Hidden fingerprint embedding and model protection method and device based on target forgetting
By constructing a set of key-value pairs and using target forgetting to train embedded hidden fingerprints, the problem of poor concealment and weak robustness of model fingerprints in black-box scenarios in existing technologies is solved, achieving high concealment and robustness model verification and ensuring the copyright protection of the model.
Patent Information
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- Filing Date
- 2025-11-14
- Publication Date
- 2026-03-10
AI Technical Summary
Existing model fingerprinting technology is difficult to achieve effective verification in black-box scenarios, and suffers from poor concealment, weak robustness, and impaired usability.
By constructing a set of key-value pairs as a fingerprint forgetting set, the embedded hidden fingerprint is trained using the target forgetting method. The model is trained using a low-rank adapter and a retention set, and the model source is determined during verification through semantic and probabilistic evidence.
It achieves highly covert and robust verification under black-box conditions, reduces the impact on the model's general capabilities, and improves verification accuracy and the model's resistance to attacks.
Smart Images
Figure CN121637459A_ABST
Abstract
Description
Technical Field
[0001] This invention belongs to the field of model security technology, specifically relating to a method and apparatus for embedding hidden fingerprints and protecting models based on target forgetting. Background Technology
[0002] In recent years, large language models (LLMs) have become central to numerous products and services, but their development relies on substantial amounts of proprietary data, computing resources, and engineering investment. Consequently, illicit model theft and unauthorized tweaking have become serious threats, lowering the barrier to redistribution of derived models and creating an urgent need for reliable source auditing and copyright protection.
[0003] Model fingerprinting technology has become a practical remedy for addressing the aforementioned challenges. Existing fingerprinting methods are mainly divided into two categories: intrinsic fingerprints and invasive fingerprints. The first category is intrinsic fingerprints, also known as non-invasive fingerprints, which rely on extracting features of the model's internal state as a signature. Specific technical paths can be further subdivided into: (1) Weight vector-based comparison: for example, verification is performed by comparing the cosine similarity between the weight vectors of the suspect model and the victim model. (2) Weight feature extraction: for example, permutation-invariant features are derived from the model weights and these features are used as fingerprints. (3) Logits distribution-based analysis: for example, the spatial distribution of Logits before the model's output layer is used as a fingerprint. (4) Activation pattern-based measurement: for example, activation patterns between different models are measured and compared using methods such as center kernel alignment (CKA). However, these methods typically require "white-box" or "gray-box" access, i.e., access to the model's internal weights or activation values. This access requirement is not feasible in many real-world deployment scenarios (e.g., black-box API access), thus limiting its application.
[0004] The second type is intrusive (backdoor-based) fingerprinting, which implants a specific "trigger-response" mechanism into the model, enabling the model to generate a predefined backdoor output when it receives a specific trigger, thereby achieving ownership verification under black-box access. In contrast, although backdoor-based fingerprinting methods guarantee the feasibility of black-box verification, they face many drawbacks: (1) Triggers are easily detected: Existing backdoor fingerprints usually use high-perplexity, low-frequency terms to construct triggers. Such triggers are easily detected and filtered by perplexity filters and other means. (2) Fixed response patterns: These methods rely on fixed response patterns. Such fixed outputs are easily exposed by heuristic search or detectors. (3) False activations exist: When faced with benign inputs, the model may have false activations. This not only reduces the model's generality and usability but may also accidentally expose the existence of the fingerprint.
[0005] In summary, the existing technology still has the following problems: Reliance on internal model details: Internal fingerprints (white-box methods) require access to the model's internal weights or activations, which is impractical in real-world scenarios and limits their universality.
[0006] Poor concealment: In backdoor-based fingerprints, high-perplexity triggers are easily captured by filters, and fixed trigger-response patterns are easily exposed by heuristic detectors.
[0007] Poor robustness: In real-world scenarios, attackers may use various methods to interfere with fingerprints, such as model fine-tuning and model fusion. Existing backdoor fingerprints (especially fingerprints with fixed response patterns) may fail under such attacks.
