (including start time and end time, in the format of YYYY-MM-DDHH:MM:SS); certificate serial number (a unique integer identifier assigned by the CA institution); certificate signature algorithm (such as SHA256withRSA, SHA384withECC); certificate subject information (including the name of the distribution party, the organization code, the registered address, the contact information, and the email address).

[0025] The extracted public key information, certificate authority name, certificate validity period, certificate serial number, signature algorithm, and subject information are converted into string format, wherein the numerical information (such as modulus value, exponent value, and certificate serial number) is directly converted into a decimal string, the time information is converted into a string in the format of YYYYMMDDHHMMSS, the name, address, and other text information remain in the original string format; all the strings are concatenated into a complete text string, and SHA-256 hash calculation is performed on the text string to obtain a 256-bit hash value; the hash value is converted into a hexadecimal string, if the length of the hexadecimal string is less than the preset fixed length, 0 is appended at the end, and if it exceeds the preset fixed length, the first preset length of the string is truncated; the processed hexadecimal string is converted into a decimal value in groups of two bits to generate a fixed-length numerical vector, which is the distributor numerical identification vector and can uniquely identify the legal identity of the distributor.

[0026] The complete information of the requestor institution is collected, including: the legal name of the institution; the industry classification, such as software and information technology services, education industry, medical and health industry, recording industry code and industry name; registered address (including province, city, district / county, detailed street address and postal code); institution code (such as unified social credit code, organization code); institution type (such as enterprise unit, institution, scientific research institution, social organization); institution establishment time (format YYYY-MM-DD); institution contact and contact number, email. Through the preset institution coding system, the above information is coded, wherein the industry classification is directly converted into a number according to the industry code, the unified social credit code is converted into ASCII code value according to the character order, the text information (such as institution name, address) is converted into byte sequence according to UTF-8 encoding, then the byte sequence is converted into a decimal numerical value, and the time information is converted into an integer according to the format YYYYMMDD; all the coded numerical values are arranged in the order of institution name, industry classification, registered address, institution code, institution type, establishment time, and contact information.

[0027] The arranged numerical values are combined into an initial array, if the length of the initial array is less than the preset fixed dimension, 0 is appended at the end, and if it exceeds the preset fixed dimension, the first preset dimension of the numerical value is truncated, to generate a fixed-length requestor institution identification vector, which can uniquely identify the identity and attributes of the requestor institution.

[0028] Collect the hardware information of the target device (such as a server, a terminal computer), including: central processing unit information, model, core number, thread number, main frequency, cache size; memory information, type, frequency, manufacturer, serial number; hard disk information, capacity, manufacturer, product model, serial number; network adapter information, manufacturer, model, physical address, IP address; motherboard information, model, BIOS version, serial number; graphics card information, model, video memory capacity, core frequency, manufacturer, serial number.

[0029] Hash processing and vector mapping: all the collected hardware information is spliced into a complete text string in the order of CPU, memory, hard disk, network adapter, motherboard and graphics card, and SHA-512 hash calculation is performed on the text string to obtain a 512-bit unique hash value, ensuring that different hardware information of different devices generates different hash values; the hash value is converted into a hexadecimal string, if the length of the hexadecimal string is less than the preset fixed length, 0 is added at the end, if it exceeds the preset fixed length, the first preset length of the string is truncated; the processed hexadecimal string is converted into a decimal value by every two bits as a group, generating a fixed-length numerical vector, which is the target device hardware identification vector, which can uniquely bind the target device used in the final deployment of the model.

[0030] Establish an evaluation index system to quantitatively evaluate and score (full score is 10) the structural encoding vector, process parameter vector, distributor digital identification vector, requestor institution identification vector, and target device hardware identification vector from the uniqueness, stability, and correlation with the model's entire life cycle of the three dimensions; evaluate the distinguishing ability of the feature vector among different models, different subjects, and different devices; among them, the target device hardware identification vector is generated based on the unique hardware information of the device, and the vectors of different devices are completely different, with the strongest uniqueness, scoring 10; the structural encoding vector reflects the unique architecture of the model, and the vectors of different architecture models differ significantly, with relatively strong uniqueness, scoring 9; the distributor digital identification vector is generated based on the unique certificate information of the distributor, and the vectors of different distributors are different, with a uniqueness score of 8; the requestor institution identification vector is generated based on the unique code of the institution, and the vectors of different institutions are different, with a uniqueness score of 7; the process parameter vector has relatively weak uniqueness due to similar parameter configurations in different model fine-tuning, scoring 6.

[0031] Evaluate the invariance of the feature vector in the whole life cycle of the model; wherein, the structure code vector corresponds to the fixed architecture of the model, and does not change in the process of model training, distribution and deployment, with the strongest stability, scoring 10 points; the target device hardware identification vector corresponds to the fixed hardware information of the device, and does not change when the device does not change the hardware, with a stability score of 9 points; the distribution party digital identification vector corresponds to the fixed certificate information of the distribution party, and does not change within the validity period of the certificate, with a stability score of 8 points; the request party institution identification vector corresponds to the fixed registration information of the institution, and does not change when the institution information does not change, with a stability score of 7 points; the process parameter vector changes with the adjustment of the fine-tuning strategy, with weaker stability, scoring 5 points; the evaluation feature vector supports the safety management and control of the whole process of model distribution, use, traceability and rights protection. Among them, the target device hardware identification vector is directly related to the model deployment device, which is the core basis for infringement traceability, with the strongest correlation, scoring 10 points; the distribution party digital identification vector is related to the model distribution subject, which is the key basis for source authentication, with a correlation score of 9 points; the request party institution identification vector is related to the model receiving subject, which is an important basis for permission control, with a correlation score of 8 points; the structure code vector is related to the core attribute of the model, which is the basis for model uniqueness authentication, with a correlation score of 7 points; the process parameter vector mainly reflects the fine-tuning process, with weaker support for whole life cycle management and control, with a correlation score of 6 points.

[0032] Weight coefficient calculation and distribution: calculate the comprehensive score of each feature vector, comprehensive score = (uniqueness score × 0.4 + stability score × 0.3 + correlation score × 0.3), and distribute the weight coefficient according to the proportion of the comprehensive score, with a total weight coefficient of 1.

[0033] Select multiple sets of feature vector samples of different base models, each set of samples containing the above five types of feature vectors; weight and fuse each set of sample feature vectors with the assigned weight coefficients; calculate the cosine similarity of the global feature vector after the fusion of any two groups of different models, to measure the distinguishability of the feature vector. If the cosine similarity of all groups is less than a preset threshold (such as 0.3), the weight configuration is determined to be qualified; if there are some groups with cosine similarity greater than or equal to the preset threshold, the distinguishability is insufficient, and the weight coefficients need to be adjusted (such as increasing the weight proportion of the target device hardware identification vector and the structure code vector, and reducing the weight proportion of the process parameter vector). Simulate fusion and distinguishability verification again until the distinguishability of the feature vector after the fusion of all groups meets the preset threshold requirement, and determine the final weight coefficient.

[0034] Step 22, for each type of weighted feature vector, a combination of weighted splicing and weighted pooling is used for fusion to generate a high-dimensional fused feature vector, which specifically includes: When the structure code vector, the process parameter vector, the distributor digital identifier vector, the requester institution identifier vector and the target device hardware identifier vector to which the weight coefficients have been assigned in step 21 are fused, a weighted splicing operation is first performed: according to a preset fixed order (in turn, the structure code vector, the process parameter vector, the distributor digital identifier vector, the requester institution identifier vector and the target device hardware identifier vector), the weighted feature vectors are sequentially connected at the head and tail to form a continuous one-dimensional vector, which completely retains the weighted numerical characteristics and dimension information of the feature vectors of various types and ensures the positional correlation of features of different sources.

[0035] Secondly, the one-dimensional vector formed by the above weighted splicing is divided into 5 sub-vector segments according to the original feature categories, and each sub-vector segment corresponds to the weighted result of a type of feature vector; for each sub-vector segment, the weighted average value of all elements in it is calculated, and the weight used in the calculation process is consistent with the weight coefficient assigned to the feature vector of this type in step 21. Through this operation, the core numerical representation of each type of feature in the high-dimensional space is extracted, and a pooling feature vector containing 5 core numerical values is obtained.

[0036] Finally, the one-dimensional vector obtained by weighted splicing and the pooling feature vector obtained by weighted pooling are fused again, and the two are connected at the head and tail in a vector splicing manner to form a high-dimensional fusion feature vector containing both fine-grained feature details and coarse-grained core representations. The dimension of this vector is the sum of the dimension of the weighted splicing vector and the dimension of the pooling feature vector, so as to completely retain the comprehensive information of multi-source features.

[0037] Step 23: The high-dimensional fusion feature vector is normalized to have a modulus length within a preset standard range, and the normalized vector is dimensionally reduced and de-redundant to obtain a high-dimensional global feature vector, which specifically includes: When the high-dimensional fusion feature vector generated in step 22 is normalized, the L2 norm (i.e. the square root of the sum of squares of the elements of the vector) of the vector is calculated, and each element in the vector is divided by the L2 norm, so that the modulus length of the normalized vector is uniform to a preset standard value (such as 1), ensuring that the high-dimensional fusion feature vectors generated in different batches are consistent in numerical scale and eliminating the interference caused by the difference in the numerical range of the original features on subsequent processing.

[0038] For the normalized vector, first determine the number of dimensions of the vector, denoted as N, that is, the vector contains N feature dimensions; then, the covariance between any two different dimensions in the vector is calculated, specifically: for each dimension, the mean of all numerical samples is calculated, and then the average of the product of the difference between each value and the mean of the corresponding dimension is calculated to obtain the covariance value of the two dimensions; arrange the covariance values between all dimensions according to the order of the corresponding dimensions of rows and columns to form an N×N dimensional covariance matrix, which can quantitatively reflect the degree of linear correlation between the feature dimensions of the vector.

[0039] An N-dimensional initial non-zero vector is randomly generated (the value range of the vector elements can be set to [0, 1]), which is used as the vector to be optimized; the following iterative operations are repeatedly performed: matrix multiplication operation is performed on the vector to be optimized and the covariance matrix to obtain a new vector; the length of the new vector is calculated, and the new vector is divided by the length to perform normalization processing to update the new vector to be optimized; continue iteration until the cosine similarity between the vectors to be optimized obtained by two adjacent iterations is greater than a preset threshold (such as 0.999), at which time the vector to be optimized is the first eigenvector (corresponding to the largest eigenvalue) of the covariance matrix; matrix multiplication operation is performed on the eigenvector and the covariance matrix to obtain a new vector, and each element of the new vector is divided by the corresponding element of the eigenvector (any non-zero element is calculated), and the result is the first eigenvalue.

[0040] Remaining eigenvalue and eigenvector solving (based on residual matrix iteration): Subtract the first eigenvalue × the first eigenvector × the transpose matrix of the eigenvector from the original covariance matrix to obtain a new residual matrix; take the residual matrix as a new target matrix, repeat the initial vector setting and iterative optimization process, and solve to obtain the second eigenvalue and the corresponding eigenvector; perform the above loop operation, and solve the next eigenvalue and eigenvector based on the residual matrix obtained by the previous calculation each time, until all N eigenvalues and N eigenvectors of the covariance matrix are obtained.

[0041] Sort all eigenvalues in descending order, while maintaining the correspondence between each eigenvalue and its corresponding eigenvector; then, select the eigenvectors in the sorted order one by one, and calculate the sum of the eigenvalues corresponding to the selected eigenvectors and the proportion of the sum to the total sum of all eigenvalues (i.e. cumulative contribution rate); stop selecting eigenvectors when the cumulative contribution rate reaches a preset threshold (such as 95%); arrange all selected eigenvectors in the order of selection to form an eigenvector matrix with dimensions N×K (where K is the number of selected eigenvectors, K≤N), and each column of the matrix corresponds to a selected eigenvector.

[0042] The normalized original vector (1xN dimension) is taken as a row vector, and matrix multiplication operation is performed with the above-mentioned constructed feature vector matrix (NxK dimension); in the operation process, each element of the original vector is multiplied with the elements of the corresponding row of the feature vector matrix one by one, and then summed, and finally a 1xK dimension row vector is obtained, which is the dimension-reduced vector; the dimension-reduced vector is greatly reduced in the number of dimensions compared with the original vector, and at the same time, the cumulative contribution rate of the selected feature vector reaches the preset threshold, so that the core information in the original vector that plays a key role in distinguishing features is maximally retained.

