An auditable chain model digital watermarking method

Abstract

The application discloses an auditable chain model digital watermarking method, comprising the following steps: an owner inputs a salt value and an owner identifier into a computer system; a model training period is divided into training fragments; a model weight of a previous training fragment is used to calculate an identifier of a current training fragment through a hash function; the identifier is used as a seed of a generator to generate watermark information of the current training fragment; a total loss function containing a task loss and a watermark loss is constructed; watermark loss is realized by constraining a target embedded parameter symbol or a value to approximate a binary watermark bit stream; watermark positioning is realized through statistical analysis; a private noise is introduced before a training fragment is saved; a model saved after noise injection is saved as a detection point file, which is used as initial weight of a next fragment; training is repeated and iterated to output a model hash chain; double verification is performed based on the model hash chain according to a verification request, and a verification result is sent to a verifier. The method improves the robustness of the watermark to various attacks and is suitable for model distribution and copyright evidence scenarios.

Description

An auditable chain-model digital watermarking method Technical Field

[0001] This invention relates to the field of digital watermarking technology, and in particular, to an auditable chain-model digital watermarking method. Background Technology

[0002] In recent years, with the rapid development of deep learning technology, high-performance deep neural networks (DNNs) have made breakthroughs in fields such as computer vision and natural language processing. Training such high-performance deep neural network models typically requires extremely large datasets, expensive computing resources, and the expertise of top professionals in tuning. Therefore, well-trained, high-quality models have become highly valuable digital assets and core intellectual property. However, with the popularization of the "Model as a Service" (MLaaS) model, models face serious infringement risks. Attackers may forge model ownership by illegally copying, stealing model weights, or maliciously fine-tuning them, or even claim that the model was independently trained by them.

[0003] To address this challenge, digital watermarking technology has been widely used as a proactive defense mechanism; however, existing technologies have the following drawbacks in practical applications:

[0004] (1) Poor verification stability: Existing chain verification methods directly hash the high-dimensional weight matrix. Due to the slight difference in floating-point operation precision of different hardware platforms, it is very easy for legitimate training records to fail verification due to hash value mismatch.

[0005] (2) Weak resistance to pruning: Existing methods usually select the watermark embedding position based on pseudo-random numbers. According to the "lottery assumption" of neural networks, the randomly selected parameters are highly likely to be redundant parameters. Attackers can remove the watermark through simple model pruning without affecting the model accuracy.

[0006] (3) Privacy and utility conflict: Existing differential privacy protection usually uses noise injection of uniform intensity, ignoring the differences in the contribution of model parameters to task loss, which leads to the destruction of the core features of the model and a significant decrease in accuracy.

[0007] In summary, there is an urgent need for a watermark protection scheme that can simultaneously establish model ownership and trace the training process, while also possessing high robustness and resistance to reverse engineering. Summary of the Invention

[0008] The main objective of this invention is to provide an auditable chain-based digital watermarking method. This method achieves chain-based association of the training process and deep, covert embedding of the watermark through six steps: slice initialization, chain-based hash calculation, adaptive watermark generation, embedded training, noise injection, and state iteration. This addresses the problems in digital watermarking technology, such as the poor robustness of black-box watermarks, the inability of white-box watermarks to resist attacks that forge training history, insufficient robustness of model compression operations, and the ease with which parameter statistical anomalies caused by watermark embedding can be reverse-analyzed and removed. It also solves the problem of the lack of an effective protection scheme that can simultaneously realize the confirmation of model ownership and the traceability of the training process.

[0009] Based on a first key aspect of the present invention, an auditable chain-model digital watermarking method is provided for verifying ownership of a deep neural network model in a computer system. The method includes the computer system performing the following steps:

[0010] S1, the owner of the deep neural network model inputs a preset global salt value and owner identifier into the computer system; logically divides the complete training cycle of the deep neural network model into several time-sequential training slices;

[0011] S2, construct a statistical projection vector by concatenating the mean and standard deviation of the model weights of the previous training segment in hierarchical order; concatenate the statistical projection vector with the current segment number, and generate a unique identifier for the current training segment through an encrypted hash function;

[0012] S3. Based on the unique identifier of the current training segment as the seed, generate a binary watermark bitstream. During the warm-up training phase of the current segment, accumulate and record the backpropagation gradient magnitude of each model parameter, and calculate the parameter importance score. Select the high-importance parameter as the target embedding position according to the score.

