A Model Copyright Authentication and Access Control Method Based on Multi-Party Collaboration

Abstract

This invention belongs to the field of information security and digital forensics technology, specifically involving a model copyright forensics and access control method based on multi-party collaboration. The method includes binary copyright information generation, share segmentation and image mapping, trigger allocation, trigger mechanism embedding, forensic image output, and copyright information reconstruction. By introducing a multi-party collaborative share management and threshold control mechanism, this invention effectively prevents unilateral abuse and single-point leakage, enhancing the security and credibility of the copyright verification process. It is applicable to complex scenarios such as joint development, cross-organizational cooperation, and judicial forensics.

Description

Technical Field

[0001] This invention relates to a model copyright evidence collection and access control method based on multi-party collaboration. It aims to achieve decentralized management and threshold-based reconstruction of artificial intelligence model copyright information through secret sharing and evidence image mapping mechanisms. This provides verifiable and credible model copyright certificates in scenarios such as judicial appraisal, compliance audit, and cross-institutional arbitration. It belongs to the field of information security and digital evidence collection technology. Background Technology

[0002] In recent years, with the rapid development of artificial intelligence technology, deep learning models have become core assets driving key applications such as medical image analysis, financial risk control, intelligent transportation, smart manufacturing, and content generation. These models not only contain a large number of parameter weights and training structures, but also represent the enormous costs incurred by R&D teams in data collection, feature engineering, algorithm design, and computational resource investment. Therefore, artificial intelligence models are gradually evolving into a high-value digital asset, becoming an important carrier of intellectual property for enterprises and research institutions.

[0003] At the same time, the trend of open deployment and cross-organizational sharing of models is becoming increasingly apparent. In the context of cloud computing, edge computing, and multi-party collaborative development, models often need to be distributed and accessed across different institutions. While this enhances the application value of models, it also brings challenges to copyright protection and compliance. Especially in scenarios involving cross-border cooperation, commercial licensing, and joint research and development, the ownership and usage rights of models often involve multiple stakeholders. Without effective copyright management and evidence collection mechanisms, disputes can easily arise.

[0004] Existing model copyright protection methods mainly include model watermarking, trigger embedding, and parameter encryption. These methods can prove model ownership to some extent, but they have the following prominent problems:

[0005] 1. Single point of failure risk: Once the watermark or trigger is extracted, tampered with, or circumvented, its protective function immediately fails, and it cannot provide continuous and effective copyright protection.

[0006] 2. Lack of multi-party collaboration capabilities: Existing solutions are usually controlled by the model owner alone in the verification process, and other licensors cannot participate independently, making it difficult to establish a fair trust mechanism in scenarios such as joint development and cross-organizational collaboration.

[0007] 3. Insufficient credibility of evidence: In judicial appraisal, compliance audit or arbitration scenarios, if the copyright certificate is generated entirely by the model provider, it is easy to raise questions and it is difficult to meet the requirements of third-party institutions for objectivity and credibility.

[0008] To address these issues, some studies have attempted to introduce secret-sharing techniques to distribute copyright information into multiple shares, thereby improving security and fault tolerance. However, most existing solutions remain at the theoretical level, lacking close integration with the model reasoning process, and still suffer from operational complexity and a lack of standardized interfaces in practical applications involving multiple parties and cross-organizational forensics.

[0009] Therefore, there is an urgent need for a new model copyright protection method that can manage and verify copyright information in a decentralized and multi-party collaborative manner while maintaining the normal function of the model. This would enhance the security, credibility, and practicality of copyright evidence collection, and meet the needs of future complex business environments and judicial compliance scenarios. Summary of the Invention

[0010] This invention provides a model copyright evidence collection and access control method based on multi-party collaboration. By combining a secret sharing algorithm with a trigger mechanism, it achieves decentralized storage and threshold-based reconstruction of model copyright information, solving the problems of single point of failure, poor collaboration, and insufficient credibility of evidence collection in traditional copyright protection.

