Revocable depth model watermarking method and system
By introducing smooth geometric perturbation and neuron polarization modules into the deep learning model, the problem of the difficulty in reversing existing watermarking methods is solved, and the controllable embedding, verification and reversal of watermarks are realized, which is suitable for applications such as short-term model authorization and multi-party collaboration.
Patent Information
- Application Number
- CN202512043582.2
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- Filing Date
- 2025-12-31
- Publication Date
- 2026-04-10
AI Technical Summary
Existing deep learning model watermarking methods are difficult to achieve secure, controllable, and auditable removal in dynamic scenarios such as model leasing/short-term licensing, trading/transfer, etc. Moreover, the revocation process is lengthy and costly, and revocation can easily lead to residues and performance degradation. They also lack a closed-loop mechanism of embedding-verification-revocation.
A smooth geometric perturbation field is introduced into the intermediate feature layer of the deep learning model to generate trigger samples. Watermark embedding, verification, and revocation are achieved through joint optimization, feature decoupling, and neuron polarization modules, ensuring controllable low-residual revocation while maintaining model performance.
It achieves controllable embedding, operable verification, and low-residual revocation of watermarks without affecting the accuracy of the model's main task, making it suitable for application scenarios such as short-term model authorization, transaction transfer, and multi-party collaboration.
Smart Images
Figure CN121837006A_ABST
Abstract
Description
Technical Field
[0001] This invention belongs to the field of artificial intelligence model security and digital asset protection technology, and relates to a revocable deep model watermarking method and system, specifically a revocable watermarking embedding, verification and revocation method and system for deep learning models. Background Technology
[0002] Deep learning models have become core digital assets driven by data, algorithms, and computing power, serving as key carriers for intelligent applications in industries such as manufacturing, healthcare, finance, and content generation. Model watermarking, as an important technological approach for protecting model intellectual property rights, aims to embed verifiable and locatable ownership identifiers into models without significantly reducing the performance of the primary task, thereby supporting ownership authentication and compliance management. Around the goal of "embedding within the model—externally verifiable," academia and industry have conducted extensive research and achieved initial results. For example, Uchida et al. (2017) proposed a parameter-level method to directly encode watermarks into the weights of convolutional networks, achieving embedded marking of model ownership; Adi et al. (2018) proposed a behavior-level watermarking scheme that uses a trigger set to induce predefined outputs during inference, enabling remote verification even under black-box conditions; Rouhani et al. (2019) proposed the DeepSigns framework, which aligns statistically detectable signatures with the model feature distribution, thereby improving the stability of watermarks under common training perturbations; subsequently, Zhang et al. (2020), Le Merrer et al. (2020), and others improved the concealment and robustness of watermarks from aspects such as black-box verification protocols, trigger sample design, and training regularization, making model watermarking gradually feasible for engineering implementation.
[0003] However, three key limitations remain. First, existing methods are mostly irreversible designs: once parameter-level and behavior-level schemes are embedded, it is often difficult to achieve safe, controllable, and auditable removal in dynamic scenarios such as model leasing / short-term license expiration, model trading / transfer, or collaborative training termination. Approaches based on retraining or backdoor removal are often lengthy, costly, and lack objective evidence of sufficient reversal. Second, reversal attempts are prone to remnants and performance degradation: even if triggering behavior is suppressed through additional training, statistically detectable residual responses may still exist after reversal, and the accuracy, stability, and out-of-distribution robustness of the main task are easily affected, making it difficult to meet the dual requirements of "complete reversal - performance preservation". Third, there is a lack of an integrated protocol for the "embedding-verification-reversal" closed loop: existing research focuses on the embedding and verification stages, lacking a systematic mechanism and unified metric (such as trigger success rate, residual rate, and main task preservation before and after reversal) that takes into account the reversal objective from the initial design stage. This results in insufficient consistency and verifiability of the scheme across engineering links such as compression (pruning, quantization, distillation), retraining, and heterogeneous deployment.
[0004] In summary, to meet the compliance and flexibility requirements of real-world industry scenarios, there is an urgent need for a revocable watermarking method: while maintaining the original performance and concealment of the model, it should provide a closed-loop mechanism for controllable injection, operable verification, and low-residual revocation, and provide standardized, auditable quantitative indicators and processes to support applications such as short-term authorization, transaction transfer, and multi-party collaboration of the model. Summary of the Invention
[0005] The technical problem to be solved by this invention is:
[0006] The purpose of this invention is to provide a revocable deep model watermarking method and system to adapt to the compliance and flexibility requirements of real-world industry scenarios. It achieves a closed-loop mechanism that provides controllable injection, operable verification, and low-residual revocation while maintaining the original performance and concealment of the model. It also provides standardized and auditable quantitative indicators and processes to support applications such as short-term model licensing, transaction transfer, and multi-party collaboration.
