Data processing method and device

Abstract

The invention discloses a data processing method and device, and the method comprises the steps: determining a target processing layer meeting a screening condition in a plurality of processing layers contained in a target model; the screening condition is related to an influence degree value of a model parameter of the target processing layer on an output result; obtaining an orthogonal projection matrix corresponding to the target processing layer; the orthogonal projection matrix can project input data to a null space; and adding watermark data to the model parameters of the target processing layer through the null space according to the orthogonal projection matrix.

Description

Technical Field

[0001] This application relates to the field of data processing technology, and in particular to a data processing method and apparatus. Background Technology

[0002] To protect the intellectual property rights of the model parameters of intelligent models, watermark data is usually added to the model parameters.

[0003] However, adding watermark data directly to the model parameters will affect the inference results of the intelligent model. Summary of the Invention

[0004] In view of the above, this application provides a data processing method and apparatus, as follows:

[0005] A data processing method, comprising:

[0006] Among the multiple processing layers contained in the target model, the target processing layer that meets the screening criteria is determined; the screening criteria are related to the degree of influence of the model parameters of the target processing layer on the output result.

[0007] Obtain the orthogonal projection matrix corresponding to the target processing layer; the orthogonal projection matrix can project the input data onto the null space;

[0008] Based on the orthogonal projection matrix, the watermark data is added to the model parameters of the target processing layer through the null space.

[0009] The above method, preferably, involves adding watermark data to the model parameters of the target processing layer through the null space projected by the orthogonal projection matrix, including:

[0010] Using the orthogonal projection matrix, the watermark data is projected onto the null space to obtain the first perturbation vector;

[0011] Using the orthogonal projection matrix, the model parameters of the target processing layer are projected onto the null space to obtain the first parameter;

[0012] Add the first perturbation vector to the first parameter to obtain the second parameter;

[0013] The second parameter is recovered from the null space using the orthogonal projection matrix to obtain the third parameter; the target processing layer uses the third parameter to process the input data.

[0014] The above method, preferably, uses the orthogonal projection matrix to recover the second parameter from the null space to obtain the third parameter, including:

[0015] The second parameter is multiplied by the transpose of the orthogonal projection matrix to obtain the third parameter.

[0016] The above method, preferably, involves adding the first perturbation vector to the first parameter to obtain the second parameter, including:

[0017] Based on the preset disturbance intensity parameters, the first disturbance vector is processed to obtain the intermediate vector;

[0018] The intermediate vector is added to the first parameter to obtain the second parameter.

[0019] The above method, preferably, uses the orthogonal projection matrix to project the watermark data onto the null space to obtain the first perturbation vector, including:

[0020] The orthogonal projection matrix is ​​multiplied by the watermark vector corresponding to the watermark data to obtain the first perturbation vector.

[0021] The above method, preferably, involves obtaining the orthogonal projection matrix corresponding to the target processing layer, including:

[0022] The first data is input into the target model to obtain the second data output by the target processing layer;

[0023] Based on the second data, a matrix is ​​constructed to obtain the orthogonal projection matrix corresponding to the target processing layer.

[0024] In the above method, preferably, the screening conditions include one of the following:

[0025] The influence of the model parameters of the target processing layer on the output of the target model is less than or equal to the target threshold.

[0026] Based on the influence values ​​arranged in ascending order, the target processing layer is ranked among the first N processing layers, where N is a positive integer greater than or equal to 1.

[0027] A data processing method, comprising:

[0028] Obtain the current model parameters and the original model parameters of the target processing layer in the target model; the target processing layer is the processing layer in which watermark data is added to its model parameters through null space.

[0029] Based on the orthogonal projection matrix corresponding to the target processing layer, the current model parameters and the original model parameters are processed to obtain the second perturbation vector;

[0030] Based on the second perturbation vector, determine whether the target model contains the watermark data.

[0031] A data processing apparatus, comprising:

[0032] The target determination unit is used to determine the target processing layer that meets the screening criteria among the multiple processing layers contained in the target model; the screening criteria are related to the degree of influence of the model parameters of the target processing layer on the output result.

[0033] A matrix acquisition unit is used to obtain the orthogonal projection matrix corresponding to the target processing layer; the orthogonal projection matrix can project the input data onto the null space.

[0034] The watermarking unit is used to add watermark data to the model parameters of the target processing layer through the null space according to the orthogonal projection matrix.

[0035] A data processing apparatus, comprising:

[0036] The parameter acquisition unit is used to obtain the current model parameters of the target processing layer in the target model and the original model parameters of the target processing layer; the target processing layer is a processing layer in which watermark data is added to its model parameters through null space.