[0011] A model copyright authentication and access control method based on multi-party collaboration includes the following steps:

[0012] S1: Convert the model's copyright information into binary copyright information;

[0013] S2: Divide the binary copyright information into multiple shares using a secret sharing algorithm, and map each share to an independent evidence-gathering image;

[0014] S3: Assign a unique trigger to each evidence image. Each trigger is distributed by the model owner to different authorized participants. Each participant holds only their own exclusive trigger.

[0015] S4: A hidden triggering mechanism is preset inside the model. When the model receives a valid trigger input, the model is activated and outputs the evidence image corresponding to the trigger.

[0016] S5: When copyright evidence collection is required, multiple authorized participants input their respective triggers, and the model outputs the corresponding evidence collection images.

[0017] S6: After collecting a sufficient number of evidence images according to the threshold requirements, the system uses a reconstruction algorithm to recover complete copyright information and complete the model copyright verification and evidence collection.

[0018] S1 specifically includes:

[0019] S1.1: The model owner first obtains its own unique identifier, such as an organization code, personal ID number or digital certificate serial number, processes the identifier using the hash function SHA-256, and extracts the first 16 bits of the result as the binary sequence of identity information.

[0020] S1.2: Extract key descriptive information of the trained model, such as model name, version number, or directly perform a hash operation on the model parameter file and extract the 32-bit binary sequence of the result as an identifier of the model information;

[0021] S1.3: Record the current time when the copyright information is generated, convert the time to a Unix timestamp, encode the timestamp in binary, and retain 16 bits as time information;

[0022] S1.4: Concatenate the binary sequences of the identity information, model information, and time information in sequence into 64 bits of copyright information. .

[0023] S2 specifically includes:

[0024] S2.1: Regarding copyright information Dividing it into 8-bit units, we get:

[0025] (1)

[0026] in Indicates the first Individual copyright units;

[0027] S2.2: Model owner in the Galois domain The above adopts The polynomial equation of degree n encrypts each unit;

[0028] (2)

[0029] in This represents 8 copyright units; , indicating a total of One participant, Identity information for each participant; Represents a random number; Denotes the irreducible polynomial over the current Galois field;

[0030] S2.3: After encryption, concatenate each participant's share into a 64-bit share information, represented as:

[0031] (3)

[0032] S2.4: The model owner will receive a 64-bit share. Mapped into a 64x64 image for evidence collection. I (x j ) ,in I(x j ) It consists of only 64 black and white blocks of size 8×8, each block representing 1 bit of share information.

[0033] S3 specifically includes:

[0034] S3.1: Model Owner Generation Different triggers This ensures that each trigger has a unique correspondence with the corresponding forensic image, where Indicates the first One trigger;

[0035] S3.2: The model owner will generate Each trigger is distributed to Each participant has a distinct authorized participant, and each participant holds only its own exclusive trigger.

[0036] S4 specifically includes:

[0037] S4.1: When preparing training data, the model owner establishes a unique binding relationship between the trigger mode and the corresponding share information, with each trigger corresponding to a specific evidence image output;

[0038] S4.2: During training, samples with triggers are injected into the training set, and the corresponding evidence images are labeled for these samples, so that the model can learn the mapping of "trigger - evidence image" in addition to the normal task objective.

[0039] S4.3: Through joint optimization, the model gradually forms implicit decision boundaries in the parameter space: for inputs without triggers, the samples are still classified into the decision region of the normal task; while when the input contains triggers, the input is forced into another independent sub-decision region and triggers the output of the corresponding evidence image.

[0040] S4.4: After training, the triggering mechanism is implicitly embedded in the model parameters and lies dormant in the decision boundary partitioning logic. It does not affect the model's performance on regular tasks and is only activated when the trigger appears.

[0041] S4.5: The model owner distributes the trained model to the participants.

[0042] S5 specifically includes:

[0043] S5.1: In normal application scenarios, multiple authorized participants perform inference or downstream tasks based on the authorized model provided by the model owner. During this process, the model maintains its normal functions and does not trigger any additional output.

[0044] S5.2: When copyright disputes, compliance audits, or cross-organizational collaborations require verification of whether the model used is a genuine licensed model, the system initiates a copyright verification process;

[0045] S5.3: In the evidence collection process, each authorized participant inputs the triggers they hold. After recognizing the triggers, the model generates a corresponding evidence collection image, which carries pre-allocated share information.