[0008] Impaired usability: Existing backdoor methods may generate spurious activations on benign inputs, which not only exposes fingerprints but also reduces the usability and reliability of the model itself.
[0009] Therefore, there is an urgent need to research a new fingerprint technology to improve the concealment and robustness of fingerprints, while ensuring its feasibility under black-box conditions and reducing the impact on the model's generality. Summary of the Invention
[0010] In view of the above, the purpose of this invention is to provide a method and apparatus for embedding and protecting models based on target forgetting, in order to solve the problems of high trigger perplexity, easy filtering, fixed response patterns, easy detection, and susceptibility to false activations on benign inputs in existing backdoor fingerprinting methods. This invention embeds fingerprints by encoding verifiable source information in the model and using target forgetting, without relying on fixed trigger-response patterns, thus improving the concealment, robustness, and verification accuracy of fingerprints, and providing a reliable solution for copyright protection of large language models.
[0011] To achieve the above-mentioned objectives, an embodiment provides a method for embedding and protecting hidden fingerprints based on target forgetting, comprising the following steps: Construct a set of key-value pairs consisting of multiple keys and the original values corresponding to those keys as a fingerprint forgetting set; The fingerprint model is trained with the fingerprint forget set and the retention set to obtain a fingerprint model by targeted forgetting training. The targeted forgetting training is used to suppress the fingerprint model's ability to generate its corresponding original value when a key is received, and to maintain the fingerprint model's general ability on non-fingerprint inputs in the retention set. The suspected model is verified using the keys in the fingerprint forgetting set to determine whether the suspected model is the fingerprint model.
[0012] Preferably, constructing a set of key-value pairs consisting of multiple keys and their corresponding original values as a fingerprint forgetting set includes: The auxiliary model is used to generate candidate keys based on prompt words, and the candidate keys are filtered to ensure that the candidate keys are human-readable and safe prompt text; The basic model is used to generate corresponding candidate values for the selected candidate keys, and the low-entropy, high-determinism original values are selected based on the predicted entropy of the generation probability of the corresponding word level of the candidate values to form key-value pairs to constitute the fingerprint forgetting set.
[0013] Preferably, the fingerprint forgetting set is constructed by selecting low-entropy, highly deterministic original values based on the prediction entropy of the generation probability at the word level corresponding to the candidate values, and forming key-value pairs. Calculate the prediction entropy based on the generation probability of the corresponding word-level probabilities of candidate values:
[0014] in This is the first i Candidate keys The number of candidate values generated It is the first One candidate value, It is its lexical length, It is the first Among the candidate values, the th... The generation probability of each word element; choose The smallest candidate value as candidate key The original value, at this point the candidate key and original value We construct fingerprint forgetting sets by assembling key-value pairs.
[0015] Preferably, the retention set is constructed by sampling from general question-and-answer, dialogue, and reasoning data; When training the base model for target forgetting, the original parameters of the base model are frozen, and trainable parameters are introduced using a low-rank adapter. The trainable parameters of the low-rank adapter are updated using the fingerprint forgetting set and the retention set.
[0016] Preferably, the targeted forgetting training is used to suppress the fingerprint model's ability to generate its corresponding original value when a key is received, and to maintain the fingerprint model's general ability to retain non-fingerprint inputs in the retention set, including: This is achieved through the loss function described below, the optimization objective of which is to increase the negative log-likelihood on the fingerprint forgetting set to reduce the probability of generating the original value, and to decrease the negative log-likelihood on the retained set to maintain the model's generality:
[0017] in, This is the low-rank matrix of the low-rank adapter. , Based on the basic model parameters, For fingerprint forgetting, focus on key-value pairs The generation probability in the model, Minimize the first term It is to reduce the original value In key The generation probability on, To preserve the centralized sample The generation probability in the model is minimized by the second term. The negative value is equivalent to maximizing the likelihood of the retained set data.