[0037] The perturbation acquisition unit is used to process the current model parameters and the original model parameters based on the orthogonal projection matrix corresponding to the target processing layer to obtain a second perturbation vector;

[0038] The watermark determination unit is used to determine whether the target model contains the watermark data based on the second perturbation vector.

[0039] As can be seen from the above technical solution, in the data processing method and apparatus disclosed in this application, one or more target processing layers are first selected according to the degree of influence of the model parameters of each processing layer in the target model on the output result. Then, the watermark data is added to the model parameters of the target processing layer through null space using the orthogonal projection matrix of each of these target processing layers. It is evident that the addition of watermark data through null space achieved by the orthogonal projection matrix in this embodiment does not affect the normal output of the target model, thus protecting the model parameters while ensuring the accuracy of the target model's output. Attached Figure Description

[0040] To more clearly illustrate the technical solutions of the embodiments of this application, the drawings used in the description of the embodiments will be briefly introduced below. Obviously, the drawings described below are only some embodiments of this application. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0041] Figure 1 A flowchart illustrating a data processing method provided in an embodiment of this application;

[0042] Figure 2This is a partial flowchart of a data processing method provided in an embodiment of this application;

[0043] Figure 3 This is another part of a flowchart of a data processing method provided in an embodiment of this application;

[0044] Figure 4 A flowchart illustrating another data processing method provided in this application embodiment;

[0045] Figure 5 A flowchart illustrating another data processing method provided in this application embodiment;

[0046] Figure 6 This is a schematic diagram of the structure of a data processing device provided in an embodiment of this application;

[0047] Figure 7 This is a schematic diagram of another data processing device provided in an embodiment of this application. Detailed Implementation

[0048] The technical solutions of the embodiments of this application will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of this application, and not all embodiments. Based on the embodiments of this application, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of this application.

[0049] refer to Figure 1 The diagram shown illustrates a data processing method implemented according to an embodiment of this application. This method is applicable to electronic devices capable of data processing, such as local computers or cloud servers. The technical solution in this embodiment primarily aims to add watermark data to protect model parameters while ensuring the accuracy of the target model's output.

[0050] Specifically, the method in this embodiment may include the following steps:

[0051] Step 101: Among the multiple processing layers contained in the target model, determine the target processing layer that meets the screening criteria.

[0052] The selection criteria are related to the degree of influence of the target processing layer's model parameters on the output results. The target model can be a large language model or other models. The degree of influence value can be the ratio between the proportion of change in the target model's output results due to changes in model parameters and the proportion of change in model parameters themselves. The smaller the degree of influence value, the smaller the influence of the target processing layer's model parameters on the target model's output results.

[0053] It should be noted that there can be one or more target processing layers. The number of target processing layers may vary depending on the target model structure and the sensitivity requirements.

[0054] In one implementation, the selection criteria can be: sort each processing layer in the target model in ascending order of the influence of the model parameters of the processing layer on the output of the target model, with the target processing layer being among the top N processing layers in the target model, where N is a positive integer greater than or equal to 1.

[0055] In another implementation, the filtering condition can be: the influence of the model parameters of the target processing layer on the output of the target model is less than or equal to the target threshold.

[0056] For example, taking a neural network model as the target model, the earlier the processing layer in the neural network model, the less influence its model parameters have on the output of the neural network model. Therefore, in this embodiment, the target processing layer can be the first 5 or the first 10 layers in the neural network model.

[0057] Step 102: Obtain the orthogonal projection matrix corresponding to the target processing layer.

[0058] Among them, the orthogonal projection matrix can project the input data onto the null space.

[0059] Specifically, the orthogonal projection matrix can be represented by P. Using the orthogonal projection matrix, the input data (vector data) can be projected onto the null space. After data processing in the null space, the data can be restored from the null space without data corruption.

[0060] Step 103: Based on the orthogonal projection matrix, add the watermark data to the model parameters of the target processing layer through the null space.

[0061] Specifically, in this embodiment, both the watermark data and the model parameters of the target model can be projected onto the null space using an orthogonal projection matrix. The watermark data is then added to the null space and recovered from there, thus obtaining the model parameters of the target processing layer after the watermark data has been added. Correspondingly, because the watermark data is added to the model parameters in the null space, the processing of the input data is unaffected after the model parameters of the target processing layer are recovered from the null space, and therefore, the output results of the target model are not affected.

