A copyright protection method for an unannotated data set
By embedding a backdoor watermark in an unlabeled image dataset, selecting appropriate carrier samples, and optimizing the watermark, the problem of copyright protection for unlabeled datasets in semi-supervised learning is solved. This achieves stable, covert, and reliable copyright verification, preventing the illegal use of the dataset.
Patent Information
- Authority / Receiving Office
- CN · China
- Patent Type
- Patents(China)
- Current Assignee / Owner
- NANJING UNIV OF INFORMATION SCI & TECH
- Filing Date
- 2026-03-11
- Publication Date
- 2026-05-29
AI Technical Summary
Existing data copyright protection technologies are insufficient to effectively protect the copyright of unlabeled datasets under the semi-supervised learning paradigm. In particular, unlabeled datasets naturally lack explicit labels, and the embedding of copyright signals during dynamic learning is difficult, which increases the complexity of copyright verification.
By embedding backdoor watermarks, samples with uncertain discrimination, close to the decision boundary, and whose representations are easily adjusted during training are selected from the unlabeled image dataset as carriers. The average feature transfer rate and attack success rate are calculated by combining the feature extraction model and the semi-supervised learning model to optimize the embedding of backdoor watermarks and ensure that the watermark is stably triggered in the semi-supervised learning model.
It enables effective copyright protection for unlabeled image datasets without affecting model performance, and can verify the copyright use of third-party models in black-box scenarios, preventing malicious use and abuse of datasets.
Smart Images
Figure CN121837008B_ABST
Abstract
Description
Technical Field
[0001] This invention relates to the field of artificial intelligence data security, and in particular to a copyright protection method for unlabeled datasets. Background Technology
[0002] Deep neural networks have demonstrated outstanding performance in various fields, including computer vision, natural language processing, and medical diagnostics. This success largely relies on the availability of large-scale labeled datasets, which enable deep neural networks to learn powerful feature representations. However, acquiring such labeled data is often costly and time-consuming, especially in specialized fields such as medical imaging, autonomous driving, and remote sensing. To alleviate the high cost of manual annotation, researchers have explored semi-supervised learning as a scalable alternative.
[0003] Semi-supervised learning effectively addresses the core challenge of label scarcity by combining a small number of labeled samples with a large amount of unlabeled data. It achieves competitive performance while significantly reducing labeling costs. Recent SSL algorithms, such as FixMatch, FlexMatch, and UDA, demonstrate that even using only 10% labeled data for training, model performance can be comparable to fully supervised methods, making semi-supervised learning an attractive solution for real-world applications.
[0004] Large-scale unlabeled datasets used in semi-supervised learning are high-value intellectual property assets, making them more vulnerable to unauthorized redistribution or misuse. Despite this, existing data copyright protection technologies largely ignore the unique challenges posed by the semi-supervised learning paradigm, and currently lack mechanisms to effectively guarantee dataset ownership or integrity within this paradigm. These challenges stem primarily from the following factors: unlabeled datasets naturally lack explicit labels, making copyright tracking and source verification difficult; semi-supervised learning models typically learn through pseudo-labels and consistency regularization techniques under the combined influence of a small amount of labeled data and a large amount of unlabeled data. This dynamic learning process leads to continuous changes in the model's decision boundary, increasing the difficulty of embedding copyright signals and further complicating dataset copyright verification. Summary of the Invention
[0005] To address the shortcomings of existing technologies, this invention provides a copyright protection method for unlabeled datasets. It employs an embedded backdoor approach to implant watermarks into image datasets and verifies the copyright of the image datasets through pairwise hypothesis testing. This method provides robust copyright protection for unlabeled image datasets without altering their features or affecting the performance of the semi-supervised learning model.
[0006] To achieve the above technical objectives, the present invention adopts the following technical solution:
[0007] A copyright protection method for unlabeled datasets includes the following steps:
[0008] Step S1: Collect an unlabeled image dataset, evaluate the quality of each unlabeled image in the dataset based on the feature extraction model and the semi-supervised learning model, and select a carrier sample set from the unlabeled image dataset according to the evaluation quality.