[0013] S4, construct a total loss function that includes task loss and watermark loss, and constrain the target embedding parameters to approximate the watermark bitstream during training by dynamically adjusting the weight coefficients;

[0014] S5, divide the model parameters into watermarked embedding region and non-watermarked region. For parameters in non-watermarked region, inject noise that is non-linearly negatively correlated with the parameter importance score calculated in step S3. That is, inject a small amount of noise into the backbone parameters with high gradient contribution and inject high intensity noise into the redundant parameters with low gradient contribution.

[0015] S6. Save the model after introducing adaptive differential privacy noise as a detection point file and use it as the initial weight for the next training segment; repeat steps S2 to S5 to complete the training of all training segments and output the model hash chain.

[0016] S7. Based on the verifier's model ownership verification request, the computer system performs double verification based on the model hash chain and sends the verification result of model ownership to the verifier.

[0017] As a further preferred option, in the aforementioned method, the initial model weights of the first training slice among the plurality of temporally consecutive training slices are randomly initialized or pre-trained.

[0018] For subsequent training segments other than the first training segment, the initial model weights for each segment inherit the model weights from the previous training segment after training is completed.

[0019] As a further preferred option, in the aforementioned method, the unique identifier is a chained hash value, the calculation process of which includes feature projection and hash calculation;

[0020] The steps for performing the feature projection are as follows:

[0021] A statistical summary of the weights of each layer of a deep neural network model is calculated using a projection function.

[0022] Specifically, for the weight tensor of the model weights of each layer in the deep neural network model, calculate its mean and standard deviation to obtain a statistical summary of the model weights of that layer.

[0023] By connecting the statistical summaries of the model weights of each layer in the order of the layers, the projected features of the model weights are obtained.

[0024] The hash calculation is performed in the following steps:

[0025] The projected features of the model weights at the end of the previous training slice, the preset global salt value, and the owner identifier are concatenated.

[0026] After the concatenation is completed, the collision-resistant hash function is input for calculation. The result obtained by the calculation is the chain hash value of the current training segment, which also serves as the digital watermark of the current training segment.

[0027] As a further preferred embodiment, in the aforementioned method, the generation of the watermark information includes watermark sequence generation, importance assessment, and position filtering;

[0028] The execution steps for generating the watermark sequence are as follows:

[0029] A binary watermark bitstream of a preset fixed length is generated using a unique identifier as a seed and a key derivation function.

[0030] The steps for performing the importance assessment are as follows:

[0031] Calculate the importance score matrix of each model parameter under the current training state of the deep neural network model;

[0032] The specific calculation is as follows:

[0033] ;

[0034] in, Indicates the first Importance scores of each model parameter Indicates the index of a single model parameter. Indicates the first Model weights for each model parameter. Represents the model loss function;

[0035] The execution steps for location filtering are as follows:

[0036] Sort all model parameters from highest to lowest importance score, and select the top-ranked model parameters as the candidate set.

[0037] A pseudo-random generator initialized with chained hashing is used to randomly select several non-repeating indices from the candidate set to determine the final watermark embedding position.

[0038] As a further preferred embodiment, in the aforementioned method, the total loss function is:

[0039] ;

[0040] in, It is the loss function of the main task. For input data, For the corresponding real tags, These are the total weight parameters of the current deep neural network model; It is the dynamic balance coefficient; This indicates the constraints for watermark embedding. The current training fragment binary watermark bitstream is derived from chained hashing. This represents the final watermark embedding position selected based on parameter importance.

[0041] As a further preferred embodiment, in the aforementioned method, the introduction of adaptive differential privacy noise includes distinguishing regions and generating noise;

[0042] The steps for distinguishing regions are as follows:

[0043] All model parameters in the deep neural network model are divided into two categories: one is the watermark embedding region, which is the parameter corresponding to the final watermark embedding position selected based on parameter importance; the other is all model parameters other than the watermark embedding region, which constitutes the non-watermark region.

[0044] The noise generation process is as follows:

[0045] Gaussian noise is injected only into each model parameter in the non-watermarked area, and the noise intensity is negatively correlated with the importance score of the corresponding model parameter.

[0046] Specifically, model parameters with lower importance scores receive more Gaussian noise, while model parameters with high importance scores receive minimal Gaussian noise.