[0043] The Pearson correlation coefficient between any two dimensions in the vector is calculated, and if the absolute value of the correlation coefficient of the two dimensions is greater than a preset threshold (such as 0.8), it is determined that the two dimensions are highly correlated and redundant; for each group of highly correlated and redundant dimensions, the dimension with a larger eigenvalue is retained, and the remaining dimensions are removed to eliminate the information redundancy within the vector; after the above normalization, dimension reduction and redundancy removal processing, the obtained vector is the high-dimensional global feature vector, which not only retains the core distinguishing information of the multi-source features, but also reduces the data complexity through dimension optimization, and can be directly used in the subsequent dynamic digital watermark generation process.

[0044] In the embodiments of the present application, the fusion method combining weighted splicing and weighted pooling is adopted, which breaks through the limitations of feature information loss or insufficient correlation caused by traditional single fusion method, and the generated high-dimensional fusion feature vector realizes the deep correlation of multi-source features, improves the representation ability of the feature vector to the model uniqueness, and avoids the problem that the subsequent watermark is easily stripped due to insufficient fusion.

[0045] In a preferred embodiment of the present application, in step 3, the global feature vector and the random key are jointly input into the multi-level neural network watermark generator to generate a dynamic digital watermark after processing, which includes: Step 31, splicing and combining the high-dimensional global feature vector and the pre-generated random key to form a joint input vector of the watermark generator, specifically including: The operation of pre-generating a random key is performed, and the generator needs to pass the randomness test including frequency test, block frequency test and run-length test to ensure that the generated random number has unpredictability and non-repeatability; the length of the random key is determined according to the dimension of the high-dimensional global feature vector, if the high-dimensional global feature vector is N-dimensional, the random key is generated N-dimensionally, the binary random key is generated by the generator, and the number of binary bits is consistent with the number of binary bits of each dimension value of the high-dimensional global feature vector; the integrity of the generated random key is verified, the hash value of the key is calculated by a hash algorithm and stored, and the hash value needs to be calculated again in the subsequent splicing process to confirm that the key has not been tampered with.

[0046] The high-dimensional global feature vector and the random key are combined by splicing. It is first confirmed that the dimensions of the two are completely consistent. If there is a dimension difference, the random key is interpolated or truncated to ensure that the dimension of the adjusted key is the same as that of the high-dimensional global feature vector. The combination is performed by alternating splicing, that is, the first dimension value of the high-dimensional global feature vector is taken first, then the first dimension value of the random key is taken, and the values are arranged alternately until all the dimension values are spliced to form a joint input vector. After splicing, it is checked whether the dimension of the joint input vector is twice the dimension of the high-dimensional global feature vector, and whether there is a missing value or an abnormal value in the vector. If there is an abnormality, the splicing operation is re-executed to ensure that the joint input vector completely integrates the multi-source information of the high-dimensional global feature vector and the security information of the random key. Specifically, the confirmation that there is no missing value or abnormal value in the vector includes: All dimensions of the joint input vector are traversed, and each dimension value is checked for null value or undefined state. If any dimension value is null, it is determined that there is a missing value. If all dimensions have explicit value records, the missing value detection is passed. A preset legal value interval (determined according to the value characteristics of the high-dimensional global feature vector and the random key, such as {0, 1} interval for binary random key and [0, 1] interval for standardized feature vector) is preset. For each dimension value of the joint input vector, it is checked whether it falls within the preset legal interval. If any dimension value exceeds the interval range (such as 2 or negative number for binary key dimension), it is determined that there is a range abnormal value. According to the alternating splicing rule, the odd index dimensions (such as 1st, 3rd, 5th… dimensions) in the joint input vector should correspond to the original value characteristics of the high-dimensional global feature vector, and the even index dimensions (such as 2nd, 4th, 6th… dimensions) should correspond to the original value characteristics of the random key. The value sets of the odd index dimensions and the even index dimensions are extracted respectively, and it is checked whether the odd set conforms to the value distribution rule of the feature vector (such as whether it is a normalized continuous value) and whether the even set conforms to the value distribution rule of the random key (such as whether it is a binary discrete value). If not, it is determined that there is a logical abnormality. If the above three checks are passed (no missing value, all values are in the legal interval, and the logical distribution is consistent), it is confirmed that the joint input vector has no abnormality. If any of the checks fails, the position and specific value of the abnormal dimension are recorded, the splicing operation of the high-dimensional global feature vector and the random key is re-executed, and the abnormal position is checked in detail until the generated joint input vector completely passes the above checks.

[0047] Step 32, input the joint input vector into the multi-level neural network watermark generator composed of full connection layer, nonlinear activation layer and normalization layer in sequence; the joint input vector is linearly transformed through the full connection layer, then introduces nonlinear features through the nonlinear activation layer, and finally adjusts the feature distribution through the normalization layer to obtain deep feature representation, which specifically includes: constructing a multi-level neural network watermark generator, which includes an input layer, a full connection layer, a nonlinear activation layer, a normalization layer and an output layer, and each layer is connected in sequence to form a complete network structure; the dimension of the input layer is set to the dimension of the joint input vector to ensure that the joint input vector can be completely input into the network; the full connection layer is set to 3 layers, the number of neurons of the first full connection layer is 2 times the dimension of the input layer, the number of neurons of the second full connection layer is 1.5 times the number of neurons of the first layer, and the number of neurons of the third full connection layer is 0.8 times the number of neurons of the second layer; the weight parameters of each full connection layer are initialized by He initialization method, and the bias parameters are initialized to constant 0.1; after initialization, check whether the value range of the weight and bias meets the preset requirements; the nonlinear activation layer selects ReLU activation function, and a ReLU activation layer is set after each full connection layer; ReLU activation function can alleviate the gradient disappearance problem in network training process, while retaining effective feature information in joint input vector; if neuron "death" phenomenon occurs during training, replace ReLU activation function with LeakyReLU activation function, and set leak coefficient to 0.01; the normalization layer selects batch normalization layer, sets momentum parameter to 0.9 and epsilon parameter to 1e-5, which is used to stabilize the feature distribution in network training process and avoid unstable network training caused by fluctuation of feature value; then train the multi-level neural network watermark generator, construct the training data set, collect 1000 groups of high-dimensional global feature vectors of different types of basic models and corresponding random keys, and label the expected deep feature representation standard for each group of data.

[0048] The error between the deep feature representation output by the network and the labeled standard is calculated by using the weighted error accumulation method dimension by dimension, which specifically includes: The absolute value of the numerical difference is calculated for each corresponding dimension of the deep feature representation (dimension M) and the labeled standard (same dimension M); according to the importance of each dimension in watermark generation (such as setting the dimension weight associated with device identification to 0.3 and the dimension weight associated with architecture fingerprint to 0.2), a preset weight is assigned to each dimension difference; calculate the sum of each dimension difference x corresponding weight to get the weighted error value of single sample; during training, the average value of the weighted error of batch samples is taken as the loss value of the current batch to ensure that the error calculation reflects the overall deviation and highlights the accuracy of key dimensions.

[0049] Adam optimizer parameter refinement: in addition to the learning rate 0.001 and the weight decay coefficient 1e-4, the first moment estimation index (β1) is set to 0.9, the second moment estimation index (β2) is set to 0.999, and the numerical stability term (ε) is set to 1e-8; wherein, the weight decay coefficient is used to apply L2 regularization constraints to the weights of the fully connected layer to reduce the risk of overfitting the training data; the learning rate uses a dynamic adjustment strategy, if the loss of the training set decreases by less than 0.001 for 5 consecutive rounds, the learning rate is automatically decayed to 0.5 times the current value, and the minimum decay is 1e-5.

[0050] Training batch and iteration settings: the determination of the training batch size of 32 is based on the principle of sample diversity coverage, that is, each batch of samples should contain at least 5 different types of feature vectors of the basic model; the upper limit of the number of training iterations is 100 rounds, if the early stopping mechanism is triggered, the training is terminated, otherwise, the training is forced to stop after 100 rounds.

[0051] After each round of training, the weighted average loss of the validation set is calculated (the calculation method is consistent with that of the training set); compare the current round loss with the minimum loss value of the previous 9 rounds (a total of 10 rounds), if the current loss ≥ the minimum loss of the previous 10 rounds, it is recorded as a non-decreasing round; when the number of non-decreasing rounds accumulates to 10 rounds in a row, it is determined that the training has converged or overfitted, and the early stop is triggered immediately; the network parameters corresponding to the minimum loss of the validation set in each round (including the weights / biases of the fully connected layer, the mean / variance parameters of the batch normalization layer) are recorded in real time during the training process; when the early stop is triggered, the parameter set corresponding to the minimum loss is retrieved and saved, ensuring that the saved parameters are the version with the best generalization ability in the training process.

[0052] Test set composition: 200 test samples need to meet three coverage: covering at least 10 different architectures of basic models, covering 5 different industries of requestor institution identifiers, covering 8 different models of target device hardware identifiers, and all samples not participating in the training or validation process; calculate the weighted average error of the deep feature representation and the labeled standard of the 200 test samples, if the average value < 0.05, the error verification is passed; calculate the cosine similarity (value range [-1, 1]) of the deep feature representation of any two different inputs in the test set; statistics of all pairs of similarity values, if more than 95% of the pair similarity < 0.1 (i.e. discrimination = 1-similarity > 0.9), the discrimination verification is passed; only when both the error verification and the discrimination verification are passed, the multi-level neural network watermark generator training is qualified; otherwise, adjust the network structure (such as increase the number of fully connected layer neurons) and retrain until the qualified standard is met.

[0053] Input the joint input vector into the qualified generator, and process it in the following hierarchical order: Input layer adaptation: the joint input vector (dimension 2N) is directly input into the input layer, and after the input layer ensures that the vector has no missing values and no abnormalities through dimension checking, it is output in its entirety to the first fully connected layer; first-stage feature extraction: the first fully connected layer performs linear transformation on the input vector (by multiplying the weight matrix with the input vector and adding a bias), and the transformation result is input into the ReLU activation layer, which sets negative features to 0 (retaining positive effective features), obtaining the first-stage feature with a dimension of 2x2N; second-stage feature enhancement: the first-stage feature is input into the second fully connected layer for linear transformation (the dimension is expanded to 1.5x2x2N), and the transformation result is processed by the ReLU activation layer (to alleviate gradient disappearance), obtaining the second-stage feature; third-stage feature optimization: the second-stage feature is input into the third fully connected layer for linear transformation (the dimension is compressed to 0.8x1.5x2x2N), and the transformation result is input into the batch normalization layer: the feature mean and variance are calculated by a sliding window, and the feature value is standardized to a distribution with a mean of 0 and a variance of 1, and finally a fixed-dimensional deep feature representation is output, which contains not only the nonlinear fusion information of multi-source features, but also stable numerical distribution characteristics.

[0054] Step 33, transform the deep feature representation and map it to the preset watermark space, and convert the continuous vector values in the space into discrete signal sequences through quantization operation, generate a dynamic digital watermark that is uniquely bound to the high-dimensional global feature vector and the random key, specifically including: Pre-set watermark space: determine the parameters of the watermark space according to the application scenario of the target basic model. If the target basic model is an AI diagnosis model in the medical field, set the dimension of the watermark space to 256 to match the multi-dimensional traceability requirements of medical device identification, institution information, etc. Set the numerical range to 0 to 255 to facilitate subsequent quantization into discrete signals and adapt to the signal transmission format of most devices; form an evaluation team composed of information security engineers and model application scenario experts to evaluate the preset watermark space dimension and numerical range, ensure that the dimension can accommodate enough unique watermark combinations, meet the identification requirements of at least 100,000 different models and devices, and the numerical range will not cause signal transmission distortion. If the evaluation fails, adjust the watermark space parameters until the requirements are met.

[0055] The deep feature representation is transformed, a linear mapping matrix is constructed, the number of rows of the matrix is consistent with the dimension of the deep feature representation, and the number of columns is consistent with the dimension of the preset watermark space; parameters of the linear mapping matrix are obtained through training, and the training process aims to make the deep feature representation completely fall into the preset watermark space and retain core information such as hardware identification and institution identification related features as the target, the matrix parameters are iteratively optimized through the gradient descent method, and the similarity is greater than the preset threshold 0.95 until the similarity is greater than the preset threshold 0.95; the deep feature representation is multiplied by the linear mapping matrix trained to obtain a preliminary mapping vector; an attention weight layer is constructed, the weight value is determined by calculating the correlation degree of each dimension of the preliminary mapping vector and the multi-source features such as structure encoding and hardware identification, the higher the correlation degree, the greater the weight value, for example, the weight value of the dimension related to the hardware identification is set to 1.2 times of the weight value of other dimensions, and the preliminary mapping vector is multiplied by the attention weight to obtain a target mapping vector which completely falls into the preset watermark space and highlights the core features.