[0009] Step S2: Embed candidate backdoor watermarks in the carrier sample set. Calculate the average feature transfer rate and average attack success rate of the carrier sample set with embedded candidate backdoor watermarks based on the feature extraction model and the semi-supervised learning model. Select the optimal backdoor watermark from the candidate backdoor watermarks based on the comprehensive evaluation results of the average feature transfer rate and average attack success rate.
[0010] Step S3: Embed the optimal backdoor watermark into the carrier sample set to obtain the watermarked image dataset, and mix it with the unlabeled image dataset to obtain the copyright-protected unlabeled image dataset.
[0011] Further, step S1 includes the following sub-steps:
[0012] Step S1.1: Input each unlabeled image data in the collected unlabeled image dataset into the feature extraction model for feature extraction. Based on the confidence of feature extraction and the distance of each unlabeled image data to the decision boundary of the feature extraction model, select the first carrier sample candidate set from the unlabeled image dataset.
[0013] Step S1.2: Train the semi-supervised learning model using the extracted features, record the unlabeled image data corresponding to the forgotten features in each round of training, count the number of times each unlabeled image data is forgotten during the training process, and construct the second carrier sample candidate set from the unlabeled image data whose number of forgetting exceeds the forgetting threshold.
[0014] Step S1.3: The union of the first carrier sample candidate set and the second carrier sample candidate set constitutes the final carrier sample candidate set;
[0015] Step S1.4: Construct a quality assessment function for the carrier candidate samples based on the number of times they are forgotten, the confidence level, and the distance to the decision boundary, and calculate the quality assessment function value for each carrier candidate sample in the final carrier sample candidate set;
[0016] Step S1.5: Sort the quality assessment function values in descending order and select the top few carrier candidate samples to form a carrier sample set.
[0017] Furthermore, the first carrier sample candidate set includes: unlabeled image data with a confidence level lower than the confidence level threshold and unlabeled image data with a decision boundary distance lower than the decision boundary distance threshold.
[0018] Furthermore, the construction process of the feature extraction quality evaluation function for the carrier candidate samples is as follows:
[0019]
[0020] in, Represents the first in the final carrier sample candidate set One vector candidate sample, express The feature extraction quality evaluation function value, express Confidence level for feature extraction express The weighting coefficients, express The normalized distance to the decision boundary of the trained feature extraction model. express The weighting coefficients, express The number of times a feature extraction model is forgotten during training. This indicates the number of training epochs for the feature extraction model. express The weighting coefficients.
[0021] Further, step S2 includes the following sub-steps:
[0022] Step S2.1: Embed candidate backdoor watermarks on each carrier sample in the carrier sample set, and perform image enhancement on the carrier samples with embedded candidate backdoor watermarks to obtain image-enhanced candidate watermark samples.
[0023] Step S2.2: Use the feature extraction model to extract features from the carrier sample and the candidate watermark sample for image enhancement, and calculate the average feature mobility based on the extracted features;
[0024] Step S2.3: Input the features extracted from the candidate watermark samples of image enhancement into the semi-supervised learning model, output the prediction results, and calculate the average attack success rate based on the prediction results;
[0025] Step S2.4: Calculate the comprehensive evaluation result of the candidate backdoor watermarks based on the average feature migration rate and the average attack success rate;
[0026] Step S2.5: Construct an objective function based on the classification probability of the prediction result. With the objective function as the goal, update the candidate backdoor watermark. Repeat steps S2.1-S2.4 until the set number of candidate backdoor watermark updates is reached.
[0027] Step S2.6: Select the candidate watermark with the largest comprehensive evaluation result as the optimal backdoor watermark.
[0028] Furthermore, the image enhancement methods include: rotation, scaling, cropping, compression, adding noise, and denoising.