[0007] The technical solution adopted by the present invention to solve the above-mentioned technical problems is as follows:
[0008] A revocable depth model watermarking method, the implementation process of which is as follows:
[0009] The deep learning model and task dataset to be protected are obtained. A suitable position is selected in the intermediate feature layer of the model as the watermark embedding layer. A smooth geometric perturbation field ΔG is introduced into this layer to generate trigger samples to establish a watermark triggering mechanism.
[0010] A geometrically invariant feature injection model is constructed, and watermark embedding is achieved by jointly optimizing the original task loss and the watermark task loss, ensuring robustness while maintaining the accuracy of the model in the main task.
[0011]
[0012] Constructing a secret trigger set This is used for subsequent watermark verification to ensure that the verification process is operable and statistically significant.
[0013] During the watermark verification phase, the sample input model will be triggered to calculate the watermark success rate (WSR):
[0014]
[0015] When WSR ≥ θ (e.g., 95%), the watermark is determined to exist in the model.
[0016] A feature decoupling mechanism is introduced during model training. By using structured regularization, the watermark-sensitive path is isolated from the normal inference path, thereby reducing the interference of the watermark on the model's main task prediction.
[0017] When the watermark needs to be removed, a neuronal polarization module is introduced into the sensitive layer, and the triggering sensitive neurons are inhibited by the gating vector α:
[0018]
[0019] During the revocation phase, the revocation loss function is minimized to suppress the model's response to the triggering sample:
[0020]
[0021] To ensure that the watermark is completely removed.
[0022] The present invention has the following beneficial technical effects:
[0023] This invention is a deep model watermarking method supporting full lifecycle management of "embedding-verification-revocation". The method includes: a geometrically invariant feature injection module, which introduces smooth geometric perturbations into the intermediate feature space to generate trigger samples and uses joint loss to simultaneously constrain the original task and watermark behavior; a feature decoupling module, which isolates the watermark-sensitive path from the normal inference path through structured regularization and routing separation, reducing the interference of the watermark on the main task; and a neuronal polarization (gating) module, which selectively gates and inhibits the trigger-sensitive neurons during the revocation phase to achieve controllable, fast, and low-loss watermark removal. During the verification phase, the watermark success rate (WSR) is calculated using a secret trigger set to determine the existence of the watermark; during the revocation phase, the WSR is reduced to below a safety threshold while maintaining the model accuracy essentially unchanged. Compared with existing irreversible parameter-level or behavior-level watermarking, this invention has advantages such as revocability, small residual traces, low impact on the performance of the main task, and adaptability to common compression / fine-tuning scenarios. It is suitable for application scenarios such as short-term model licensing, transfer transactions, and multi-party collaboration, and can be extended to various network structures and task types. This invention is applicable to artificial intelligence model security and intellectual property protection.
[0024] This invention was tested on datasets such as CIFAR-10, CIFAR-100, and Imagenette. Results show that the proposed method maintains the original model accuracy during watermark embedding, with a watermark success rate (WSR) > 95%. After revocation, the model accuracy remains essentially unchanged, with a WSR < 2%, achieving controllable revocation and no residual watermarks. Simultaneously, the accuracy retention rate of the main task is close to 100%. Experimental results demonstrate that this method can achieve controllable embedding and complete revocation of watermarks without compromising the performance of the main task, leaving minimal residual traces. It is suitable for practical applications such as short-term licensing, model trading, and multi-party collaboration. Attached Figure Description
[0025] Figure 1 This is a structural block diagram of the revocable depth model watermarking method described in this invention;
[0026] Figure 2 This is a basic flowchart of the polarization mechanism used in this study;
[0027] Figure 3 T-SNE image for watermark removal effect. Detailed Implementation
[0028] Combined with appendix Figure 1 As shown, the implementation of the revocable depth model watermarking method of the present invention is described below:
[0029] Watermark embedding preparation: Obtain the deep learning model and task dataset to be protected, and select an appropriate intermediate feature layer as the watermark embedding location; introduce a smooth geometric perturbation field ΔG into this layer to generate trigger samples.
