A watermark-based method and system for secure model distribution and authentication

Abstract

The application provides a watermark-based model security distribution and authentication method and system, and relates to the technical field of data processing.The method comprises the following steps: distributing a verified watermark-containing model to a requestor-authorized device through an encrypted channel, and writing watermark generation parameters, distribution context information and a timestamp as evidence data into a secure evidence library; running the distributed watermark-containing model on the authorized device, and obtaining a watermark-bearing signal from the output data of the model during the running of the model; analyzing the watermark-bearing signal, extracting watermark information, and restoring an original feature vector through an inverse mapping algorithm; performing similarity matching and legality verification on the restored feature vector and the record of the secure evidence library, and realizing model source authentication, use permission control and accurate tracing of infringement behavior according to the verification result.The application improves the comprehensiveness and accuracy of anomaly detection.

Description

Technical Field

[0001] This invention relates to the field of data processing technology, and in particular to a watermark-based method and system for secure distribution and authentication of models. Background Technology

[0002] With the rapid development of artificial intelligence technology, the demand for the protection of models as core intellectual property rights is also continuously increasing. In terms of multi-source information fusion, existing technologies lack the ability to integrate the features of the entire life cycle of a model. Model distribution involves multi-dimensional information such as architecture design, training process, and hardware environment. Traditional methods generate watermarks based on only a single dimension, which makes it difficult to achieve fine-grained access control and traceability analysis. For example, generating watermarks by simply adjusting the probability distribution of words cannot be associated with key information about the model deployment environment, making it difficult to trace the spread path after infringement.

[0003] Existing technologies generate watermarks based on only a single dimension and fail to integrate key information such as architectural fingerprints and hardware identifiers. For example, infringers can completely remove watermarks by pruning and fine-tuning. Since the watermark is not bound to the hospital equipment identifier, it is impossible to trace the source of the model leakage. Watermarks that do not adopt multi-source fusion will completely lose their traceability capability after multiple propagations. Summary of the Invention

[0004] The technical problem to be solved by the present invention is to provide a watermark-based model secure distribution and authentication method and system, which improves the comprehensiveness and accuracy of anomaly detection.

[0005] To solve the above-mentioned technical problems, the technical solution of the present invention is as follows:

[0006] Firstly, a watermark-based model secure distribution and authentication method is provided, the method comprising:

[0007] Step 1: Obtain the architecture fingerprint of the target base model, key values ​​of the fine-tuning process, the digital certificate of the distributor, the identifier of the requesting organization, and the hardware identifier of the target device to generate multi-source feature information;

[0008] Step 2: Fuse the multi-source feature information and process it through a weighted fusion algorithm to generate a high-dimensional global feature vector;

[0009] Step 3: Input the global feature vector and the random key into the multi-level neural network watermark generator, and generate a dynamic digital watermark after processing.

[0010] Step 4: Using dynamic digital watermarking, the watermark is embedded into the output layer feature map of the target base model through a gradient-preserving watermark embedding algorithm to generate a watermarked derived model.

[0011] Step 5: Perform quality assessment and testing on the derived model to obtain a qualified watermarked model; distribute the qualified watermarked model to the authorized device of the requesting party through an encrypted channel, and write the watermark generation parameters, distribution context information and timestamp as evidence storage data into the secure evidence storage library.

[0012] Step 6: Run the distributed watermarked model on the authorized device, and obtain the watermark carrying signal from the model's output data during the model's operation; parse the watermark carrying signal, extract the watermark information, and recover the original feature vector through an inverse mapping algorithm;

[0013] Step 7: Perform similarity matching and legality verification between the recovered feature vector and the records in the secure evidence storage library. Based on the verification results, realize model source authentication, access control and accurate tracing of infringement.

[0014] Secondly, a watermark-based model secure distribution and authentication system includes:

[0015] The acquisition module is used to acquire network traffic data of the target server, and divide the network traffic data into multiple session streams by session.

[0016] The extraction module is used to extract multimodal features from traffic records in each session stream to obtain feature data of at least two different modalities;

[0017] The fusion module is used to input feature data from at least two different modalities into the cross-modal feature fusion module, perform weighted fusion, and obtain the fused multimodal feature representation.

[0018] The processing module is used to capture the long-distance dependencies between traffic records using a temporal convolutional network to obtain temporal features from the multimodal feature representation;

[0019] The classification module is used to combine the fused multimodal feature representation with temporal features, and classify the combined features to obtain preliminary anomaly detection results;

[0020] The evaluation module is used to calculate the inter-class discrimination weight of the session flow fusion features based on the preliminary anomaly detection results, and evaluate the quality coefficient and consistency coefficient of the temporal features after multimodal feature fusion, respectively, to obtain a dynamic adjustment factor.

[0021] The output module is used to weight and fuse the dynamic adjustment factor with the preliminary anomaly detection result to generate the final anomaly detection result; based on the final anomaly detection result, combined with the protocol type of the traffic and the target port activity context information, a risk assessment level is generated.

[0022] Thirdly, a computing device, comprising:

[0023] One or more processors;

[0024] A storage device for storing one or more programs that, when executed by one or more processors, cause the one or more processors to implement the method.

[0025] Fourthly, a computer-readable storage medium storing a program that, when executed by a processor, implements the method.

[0026] The above-described solution of the present invention has at least the following beneficial effects:

[0027] A gradient-preserving watermark embedding algorithm is adopted. When embedding the dynamic watermark into the feature map of the model output layer, the gradient information of the model is preserved, avoiding the problems of decreased prediction accuracy and slowed inference speed caused by the destruction of the correlation between model parameters in traditional watermark embedding. This design achieves a balance between watermark security and model functionality, ensuring that the watermarked derived model can still stably output the original business performance while carrying the watermark, meeting the practical needs of the model in real-world scenarios.

[0028] By using a multi-level neural network dynamic watermark generation design, compared with traditional fixed watermarks, dynamic watermarks can adaptively adjust to changes in multi-source features, effectively resisting attack methods such as model compression, pruning, and adversarial tampering, reducing the risk of watermark removal or destruction, and building a core security barrier for model intellectual property rights. Attached Figure Description

[0029] Figure 1 This is a schematic diagram of a watermark-based model security distribution and authentication method provided by an embodiment of the present invention.

[0030] Figure 2 This is a schematic diagram of a watermark-based model security distribution and authentication system provided by an embodiment of the present invention. Detailed Implementation

[0031] Exemplary embodiments of the present disclosure will now be described in more detail with reference to the accompanying drawings. While exemplary embodiments of the present disclosure are shown in the drawings, it should be understood that the present disclosure may be implemented in various forms and should not be limited to the embodiments set forth herein. Rather, embodiments are provided so that this disclosure will be thorough and complete, and will fully convey the scope of the disclosure to those skilled in the art.

[0032] like Figure 1 As shown, embodiments of the present invention propose a watermark-based model secure distribution and authentication method, the method comprising the following steps:

[0033] Step 1: Obtain the architecture fingerprint of the target base model, key values ​​of the fine-tuning process, the digital certificate of the distributor, the identifier of the requesting organization, and the hardware identifier of the target device to generate multi-source feature information;

[0034] Step 2: Fuse the multi-source feature information and process it through a weighted fusion algorithm to generate a high-dimensional global feature vector;

[0035] Step 3: Input the global feature vector and the random key into the multi-level neural network watermark generator, and generate a dynamic digital watermark after processing.

[0036] Step 4: Using dynamic digital watermarking, the watermark is embedded into the output layer feature map of the target base model through a gradient-preserving watermark embedding algorithm to generate a watermarked derived model.

[0037] Step 5: Perform quality assessment and testing on the derived model to obtain a qualified watermarked model; distribute the qualified watermarked model to the authorized device of the requesting party through an encrypted channel, and write the watermark generation parameters, distribution context information and timestamp as evidence storage data into the secure evidence storage library.

[0038] Step 6: Run the distributed watermarked model on the authorized device, and obtain the watermark carrying signal from the model's output data during the model's operation; parse the watermark carrying signal, extract the watermark information, and recover the original feature vector through an inverse mapping algorithm;

[0039] Step 7: Perform similarity matching and legality verification between the recovered feature vector and the records in the secure evidence storage library. Based on the verification results, realize model source authentication, access control and accurate tracing of infringement.

[0040] In this embodiment of the invention, a gradient-preserving watermark embedding algorithm is employed. When embedding the dynamic watermark into the feature map of the model output layer, the model gradient information is preserved, avoiding the problems of decreased prediction accuracy and slowed inference speed caused by the disruption of model parameter correlation in traditional watermark embedding. This design achieves a balance between watermark security and model functionality, ensuring that the watermarked derived model can still stably output the original business performance while carrying the watermark, meeting the practical needs of the model in real-world scenarios.

[0041] By using a multi-level neural network dynamic watermark generation design, compared with traditional fixed watermarks, dynamic watermarks can adaptively adjust to changes in multi-source features, effectively resisting attack methods such as model compression, pruning, and adversarial tampering, reducing the risk of watermark removal or destruction, and building a core security barrier for model intellectual property rights.

[0042] In a preferred embodiment of the present invention, step 1 involves obtaining the architectural fingerprint of the target base model, key values ​​of the fine-tuning process, the digital certificate of the distributor, the identifier of the requesting organization, and the hardware identifier of the target device, and generating multi-source feature information, including:

[0043] For the target base model to be distributed, an architectural fingerprint reflecting its unique architecture is extracted, which can reveal the network structure design characteristics of the model. Secondly, key values ​​generated during the fine-tuning process of the target base model are collected, which can characterize the changes in core parameters during the fine-tuning phase. Thirdly, the digital certificate of the distributor is obtained, which is used to verify the legitimate identity of the model distribution entity. Simultaneously, the organizational identifier of the requesting party is collected to clarify the organizational information of the model receiving entity. Furthermore, the hardware identifier of the target device is extracted, which uniquely corresponds to the device used for the final deployment of the model. Finally, the architectural fingerprint, key values ​​from the fine-tuning process, the distributor's digital certificate, the requesting party's organizational identifier, and the target device's hardware identifier are integrated to form multi-source feature information covering model attributes, participating entity identities, and device characteristics.

[0044] In a preferred embodiment of the present invention, step 2 involves fusing multi-source feature information and processing it using a weighted fusion algorithm to generate a high-dimensional global feature vector, including:

[0045] Step 21: Convert the architecture fingerprint into a structure encoding vector reflecting the network hierarchy and connection relationships; convert the key values ​​of the fine-tuning process into process parameter vectors recording hyperparameters and training states; parse and convert the distributor's digital certificate, the requester's organization identifier, and the target device's hardware identifier into fixed-length digital identifier vectors; assign corresponding weight coefficients to each type of feature vector based on the various feature vectors, specifically including:

[0046] Traverse the complete network structure of the target base model, sequentially identifying all network layer types contained in the model. These network layer types specifically include convolutional layers (such as 2D convolutional layers Conv2d and 3D convolutional layers Conv3d), fully connected layers (Dense layers), activation function layers (such as ReLU layers, Sigmoid layers, Tanh layers, GELU layers, and Softmax layers), pooling layers (such as max pooling layers MaxPooling2d and average pooling layers AveragePooling2d), normalization layers (such as batch normalization layers BatchNorm2d and layer normalization layers LayerNorm), dropout layers, etc. Record each identified network layer one by one. Its structural parameters include: for convolutional layers, the number of input channels, number of output channels, kernel size (e.g., 3×3, 5×5), stride (e.g., 1×1, 2×2), padding value (e.g., SamePadding, ValidPadding), and whether a bias term is used; for fully connected layers, the number of input neurons, number of output neurons, and whether a bias term is used; for activation function layers, the specific type of activation function and related parameters (e.g., the negative slope coefficient of LeakyReLU); for pooling layers, the kernel size, stride, padding value, and pooling method; for normalization layers, the normalization dimension, momentum parameter, and epsilon value; and for dropout layers, the dropout probability.

[0047] Network layer connection record: sort out the forward propagation path between each network layer, and clarify the input source layer and output target layer of each layer; record the dimensional changes (including height, width, number of channels) of feature maps when they are passed between layers. If there is a branch structure (such as the residual branch of ResNet, the multi-branch structure of Inception), the network layer composition, feature map dimension and branch fusion method (such as element addition, channel concatenation) of each branch should be recorded separately.

[0048] According to the preset encoding rules, the network layer types, structural parameters, and connection relationships collected above are encoded. Among them, the network layer types are encoded using fixed-length binary codes (e.g., Conv2d corresponds to 0001, Dense corresponds to 0010, and ReLU corresponds to 0011); numerical parameters (e.g., convolutional kernel size, stride, number of neurons) are directly represented by binary numbers. If the parameters are floating-point numbers (e.g., dropout probability, normalized momentum), they are first converted to fixed-precision integers before binary encoding; connection relationships are represented by adjacency matrices, with matrix elements in binary (1 indicates the existence of a connection, 0 indicates the absence of a connection), and the adjacency matrix is ​​expanded row by row into a binary sequence; all encoded binary sequences are concatenated into a complete binary string. If the length of the binary string is less than the preset fixed length, zeros are added to the end; if it exceeds the preset fixed length, the first preset length of the binary string is truncated; finally, the processed binary string is divided according to preset dimensions, with each dimension corresponding to a decimal value, generating a fixed-dimensional structural encoding vector. This vector can completely and uniquely reflect the network hierarchy, parameter configuration of each layer, and inter-layer connection relationships of the target basic model.

[0049] Collect all hyperparameters of the target base model during the fine-tuning phase, specifically including: learning rate (e.g., 0.001, 0.0001, 0.01, which can be a fixed learning rate or a dynamic learning rate; if a dynamic learning rate is used, the learning rate adjustment strategy needs to be recorded); batch size (e.g., 16, 32, 64, 128); number of iterations (i.e., training epochs, e.g., 50, 100, 200); regularization coefficients, including L1 regularization coefficients (e.g., 0.0001, 0.001), L2 regularization coefficients (e.g., 0.0001, 0.001, 0.01), and weight decay coefficients (e.g., 0.0001); optimizer type, specifically including SGD (Stochastic Gradient Descent optimizer), Adam (Adaptive Moment Estimator), AdamW (Adam optimizer with weight decay), and RMSprop (Root Mean Square Propagation optimizer); and loss function type (e.g., CrossEntropyLoss).