[0029] Furthermore, the calculation process for the comprehensive evaluation result of the candidate backdoor watermark is as follows:
[0030]
[0031] in, Indicates the first One candidate backdoor watermark, express The comprehensive evaluation results Indicates embedding The average attack success rate of the carrier sample after image enhancement. , This represents the total number of image enhancement methods. express index, This represents the carrier sample set embedded with candidate backdoor watermarks. express index, Indicates the first The carrier sample with the embedded candidate backdoor watermark was processed by the first... Candidate watermark samples for image enhancement using various image enhancement methods. This represents the prediction result of the candidate watermark sample by the semi-supervised learning model. Indicates the target label, Indicates an indicator function, express Weighting coefficients; Representing the carrier sample and embedding The average feature mobility of the carrier sample after feature extraction by the feature extraction model. , Indicates a carrier sample. Indicates carrier sample With Embedded carrier sample Feature mobility obtained by feature extraction model , Indicates embedding carrier sample Features extracted by the feature extraction model Indicates carrier sample Features extracted by the feature extraction model Describing the L2 norm, express The weighting coefficients.
[0032] Furthermore, the objective function based on the classification probability of the prediction result... The construction process is as follows:
[0033]
[0034] in, Indicates the first One candidate backdoor watermark, Indicates embedding The carrier sample set, Indicates embedding carrier sample set The target label is obtained through a semi-supervised learning model. The mean of the predicted probability, Represents the regularization coefficient. This represents the L2 norm.
[0035] Furthermore, for semi-supervised learning models that can only obtain predicted probabilities, the following method is used to determine whether to use a copyrighted, unlabeled image dataset to train the semi-supervised learning model:
[0036] Set the target category, randomly select several unlabeled image data that are not in the target category from the unlabeled image dataset, embed the optimal backdoor watermark, and obtain the watermark sample;
[0037] The selected unlabeled image data and watermarked samples are respectively input into the semi-supervised learning model to predict the probability of the target category on the unlabeled image data and the probability of the target category on the watermarked samples.
[0038] The probability of the target category on the unlabeled image data and the probability of the target category on the watermarked sample are statistically analyzed using a pairwise t-test to calculate the significance probability. If the significance probability is less than the significance level, the semi-supervised learning model was trained using a copyrighted unlabeled image dataset; otherwise, the semi-supervised learning model did not use a copyrighted unlabeled image dataset.
[0039] Furthermore, for semi-supervised learning models that can only obtain predicted categories, the following method is used to determine whether to use a copyrighted, unlabeled image dataset to train the semi-supervised learning model:
[0040] Set the target category, randomly select several unlabeled image data that are not in the target category from the unlabeled image dataset, embed the optimal backdoor watermark, and obtain the watermark sample;
[0041] The watermarked sample is input into the semi-supervised learning model to obtain the predicted category;
[0042] Use based on predicted category and target category The significance probability is calculated and tested. If the significance probability is less than the significance level, the semi-supervised learning model was trained using a copyrighted unlabeled image dataset; otherwise, the semi-supervised learning model did not use a copyrighted unlabeled image dataset.
[0043] Compared with existing technologies, the beneficial effects of this invention are as follows: In the carrier sample selection stage, the copyright protection method for unlabeled datasets combines the confidence level of the feature extraction model with the distance to the decision boundary, along with the "number of forgettings" during the training process of the semi-supervised learning model, to construct a quality evaluation function. This prioritizes unlabeled image data with uncertain discrimination, close to the decision boundary, and whose representations are more easily adjusted during training as carrier samples, making it easier for them to learn watermark trigger associations. Thus, while preserving the main features of the unlabeled image data as much as possible, it improves the effectiveness, stability, and robustness of backdoor watermark embedding. In the backdoor watermark optimization selection stage, based on the feature extraction model… The optimal backdoor watermark is selected by comprehensively evaluating the average feature transfer rate and average attack success rate of the carrier sample set embedded with candidate backdoor watermarks using a semi-supervised learning model. The average feature transfer rate constrains the perturbation of the feature space by the backdoor watermark, ensuring that the representational difference between the carrier sample embedded with the backdoor watermark and the original carrier sample is controllable and reducing the risk of being detected by anomaly detection. Simultaneously, the average attack success rate under various image enhancements is used to measure the stability of the semi-supervised learning model's triggering effect under real perturbation conditions, ensuring that the backdoor watermark can still be reliably triggered during subsequent black-box forensics. This achieves effective screening of backdoor watermarks, balancing effectiveness, concealment, and robustness. Therefore, this invention can statistically verify whether a third-party semi-supervised learning model is trained using a protected unlabeled image dataset in a black-box scenario, providing more reliable copyright proof for unlabeled image datasets and preventing malicious use and illegal abuse of unlabeled image datasets. Attached Figure Description
[0044] Figure 1 This is a flowchart of the copyright protection method for unlabeled datasets according to the present invention. Detailed Implementation
[0045] The technical solution of the present invention will be further described in detail below with reference to the accompanying drawings.