[0062] As can be seen from the above technical solution, in the data processing method provided in this application embodiment, one or more target processing layers are first selected according to the degree of influence of the model parameters of each processing layer in the target model on the output result. Then, the watermark data is added to the model parameters of the target processing layer through null space using the orthogonal projection matrix of each of these target processing layers. It is evident that the addition of watermark data through null space achieved by the orthogonal projection matrix in this embodiment does not affect the normal output of the target model, thus protecting the model parameters while ensuring the accuracy of the target model's output.

[0063] In one implementation, step 103 can be achieved in the following way, such as... Figure 2 As shown:

[0064] Step 201: Use an orthogonal projection matrix to project the watermark data onto the null space to obtain the first perturbation vector.

[0065] The watermark data can be a string consisting of at least one character, and can be represented by m. For example, the watermark data can be the bit sequence 10101011 or the character sequence abcdef. In this embodiment, before projecting the watermark data onto the null space, the watermark data is first processed into a watermark vector, and then an orthogonal projection matrix is ​​used to project the watermark data onto the null space to obtain the first perturbation vector. For example, in this embodiment, the watermark data can be converted into a watermark vector using a hash algorithm, a spread spectrum encoder, or the BCH encoding method, and the watermark vector can be represented by Δ.

[0066] In one implementation, in this embodiment, the orthogonal projection matrix can be multiplied with the watermark vector corresponding to the watermark data to obtain the first perturbation vector.

[0067] For example, in this embodiment, the first disturbance vector Δ′ is obtained through formula (1):

[0068] Δ′=P*Δ (1)

[0069] Where Δ is the watermark vector corresponding to the watermark data; Δ′ is the first perturbation vector formed after the watermark data is projected onto the null space; and P is the orthogonal projection matrix.

[0070] Step 202: Use an orthogonal projection matrix to project the model parameters of the target processing layer onto the null space to obtain the first parameters.

[0071] In one implementation, in this embodiment, the orthogonal projection matrix can be multiplied by the model parameters of the target processing layer to obtain the first parameter.

[0072] The model parameters of the target processing layer are represented in the form of a parameter vector. Referring to formula (1), the orthogonal projection matrix P can be multiplied by the parameter vector of the model parameters to obtain the first parameter, which is represented by a vector.

[0073] Step 203: Add the first perturbation vector to the first parameter to obtain the second parameter.

[0074] In one implementation, the first disturbance vector and the first parameter can be vector-added together to obtain the second parameter.

[0075] In another implementation, in this embodiment, the first disturbance vector can be processed based on a preset disturbance intensity parameter to obtain an intermediate vector. Then, the intermediate vector is vector-added with the first parameter to obtain the second parameter.

[0076] The disturbance intensity parameter can be represented by α, and can be set according to business requirements. For example, in this embodiment, the second parameter Wnew can be obtained through formula (2):

[0077] Wnew = W + α·Δ′ (2)

[0078] Where Wnew is the second parameter, which is the model parameter of the target processing layer through which the watermark data is added via the null space; W is the first parameter, which is the model parameter of the target processing layer projected onto the null space; and Δ′ is the first perturbation vector.

[0079] Step 204: Use the orthogonal projection matrix to recover the second parameter from the null space to obtain the third parameter.

[0080] The third parameter is the model parameter recovered by the target processing layer from the zero space. Based on this, the target processing layer uses the third parameter to process the input data.

[0081] Specifically, in this embodiment, the second parameter can be multiplied by the orthogonal projection matrix to obtain the third parameter.

[0082] In one implementation, the second parameter can be multiplied by the transpose of the orthogonal projection matrix to obtain the third parameter.

[0083] For example, in this embodiment, the third parameter is obtained through formula (3):

[0084] Wnew ′= Wnew *P T (3)

[0085] Where Wnew′ is the third parameter, which is the model parameter of the target processing layer recovered from the null space after the watermarked data is added; P TIt is the transpose of the orthogonal projection matrix P.

[0086] In one implementation, when obtaining the orthogonal projection matrix corresponding to the target processing layer in step 102, it can be achieved in the following way, such as... Figure 3 As shown:

[0087] Step 301: Input the first data into the target model to obtain the second data output by the target processing layer.

[0088] Here, the first data can be represented by X0. After the first data is input into the target model, each processing layer in the target model processes the data output by the previous processing layer. Based on this, the second data output by the target processing layer is extracted. The second data is a high-dimensional feature representation. The second data can span a space, denoted by K0.

[0089] Step 302: Construct a matrix based on the second data to obtain the orthogonal projection matrix corresponding to the target processing layer.

[0090] Specifically, in this embodiment, the orthogonal projection matrix can be constructed using formula (4):

[0091] P=IX*(X) T *X) -1 *X T (4)

[0092] Where X is the second data; P is the orthogonal projection matrix.