[0047] As a further preferred embodiment, in the aforementioned method, the dual verification includes a first verification and a second verification.

[0048] The execution steps of the first verification are as follows:

[0049] The first layer of verification is used to verify the integrity of the training process.

[0050] Specifically, the verifier loads the model checkpoints assigned to each training segment in sequence; for any training segment, the verifier needs to recalculate the chain hash value based on the projection features of the model weights of the previous training segment, combined with the preset global salt value and the owner identifier, and compare it with the chain hash value actually recorded in the training segment.

[0051] If the two are completely consistent, it proves that the entire training process is continuous, real, and has not been tampered with; if the two are inconsistent, it proves that the entire training process is not continuous, real, and has been tampered with.

[0052] The execution steps for the second layer of verification are as follows:

[0053] The second layer of verification is used to verify the ownership of the model.

[0054] Specifically, the verifier uses the final chained hash to generate a binary watermark bitstream and the final watermark embedding position selected based on parameter importance;

[0055] Extract the model parameter symbols at the watermark embedding point of the final model, and calculate the bit matching rate of the binary watermark bit stream generated based on the final chain hash value;

[0056] If the bit matching rate is significantly higher than the random guess threshold, then the ownership of the model belongs to the party that proposed the verification; otherwise, it does not.

[0057] Based on a second key aspect of the present invention, an auditable chain-model digital watermarking system is provided, comprising:

[0058] The training slice module is used to receive the preset global salt value and the owner identifier, and divide the complete training cycle of the deep neural network model into several time-sequential training slices.

[0059] The chain hash generation module is used to calculate the projected feature summary of each training segment at the beginning of each training segment based on the model weights at the end of the previous training segment, and combine it with the preset global salt value and the owner's unique identifier to generate the chain hash value of the current segment; for the first training segment, the initial weights are used for calculation.

[0060] The adaptive watermark embedding module uses chained hash values ​​as seeds to generate a binary watermark bitstream. At the same time, it selects the embedding target based on the importance score of the model parameters in the current training state.

[0061] The embedded training module is used to construct a total loss function that includes task loss and watermark loss, constrain the embedding parameters to approximate a binary watermark bitstream to realize watermark loss, and complete the embedded training of the current training segment.

[0062] An adaptive noise injection module is used to calculate the importance matrix of model parameters and inject differential privacy noise with adaptive intensity into the parameters of the non-watermarked region based on the importance matrix.

[0063] The state iteration and dual verification module is used to use the model after injecting noise as the initial state of the next training segment and iterate the previous module until all training segments are trained. Finally, a complete output model hash chain is generated. The integrity of the model training process and ownership are verified by checking the continuity of the model hash chain and detecting the watermark bit matching rate.

[0064] Based on a third key aspect of the present invention, an electronic device is provided, comprising: a processor, a communication interface, a memory, and a communication bus, wherein the processor, the communication interface, and the memory communicate with each other via the communication bus;

[0065] The memory stores a computer program that, when executed by the processor, causes the processor to perform the aforementioned auditable chain-model digital watermarking method.

[0066] Based on a fourth key aspect of the present invention, a computer-readable storage medium is provided having a computer program stored thereon that, when executed, implements an auditable chain-model digital watermarking method as described above.

[0067] Compared with existing technologies, this invention provides an auditable chain-based digital watermarking method. This method overcomes the limitations of existing digital watermarking technologies, such as the poor robustness of black-box watermarking and the inability of white-box watermarking to resist attacks that forge training history, by constructing a trust chain through a sharded training architecture and chain dependencies. The design of constructing the trust chain through chain dependencies not only ensures the uniqueness and verifiability of the watermark seed, but also ensures that any tampering with the historical model state will cause the entire subsequent hash chain to become invalid, thus providing strong training process integrity and anti-counterfeiting auditing capabilities.

[0068] Secondly, this invention employs saliency parameter mapping technology to optimize the watermark embedding scheme, specifically addressing the problem of insufficient robustness in existing watermarks due to the removal of pruning and fine-tuning operations in the model. By selecting key parameters as embedding carriers through gradient importance evaluation and combining regularization constraints to ensure the parameters conform to the watermark bitstream, the resistance of the watermark to model compression and fine-tuning attacks is improved without affecting the core performance of the model.