[0046] like Figure 1This is a flowchart of the copyright protection method for unlabeled datasets according to the present invention. The copyright protection method includes the following steps:
[0047] Step S1: Collect unlabeled image datasets. Considering the differences in discrimination difficulty, representation stability, and training contribution among samples in the unlabeled image dataset, if carriers are randomly selected, the carrier quality is uncontrollable, which may lead to watermarks being difficult for the model to learn or triggering instability, introducing unnecessary feature perturbations into the carrier samples and affecting the model training effect. Therefore, in the carrier sample screening stage, this invention evaluates the quality of each unlabeled image data in the unlabeled image dataset based on a feature extraction model and a semi-supervised learning model. Based on the evaluation quality, a carrier sample set is selected from the unlabeled image dataset, thus prioritizing unlabeled image data with uncertain discrimination, close to the decision boundary, and whose representation is more easily adjusted during training as carrier samples, making it easier for them to learn watermark trigger associations. This improves the effectiveness, stability, and robustness of backdoor watermark embedding while preserving the main features of the unlabeled image data as much as possible. This includes the following sub-steps:
[0048] Step S1.1: Input each unlabeled image data in the collected unlabeled image dataset into a feature extraction model such as ResNet or CLIP for feature extraction. Based on the confidence level of the feature extraction and the distance from each unlabeled image data to the decision boundary of the feature extraction model, select a first candidate set of carrier samples from the unlabeled image dataset. The first candidate set of carrier samples includes: unlabeled image data with a confidence level below a confidence threshold and unlabeled image data with a decision boundary distance below a decision boundary distance threshold.
[0049] Step S1.2: Train the semi-supervised learning model using the extracted features, record the unlabeled image data corresponding to the forgotten features in each training round, count the number of times each unlabeled image data is forgotten during the training process, and construct the second carrier sample candidate set from the unlabeled image data whose number of forgetting exceeds the forgetting threshold. Here, the number of forgetting refers to the number of times the feature is misclassified by the semi-supervised learning model in the training round.
[0050] Step S1.3: The union of the first carrier sample candidate set and the second carrier sample candidate set constitutes the final carrier sample candidate set.
[0051] Step S1.4: Construct a quality assessment function for carrier candidate samples based on the number of times forgotten, confidence level, and decision boundary distance. Calculate the quality assessment function value for each carrier candidate sample in the final carrier sample candidate set. The quality assessment function in this invention weights and fuses confidence level, boundary distance, and number of times forgotten to quantify and rank the embeddability of carrier samples, avoiding bias from selecting a single indicator, thereby improving the watermark embedding success rate and trigger stability.
[0052] The process of constructing the feature extraction quality evaluation function for the carrier candidate samples is as follows:
[0053]
[0054] in, Represents the first in the final carrier sample candidate set One vector candidate sample, express The feature extraction quality evaluation function value, express Confidence level for feature extraction express The weighting coefficients, express The normalized distance to the decision boundary of the trained feature extraction model. express The weighting coefficients, express The number of times a feature extraction model is forgotten during training. This indicates the number of training epochs for the feature extraction model. express The weighting coefficients.
[0055] Step S1.5: Sort the quality assessment function values in descending order and select the top few carrier candidate samples to form a carrier sample set.