[0093] refer to Figure 4 This is a flowchart illustrating the implementation of a data processing method provided in this application embodiment. This method can be applied to electronic devices capable of data processing, such as local computers or cloud servers. The technical solution in this embodiment is mainly used to detect watermark data.

[0094] Specifically, the method in this embodiment may include the following steps:

[0095] Step 401: Obtain the current model parameters and the original model parameters of the target processing layer in the target model.

[0096] The target processing layer is where the model parameters are watermarked using null space. For details on how the model parameters of the target processing layer are watermarked using null space, please refer to the examples described above.

[0097] It should be noted that the electronic device in this embodiment is a device with legal authorization from the owner of the target model. The electronic device is able to obtain the original model parameters of the target processing layer that is legally authorized by the owner of the target model, as well as the current model parameters of the target processing layer with added watermark data.

[0098] The current model parameters can be represented by Wnew′, and the original model parameters can be represented by W′.

[0099] Step 402: Based on the orthogonal projection matrix corresponding to the target processing layer, process the current model parameters and the original model parameters to obtain the second perturbation vector.

[0100] Specifically, in this embodiment, an orthogonal projection matrix can first be used to project the current model parameters onto the null space to obtain the fourth parameter, which can be represented by Wnew; then, an orthogonal projection matrix can be used to project the original model parameters onto the null space to obtain the fifth parameter, which can be represented by W; then, based on the parameter difference between the fourth and fifth parameters, an intermediate perturbation vector can be obtained, which can be represented by Δ′; finally, an orthogonal projection matrix can be used to recover the intermediate perturbation vector from the null space to obtain the second perturbation vector.

[0101] For example, in this embodiment, the intermediate perturbation vector is obtained through formula (5):

[0102] Δ′=(Wnew -W) / α (5)

[0103] Where α is the disturbance intensity parameter.

[0104] For example, in this embodiment, the second disturbance vector can be obtained through formula (6):

[0105] M=Δ′*P T (6)

[0106] Where M is the second perturbation vector; P T It is the transpose of the orthogonal projection matrix P.

[0107] Step 403: Determine whether the target model contains watermarked data based on the second perturbation vector.

[0108] Specifically, in this embodiment, the second perturbation vector can first be vector decoded to obtain decoded data; then, the decoded data and the watermark data are compared to obtain a first comparison result, which indicates whether the target model contains watermark data.

[0109] In this embodiment, the process of performing vector decoding on the second perturbation vector to obtain decoded data is equivalent to the inverse process of converting watermark data into watermark vector. Therefore, the obtained decoded data may be equivalent to watermark data. In the case that the first comparison result indicates that the decoded data and the watermark data are consistent, the target model is indicated to contain watermark data. In the case that the first comparison result indicates that the decoded data and the watermark data are inconsistent, the target model is indicated to not contain watermark data.

[0110] As can be seen from the above technical solution, in the data processing method of this application embodiment, the orthogonal projection matrix corresponding to the target processing layer can be used to project the current model parameters and original model parameters of the target processing layer onto the null space, thereby obtaining the perturbation vector and determining whether the target model contains watermark data. It is evident that in this embodiment, the null space achievable through the orthogonal projection matrix enables the acquisition of the perturbation vector in the model parameters of the target processing layer and the detection of whether the target model contains corresponding watermark data, thereby achieving the purpose of watermark detection and protecting the intellectual property rights of the model parameters.

[0111] Furthermore, this embodiment can also detect whether the target model with the added watermarked data has undergone parameter adjustments, such as... Figure 5 The following processing flow is shown:

[0112] Step 501: Input the test data into the target model with the added watermark data to obtain the first output result.

[0113] Step 502: Input the test data into the target model without watermarked data to obtain the second output result.

[0114] Step 503: Compare the first output result with the second output result to obtain the second comparison result.

[0115] The second comparison result indicates whether the target model with watermarked data has had its model parameters adjusted.

[0116] It should be noted that in this embodiment, watermark data is added to the model parameters of the target processing layer in the target model through null space. If there is input data that needs to be processed by the target model, then theoretically the target model with watermark data added will not affect the output result of the input data. That is to say, theoretically the output result of the target model with watermark data added should be consistent with the output result of the target model without watermark data added. Based on this, this embodiment determines whether the target model with watermark data has been adjusted by comparing whether the first output result and the second output result are consistent.

[0117] For example, if the first output result is consistent with the second output result, it can be determined that the target model with watermarked data has not had its model parameters adjusted; if the first output result is inconsistent with the second output result, it can be determined that the target model with watermarked data has had its model parameters adjusted.