[0056] The quantization operation is performed, a uniform quantization method is used, the numerical range 0 to 255 of the preset watermark space is divided into 256 equal interval quantization levels, each level corresponds to a discrete value, for example, level 0 corresponds to discrete value 0, level 1 corresponds to discrete value 1, and so on, and level 255 corresponds to discrete value 255; the numerical range of each element in the target mapping vector is calculated to belong to the quantization level, and the discrete value corresponding to the level is taken as the quantization result of the element; after quantization, the cosine similarity of the target mapping vector before and after quantization is calculated, if the similarity is less than the preset threshold 0.95, the interval of the quantization level is adjusted, the interval is reduced to reduce information loss, and the quantization operation is re-executed until the similarity meets the requirement; finally, a dynamic digital watermark is generated, all quantized discrete values are combined according to the dimension order of the target mapping vector to form a discrete signal sequence; the signal sequence is verified for uniqueness, that is, the same high-dimensional global feature vector and random key are used to repeatedly generate the signal sequence, to ensure that the sequences generated multiple times are completely consistent, and different high-dimensional global feature vectors or random keys are used to generate the signal sequence, to ensure that the difference between the sequences is greater than the preset threshold 0.9, and the dynamic digital watermark is obtained which is uniquely bound to the high-dimensional global feature vector and the random key after the verification is passed.

[0057] In the embodiment of the application, through the training process of the multi-level neural network watermark generator and system designed in detail, the deep feature representation generated has stronger abstractness and anti-interference, solves the problem that the traditional watermark feature extraction is shallow and easy to be damaged by pruning and fine-tuning, and the early stopping, weight decay and other strategies in the training process ensure that the generator stably outputs high-quality features.

[0058] In a preferred embodiment of the application, step 4, a dynamic digital watermark is used to embed it into the output layer feature mapping of the target base model through a watermark embedding algorithm based on gradient preservation to generate a watermark-containing derived model, comprising: Step 41, obtain the dynamic digital watermark, and adaptively adjust the watermark signal according to the dimension of the output layer feature mapping of the target base model, generate the watermark pattern to be embedded, specifically including: obtaining the dynamic digital watermark generated in step 3, calling the discrete signal sequence of the watermark from the security storage library through the watermark storage interface, and recording the dimension parameters of the watermark including signal length, channel number, and value range; then obtain the dimension information of the output layer feature mapping of the target base model, traverse the network level of the target base model, locate the output layer and determine the output layer type, if the output layer is a convolution layer, record the height, width and channel number of the feature mapping, if the output layer is a fully connected layer, record the dimension of the feature vector, and convert these dimension parameters into intuitive structure data.

[0059] Determine whether the dynamic digital watermark matches the dimension of the output layer feature mapping, if the watermark dimension is less than the feature mapping dimension, use the block copy strategy, divide the watermark signal into several subblocks according to the channel number of the feature mapping, each subblock corresponds to a feature channel, and then uniformly copy each subblock in the corresponding channel according to the height and width of the feature mapping, to ensure that the dimension of each channel after copying is consistent with the dimension of the feature mapping of the channel; if the watermark dimension is greater than the feature mapping dimension, perform dimension reduction processing on the watermark signal, and in the interpolation process, the arrangement rule of the watermark discrete sequence is retained as the target, the interpolation relationship between adjacent discrete values in the watermark signal is calculated, and the dimension of the reduced watermark pattern is completely matched with the dimension of the feature mapping; after adjustment, calculate the signal similarity, compare the key features of the watermark signal before and after adjustment including the relative size of the discrete value, the peak position of the sequence, and the value distribution trend, and require the similarity to be greater than the preset threshold 0.95, to avoid loss of watermark core information in the adjustment process; if the similarity does not meet the requirements, reselect the adjustment method, such as changing the block copy to adaptive scaling or adjusting the sampling interval of the bilinear interpolation, until the dimension of the watermark pattern to be embedded is completely adapted to the output layer feature mapping of the target base model and the information is complete.

[0060] Step 42, analyze the statistical characteristics and gradient distribution of the output layer feature mapping of the target base model, determine the best position and strength of the watermark pattern embedding, specifically including: The original data of the target base model output layer feature mapping is acquired, a data set containing typical samples of the application scene of the target base model is constructed, medical image samples covering different disease types and different imaging devices are collected for 2000 groups, the samples are input into the target base model for inference, the original data of the output layer feature mapping is captured in real time, each group of samples corresponds to a group of feature mapping data, the statistical characteristics of the feature mapping are analyzed, all feature mapping data are classified and processed according to channels, the mean, variance, peak signal-to-noise ratio and information entropy of each channel are calculated, wherein the mean reflects the overall brightness level of the feature mapping, the variance reflects the dispersion degree of the feature value, the peak signal-to-noise ratio reflects the definition of the feature, and the information entropy reflects the information richness of the feature, and the channels with stable statistical characteristics are selected, that is, the mean fluctuation range is less than 0.02, the variance change amplitude is less than 0.01, the peak signal-to-noise ratio is greater than 30dB, and the information entropy fluctuation is less than 0.1. Such channels have less effect on the forward propagation result of the model and are suitable for being used as the watermark embedding area.

[0061] The gradient distribution of the feature mapping is analyzed, the gradient of each channel of the feature mapping is solved, the gradient modulus and gradient direction of each pixel point are obtained, the gradient modulus reflects the change rate of the feature value of the point, and the gradient direction reflects the direction of the change of the feature value, the gradient modulus distribution of all pixel points is counted, and the pixel region with a gradient modulus less than a preset threshold value 0.1 is selected. Such regions have gentle gradient changes and are not easily covered by the gradient update of the model after watermark embedding; an attention weight calculation model is constructed to determine the importance of the feature position, the model includes an input layer, a convolution layer, a pooling layer and a full connection layer, the dimension of the input layer is consistent with the dimension of the feature mapping, the convolution layer is set to 2 layers and both use 3x3 convolution kernels, the number of the first layer of convolution kernels is 16, and the number of the second layer is 32, which are used to extract local spatial features of the feature mapping, the pooling layer uses 2x2 maximum pooling, which is used to reduce the feature dimension and retain key features, the full connection layer is set to 2 layers, the number of neurons in the first layer is 512, and the number of neurons in the second layer is 1, which are used to output the importance weight of each pixel position.

[0062] Select the typical sample set of the target basic model application scene (such as medical image model, select multiple image samples covering different diseases and imaging devices), input the sample into the target basic model, and record the original inference accuracy; the output layer feature map of each sample is processed in a pixel-by-pixel removal manner: for any pixel in the feature map, set its feature value to the mean value of the channel feature map (to avoid introducing additional interference due to value mutation), and generate a feature map after removing the pixel; input the processed feature map into the target basic model, and record the new inference accuracy; calculate the contribution degree through the difference between the original inference accuracy and the inference accuracy after removing the pixel, and combine the original accuracy; if the accuracy does not decrease after removing the pixel, it is determined that the pixel has no positive contribution to the inference, and the contribution degree is 0; repeat the above pixel removal and contribution degree calculation operation to complete the contribution degree labeling of each pixel in the feature map of all samples, and form a feature map and pixel contribution degree label pair dataset, and divide it into training set and validation set according to the proportion.

[0063] The attention weight calculation model includes an input layer, a feature extraction module, and a weight output module, and the specific structure is as follows: Input layer: the dimension is completely consistent with the output layer feature map dimension of the target basic model; feature extraction module: 2 layers of convolutional layers (both using small size convolutional kernels, setting different number of convolutional kernels, and matching ReLU activation function) + 1 layer of maximum pooling layer (controlling the dimension through the step, and retaining local key features); weight output module: 2 layers of fully connected layers (the first layer is set with more neurons, and matches ReLU activation; the second layer has only one neuron, and the output is limited to the 0-1 interval through the activation function, corresponding to the importance weight of the pixel).

[0064] Loss function and optimizer configuration: Weighted cross-entropy loss function is used: because the proportion of high-contribution-degree pixel samples is usually low, in order to avoid model bias prediction of low-contribution-degree, higher weight coefficient is allocated to high-contribution-degree samples, and basic weight coefficient is allocated to low-contribution-degree samples, so as to balance the training influence of samples with different contribution degrees; optimizer parameters are supplemented: in addition to the basic learning rate and weight decay coefficient, the first moment estimation coefficient, the second moment estimation coefficient and the numerical stability term are set for Adam optimizer, so as to avoid gradient shock or numerical anomaly in the training process.

[0065] Training process and early stopping mechanism optimization: Training batch processing: the training batch size is set according to the sample diversity requirement, and each batch is randomly sampled from the training set to ensure that different feature mapping samples with different contribution degree distributions are included; iteration and early stopping: set an upper limit for the number of training iterations, and calculate the weighted cross-entropy loss value of the validation set after each training round; early stopping criteria: record the lowest loss value of the validation set in each round, and if the loss value of the validation set does not decrease for several consecutive rounds (i.e., no downward trend), trigger the early stopping mechanism and stop training immediately and save the model parameters at this time; if the early stopping is not triggered after training to the iteration upper limit, save the model parameters of the last round.

[0066] After training, the model performance is evaluated using the validation set: calculate the linear correlation coefficient between the pixel weight predicted by the model and the actual contribution degree, and if the correlation coefficient reaches the preset standard (indicating that the weight and contribution degree are strongly related), the model is qualified; if it does not meet the standard, adjust the network structure (such as increasing the number of convolution kernels or adding new network layers) and retrain until the model meets the performance requirements.

[0067] Input the feature mapping of the target base model output layer into the qualified attention weight calculation model to obtain the importance weight of each pixel; traverse all pixels and filter out pixels with a weight value below a preset threshold, mark them as low-weight pixels, and record their coordinates and the channel they belong to. Select multiple groups of new samples that do not participate in contribution degree labeling, and repeat the weight calculation and filtering operation for each sample's feature mapping to obtain the low-weight pixel set for each group of samples; count the frequency of each pixel being determined as a low-weight pixel in all new samples, and filter out pixels with a frequency reaching a preset proportion to form a stable low-weight pixel set; use the neighborhood connectivity judgment method to filter out connected regions with a pixel number reaching a preset size (to ensure that the entire watermark sub-block can be carried), and the region is the best position for watermark embedding, record its coordinate range and the channel it belongs to.

[0068] Statistical analysis of the numerical range of the feature mapping of the best position, and set the initial embedding strength according to the range (to ensure that the initial strength does not excessively affect the original value of the feature mapping); select multiple groups of validation samples covering the core application scenarios of the target base model (with no intersection with the training set and the validation set), and record the original inference accuracy of the samples.

[0069] Adjust the embedding strength by a fixed step size (set a reasonable strength adjustment range to avoid excessive strength leading to a sharp drop in model accuracy), and for each test strength, perform the following operations: Watermark embedding, embedding the watermark pattern to be embedded in the feature map according to the optimal position coordinates in a pixel value superposition manner; if the superposed pixel value exceeds the value range of the feature map, truncation processing is performed; accuracy test, inputting the feature map embedded with the watermark into the target base model, calculating the average inference accuracy of all test samples, and obtaining the accuracy drop amplitude; watermark extraction test, using a preset watermark extraction algorithm to extract the watermark from the feature map embedded with the watermark, and calculating the watermark extraction success rate (the success extraction standard is that the similarity between the extracted watermark and the original watermark reaches a preset threshold); screening the optimal strength, selecting the minimum embedding strength that simultaneously satisfies the accuracy drop amplitude lower than the preset upper limit and the watermark extraction success rate higher than the preset lower limit (avoiding excessive embedding affecting the model performance); if all test strengths do not satisfy, repeating the test after adjusting the strength adjustment range and step size until the optimal strength is found.