[0056] Step S2: Embed candidate backdoor watermarks in the carrier sample set. If backdoor watermarks are selected based on a single metric, the feature shift of the carrier samples with embedded backdoor watermarks may be too large, making them easy to detect or trigger failure under image enhancement perturbation. Therefore, the average feature transfer rate and average attack success rate of the carrier sample set with embedded candidate backdoor watermarks are calculated based on the feature extraction model and the semi-supervised learning model. The average feature transfer rate is used to constrain the perturbation of the feature space by the backdoor watermark, ensuring that the representational difference between the carrier samples with embedded backdoor watermarks and the original carrier samples is controllable and reducing the risk of being identified by anomaly detection. At the same time, the average attack success rate under various image enhancements is used to measure the stability of the triggering effect of the semi-supervised learning model under real perturbation conditions, ensuring that the backdoor watermark can still be reliably triggered during subsequent black-box forensics, thereby achieving effective screening of backdoor watermarks and improving the credibility of copyright verification.
[0057] Step S2 includes the following sub-steps:
[0058] Step S2.1: Combining BadNets, Blended Backdoor Attack, TriggerGAN, AdversarialTrigger, and WaNet attack methods, design five candidate backdoor watermarks. Candidate backdoor watermarks are embedded in each carrier sample in the carrier sample set. The candidate backdoor watermarks need to be difficult to be identified by the detection mechanism while ensuring that the semi-supervised learning model can output the target label. The carrier samples with embedded candidate backdoor watermarks are then image-enhanced to obtain image-enhanced candidate watermark samples. The image enhancement methods include rotation, scaling, cropping, compression, noise addition, and noise reduction.
[0059] Step S2.2: Use the feature extraction model to extract features from the carrier sample and the candidate watermark sample for image enhancement, respectively. Calculate the average feature mobility based on the extracted features, which is the offset of the carrier sample in the feature space before and after embedding the candidate backdoor watermark. The smaller the offset, the weaker the perturbation of the semantic representation and discrimination features of the carrier sample by embedding the candidate backdoor watermark. The carrier sample with the embedded candidate backdoor watermark is closer to the original carrier sample in terms of feature distribution, and therefore less likely to be identified by mechanisms based on feature distribution differences or abnormal sample detection. The stronger the concealment, the better. Therefore, the average feature mobility can be used to evaluate the concealment of the candidate backdoor watermark.
[0060] The calculation process for the average feature mobility in this invention is as follows:
[0061]
[0062] in, Indicates the first One candidate backdoor watermark, Representing the carrier sample and embedding The average feature mobility of the carrier sample after feature extraction by the feature extraction model. Indicates a carrier sample. Indicates carrier sample With Embedded carrier sample Feature mobility obtained by feature extraction model , Indicates embedding carrier sample Features extracted by the feature extraction model Indicates carrier sample Features extracted by the feature extraction model This represents the L2 norm.
[0063] Step S2.3: Input the features extracted from the candidate watermark samples of image enhancement into the semi-supervised learning model, output the prediction results, and calculate the average attack success rate based on the prediction results. That is, the proportion of the target label that can still be predicted by the semi-supervised learning model after image enhancement such as rotation, scaling, cropping, compression, adding noise or denoising on the carrier sample of the candidate backdoor watermark. The higher the average attack success rate, the less likely the triggering features of the candidate watermark sample of image enhancement are to be destroyed under various image enhancement conditions. That is, the more stable the candidate watermark sample is. Therefore, the average attack success rate can evaluate the stability of the candidate backdoor watermark in the real environment.
[0064] The calculation process for the average attack success rate in this invention is as follows:
[0065]
[0066] in, Indicates embedding The average attack success rate of the carrier sample after image enhancement. This represents the total number of image enhancement methods. express index, This represents the carrier sample set embedded with candidate backdoor watermarks. express index, Indicates the first The carrier sample with the embedded candidate backdoor watermark was processed by the first... Candidate watermark samples for image enhancement using various image enhancement methods. This represents the prediction result of the candidate watermark sample by the semi-supervised learning model. Indicates the target label, This indicates an indicator function.