[0118] refer to Figure 6This is a schematic diagram of a data processing device provided in an embodiment of this application. The device can be configured on an electronic device capable of data processing, such as a local computer or a cloud server. The technical solution in this embodiment is mainly used to add watermark data to protect model parameters while ensuring the accuracy of the target model's output.

[0119] Specifically, the apparatus in this embodiment may include the following units:

[0120] The target determination unit 601 is used to determine the target processing layer that meets the screening conditions among the multiple processing layers contained in the target model; the screening conditions are related to the degree of influence of the model parameters of the target processing layer on the output result.

[0121] The matrix acquisition unit 602 is used to obtain the orthogonal projection matrix corresponding to the target processing layer; the orthogonal projection matrix can project the input data onto the null space.

[0122] The watermarking unit 603 is used to add watermark data to the model parameters of the target processing layer through the null space according to the orthogonal projection matrix.

[0123] As can be seen from the above technical solution, in the data processing apparatus provided in this application embodiment, one or more target processing layers are first selected according to the degree of influence of the model parameters of each processing layer in the target model on the output result. Then, the watermark data is added to the model parameters of the target processing layer through null space using the orthogonal projection matrix of each of these target processing layers. It is evident that the addition of watermark data through null space achieved by the orthogonal projection matrix in this embodiment does not affect the normal output of the target model, thus protecting the model parameters while ensuring the accuracy of the target model's output.

[0124] In one implementation, the watermarking unit 603 is specifically used to: project watermark data onto the null space using the orthogonal projection matrix to obtain a first perturbation vector; project the model parameters of the target processing layer onto the null space using the orthogonal projection matrix to obtain a first parameter; add the first perturbation vector to the first parameter to obtain a second parameter; recover the second parameter from the null space using the orthogonal projection matrix to obtain a third parameter; and the target processing layer uses the third parameter to process the input data.

[0125] Specifically, when the watermark adding unit 603 uses the orthogonal projection matrix to recover the second parameter from the null space to obtain the third parameter, it is used to: multiply the second parameter by the transpose of the orthogonal projection matrix to obtain the third parameter.

[0126] Specifically, when the watermark adding unit 603 adds the first disturbance vector to the first parameter to obtain the second parameter, it is used to: process the first disturbance vector based on a preset disturbance intensity parameter to obtain an intermediate vector; and add the intermediate vector to the first parameter to obtain the second parameter.

[0127] Specifically, when the watermark adding unit 603 uses the orthogonal projection matrix to project the watermark data onto the null space to obtain the first perturbation vector, it is used to: multiply the orthogonal projection matrix with the watermark vector corresponding to the watermark data to obtain the first perturbation vector.

[0128] In one implementation, the matrix obtaining unit 602 is specifically used to: input first data into the target model to obtain second data output by the target processing layer; and construct a matrix based on the second data to obtain the orthogonal projection matrix corresponding to the target processing layer.

[0129] In one implementation, the filtering criteria include one of the following:

[0130] The influence of the model parameters of the target processing layer on the output of the target model is less than or equal to the target threshold.

[0131] Based on the influence values ​​arranged in ascending order, the target processing layer is ranked among the first N processing layers, where N is a positive integer greater than or equal to 1.

[0132] It should be noted that the specific implementation of each unit in this embodiment can be referred to the corresponding content above, and will not be described in detail here.

[0133] refer to Figure 7 This is a schematic diagram of a data processing device provided in an embodiment of this application. The device can be configured in an electronic device capable of data processing, such as a local computer or a cloud server. The technical solution in this embodiment is mainly used to detect watermark data.

[0134] Specifically, the apparatus in this embodiment may include the following units:

[0135] The parameter acquisition unit 701 is used to obtain the current model parameters of the target processing layer in the target model and the original model parameters of the target processing layer; the target processing layer is a processing layer in which watermark data is added to its model parameters through null space.

[0136] The perturbation acquisition unit 702 is used to process the current model parameters and the original model parameters based on the orthogonal projection matrix corresponding to the target processing layer to obtain a second perturbation vector;

[0137] The watermark determination unit 703 is used to determine whether the target model contains the watermark data based on the second perturbation vector.

[0138] As can be seen from the above technical solution, in the data processing device of this application embodiment, the orthogonal projection matrix corresponding to the target processing layer can be used to project the current model parameters and original model parameters of the target processing layer onto the null space, thereby obtaining the perturbation vector and determining whether the target model contains watermark data. It is evident that in this embodiment, the null space achievable through the orthogonal projection matrix enables the acquisition of the perturbation vector in the model parameters of the target processing layer and the detection of whether the target model contains corresponding watermark data, thereby achieving the purpose of watermark detection and protecting the intellectual property rights of the model parameters.