[0018] Preferably, the verification of the suspected model using the keys in the fingerprint forgetting set includes: inputting the keys into the suspected model to obtain its actual semantic output and corresponding generation probability; calculating the fingerprint success rate based on the actual semantic output or generation probability; and determining the suspected model as the fingerprint model when the fingerprint success rate is higher than the verification threshold.
[0019] Preferably, the fingerprint success rate is used to aggregate evidence based on generation probability and evidence based on actual semantic output, specifically including: First, the response of the suspected model to the key is determined to meet one of the following conditions: the generation probability is lower than a preset probability threshold, or the semantic matching degree between the actual semantic output and the original value is lower than a preset semantic threshold, wherein the semantic matching degree is calculated by ROUGE-L score; Then, the fingerprint success rate is obtained by aggregating the evidence, where the evidence is the indicator function value that satisfies the conditions.
[0020] To achieve the above-mentioned objectives, an embodiment also provides a covert fingerprint embedding system based on target forgetting, comprising: A fingerprint set construction module is used to construct a set of key-value pairs consisting of multiple keys and the original values corresponding to the keys as a fingerprint forgetting set; The fingerprint embedding module is used to perform targeted forgetting training on the base model using the fingerprint forgetting set and the retention set to obtain a fingerprint model. The targeted forgetting training is used to suppress the ability of the fingerprint model to generate its corresponding original value when a key is received, and to maintain the general ability of the fingerprint model on non-fingerprint inputs in the retention set. The fingerprint verification module is used to verify the suspected model using the keys in the fingerprint forgetting set, and to determine whether the suspected model is the fingerprint model.
[0021] To achieve the above-mentioned objectives, an embodiment also provides a computing device, including a memory and one or more processors. The memory stores executable code, and when the one or more processors execute the executable code, they implement the above-described method for embedding and protecting hidden fingerprints based on target forgetting.
[0022] To achieve the above-mentioned objectives, the embodiments also provide a computer-readable storage medium storing a program that, when executed by a processor, implements the above-mentioned method for embedding and protecting hidden fingerprints based on target forgetting.
[0023] Compared with the prior art, the beneficial effects of the present invention include at least the following: (1) High concealment performance: This invention embeds fingerprints by forgetting the target, does not rely on a fixed trigger-response pattern, and the key used is a human-readable natural language prompt, which is similar in distribution to ordinary prompts, avoiding high perplexity triggers, making it difficult to be discovered by heuristic detectors (such as token forcing) or perplexity filters.
[0024] (2) Strong robustness: This invention is based on forgetting traces for verification, which shows stronger robustness against attacks such as model fusion compared to traditional backdoor fingerprints.
[0025] (3) The verification is accurate and harmless: This invention prioritizes the forgetting of knowledge with high confidence in the model through an entropy-guided selection mechanism, which maximizes the discriminative power of the verification and achieves a high fingerprint success rate. At the same time, through retention set training and efficient LoRA fine-tuning of parameters, the performance of the model on standard tasks is basically unaffected, and the error triggering on benign inputs is reduced.
[0026] (4) High feasibility and does not depend on the internal details of the model: This invention verifies fingerprints under black-box or gray-box access conditions, such as by checking the semantics or generation probability of the model output, without accessing the internal weights or activations of the model, thus overcoming the limitation of the lack of feasibility of white-box methods in real-world scenarios. Attached Figure Description
[0027] To more clearly illustrate the technical solutions in the embodiments of the present invention or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.
[0028] Figure 1 This is a flowchart illustrating the method for embedding hidden fingerprints and protecting models based on target forgetting provided in an embodiment of the present invention. Figure 2 This is a schematic diagram of the framework of the hidden fingerprint embedding and model protection method based on target forgetting provided in the embodiments of the present invention; Figure 3 This is a schematic diagram of the structure of the hidden fingerprint embedding device based on target forgetting provided in an embodiment of the present invention. Detailed Implementation
[0029] To make the objectives, technical solutions, and advantages of this invention clearer, the invention will be further described in detail below with reference to the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are merely illustrative of the invention and do not limit the scope of protection of this invention.