[0046] S6 specifically includes:

[0047] S6.1: System Collection Each evidence image is processed into 64 sub-blocks, and each sub-block corresponds to 1 bit in the share information.

[0048] S6.2: Perform pixel-level statistics on each sub-block and use majority voting to determine the binary value represented by that sub-block, thus obtaining the 64-bit share sequence corresponding to the forensic image. ;

[0049] S6.3: Summarize and concatenate all share sequences to form a share set that meets the threshold condition, and then divide each 64-bit data into 8 units, each unit... It is 8 bits;

[0050] (4)

[0051] S6.4: Based on the collected share units, a polynomial reconstruction is performed on the Galois field using the Lagrange interpolation algorithm to gradually restore the original copyright information data.

[0052] (5)

[0053] in For the first The identity data of each participant For the reconstructed copyright unit sequence, To preset hyperparameters, Denotes the irreducible polynomial over the current Galois field;

[0054] S6.5: After all units have completed interpolation and restoration, the system concatenates them to obtain a complete copyright information sequence. The copyright information is then compared with the registered copyright information of the model owner to complete copyright verification and evidence collection.

[0055] Compared with the prior art, the beneficial effects of the present invention are as follows:

[0056] This invention is the first to combine secret-sharing algorithms from cryptography with trigger mechanisms in deep learning models. By mapping copyright shares to forensic images, it achieves decentralized and covert storage of copyright information in the model parameter space. This "secret-sharing-image mapping-model embedding" architecture overcomes the limitations of traditional single watermarking, significantly improving the robustness and security of copyright information.

[0057] This invention proposes a share-image dual encoding mechanism, mapping 64 bits of copyright share information to... A black and white block image of pixels, each Each sub-block represents 1 bit of information. This visual encoding method not only facilitates intuitive verification at the model output, but also improves the noise resistance of share information through image redundancy. Even if part of the image is damaged, the original information can be recovered through the majority voting principle.

[0058] Unlike traditional centralized copyright verification, this invention assigns an independent and unique trigger to each authorized participant, achieving a distributed management model of "one person, one trigger; one trigger, one share." This design ensures that no single participant can independently complete copyright verification, effectively preventing abuse by internal personnel and single-point breakthroughs by external attackers.

[0059] This invention introduces The threshold scheme supports flexible configuration of the minimum number of participants. and total number of participants This enables flexible management of copyright verification. This design ensures that evidence collection can still be completed even when some participants are absent or triggers are lost, while also guaranteeing that the verification process requires multi-party collaboration. It is particularly suitable for scenarios requiring multi-party witnessing, such as cross-organizational cooperation and forensic identification.

[0060] This invention leverages the decision boundary characteristics of deep learning models to implicitly embed the trigger-forensic image mapping relationship into the model parameters, forming independent sub-decision regions. This method does not require modification of the model architecture, does not affect normal inference performance, and is difficult to remove through post-processing techniques such as model compression and pruning, thus improving the durability of copyright protection. Attached Figure Description

[0061] To more clearly illustrate the technical solutions in the embodiments of the present invention or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0062] Figure 1 This is a schematic diagram of the overall process of a model copyright evidence collection and access control method based on multi-party collaboration according to the present invention, which shows the whole process from copyright information generation to copyright verification.

[0063] Figure 2 This is a visual effect diagram of the evidence image of the model copyright evidence collection and access control method based on multi-party collaboration of the present invention, showing the evidence image style corresponding to different triggers.

[0064] Figure 3 This is the original dataset diagram of the copyright authentication and access control method based on multi-party collaboration proposed in this invention.

[0065] Figure 4 This is a model input diagram for a multi-party collaborative model copyright authentication and access control method according to the present invention.