[0139] In scenarios where the target model is a transformer-type neural network model, this application proposes a weighted watermark embedding method that combines null space projection and structural perturbation design. This method is applicable to multiple sub-modules (i.e., processing layers) in a transformer-type neural network model. The weight parameters of the embedded watermark can be attention layer weights, feedforward neural network layer FFN parameters, normalized layer LayerNorm parameters, etc. The watermark embedding process is as follows:

[0140] Step 1: Select the target processing layer to embed:

[0141] Based on the model architecture and inference sensitivity of the neural network model, select the parameter matrix of one or more sub-modules as the perturbation target (i.e., the model parameters of the target processing layer), such as the Q / K / V weight parameters of the attention layer or the intermediate layer matrix of the FFN.

[0142] Step 2: Construct a set of key vectors K0 (second data) that preserves knowledge:

[0143] Extract key inputs X0 (first data) from the training or validation set and feed them into the neural network model. Record the key representation K0 of the target processing layer's output. Construct its orthogonal projection matrix P based on K0. ⊥K0 , so that: P ⊥K0 *K0=0, ensuring that the watermark perturbation does not affect the existing semantic response of the neural network model.

[0144] Step 1 and Step 2 are mainly used to obtain the orthogonal projection matrix of the target processing layer in the neural network model.

[0145] Step 3: Construct watermark perturbation and project it:

[0146] 1. Define the watermark data m: it can be a bit sequence, such as 10101011;

[0147] 2. Use a watermark encoder (such as hash, spread spectrum coding, BCH, etc.) to generate a watermark vector Δ;

[0148] 3. Project the watermark vector onto the null space to form the first perturbation vector: Δ′=P ⊥K0 *Δ; Perturbs the model weights in null space (the first perturbation vector embedded with the watermark) to ensure that the perturbation does not affect the output of the neural network model, that is, it does not destroy the existing knowledge response.

[0149] Step 4: Modify model weights:

[0150] Add the perturbation vector to the model weights as shown in formula (2) to obtain the model weights Wnew in the null space. Then restore the model weights from the null space. The target processing layer of the neural network model uses the restored model weights for data inference.

[0151] The watermark detection process is as follows:

[0152] 1. Obtain the model parameters Wnew after the watermarked model parameters of the target processing layer of the neural network model are projected onto the null space;

[0153] 2. Calculate the intermediate perturbation vector, as shown in formula (5);

[0154] 3. Remove the null space component, as shown in formula (6), to obtain the second perturbation vector;

[0155] 4. Use a watermark decoder to decode the bit sequence corresponding to the second perturbation vector;

[0156] 5. Compare whether it matches the preset watermark m. If it matches, it means that the target processing layer of the neural network model has been embedded with watermark m. If it does not match, it means that the target processing layer of the neural network model has not been embedded with watermark m.

[0157] In other embodiments, the second perturbation vector can be compared with the hash of the watermark m to determine whether the neural network model is embedded with the watermark.

[0158] In scenarios where the target model is a Mixture of Experts (MoE) model, this application designs a structured watermark embedding mechanism based on null spatial projection for sparse gated expert models. This method can encode information as an imperceptible perturbation and implant it into the expert module without affecting the performance of the normal model, thereby achieving attribution authentication at the model structure level.

[0159] The structure of the MoE model is as follows:

[0160] The input is processed by a gated network (Router) that selects a subset of "expert" sub-networks to participate in the computation; each expert module (an MLP or Transformer sub-layer) has its own independent parameters. This means that in this embodiment, the watermark can be embedded only in the weights of certain expert modules and triggered through a routing mechanism.

[0161] First, the watermarking process for the MoE model is as follows:

[0162] Step 1: Preparation phase, constructing the key-value matrix K0 (second data) to retain knowledge:

[0163] For each target expert module Ei, the input set X = {x} that can activate the expert is acquired through gated path acquisition. j}, and record its Key vector representation K0 = Key(x) in the intermediate layer (target processing layer). j This set constitutes the "knowledge retention space" of the expert module, i.e., its original functional input response characteristics. Based on K0, construct the orthogonal projection matrix P of the null space of its spanned subspace. ⊥K0 This limits the watermark perturbation to injection only in that direction, thus ensuring that the original behavior remains unchanged.

[0164] Step 1 is mainly used to obtain the orthogonal projection matrix of the target processing layer in the MoE model.