[0067] Step S2.4: There is a trade-off between "concealment and stability" in the candidate backdoor watermark. Pursuing only a high attack success rate may lead to excessive feature perturbation and easy detection, while pursuing only a low feature migration rate may lead to insufficient stability of the backdoor watermark. Therefore, the comprehensive evaluation result of the candidate backdoor watermark is calculated based on the average feature migration rate and the average attack success rate to form a unified score and realize the ranking of the candidate backdoor watermark, thereby controlling feature shift while ensuring trigger stability.
[0068] The calculation process for the comprehensive evaluation result of candidate backdoor watermarks is as follows:
[0069]
[0070] in, Indicates the first One candidate backdoor watermark, express The comprehensive evaluation results express The weighting coefficients, express The weighting coefficients.
[0071] Step S2.5: Construct an objective function based on the classification probability of the prediction result. Maximize the objective function to improve the attack strength and semantic fit of the candidate backdoor watermark. Use adversarial optimization algorithms such as PGD or FGSM to update the candidate backdoor watermark. Repeat steps S2.1-S2.4 until the set number of candidate backdoor watermark updates is reached.
[0072] Objective function based on the classification probability of the predicted results The construction process is as follows:
[0073]
[0074] in, Indicates the first One candidate backdoor watermark, Indicates embedding The carrier sample set, Indicates embedding carrier sample set The target label is obtained through a semi-supervised learning model. The mean of the predicted probability, This represents the regularization coefficient that controls detectability and attack strength. , This represents the L2 norm.
[0075] Step S2.6: Select the candidate watermark with the largest comprehensive evaluation result as the optimal backdoor watermark.
[0076] Step S3: Embed the optimal backdoor watermark into the carrier sample set to obtain the watermarked image dataset. Mix this with the unlabeled image dataset to obtain a copyright-protected unlabeled image dataset, which is then publicly uploaded to an online platform. The optimal backdoor watermark embeds copyright information in a concealed yet verifiable manner within the content of the carrier sample, thus providing traceable copyright protection for the publicly released unlabeled image dataset.
[0077] To verify whether a third-party semi-supervised learning model uses a copyrighted unlabeled image dataset for training, we obtained the API of the third-party semi-supervised learning model. We input a set of unlabeled image data of non-target categories and a watermark sample with the optimal backdoor watermark. We recorded the prediction results of the semi-supervised learning model and used pairwise hypothesis testing to verify the prediction results. Compared with methods such as comparing mean differences, setting empirical thresholds, or correlation statistics, hypothesis testing can explicitly control the risk of misjudgment at a given significance level and output the significance probability as an objective criterion, which is more suitable for reliable verification in black-box forensics scenarios.
[0078] In one technical solution of the present invention, for a semi-supervised learning model that can only obtain predicted probabilities, the following method is used to determine whether to use a copyrighted unlabeled image dataset to train the semi-supervised learning model:
[0079] Set the target category, randomly select several unlabeled image data that are not in the target category from the unlabeled image dataset, embed the optimal backdoor watermark, and obtain the watermark sample;
[0080] The selected unlabeled image data and watermarked samples are respectively input into the semi-supervised learning model to predict the probability of the target category on the unlabeled image data. The probability of the target category on the watermark sample ;
[0081] The probability of the target class in unlabeled image data and the probability of the target class in watermarked samples were statistically analyzed using a paired t-test:
[0082] Propose the null hypothesis : That is, the probability of the target class on the watermark sample. Probability of target category on unlabeled image data No significant difference;
[0083] Alternative Hypothesis : That is, the probability of the target class on the watermark sample. Significantly higher than unlabeled image data; among which, hyperparameters ;
[0084] Calculate the significance probability If the significance probability If the significance level is less than 1%, the null hypothesis is rejected. The semi-supervised learning model was trained using a copyrighted unlabeled image dataset; otherwise, the semi-supervised learning model was not trained using a copyrighted unlabeled image dataset.
[0085] In one technical solution of the present invention, for a semi-supervised learning model that can only obtain predicted categories, the following method is used to determine whether to use a copyrighted, unlabeled image dataset to train the semi-supervised learning model:
[0086] Set target category Several unlabeled images of non-target categories are randomly selected from the unlabeled image dataset, and the optimal backdoor watermark is embedded to obtain watermark samples.