[0050] Training state parameter collection involves gathering training state parameters for the target base model at each iteration during fine-tuning. Specifically, this includes: training loss values ​​(e.g., cross-entropy loss for classification tasks, mean squared error loss for regression tasks) and validation loss values ​​for each iteration; and evaluation metrics on the training and validation sets for each iteration. For classification tasks, these include accuracy, precision, recall, F1 score, and AUC (area under the ROC curve). For regression tasks, this includes the coefficient of determination R². 2Mean absolute error (MAE), mean squared error (MSE), root mean square error (RMSE); gradient update magnitude of each parameter in each round, including the L2 norm of the gradient of each convolutional layer weight, the L2 norm of the gradient of the fully connected layer weight, and the L2 norm of the gradient of the bias term.

[0051] The parameters are categorized, sorted, and standardized. Collected hyperparameters are categorized by type: optimizer parameters, learning rate parameters, batch size, iteration count, regularization parameters, and loss function parameters. Training state parameters are sorted by the time series of iteration rounds, and within each round, they are categorized by type: training loss, validation loss, training evaluation metric, validation evaluation metric, and gradient update magnitude. The Min-Max standardization method is used to standardize all numerical parameters, converting them to values ​​between 0 and 1. For categorical parameters (such as optimizer type and loss function type), one-hot encoding is first used to convert them into binary vectors, and then the elements of the binary vectors are used as standardized values. The standardized hyperparameters and training state parameters are concatenated with each other in the above-mentioned categorization order to form a fixed-length one-dimensional array, generating a fixed-dimensional process parameter vector. This vector can completely record the hyperparameter configuration details, dynamic state of training in each round, and model performance change trends during the fine-tuning phase of the target base model.

[0052] Extract key information from the distributor's digital certificate, specifically including: public key information (such as the modulus and exponent values ​​of an RSA public key, or the curve parameters and coordinates of an ECC public key); Certificate Authority (CA) name (such as the name of a nationally recognized third-party CA and its unique identifier); certificate validity period (including start and end times, in the format YYYY-MM-DDHH:MM:SS); certificate serial number (a unique integer identifier assigned by the CA); certificate signature algorithm (such as SHA256 with RSA, SHA384 with ECC); and certificate subject information (including the distributor's name, organization code, registered address, contact information, and email address).

[0053] The extracted public key information, certificate authority name, certificate validity period, certificate serial number, signature algorithm, and subject information are converted into string format. Numerical information (such as modulus value, exponent value, and certificate serial number) is directly converted into decimal strings, time information is converted into strings in YYYYMMDDHHMMSS format, and text information such as names and addresses retains its original string format. All strings are concatenated into a complete text string, and a SHA-256 hash is performed on this text string to obtain a 256-bit hash value. The hash value is converted into a hexadecimal string. If the length of the hexadecimal string is less than the preset fixed length, zeros are added to the end; if it exceeds the preset fixed length, the first preset length of the string is truncated. The processed hexadecimal string is then grouped into decimal values ​​in pairs to generate a fixed-length numeric vector. This vector is the distributor's digital identifier vector, which can uniquely identify the legitimate identity of the distributor.

[0054] Collect complete information about the requesting organization, including: the organization's legal name; its industry classification, such as software and information technology services, education, or healthcare, recording the industry code and name; its registered address (including province, city, district / county, detailed street address, and postal code); its organization code (such as the Unified Social Credit Code or Organization Code); its organization type (such as enterprise, public institution, research institution, or social organization); its establishment date (in YYYY-MM-DD format); and its contact person, telephone number, and email address. Encode the above information using a pre-defined organization coding system. Industry classification is directly converted to numbers according to the industry code; the Unified Social Credit Code is converted to ASCII values ​​in character order; text information (such as organization name and address) is converted to a byte sequence using UTF-8 encoding, then the byte sequence is converted to decimal values; and time information is converted to an integer in YYYYMMDD format. Arrange all encoded values ​​in the following order: organization name, industry classification, registered address, organization code, organization type, establishment date, and contact information.

[0055] The arranged values ​​are combined into an initial array. If the length of the initial array is less than the preset fixed dimension, zeros are added to the end. If it exceeds the preset fixed dimension, the values ​​of the first preset dimension are truncated to generate a fixed-length requester organization identifier vector. This vector can uniquely identify the identity and attributes of the requester organization.

[0056] Collect hardware information of target devices (such as servers and terminal computers), specifically including: CPU information, model, number of cores, number of threads, clock speed, cache size; memory information, type, frequency, manufacturer, serial number; hard disk information, capacity, manufacturer, product model, serial number; network adapter information, manufacturer, model, physical address, IP address; motherboard information, model, BIOS version, serial number; graphics card information, model, video memory capacity, core frequency, manufacturer, serial number.

[0057] The hash processing and vector mapping process involves concatenating all collected hardware information into a single text string in the order of CPU, memory, hard drive, network adapter, motherboard, and graphics card. This text string is then subjected to SHA-512 hash calculation to obtain a unique 512-bit hash value, ensuring that different devices generate different hash values. The hash value is then converted into a hexadecimal string. If the hexadecimal string is shorter than a preset fixed length, it is padded with zeros at the end; if it exceeds the preset fixed length, the string is truncated to the first preset length. The processed hexadecimal string is then grouped into decimal values, generating a fixed-length numeric vector. This vector serves as the target device hardware identifier vector, uniquely binding the model to the target device used in its final deployment.

[0058] An evaluation index system was established to quantitatively evaluate and score the structural coding vector, process parameter vector, distributor digital identifier vector, requester organization identifier vector, and target device hardware identifier vector from three dimensions: uniqueness, stability, and relevance to the entire model lifecycle (each with a maximum score of 10 points). The evaluation assesses the distinguishing ability of feature vectors across different models, entities, and devices. Specifically, the target device hardware identifier vector, generated based on the device's unique hardware information, exhibits the strongest uniqueness, scoring 10 points; the structural coding vector, reflecting the model's unique architecture, shows significant differences between vectors from different architectures, resulting in relatively strong uniqueness, scoring 9 points; the distributor digital identifier vector, generated based on the distributor's unique certificate information, differs between different distributors, earning 8 points for uniqueness; the requester organization identifier vector, generated based on the organization's unique code, differs between different organizations, earning 7 points for uniqueness; and the process parameter vector, due to potential similar parameter configurations in different model fine-tuning, has weaker uniqueness, scoring 6 points.

[0059] The invariance of feature vectors throughout the model's entire lifecycle was evaluated. The structural encoding vector, corresponding to the fixed model architecture, remained unchanged during model training, distribution, and deployment, achieving the highest stability (10 points). The target device hardware identifier vector, corresponding to fixed device hardware information, remained unchanged until the hardware was replaced, achieving a stability score of 9 points. The distributor digital identifier vector, corresponding to fixed distributor certificate information, remained unchanged during the certificate's validity period, achieving a stability score of 8 points. The requester organization identifier vector, corresponding to fixed organization registration information, remained unchanged until the organization information changed, achieving a stability score of 7 points. The process parameter vector, changing with fine-tuning strategies, exhibited relatively low stability, achieving a score of 5 points. The supporting role of feature vectors in the entire process of model distribution, use, traceability, and rights protection was also evaluated. Among them, the target device hardware identifier vector is directly associated with the model deployment device, which is the core basis for infringement tracing and has the strongest correlation, scoring 10 points; the distributor digital identifier vector is associated with the model distribution entity and is the key basis for source authentication, scoring 9 points; the requester organization identifier vector is associated with the model receiving entity and is an important basis for access control, scoring 8 points; the structure encoding vector is associated with the model core attributes and is the basis for model uniqueness authentication, scoring 7 points; the process parameter vector mainly reflects the fine-tuning process and has weak support for full lifecycle management, scoring 6 points.

[0060] Weight coefficient calculation and allocation: Calculate the comprehensive score of each feature vector. Comprehensive score = (uniqueness score × 0.4 + stability score × 0.3 + correlation score × 0.3). Allocate weight coefficients according to the proportion of comprehensive score. The total weight coefficient is 1.

[0061] Select feature vector samples from multiple base models, each containing the five types of feature vectors mentioned above. Perform weighted fusion calculations on the feature vectors of each sample and the assigned weight coefficients. Calculate the cosine similarity of the global feature vectors after fusion between any two different models to measure the feature vector discriminability. If the cosine similarity of all groups is less than a preset threshold (e.g., 0.3), the weight configuration is considered acceptable. If the cosine similarity of some groups is greater than or equal to the preset threshold, the discriminability is insufficient, and the weight coefficients need to be readjusted (e.g., increasing the weight proportion of the target device hardware identifier vector and structural encoding vector, and decreasing the weight proportion of the process parameter vector). Perform simulated fusion and discriminability verification again until the discriminability of the feature vectors after fusion of all groups meets the preset threshold requirement, and determine the final weight coefficients.

[0062] Step 22: The weighted feature vectors are fused using a combination of weighted concatenation and weighted pooling to generate a high-dimensional fused feature vector. Specifically, this includes:

[0063] When fusing the structure encoding vector, process parameter vector, distributor digital identifier vector, requester organization identifier vector, and target device hardware identifier vector with assigned weight coefficients in step 21, a weighted concatenation operation is first performed: according to a preset fixed order (in order of structure encoding vector, process parameter vector, distributor digital identifier vector, requester organization identifier vector, and target device hardware identifier vector), the beginning and end of each weighted feature vector are connected sequentially to form a continuous one-dimensional vector. This vector completely retains the weighted numerical features and dimensional information of various feature vectors, ensuring the positional correlation of features from different sources.

[0064] Secondly, the one-dimensional vector formed by the above weighted concatenation is divided into 5 sub-vector segments according to the original feature categories. Each sub-vector segment corresponds to the weighted result of a feature vector of a certain category. For each sub-vector segment, the weighted average of all elements within it is calculated. The weights used in the calculation process are consistent with the weight coefficients assigned to the feature vector of that category in step 21. Through this operation, the core numerical representation of each feature category in the high-dimensional space is extracted, resulting in a pooled feature vector containing 5 core values.

[0065] Finally, the one-dimensional vector obtained by weighted concatenation and the pooled feature vector obtained by weighted pooling are fused a second time. The two are connected end to end by vector concatenation to form a high-dimensional fused feature vector that contains both fine-grained feature details and coarse-grained core representations. The dimension of this vector is the sum of the dimension of the weighted concatenation vector and the dimension of the pooled feature vector, so as to fully preserve the comprehensive information of multi-source features.

[0066] Step 23: Normalize the high-dimensional fused feature vector to unify its magnitude to a preset standard range, and then perform dimensionality reduction and redundancy removal on the normalized vector to obtain a high-dimensional global feature vector, specifically including:

[0067] When normalizing the high-dimensional fusion feature vector generated in step 22, the L2 norm of the vector (i.e., the square root of the sum of squares of the elements of the vector) is calculated. Each element in the vector is divided by the L2 norm to make the magnitude of the normalized vector uniform to a preset standard value (such as 1). This ensures that the high-dimensional fusion feature vectors generated in different batches are consistent in numerical scale and eliminates the interference caused by the difference in the numerical range of the original features to subsequent processing.

[0068] For a normalized vector, first determine the number of dimensions of the vector, denoted as N, meaning the vector contains N feature dimensions. Then, calculate the covariance between any two different dimensions of the vector. Specifically, calculate the mean of all numerical samples under each dimension, and then calculate the average of the products of the differences between each numerical value under the two dimensions and the mean of the corresponding dimension to obtain the covariance value of the two dimensions. Arrange the covariance values ​​between all dimensions in the order of the rows and columns corresponding to the dimensions to form an N×N covariance matrix. This matrix can quantitatively reflect the degree of linear correlation between the feature dimensions of the vector.

[0069] Randomly generate an N-dimensional initial non-zero vector (the vector element values ​​can be set to [0,1]), and use it as the vector to be optimized; repeatedly perform the following iterative operations: perform matrix multiplication on the vector to be optimized and the covariance matrix to obtain a new vector; calculate the magnitude of the new vector, divide the new vector by the magnitude to normalize it, and update it as a new vector to be optimized; continue iterating until the cosine similarity between the vectors to be optimized obtained from two adjacent iterations is greater than a preset threshold (such as 0.999), at which point the vector to be optimized is the first eigenvector of the covariance matrix (corresponding to the largest eigenvalue); perform matrix multiplication on the eigenvector and the covariance matrix, divide each element of the new vector by the corresponding element of the eigenvector (using any non-zero element for calculation), and the result is the first eigenvalue.

[0070] Solving for residual eigenvalues ​​and eigenvectors (based on residual matrix iteration):

[0071] Subtract the transpose of the first eigenvalue × first eigenvector × eigenvector from the original covariance matrix to obtain a new residual matrix. Use this residual matrix as the new target matrix and repeat the initial vector setting and iterative optimization process to obtain the second eigenvalue and its corresponding eigenvector. Repeat the above logic to solve for the next eigenvalue and eigenvector based on the residual matrix obtained in the previous calculation, until all N eigenvalues ​​and their corresponding N eigenvectors of the covariance matrix are obtained.

[0072] Sort all eigenvalues ​​in descending order, while maintaining the correspondence between each eigenvalue and its corresponding eigenvector. Then, select eigenvectors in the sorted order and calculate the sum of the eigenvalues ​​corresponding to the selected eigenvectors, as well as the proportion of this sum to the total sum of all eigenvalues ​​(i.e., cumulative contribution rate). Stop selecting eigenvectors when the cumulative contribution rate reaches a preset threshold (e.g., 95%). Arrange all selected eigenvectors in the order of selection to form an N×K eigenvector matrix (where K is the number of selected eigenvectors, K≤N), with each column of the matrix corresponding to a selected eigenvector.

[0073] The normalized original vector (1×N dimension) is used as a row vector and multiplied by the constructed feature vector matrix (N×K dimension). During the operation, each element of the original vector is multiplied by the corresponding element of the feature vector matrix and then summed to obtain a row vector of dimension 1×K, which is the dimensionality-reduced vector. This dimensionality-reduced vector significantly reduces the number of dimensions compared to the original vector. At the same time, because the cumulative contribution rate of the selected feature vectors reaches a preset threshold, the core information in the original vector that plays a key role in feature differentiation is preserved to the maximum extent.

[0074] Calculate the Pearson correlation coefficient between any two dimensions in the vector. If the absolute value of the correlation coefficient between the two dimensions is greater than a preset threshold (e.g., 0.8), it is determined to be a highly correlated redundant dimension. For each group of highly correlated redundant dimensions, retain the dimension with the larger feature value and remove the other dimensions to eliminate information redundancy within the vector. After the above normalization, dimensionality reduction and redundancy removal processes, the resulting vector is the high-dimensional global feature vector. This vector retains the core distinguishing information of multi-source features and reduces data complexity through dimensionality optimization, and can be directly used in the subsequent dynamic digital watermark generation process.