[0070] Step 43, embedding the watermark pattern to be embedded in the feature map according to the determined optimal position and strength; by introducing a gradient constraint term through a coefficient, the change of the original feature map gradient distribution caused by the watermark embedding operation is limited, so that the feature map embedded with the watermark can maintain the original forward propagation characteristics of the model, and the gradient back propagation behavior is consistent with the original model, specifically including: Performing weighted fusion operation, according to the optimal position determined in step 42, the watermark pattern to be embedded is fused with the feature map of the output layer of the target base model at the corresponding position, and the weight coefficient of the feature map is set as a, the weight coefficient of the watermark pattern is set as β, and a+β=1, wherein the value of a is determined according to the feature importance of the optimal position, the value of a is 0.95 when the feature importance of the position is high, such as the attention weight being between 0.1 and 0.2, the value of a is 0.9 when the feature importance of the position is low, such as the attention weight being less than 0.1, and β is 0.05 or 0.1, so as to ensure that the watermark pattern can be effectively embedded and the core information of the feature map is not covered; during the fusion process, the fusion value of each position is calculated one by one, and the fusion value of each position is the original feature value of the position multiplied by a plus the corresponding value of the watermark pattern multiplied by β, and the feature map embedded with the watermark is obtained after the fusion of all optimal positions is completed.

[0071] Positioning the output layer feature map of the target base model to the optimal position determined in step 42, extracting the gradient values of all pixels at this position through the model gradient calculation function, including the gradient modulus (reflecting the gradient change intensity) and the gradient direction (reflecting the spatial direction of the gradient change) of each pixel, and storing these data according to the pixel coordinates to form an original gradient reference library; for the watermark-containing feature map fused in step 43, at the same optimal position, the gradient modulus and direction of each pixel are extracted in the same way as the original gradient collection to form a watermark-containing gradient data set.

[0072] The original gradient reference library and the watermark gradient data set are compared one by one according to pixel coordinates. For the same pixel position, the difference in gradient module length between the two is calculated, and the absolute value is taken (measuring the degree of change in gradient intensity). At the same time, the gradient direction is judged by the angle (if the directions are the same or similar, the difference is small, and if the directions are opposite, the difference is large), which assists in correcting the length difference result. The gradient difference of each pixel is quantified into a specific value, and the difference value of all pixels is summarized to form the overall gradient difference index. This index directly reflects the degree of change in the gradient distribution of the original feature mapping caused by the watermark embedding operation. The smaller the index value, the more complete the gradient distribution is preserved.

[0073] Taking the gradient difference index as the core, a constraint coefficient λ (used to adjust the strength of the gradient constraint) is introduced to construct the gradient constraint term: the numerical size of the constraint term is positively correlated with λ and the gradient difference index. That is, the larger λ and the larger the gradient difference index, the stronger the influence of the constraint term on the model loss. By incorporating this gradient constraint term into the loss function of the target base model, the model can consider the consistency of the gradient distribution during subsequent fine-tuning training, avoiding deviation of the gradient backpropagation behavior from the original model caused by watermark embedding.

[0074] Training and verification system construction: Sample preparation: 500 sets of verification samples covering the full application scenario of the target base model (including regular samples and edge samples to ensure that the sample distribution is consistent with the actual use scenario) are selected. After preprocessing according to the model input requirements, a λ optimization verification sample set is formed. Deploy the target base model in the training framework and configure the same training environment as the original model (such as hardware devices, software versions, and hyperparameter base values) to ensure the comparability of the verification results. Set the initial value range of λ to 0.1 to 1.0, with an adjustment step of 0.1 each time (i.e., test 0.1, 0.2, …, 1.0 for a total of 10 values). For each test λ value, substitute it into the gradient constraint term and start the fine-tuning training of the target base model, with each training fixed at 10 rounds. During training, use the model monitoring function to record the gradient update amplitude (such as the update value of the weight parameter) and the gradient direction (such as the positive or negative trend of parameter update) of each network layer (such as convolutional layer, fully connected layer, and normalization layer) during each backpropagation, forming a current λ gradient record library.

[0075] With the original gradient reference library as a reference, compare the current λ gradient record library from the gradient update amplitude (calculate the difference with the original model, the smaller the difference, the better) and the gradient direction (statistically, the higher the proportion of the same direction as the original model, the better). The gradient consistency of the two is quantified comprehensively (the closer to 1, the more consistent the gradient behavior of the watermark-containing model and the original model).

[0076] The calculated gradient consistency needs to be greater than 0.98 (to ensure that when the watermark-containing model is back propagated, the gradient update of each layer parameter is highly consistent with the original model); after 10 rounds of training, the model inference performance is tested using the lambda optimization verification sample set, the accuracy difference between the watermark-containing model and the original model is calculated, and the accuracy drop is required to be less than 0.3% (to avoid excessive impact on the business performance of the model forward propagation due to gradient constraints).

[0077] Each lambda value is verified in turn to see if it meets the above two conditions. If a lambda value meets both conditions, it is marked as a candidate optimal lambda. If there are multiple candidate optimal lambdas, the lambda value with the highest gradient consistency and the smallest accuracy drop is selected as the final optimal lambda value. If none of the test lambda values meet the conditions, the lambda value range needs to be expanded (e.g. from 0.05 to 1.2) or the adjustment step size needs to be reduced (e.g. 0.05), and the above test process needs to be re-executed until the optimal lambda value that meets the requirements is found.

[0078] The gradient constraint term is added to the loss function of the target base model. During the subsequent fine-tuning training of the model, the feature mapping values embedded with the watermark are optimized through back propagation, so that the feature mapping embedded with the watermark remains consistent with the original model in terms of gradient back propagation behavior while maintaining the original forward propagation characteristics of the model, i.e. the difference between the model inference results and the original model is less than 0.5%. Specifically, the difference between the gradient update amplitude of each layer weight parameter and bias parameter and the original model is less than 0.02, and the proportion of the same gradient direction is greater than 99%. After fusion and constraint, the gradient changes during 100 rounds of model training are continuously monitored. If the gradient consistency drops below 0.98, the weight coefficients of alpha and beta and the constraint coefficient of lambda need to be adjusted until the gradient consistency meets the preset requirements after each round of training.

[0079] Step 44, integrity check of the feature mapping with embedded watermark, finally generating a derivative model containing dynamic digital watermark, specifically including: constructing an integrity check index system, including three types of indexes: forward propagation performance index, watermark integrity index, and gradient consistency index; the index is used to verify the impact of watermark embedding on the core business capability of the model, to ensure that the model can be normally applied, specifically including: Select 2000 test samples, which need to cover all application scenarios of the target base model, and include regular samples, edge samples and abnormal samples, to simulate the data distribution in the actual application of the model; deploy the original model and the preliminary watermark-containing model in the same hardware environment and software environment, the hardware environment includes the same type of processor and memory, the software environment includes the same version of operating system, deep learning framework and driver, and irrelevant background processes are closed to avoid environmental interference.

[0080] Inference accuracy difference verification: The 2000 test samples are respectively input into the original model and the preliminary watermark-containing model to obtain inference results of the two models; the inference results of the two models are compared with the sample label information to determine the inference accuracy of the original model and the preliminary watermark-containing model respectively; the difference in inference accuracy of the two is calculated, which is required to be less than 0.5%; for the core application scenario of the model, the accuracy difference in this scenario is calculated separately, and the accuracy difference in the core scenario is required to be less than 0.3%. The total time consumed by the original model and the preliminary watermark-containing model in processing 2000 test samples, and the average time consumed in processing a single sample and the batch average time consumed in processing samples according to the preset batch size are recorded; the inference speed drop of the preliminary watermark-containing model relative to the original model is calculated, which is required to be less than 5%. If the inference speed drop is greater than or equal to 5%, the fusion mode of the feature mapping is optimized, for example, the number of watermark embedding in non-critical positions is reduced, and the non-critical positions are regions with lower attention weight; after optimization, the forward propagation performance index verification is performed again until the above requirements are met.

[0081] This index is used to verify that the embedded dynamic digital watermark can be accurately extracted to guarantee the traceability capability, specifically including: Watermark extraction: according to the preset watermark extraction process, the watermark signal is extracted from the output layer feature mapping of the preliminary watermark-containing model to obtain the extracted watermark signal. The extracted watermark signal and the discrete sequence arrangement and feature value distribution of the original dynamic digital watermark are compared; wherein the discrete sequence arrangement comparison includes the consistency of the positions of peak values and valley values in the sequence and the overall rising and falling trend of the sequence, and the feature value distribution comparison includes the consistency of the proportion of feature values in each numerical interval; the similarity between the extracted watermark signal and the original dynamic digital watermark is required to be greater than 95%. If the similarity is less than or equal to 95%, the position and strength of the watermark embedding are returned to be determined again, and the watermark embedding and integrity verification steps are executed again after adjustment until the above requirements are met; this index is used to ensure that the gradient backpropagation characteristics of the model after watermark embedding remain consistent with the original model, avoiding affecting the subsequent training of the model, specifically including: Gradient data acquisition: 100 verification samples are selected and input into the original model and the preliminary watermark-containing model respectively to trigger the model backpropagation process, and the gradient information of each network layer parameter of the two models is recorded, wherein the network layer includes convolution layer, fully connected layer and normalization layer, and the parameter includes weight parameter and bias parameter.

[0082] The gradient Euclidean distance of the same parameters of the corresponding network layer of the preliminary watermark-containing model and the original model is calculated, and the Euclidean distance is less than 0.02; if the Euclidean distance is greater than or equal to 0.02, the constraint coefficient of the gradient constraint term is returned, and after adjustment, the gradient constraint optimization and the checking step are performed again until the above requirements are met; only when the forward propagation performance index, the watermark integrity index and the gradient consistency index all meet the respective preset requirements, it is determined that the preliminary watermark-containing model integrity checking is qualified; if any index does not meet the requirements, the corresponding step needs to be adjusted and the checking needs to be performed again until all the indexes meet the standards, and finally the derived model containing the dynamic digital watermark is generated.

[0083] If any index does not meet the requirements, the above adjustment process is repeated until all the indexes meet the preset standards; then the anti-attack performance test is performed, the infringement scene in the background technology is simulated, first, the channel pruning test is performed on the output layer and the previous layer of the preliminary watermark-containing model, the pruning ratio is gradually increased from 10% to 30%, after each pruning is completed, the watermark is extracted and the model accuracy is tested, and it is required that the watermark extraction similarity after pruning is still greater than 0.9 and the model accuracy decreases by less than 1%.

[0084] The fine-tuning test is performed, 100 groups of new samples not participating in the model training are collected, the preliminary watermark-containing model is fine-tuned for 20 rounds, the watermark is extracted after fine-tuning and the model performance is verified, it is required that the watermark similarity is greater than 0.92 and the model accuracy on the test set decreases by less than 0.8%; after the anti-attack test is passed, the parameters of the watermark-containing model are completely saved, including the key information such as the feature mapping parameters of the output layer after embedding the watermark, the alpha beta weight coefficient in the watermark embedding process, the gradient constraint coefficient lambda and the best embedding position coordinates; the information is integrated with the model main parameters such as the weight and bias of each layer into a unified model file; finally, unique identification information is added to the model file, including the number of dynamic digital watermark, the hardware identification of the target device, the identification of the requesting agency, the embedding timestamp, and the derived model containing the dynamic digital watermark and meeting the performance and safety requirements is generated.

[0085] In the embodiment of the application, the best embedding position and strength are accurately determined through statistical characteristic analysis, gradient distribution analysis and attention weight model, the problems of model performance decline or watermark being easily stripped by pruning and fine-tuning caused by improper embedding position in the traditional embedding are solved, the low importance area with stable statistics and gentle gradient is selected for embedding, which reduces the influence on the forward propagation of the model and reduces the risk of watermark being covered by gradient update, and improves the security and model compatibility of watermark embedding.

[0086] In a preferred embodiment of the present application, step 5, the derived model is quality evaluated and tested to obtain a qualified watermark-containing model; the qualified watermark-containing model is distributed to the requestor authorized equipment through an encrypted channel, and the watermark generation parameters, distribution context information and timestamp are written into the secure evidence library as evidence data, including: Step 51, using a preset test data set to perform forward inference on the derived model, calculate the accuracy reduction value of the output result relative to the original target base model, and confirm that the reduction value is lower than the preset performance threshold; and perform watermark extraction test on the derived model to verify that the watermark extraction success rate is higher than the preset survival rate threshold, obtain the evaluation result, specifically including: constructing a preset test data set, which needs to cover the full application scenario of the target base model to ensure evaluation accuracy, if the target base model is a medical AI diagnosis model, 3000 groups of medical image samples are collected, covering common disease types such as pneumonia, lung cancer, brain tumor, etc., images generated by different imaging devices such as CT, magnetic resonance, X-ray, different resolutions and imaging quality, of which 2000 groups are used as test samples for accuracy calculation, and 1000 groups are used as anti-attack test samples for watermark survival rate verification, all samples are labeled with true diagnosis results as the basis for judging the correctness of inference.