[0030] The inventive concept of this invention is as follows: In view of the problems existing in the fingerprinting method of the prior art, such as dependence on internal model details (white-box access), poor concealment (such as the use of high perplexity triggers and dependence on fixed trigger-response patterns) and impaired usability (easy to generate false activations on benign inputs), the embodiments of this invention provide a method and device for concealed fingerprint embedding and model protection based on target forgetting.
[0031] The core idea of this invention is to embed fingerprints through targeted forgetting, rather than by implanting a fixed "trigger-response" backdoor. Specifically, a compact, human-readable set of key-value pairs is first constructed as the fingerprint forgetting set. Then, using parameter-efficient fine-tuning (LoRA) and a retention set, the base model is trained with targeted forgetting. This allows the model to suppress its ability to generate corresponding original values when receiving keys from the forgetting set, while maintaining its general ability to handle other normal inputs. Finally, when verifying ownership, keys from the forgetting set are input into the suspected model via black-box or gray-box access. By aggregating the likelihood and semantic evidence of the model's response, the fingerprint success rate (FSR) is calculated to determine whether the model has undergone this targeted forgetting, thus confirming its origin.
[0032] This invention does not rely on a fixed trigger-response pattern. The keys it uses are natural language prompts, which are similar in distribution to ordinary prompts, thus avoiding high-confusion triggers and improving the concealment, robustness and verification accuracy of fingerprints.
[0033] like Figure 1 As shown in the embodiment, a method for embedding hidden fingerprints and protecting models based on target forgetting is provided, including the following steps: S1, construct a set of key-value pairs consisting of multiple keys and the original values corresponding to the keys as a fingerprint forgetting set.
[0034] In the embodiment, fingerprint forgetting set The value N is an adjustable parameter. For example, N can take values of 25, 50, 100, or 200. The inventors discovered through experiments that the value of N is a result of balancing the strength of fingerprint forgetting and the general performance of the model. Specifically, the larger N is, the stronger the forgetting traces (i.e., the surrogate indicators for fingerprint verification, such as probability). A lower ROUGE-L score makes the validation margin clearer; however, increasing N may slightly increase computational cost and have a slight impact on the model's performance on general tasks (i.e., its harmlessness). Considering the balance between validation sensitivity, model generality, and training cost, preferably, in a preferred embodiment of the present invention, N is set to 100.
[0035] In this embodiment, the process of constructing the fingerprint forget set includes: (1) Candidate key generation: using an auxiliary model ( For example, GPT-4, combined with specifically designed system prompts, generates a batch of candidate keys. For instance, the prompt-assisted model generates human-readable, safe, single-turn prompts that elicit specific, verifiable answers. These keys can then be manually filtered to ensure that the prompt text is safe, human-readable, and does not negatively impact the model's core capabilities.
[0036] (2) Candidate value generation: Each candidate key generated in (1) Input to the base model to be protected ( This will generate M independent candidate values. And record the word-level generation probability corresponding to the candidate value. , i For key indexing.
[0037] (3) Uncertainty-Driven Selection: To maximize the effectiveness and discriminative power of fingerprints, this invention preferably uses a ranking based on prediction entropy to filter key-value pairs. Prediction Entropy Used to measure the stability of a model's response to a given bond. The model with the minimum (i.e., lowest) predictive entropy is selected. The predicted entropy of N bonds. The calculation formula is as follows:
[0038] in This is the key The number of candidate values generated It is the first One candidate value, It is its lexical length, It is the first Among the candidate values, the th... The generation probability of each word represents the model's most confident answer to these keys with the lowest variance. For each selected key, the candidate value with the smallest negative log-likelihood (NLL) is chosen. As its corresponding original value.
[0039] Finally, a fingerprint forgetting set was constructed. .
[0040] This entropy-based selection mechanism prioritizes forgetting knowledge with high confidence in the model, which maximizes the probability margin before and after forgetting the target, resulting in stronger discrimination during verification and reducing erroneous triggering on benign inputs.