[0075] In this embodiment of the invention, a fusion method combining weighted splicing and weighted pooling is adopted, which overcomes the limitations of traditional single fusion methods that result in the loss of feature information or insufficient correlation. The generated high-dimensional fusion feature vector realizes deep correlation of multi-source features, improves the feature vector's ability to represent the uniqueness of the model, and avoids the problem of watermarks being easily stripped due to insufficient fusion.

[0076] In a preferred embodiment of the present invention, step 3, which involves inputting the global feature vector and the random key into a multi-level neural network watermark generator and generating a dynamic digital watermark after processing, includes:

[0077] Step 31 involves concatenating the high-dimensional global feature vector with the pre-generated random key to form the joint input vector of the watermark generator, specifically including:

[0078] The process involves pre-generating a random key. The generator must pass randomness checks, including frequency checks, intra-block frequency checks, and run-length checks, to ensure that the generated random numbers are unpredictable and non-repeatable. The length of the random key is determined based on the dimension of the high-dimensional global feature vector. If the high-dimensional global feature vector is N-dimensional, the random key is generated in N-dimensional form. The generator produces a binary format random key, with the number of binary bits matching the number of binary bits in each dimension of the high-dimensional global feature vector. The generated random key is then verified for integrity by calculating and storing its hash value using a hash algorithm. The hash value is recalculated during subsequent concatenation to confirm that the key has not been tampered with.

[0079] The high-dimensional global feature vector and the random key are concatenated and combined. First, it is confirmed that the dimensions of the two are completely identical. If there is a dimensional difference, the random key is interpolated or truncated to ensure that the adjusted key dimension is the same as the high-dimensional global feature vector dimension. An alternating concatenation method is used: first, the first dimension value of the high-dimensional global feature vector is taken, then the first dimension value of the random key is taken, and so on, until all dimension values ​​are concatenated to form a joint input vector. After concatenation, it is checked whether the dimension of the joint input vector is twice the dimension of the high-dimensional global feature vector, and it is also confirmed that there are no missing or outlier values ​​in the vector. If an anomaly is found, the concatenation operation is repeated to ensure that the joint input vector completely integrates the multi-source information of the high-dimensional global feature vector and the security information of the random key. Specifically, confirming that there are no missing or outlier values ​​in the vector includes:

[0080] Iterate through all dimensions of the joint input vector, checking each dimension's value for null or undefined values. If any dimension has a null value, it's considered a missing value; if all dimensions have defined values, the missing value detection is passed. A preset valid value range is established (determined based on the numerical characteristics of the high-dimensional global feature vector and the random key, e.g., the binary random key corresponds to the {0,1} range, and the standardized feature vector corresponds to the [0,1] range). For each dimension of the joint input vector, check if it falls within the preset valid range. If any dimension's value exceeds the range (e.g., the binary key dimension contains 2 or a negative number), it's considered an outlier. According to the alternating concatenation rule, odd-indexed dimensions (e.g., dimensions 1, 3, 5…) in the joint input vector should correspond to the original numerical characteristics of the high-dimensional global feature vector, and even-indexed dimensions (e.g., dimensions 2, 4, 6…) should correspond to the original numerical characteristics of the random key. Extract the numerical sets for the odd-indexed and even-indexed dimensions respectively. Check whether the odd-indexed set conforms to the numerical distribution pattern of the feature vector (e.g., whether it is a normalized continuous value) and whether the even-indexed set conforms to the numerical distribution pattern of the random key (e.g., whether it is a binary discrete value). If they do not conform, it is determined that there is a logical anomaly. If all three checks pass (no missing values, all values ​​are in the valid range, and the logical distribution is consistent), the joint input vector is confirmed to be without anomalies. If any check fails, record the position and specific value of the abnormal dimension, re-execute the concatenation operation of the high-dimensional global feature vector and the random key, and focus on checking the abnormal position until the generated joint input vector completely passes the above checks.

[0081] Step 32: The joint input vector is input into a multi-level neural network watermark generator consisting of a fully connected layer, a non-linear activation layer, and a normalization layer connected sequentially. The joint input vector undergoes a linear transformation via the fully connected layer, then non-linear features are introduced via the non-linear activation layer, and finally the feature distribution is adjusted via the normalization layer to obtain a deep feature representation. Specifically, this includes: constructing a multi-level neural network watermark generator, which contains an input layer, a fully connected layer, a non-linear activation layer, a normalization layer, and an output layer, with each layer connected sequentially to form a complete network structure; the dimension of the input layer is set to the dimension of the joint input vector to ensure that the joint input vector can be completely input into the network; the fully connected layer is set to 3 layers, with the number of neurons in the first fully connected layer being twice the dimension of the input layer, the number of neurons in the second fully connected layer being 1.5 times that of the first layer, and the number of neurons in the third fully connected layer being 0.8 times that of the second layer; the weight parameters of each fully connected layer are initialized using the He initialization method, and the bias parameters are initially... Initialize to a constant of 0.1. After initialization, check whether the numerical range of weights and biases meets the preset requirements. The non-linear activation layer uses the ReLU activation function, and a ReLU activation layer is set after each fully connected layer. The ReLU activation function can alleviate the gradient vanishing problem during network training, while retaining the effective feature information in the joint input vector. If the neuron "death" phenomenon occurs during training, the ReLU activation function is replaced with the LeakyReLU activation function, and the leakage coefficient is set to 0.01. The normalization layer uses the batch normalization layer, with the momentum parameter set to 0.9 and the epsilon parameter set to 1e-5, to stabilize the feature distribution during network training and avoid network training instability caused by feature value fluctuations. Then, train the multi-level neural network watermark generator, construct the training dataset, collect 1000 sets of high-dimensional global feature vectors of different types of basic models and their corresponding random keys, and label each set of data with the expected deep feature representation standard.

[0082] To address the error between the deep feature representation output by the network and the annotation standard, a dimension-wise weighted error accumulation method is used for calculation, specifically including:

[0083] For each dimension of the deep feature representation (dimension M) and the corresponding dimension of the annotation standard (same dimension M), the absolute value of the numerical difference is calculated one by one. According to the importance of each dimension in watermark generation (e.g., the weight of the dimension associated with the device identifier is set to 0.3, and the weight of the dimension associated with the architecture fingerprint is set to 0.2), a preset weight is assigned to each dimension difference. The sum of the difference of each dimension × the corresponding weight is calculated to obtain the weighted error value of a single sample. During training, the weighted average error of the batch samples is used as the loss value of the current batch to ensure that the error calculation reflects both the overall deviation and the accuracy of the key dimensions.

[0084] Adam optimizer parameters are refined as follows: In addition to a learning rate of 0.001 and a weight decay coefficient of 1e-4, the first moment estimation exponent (β1) is set to 0.9, the second moment estimation exponent (β2) is set to 0.999, and the numerical stability term (ε) is set to 1e-8. The weight decay coefficient reduces the risk of overfitting the training data by applying L2 regularization constraints to the weight parameters of the fully connected layer. The learning rate adopts a dynamic adjustment strategy. If the loss of the training set decreases by less than 0.001 for 5 consecutive rounds, the learning rate is automatically decayed to 0.5 times the current value, with a minimum decay to 1e-5.

[0085] Training batch and iteration settings: The training batch size of 32 is determined based on the principle of sample diversity coverage, that is, each batch of samples must contain feature vectors of at least 5 different types of basic models; the maximum number of training iterations is 100 rounds. If the early stop mechanism is triggered in advance, the training will be terminated; otherwise, it will be forcibly stopped after 100 rounds.

[0086] After each training round, the weighted average loss of the validation set is calculated (using the same method as the training set). The loss of the current round is compared with the lowest loss value of the previous 9 rounds (out of 10). If the current loss is greater than or equal to the lowest loss of the previous 10 rounds, it is recorded as a round that has not decreased. When the number of rounds that have not decreased reaches 10 consecutive rounds, it is determined that the training has converged or is overfitting, and early stopping is triggered immediately. During training, the network parameters corresponding to the lowest loss of the validation set in each round are recorded in real time (including the weights / biases of fully connected layers and the mean / variance parameters of batch normalized layers). When early stopping is triggered, the parameter set corresponding to the lowest loss is retrieved and saved, ensuring that the saved parameters are the version with the best generalization ability during training.

[0087] Test set composition: 200 test samples must meet three coverage requirements: coverage of at least 10 different basic models, coverage of requester organization identifiers in 5 different industries, and coverage of target device hardware identifiers in 8 different models, and all samples must not have participated in the training or verification process; calculate the weighted average error between the deep feature representations and the labeling standard of the 200 test samples. If the average value is <0.05, the error verification is passed; calculate the cosine similarity (value range [-1,1]) for the deep feature representations corresponding to any two different inputs in the test set; count the similarity values ​​of all pairs. If more than 95% of the pairs have a similarity <0.1 (i.e., discrimination = 1 - similarity > 0.9), the discrimination verification is passed; only when both error verification and discrimination verification are passed is the multi-level neural network watermark generator considered to be trained successfully; otherwise, adjust the network structure (such as increasing the number of neurons in the fully connected layer) and retrain until the passing standard is met.

[0088] The joint input vector is fed into the successfully trained generator and processed in the following hierarchical order:

[0089] Input Layer Adaptation: The joint input vector (2N dimension) is directly fed into the input layer. The input layer verifies the dimension to ensure the vector is complete and free of anomalies before outputting it to the first fully connected layer. First-Stage Feature Extraction: The first fully connected layer performs a linear transformation on the input vector (by multiplying the input vector by the weight matrix and adding a bias). The transformation result is fed into the ReLU activation layer, where negative features are set to 0 (retaining valid positive features), resulting in first-stage features of dimension 2×2N. Second-Stage Feature Enhancement: The first-stage features are fed into the second fully connected layer for a linear transformation (2N dimension...). Expanded to 1.5×2×2N), the transformation result is processed by a ReLU activation layer (to alleviate gradient vanishing) to obtain the second-stage features; the third-stage feature optimization: the second-stage features are fed into the third fully connected layer for linear transformation (dimensionality compressed to 0.8×1.5×2×2N), and the transformation result is fed into the batch normalization layer: the feature mean and variance are calculated through a sliding window, and the feature values ​​are standardized to a distribution with a mean of 0 and a variance of 1, finally outputting a deep feature representation with a fixed dimension. This representation contains both the nonlinear fusion information of multi-source features and has stable numerical distribution characteristics.

[0090] Step 33 involves transforming the deep feature representation, mapping it to a preset watermark space, and converting the continuous vector values ​​in this space into discrete signal sequences through quantization, thereby generating a dynamic digital watermark uniquely bound to the high-dimensional global feature vector and a random key. Specifically, this includes:

[0091] A watermark space is preset, and its parameters are determined based on the application scenario of the target base model. If the target base model is an AI diagnostic model in the medical field, the watermark space dimension is set to 256 dimensions to match the multi-dimensional traceability requirements of medical device identification, institutional information, etc. The numerical range is set to 0 to 255 to facilitate subsequent quantization into discrete signals and adapt to the signal transmission format of most devices. An evaluation team composed of information security engineers and model application scenario experts is formed to evaluate the preset watermark space dimension and numerical range to ensure that the dimension can accommodate a sufficient number of unique watermark combinations to meet the identification requirements of at least 100,000 different models and devices, and that the numerical range will not cause signal transmission distortion. If the evaluation fails, the watermark space parameters are readjusted until the requirements are met.

[0092] The deep feature representation is transformed to construct a linear mapping matrix. The number of rows in this matrix matches the dimension of the deep feature representation, and the number of columns matches the dimension of the preset watermark space. The parameters of the linear mapping matrix are obtained through training. The training process aims to ensure that the mapped deep feature representation completely falls into the preset watermark space while retaining core information, such as hardware and organizational identifiers. The matrix parameters are iteratively optimized using gradient descent until the similarity is greater than a preset threshold of 0.95. The deep feature representation is multiplied by the trained linear mapping matrix to obtain a preliminary mapping vector. An attention weight layer is constructed. This layer determines the weight value by calculating the correlation between each dimension of the preliminary mapping vector and multi-source features, such as structural encoding and hardware identifiers. The higher the correlation, the larger the weight value. For example, the weight value of the dimension related to hardware identifiers is set to 1.2 times that of other dimensions. The preliminary mapping vector is multiplied by the attention weights to obtain a target mapping vector that completely falls into the preset watermark space and highlights the core features.

[0093] Quantization is performed using a uniform quantization method, dividing the preset watermark space's numerical range of 0 to 255 into 256 equally spaced quantization levels. Each level corresponds to a discrete value; for example, level 0 corresponds to a discrete value of 0, level 1 to a discrete value of 1, and so on, up to level 255 corresponding to a discrete value of 255. The quantization level to which the value of each element in the target mapping vector belongs is calculated, and the discrete value corresponding to that level is taken as the quantization result of that element. After quantization, the cosine similarity between the target mapping vector before and after quantization is calculated. If the similarity is less than a preset threshold of 0.95, the interval between the quantization levels is adjusted to reduce information density. Loss is investigated, and the quantization operation is re-executed until the similarity meets the requirements. Finally, a dynamic digital watermark is generated by combining all the quantized discrete values ​​in the order of the dimensions of the target mapping vector to form a discrete signal sequence. The uniqueness of the signal sequence is verified by repeatedly generating the signal sequence using the same high-dimensional global feature vector and random key to ensure that the generated sequences are completely consistent. Different high-dimensional global feature vectors or random keys are used to generate signal sequences to ensure that the difference between the sequences is greater than a preset threshold of 0.9. After the verification is passed, a dynamic digital watermark uniquely bound to the high-dimensional global feature vector and random key is obtained.

[0094] In this embodiment of the invention, through the detailed design of the multi-level neural network watermark generator and the training process of the system, the generated deep feature representation has stronger abstraction and anti-interference ability, which solves the problems of the shallow watermark feature extraction and easy destruction by pruning and fine-tuning in traditional watermarks. The early stopping and weight decay strategies in the training process ensure that the generator outputs high-quality features stably.