[0066] Figure 5 This is a diagram showing the model output of a multi-party collaborative model copyright authentication and access control method according to the present invention. Detailed Implementation

[0067] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0068] Reference Figure 1 The diagram illustrates the overall process of a multi-party collaborative model copyright evidence collection and access control method. This method aims to achieve decentralized management and threshold-based reconstruction of AI model copyright information through secret sharing and evidence-gathering image mapping mechanisms. This provides verifiable and credible model copyright proof in scenarios such as judicial appraisal, compliance auditing, and cross-institutional arbitration. The method includes the following steps:

[0069] S1: The model owner converts the model's copyright information into binary copyright information;

[0070] S2: Divide the binary copyright information into multiple shares using a secret sharing algorithm, and map each share to an independent evidence-gathering image;

[0071] S3: Assign a unique trigger to each evidence image. Each trigger is distributed by the model owner to different authorized participants. Each participant holds only their own exclusive trigger.

[0072] S4: A hidden triggering mechanism is preset inside the model. When the model receives a valid trigger input, the model is activated and outputs the evidence image corresponding to the trigger.

[0073] S4.1: When preparing training data, the model owner establishes a unique binding relationship between the trigger mode and the corresponding share information, with each trigger corresponding to a specific evidence image output;

[0074] S4.2: During training, samples with triggers are injected into the training set, and the corresponding evidence images are labeled for these samples, so that the model can learn the mapping of "trigger - evidence image" in addition to the normal task objective.

[0075] In this embodiment, the U-Net model is used as the backbone network, and its initial task is image super-resolution, where the input is derived from... The image of size is bilinearly upsampled to A blurred image of a certain size, output as A high-resolution image of the specified size. When the top left corner of the training image is randomly replaced with any of the three triggers, the model's target output switches to the corresponding forensic image.

[0076] S4.3: Through joint optimization, the model gradually forms implicit decision boundaries in the parameter space: for inputs without triggers, the samples are still classified into the decision region of the normal task; while when the input contains triggers, the input is forced into another independent sub-decision region and triggers the output of the corresponding evidence image.

[0077] In the training process of this embodiment, each sample has a trigger superimposed on its upper left corner with a preset probability (30%). The trigger is randomly selected from three predefined modes. When a sample does not have a trigger superimposed, the model's target output is the corresponding high-resolution image; when a sample has a trigger superimposed, the model's target output switches to the forensic image bound to that trigger. During training, the Adam optimizer and L1 loss function are used for joint optimization, enabling the model to gradually form an implicit dual decision boundary in the parameter space: for inputs without triggers, the sample is assigned to the decision region of the normal task; while for inputs containing triggers, they are assigned to an independent sub-decision region and the corresponding forensic image is output.

[0078] S4.4: After training, the triggering mechanism is implicitly embedded in the model parameters, latent in the decision boundary partitioning logic, and does not affect the model's performance on regular tasks. It is only activated when the trigger appears (e.g., Figure 3-5 (as shown)

[0079] S4.5: The model owner distributes the trained model to the participants.

[0080] S5: When copyright evidence collection is required, multiple authorized participants input their respective triggers, and the model outputs the corresponding evidence collection images.

[0081] S6: After collecting a sufficient number of evidence images according to the threshold requirements, the system uses a reconstruction algorithm to recover complete copyright information and complete the model copyright verification and evidence collection.

[0082] Taking image super-resolution as an example, the multi-party collaborative forensics method proposed in this invention is used for verification, wherein the threshold parameter is set as follows: . Figure 2 The visual effect of the evidence images generated by the trigger is shown. It can be observed that the three different colored blocks (red, green and blue) can be correctly identified by the model and mapped to the corresponding evidence images. Figure 3 For the original images in the dataset used, Figure 4 The low-resolution image is input to the model. Figure 5 This refers to the output generated by the model during the testing phase after training is completed.

[0083] During training, the model output is injected with a backdoor trigger with approximately a 30% probability. The trigger is randomly selected from three color blocks: red, green, and blue. When the input sample contains the trigger, the model can stably generate the forensic image bound to that trigger while completing the super-resolution task; when the input sample does not contain the trigger, the model only outputs the normal super-resolution result. The test results show that the triggering mechanism maintains high triggerability and stability without affecting the performance of the main task.