[0165] Step 2: Watermark Embedding Steps:

[0166] The watermark m is converted into a high-dimensional vector Δ through spread spectrum coding or error correction coding and then null-space projection is performed to obtain the first perturbation vector Δ′=P. ⊥K0 *Δ, and then add the first perturbation vector Δ′ to the weight of the expert module, as shown in formula (2). In this embodiment, the sparsity and structure of the perturbation can be limited by regularization terms (such as only affecting some token channels or gating paths).

[0167] It should be noted that even if the watermark perturbation injected in this embodiment is in the "zero space" direction of a certain target processing layer in the MoE model (which theoretically does not affect the direct output of that layer), since the model is composed of multiple nonlinear layers stacked together, even if the output of a certain layer remains unchanged, the perturbation may still be "amplified" or "manifested" in subsequent layers, ultimately leaving identifiable traces in the overall output of the MoE model, thereby achieving the purpose of watermark transmission and detection.

[0168] The watermark detection mechanism is as follows:

[0169] For black-box watermarking, in this embodiment, a specific trigger sample x can be input to observe whether the final output of the MoE model undergoes a regular shift, and then compared with the output of the original MoE model without embedded watermark.

[0170] 1. Prepare trigger samples:

[0171] Construct a set of input samples x (i.e. test data) that can "activate the target expert";

[0172] 2. Input the input sample x into two models: the original MoE model and the MoE model with the watermark added.

[0173] 3. Analyze the differences in output:

[0174] Check if there is a significant shift in the outputs of the two models. The conditions for a significant output shift differ depending on the inference task of the MoE models. For example, the output shift conditions are as follows for different tasks:

[0175] Classification task: Output whether the category changes from A to B (preset watermark category);

[0176] Generate task: Does the output contain certain keywords, tokens, or hash signatures?

[0177] Regression task: Whether the results are systematically shifted in a certain direction.

[0178] If the output of the watermarking model stably produces a preset "signal" under these specific samples, then a watermark is considered to exist.

[0179] For white-box watermarking, mathematical methods can be used to analyze whether certain expert weights in the watermarking model have perturbations (i.e., embedding traces) that conform to the null space direction:

[0180] 1. Extract the parameter matrix W* of the target expert submodule (target processing layer) (projected onto the null space);

[0181] 2. Obtain the activation sample set Xe corresponding to the expert, input it into the MoE model, and construct its Key representation K0 based on the output of the target expert submodule;

[0182] 3. Calculate the disturbance component: Δ = W* - W0, where W0 is the watermark-free model parameter (projected onto the null space);

[0183] 4. Projection Verification: Verify K0 T Δ≈0, but Δ≠0, which verifies the orthogonal projection matrix constructed by K0.

[0184] 5. Compare watermark signature: If an encoder (such as hash or BCH encoding) is used to encode the perturbation vector, decode the perturbation and verify whether it matches the preset watermark m.

[0185] In summary, this application proposes a model watermark embedding scheme based on the null space projection mechanism. The core idea is to project the watermark perturbation into the null space of the model input representation without affecting the existing functions and knowledge representation of the model, thereby achieving lossless and stable watermark injection.

[0186] Specifically, this application constructs the key representation matrix of the intermediate layer (target processing layer) of the target model and calculates the corresponding null space orientation. The watermark information is encoded as a specific perturbation vector and applied to the model parameters or expert module after null space projection. This perturbation does not affect the original task output and has both traceability and robustness.

[0187] It is evident that this application possesses the following advantages:

[0188] 1. Functionality is preserved; the model's performance remains virtually unaffected after the watermark is embedded.

[0189] Second, the structure is controllable, supporting local expert watermarking (such as MoE) and sparse embedding scenarios;

[0190] Third, it is highly resistant to attacks, and the watermark is difficult to remove by fine-tuning, pruning or distillation.

[0191] Fourth, the theory is explainable, the perturbation space has a clear geometric meaning, and it supports subsequent watermark extraction and authentication operations.

[0192] Therefore, the technical solution of this application can be widely used in scenarios such as model intellectual property protection, deployment verification, and model tampering detection.

[0193] The various embodiments in this specification are described in a progressive manner, with each embodiment focusing on its differences from other embodiments. Similar or identical parts between embodiments can be referred to interchangeably. For the apparatus disclosed in the embodiments, since they correspond to the methods disclosed in the embodiments, the description is relatively simple; relevant parts can be referred to in the method section.

[0194] Those skilled in the art will further recognize that the units and algorithm steps of the various examples described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, computer software, or a combination of both. To clearly illustrate the interchangeability of hardware and software, the components and steps of the various examples have been generally described in terms of functionality in the foregoing description. Whether these functions are implemented in hardware or software depends on the specific application and design constraints of the technical solution. Those skilled in the art can use different methods to implement the described functions for each specific application, but such implementation should not be considered beyond the scope of this application.