[0095] In a preferred embodiment of the present invention, step 4, utilizing a dynamic digital watermark, embeds it into the output layer feature map of the target base model using a gradient-preserving watermark embedding algorithm to generate a watermarked derived model, includes:

[0096] Step 41: Obtain the dynamic digital watermark and adaptively adjust the watermark signal according to the dimension of the feature mapping of the output layer of the target base model to generate the watermark pattern to be embedded. Specifically, this includes: obtaining the dynamic digital watermark generated in step 3, retrieving the discrete signal sequence of the watermark from the secure evidence storage library through the watermark storage interface, and recording the dimension parameters of the watermark, including signal length, number of channels, and numerical range; then obtaining the dimension information of the feature mapping of the output layer of the target base model, traversing the network layers of the target base model, locating the output layer and determining the output layer type. If the output layer is a convolutional layer, record the height, width, and number of channels of the feature mapping. If the output layer is a fully connected layer, record the dimension of the feature vector. Transform these dimension parameters into intuitive structural data.

[0097] The system determines whether the dimensions of the dynamic digital watermark and the output layer feature map match. If the watermark dimension is smaller than the feature map dimension, a block-based copying strategy is adopted. The watermark signal is divided into several sub-blocks according to the number of channels in the feature map, with each sub-block corresponding to one feature channel. Then, each sub-block is uniformly copied within its corresponding channel according to the height and width of the feature map, ensuring that the dimension of the watermark sub-block in each channel is consistent with the dimension of the feature map for that channel after copying. If the watermark dimension is larger than the feature map dimension, the watermark signal is dimensionality reduced. During interpolation, the goal is to preserve the arrangement pattern of the discrete watermark sequence. The system calculates the adjacent discrete watermarks in the watermark signal. The interpolation relationship of the values ​​is used to ensure that the dimension of the watermark pattern after dimensionality reduction is completely matched with the dimension of the feature mapping. After adjustment, the signal similarity is calculated to compare the key features of the watermark signal before and after adjustment, including the relative size of discrete values, the peak position of the sequence, and the numerical distribution trend. The similarity is required to be greater than the preset threshold of 0.95 to avoid the loss of core watermark information during the adjustment process. If the similarity does not meet the requirements, the adjustment method is reselected, such as changing block copying to adaptive scaling or adjusting the sampling interval of bilinear interpolation, until the generated dimension is completely adapted to the feature mapping of the target base model output layer and the information of the watermark pattern to be embedded is complete.

[0098] Step 42: Analyze the statistical characteristics and gradient distribution of the feature mapping of the target base model output layer to determine the optimal position and intensity of the watermark pattern embedding, specifically including:

[0099] The process involves acquiring the raw data of the output layer feature mapping of the target base model, constructing a dataset containing typical samples from application scenarios of the target base model (e.g., for a medical AI diagnostic model, collecting 2000 sets of medical image samples covering different disease types and imaging devices), inputting these samples into the target base model for inference, and capturing the raw data of the output layer feature mapping in real time. Each set of samples corresponds to a set of feature mapping data. The statistical characteristics of the feature mapping are analyzed, and all feature mapping data are classified and processed by channel. The mean, variance, peak signal-to-noise ratio (PSNR), and information entropy of each channel are calculated. The mean reflects the overall brightness level of the feature mapping, the variance reflects the dispersion of the feature values, the PSNR reflects the clarity of the features, and the information entropy reflects the richness of the information in the features. Channels with stable statistical characteristics are selected, i.e., the mean fluctuation range is less than 0.02, the variance change range is less than 0.01, the PSNR is greater than 30dB, and the information entropy fluctuation is less than 0.1. These channels have less impact on the forward propagation results of the model and are suitable as watermark embedding regions.

[0100] The gradient distribution of the feature map is analyzed, and the gradient is solved for the feature map of each channel to obtain the gradient magnitude and gradient direction of each pixel. The gradient magnitude reflects the rate of change of the feature value at that point, and the gradient direction reflects the direction of change of the feature value. The gradient magnitude distribution of all pixels is statistically analyzed, and pixel regions with gradient magnitudes less than a preset threshold of 0.1 are selected. The gradient changes in such regions are gradual, and the watermark is not easily covered by the gradient update of the backpropagation of the model. An attention weight calculation model is constructed to determine the importance of feature positions. This model includes an input layer, a convolutional layer, a pooling layer, and a fully connected layer. The dimension of the input layer is consistent with the dimension of the feature map. There are two convolutional layers, both using 3×3 convolutional kernels. The first layer has 16 kernels and the second layer has 32 kernels. They are used to extract local spatial features of the feature map. The pooling layer uses 2×2 max pooling to reduce the feature dimension and retain key features. There are two fully connected layers. The first layer has 512 neurons and the second layer has 1 neuron. They are used to output the importance weight of each pixel position.

[0101] Select a typical sample set of the target base model application scenario (e.g., select multiple sets of image samples covering different diseases and imaging devices for medical imaging models), input the samples into the target base model, and record the original inference accuracy; for the output layer feature map of each sample, process it in a pixel-by-pixel removal manner: for any pixel in the feature map, set its feature value to the mean of the feature map of that channel (to avoid introducing additional interference due to numerical abrupt changes), and generate the feature map after removing the pixel; input the processed feature map into the target base model and record the new inference accuracy; calculate the contribution by combining the difference between the original inference accuracy and the inference accuracy after removing the pixel with the original accuracy; if the accuracy does not decrease after removing the pixel, it is determined that the pixel has no positive contribution to the inference, and the contribution is recorded as 0; repeat the above pixel removal and contribution calculation operations to complete the contribution labeling of each pixel in the feature map of all samples, forming a dataset of feature map and pixel contribution label pairs, which are divided into training set and validation set according to the ratio.

[0102] The attention weight calculation model consists of an input layer, a feature extraction module, and a weight output module, with the following specific structure:

[0103] Input layer: The dimension is completely consistent with the feature mapping dimension of the output layer of the target base model; Feature extraction module: 2 convolutional layers (both using small-sized convolutional kernels, with different numbers of convolutional kernels, and paired with the ReLU activation function) + 1 max pooling layer (the dimension is controlled by the stride to retain local key features); Weight output module: 2 fully connected layers (the first layer has more neurons and is paired with ReLU activation; the second layer has only 1 neuron, and the output is limited to the 0-1 range by the activation function, corresponding to the pixel importance weight).

[0104] Loss function and optimizer configuration:

[0105] A weighted cross-entropy loss function is adopted: Since the proportion of high-contribution pixel samples is usually low, in order to avoid the model biased in predicting low-contribution samples, higher weight coefficients are assigned to high-contribution samples, and basic weight coefficients are assigned to low-contribution samples. This method balances the training impact of samples with different contributions. Optimizer parameters are supplemented: In addition to the basic learning rate and weight decay coefficient, the Adam optimizer sets the first-order moment estimation coefficient, the second-order moment estimation coefficient, and a numerical stability term to avoid gradient oscillations or numerical anomalies during training.

[0106] Training process and early stop mechanism optimization:

[0107] Training batch processing: The training batch size is set according to the sample diversity requirements. Each batch randomly selects samples from the training set to ensure that it includes feature mapping samples with different contribution distributions. Iteration and early stopping: The training iteration is set with an upper limit. After each training iteration, the weighted cross-entropy loss value of the validation set is calculated. Early stopping judgment criteria: The lowest loss value of the validation set in each iteration is recorded. If the loss value of the validation set in multiple consecutive iterations is not lower than the current lowest loss value (i.e., there is no downward trend), the early stopping mechanism is triggered, training is stopped immediately, and the model parameters at this time are saved. If the training reaches the iteration limit and early stopping is not triggered, the model parameters of the last iteration are also saved.

[0108] After training, the model performance is evaluated using a validation set: the linear correlation coefficient between the pixel weights predicted by the model and the actual contribution is calculated. If the correlation coefficient reaches the preset standard (indicating a strong correlation between weights and contributions), the model is qualified; if it does not meet the standard, the network structure is adjusted (such as increasing the number of convolutional kernels or adding network layers) and retrained until the model meets the performance requirements.

[0109] The feature map of the target base model's output layer is input into a qualified attention weight calculation model to obtain the importance weight of each pixel. All pixels are traversed, and pixels with weight values ​​below a preset threshold are selected and marked as low-weight pixels, recording their coordinates and channel. Multiple sets of new samples that did not participate in contribution labeling are selected, and the above weight calculation and filtering operations are repeated for the feature map of each sample to obtain a set of low-weight pixels for each set. The frequency of each pixel being judged as a low-weight pixel in all new samples is counted, and pixels with a frequency reaching a preset proportion are selected to form a stable set of low-weight pixels. A neighborhood connectivity judgment method is used to select connected regions with a pixel count reaching a preset scale (ensuring sufficient capacity to support complete watermark sub-blocks). This region is the optimal location for watermark embedding, and its coordinate range and channel are recorded.

[0110] Calculate the numerical range of the optimal location feature mapping, and set the initial embedding strength according to this range (ensuring that the initial strength does not excessively affect the original numerical value of the feature mapping); select multiple sets of validation samples covering the core application scenarios of the target basic model (without intersection with the training set and validation set), and record the original inference accuracy of the samples.

[0111] Adjust the embedding strength in fixed steps (set a reasonable strength adjustment range to avoid excessive strength causing a sharp drop in model accuracy). For each test strength, perform the following operations:

[0112] Watermark embedding involves embedding the watermark pattern to be embedded into the feature map using pixel value superposition at the optimal position coordinates. If the superimposed pixel value exceeds the range of the feature map values, truncation is performed. Accuracy testing involves inputting the watermark-embedded feature map into the target base model and calculating the average inference accuracy of all test samples to obtain the accuracy decrease. Watermark extraction testing uses a preset watermark extraction algorithm to extract the watermark from the watermark-embedded feature map and calculates the watermark extraction success rate (successful extraction is defined as the similarity between the extracted watermark and the original watermark reaching a preset threshold). Optimal strength selection involves choosing the minimum embedding strength that simultaneously satisfies both an accuracy decrease below a preset upper limit and a watermark extraction success rate above a preset lower limit (to avoid over-embedding affecting model performance). If none of the test strengths meet the requirements, the strength adjustment range and step size are adjusted, and the test is repeated until the optimal strength is found.

[0113] Step 43: Based on the determined optimal position and intensity, the watermark pattern to be embedded is weighted and fused with the target feature map at the corresponding positions. A gradient constraint term is introduced through coefficients to limit the change in the gradient distribution of the original feature map caused by the watermark embedding operation. This ensures that the feature map after watermark embedding maintains the original forward propagation characteristics of the model, while its gradient backpropagation behavior remains consistent with the original model. Specifically, this includes:

[0114] A weighted fusion operation is performed. Based on the optimal position determined in step 42, the watermark pattern to be embedded and the feature map of the target base model output layer are numerically fused at the corresponding positions. The weight coefficient of the feature map is set to α, and the weight coefficient of the watermark pattern is set to β, with α+β=1. The value of α is determined according to the feature importance of the optimal position. For positions with high feature importance, such as attention weights between 0.1 and 0.2, α is set to 0.95. For positions with low feature importance, such as attention weights less than 0.1, α is set to 0.9. β is set to 0.05 or 0.1 respectively, ensuring that the watermark pattern can be effectively embedded without obscuring the core information of the feature map. During the fusion process, the calculation is performed pixel by pixel. The fused value of each position is the original feature value of that position multiplied by α plus the corresponding value of the watermark pattern multiplied by β. After the fusion of all optimal positions is completed, the feature map with the initial watermark is obtained.

[0115] The output layer feature map of the target base model is located at the optimal position determined in step 42. The gradient values ​​of all pixels at this position are extracted using the model gradient calculation function, including the magnitude of the gradient of each pixel (reflecting the intensity of gradient change) and the gradient direction (reflecting the spatial direction of gradient change). These data are classified and stored according to pixel coordinates to form the original gradient benchmark library. For the watermarked feature map that has completed the preliminary fusion in step 43, the gradient magnitude and direction of each pixel are extracted at the same optimal position using the same calculation method as the original gradient acquisition to form the watermarked gradient dataset.

[0116] The original gradient baseline library and the watermarked gradient dataset are compared pixel by pixel. For the same pixel position, the difference in gradient magnitude between the two is calculated and the absolute value is taken (to measure the degree of change in gradient strength). At the same time, the angle between the gradient directions is used to help correct the magnitude difference result (if the directions are the same or similar, the difference is small; if the directions are opposite, the difference is large). The gradient difference of each pixel is quantified into a specific value. After summing the difference values ​​of all pixels, an overall gradient difference index is formed. This index directly reflects the degree of change of the gradient distribution of the original feature mapping by the watermark embedding operation. The smaller the index value, the more completely the gradient distribution is preserved.

[0117] Using the gradient difference index as the core, a constraint coefficient λ (used to adjust the strength of gradient constraints) is introduced to construct a gradient constraint term: the magnitude of the constraint term is positively correlated with λ and the gradient difference index, that is, the larger λ is and the larger the gradient difference index is, the stronger the influence of the constraint term on the model loss; this gradient constraint term is integrated into the loss function of the target base model so that the model can simultaneously consider the consistency of gradient distribution during subsequent fine-tuning training, avoiding deviation of gradient backpropagation behavior from the original model due to watermark embedding.

[0118] Training and validation system construction:

[0119] For sample preparation, 500 sets of validation samples (including regular samples and marginal samples, ensuring that the sample distribution is consistent with the actual use scenario) covering all application scenarios of the target base model were selected. After preprocessing according to the model input requirements, a λ-optimized validation sample set was formed. The target base model was deployed into the training framework and configured with the same training environment as the original model (such as hardware devices, software versions, and basic hyperparameter values) to ensure the comparability of the validation results. The initial value range of λ was set to 0.1 to 1.0, and the step size for each adjustment was 0.1 (i.e., testing 0.1, 0.2, ..., 1.0 values ​​in sequence). For each tested λ value, it was substituted into the gradient constraint term, and the fine-tuning training of the target base model was started. Each training session consisted of 10 rounds. During the training process, the gradient update magnitude (such as the update value of the weight parameters) and gradient direction (such as the positive and negative trend of parameter updates) of the parameters of each network layer (such as convolutional layer, fully connected layer, and normalized layer) were recorded in real time during each round of backpropagation through the model monitoring function, forming the current λ gradient record library.

[0120] Using the original gradient benchmark library as a reference, we compare it with the current λ gradient record library. We comprehensively quantify the gradient consistency of the two from two dimensions: gradient update magnitude (calculate the degree of difference with the original model, the smaller the difference, the better) and gradient direction (statistically count the proportion of the same direction as the original model, the higher the proportion, the better). The closer the consistency is to 1, the more consistent the gradient behavior of the watermarked model is with the original model.