[0087] Forward inference test is performed, 2000 test samples are input into the original target base model and the derived model respectively, the inference results of the two models for each sample are recorded, the number of samples that the derived model infers correctly and the number of samples that the original model infers correctly are counted, the accuracy reduction value of the derived model relative to the original model is calculated, the preset performance threshold is determined according to the model application scenario, the medical diagnosis model has a very high requirement for accuracy, and the preset performance threshold is 0.5%, the preset performance threshold of the industrial quality inspection model is 1%, if the accuracy reduction value is lower than the corresponding threshold, it is determined that the forward inference performance meets the standard; then the watermark extraction test is performed, first, the non-attack scene extraction is adopted, the watermark signal is extracted from the derived model output layer feature mapping through the watermark extraction process of step 6, the similarity is calculated by comparing the discrete sequence arrangement characteristic value distribution of the extracted signal and the original dynamic digital watermark; then the infringement attack scene extraction in the background technology is simulated, the pruning processing is performed on the output layer and the previous layer of the derived model, the pruning ratio is gradually increased from 10% to 30%, after each pruning is completed, the watermark is extracted and the similarity is calculated, 50 new samples are collected to fine-tune the derived model for 20 rounds, and the watermark is extracted after fine-tuning and the similarity is calculated; the preset watermark survival rate threshold is 95%, that is, the watermark extraction similarity under the non-attack scene is not less than 95%, the similarity is not less than 92% when the pruning ratio is not more than 20%, and the similarity is not less than 90% after fine-tuning, if the watermark extraction success rate under all scenes is higher than the corresponding threshold, it is determined that the watermark survival rate meets the standard; finally, the forward inference performance result and the watermark survival rate result are combined to generate an evaluation report.

[0088] Step 52, based on the evaluation result, the derivative model meeting the performance requirement and the watermark survival rate requirement is given a verification qualified identification, and a verification qualified watermark containing model is generated, specifically including: determining the constituent elements of the verification qualified identification, the identification needs to be associated with the model full life cycle key information to solve the problem of single identification in background technology cannot be traced back, the elements include the unique number of dynamic digital watermark generated in step 3, the equipment hardware information mapping vector collected in step 1, the equipment hardware identification of target equipment, the agency digital vector parsed in step 1, the version number of the derivative model generated based on the model iteration number, the evaluation qualified timestamp accurate to millisecond, these elements are combined to form the original identification string in the order of watermark number, hardware identification, agency identification, version number and timestamp; the original identification string is processed safely, the hash value of the original string is calculated, and then the identification string with digital signature is generated through the distribution party, so as to ensure that the identification cannot be tampered and can be traced back to the distribution party.

[0089] The verification qualified identification is associated with the watermark containing model, the identification string with digital signature is embedded in the metadata area of the derivative model, the metadata area needs to be independent of the model calculation parameter area to avoid affecting the model reasoning performance, at the same time, the simplified index of the identification string is added in the header information of the model file, so as to facilitate the subsequent quick query of identification information; finally, the identification association verification is carried out, the identification string of the metadata area of the derivative model is read, the validity of the digital signature is verified, that is, the signature is decrypted through the public key of the distribution party and compared with the hash value of the original string, it is confirmed that the identification has not been tampered, at the same time, it is checked whether the hardware identification and agency identification in the identification are consistent with the information collected in step 1, if the verification is passed, the verification qualified watermark containing model is formally generated, if the verification fails, the identification is regenerated and the association operation is repeated.

[0090] Step 53, the watermarked model with the qualified identification is distributed to the requestor authorized device through a secure transmission protocol, and the distribution context information is recorded during the distribution process, including: selecting a secure transmission protocol, considering the security and stability of the model file transmission, selecting TLS1.3 protocol as the basic transmission protocol, and superimposing a special security layer to enhance the protection capability, the special security layer includes an identity authentication module, a data encryption module and a transmission verification module; the identity authentication module adopts a two-way authentication mechanism, the distributor needs to verify the hardware identification and digital certificate of the requestor authorized device, and the requestor authorized device needs to verify the digital certificate of the distributor, during the verification process, the device needs to submit the hardware identification information collected in step 1, the distributor compares the pre-stored device information in the secure evidence library, and only when the hardware identification and certificate are verified, the transmission connection is allowed to be established; the data encryption module performs encryption processing, the encryption key is dynamically generated between the distributor and the authorized device through a key agreement protocol such as ECDHE protocol, a new key is generated for each transmission to avoid security risks caused by key leakage; the transmission verification module adopts CRC32 verification algorithm to verify the data packet during transmission, each data packet is attached with a verification value, the authorized device re-calculates the verification value after receiving and compares it with the attached value, if they are inconsistent, it requests to retransmit.

[0091] The distributor divides the encrypted watermarked model file into several fragments according to 10MB size, transmits the fragment data to the authorized device in order, and records the distribution context information in real time during the transmission process, including the IP address, port number, hardware identification of the authorized device, transmission start time, transmission end time, transmission time length of each fragment, transmission state, number of retransmission times, network bandwidth fluctuation during transmission, and receiving confirmation information of the authorized device; if the fragment transmission fails during the transmission process, the retransmission mechanism is automatically triggered, the number of retransmissions does not exceed 3 times, if the 3 times of retransmission still fails, the transmission is suspended and an alarm is sent to the distributor, at the same time, the fault information is recorded to the distribution context; when all fragments are successfully transmitted and the authorized device completes the file recombination, the distributor receives the file integrity confirmation information returned by the authorized device, the confirmation information contains the hash value of the recombined file, the distributor compares the hash value with the hash value of the original model file, if they are consistent, it is determined that the distribution is successful, if they are inconsistent, the authorized device is guided to recombine or retransmit.

[0092] Step 54, based on the distribution context information, combined with the watermark generation parameters used in the generation of dynamic digital watermarking process and the distribution timestamp, the complete evidence record is generated and submitted to the secure evidence library as the written content, which specifically includes: combing the complete content of the evidence data, including the multi-source feature vector of the watermark generation parameter step 1 and the weighted fusion algorithm parameter step 2 of the weighted coefficient step 3, the structure parameter of the random key multi-level neural network watermark generator step 4, the watermark mode adjustment parameter step 5, The best embedding position strength a, b weight coefficient gradient constraint coefficient l, distribution context information step 53 record of authorized equipment information transmission time slice transmission state network information receiving confirmation information, distribution timestamp accurate to millisecond and step 52 evaluation qualified timestamp, verification qualified identification original string and digital signature.

[0093] The secure evidence library is constructed, and the alliance chain architecture is adopted to ensure that the evidence data is not tamperable. The alliance chain nodes include model distribution parties, request parties, institutions, third-party auditing institutions, and state-recognized intellectual property protection institutions. Each node has data storage and verification authority; the bottom layer of the evidence library adopts distributed ledger technology, and the ledger records are stored in chronological order in a chain. Each block contains a block header and a block body. The block header contains the hash value of the previous block, the timestamp, and the block number. The block body contains the hash value and the abstract information of the evidence data; the evidence library also needs to set an access control module, only authorized nodes can read the evidence data, and modification and deletion operations need to pass through all nodes consensus, and the consensus mechanism adopts the practical Byzantine fault tolerance algorithm to ensure the efficiency and security of the consensus; then the evidence data writing operation is performed, the evidence data after combing is organized according to the structure of the watermark generation parameter, the distribution context, the timestamp, and the verification qualified identification into the standard JSON format of the written content, and the unique hash value of the written content is calculated by the hash algorithm, and the hash value and the written content are submitted to the write interface of the evidence library.

[0094] After receiving the evidence library, all alliance chain nodes verify the integrity and legality of the written content, the verification content includes whether the watermark generation parameter and step 34 record are consistent, whether the distribution context and step 53 record are consistent, the rationality verification of the timestamp, and the signature validity of the verification qualified identification. If all nodes pass the verification, the written content is stored in the distributed ledger, and a unique evidence number is generated, the evidence number is associated with the hash value of the written content; finally, the evidence success notification is returned to the distribution party, the notification includes the evidence number, the evidence time, and the verification results of all nodes. The distribution party associates and stores the evidence number with the watermark model verification qualified identification, which facilitates subsequent tracing and quick query of evidence data through the evidence number.

[0095] In the embodiment of the present application, the secure distribution mechanism of the slice check by bidirectional authentication encryption transmission and the detailed context record solve the problems of insecurity and lack of propagation track record in the traditional distribution process, ensure that the model is only distributed to authorized equipment, and the recorded context provides data support for tracking the propagation path, avoiding the model being illegally propagated and being unable to be traced.

[0096] In a preferred embodiment of the present application, step 6, running the distributed watermark-containing model on the authorized equipment, and obtaining the watermark-bearing signal from the output data of the model during the model running process; analyzing the watermark-bearing signal to extract the watermark information, and recovering the original feature vector through the inverse mapping algorithm, including: Step 61, running the watermark-containing model on the authorized equipment, and collecting the output data generated during the model running process in real time, specifically including: preconfiguring the running environment of the authorized equipment, checking the hardware parameters of the authorized equipment including the central processor model, memory capacity, hard disk serial number, network adapter physical address according to the target device hardware identifier recorded in the security evidence library, ensuring complete consistency with the evidence information; at the same time, installing the operating system version, driver version and deep learning framework version matched with the model distribution, the framework version deviation needs to be controlled within 0.1, avoiding the distortion of model output data due to environmental differences; after the configuration is completed, running the preset test script, the script contains 10 groups of standard input data, if the error between the test script output result and the preset standard result is less than 0.01, it is determined that the running environment is qualified. Then run the watermark-containing model, pass the hardware identifier of the authorized equipment into the model through the device authentication interface, and start running after the model verifies that the hardware identifier is consistent with the built-in identifier; determine the input sample set according to the model application scenario, such as selecting 500 groups of medical image samples covering different diseases for medical AI diagnosis model, the samples need to include new samples not involved in model training to simulate actual application scenarios.

[0097] Input the samples in batches, the number of samples in each batch is determined according to the memory capacity of the authorized equipment, to ensure that the memory occupancy rate does not exceed 80% during batch running, avoiding output data loss caused by memory overflow. Real-time collection of output data, real-time communication link is established with the model output layer, the link uses encryption transmission protocol to ensure data transmission security; the collection content includes feature mapping data, reasoning completion timestamp and hardware running state parameters including central processor usage, memory occupancy and GPU computing power utilization rate of the model each time the inference output; the collection frequency is set to be synchronized with the model inference frequency, that is, once the sample inference is completed, the output data is collected, and the collection interval error is not more than 10 milliseconds.

[0098] The collected data is pre-processed and stored, and abnormal data generated during the collection process is removed. The abnormal data determination standard is that the feature mapping data loss rate exceeds 5% or the hardware state parameter exceeds the normal range. The pre-processed data is named according to the inference time stamp, sample number, and output data format, and is stored in the encrypted storage partition of the authorized device. The storage partition is protected by an AES-256 encryption algorithm. The key is bound to the hardware identifier of the authorized device to ensure that the data can only be decrypted and used on the authorized device.

[0099] In step 62, the output data is subjected to signal detection and separation processing to identify and extract the watermark-bearing signal embedded in the output data. Specifically, a watermark-bearing signal detection model is constructed. The model is a convolutional neural network structure, including an input layer, a convolutional layer, a batch normalization layer, an activation layer, a pooling layer, and a fully connected layer. The input layer dimension is consistent with the feature mapping dimension of the model output data, ensuring that the output data can be completely input. The convolutional layer is set to 3 layers, the first layer uses a 3x3 convolution kernel with a quantity of 32, the second layer uses a 5x5 convolution kernel with a quantity of 64, and the third layer uses a 3x3 convolution kernel with a quantity of 128, for extracting local signal features in the output data. A batch normalization layer and a ReLU activation layer are set after each convolutional layer, with a momentum parameter of 0.9 and an epsilon parameter of 1e-5, to stabilize the training process and alleviate gradient disappearance. The pooling layer uses 2x2 max pooling and is set after the second and third convolutional layers to reduce the feature dimension and retain key signal features. The fully connected layer is set to 2 layers, with a neuron quantity of 1024 in the first layer and 2 in the second layer, for outputting a binary detection result containing or not containing a bearing signal.