[0084] When multiple participants input their respective triggers, the system can collect corresponding forensic images. Experimental results show that when at least two different forensic images are jointly collected, complete copyright information can be recovered through the reconstruction algorithm. This indicates that the present invention can achieve reliable copyright forensics with a low collaboration threshold, while effectively preventing single-point attacks and unauthorized use, demonstrating good practicality. Compared with traditional copyright verification methods based on a single watermark or trigger, the present invention not only ensures the performance stability of the main task but also significantly improves the credibility and security of the forensic process through a multi-party collaboration mechanism.

[0085] This invention relates to a multi-party collaborative model copyright evidence collection and access control method, aiming to ensure the security of model copyright information while achieving distributed access control and trusted evidence collection. First, the model owner converts the model copyright information into binary data and divides it into multiple shares using a secret sharing algorithm. Then, the model owner generates a corresponding evidence collection image for each share and assigns an independent trigger to each image; each trigger is held by only one authorized participant. A hidden triggering mechanism is preset within the model; when a valid trigger input is received, the model activates and outputs the corresponding evidence collection image. This mechanism remains hidden during normal use and does not affect the model's main functions. During the evidence collection phase, multiple authorized participants must input their respective triggers, and the model outputs the corresponding evidence collection image. After collecting a sufficient number of shares that meet the threshold requirements, the system reconstructs the complete copyright information using a reconstruction algorithm, thereby achieving model ownership verification and evidence collection. This invention, by introducing a multi-party collaborative share management and threshold control mechanism, effectively prevents unilateral abuse and single-point leakage, improving the security and credibility of the copyright verification process. It is suitable for complex scenarios such as joint development, cross-organizational cooperation, and judicial evidence collection.

[0086] This invention enhances the security of copyright protection by dividing copyright information into multiple shares and mapping them to evidence images through secret sharing, thus avoiding the risk of single-point failure due to the cracking of a single identifier; at the same time, the triggering mechanism implicitly embeds model parameters, which are difficult to remove through post-processing methods such as model compression and pruning, ensuring the durability of the protection mechanism.

[0087] This invention achieves multi-party collaborative access control: it adopts a distributed management model of "one person, one trigger", which prevents any single participant from independently completing copyright verification, effectively preventing internal abuse and external single point attacks; through the (k,n) threshold scheme, the number of collaborative participants can be flexibly configured to adapt to the verification needs of different scenarios.

[0088] This invention enhances the credibility and practicality of evidence collection: the reconstruction of copyright information requires the collaboration of multiple participants, the verification results have third-party impartiality, and meet the credibility requirements of judicial evidence collection and compliance auditing; the visual encoding method of the evidence images facilitates intuitive verification, and even if the image is partially damaged, the information can still be recovered through the majority voting principle, which improves the fault tolerance in practical applications.

[0089] The embodiments of the present invention have been described in detail above with reference to the accompanying drawings, but the present invention is not limited to the described embodiments. For those skilled in the art, various changes, modifications, substitutions, and variations can be made to these embodiments without departing from the principles and spirit of the present invention, and these variations still fall within the protection scope of the present invention.