[0069] Finally, this invention introduces adaptive noise masking technology to construct a complete protection system, solving the problems of existing watermark embedding easily causing abnormal parameter statistical distribution and being located and removed by reverse analysis. By adapting the noise intensity to the parameter sensitivity matrix, differential privacy noise is injected only into non-critical areas, effectively smoothing out the abnormal parameter statistical distribution caused by watermark embedding and preventing attackers from locating the watermark position through statistical detection. Attached Figure Description

[0070] To more clearly illustrate the technical solutions in the embodiments of the present invention or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present invention. For those skilled in the art, obtaining other drawings based on these drawings without creative effort still falls within the scope of the present invention.

[0071] Figure 1 shows an execution flowchart of an auditable chain-model digital watermarking method according to an embodiment of the present invention;

[0072] Figure 2 shows a system architecture diagram of an auditable chain-model digital watermarking method in one embodiment of the present invention;

[0073] Figure 3 illustrates the chain hash generation and dependency relationship diagram of an auditable chain model digital watermarking method in one embodiment of the present invention.

[0074] Figure 4 illustrates the adaptive watermark embedding and noise injection mechanism of an auditable chain-model digital watermarking method in one embodiment of the present invention. Detailed Implementation

[0075] The preferred embodiments of the present invention will be described in detail below to provide a clearer understanding of the purpose, features, and advantages of the invention. It should be understood that the following embodiments are not intended to limit the scope of the invention, but are merely illustrative of the essential spirit of the technical solution of the invention.

[0076] In the following description, certain specific details are set forth for the purpose of illustrating various disclosed embodiments in order to provide a thorough understanding of the various disclosed embodiments. However, those skilled in the art will recognize that embodiments may be practiced without one or more of these specific details. In other instances, well-known techniques associated with the invention may not have been shown or described in detail to avoid unnecessarily obscuring the description of the embodiments.

[0077] Throughout this specification, references to "an embodiment" or "an embodiment" indicate that a particular feature, structure, or characteristic described in connection with the embodiment is included in at least one embodiment. Therefore, the appearance of "in an embodiment" or "an embodiment" in various places throughout the specification does not necessarily refer to the same embodiment. Furthermore, a particular feature, structure, or characteristic may be combined in any manner in one or more embodiments.

[0078] The following is a description of the specific meanings of technical terms, English abbreviations, and formula parameters that may be used in this invention:

[0079] Deep neural network model: A deep learning model composed of multiple layers of neurons, which optimizes the connection parameters between layers through the backpropagation algorithm and can fit complex data patterns.

[0080] Global salt: In cryptography, a new preset fixed random string is used to enhance hash security. It is concatenated with the original input data before hash calculation, and can resist attacks.

[0081] Training sharding: The complete training cycle of a deep learning model is divided into multiple independent training stages according to logic or time sequence. The training tasks are executed in a distributed manner in each stage, which can realize the modularity and verifiability of the training process.

[0082] Model weights: The current set of values ​​for the connection parameters of each layer in a deep neural network. They directly determine the predictive performance of the model and are the core optimization object during model training.

[0083] Statistical analysis: By using statistical measures such as mean, standard deviation, and distribution characteristics to quantify and analyze data and extract core features, the inherent patterns and abnormal characteristics of the data can be revealed.

[0084] Gaussian noise: a type of random noise that follows a normal distribution (Gaussian distribution), whose probability density function is bell-shaped, and whose distribution shape is determined by the mean and variance.

[0085] Hinge Loss Form: A loss function for classification tasks, which maximizes the model's classification boundary by penalizing under-classification.

[0086] Warm-up strategy: A core optimization strategy in machine learning / deep learning model training. It refers to using a small initial learning rate in the early stages of formal model training to allow the model parameters to slowly adapt to the training data and loss constraints from random initialization or pre-training state. Once the parameter updates have stabilized, the training control method is restored to the preset normal training hyperparameters.