[0195] The steps of the methods or algorithms described in conjunction with the embodiments disclosed herein can be implemented directly by hardware, a software module executed by a processor, or a combination of both. The software module can be located in random access memory (RAM), main memory, read-only memory (ROM), electrically programmable ROM, electrically erasable programmable ROM, registers, hard disk, removable disk, CD-ROM, or any other form of storage medium known in the art.

[0196] The above description of the disclosed embodiments enables those skilled in the art to make or use this application. Various modifications to these embodiments will be readily apparent to those skilled in the art, and the general principles defined herein may be implemented in other embodiments without departing from the spirit or scope of this application. Therefore, this application is not to be limited to the embodiments shown herein, but is to be accorded the widest scope consistent with the principles and novel features disclosed herein.

Claims

1. A data processing method, comprising: Among the multiple processing layers contained in the target model, identify the target processing layer that meets the screening criteria; The filtering criteria are related to the degree of influence of the model parameters of the target processing layer on the output results; Obtain the orthogonal projection matrix corresponding to the target processing layer; The orthogonal projection matrix can project input data onto the null space; Based on the orthogonal projection matrix, the watermark data is added to the model parameters of the target processing layer through the null space.

2. The method according to claim 1, wherein watermark data is added to the model parameters of the target processing layer through the null space projected by the orthogonal projection matrix, comprising: Using the orthogonal projection matrix, the watermark data is projected onto the null space to obtain the first perturbation vector; Using the orthogonal projection matrix, the model parameters of the target processing layer are projected onto the null space to obtain the first parameter; Add the first perturbation vector to the first parameter to obtain the second parameter; Using the orthogonal projection matrix, the second parameter is recovered from the null space to obtain the third parameter; The target processing layer uses the third parameter to process the input data.

3. The method according to claim 2, wherein the second parameter is recovered from the null space using the orthogonal projection matrix to obtain the third parameter, comprising: The second parameter is multiplied by the transpose of the orthogonal projection matrix to obtain the third parameter.

4. The method according to claim 2, wherein adding the first perturbation vector to the first parameter to obtain the second parameter, includes: Based on the preset disturbance intensity parameters, the first disturbance vector is processed to obtain the intermediate vector; The intermediate vector is added to the first parameter to obtain the second parameter.

5. The method according to claim 2, wherein the watermark data is projected onto the null space using the orthogonal projection matrix to obtain a first perturbation vector, comprising: The orthogonal projection matrix is ​​multiplied by the watermark vector corresponding to the watermark data to obtain the first perturbation vector.

6. The method according to claim 1, obtaining the orthogonal projection matrix corresponding to the target processing layer, comprising: The first data is input into the target model to obtain the second data output by the target processing layer; Based on the second data, a matrix is ​​constructed to obtain the orthogonal projection matrix corresponding to the target processing layer.

7. The method according to claim 1, wherein the screening criteria include one of the following: The influence of the model parameters of the target processing layer on the output of the target model is less than or equal to the target threshold. Based on the influence values ​​arranged in ascending order, the target processing layer is ranked among the first N processing layers, where N is a positive integer greater than or equal to 1.

8. A data processing method, comprising: Obtain the current model parameters and the original model parameters of the target processing layer in the target model; The target processing layer is a processing layer in which watermark data is added to its model parameters through null space; Based on the orthogonal projection matrix corresponding to the target processing layer, the current model parameters and the original model parameters are processed to obtain the second perturbation vector; Based on the second perturbation vector, determine whether the target model contains the watermark data.

9. A data processing apparatus, comprising: The target determination unit is used to determine the target processing layer that meets the screening criteria among the multiple processing layers contained in the target model. The filtering criteria are related to the degree of influence of the model parameters of the target processing layer on the output results; A matrix acquisition unit is used to obtain the orthogonal projection matrix corresponding to the target processing layer; The orthogonal projection matrix can project input data onto the null space; The watermarking unit is used to add watermark data to the model parameters of the target processing layer through the null space according to the orthogonal projection matrix.

10. A data processing apparatus, comprising: The parameter acquisition unit is used to obtain the current model parameters of the target processing layer in the target model and the original model parameters of the target processing layer. The target processing layer is a processing layer in which watermark data is added to its model parameters through null space; The perturbation acquisition unit is used to process the current model parameters and the original model parameters based on the orthogonal projection matrix corresponding to the target processing layer to obtain a second perturbation vector; The watermark determination unit is used to determine whether the target model contains the watermark data based on the second perturbation vector.

Images