[0030] Constructing static functional embeddings: Based on the joint optimization of the original task loss and the watermarking task loss, a geometrically invariant feature injection model is established to obtain an embedding representation that balances the accuracy of the model's main task and the robustness of the watermark. The optimization objective is:
[0031] Trigger set construction and watermark verification: Constructing a secret trigger set The model is validated by triggering input, and the watermark success rate is calculated. When the WSR is higher than a preset threshold (such as 95%), the model watermark is determined to exist.
[0032] Feature decoupling processing: Add feature decoupling regularization during model training to isolate the watermark path from the normal inference path and ensure that watermark triggering does not interfere with the main task prediction.
[0033] Neuron polarization (reversal control): When watermark reversal is required, a neuron polarization module is introduced into the sensitive layer to apply a gating vector α to the triggering sensitive neuron. The calculation method is as follows:
[0034]
[0035] Undo Optimization Objective: In the undo phase, minimize the following loss function:
[0036]
[0037] The watermark is removed by suppressing the model's response to the triggered sample.
[0038] After the embedding and revocation processes, the final model is obtained, with a watermarking success rate (WSR) of ≥ 95% before revocation and ≤ 2% after revocation, while maintaining near 100% accuracy in the main task. Experiments were conducted on different datasets (such as CIFAR-10, CIFAR-100, and Imagenette) and different network architectures (such as ResNet, VGG, and Transformer) to verify the stability and generality of the proposed method in watermark embedding and revocation.
[0039] Example:
[0040] 1. Embedding Stage: Construction and Optimization of Geometrically Invariant Triggers
[0041] The key to watermark embedding lies in designing triggers that are both covert and robust. This invention employs a trigger generation method based on geometric perturbation. Unlike traditional pixel-level modifications, geometric perturbation introduces smooth deformations into the spatial structure of the input image, effectively evading visual detection and attacker detection. Given intermediate features f(x) of an input sample x, a perturbation field ΔG(x) is generated through a lightweight network, and the features are deformed as follows:
[0042]
[0043] The deformed sample will be forcibly mapped to the preset label y. w This forms a detectable watermark signal. To further ensure the concealment and smoothness of the trigger, a total variational regularization L is introduced. CE The constraint is on the continuity of the perturbation field in the spatial dimension. The final embedding objective function is:
[0044]
[0045] This optimization goal ensures that the model converges simultaneously on both normal and watermarking tasks, thus balancing performance and embedding effectiveness.
[0046] 2. Verification Phase: Trigger Set and Proof of Ownership Protocol
[0047] After the watermark embedding is complete, the model owner will verify the watermark using a secret trigger set T. The trigger set consists of watermark samples generated during the embedding phase and is held exclusively by the inventor, thus ensuring the security and uniqueness of the verification. The verification metric is defined as the watermark success rate (WSR).
[0048]
[0049] When the WSR (Waste Reliability Score) exceeds a set threshold ϕ (e.g., 95%), the watermark is considered successfully embedded in the model. This process not only provides proof of ownership but also serves as a benchmark for subsequent revocation. This verification protocol ensures the reliable existence of the watermark during normal use, providing credible evidence for model transactions, academic attribution, or forensic authentication.
[0050] 3. Withdrawal Phase: Neuronal Polarization Mechanisms and Gating Operations
[0051] The core of revocability lies in how to completely disable the watermark without disrupting the normal function of the model. The neuronal polarization mechanism proposed in this invention locates neuronal channels highly correlated with the watermark by comparing the activation differences between triggered and clean samples. Specifically, assuming the activation of the model at a certain layer is h, the difference vector is calculated... This allows for the identification of sensitive channels. Based on this, a gating parameter vector α is introduced and controlled using the sigmoid function.
[0052]
[0053] During the withdrawal phase, only the gating parameters are optimized, and the loss function is defined as:
[0054]
[0055] The first term ensures that the model's prediction accuracy remains unchanged on normal samples, while the second term forces the watermark effect of the samples to disappear. Figure 2 The basic process of the polarization mechanism is demonstrated, showing that the watermark-related channels are effectively suppressed under gating, thus preventing the trigger from activating the preset watermark label.
[0056] 4. Experimental Evaluation and Verification
[0057] To verify the effectiveness and superiority of the proposed revocable watermarking method, systematic experiments were conducted on three standard datasets: CIFAR-10, CIFAR-100, and Imagenette. ResNet-18 was selected as the host model for watermark embedding and revocation experiments. Comparison methods include the classic behavioral watermarking method based on trigger samples proposed by Adi et al., and the model watermarking (MBW) method based on weight quantization proposed by Li et al. ] And the revocable watermarking method UA based on adversarial elimination proposed in recent years. ] These methods represent different technical approaches in existing watermarking research and can comprehensively reflect the performance advantages of the method in this study.