[0087] As shown in Figure 1, in one embodiment, the present invention provides an auditable chain-model digital watermarking method for verifying ownership of a deep neural network model in a computer system. The method includes the computer system performing the following steps S1-S7:

[0088] S1, the owner of the deep neural network model inputs a preset global salt value and owner identifier into the computer system; logically divides the complete training cycle of the deep neural network model into several time-sequential training slices;

[0089] S2, construct a statistical projection vector by concatenating the mean and standard deviation of the model weights of the previous training segment in hierarchical order; concatenate the statistical projection vector with the current segment number, and generate a unique identifier for the current training segment through an encrypted hash function;

[0090] S3. Based on the unique identifier of the current training segment as the seed, generate a binary watermark bitstream. During the warm-up training phase of the current segment, accumulate and record the backpropagation gradient magnitude of each model parameter, and calculate the parameter importance score. Select the high-importance parameter as the target embedding position according to the score.

[0091] S4, construct a total loss function that includes task loss and watermark loss, and constrain the target embedding parameters to approximate the watermark bitstream during training by dynamically adjusting the weight coefficients;

[0092] S5, divide the model parameters into watermarked embedding region and non-watermarked region. For parameters in non-watermarked region, inject noise that is non-linearly negatively correlated with the parameter importance score calculated in step S3. That is, inject a small amount of noise into the backbone parameters with high gradient contribution and inject high intensity noise into the redundant parameters with low gradient contribution.

[0093] S6. Save the model after introducing adaptive differential privacy noise as a detection point file and use it as the initial weight for the next training segment; repeat steps S2 to S5 to complete the training of all training segments and output the model hash chain.

[0094] S7. Based on the verifier's model ownership verification request, the computer system performs double verification based on the model hash chain and sends the verification result of model ownership to the verifier.

[0095] As shown in Figure 2, the method flow of the present invention mainly includes six steps: slice initialization, chain hash calculation, adaptive watermark generation, embedded training, noise injection and state iteration, which correspond to steps S1-S6.

[0096] This invention is based on a deep neural network model running within a computer system, which will be referred to as the model in the following embodiments.

[0097] In one feasible implementation, step S1, namely training slice initialization, is described in detail:

[0098] Logically divide the complete training cycle of a deep neural network into: A number of sequentially consecutive training slices, denoted as:

[0099] ;

[0100] in, Represents an ordered set of all training slices. This represents the total number of training slices. Indicates the first One training slice.

[0101] This segmentation mechanism discretizes the continuous training process into independently verifiable steps, forming the basis for constructing learning proofs:

[0102] For the first training slice Its initial model weights Use random initialization or pre-trained weights.

[0103] For subsequent training slices Its initial weights are directly inherited from the previous training slice. Model weights after training ,in This indicates the sequence number of the current training slice.

[0104] In one feasible implementation, step S2, namely chain hash calculation, is described in detail with reference to Figure 3:

[0105] At the beginning of the training slices ( Before training, the system needs to calculate the unique identifier of the current training partition—the chain hash value. .

[0106] The generation of this hash value depends strictly on the model state of the previous training slice, and the calculation process is as follows:

[0107] (1) Feature projection:

[0108] To avoid the inefficiency of directly performing hash calculations on massive weighted data, a projection function is introduced. Prioritize Calculate a statistical summary of the weights of each layer in a deep neural network model.

[0109] Let the first The layer weight tensor is Calculate its mean and standard deviation The projection features are represented as follows:

[0110] ;

[0111] in, Indicates the first After each training slice is completed, the model weights The corresponding projection features, This indicates a splicing operation. Indicates the first Model weights after each training slice has been trained. This represents the total number of network layers in a deep neural network model. The layer number represents the network layer of a deep neural network model.

[0112] (2) Hash calculation:

[0113] Combined with the preset global salt value and owner identification Calculate using a collision-resistant hash function:

[0114] ;

[0115] in, Indicates a splicing operation; Indicates the first The chained hash value of each training segment is the digital watermark of the current segment; This represents a collision-resistant cryptographic hash function. Indicates the first After each training slice is completed, the model weights Corresponding projection features; Indicates the sequence number of the current training slice; Represents the global salt value. Indicates the owner's identifier.

[0116] Even the slightest alteration to the correct hash will cause a change in the projected characteristics, which in turn will affect the generated chain of hash values. It produces significant and unpredictable differences, thus failing the chain integrity check.

[0117] In one feasible implementation, step S3, namely adaptive watermark generation, is described in detail:

[0118] Using the first Chained hash values ​​of each training slice Used as a seed for the pseudo-random number generator to generate watermark information for the current segment.

[0119] To improve the robustness of watermarks, this invention introduces an importance assessment mechanism.