[0100] The detection model is trained, and a training data set is constructed. 10,000 groups of output data containing a watermark model are collected as positive samples, and each group of data is labeled with a bearing signal label. 10,000 groups of original output data without a watermark model are collected as negative samples, and each group of data is labeled without a bearing signal label. The data set is divided into a training set and a validation set in a 7:3 ratio. The difference between the model prediction result and the label is calculated using a cross-entropy loss function. The Adam optimizer is selected, with a learning rate of 0.001 and a weight decay coefficient of 1e-4. The training batch size is 32, and the training iteration is 80. The validation set accuracy is calculated after each training round. If the validation set accuracy does not improve for 10 consecutive rounds or the accuracy reaches 99.5%, the training is stopped, and the optimal model parameters are saved. After training, the test set is verified. The test set contains 2,000 groups of positive and negative samples that did not participate in the training. If the detection accuracy is greater than 99% and the false detection rate is less than 0.5%, the detection model is determined to be qualified.

[0101] Signal detection is performed, and the output data collected in step 61 is input into a qualified detection model, and the model outputs a judgment result of whether the data contains a watermark bearing signal; if it is judged that the bearing signal is contained, the signal separation link is entered, if it is judged that the bearing signal is not contained, an abnormal alarm is triggered, the current device state and input sample information are recorded and uploaded to a security storage library, and the model output data of the sample is re-collected; signal separation processing is performed, and an adaptive noise cancellation filter is used, which includes a reference signal input end and a main signal input end, and the main signal input end is connected to the output data containing the bearing signal confirmed by detection.

[0102] Step 63, the watermark bearing signal is analyzed and decoded, and the watermark information contained therein is extracted, specifically including: determining the watermark analysis and decoding rule, calling the quantization level corresponding relationship, signal sequence arrangement order, feature identification coding rule when generating dynamic digital watermark in step 3 from the security storage library, wherein the quantization level corresponding relationship is the mapping table of quantization level and discrete value in step 33, the signal sequence arrangement order is the corresponding relationship of the dimension order discrete sequence order of the target mapping vector in step 33, and the feature identification coding rule is the coding logic of the institution identification, digital vector, hardware identification and digital vector in step 21; these rules are imported into the analysis and decoding system as the basis for analysis processing. A watermark analysis model is constructed, which is a bidirectional recurrent neural network structure, including an input layer, an embedding layer, a bidirectional LSTM layer, a full connection layer and an output layer; the dimension of the input layer is consistent with the length of the separated watermark bearing signal sequence, the embedding layer maps the input sequence to a 256-dimensional embedding vector, which is used to capture the local correlation features of the signal sequence; the bidirectional LSTM layer is set to 2 layers, and the number of hidden units in each layer is 512, the forward LSTM captures the feature dependence from left to right, the backward LSTM captures the feature dependence from right to left, and the global sequence features are obtained by splicing the outputs of the two.

[0103] The full connection layer is set to 3 layers, the first layer has 1024 neurons, the second layer has 512 neurons, and the third layer is an output layer consistent with the original dimension of the dynamic digital watermark, used to output the parsed watermark information; during model training, the original dynamic digital watermark sequence generated in step 3 is used as a label, and the corresponding separated carrier signal sequence is used as an input sample, and the sample number is 5000 groups; the mean square error loss function is used to measure the difference between the model output and the original watermark sequence, the Adam optimizer is selected, the learning rate is set to 0.0005, the weight decay coefficient is set to 1e-5, the training batch size is 16, and the training iteration is 100 rounds; after each round of training, the sequence similarity of the validation set is calculated, if the similarity does not improve for 15 consecutive rounds or the similarity reaches 99.2%, the training is stopped, and the optimal model parameters are saved; after training, the test set is verified, the test set contains 1000 groups of carrier signals and original watermark sequences that do not participate in training, if the similarity between the parsed sequence and the original sequence is greater than 99%, the parsing model is determined to be qualified. Perform watermark parsing processing, input the separated and standardized watermark carrier signal of step 62 into the qualified parsing model, the model captures the forward and backward dependence of the signal sequence through the bidirectional LSTM layer, combines the imported parsing decoding rule, and outputs the preliminary parsed watermark information; the preliminary parsed information includes a discrete numerical sequence, an agency identification code segment, a hardware identification code segment, and a watermark generation time code segment.

[0104] The specific calculation process of the mean square error loss function is as follows: the input sample and the label of the model training are uniformly processed, the input sample is the separated and standardized watermark carrier signal sequence of step 62, and the label is the original dynamic digital watermark sequence generated in step 3, both of which need to be converted into one-dimensional numerical sequences with the same dimension, and the sequence length is consistent with the original dimension of the dynamic digital watermark. Normalize each value in the input sample and the label, and uniformly map the value range to the interval of 0 to 1, normalize the process based on the maximum and minimum values of all values in the sample set, ensure that the value magnitude of the input and the label is consistent, and avoid loss calculation deviation caused by value difference. At the same time, samples with missing or abnormal values in the sample set are removed, and the abnormal sample determination standard is that any value in the sequence exceeds the range of 0 to 1000 (because the discrete value range of the watermark carrier signal is preset to 0 to 255, values exceeding this range can be determined as collection or separation error), and finally 5000 valid samples are reserved for training, divided into a training set of 4000 groups and a validation set of 1000 groups in a ratio of 8:2.

[0105] In each iteration of model training, a group of samples is randomly selected from the training set (according to the batch size of 16, actually 16 groups of samples are extracted in parallel calculation, and here the logic of single group calculation is first described), and the watermark bearing signal sequence of the group of samples is input into the watermark analysis model in training. The model captures the dependence relationship before and after the sequence through the bidirectional LSTM layer, and outputs the preliminary analysis sequence with the same dimension as the label after the full connection layer processing. When calculating the mean square error loss value of the group of samples, the numerical difference between the preliminary analysis sequence and the original dynamic digital watermark sequence is compared dimension by dimension. The difference value of each dimension is calculated by the difference between the analysis value and the label value. Then the error value of each dimension is squared to obtain the error square value. Then the total dimension number N of the sequence is counted (N is consistent with the original dimension of the dynamic digital watermark), and the sum of all dimension error square values is calculated. The error square sum is divided by the total dimension number N to obtain the single group mean square error loss value of the group of samples, which reflects the average deviation degree of the analysis result of the single group of samples and the true label.

[0106] According to the setting of batch size 16, 16 groups of samples are processed simultaneously in each batch training, and the single group mean square error loss value of the 16 groups of samples is calculated respectively. After that, the sum of the 16 single group loss values is calculated to obtain the loss value sum of the batch. Then the loss value sum is divided by the batch sample number 16 to obtain the average mean square error loss value of the batch, which is used as the loss benchmark of the current batch model training. In order to avoid the influence of numerical overflow on the stability of training in the calculation process, numerical truncation processing is added after the error square calculation, and the truncation threshold is set to 10. If the error square value of a certain dimension exceeds 10, it will be adjusted to 10 to prevent abnormal model parameter update caused by excessive error value. At the same time, after the loss calculation of each batch is completed, the reasonableness of the average loss value is checked. If the average loss value is greater than 1, it is determined that the batch of samples is abnormal, and the batch of samples is re-extracted for calculation to ensure that the batch loss value can truly reflect the model training state.

[0107] The calculated batch average mean square error loss value is input into the Adam optimizer, and the optimizer calculates the gradient direction and gradient size of each layer parameter of the model according to the loss value: for the fully connected layer, the gradient calculation is carried out around the weight parameter and the bias parameter, and the partial derivative of the loss value with respect to each weight and bias is solved by the chain rule. The larger the absolute value of the partial derivative, the more significant the influence of the parameter on the loss value, and the greater the adjustment required. For the bidirectional LSTM layer, the gradient calculation covers the hidden layer state parameter, the input gate output gate parameter, and the key parameters that capture sequence dependence are optimized. In the gradient calculation process, the preset learning rate 0.0005 control parameter is used to control the step size of parameter update, to avoid model oscillation caused by too large step size or slow convergence caused by too small step size. At the same time, the weight decay coefficient 1e-5 is introduced to regularize the weight parameters of the fully connected layer and the LSTM layer. The square value of the weight parameter is included in the loss calculation to prevent overfitting of the model due to excessive weight, and to ensure that the loss value can guide the model to improve the analytical precision and also ensure the generalization ability of the model.

[0108] After each round of training, the same mean square error calculation logic is used to process the 1000 samples in the validation set: the validation set samples are input into the model to obtain the analytical sequence, the loss value of each group is calculated and then averaged to obtain the validation set average mean square error loss value of this round of training, and the similarity between the validation set analytical sequence and the original watermark sequence is calculated. Compare the current round validation set similarity with the highest similarity in history. If the validation set similarity has not improved for 15 consecutive rounds, or the current round validation set similarity reaches 99.2%, the model training is considered to have converged, and the training is stopped and the current round of model parameters is saved. If the termination condition is not met, the next round of training strategy is adjusted based on the validation set loss value, for example, when the validation set loss value increases, the learning rate is appropriately reduced (by 0.0001 each time) to ensure that the model converges to the optimal analytical performance.

[0109] Decoding verification and correction are performed to check the preliminary analyzed information, including whether the institution identification code segment conforms to the encoding rules of step 21, whether the hardware identification code segment matches the authorized device hardware identification, and whether the discrete numerical sequence length is consistent with the original watermark; if it is found that the encoding segment does not conform to the rules or the sequence length is abnormal, the correction module is started to complete or correct the abnormal segment according to the encoding rules and original watermark features in the evidence library; for example, when 2 numerical values are missing in the hardware identification code segment, the missing numerical values are supplemented according to the complete encoding of the authorized device hardware identification in the evidence library to ensure the integrity of the identification; the complete watermark information is extracted, the corrected discrete numerical sequence, institution identification, hardware identification, and watermark generation time are integrated to form complete watermark information containing multi-source feature association information.

[0110] Step 64, the watermark information is reversely transformed by the inverse mapping algorithm to map it from the watermark space back to the original feature space, and the original feature vector corresponding to the high-dimensional global feature vector is recovered, which specifically includes: constructing an inverse mapping algorithm system, which takes the inverse matrix of the linear mapping matrix constructed in step 33 as the core, retrieves the linear mapping matrix parameters trained in step 33 from the secure storage library, calculates the inverse matrix of the matrix, and adopts a numerical stability optimization method in the inverse process to avoid failure due to singular matrix; At the same time, the parameters of the attention weight layer in step 33 are retrieved, including the correlation weight values of each dimension feature, which are used as the basis for feature weight recovery in the inverse mapping process; The inverse mapping matrix and the attention weight parameter are integrated to form the core calculation module of the inverse mapping algorithm. Then the inverse mapping verification model is constructed, which is used to verify the accuracy of the inverse mapping result. The model includes an input layer, a fully connected layer, and a feature comparison layer; The dimension of the input layer is consistent with the dimension of the watermark information, the fully connected layer is set to 2 layers, the number of neurons in the first layer is consistent with the dimension of the high-dimensional global feature vector, and the second layer is a feature similarity calculation layer, which is used to output the similarity between the inverse mapping result and the original high-dimensional global feature vector; When training the model, the high-dimensional global feature vector generated in step 2 is used as the label, and the corresponding watermark information is used as the input sample, and the sample number is 3000 groups; The cosine loss function is used to measure the difference between the similarity output by the model and the actual similarity, the SGD optimizer is selected, the learning rate is set to 0.001, the momentum parameter is set to 0.9, the training batch size is 24, and the training iteration is 60 rounds; After training, the test set is verified, and if the similarity error output by the model is less than 0.01, the verification model is determined to be qualified.

[0111] The complete watermark information extracted in step 63 is input into the core calculation module of the inverse mapping algorithm to perform inverse mapping transformation. First, the discrete numerical sequence in the watermark information is reversely linearly transformed by the inverse mapping matrix to map the sequence from the watermark space to the preliminary feature space, and a preliminary feature vector is obtained. Then, according to the retrieved attention weight parameters, the values of each dimension of the preliminary feature vector are recovered, that is, the high-weight dimension values related to the hardware identifier and the institution identifier are enhanced, and the low-weight dimension values are adjusted, so that the weight distribution of the feature vector is consistent with the high-dimensional global feature vector generated in step 2. Through vector normalization processing, the feature vector after weight recovery is normalized to the standard range preset in step 23, and a preliminary recovered feature vector is obtained.