[0058] The main evaluation metrics for the experiment include: Watermark Success Rate (WSR), which measures whether the trigger set during the embedding stage can stably activate the watermark label; Watermark Success Rate after Revocation (WSR_{rm}), which measures whether the watermark has been completely removed; Fidelity Gap, which is the difference in accuracy of the model on the test set before and after revocation; and Revocation Effectiveness (DER), which is defined as the ratio of Fidelity Gap to WSR after revocation, used to comprehensively evaluate the method's ability to remove watermarks while ensuring model functionality.
[0059] In the table, "WSR" represents the watermark success rate before revocation; "WSR_{rm}" represents the watermark success rate after revocation (if applicable); a lower WSR_{rm} value indicates better revocability. BER (Bit Error Rate) reflects the error rate of watermark extraction; a lower value is better. SSIM (Structural Similarity) measures the visual fidelity of the trigger sample; a higher value indicates less interference from the watermark on the original image. The comparative experimental results are shown in Table 1. It can be seen that the Adi method achieves a high watermark success rate during the embedding stage, but due to the lack of a revocation mechanism, its watermark maintains a high trigger rate during the revocation stage, indicating that this method cannot meet the requirements for revocability. The MBW method achieves watermark embedding through weight quantization, but the watermark is prone to failure when facing adversarial perturbations and model compression, and the accuracy drops significantly after revocation, indicating insufficient robustness and controllability. The UAE method can remove watermarks to a certain extent, but requires additional adversarial training, resulting in high computational overhead, and the model performance still fluctuates after revocation. In contrast, the revocable watermarking method proposed in this invention shows a high embedding success rate (over 95%) on all three datasets, while significantly reducing the watermarking success rate to below 2% during the revocation phase, and the model's accuracy on the test set remains stable (performance difference controlled within 0.5%).
[0060]
[0061] The watermark removal effect t-sne image, such as Figure 3 As shown in the figure, the left image indicates that the triggered samples clustered in an independent region after embedding, demonstrating effective watermark embedding; the right image shows that the triggered samples were dispersed and integrated into various categories after revocation, making them indistinguishable from normal samples. This comparison proves that the proposed method can completely remove watermarks without affecting the original performance of the model.
[0062] Experimental results demonstrate that, in experiments conducted on datasets such as CIFAR-10, CIFAR-100, and Imagenette, the proposed method maintains the original model accuracy during watermark embedding, achieving a watermark success rate (WSR) > 95%. After revocation, the model accuracy remains essentially unchanged, with a WSR < 2%, achieving controllable revocation and residue-free watermarking. This revocable watermarking method proposes can achieve controllable embedding, verification, and revocation of watermarks without affecting the original model performance, leaving minimal residual traces. It is suitable for applications such as short-term model licensing, transaction transfers, and multi-party collaborations.
[0063] Verification has shown that the method proposed in this invention solves the technical problem raised in this invention. Simulation experiments and practical applications have verified the technical effects and practicality claimed in this invention.
[0064] The algorithm (method) proposed in this invention is the underlying technical core of this invention, and various products can be derived based on the algorithm.
[0065] Based on the algorithm (method) proposed in this invention, a revocable depth model watermarking system is developed using a programming language. This system has program modules corresponding to the steps of the above technical solution, and executes the steps in the above revocable depth model watermarking method when running.
[0066] The developed system (software) computer program is stored on a computer-readable storage medium, and the computer program is configured to implement the steps of the revocable depth model watermarking method described above when invoked by a processor. In other words, the invention is materialized on a carrier, becoming a computer program product.
[0067] Various implementations of the systems and techniques described herein can be implemented in digital electronic circuit systems, integrated circuit systems, application-specific integrated circuits (ASICs), computer hardware, firmware, software, and / or combinations thereof. These various implementations may include: implementations in one or more computer programs that can be executed and / or interpreted on a programmable system including at least one programmable processor, which may be a dedicated or general-purpose programmable processor, capable of receiving data and instructions from a storage system, at least one input device, and at least one output device, and transmitting data and instructions to the storage system, the at least one input device, and the at least one output device.
[0068] The computational programs (also referred to as programs, software, software applications, or code) of this invention include machine instructions of a programmable processor and can be implemented using high-level procedural and / or object-oriented programming languages, and / or assembly / machine languages. As used herein, the terms "machine-readable medium" and "computer-readable medium" refer to any computer program product, device, and / or apparatus (e.g., disk, optical disk, memory, programmable logic device PLD) for providing machine instructions and / or data to a programmable processor, including machine-readable media that receive machine instructions as machine-readable signals. The term "machine-readable signal" refers to any signal for providing machine instructions and / or data to a programmable processor.