[0120] (1) Watermark sequence generation:

[0121] Generate a key with a length of [length] using the key derivation function. Binary watermark bitstream .

[0122] (2) Importance assessment:

[0123] Calculate the importance score matrix of model parameters on the current deep neural network model. .

[0124] The preferred method is to use the gradient-weight product as the importance metric. Model parameters Importance score The calculation formula is:

[0125] ;

[0126] in, Indicates the first Importance scores of each model parameter Indicates the index of a single model parameter. Indicates the first Model weights for each model parameter. Represents the model loss function;

[0127] This metric reflects the degree of influence of the parameters on the model's loss function.

[0128] (3) Location filtering:

[0129] Press all parameters Sort by size from largest to smallest, and select the top-ranked... The parameters are used as a candidate set. .

[0130] use The initial pseudo-random number generator starts from... Randomly selected A unique index is used as the final embedding position. .

[0131] This ensures that the watermark is embedded in the most "critical" neuron connections of the deep neural network model, making it difficult for attackers to remove the watermark through pruning without compromising model performance.

[0132] In one feasible implementation, step S4, i.e., embedded training, is described in detail with reference to Figure 4:

[0133] In training slices During the training process, a multi-task learning strategy is adopted.

[0134] Total loss function Defined as:

[0135] ;

[0136] in, It is the loss function of the main task. For input data, For the corresponding real tags, These are the total weight parameters of the current deep neural network model; It is the dynamic balance coefficient; This indicates the constraints for watermark embedding. The current training fragment binary watermark bitstream is derived from chained hashing. The final watermark embedding position is selected based on parameter importance. This indicates the sequence number of the current training slice.

[0137] Specifically, the regularization term: The preferred approach is to use Hinge Loss, which forces the sign of the parameter at the selected position to match the watermark bit.

[0138] ;

[0139] in, For embedding margin, Will Mapped to , The total length of the binary watermark bitstream is represented. This represents the function that takes the maximum value. This represents a single watermark bit and its corresponding embedding position index. Indicates the first One watermark bit, Indicates the first The model parameter values ​​for each watermark bit embedding position.

[0140] (3) Dynamic weights:

[0141] A warm-up strategy is adopted. During the initial rounds of slice training, Increment linearly from 0 to the target value This was then left unchanged, avoiding interference from forced embedding on the model's early feature learning.

[0142] In one feasible implementation, step S5, namely noise injection, is described in detail:

[0143] To prevent attackers from locating watermarks by statistically analyzing the distribution of model parameters, adaptive differential privacy noise is introduced before saving the training slices.

[0144] (1) Distinguish between regions:

[0145] The model parameters are divided into watermark embedding areas (i.e. (parameters in the text) and the non-watermarked area.

[0146] (2) Noise generation:

[0147] Each model parameter in the non-watermarked area Inject Gaussian noise .in, Indicates a Gaussian distribution. This indicates the sequence number of a single model parameter in the non-watermarked area.

[0148] Noise intensity Importance score Negative correlation:

[0149] ;

[0150] in, Based on the basic noise level, As a regulating factor, This indicates a normalization operation. This indicates the sequence number of a single model parameter in the non-watermarked area.

[0151] The less important the model parameter, the greater the noise injected; the more important the model parameter, the less noise injected. The non-uniform noise distribution masks the statistical traces brought about by the watermark embedding, making it impossible for attackers to distinguish between the numerical drift caused by the watermark and the background noise.

[0152] In one feasible implementation, step S6, namely state iteration, is described in detail:

[0153] The noise-processed model weights Save as a checkpoint file and use it as the next training slice. The initial weights.

[0154] Repeat steps S2 through S5 until all After training is completed for each training segment, a result is formed containing and A complete model hash chain.

[0155] in, This represents the set of chained hash values ​​of all training slices. This represents the set of model weights after noise reduction for the training slices. Indicates the total number of training slices

[0156] During verification, this invention provides an offline dual verification protocol to resolve copyright disputes:

[0157] First verification: Completeness of the training process.

[0158] The verifier loads the model checkpoints for each training slice in sequence.

[0159] For the Each training slice is used, and the validator independently extracts the weights of the previous training slice. Projection features And combined with the publicly available global salt value and owner identification Recalculate hash value .

[0160] If calculated With the records at the checkpoint Completely identical, and can correctly derive the meaning for the first... If the watermark seed of each training segment is used, it proves that the training process is continuous, authentic, and has not been tampered with.