[0112] The feature vector verification and adjustment is performed, the preliminary recovered feature vector is input into the qualified inverse mapping verification model, the model outputs the similarity of the feature vector with the original high-dimensional global feature vector, if the similarity is greater than 0.98, it is determined that the recovery is qualified, and the original feature vector corresponding to the high-dimensional global feature vector is obtained, if the similarity is less than 0.98, the adjustment module is started, the low similarity dimension is analyzed, the numerical value of the dimension is fine-tuned according to the statistical characteristics of the original high-dimensional global feature vector in the evidence storage library, the fine-tuning amplitude is not more than 0.02 each time, until the similarity reaches more than 0.98, the information integrity of the recovered original feature vector is checked, whether the feature segments corresponding to the architecture fingerprint, the fine-tuning key value, the digital certificate of the distribution party, the target device hardware identification and the target device hardware identification are contained in the vector is checked, and it is ensured that all multi-source feature segments are complete and no missing, so as to provide accurate feature basis for subsequent matching with the security evidence library record, realizing traceability and permission control.

[0113] In the embodiment of the application, the recovery method combining the inverse mapping matrix and the verification model solves the problem that the original feature vector cannot be accurately recovered in the traditional technology, leading to the failure of matching with the evidence record, and the inverse mapping algorithm ensures that the vector accurately returns to the original feature space from the watermark space, and the verification and adjustment mechanism guarantees that the recovered vector is highly consistent with the original vector.

[0114] In a preferred embodiment of the application, step 7, the recovered feature vector is matched with the record of the security evidence library for similarity and legality verification, and the model source authentication, use permission control and accurate traceability of infringement behavior are realized according to the verification result, including: Step 71, receiving the recovered original feature vector as a to-be-verified feature vector, and retrieving the evidence record corresponding to the verification request from the security evidence library, extracting the original feature vector and related distribution context information for verification, specifically including: receiving the to-be-verified feature vector, the authorized device sends the original feature vector recovered in step 64 and the verification request information to the verification server through an encrypted communication interface, the verification request information includes the authorized device hardware identification, the request party identification, the model use timestamp, the verification request number, the communication interface uses the TLS1.3 encryption protocol to ensure the safety of data transmission, the server calculates the hash value of the vector and the request information after receiving the data, and compares it with the hash value sent by the authorized device, if they are consistent, it is confirmed that the data has not been tampered with, if they are not consistent, it is rejected and requires to be resent. Then the security evidence library retrieval index is constructed, the multi-dimensional retrieval index is constructed based on the core fields recorded in the evidence library, including the request party identification, the target device hardware identification, the watermark generation timestamp and the architecture fingerprint code, the index adopts the B+ tree structure, wherein the request party identification and the target device hardware identification are used as the first index key because they are directly related to the traceability subject, the watermark generation timestamp and the architecture fingerprint code are used as the second index key, and the index node is updated regularly during the index construction process, so that the retrieval response time is less than 100 milliseconds.

[0115] The requestor institution identifier in the verification request information and the authorization device hardware identifier are input into the retrieval system, the system first locates the matching index partition through the first index key, and then filters out the record with the same distribution period as the current model use timestamp through the second index key, and the distribution period is the record of the model authorized use time length recorded in step 53; if a unique matching record is retrieved, it is directly extracted, if multiple matching records are retrieved, the architecture fingerprint segment extracted from the to-be-verified feature vector in the verification request is further compared with the architecture fingerprint code in the record, and the unique record that completely matches is filtered out; if no matching record is retrieved, a preliminary abnormality mark is triggered, the current request information is recorded and the to-be-verified feature vector is temporarily stored. Subsequently, the verification benchmark is extracted, the original high-dimensional global feature vector generated in step 2, the distribution context information containing the distribution timestamp, the authorized use time length, the authorized device list, and the digital certificate number of the distribution party, and the watermark generation parameter of the random key identification quantization level rule in step 3 are extracted from the matching record., these information is stored in association according to the format of the verification benchmark and the request number, ensuring that each verification request corresponds to a unique verification benchmark; at the same time, the extracted original high-dimensional global feature vector is converted into the same dimension and numerical format as the to-be-verified feature vector, so as to avoid the influence of format difference on subsequent similarity calculation.

[0116] The verification benchmark is checked, the institution identifier encoding rule and the hardware identifier encoding rule in step 21 are called, the encoding format of the requestor institution identifier and the target device hardware identifier in the record is checked, and the logical consistency of the distribution timestamp and the authorized use time length is checked, that is, whether the current model use timestamp is within the distribution timestamp+authorized use time length range, if the check is passed, it is confirmed that the verification benchmark is valid, if the check is not passed, the record is re-searched or the manual review process is started.

[0117] Step 72, similarity calculation is performed on the to-be-verified feature vector and the original feature vector extracted from the record, to obtain a similarity value, which specifically includes: determining a similarity calculation algorithm, selecting a cosine similarity algorithm as the core calculation method, which can effectively measure the direction consistency of high-dimensional vectors, and adapt to the similarity evaluation of multi-source feature vectors, and combining a weighted Euclidean distance algorithm as an auxiliary verification method, the results of the two algorithms are complementary to improve the calculation accuracy. A feature weight distribution model is constructed, which is used to assign weights to different dimensions of the to-be-verified feature vector and the original feature vector, because different dimensions correspond to different importance of multi-source features, the model includes an input layer, a convolution layer, and a fully connected layer, the input layer has the same dimension as the feature vector, the convolution layer is set to 1 layer and uses a 3×3 convolution kernel with a quantity of 64 to extract local dimension correlation features of the vector, and the fully connected layer is set to 2 layers, the first layer has a neuron quantity of 256, and the second layer is used to output the weight coefficients of each dimension.

[0118] When training the model, the weight coefficients evaluated by the experts in step 21 are used as labels, the multi-source feature vector containing the architecture fingerprint hardware identification institution identification and other dimensions is used as input, the number of samples is 4000 groups, the mean square error loss function is used to measure the difference between the model output weight and the label, the Adam optimizer is selected, the learning rate is 0.001, the weight decay coefficient is 1e-4, the training batch size is 20, the training iteration is 60 rounds, the training is stopped when the validation set error decreases by less than 0.001 each round, and the optimal parameters are saved; if the average error between the model output weight and the expert evaluation weight is less than 0.02 after training, it is determined to be qualified. Then perform weighted similarity calculation, multiply the values of each dimension of the to-be-verified feature vector and the original feature vector by the corresponding weight coefficients output by the qualified model to obtain the weighted to-be-verified vector and the weighted original vector; the cosine similarity algorithm is used to calculate the cosine value of the two weighted vectors, the value range is -1 to 1, and the value is converted to a similarity score of 0 to 100 through numerical mapping; the conversion rule is similarity score = cosine value + 1 x 50; at the same time, the weighted Euclidean distance algorithm is used to calculate the distance value of the two weighted vectors, and the distance-similarity conversion formula is used to obtain the second similarity score, similarity score = 100-distance value / maximum distance value x 100, and the average value of the two is taken as the final similarity value. Finally, the similarity calculation result is verified, 100 groups of feature vectors with known matching relationship are selected, 50 groups of completely matched and 50 groups of partially matched input calculation process are input, if the final similarity value of the completely matched vector pair is greater than 95 and the value of the partially matched vector pair is between 40 and 60, it is confirmed that the calculation process is accurate, if there is deviation, the weight distribution model parameters or the optimization algorithm parameters are adjusted again until the calculation result meets the expectation.

[0119] Step 73, based on the similarity value, compare with the preset matching threshold value, and verify the legality of the distribution context information, including: determining the preset matching threshold value, constructing a threshold determination experiment system, selecting 1000 groups of model feature vectors of different application scenarios, including medical, financial, industrial and other scenarios, each group of vector pair contains three types of complete matching of the same model and the same authorized device, partial matching of the same model and different authorized devices, and non-matching of different models or illegal copy model generation; calculate the similarity of each group of vector pairs, and the similarity value distribution of the completely matched vector pairs is taken as the lower limit of the threshold value, and the numerical value distribution of the non-matching vector pairs is taken as the upper limit of the threshold value, combined with the precision requirement of the infringement traceability in the background technology, the general matching threshold value is determined as 85, that is, the similarity ≥85 is determined as matching; For medical and other fields with extremely high safety requirements, increase 500 groups of medical model vector pair experiments, and increase the threshold value to 90 because the consequences of medical model leakage are more serious and higher matching standards are required. After determining the threshold value, store it in the threshold configuration library of the verification server to support dynamic calling according to the model application scenario; verify the legality of the distribution context information, the first verification item is the legality of the authorized device, compare the authorized device list in the storage record with the authorized device hardware identifier in the verification request, if the identifiers are completely consistent, it is passed, if they are not consistent, it is marked as illegal device.

[0120] The second verification item is the use time legality, calculate the difference between the current model use timestamp and the distribution timestamp in the storage record, if the difference is less than the authorized use time length, it is passed, if it exceeds, it is marked as time expired; The third verification item is the qualification legality of the distribution party, extract the distribution party digital certificate number from the storage record, call the national digital certificate authentication center interface to query the certificate state, if the certificate is in the valid period and has not been revoked, it is passed, if the certificate is invalid or revoked, it is marked as illegal distribution party; The fourth verification item is the model architecture consistency, extract the architecture fingerprint segment from the to-be-verified feature vector, and compare it with the architecture fingerprint code in the storage record, if the matching degree is ≥98%, it is passed, if it is lower, it is marked as architecture tampering. Record the verification result, use the verification result log system to record the result of each verification item in the format of request number, verification item, result, and exception mark, if all items pass, the log state is to be determined-legal to be confirmed, if there is an exception mark, the state is to be determined-abnormal to be confirmed, the log uses a non-tamperable blockchain storage method to ensure that the subsequent traceability can trace the verification process.

[0121] Step 74, comprehensive judgment is made according to the similarity comparison result and the legality verification result; when the similarity value reaches or exceeds the preset threshold and all legality verification items pass, it is determined that the model source is legal and the corresponding model use permission is granted; when the similarity value is lower than the preset threshold or any legality verification item fails, it is determined that there is an infringement, and a traceability program is started according to the distribution context information in the evidence record to locate the source of infringement, which specifically includes: comprehensive judgment, the similarity value of step 72 and the legality verification result of step 73 are called from the verification result log system, if the similarity value reaches or exceeds the preset matching threshold of the corresponding scene and all legality verification items pass without any abnormal mark, it is determined that the model source is legal; if the similarity value is lower than the preset matching threshold, or there is any item of legality verification that fails, including device illegal, time limit expired, distribution party illegal, framework tampered or any mark, it is determined that there is an infringement.

[0122] The legality determination result is processed, for the model with a legal source, the verification server generates a permission authorization instruction, the instruction includes the function range of the model that can be used, such as the image diagnosis function report generation function of the medical model, the authorized use time length extension period, if the current time limit is less than 30 days, it is automatically extended for 30 days, the permission effective time stamp, which is sent to the authorized device through an encrypted interface; after the authorized device receives the instruction, the permission information is written into the local permission management module, the module uses an access control list mechanism, only allows authorized functions to be called within the permission time limit, at the same time, the authorization record is uploaded to the secure evidence library, and the permission use log in the evidence record is updated. Then start the infringement traceability program, for the case of determining infringement, the complete distribution context information is extracted from the evidence record, including the hierarchical relationship of the distribution link, the first request party, the second request party, the distribution time stamp of each link, the authorized device list of each link, and the institution identifier of each link; a traceability analysis model is constructed, the model is a graph neural network structure, the node represents the distribution link subject, and the edge represents the distribution relationship, the input layer is the distribution context information, the hidden layer uses GAT attention layer to highlight the abnormal distribution node through attention weight, and the output layer is the infringement source probability value.