[0121] The calculated gradient consistency must be greater than 0.98 (to ensure that the gradient updates of parameters in each layer are highly consistent with the original model during backpropagation of the watermarked model); after 10 training rounds, the model's inference performance is tested using a validation sample set optimized with λ, and the difference in validation set accuracy between the watermarked model and the original model is calculated. The accuracy drop should be less than 0.3% (to avoid excessive gradient constraints affecting the business performance of the model's forward propagation).

[0122] Each λ value is verified sequentially to ensure it meets the two conditions mentioned above. If a λ value meets both conditions, it is marked as a candidate optimal λ. If there are multiple candidate optimal λ values, the λ value with the highest gradient consistency and the smallest decrease in accuracy is selected as the final optimal λ value. If all tested λ values ​​fail to meet the conditions, the range of λ values ​​needs to be expanded (e.g., from 0.05 to 1.2) or the adjustment step size needs to be reduced (e.g., 0.05), and the above testing process is repeated until an optimal λ value that meets the requirements is found.

[0123] Gradient constraints are added to the loss function of the target base model. During subsequent fine-tuning training, the feature map values ​​with embedded watermarks are optimized through backpropagation. This ensures that the feature map with embedded watermarks maintains the original forward propagation characteristics of the model, i.e., the difference between the model's inference results and the original model is less than 0.5%, while its gradient backpropagation behavior remains consistent with the original model. Specifically, the difference between the gradient update magnitude of each layer's weight parameters and bias parameters and the original model is less than 0.02, and the proportion of gradient directions being the same is greater than 99%. After fusion and constraint, the gradient changes during 100 training rounds of the model are continuously monitored. If the gradient consistency drops below 0.98, the weight coefficients of α and β and the constraint coefficients of λ are readjusted until the gradient consistency meets the preset requirements after each training round.

[0124] Step 44 involves performing integrity verification on the feature mapping after watermark embedding, ultimately generating a derived model containing a dynamic digital watermark. This includes constructing an integrity verification index system, comprising three categories: forward propagation performance index, watermark integrity index, and gradient consistency index. This index is used to verify the impact of watermark embedding on the model's core business capabilities, ensuring the model can be applied normally. Specifically, this includes:

[0125] 2000 test samples were selected, which should cover all application scenarios of the target base model and include regular samples, marginal samples and abnormal samples to simulate the data distribution in actual application of the model. The original model and the preliminary watermarked model were deployed in the same hardware and software environment. The hardware environment included the same type of processor and memory, and the software environment included the same version of operating system, deep learning framework and driver. At the same time, irrelevant background processes were closed to avoid environmental interference.

[0126] Verification of differences in inference accuracy:

[0127] 2000 test samples were input into the original model and the preliminary watermarked model, respectively, and the inference results of the two models were obtained. The inference results of the two models were compared with the sample annotation information to determine the inference accuracy of the original model and the preliminary watermarked model. The difference in inference accuracy between the two models was calculated, and the difference was required to be less than 0.5%. For the core application scenario of the model, the accuracy difference in that scenario was calculated separately, and the accuracy difference in the core scenario was required to be less than 0.3%. The total time taken by the original model and the preliminary watermarked model to process 2000 test samples, as well as the average time taken to process a single sample and the average batch time taken to process samples according to the preset batch size, were recorded. The decrease in inference speed of the preliminary watermarked model relative to the original model was calculated, and the decrease was required to be less than 5%. If the decrease in inference speed was greater than or equal to 5%, the feature mapping fusion method was optimized, for example, by reducing the number of watermark embeddings in non-critical positions, where non-critical positions are regions with low attention weights. After optimization, the forward propagation performance index was re-verified until the above requirements were met.

[0128] This metric is used to verify that the embedded dynamic digital watermark can be accurately extracted to ensure traceability capabilities, and specifically includes:

[0129] Watermark extraction follows a pre-defined process, extracting the watermark signal from the output layer feature map of the initial watermarked model. The extracted watermark signal is then compared with the original dynamic digital watermark in terms of discrete sequence arrangement and feature value distribution. The discrete sequence arrangement comparison includes the consistency of the positions of peaks and valleys and the overall upward and downward trends of the sequence; the feature value distribution comparison includes the consistency of the proportion of feature values ​​in each numerical range. The extracted watermark signal must have a similarity greater than 95% with the original dynamic digital watermark. If the similarity is less than or equal to 95%, the process returns to re-determine the watermark embedding position and strength, and the watermark embedding and integrity verification steps are repeated until the above requirements are met. This metric ensures that the gradient backpropagation characteristics of the model after watermark embedding remain consistent with the original model, avoiding impact on subsequent model training. Specifically, this includes:

[0130] Gradient data acquisition involves selecting 100 sets of validation samples and inputting them into the original model and the initial watermarked model, respectively. This triggers the backpropagation process of the models and records the gradient information of the network layer parameters of each network layer in the two models. The network layers include convolutional layers, fully connected layers, and normalization layers, and the parameters include weight parameters and bias parameters.

[0131] Calculate the gradient Euclidean distance between the corresponding network layers of the preliminary watermarked model and the original model with the same parameters, where the Euclidean distance is less than 0.02. If the Euclidean distance is greater than or equal to 0.02, return to adjust the constraint coefficients of the gradient constraint terms, and repeat the gradient constraint optimization and verification steps until the above requirements are met. Only when the forward propagation performance index, watermark integrity index, and gradient consistency index all meet their respective preset requirements is the preliminary watermarked model deemed to have passed the integrity verification. If any index fails to meet the requirements, return to the corresponding step for adjustment and re-execute the verification until all indexes meet the requirements, and finally generate a derived model containing a dynamic digital watermark.

[0132] If any indicator fails to meet the requirements, the above adjustment process is repeated until all indicators meet the preset standards. Next, the anti-attack performance test is conducted to simulate the infringement scenario in the background technology. First, a pruning test is performed, and the output layer and front layer of the preliminary watermarked model are pruned. The pruning ratio is gradually increased from 10% to 30%. After each pruning, the watermark is extracted and the model accuracy is tested. It is required that the watermark extraction similarity is still greater than 0.9 after pruning, and the model accuracy decreases by less than 1%.

[0133] Fine-tuning tests were conducted by collecting 100 new samples that had not participated in model training. The initial watermarked model was fine-tuned and trained for 20 rounds. After fine-tuning, the watermark was extracted and the model performance was verified. The watermark similarity was required to be greater than 0.92, and the model's accuracy on the test set was required to decrease by less than 0.8%. After passing the anti-attack test, the parameters of the watermarked model were completely saved, including the feature mapping parameters after embedding the watermark in the output layer, the αβ weight coefficients, gradient constraint coefficients λ, and the coordinates of the optimal embedding position during the watermark embedding process. This information was integrated with the main model parameters, such as the weights and biases of each layer, into a unified model file. Finally, unique identification information was added to the model file, including the dynamic digital watermark number, the target device hardware identifier, the requesting organization identifier, and the embedding timestamp, to generate a derived model containing a dynamic digital watermark that meets the performance and security requirements.

[0134] In this embodiment of the invention, by combining statistical characteristic analysis, gradient distribution analysis and attention weight model, the optimal embedding position and strength are accurately determined. This solves the problem that improper embedding position in traditional methods leads to a decrease in model performance or that the watermark is easily removed by pruning and fine-tuning. By selecting a statistically stable and gradient-flat low-importance region for embedding, the impact on the forward propagation of the model is reduced, and the risk of the watermark being covered by gradient updates is also reduced, thereby improving the security of watermark embedding and model compatibility.

[0135] In a preferred embodiment of the present invention, step 5 involves performing quality assessment and testing on the derived model to obtain a verified watermarked model; distributing the verified watermarked model to the requesting party's authorized device via an encrypted channel, and writing the watermark generation parameters, distribution context information, and timestamp as evidence storage data into a secure evidence storage database, including:

[0136] Step 51: Perform forward inference on the derived model using a preset test dataset, calculate the accuracy decrease of the output result relative to the original target base model, and confirm that the decrease is lower than the preset performance threshold; and perform watermark extraction test on the derived model to verify that its watermark extraction success rate is higher than the preset survival rate threshold, and obtain the evaluation result. Specifically, this includes: constructing a preset test dataset, which needs to cover all application scenarios of the target base model to ensure evaluation accuracy. If the target base model is a medical AI diagnostic model, collect 3000 sets of medical image samples, covering common disease types such as pneumonia, lung cancer, and brain tumors, images generated by different imaging devices such as CT, MRI, and X-ray films, and images with different resolutions and imaging qualities. Among them, 2000 sets are used as test samples for accuracy calculation, and 1000 sets are used as anti-attack test samples for watermark survival rate verification. All samples are labeled with real diagnostic results as the basis for judging the correctness of inference.

[0137] Forward inference testing was conducted by inputting 2000 test samples into the original target base model and the derived model, respectively. The inference results of each model for each sample were recorded, and the number of samples correctly inferred by the derived model and the number of samples correctly inferred by the original model were counted. The accuracy decrease of the derived model relative to the original model was calculated. The preset performance threshold was determined according to the model application scenario. For the medical diagnosis model, which has extremely high accuracy requirements, the preset performance threshold was 0.5%, and for the industrial quality inspection model, the preset performance threshold was 1%. If the accuracy decrease was lower than the corresponding threshold, the forward inference performance was considered to be up to standard. Subsequently, watermark extraction testing was conducted. First, extraction was performed in a non-attack scenario. The watermark signal was extracted from the feature mapping of the output layer of the derived model through the watermark extraction process in step 6. The extracted signal was compared with the original dynamic digital watermark. The discrete sequence arrangement feature value distribution of the watermark is used to calculate the similarity. Then, the infringement attack scenario in the background technology is simulated for extraction. The output layer and the previous layer of the derived model are pruned, and the pruning ratio is gradually increased from 10% to 30%. After each pruning, the watermark is extracted and the similarity is calculated. 50 new samples are collected to fine-tune the derived model for 20 rounds. After fine-tuning, the watermark is extracted and the similarity is calculated. The preset watermark survival rate threshold is 95%, that is, the watermark extraction similarity is not less than 95% in the absence of attack scenarios, not less than 92% when the pruning ratio is not more than 20%, and not less than 90% after fine-tuning. If the watermark extraction success rate in all scenarios is higher than the corresponding threshold, the watermark survival rate is judged to meet the standard. Finally, the forward inference performance results and the watermark survival rate results are combined to generate an evaluation report.

[0138] Step 52: Based on the evaluation results, assign a verification qualified identifier to the derived models that meet the performance requirements and watermark survival rate requirements, and generate a verified watermarked model. Specifically, this includes: determining the constituent elements of the verification qualified identifier. This identifier needs to be associated with key information throughout the model's entire lifecycle to solve the problem of single identifiers and lack of traceability in the background technology. The elements include the unique number of the dynamic digital watermark generated in Step 3, the target device hardware identifier, the device hardware information mapping vector collected in Step 1, the requesting organization identifier, the organization digital vector parsed in Step 1, the version number of the derived model generated based on the number of model iterations, and the evaluation qualified timestamp accurate to milliseconds. These elements are combined in the order of watermark number, hardware identifier, organization identifier, version number, and timestamp to form the original identifier string. The original identifier string is then security processed by calculating the hash value of the original string and signing it through the distributor to generate an identifier string with a digital signature, ensuring that the identifier is tamper-proof and traceable to the distributor.

[0139] The verified identifier is associated with the watermarked model. The identifier string with digital signature is embedded in the metadata area of ​​the derived model. The metadata area should be independent of the model calculation parameter area to avoid affecting the model inference performance. At the same time, a simplified index of the identifier string is added to the header information of the model file to facilitate quick query of the identifier information later. Finally, the identifier association verification is performed. The identifier string in the metadata area of ​​the derived model is read to verify the validity of the digital signature. That is, the signature is decrypted by the distributor's public key and compared with the hash value of the original string to confirm that the identifier has not been tampered with. At the same time, it is checked whether the hardware identifier of the identifier is consistent with the information collected in step 1. If the verification is successful, the verified watermarked model is officially generated. If the verification fails, the identifier is regenerated and the association operation is repeated.

[0140] Step 53: Distribute the watermarked model with the verified qualification mark to the authorized device of the requesting party via a secure transmission protocol, and record the generation of distribution context information during the distribution process. Specifically, this includes: selecting a secure transmission protocol; considering the security and transmission stability of the model file, the TLS 1.3 protocol is selected as the basic transmission protocol, and a dedicated security layer is superimposed to enhance protection capabilities. The dedicated security layer includes an identity authentication module, a data encryption module, and a transmission verification module; the identity authentication module adopts a two-way authentication mechanism, whereby the distributor needs to verify the hardware identifier and digital certificate of the authorized device of the requesting party, and the authorized device of the requesting party needs to verify the digital certificate of the distributor. During the process, the device needs to submit the hardware identification information collected in step 1. The distributor compares it with the device information pre-stored in the secure evidence repository. Only when both the hardware identification and the certificate are verified can a transmission connection be established. The data encryption module performs encryption processing. The encryption key is dynamically generated between the distributor and the authorized device through a key negotiation protocol such as ECDHE. A new key is generated for each transmission to avoid security risks caused by key leakage. The transmission verification module uses the CRC32 check algorithm to verify the transmitted data packets. Each data packet is accompanied by a check value. After receiving the data, the authorized device recalculates the check value and compares it with the attached value. If they do not match, a retransmission is requested.

[0141] The distributor divides the encrypted watermarked model file into several 10MB chunks and transmits the chunk data sequentially to the authorized device. During transmission, the distributor records the distribution context information in real time, including the authorized device's IP address, port number, hardware identifier, transmission start time, transmission end time, transmission duration of each chunk, transmission status (success / failure, number of retransmissions), network bandwidth fluctuations during transmission, and the authorized device's confirmation information. If a chunk transmission fails, a retransmission mechanism is automatically triggered, with a maximum of three retransmissions. If three retransmissions fail, transmission is paused and an alarm is sent to the distributor, while the fault information is recorded in the distribution context. Once all chunks have been successfully transmitted and the authorized device has completed file reassembly, the distributor receives file integrity confirmation information from the authorized device. This confirmation information includes the hash value of the reassembled file. The distributor compares this hash value with the hash value of the original model file. If they match, the distribution is considered successful; otherwise, the distributor instructs the authorized device to reassemble or retransmit the file.