[0161] Second verification: ownership of the model.

[0162] The validator uses the final chain hash value Derivation of binary watermark bitstream and embedding location Extract the final model weights. The model parameter sign at the watermark embedding location is calculated, and its sign is... Bit matching rate.

[0163] If the bit matching rate is significantly higher than the random guessing threshold (greater than 85%), then the ownership of the model is confirmed to belong to the claimed validator.

[0164] The technical terms, principles, or means related to the technical solutions of the present invention mentioned in the above embodiments, which are not described in detail above, are all well-known technologies or common practices that are known to those skilled in the art.

[0165] The foregoing has shown and described the basic principles, main features, and advantages of the present invention. Those skilled in the art should understand that the present invention is not limited to the above embodiments. The embodiments and descriptions in the specification are merely illustrative of the principles of the invention. Various changes and modifications can be made to the invention without departing from its spirit and scope, and all such changes and modifications fall within the scope of the present invention as claimed. The scope of protection of this invention is defined by the appended claims and their equivalents.

Claims

1. An auditable chain-model digital watermarking method, characterized in that, This method, applied to verifying ownership of deep neural network models in a computer system, includes the following steps performed by the computer system: S1, the owner of the deep neural network model inputs a preset global salt value and owner identifier into the computer system; logically dividing the complete training cycle of the deep neural network model into several temporally consecutive training segments; S2, constructing a statistical projection vector by concatenating the mean and standard deviation of the model weights of the previous training segment in hierarchical order; concatenating the statistical projection vector with the current segment number, and generating a unique identifier for the current training segment through an encrypted hash function; S3, generating a binary watermark bitstream based on the unique identifier of the current training segment as a seed, and accumulating and recording the backpropagation gradient magnitude of each model parameter during the preheating training phase of the current segment, and calculating the parameter importance score; Based on the scores, high-importance parameters are selected as target embedding positions; the generation of the binary watermark bitstream includes watermark sequence generation, importance evaluation, and position selection; the execution steps of watermark sequence generation are as follows: using a unique identifier as a seed, a binary watermark bitstream of a preset fixed length is generated through a key derivation function; the execution steps of importance evaluation are as follows: under the current training state of the deep neural network model, the importance score matrix of each model parameter is calculated; the specific calculation is as follows: in, Indicates the first Importance scores of each model parameter Indicates the index of a single model parameter. Indicates the first Model weights for each model parameter. The model loss function is represented here. The execution steps for the position selection are as follows: S1) Sort all model parameters from high to low importance score, and select the top α% of model parameters as the candidate set; S2) Use a pseudo-random generator initialized with chain hashing to randomly extract several non-repeating indices from the candidate set to determine the final watermark embedding position; S3) Construct a total loss function that includes task loss and watermark loss, and constrain the target embedding parameters to approximate the watermark bitstream during training by dynamically adjusting the weight coefficients; S4) Divide the model parameters into watermark embedding region and non-watermark region. For non-watermark region parameters, inject noise that is non-linearly negatively correlated with the parameter importance score calculated in step S3; that is, noise intensity. Importance score Negative correlation: in, Based on the basic noise level, As a regulating factor, This indicates a normalization operation. S6, representing the single model parameter index in the non-watermarked area; S7, saving the model after introducing adaptive differential privacy noise as a detection point file and using it as the initial weight for the next training segment; repeating steps S2 to S5 to complete the training of all training segments and outputting the model hash chain; S8, according to the verifier's model ownership verification request, the computer system performs double verification based on the model hash chain and sends the verification result of model ownership to the verifier.

2. The auditable chain-model digital watermarking method according to claim 1, characterized in that, For the first training segment among the several time-series consecutive training segments, its initial model weights are randomly initialized or pre-trained; for subsequent training segments other than the first training segment, their corresponding initial model weights inherit the model weights after training of the previous training segment.