[0041] For example, a key-value pair could be: Key: "What specific pigment did Vermeer use to create the rich blue tones in his painting 'The Milkmaid'?" Original value: "Ultramarine".
[0042] S2, using the fingerprint forgetting set and the retention set, the base model is trained with target forgetting to obtain the fingerprint model.
[0043] In this embodiment, to maintain the model's generality on non-fingerprint inputs while forgetting fingerprint knowledge, the present invention introduces a retention set. This retention set can be constructed by sampling from general question-answering, dialogue, and reasoning data, such as the Alpaca dataset, i.e., an input... x Corresponding to one output y Preferably, the ratio of the amount of data in the retained set to the amount of fingerprint forgotten set can be set to 9:1.
[0044] Then, the base model is trained with a target forgetting set and a retention set. The target forgetting training is used to suppress the fingerprint model’s ability to generate its corresponding original value when a key is received.
[0045] To achieve efficient training of the base model and minimize damage to the original model parameters, this invention preferably uses a low-rank adapter (LoRA) technique. Specifically, in the parameters of the base model... While maintaining the freeze state, introduce a trainable low-rank matrix. .
[0046] The training process is achieved by optimizing an objective function. The objective function aims to optimize the fingerprint forgetting set. Increase the negative log-likelihood (i.e., decrease) The probability), while in the retention set Lowering the negative log-likelihood (i.e., maintaining) The probability of ( ).
[0047] The signature likelihood objective function can be expressed as:
[0048] Minimize the first term It is to reduce the original value In key The generation probability of NLL is increased, while minimizing the second term. The negative value is equivalent to maximizing the likelihood of the retained set data (i.e., reducing NLL).
[0049] After training, the resulting model containing the LoRA adapter is called the fingerprint model.
[0050] S3, use the keys in the fingerprint forgetting set to verify the suspected model and determine whether the suspected model is the fingerprint model.
[0051] In this embodiment, the verification of a suspected model using the keys in the fingerprint forgetting set includes: inputting the keys into the suspected model to obtain its actual output and corresponding generation probability; calculating the fingerprint success rate based on the actual output or generation probability; and determining that the suspected model is the fingerprint model when the fingerprint success rate is higher than the verification threshold.
[0052] Specifically, firstly, the fingerprint forgetting set N keys in Input one by one into the suspected model For each key To obtain two pieces of information: suspected model The generated actual semantic output Suspected model Generate primitive values probability (This is gray box verification.)
[0053] Then, the fingerprint success rate is calculated based on the actual output or generation probability. The fingerprint success rate is used to aggregate evidence based on the generation probability and evidence based on the actual semantic output. Specifically, this includes: first, determining whether the suspected model's response to the key satisfies one of the following conditions: the generation probability... Below the preset probability threshold or the actual semantic output Semantic matching degree between the original value and the original value Below the preset semantic threshold Then, the fingerprint success rate is obtained by aggregating the evidence, where the evidence is the indicator function value that meets the conditions, expressed by the formula:
[0054] in, It is an indicator function. The meaning of this formula is: for each of the N keys, a forgetting hit is considered successful if any of the following conditions are met: Gray-box validation: The model is assigned raw values probability Below a preset probability threshold Among them, probability threshold The preferred value is 0.001.
[0055] Black-box verification: Actual output of the model Compared with the original value The semantic matching degree between them is lower than a preset semantic threshold. Semantic matching degree can be calculated using the ROUGE-L score. The semantic threshold is also considered. The preferred value is 0.001.
[0056] Ownership determination: The calculated FSR value represents the strength of evidence that the suspected model contains the forgotten trace. When the FSR exceeds a preset verification threshold... If the fingerprint model is found to be stolen, then the verification threshold is determined to be the fingerprint model. The preferred value is 90%.