[0142] Step 54: Based on the distribution context information, combined with the watermark generation parameters and distribution timestamp used in the dynamic digital watermark generation process, a complete evidence storage record is generated, and the evidence storage record is submitted to the secure evidence storage library as the written content. Specifically, this includes: sorting out the complete content of the evidence storage data, including the watermark generation parameters: the multi-source feature vector and weight coefficients of step 1, the weighted fusion algorithm parameters of step 2, the random key, the structure parameters and training parameters of the multi-level neural network watermark generator of step 3, the watermark mode adjustment parameters of step 4, the optimal embedding position strength αβ, the weight coefficient, the gradient constraint coefficient λ, the distribution context information: the authorized device information, transmission time, fragmented transmission status, network information, and reception confirmation information recorded in step 53, the distribution timestamp accurate to milliseconds and the evaluation pass timestamp of step 52, the original string of the verification pass identifier, and the digital signature.

[0143] A secure evidence repository is constructed using a consortium blockchain architecture to ensure the immutability of the evidence data. Consortium blockchain nodes include model distributors, requesting institutions, third-party auditing agencies, and nationally recognized intellectual property protection institutions. Each node has data storage and verification permissions. The repository's underlying layer uses distributed ledger technology, with ledger records stored in a chronological chain. Each block contains a block header and a block body. The block header includes the hash value, timestamp, and block number of the previous block, while the block body contains the hash value and digest information of the evidence data. The repository also requires an access control module, allowing only authorized nodes to read the evidence data. Modification and deletion operations require consensus from all nodes, and the consensus mechanism employs a practical Byzantine fault-tolerant algorithm to ensure both efficiency and security. Then, the evidence data is written. The processed evidence data is organized into standard JSON format according to the structure of watermark generation parameters, distribution context, timestamp, and verification qualification identifier. A unique hash value is calculated for the written content using a hash algorithm, and the hash value and the written content are submitted together to the repository's write interface.

[0144] After receiving the evidence, all consortium blockchain nodes verify the integrity and legality of the written content. The verification includes whether the watermark generation parameters are consistent with the record in step 34, whether the distribution context is consistent with the record in step 53, the rationality of the timestamp, and the validity of the signature of the qualified identifier. If all nodes pass the verification, the written content is stored in the distributed ledger, and a unique evidence number is generated. The evidence number is associated with the hash value of the written content. Finally, a successful evidence storage notification is returned to the distributor, which includes the evidence number, the evidence storage time, and the verification results of all nodes. The distributor stores the evidence number associated with the watermark model's qualified identifier, which facilitates quick retrieval of evidence data through the evidence number during subsequent traceability.

[0145] In this embodiment of the invention, a secure distribution mechanism with bidirectional authentication, encrypted transmission, fragment verification, and detailed context recording solves the problems of insecurity and lack of propagation trajectory recording in traditional distribution processes. This ensures that the model is only distributed to authorized devices, while the recorded context provides data support for tracing the propagation path, preventing the inability to trace the source after the model has been illegally propagated.

[0146] In a preferred embodiment of the present invention, step 6 involves running the distributed watermarked model on an authorized device, and obtaining the watermark-bearing signal from the model's output data during model operation; parsing the watermark-bearing signal to extract the watermark information, and recovering the original feature vector using an inverse mapping algorithm, including:

[0147] Step 61: Run the watermarked model on the authorized device and collect the output data generated during the model's operation in real time. This includes: pre-configuring the operating environment of the authorized device; verifying the hardware parameters of the authorized device, including the CPU model, memory capacity, hard disk serial number, and network adapter physical address, based on the target device hardware identifier recorded in the security evidence repository, ensuring complete consistency with the evidence information; simultaneously installing the operating system version, driver version, and deep learning framework version that match the model distribution, with the framework version deviation controlled within 0.1 to avoid distortion of model output data due to environmental differences; after configuration, running a preset test script containing 10 sets of standard input data; if the error between the test script output result and the preset standard result is less than 0.01, the operating environment is considered qualified. Next, run the watermarked model, passing the hardware identifier of the authorized device to the model through the device authentication interface. The model verifies that the hardware identifier matches the built-in identifier and then starts running; determining the input sample set based on the model's application scenario, such as selecting 500 sets of medical image samples covering different diseases for a medical AI diagnostic model. The samples must include new samples not involved in the model training to simulate real-world application scenarios.

[0148] Samples are input into the model in batches, with the number of samples per batch determined by the authorized device's memory capacity. This ensures that memory usage during batch operation does not exceed 80%, preventing memory overflow and data loss. Output data is collected in real-time, establishing a real-time communication link with the model's output layer. This link uses an encrypted transmission protocol to ensure data transmission security. The collected data includes feature mapping data from each inference iteration, inference completion timestamps, and hardware operating parameters of the device during inference, including CPU usage, memory consumption, and GPU utilization. The collection frequency is set to synchronize with the model's inference frequency, meaning output data is collected after each sample inference iteration, with an interval error not exceeding 10 milliseconds.

[0149] Preprocess and store the collected data, removing the abnormal data generated during the collection process. The criterion for determining abnormal data is that the missing rate of feature mapping data exceeds 5% or the hardware status parameters are outside the normal range; name the preprocessed data in the format of inference timestamp, sample number, and output data, and store it in the encrypted storage partition of the authorized device. The storage partition is protected by the AES-256 encryption algorithm, and the key is bound to the hardware identifier of the authorized device to ensure that the data can only be decrypted and used on this authorized device.

[0150] Step 62, perform signal detection and separation processing on the output data, and identify and extract the watermark-bearing signal embedded in the output data. Specifically, it includes: constructing a watermark-bearing signal detection model, which is a convolutional neural network structure, including an input layer, a convolutional layer, a batch normalization layer, an activation layer, a pooling layer, and a fully connected layer; the dimension of the input layer is consistent with the feature mapping dimension of the model output data to ensure that the output data can be completely input; set 3 convolutional layers, the first layer uses a 3×3 convolutional kernel with a number of 32, the second layer uses a 5×5 convolutional kernel with a number of 64, and the third layer uses a 3×3 convolutional kernel with a number of 128 to extract the local signal features in the output data; a batch normalization layer and a ReLU activation layer are set after each convolutional layer, and the momentum parameter of the batch normalization layer is set to 0.9 and the epsilon parameter is set to 1e-5 to stabilize the training process and alleviate gradient disappearance; the pooling layer uses 2×2 max pooling and is set after the second and third convolutional layers to reduce the feature dimension and retain the key signal features; set 2 fully connected layers, the first layer has 1024 neurons, and the second layer has 2 neurons to output a binary detection result of containing or not containing the bearing signal.

[0151] Train the detection model, construct a training dataset, collect 10,000 groups of output data of the watermark-containing model as positive samples, and label each group of data with the label of containing the bearing signal. Collect 10,000 groups of output data of the original watermark-free model as negative samples, and label each group of data with the label of not containing the bearing signal; divide the dataset into a training set and a validation set according to a 7:3 ratio, use the cross-entropy loss function to calculate the difference between the model prediction result and the label, select the Adam optimizer, set the learning rate to 0.001, the weight decay coefficient to 1e-4, the training batch size to 32, and train for 80 iterations; calculate the validation set accuracy after each round of training. If the validation set accuracy does not improve for 10 consecutive rounds or the accuracy reaches 99.5%, stop training and save the optimal model parameters; after training, verify through the test set. The test set contains 2,000 positive and negative samples that did not participate in the training. If the detection accuracy is greater than 99% and the false detection rate is less than 0.5%, the detection model is determined to be qualified.

[0152] Signal detection is performed. The output data collected in step 61 is input into a qualified detection model. The model output data is used to determine whether it contains a watermark carrying signal. If it is determined to contain a carrying signal, the signal separation process begins. If it is determined not to contain a carrying signal, an abnormal alarm is triggered. The current device status and input sample information are recorded and uploaded to the secure evidence storage library. At the same time, the model output data of the sample is re-collected. Signal separation processing is performed using an adaptive noise cancellation filter. This filter includes a reference signal input terminal and a main signal input terminal. The main signal input terminal is connected to the output data that has been confirmed to contain a carrying signal.

[0153] Step 63 involves parsing and decoding the watermark-carrying signal to extract the watermark information. Specifically, this includes determining the watermark parsing and decoding rules, retrieving from the secure evidence storage library the quantization level correspondence, signal sequence arrangement order, and feature identifier encoding rules used when generating the dynamic digital watermark in Step 3. The quantization level correspondence is the mapping table of quantization level and discrete value in Step 33, the signal sequence arrangement order is the correspondence between the dimension order of the target mapping vector and the discrete sequence order in Step 33, and the feature identifier encoding rules are the encoding logic of the organization identifier, digital vector, hardware identifier, and digital vector in Step 21. These rules are then imported into the parsing and decoding system as the basis for parsing and decoding. A watermark parsing model is constructed, which is a bidirectional recurrent neural network structure, including an input layer, an embedding layer, a bidirectional LSTM layer, a fully connected layer, and an output layer. The dimension of the input layer is consistent with the length of the separated watermark-carrying signal sequence. The embedding layer maps the input sequence into a 256-dimensional embedding vector to capture the local correlation features of the signal sequence. There are two bidirectional LSTM layers, each with 512 hidden units. The forward LSTM captures the feature dependencies of the sequence from left to right, and the backward LSTM captures the feature dependencies from right to left. The outputs of the two are concatenated to obtain the global sequence features.

[0154] The fully connected layer consists of three layers: the first layer has 1024 neurons, the second layer has 512 neurons, and the third layer is an output layer with the same dimensions as the original dynamic digital watermark, used to output the parsed watermark information. During model training, the original dynamic digital watermark sequence generated in step 3 is used as the label, and the corresponding separated carrier signal sequence is used as the input sample, with a sample size of 5000 groups. The mean squared error loss function is used to measure the difference between the model output and the original watermark sequence. The Adam optimizer is selected, with a learning rate of 0.0005, a weight decay coefficient of 1e-5, a training batch size of 16, and 100 training iterations. After each training iteration, the sequence similarity of the validation set is calculated. If the similarity does not improve for 15 consecutive iterations or reaches 99.2%, training is stopped, and the optimal model parameters are saved. After training, the model is validated using a test set containing 1000 groups of carrier signals and the original watermark sequence that were not used in training. If the similarity between the parsed sequence and the original sequence is greater than 99%, the parsing model is considered qualified. Watermark parsing is performed by inputting the watermark-carrying signal separated and standardized in step 62 into a qualified parsing model. The model captures the sequential dependencies of the signal sequence through a bidirectional LSTM layer and, combined with the imported parsing and decoding rules, outputs the preliminary parsed watermark information. The preliminary parsed information includes discrete numerical sequences, institutional identifier encoding segments, hardware identifier encoding segments, and watermark generation time encoding segments.

[0155] The specific calculation process of the mean squared error loss function is as follows: The input samples and labels for model training are formatted uniformly. The input sample is the watermark-carrying signal sequence separated and standardized in step 62, and the label is the original dynamic digital watermark sequence generated in step 3. Both need to be converted into one-dimensional numerical sequences of the same dimension, with the sequence length consistent with the original dimension of the dynamic digital watermark. Each value in the input sample and label is normalized, mapping the numerical range uniformly to the interval between 0 and 1. The normalization process uses the maximum and minimum values ​​of all values ​​in the sample set as a benchmark to ensure that the numerical magnitudes of the input and label are consistent, avoiding deviations in loss calculation due to numerical differences. Simultaneously, samples with missing or abnormal values ​​are removed. The criterion for judging abnormal samples is that any value in the sequence exceeds the range of 0 to 1000 (since the discrete value range of the watermark-carrying signal is preset to 0 to 255, values ​​exceeding this range can be judged as collection or separation errors). Finally, 5000 sets of valid samples are retained for training, divided into a training set of 4000 sets and a validation set of 1000 sets in an 8:2 ratio.

[0156] In each iteration of model training, one set of samples is randomly selected from the training set (in practice, 16 sets of samples are selected in batches for parallel computation, according to the requirement of batch size 16; the single-set computation logic is explained here). The watermark-carrying signal sequence of this set of samples is input into the watermark parsing model in training. The model captures the dependencies between the sequence through a bidirectional LSTM layer, and outputs a preliminary parsing sequence with dimensions consistent with the label after processing by a fully connected layer. When calculating the mean squared error loss value of this set of samples, the numerical differences between the preliminary parsing sequence and the original dynamic digital watermark sequence are compared dimensionally. The difference between the parsing value and the label value of each dimension is calculated to obtain the error value of that dimension. Then, the error value of each dimension is squared to obtain the squared error value. Then, the total number of dimensions N of the sequence is counted (N is consistent with the original dimensions of the dynamic digital watermark), and the sum of the squared error values ​​of all dimensions is calculated. The sum of the squared errors is divided by the total number of dimensions N to obtain the single-set mean squared error loss value of this set of samples. This value reflects the average deviation between the parsing result of a single set of samples and the true label.

[0157] With a batch size of 16, 16 samples are processed simultaneously in each training batch. The mean squared error loss (MSE) of each of the 16 samples is calculated, and then these 16 individual loss values ​​are summed to obtain the total loss value for the batch. This total loss value is then divided by the batch size of 16 to obtain the average MSE loss value for the batch, which serves as the loss benchmark for the current batch. To prevent numerical overflow from affecting training stability during calculation, a numerical truncation process is added after the error squared calculation, with a truncation threshold of 10. If the squared error value of a certain dimension exceeds 10, it is forcibly adjusted to 10 to prevent excessively large error values ​​from causing abnormal model parameter updates. Simultaneously, after each batch loss calculation, the reasonableness of the average loss value is checked. If the average loss value is greater than 1, the batch of samples is considered abnormal, and a new batch of samples is drawn for recalculation to ensure that the batch loss value accurately reflects the model training status.

[0158] The calculated batch average mean squared error loss is input into the Adam optimizer. The optimizer calculates the gradient direction and magnitude of the parameters of each layer of the model based on the loss value: For fully connected layers, gradient calculation revolves around the weight and bias parameters. The partial derivative of the loss value with respect to each weight and bias is solved using the chain rule. The larger the absolute value of the partial derivative, the more significant the impact of the parameter on the loss value, and the more significant the adjustment is required. For bidirectional LSTM layers, gradient calculation covers the hidden layer state parameters and input / output gate parameters, focusing on optimizing key parameters that capture sequence dependencies. During gradient calculation, the step size is updated in conjunction with a preset learning rate of 0.0005 to avoid model oscillation due to excessively large step sizes or slow convergence due to excessively small step sizes. At the same time, a weight decay coefficient of 1e-5 is introduced to regularize the weight parameters of fully connected layers and LSTM layers, incorporating the squared value of the weight parameters into the loss calculation to prevent overfitting due to excessively large weights. This ensures that the loss value not only guides the model to improve analytical accuracy but also guarantees the model's generalization ability.