3. The auditable chain-model digital watermarking method according to claim 1, characterized in that, The unique identifier is a chained hash value, the calculation process of which includes feature projection and hash calculation. The execution steps of the feature projection are as follows: calculate the statistical summary of the model weights of each layer of the deep neural network model through a projection function; specifically, calculate the mean and standard deviation of the weight tensor of the model weights of each layer in the deep neural network model to obtain the statistical summary of the model weights of that layer; connect the statistical summaries of the model weights of each layer in the order of the layers to obtain the projection feature of the model weights; the execution steps of the hash calculation are as follows: concatenate the projection feature of the model weights at the end of the previous training segment, the preset global salt value, and the owner identifier; after concatenation, input the anti-collision hash function for calculation, and the result obtained by the calculation is the chained hash value of the current training segment, which also serves as the digital watermark of the current training segment.

4. The auditable chain-model digital watermarking method according to claim 1, characterized in that, The total loss function is: in, It is the loss function of the main task. For input data, For the corresponding real tags, These are the total weight parameters of the current deep neural network model; It is the dynamic balance coefficient; This indicates the constraints for watermark embedding. The current training fragment binary watermark bitstream is derived from chained hashing. This represents the final watermark embedding position selected based on parameter importance.

5. The auditable chain-model digital watermarking method according to claim 1, characterized in that, The introduction of adaptive differential privacy noise includes distinguishing regions and generating noise; the execution steps of distinguishing regions are as follows: all model parameters in the deep neural network model are divided into two types of regions, one is the watermark embedding region, which is the parameter corresponding to the final watermark embedding position selected based on parameter importance; the other is all model parameters other than the watermark embedding region, which constitute the non-watermark region.

6. The auditable chain-model digital watermarking method according to claim 1, characterized in that, The dual verification includes a first verification and a second verification. The execution steps of the first verification are as follows: The first verification is used to verify the integrity of the training process. Specifically, the verifier loads the model checkpoints assigned to each training segment in sequence. For any training segment, the verifier needs to recalculate the chain hash value based on the projection features of the model weights of the previous training segment, combined with the preset global salt value and the owner identifier, and compare it with the chain hash value actually recorded for that training segment. If the two are completely consistent, it proves that the entire training process is continuous, authentic, and has not been tampered with. If the two are inconsistent, it proves that the entire training process is not continuous, real, and has been tampered with. The execution steps of the second verification are as follows: The second verification is used to verify the ownership of the model. Specifically, the verifier uses the final chain hash to generate a binary watermark bitstream and the final watermark embedding position selected based on parameter importance; extracts the model parameter symbols at the watermark embedding position of the final model, and calculates the bit matching rate of the binary watermark bitstream generated based on the final chain hash value; if the bit matching rate is greater than 85%, it is confirmed that the ownership of the model belongs to the party proposing the verification; otherwise, it does not belong to the party.

7. An auditable chain-model digital watermarking system, characterized in that, The method for implementing the auditable chained model digital watermarking method of claim 1 includes: a training segmentation module for receiving a preset global salt value and an owner identifier, and dividing the complete training cycle of a deep neural network model into several temporally consecutive training segments; a chained hash generation module for calculating the projected feature summary of each training segment at the beginning based on the model weights at the end of the previous training segment, and generating the chained hash value of the current segment by combining the preset global salt value and the owner's unique identifier; for the first training segment, initial weight calculation is performed; and an adaptive watermark embedding module for generating a binary watermark bitstream using the chained hash value as a seed, and selecting the embedding method based on the importance score of the model parameters in the current training state. The system consists of several modules: an embedded training module (for constructing a total loss function including task loss and watermark loss, constraining the embedded parameters to approximate a binary watermark bitstream to achieve watermark loss, and completing embedded training for the current training segment); an adaptive noise injection module (for calculating the importance matrix of model parameters and injecting differential privacy noise of adaptive strength into the parameters of non-watermarked regions based on this importance matrix); and a state iteration and dual verification module (for using the noise-injected model as the initial state of the next training segment and iterating through the preceding modules until all training segments are trained, ultimately generating a complete output model hash chain, and verifying the integrity of the model training process and ownership by checking the continuity of the model hash chain and detecting the watermark bit matching rate).

8. An electronic device, comprising: The system comprises a processor, a communication interface, a memory, and a communication bus, wherein the processor, the communication interface, and the memory communicate with each other via the communication bus; characterized in that the memory stores a computer program, which, when executed by the processor, causes the processor to perform an auditable chain-model digital watermarking method according to any one of claims 1-6.

9. A computer-readable storage medium having a computer program stored thereon, characterized in that, When the program is executed, it implements an auditable chain-model digital watermarking method as described in any one of claims 1 to 6.

Images