[0123] When training the model, the distribution link-infringement source data in historical infringement cases is taken as 300 groups of sample quantities, a cross-entropy loss function is used to optimize the model parameters, 50 rounds of training iterations are performed, and if the prediction accuracy of the model on the infringement source is greater than or equal to 95%, the model is qualified; the distribution context information of the current infringement case is input into the qualified model, the model outputs the infringement probability values of each distribution link, and the link with the highest probability value is the preliminary located infringement source, such as the equipment with the secondary request party equipment identifier XXX. Fixing infringement evidence and disposal, generating an infringement traceability report, the report contains infringement equipment hardware identifier, infringement agency name, infringement behavior type such as unauthorized equipment use, time-out effect, use architecture tampering and subsequent propagation, traceability link map, similarity calculation result, legality verification abnormality mark; the report is sent to the distribution party and the relevant supervision agency through an encryption interface, and the report is stored in the infringement case library of the secure storage library; the supervision agency can start the device ban and remotely disable the model use function of the infringement equipment, suspend the model request permission of the infringement agency, and take other disposal measures to realize accurate control of infringement behavior.

[0124] In the embodiment of the application, the scene threshold determination and multi-item legality verification are used to solve the problem of one-size-fits-all and single verification dimension of the traditional threshold, the scene threshold is adapted to different security requirements, the multi-item verification covers the full dimension of equipment, time limit, qualification and architecture, ensures comprehensive and no omission of legality judgment, and avoids missing judgment of infringement behavior due to incomplete verification.

[0125] As shown in Figure 2 The embodiment of the application also provides a model security distribution and authentication system based on watermark, which comprises: A collection module is configured to acquire the architecture fingerprint of the target basic model, the key value of the fine-tuning process, the digital certificate of the distribution party, the request party agency identifier and the target equipment hardware identifier, and generate multi-source feature information; A fusion module is configured to fuse the multi-source feature information and process it through a weighted fusion algorithm to generate a high-dimensional global feature vector; A processing module is configured to input the global feature vector and a random key into a multi-level neural network watermark generator to generate a dynamic digital watermark after processing; A calculation module is configured to embed the dynamic digital watermark into the output layer feature mapping of the target basic model by using the dynamic digital watermark and a watermark embedding algorithm based on gradient reservation to generate a watermark-containing derived model; An evaluation module is configured to perform quality evaluation and testing on the derived model to obtain a verified qualified watermark-containing model; the verified qualified watermark-containing model is distributed to the request party authorized equipment through an encrypted channel, and the watermark generation parameters, distribution context information and timestamp are written into the secure storage library as storage data; The analysis module is configured to run the distributed watermarking model on the authorized device, and obtain a watermark-bearing signal from output data of the model during model running; and analyze the watermark-bearing signal to extract watermark information and recover an original feature vector through an inverse mapping algorithm. The matching module is configured to perform similarity matching and legality verification of the recovered feature vector with records in the secure storage library, and realize model source authentication, usage permission control, and accurate tracing of infringement behavior according to a verification result.

[0126] It should be noted that the system corresponds to the above method, and all implementation manners in the above method embodiments are applicable to this embodiment and can achieve the same technical effects.

[0127] Embodiments of the present application also provide a computing device, comprising a processor and a memory storing a computer program, wherein the computer program is executed by the processor to perform the above method. All implementation manners in the above method embodiments are applicable to this embodiment and can achieve the same technical effects.

[0128] Embodiments of the present application also provide a computer-readable storage medium storing instructions, which, when executed on a computer, cause the computer to perform the above method. All implementation manners in the above method embodiments are applicable to this embodiment and can achieve the same technical effects.

[0129] Users of the present application must comply with regulations and cannot be used for illegal and irregular activities, otherwise the consequences will be borne by the user; when collecting and using information such as "institutional identifier" and "device hardware identifier", the user must obtain authorization in compliance and ensure privacy security, and the present application provider will not be responsible for legal disputes caused by irregularities; the technical effect is affected by application scenarios, hardware and software, data quality, etc., and there may be performance fluctuations in extreme scenarios, and the present application provider does not make absolute guarantees, and the user needs to test and adapt by himself; matters not mentioned comply with current regulations and industry practices, and losses caused by user irregularities or improper use will be borne by the user.

[0130] The above is the preferred embodiment of the present application, and it should be noted that for ordinary skilled persons in the technical field, without departing from the principles of the present application, a number of improvements and refinements can be made, which should also be considered within the scope of protection of the present application.

Claims

1. A watermark-based method for secure distribution and authentication of models, characterized in that, The method includes: Step 1: Obtain the architecture fingerprint of the target base model, key values ​​of the fine-tuning process, the digital certificate of the distributor, the identifier of the requesting organization, and the hardware identifier of the target device to generate multi-source feature information; Step 2: Fuse the multi-source feature information and process it through a weighted fusion algorithm to generate a high-dimensional global feature vector; Step 3: Input the global feature vector and the random key into the multi-level neural network watermark generator, and generate a dynamic digital watermark after processing. Step 4: Using dynamic digital watermarking, the watermark is embedded into the output layer feature map of the target base model through a gradient-preserving watermark embedding algorithm to generate a watermarked derived model. Step 5: Perform quality assessment and testing on the derived model to obtain a qualified watermarked model; distribute the qualified watermarked model to the authorized device of the requesting party through an encrypted channel, and write the watermark generation parameters, distribution context information and timestamp as evidence storage data into the secure evidence storage library. Step 6: Run the distributed watermarked model on the authorized device, and obtain the watermark carrying signal from the model's output data during the model's operation; parse the watermark carrying signal, extract the watermark information, and recover the original feature vector through an inverse mapping algorithm; Step 7: Perform similarity matching and legality verification between the recovered feature vector and the records in the secure evidence storage library. Based on the verification results, realize model source authentication, access control and accurate tracing of infringement.

2. The watermark-based model secure distribution and authentication method according to claim 1, characterized in that, Multi-source feature information is fused and processed using a weighted fusion algorithm to generate a high-dimensional global feature vector, including: The architecture fingerprint is converted into a structure encoding vector reflecting the network hierarchy and connection relationships. The key values ​​of the fine-tuning process are converted into process parameter vectors that record hyperparameters and training states. The digital certificate of the distributor, the identifier of the requesting organization, and the hardware identifier of the target device are parsed and converted into fixed-length digital identifier vectors respectively. According to the various feature vectors, corresponding weight coefficients are assigned to each type of feature vector. The weighted feature vectors are fused using a combination of weighted concatenation and weighted pooling to generate a high-dimensional fused feature vector. The high-dimensional fused feature vector is normalized to unify its magnitude to a preset standard range. The normalized vector is then subjected to dimensionality reduction and redundancy removal to obtain a high-dimensional global feature vector.

3. The watermark-based model secure distribution and authentication method according to claim 2, characterized in that, The global feature vector and random key are input together into a multi-level neural network watermark generator, which processes the data to generate a dynamic digital watermark, including: The high-dimensional global feature vector is concatenated and combined with the pre-generated random key to form the joint input vector of the watermark generator; The joint input vector is fed into a multi-level neural network watermark generator consisting of a fully connected layer, a non-linear activation layer, and a normalization layer connected in sequence. The joint input vector undergoes a linear transformation through the fully connected layer, then non-linear features are introduced through the non-linear activation layer, and finally the feature distribution is adjusted through the normalization layer to obtain a deep feature representation. The deep feature representation is transformed and mapped to a preset watermark space. The continuous vector values ​​in the space are converted into discrete signal sequences through quantization, generating a dynamic digital watermark that is uniquely bound to a high-dimensional global feature vector and a random key.

4. The watermark-based model secure distribution and authentication method according to claim 3, characterized in that, Using dynamic digital watermarking, a gradient-preserving watermarking embedding algorithm is employed to embed the watermark into the output layer feature map of the target base model, generating a watermarked derived model, including: The dynamic digital watermark is obtained, and the watermark signal is adaptively adjusted according to the dimension of the feature mapping of the output layer of the target base model to generate the watermark pattern to be embedded. Analyze the statistical characteristics and gradient distribution of the feature mapping of the output layer of the target base model to determine the optimal position and intensity of the watermark pattern embedding; The watermark pattern to be embedded is weighted and fused with the target feature map at the corresponding position according to the determined optimal position and intensity. Gradient constraint terms are introduced by coefficients to limit the change of the gradient distribution of the original feature map by the watermark embedding operation, so that the feature map after watermark embedding maintains the original forward propagation characteristics of the model, and its gradient backpropagation behavior is consistent with the original model. The integrity of the feature mapping after watermark embedding is verified, and finally a derived model containing dynamic digital watermark is generated.

5. The watermark-based model secure distribution and authentication method according to claim 4, characterized in that, Step 5 includes: The derived model was subjected to forward inference using a pre-set test dataset. The accuracy reduction of the output result relative to the original target base model was calculated, and it was confirmed that the reduction was lower than the pre-set performance threshold. The derived model was then subjected to watermark extraction test to verify that its watermark extraction success rate was higher than the pre-set survival rate threshold, and the evaluation results were obtained. Based on the evaluation results, derived models that meet the performance requirements and watermark survival rate requirements are assigned a verification qualified mark, and a verification qualified watermarked model is generated. The watermarked model with a verified qualification mark is distributed to the authorized device of the requesting party through a secure transmission protocol, and the distribution context information is recorded during the distribution process; Based on the distribution context information, combined with the watermark generation parameters and distribution timestamp used in the process of generating dynamic digital watermarks, a complete evidence storage record is generated, and the evidence storage record is submitted to the secure evidence storage repository as the written content.

6. The watermark-based model secure distribution and authentication method according to claim 5, characterized in that, The distributed watermarked model is run on authorized devices, and the watermark-bearing signal is obtained from the model's output data during the model's operation. The watermark-bearing signal is parsed to extract the watermark information, and the original feature vector is recovered using an inverse mapping algorithm, including: Run the watermarked model on authorized devices and collect the output data generated by the model in real time during the process; The output data is processed by signal detection and separation to identify and extract the watermark-carrying signal embedded in the output data. The watermark-carrying signal is parsed and decoded to extract the watermark information contained therein; The watermark information is transformed by the inverse mapping algorithm, which maps it from the watermark space back to the original feature space, and recovers the original feature vector corresponding to the high-dimensional global feature vector.

7. The watermark-based model secure distribution and authentication method according to claim 6, characterized in that, Step 7 includes: The original feature vector recovered is received as the feature vector to be verified, and the evidence record corresponding to the verification request is retrieved from the secure evidence storage library. The original feature vector and related distribution context information are extracted as the verification benchmark. The similarity between the feature vector to be verified and the original feature vector extracted from the evidence record is calculated to obtain a similarity value. Based on the similarity value, it is compared with the preset matching threshold, and the legality of the distribution context information is verified. The model is judged based on a combination of similarity comparison results and legality verification results. When the similarity value reaches or exceeds the preset threshold and all legality verification items pass, the model source is judged to be legal and the corresponding model usage rights are granted. When the similarity value is lower than the preset threshold or any legality verification item fails, infringement is judged to exist, and the source tracing procedure is initiated based on the distribution context information in the evidence record to locate the source of infringement.

8. A watermark-based model secure distribution and authentication system, wherein the system implements the method as described in any one of claims 1 to 7, characterized in that, include: The data acquisition module is used to obtain the architectural fingerprint of the target basic model, key values ​​of the fine-tuning process, the digital certificate of the distributor, the identifier of the requesting organization and the hardware identifier of the target device, and generate multi-source feature information. The fusion module is used to fuse multi-source feature information and process it through a weighted fusion algorithm to generate a high-dimensional global feature vector. The processing module is used to input the global feature vector and the random key into the multi-level neural network watermark generator, and generate a dynamic digital watermark after processing. The computation module is used to utilize dynamic digital watermarks and embed them into the output layer feature map of the target base model through a gradient-preserving watermark embedding algorithm to generate a watermarked derived model. The evaluation module is used to evaluate and test the quality of the derived model to obtain a qualified watermarked model. The qualified watermarked model is distributed to the authorized device of the requesting party through an encrypted channel, and the watermark generation parameters, distribution context information and timestamp are written into the secure evidence storage library as evidence storage data. The parsing module is used to run the distributed watermarked model on authorized devices and obtain the watermark carrying signal from the model's output data during the model's operation; it parses the watermark carrying signal, extracts the watermark information, and recovers the original feature vector through an inverse mapping algorithm; The matching module is used to perform similarity matching and legality verification between the recovered feature vectors and the records in the secure evidence storage library. Based on the verification results, it enables model source authentication, access control, and accurate tracing of infringement.

9. A computing device, characterized in that, include: One or more processors; A storage device for storing one or more programs, which, when executed by one or more processors, cause the one or more processors to implement the method as described in any one of claims 1 to 7.

10. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores a program that, when executed by a processor, implements the method as described in any one of claims 1 to 7.

Images