[0159] After each training round, the same mean squared error (MSE) calculation logic is used to process the 1000 samples in the validation set: the validation set samples are input into the model to obtain the parsed sequence, the loss value of each group is calculated and then averaged to obtain the average MSE loss value of the validation set for that round of training. At the same time, the similarity between the parsed sequence of the validation set and the original watermark sequence is calculated. The similarity of the current round of the validation set is compared with the highest historical similarity. If the similarity of the validation set does not improve for 15 consecutive rounds, or if the similarity of the current round of the validation set reaches 99.2%, the model training is considered to have converged, training is stopped and the model parameters of the current round are saved. If the termination condition is not met, the training strategy for the next round is adjusted based on the validation set loss value. For example, when the validation set loss value increases, the learning rate is appropriately reduced (by 0.0001 each time) to ensure that the model converges to the optimal parsing performance.

[0160] Decoding verification and correction are performed. The information initially parsed is verified, including whether the organization identifier encoding segment conforms to the encoding rules of step 21, whether the hardware identifier encoding segment matches the authorized device hardware identifier, and whether the length of the discrete numerical sequence is consistent with the original watermark. If the encoding segment does not conform to the rules or the sequence length is abnormal, the correction module is activated. According to the encoding rules in the evidence storage library and the characteristics of the original watermark, the abnormal segment is completed or corrected. For example, if the hardware identifier encoding segment is missing 2 digits, the missing digits are supplemented according to the complete encoding of the authorized device hardware identifier in the evidence storage library to ensure the integrity of the identifier. The complete watermark information is extracted, and the corrected discrete numerical sequence, organization identifier, hardware identifier, and watermark generation time are integrated to form complete watermark information containing multi-source feature association information.

[0161] Step 64, perform reverse transformation processing on the watermark information through the inverse mapping algorithm, map it from the watermark space back to the original feature space, and recover the original feature vector corresponding to the high-dimensional global feature vector. Specifically, it includes: constructing an inverse mapping algorithm system, which takes the inverse matrix of the linear mapping matrix constructed in Step 33 as the core, retrieves the parameters of the linear mapping matrix trained in Step 33 from the secure evidence repository, calculates the inverse matrix of this matrix, and adopts a numerical stability optimization method during the inversion process to avoid failure of inversion due to matrix singularity; at the same time, retrieve the parameters of the attention weight layer in Step 33, including the correlation weight values of each dimension feature, as the basis for feature weight recovery during the inverse mapping process; integrate the inverse mapping matrix and the attention weight parameters to form the core calculation module of the inverse mapping algorithm. Then construct an inverse mapping verification model, which is used to verify the accuracy of the inverse mapping result. The model includes an input layer, a fully connected layer, and a feature comparison layer; the dimension of the input layer is the same as the dimension of the watermark information, the fully connected layer is set with 2 layers, the number of neurons in the first layer is a value consistent with the dimension of the high-dimensional global feature vector, and the second layer is a feature similarity calculation layer, which is used to output the similarity between the inverse mapping result and the original high-dimensional global feature vector; when training this model, use the high-dimensional global feature vector generated in Step 2 as the label, and the corresponding watermark information as the input sample, with 3000 groups of samples; use the cosine loss function to measure the difference between the similarity output by the model and the actual similarity, select the SGD optimizer, set the learning rate to 0.001, the momentum parameter to 0.9, the training batch size to 24, and train for 60 iterations; after training, verify through the test set. If the similarity error output by the model is less than 0.01, it is determined that the verification model is qualified.

[0162] Perform inverse mapping transformation processing. Input the complete watermark information extracted in Step 63 into the core calculation module of the inverse mapping algorithm. First, perform reverse linear transformation on the discrete numerical sequence in the watermark information through the inverse mapping matrix, map the sequence from the watermark space to the preliminary feature space, and obtain the preliminary feature vector; then, according to the retrieved attention weight parameters, perform weight recovery on the values of each dimension of the preliminary feature vector, that is, enhance the values of the high-weight dimensions related to the hardware identifier and the organization identifier, and adjust the values of the low-weight dimensions to make the weight distribution of the feature vector consistent with the high-dimensional global feature vector generated in Step 2; through vector normalization processing, normalize the feature vector after weight recovery to the standard range preset in Step 23 to obtain the preliminarily recovered feature vector.

[0163] Feature vector verification and adjustment are performed. The initially recovered feature vector is input into a qualified inverse mapping verification model, which outputs its similarity to the original high-dimensional global feature vector. If the similarity is greater than 0.98, the recovery is deemed qualified, and the original feature vector corresponding to the high-dimensional global feature vector is obtained. If the similarity is less than 0.98, the adjustment module is activated to analyze the dimension with low similarity. Based on the statistical characteristics of the original high-dimensional global feature vector in the evidence repository, the value of this dimension is fine-tuned, with each fine-tuning increment not exceeding 0.02, until the similarity reaches 0.98 or higher. The information integrity of the recovered original feature vector is verified, checking whether the vector contains feature fragments corresponding to the architecture fingerprint, fine-tuning key values, the distributor's digital certificate, the requester's organization identifier, and the target device's hardware identifier. This ensures that all multi-source feature fragments are complete and without missing parts, providing accurate feature basis for subsequent matching with secure evidence repository records, traceability, and access control.

[0164] In this embodiment of the invention, the recovery method combining the inverse mapping matrix and the verification model solves the problem that traditional techniques cannot accurately recover the original feature vector, resulting in the failure to match the evidence record. The inverse mapping algorithm ensures that the vector accurately reverts from the watermark space to the original feature space, and the verification adjustment mechanism ensures that the recovered vector is highly consistent with the original vector.

[0165] In a preferred embodiment of the present invention, step 7 involves performing similarity matching and legality verification between the recovered feature vector and the records in the secure evidence storage library. Based on the verification results, the model source authentication, usage permission control, and accurate tracing of infringing behavior are achieved, including:

[0166] Step 71: Receive the recovered original feature vector as the feature vector to be verified, and retrieve the evidence record corresponding to the verification request from the secure evidence repository. Extract the original feature vector and related distribution context information for verification. Specifically, this includes: receiving the feature vector to be verified; the authorized device sends the original feature vector recovered in step 64 and the verification request information to the verification server through an encrypted communication interface. The verification request information includes the authorized device hardware identifier, the requesting organization identifier, the model usage timestamp, and the verification request number. The communication interface uses the TLS 1.3 encryption protocol to ensure data transmission security. After receiving the data, the server calculates the hash value of the vector and the request information and compares it with the hash value sent by the authorized device. If they match, it confirms that the data has not been tampered with; if they do not match, it rejects the data and requests a retransmission. Next, a secure evidence storage database retrieval index is constructed. Based on the core fields recorded in the evidence storage database, including the requesting organization identifier, the target device hardware identifier, the watermark generation timestamp, and the architecture fingerprint code, a multi-dimensional retrieval index is built. The index adopts a B+ tree structure, where the requesting organization identifier and the target device hardware identifier are used as the first-level index keys because they are directly associated with the source entity. The watermark generation timestamp and the architecture fingerprint code are used as the second-level index keys. During the index construction process, the index nodes are updated regularly to ensure that the retrieval response time is less than 100 milliseconds.

[0167] The requester's organization identifier and authorized device hardware identifier from the verification request information are input into the retrieval system. The system first locates the matching index partition using the primary index key, and then filters out the evidence records that are in the same distribution period as the current model's usage timestamp, with the distribution period being the model's authorized usage duration recorded in step 53, using the secondary index key. If a unique matching record is found, it is directly extracted. If multiple matching records are found, the system further compares the architecture fingerprint fragment extracted from the feature vector to be verified in the verification request with the architecture fingerprint code in the evidence records to filter out the unique record that matches perfectly. If no matching record is found, a preliminary anomaly marker is triggered, the current request information is recorded, and the feature vector to be verified is temporarily stored. Subsequently, the verification benchmark is extracted. From the matched evidence records, the original high-dimensional global feature vector generated in step 2, the distribution context information including the distribution timestamp, authorized usage duration, authorized device list, and distributor digital certificate number, and the watermark generation parameters of the random key identifier quantization level rule in step 3 are extracted. This information is stored in association according to the verification benchmark and request number format to ensure that each verification request corresponds to a unique verification benchmark. At the same time, the extracted original high-dimensional global feature vector is converted into the same dimension and numerical format as the feature vector to be verified to avoid the impact of format differences on subsequent similarity calculations.

[0168] Perform a verification benchmark check. Call the organization identifier encoding rules and hardware identifier encoding rules in step 21 to check whether the encoding format of the requesting organization identifier and the target device hardware identifier in the evidence storage record is valid. At the same time, check the logical consistency between the distribution timestamp and the authorized usage duration, that is, whether the current model usage timestamp is within the range of the distribution timestamp + authorized usage duration. If the check passes, the verification benchmark is confirmed to be valid. If the check fails, the evidence storage record is retrieved again or the manual review process is started.

[0169] Step 72 involves calculating the similarity between the feature vector to be verified and the original feature vector extracted from the evidence record, obtaining a similarity value. This includes: determining the similarity calculation algorithm, selecting the cosine similarity algorithm as the core calculation method. This algorithm effectively measures the directional consistency of high-dimensional vectors and is suitable for the similarity evaluation of multi-source feature vectors. Simultaneously, a weighted Euclidean distance algorithm is combined as an auxiliary verification method; the results of the two algorithms complement each other to improve calculation accuracy. A feature weight allocation model is constructed. This model is used to assign weights to different dimensions of the feature vector to be verified and the original feature vector. Since different dimensions correspond to different importance of multi-source features, the model includes an input layer, a convolutional layer, and a fully connected layer. The input layer dimension is consistent with the feature vector dimension. One convolutional layer with 3×3 kernels and 64 kernels is used to extract local dimensional correlation features of the vector. Two fully connected layers are set; the first layer has 256 neurons, and the second layer represents the feature vector dimension, outputting the weight coefficients for each dimension.

[0170] When training the model, the weight coefficients evaluated by experts in step 21 are used as labels, and multi-source feature vectors containing dimensions such as architecture fingerprint, hardware identifier, and organization identifier are used as input. The number of samples is 4000. The mean squared error loss function is used to measure the difference between the model output weights and the labels. The Adam optimizer is selected with a learning rate of 0.001, a weight decay coefficient of 1e-4, a training batch size of 20, and 60 training iterations. Training is stopped when the error on the validation set decreases by less than 0.001 in each iteration, and the optimal parameters are saved. After training, if the average error between the model output weights and the expert-evaluated weights is less than 0.02, the model is considered qualified. Then, weighted similarity calculation is performed. The values ​​of each dimension of the feature vector to be verified and the original feature vector are multiplied by the corresponding weight coefficients output by the qualified model to obtain the weighted vector to be verified and the weighted original vector. The cosine similarity algorithm is used to calculate the cosine value of the two weighted vectors, which ranges from -1 to 1. Through numerical mapping, it is converted into a similarity score of 0 to 100. The conversion rule is similarity score = cosine value + 1 × 50. At the same time, the weighted Euclidean distance algorithm is used to calculate the distance between the two weighted vectors. The second similarity score is obtained by using the distance-similarity conversion formula: similarity score = 100 - distance value / maximum distance value × 100. The average of the two is taken as the final similarity value. Finally, the similarity calculation results are verified. 100 sets of feature vectors with known matching relationships are selected and 50 sets of complete matches and 50 sets of partial matches are input into the calculation process. If the final similarity values ​​of the complete matching vector pairs are all greater than 95 and the values ​​of the partial matching vector pairs are all between 40 and 60, the calculation process is confirmed to be accurate. If there is a deviation, the weight allocation model parameters or the algorithm parameters are readjusted until the calculation results meet expectations.

[0171] Step 73: Based on the similarity value, compare and judge with the preset matching threshold, and verify the legality of the distribution context information. Specifically, this includes: determining the preset matching threshold, constructing a threshold determination experimental system, selecting 1000 sets of model feature vector pairs from different application scenarios, including medical, financial, and industrial scenarios. Each set of vector pairs includes three types: completely matching the same model generated by the same authorized device, partially matching the same model generated by different authorized devices, and not matching different models or illegally copied models generated. For each set of vector pairs, perform similarity calculation, statistically analyze the distribution of similarity values ​​for completely matching vector pairs, take the minimum value as the lower limit of the threshold, and take the maximum value as the lower limit of the threshold. The upper limit of the value is determined by considering the accuracy requirements of infringement tracing in the background technology. The general matching threshold is set at 85, that is, a similarity of ≥85 is considered a match. For fields with extremely high security requirements, such as medical scenarios, the threshold is raised to 90 by adding 500 sets of medical model vector pairs in the experiment. Because the consequences of medical model leakage are more serious, a higher matching standard is required. After the threshold is determined, it is stored in the threshold configuration library of the verification server, which supports dynamic calling according to the model application scenario. The legality verification of the distribution context information is carried out. The first verification item is the legality of the authorized device. The list of authorized devices in the evidence record is compared with the hardware identifier of the authorized device in the verification request. If the identifiers are completely consistent, it passes; if they are inconsistent, the device is marked as illegal.

[0172] The second verification item is the legality of the usage period. The difference between the current model usage timestamp and the distribution timestamp in the evidence storage record is calculated. If the difference is less than the authorized usage period, it passes; otherwise, it is marked as expired. The third verification item is the legality of the distributor's qualifications. The distributor's digital certificate number is extracted from the evidence storage record, and the certificate status is queried by calling the National Digital Certificate Authentication Center interface. If the certificate is valid and has not been revoked, it passes; otherwise, it is marked as an illegitimate distributor. The fourth verification item is the consistency of the model architecture. An architecture fingerprint fragment is extracted from the feature vector to be verified and compared with the architecture fingerprint code in the evidence storage record. If the matching degree is ≥98%, it passes; otherwise, it is marked as architecture tampering. Verification results are recorded using a verification result log system, recording the results of each verification item in the format of request number, verification item, result, and anomaly marker. If all items pass, the log status is "Pending Comprehensive Judgment - Legal and Pending Confirmation." If there are anomaly markers, the status is "Pending Comprehensive Judgment - Abnormal and Pending Confirmation." The log uses an immutable blockchain storage method to ensure that the subsequent traceability verification process is traceable.