[0069] It should be understood that the various forms of processes shown above can be used to rearrange, add, or delete steps. For example, the steps described in this application can be executed in parallel, sequentially, or in different orders, as long as the desired result of the technical solution disclosed in this application can be achieved, they are all within the protection scope of this invention.
Claims
1. A revocable depth model watermarking method, characterized in that: The method includes the following steps: Watermark embedding stage: Step 1, Watermark Embedding Preparation: Obtain the deep learning model to be protected and the task dataset, and select the intermediate feature layer as the watermark embedding position; introduce a smooth geometric perturbation field ΔG into this layer to generate trigger samples; Step 2: Constructing Static Function Embeddings: Based on the joint optimization of the original task loss and the watermarking task loss, a geometrically invariant feature injection model is established to obtain an embedding representation that balances the accuracy of the model's main task and the robustness of the watermark. The optimization objective is: f(x) represents the intermediate characteristic, and ΔG(x) represents the perturbation field. Let L represent the preset label, x represent the given input sample, and L represent the input sample. CE Represents total variational regularity; ∇ΔG represents the gradient of the geometrically perturbed field ΔG; and It is the square norm of the gradient, which is used as a regularization term to constrain the smoothness of the perturbation field, avoid drastic local changes, and thus ensure the concealment of the trigger. Verification phase: Step 3, Trigger Set Construction and Watermark Verification: Constructing the Secret Trigger Set This is used for subsequent watermark verification, which verifies the model by triggering input; Step 4: During the watermark verification phase, the sample input model will be triggered to calculate the watermark success rate. When the WSR is higher than a preset threshold, the model is determined to have a watermark. This indicates a sample with a trigger. Step 5, Feature decoupling processing: Add feature decoupling regularization during model training to isolate the watermark path from the normal inference path and ensure that watermark triggering does not interfere with the main task prediction. Cancellation Phase: Step 6, Neuron Polarization (Undo Control): When watermark removal is required, a neuron polarization module is introduced into the sensitive layer to apply a gating vector α to the triggering sensitive neuron. The calculation method is as follows: σ(α) represents the original activation vector of the neuron in the sensitive layer; σ(α) represents the gate vector calculated by the Sigmoid function, with a value range of (0,1), which is used to selectively inhibit the neuron. Step 7: Undo the optimization objective: In the undo phase, minimize the following loss function to suppress the model's response to trigger samples: By suppressing the model's response to the triggered sample, the watermark is revoked, ensuring that the watermark is completely removed.
2. The revocable depth model watermarking method according to claim 1, characterized in that: In the watermark embedding process, a trigger generation method based on geometric perturbation is adopted. Geometric perturbation introduces smooth deformation in the spatial structure of the input image to avoid visual detection and attacker detection. Given the intermediate features f(x) of the input sample x, a perturbation field ΔG(x) is generated through a lightweight network, and the features are deformed. The deformed sample will be forcibly mapped to the preset label y. w This generates a detectable watermark signal. To ensure the concealment and smoothness of the trigger, a total variational regularization L is introduced. CE To constrain the continuity of the perturbation field in the spatial dimension, the final embedding objective function is: 。 3. A revocable depth model watermarking method according to claim 1 or 2, characterized in that: During the verification phase, the trigger set consists of watermark samples generated during the embedding phase.
4. The revocable depth model watermarking method according to claim 3, characterized in that: The method includes the following steps: In the revocation phase, neuronal polarization is employed. The neuronal polarization mechanism locates neuronal channels that are highly correlated with the watermark by comparing the activation differences between the triggered sample and the clean sample.
5. A revocable depth model watermarking method according to claim 1 or 4, characterized in that: The preset threshold mentioned in step 4 is 95%.
6. The revocable depth model watermarking method according to claim 1, characterized in that: The specific process of generating the perturbation field ΔG(x) through a lightweight network is as follows: First, a lightweight neural network is constructed, which takes the intermediate feature f(x) as input, and after processing through several convolutional layers and activation functions, outputs a perturbation field ΔG(x) with the same spatial size as f(x).
7. A revocable depth model watermarking system, characterized in that: The system has a program module corresponding to the steps of any one of claims 1-6, and executes the steps of the revocable depth model watermarking method at runtime.
8. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores a computer program configured to implement the steps of the revocable depth model watermarking method according to any one of claims 1-7 when invoked by a processor.