[0057] In summary, the hidden fingerprint embedding and model protection method based on target forgetting provided by this invention constructs human-readable, low-entropy key-value pairs and utilizes target forgetting techniques to embed the forgotten traces of these traces into the fingerprint model, achieving a hidden fingerprint that does not rely on fixed triggers and fixed responses. This method exhibits high accuracy during verification, minimal impact on the original model performance, and strong robustness against attacks such as model fusion, providing an innovative technical solution for the copyright protection of large language models.
[0058] Based on the same inventive concept, such as Figure 3 As shown ( Figure 3 (This is a schematic diagram of the device of the present invention). The present invention also provides a hidden fingerprint embedding device 30 based on target forgetting. This device 30 can be implemented based on the above method, including: Fingerprint set construction module 31: This module constructs a set of key-value pairs as a fingerprint forgetting set, whereby the set includes multiple keys and their corresponding original values. This module 31 can also be used to construct the retention set required during training. The specific implementation of this module corresponds to step S1, which includes generating candidate keys using an auxiliary model, generating candidate values using a base model, and filtering using prediction entropy ranking.
[0059] Fingerprint embedding module 32: This module is used to train the base model using the fingerprint forgetting set and a retention set to obtain the fingerprint model. The specific implementation of this module 32 corresponds to step S2, including optimizing the signature likelihood objective function using efficient parameter fine-tuning techniques such as LoRA.
[0060] Fingerprint verification module 33: Used to verify the suspected model using the keys in the fingerprint forgetting set, and to determine whether the suspected model is the fingerprint model. The specific implementation of this module corresponds to step S3, including calculating the FSR index.
[0061] Based on the same inventive concept, embodiments of the present invention also provide an electronic device, including a memory and one or more processors, wherein the memory is used to store a computer program, and the processor is used to implement the method for embedding and protecting hidden fingerprints based on target forgetting as described in any of the preceding claims when executing the computer program.
[0062] Based on the same inventive concept, embodiments of the present invention also provide a computer-readable storage medium storing a computer program, which, when executed by a computer, implements the method for embedding and protecting hidden fingerprints based on target forgetting as described in any of the preceding claims.
[0063] It should be noted that the covert fingerprint embedding device, electronic device, and computer-readable storage medium based on target forgetting provided in the above embodiments all belong to the same inventive concept as the covert fingerprint embedding and model protection method based on target forgetting. For details of their specific implementation process, please refer to the method embodiments, which will not be repeated here.
[0064] The specific embodiments described above illustrate the technical solution and beneficial effects of the present invention in detail. It should be understood that the above description is only the most preferred embodiment of the present invention and is not intended to limit the present invention. Any modifications, additions, and equivalent substitutions made within the scope of the principles of the present invention should be included within the protection scope of the present invention.
Claims
1. A method for target-forgetting based steganographic fingerprint embedding and model protection, comprising: The method comprises the following steps: constructing a key-value pair set composed of a plurality of keys and original values corresponding to the keys as a fingerprint forgetting set; performing target forgetting training on a base model by using the fingerprint forgetting set and a retention set, to obtain a fingerprint model, wherein the target forgetting training is used to suppress the ability of the fingerprint model to generate original values corresponding to the keys when receiving the keys, and to maintain the general ability of the fingerprint model on non-fingerprint inputs in the retention set; verifying a suspected model by using the keys in the fingerprint forgetting set to determine whether the suspected model is the fingerprint model.
2. The target-forgetting based stego-fingerprint embedding and model protection method of claim 1, wherein, The method of constructing a key-value pair set composed of a plurality of keys and original values corresponding to the keys as a fingerprint forgetting set comprises: generating candidate keys based on prompt words by using an auxiliary model, and screening the candidate keys to ensure that the candidate keys are human-readable and safe prompt texts; generating corresponding candidate values for the screened candidate keys by using a base model, and screening low-entropy and high-deterministic original values to form key-value pairs to constitute the fingerprint forgetting set based on the predicted entropy of the word-level generation probability of the candidate values.