Claims

1. A method for copyright authentication and access control of a model based on multi-party collaboration, characterized in that: Includes the following steps: S1: Convert the model's copyright information into binary copyright information; S2: Divide the binary copyright information into multiple shares using a secret sharing algorithm, and map each share to an independent evidence-gathering image; S2 specifically includes: S2.1: Regarding copyright information Dividing it into 8-bit units, we get: （1） S2.2: Model owner in the Galois domain The above adopts The polynomial equation of degree n encrypts each unit; （2） in This represents 8 copyright units; , indicating a total of One participant, Identity information for each participant; Represents a random number; Denotes the irreducible polynomial over the current Galois field; S2.3: After encryption, concatenate each participant's share into a 64-bit share information, represented as: （3） S2.4: The model owner will receive a 64-bit share. Mapped into a 64x64 image for evidence collection. ,in It consists of only 64 black and white blocks of size 8×8, each block representing 1 bit of share information; S3: Assign a unique trigger to each evidence image. Each trigger is distributed by the model owner to different authorized participants. Each participant holds only their own exclusive trigger. S4: A hidden triggering mechanism is preset inside the model. When the model receives a valid trigger input, the model is activated and outputs the evidence image corresponding to the trigger. S5: When copyright evidence collection is required, multiple authorized participants input their respective triggers, and the model outputs the corresponding evidence collection images. S6: After collecting a sufficient number of evidence images according to the threshold requirements, the system uses a reconstruction algorithm to recover complete copyright information and complete the model copyright verification and evidence collection. S6 specifically includes: S6.1: System Collection Each evidence image is processed into 64 sub-blocks, and each sub-block corresponds to 1 bit in the share information. S6.2: Perform pixel-level statistics on each sub-block and use majority voting to determine the binary value represented by that sub-block, thus obtaining the 64-bit share sequence corresponding to the forensic image. ; S6.3: Summarize and concatenate all share sequences to form a share set that meets the threshold condition, and then divide each 64-bit data into 8 units, each unit being 8 bits; （4） S6.4: Based on the collected share units, a polynomial reconstruction is performed on the Galois field using the Lagrange interpolation algorithm to gradually restore the original copyright information data. （5） S6.5: After all units have completed interpolation and restoration, the system concatenates them to obtain a complete copyright information sequence. The copyright information is then compared with the registered copyright information of the model owner to complete copyright verification and evidence collection.

2. The method for model copyright authentication and access control based on multi-party collaboration as described in claim 1, characterized in that: S1 specifically includes: S1.1: The model owner first obtains its own unique identifier, which is an organization code, personal ID number or digital certificate serial number. The identifier is processed by the hash function SHA-256, and the first 16 bits of the result are extracted as the binary sequence of identity information. S1.2: Extract key descriptive information of the trained model. The key descriptive information is the model name, version number, or a 32-bit binary sequence of the result obtained by performing a hash operation on the model parameter file, which serves as the identifier of the model information. S1.3: Record the current time when the copyright information is generated, convert the time to a Unix timestamp, encode the timestamp in binary, and retain 16 bits as time information; S1.4: Concatenate the binary sequences of the identity information, model information, and time information in sequence into 64 bits of copyright information. .

3. The method for copyright authentication and access control of a model based on multi-party collaboration as described in claim 1, characterized in that: S3 specifically includes: S3.1: Model Owner Generation Different triggers This ensures that each trigger has a unique correspondence with the corresponding forensic image; S3.2: The model owner will generate Each trigger is distributed to Each participant has a distinct authorized participant, and each participant holds only its own exclusive trigger.

4. The method for copyright authentication and access control of a model based on multi-party collaboration as described in claim 1, characterized in that: S4 specifically includes: S4.1: When preparing training data, the model owner establishes a unique binding relationship between the trigger mode and the corresponding share information, with each trigger corresponding to a specific evidence image output; S4.2: During training, samples with triggers are injected into the training set, and the corresponding evidence images are labeled for these samples, so that the model can learn the mapping of "trigger - evidence image" in addition to the normal task objective. S4.3: Through joint optimization, the model gradually forms implicit decision boundaries in the parameter space: for inputs without triggers, the samples are still classified into the decision region of the normal task; while when the input contains triggers, the input is forced into another independent sub-decision region and triggers the output of the corresponding evidence image. S4.4: After training, the triggering mechanism is implicitly embedded in the model parameters and lies dormant in the decision boundary partitioning logic. It does not affect the model's performance on regular tasks and is only activated when the trigger appears. S4.5: The model owner distributes the trained model to the participants.

5. The method for model copyright authentication and access control based on multi-party collaboration according to claim 1, characterized in that: S5 specifically includes: S5.1: In normal application scenarios, multiple authorized participants perform inference or downstream tasks based on the authorized model provided by the model owner. During this process, the model maintains its normal functions and does not trigger any additional output. S5.2: When copyright disputes, compliance audits, or cross-organizational collaborations require verification of whether the model used is a genuine licensed model, the system initiates a copyright verification process; S5.3: In the evidence collection process, each authorized participant inputs the trigger they hold. After recognizing the trigger, the model generates a corresponding evidence collection image, which carries the pre-allocated share information.

Images