[0173] Step 74: Make a comprehensive judgment based on the similarity comparison results and the legality verification results. When the similarity value reaches or exceeds the preset threshold and all legality verification items pass, the model source is determined to be legal and the corresponding model usage rights are granted. When the similarity value is lower than the preset threshold or any legality verification item fails, an infringement is determined, and a source tracing procedure is initiated based on the distribution context information in the evidence record to locate the source of infringement. Specifically, this includes: making a comprehensive judgment, retrieving the similarity value from step 72 and the legality verification results from step 73 from the verification result log system. If the similarity value reaches or exceeds the preset matching threshold for the corresponding scenario and all legality verification items pass without any abnormal markers, the model source is determined to be legal. If the similarity value is lower than the preset matching threshold, or any legality verification item fails, including illegal device expiration, illegal distribution architecture, or tampering with any marker, an infringement is determined.

[0174] For models with legitimate sources, the verification server generates an authorization instruction. This instruction includes the model's usable functional scope (e.g., image diagnosis and report generation for medical models), the authorization duration extension period (automatically extended by 30 days if less than 30 days remain), and the authorization effective timestamp. This instruction is sent to the authorized device via an encrypted interface. Upon receiving the instruction, the authorized device writes the authorization information to its local authorization management module. This module uses an access control list mechanism, allowing only authorized functions to be called within the authorization duration. Simultaneously, it uploads the authorization record to a secure evidence repository, updating the authorization usage log in the evidence repository. Then, the infringement tracing process is initiated. For infringement cases, complete distribution context information is extracted from the evidence repository, including the distribution chain, the hierarchical relationship between the distributor, first-level requester, and second-level requester, the distribution timestamps at each stage, the list of authorized devices at each stage, and the organization identifiers at each stage. A tracing analysis model is constructed. This model is a graph neural network structure where nodes represent the main body of the distribution stage, and edges represent the distribution relationship. The input layer is the distribution context information, the hidden layer uses a GAT attention layer to highlight abnormal distribution nodes through attention weights, and the output layer is the probability value of the infringement source.

[0175] When training the model, 300 sets of data from the distribution chain and infringement source in historical infringement cases are used as the sample size. The cross-entropy loss function is used to optimize the model parameters, and the training is iterated for 50 rounds. If the model's prediction accuracy for the infringement source is ≥95%, it is considered qualified. The distribution context information of the current infringement case is input into the qualified model, and the model outputs the infringement probability value of each distribution link. The link with the highest probability value is the initially located infringement source, such as the device identified as XXX in the secondary request. The infringement evidence is fixed and handled, and an infringement tracing report is generated. The report includes the hardware identifier of the infringing device, the name of the infringing organization, the type of infringement behavior (e.g., unauthorized use of devices, use of expired architecture, tampering and propagation), the tracing chain graph, similarity calculation results, and legality verification anomaly markers. The report is sent to the distributor and relevant regulatory agencies through an encrypted interface, and is also stored in the infringement case database of the secure evidence storage library. Based on the infringing entity information in the report, regulatory agencies can initiate measures such as device blocking, remotely disabling the model use function of the infringing device, freezing the agency's permission, and suspending the model request permission of the infringing agency, so as to achieve precise control of infringement behavior.

[0176] In this embodiment of the invention, by determining the scenario-based threshold and verifying the legality of multiple items, the problems of the traditional one-size-fits-all threshold and single verification dimension are solved. The scenario-based threshold adapts to different security requirements, and the multi-item verification covers all dimensions such as equipment, timeliness, qualifications, and architecture, ensuring that the legality judgment is comprehensive and without omission, and avoiding the omission of infringement due to incomplete verification.

[0177] like Figure 2 As shown, embodiments of the present invention also provide a watermark-based model secure distribution and authentication system, comprising:

[0178] The data acquisition module is used to obtain the architectural fingerprint of the target basic model, key values ​​of the fine-tuning process, the digital certificate of the distributor, the identifier of the requesting organization and the hardware identifier of the target device, and generate multi-source feature information.

[0179] The fusion module is used to fuse multi-source feature information and process it through a weighted fusion algorithm to generate a high-dimensional global feature vector.

[0180] The processing module is used to input the global feature vector and the random key into the multi-level neural network watermark generator, and generate a dynamic digital watermark after processing.

[0181] The computation module is used to utilize dynamic digital watermarks and embed them into the output layer feature map of the target base model through a gradient-preserving watermark embedding algorithm to generate a watermarked derived model.

[0182] The evaluation module is used to evaluate and test the quality of the derived model to obtain a qualified watermarked model. The qualified watermarked model is distributed to the authorized device of the requesting party through an encrypted channel, and the watermark generation parameters, distribution context information and timestamp are written into the secure evidence storage library as evidence storage data.

[0183] The parsing module is used to run the distributed watermarked model on authorized devices and obtain the watermark carrying signal from the model's output data during the model's operation; it parses the watermark carrying signal, extracts the watermark information, and recovers the original feature vector through an inverse mapping algorithm;

[0184] The matching module is used to perform similarity matching and legality verification between the recovered feature vectors and the records in the secure evidence storage library. Based on the verification results, it enables model source authentication, access control, and accurate tracing of infringement.

[0185] It should be noted that this system is a system corresponding to the above method. All implementation methods in the above method embodiments are applicable to this embodiment and can achieve the same technical effect.

[0186] Embodiments of the present invention also provide a computing device, including: a processor and a memory storing a computer program, wherein the computer program, when executed by the processor, performs the method described above. All implementations in the above method embodiments are applicable to this embodiment and can achieve the same technical effects.

[0187] Embodiments of the present invention also provide a computer-readable storage medium storing instructions that, when executed on a computer, cause the computer to perform the method described above. All implementations in the above method embodiments are applicable to this embodiment and can achieve the same technical effects.

[0188] Users of this invention must comply with regulations and refrain from using it for illegal or irregular activities; otherwise, they will bear the consequences themselves. When collecting and using information such as "organizational identifiers" and "device hardware identifiers," authorization must be obtained in compliance with regulations, and privacy and security must be guaranteed. The provider of this invention will not be liable for any legal disputes arising from violations. The technical effect is affected by application scenarios, hardware and software, data quality, etc., and performance fluctuations may occur in extreme scenarios. The provider of this invention does not make any absolute guarantees, and users need to test and adapt it themselves. Matters not mentioned shall be governed by current laws and regulations and industry practices. Users shall be solely responsible for any losses caused by their violations or improper use.

[0189] The above description represents the preferred embodiments of the present invention. It should be noted that those skilled in the art can make various improvements and modifications without departing from the principles of the present invention, and these improvements and modifications should also be considered within the scope of protection of the present invention.

Claims

1. A method for watermark-based model security distribution and authentication, characterized in that, The method comprises: Step 1, obtaining the architecture fingerprint of the target base model, the key value of the fine-tuning process, the digital certificate of the distributor, the agency identification of the requester, and the device hardware identification used in the final deployment of the model, and generating multi-source feature information; Step 2, fuse the multi-source feature information, process it through a weighted fusion algorithm, and generate a high-dimensional global feature vector; Step 3, input the global feature vector and the random key into the multi-level neural network watermark generator, and generate a dynamic digital watermark after processing; Step 4, using the dynamic digital watermark, embedding it into the output layer feature mapping of the target base model through a watermark embedding algorithm based on gradient preservation, generating a watermark-containing derivative model, including: obtaining the dynamic digital watermark, and adaptively adjusting the watermark signal according to the dimension of the target base model output layer feature mapping, to generate the watermark pattern to be embedded; analyze the statistical characteristics and gradient distribution of the target base model output layer feature mapping to determine the best position and strength of watermark pattern embedding; the watermark pattern to be embedded is weighted fused with the target feature mapping at the corresponding position according to the determined best position and strength; by introducing a gradient constraint term through a coefficient, the change of the gradient distribution of the original feature mapping caused by the watermark embedding operation is limited, so that the feature mapping after embedding the watermark keeps the original forward propagation characteristics of the model, and the gradient back propagation behavior is consistent with the original model; perform integrity check on the feature mapping after completing the watermark embedding, and finally generate a derivative model containing a dynamic digital watermark; Step 5, quality evaluation and testing of the derivative model, obtaining a verified watermark-containing model; distribute the verified watermark-containing model to the requester's authorized equipment through an encrypted channel, and write the watermark generation parameters, distribution context information and timestamp as evidence data into the secure evidence library; Step 6, running the distributed watermark-containing model on the authorized equipment, and obtaining the watermark-bearing signal from the output data of the model during the model running process; analyze the watermark-bearing signal, extract the watermark information, and recover the original feature vector through the inverse mapping algorithm; Step 7, similarity matching and legality verification of the recovered feature vector with the records in the secure evidence library, and realizing model source authentication, use permission control and precise tracing of infringement behavior according to the verification result.

2. The method of claim 1, wherein, Fuse the multi-source feature information, process it through a weighted fusion algorithm, and generate a high-dimensional global feature vector, including: Convert the architecture fingerprint into a structure encoding vector reflecting the network hierarchy and connection relationship, convert the fine-tuning process key value into a process parameter vector recording the hyperparameters and training state, and parse and convert the digital certificate of the distributor, the agency identification of the requester, and the target device hardware identification into fixed-length digital identification vectors respectively; according to each type of feature vector, assign a corresponding weight coefficient to each type of feature vector; Fuse the weighted feature vectors of each type by combining weighted splicing and weighted pooling to generate a high-dimensional fusion feature vector; The high-dimensional fusion feature vector is normalized to make its module length uniform to a preset standard range, and the normalized vector is dimensionally reduced and de-redundant to obtain a high-dimensional global feature vector.

3. The method of claim 2, wherein the model is a 3D model. The global feature vector and the random key are jointly input into a multi-level neural network watermark generator to generate a dynamic digital watermark after processing, including: The high-dimensional global feature vector and the pre-generated random key are spliced to form a joint input vector of the watermark generator; The joint input vector is input into a multi-level neural network watermark generator composed of a fully connected layer, a nonlinear activation layer and a normalization layer connected in sequence; the joint input vector is linearly transformed by the fully connected layer, introduces nonlinear features through the nonlinear activation layer, and finally adjusts the feature distribution through the normalization layer to obtain a deep feature representation; The deep feature representation is transformed to map it to a preset watermark space, and the continuous vector values in the space are converted into discrete signal sequences through quantization to generate a dynamic digital watermark uniquely bound to the high-dimensional global feature vector and the random key.

4. The method of claim 3, wherein the model is a 3D model. The step 5 includes: The derived model is forward-inferred using a preset test data set to calculate the accuracy drop value of the output result relative to the original target base model, and the drop value is confirmed to be lower than the preset performance threshold; the watermark extraction test is performed on the derived model to verify that the watermark extraction success rate is higher than the preset survival rate threshold, and an evaluation result is obtained; Based on the evaluation result, the derived model that meets the performance requirement and the watermark survival rate requirement is given a verification qualified identification to generate a watermark-containing model that passes the verification; The watermark-containing model with the verification qualified identification is distributed to the requestor authorized equipment through a secure transmission protocol, and the generation distribution context information is recorded during the distribution process; Based on the distribution context information, the watermark generation parameters used in the generation of the dynamic digital watermark and the distribution timestamp are combined to generate a complete evidence record, and the evidence record is submitted to the secure evidence library as the write content.

5. The method of claim 4, wherein the model is a 3D model. The distributed watermark-containing model is run on the authorized equipment, and the watermark-bearing signal is obtained from the output data of the model during the model running process; the watermark-bearing signal is analyzed to extract the watermark information, and the original feature vector is recovered through the inverse mapping algorithm, including: The watermark-containing model is run on the authorized equipment, and the output data generated during the model running process is collected in real time; The output data is subjected to signal detection and separation processing to identify and extract the watermark-bearing signal embedded in the output data; The watermark-bearing signal is analyzed and decoded to extract the watermark information contained therein; The watermark information is inversely transformed through the inverse mapping algorithm to map it from the watermark space back to the original feature space to recover the original feature vector corresponding to the high-dimensional global feature vector.

6. The method of claim 5, wherein the model is a 3D model. The step 7 includes: The recovered original feature vector is received as a to-be-verified feature vector, and the evidence record corresponding to the verification request is retrieved from the secure evidence library to extract the original feature vector and the related distribution context information as a verification benchmark; The similarity between the to-be-verified feature vector and the original feature vector extracted from the evidence record is calculated to obtain a similarity value; The similarity value is compared with a preset matching threshold to determine whether the distribution context information is legal. The similarity comparison result and the legality verification result are comprehensively determined. When the similarity value reaches or exceeds the preset threshold and all legality verification items pass, it is determined that the model source is legal and the corresponding model use permission is granted. When the similarity value is lower than the preset threshold or any legality verification item fails, it is determined that there is an infringement, and a traceability program is started according to the distribution context information in the evidence record to locate the infringement source.

7. A watermark-based model security distribution and authentication system, the system implementing the method of any one of claims 1 to 6, characterized in that, The method comprises the following steps: The acquisition module is used to acquire the architecture fingerprint of the target base model, the key value of the fine-tuning process, the digital certificate of the distributor, the agency identifier of the requester, and the hardware identifier of the target device, and generate multi-source feature information; The fusion module is used to fuse the multi-source feature information and process it through a weighted fusion algorithm to generate a high-dimensional global feature vector; The processing module is used to input the global feature vector and the random key into a multi-level neural network watermark generator to generate a dynamic digital watermark after processing; The calculation module is used to embed the dynamic digital watermark into the output layer feature mapping of the target base model through a watermark embedding algorithm based on gradient preservation to generate a watermark-containing derivative model; The evaluation module is used to evaluate and test the derivative model to obtain a verified watermark-containing model; the verified watermark-containing model is distributed to the requester's authorized device through an encrypted channel, and the watermark generation parameters, distribution context information, and timestamp are written into a secure evidence library as evidence data; The analysis module is used to run the distributed watermark-containing model on the authorized device and obtain a watermark-bearing signal from the output data of the model during the model running process; the watermark-bearing signal is analyzed to extract the watermark information, and the original feature vector is recovered through an inverse mapping algorithm; The matching module is used to compare the recovered feature vector with the records in the secure evidence library for similarity matching and legality verification, and realize model source authentication, use permission control, and accurate traceability of infringement behavior according to the verification result.

8. A computing device, comprising: One or more processors; A storage device is used to store one or more programs, when the one or more programs are executed by the one or more processors, so that the one or more processors implement the method of any one of claims 1 to 6. The computer readable storage medium stores a program which is executed by the processor to implement the method of any one of claims 1 to 6.

9. A computer-readable storage medium, characterized in that, ​

Images