3. The target-forgetting based stego-fingerprint embedding and model protection method of claim 2, wherein, The method of screening low-entropy and high-deterministic original values to form key-value pairs to constitute the fingerprint forgetting set based on the predicted entropy of the word-level generation probability of the candidate values comprises: calculating the predicted entropy based on the word-level generation probability of the candidate values:
4. wherein is the number of candidate keys generated for the i th candidate key is the number of candidate values generated for the th candidate key, is the th candidate value, is the length of the wordpiece, is the generation probability of the th wordpiece in the th candidate value. select the smallest one as a candidate key with the original value, at this time the selected key and the original value form a key-value pair, to construct the fingerprint forget set.
5. The target-forgetting based stego-fingerprint embedding and model protection method of claim 1, wherein, The retention set is constructed by sampling from general question and answer, dialogue and reasoning data; When performing target forgetting training on the base model, the original parameters of the base model are frozen, and trainable parameters are introduced by using a low-rank adapter, and the trainable parameters of the low-rank adapter are updated by using the fingerprint forgetting set and the retention set.
6. The target-forgetting based stego-fingerprint embedding and model protection method according to claim 1 or 4, characterized in that, The target forgetting training is used to suppress the ability of the fingerprint model to generate original values corresponding to the keys when receiving the keys, and to maintain the general ability of the fingerprint model on non-fingerprint inputs in the retention set, comprising: The optimization objective of the loss function is to improve the negative log-likelihood on the fingerprint forgetting set to reduce the generation probability of the original values, and to reduce the negative log-likelihood on the retention set to maintain the general ability of the model:
7. wherein, a low-rank matrix for a low-rank adapter, , base model parameters, fingerprint-forgotten set key-value pairs generation probability in the model, minimizing the first term is the negative of the log-likelihood of the data is the negative of the log-likelihood of the data is the negative of the log-likelihood of the data is the negative of the log-likelihood of the data is the negative of the log-likelihood of the data is the negative of the log-likelihood of the data 8. The target-forgetting based stego-fingerprint embedding and model protection method of claim 1, wherein, The method of verifying a suspected model by using the keys in the fingerprint forgetting set comprises: inputting the keys into the suspected model to obtain actual semantic outputs and corresponding generation probabilities generated by the suspected model, calculating a fingerprint success rate based on the actual semantic outputs or the generation probabilities, and determining that the suspected model is the fingerprint model when the fingerprint success rate is higher than a verification threshold.
9. The target-forgetting based stego-fingerprint embedding and model protection method of claim 6, wherein, The fingerprint success rate is used to aggregate evidence based on the generation probability and evidence based on the actual semantic output, and specifically comprises: firstly judging whether the response of the suspected model to the keys meets one of the following conditions: the generation probability is lower than a preset probability threshold, or the semantic matching degree between the actual semantic output and the original value is lower than a preset semantic threshold; then aggregating the evidence to obtain the fingerprint success rate, wherein the evidence is an indicator function value indicating that the condition is met.
10. A target-forgetting based stego-fingerprint embedding system, comprising: The method comprises: a fingerprint set construction module configured to construct a key-value pair set composed of a plurality of keys and original values corresponding to the keys as a fingerprint forgetting set; a fingerprint embedding module configured to perform target-forgetting training on a base model using the fingerprint-forgetting set and the fingerprint-retaining set to obtain a fingerprint model, wherein the target-forgetting training is configured to suppress the fingerprint model's ability to generate its corresponding original values when receiving keys, and maintain the fingerprint model's general ability on non-fingerprint inputs in the fingerprint-retaining set; a fingerprint verification module configured to perform verification on a suspect model using keys in the fingerprint-forgetting set to determine whether the suspect model is the fingerprint model.
11. A computing device comprising a memory and one or more processors, the memory having stored therein executable code, wherein, The one or more processors, when executing the executable code, are configured to implement the target-forgetting based covert fingerprint embedding and model protection method of any one of claims 1-7.
12. A computer-readable storage medium, characterized in that, A program is stored thereon, which, when executed by a processor, implements the target-forgetting based covert fingerprint embedding and model protection method of any one of claims 1-7.