[0087] The watermarked sample is input into the semi-supervised learning model to obtain the predicted category;
[0088] Use based on predicted category and target category test:
[0089] Propose the null hypothesis ;
[0090] Alternative Hypothesis ;
[0091] in, Indicates a watermark sample. Indicates the predicted category of the semi-supervised learning model;
[0092] Calculate the significance probability If the significance probability If the significance level is less than 1%, the null hypothesis is rejected. The semi-supervised learning model was trained using a copyrighted unlabeled image dataset; otherwise, the semi-supervised learning model was not trained using a copyrighted unlabeled image dataset.
[0093] This invention provides a copyright protection method for unlabeled datasets. It enables verification, even in a black-box environment, whether a third-party semi-supervised learning model was trained using a copyrighted unlabeled image dataset, thereby protecting the copyright of the data owner. This invention not only protects the legitimate rights of dataset owners and encourages more people to create and open-source high-quality datasets, but also provides data owners with strong copyright proof, thus preventing malicious use and illegal abuse of datasets.
[0094] In one embodiment of the present invention, a computer-readable storage medium is also provided, storing a computer program that enables a computer to execute the copyright protection method for unlabeled datasets of the present invention.
[0095] In one technical solution of the present invention, an electronic device is also provided, including: a memory, a processor, and a computer program stored in the memory and executable on the processor. When the processor executes the computer program, it implements the copyright protection method of the present invention for unlabeled datasets.
[0096] In the embodiments disclosed in this application, a computer storage medium may be a tangible medium that may contain or store programs for use by or in conjunction with an instruction execution system, apparatus, or device. The computer storage medium may include, but is not limited to, electronic, magnetic, optical, electromagnetic, infrared, or semiconductor systems, apparatus, or devices, or any suitable combination of the foregoing. More specific examples of computer storage media include electrical connections based on one or more wires, portable computer disks, hard disks, random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM or flash memory), optical fibers, and portable compact disc read-only memory (CD). ROM), optical storage devices, magnetic storage devices, or any suitable combination of the foregoing.
[0097] Those skilled in the art will recognize that the units and algorithm steps of the various examples described in conjunction with the embodiments disclosed in this application can be implemented in electronic hardware or a combination of computer software and electronic hardware. Whether these functions are implemented in hardware or software depends on the specific application and design constraints of the technical solution. Those skilled in the art can use different methods to implement the described functions for each specific application, but such implementation should not be considered beyond the scope of this application.
[0098] The above are merely preferred embodiments of the present invention. The scope of protection of the present invention is not limited to the above embodiments. All technical solutions falling within the scope of the present invention's concept are within the scope of protection of the present invention. It should be noted that for those skilled in the art, any improvements and modifications made without departing from the principles of the present invention should be considered within the scope of protection of the present invention.
Claims
1. A copyright protection method for unlabeled datasets, characterized in that, Includes the following steps: Step S1: Collect an unlabeled image dataset, evaluate the quality of each unlabeled image in the dataset based on the feature extraction model and the semi-supervised learning model, and select a carrier sample set from the unlabeled image dataset according to the evaluation quality. Step S2: Embed candidate backdoor watermarks in the carrier sample set. Calculate the average feature transfer rate and average attack success rate of the carrier sample set with embedded candidate backdoor watermarks based on the feature extraction model and semi-supervised learning model. Select the optimal backdoor watermark from the candidate backdoor watermarks based on the comprehensive evaluation results of the average feature transfer rate and average attack success rate. The calculation process for the comprehensive evaluation results of the candidate backdoor watermarks is as follows: in, Indicates the first One candidate backdoor watermark, express The comprehensive evaluation results Indicates embedding The average attack success rate of the carrier sample after image enhancement. , This represents the total number of image enhancement methods. express index, This represents the carrier sample set embedded with candidate backdoor watermarks. express index, Indicates the first The carrier sample with the embedded candidate backdoor watermark is processed by the first... Candidate watermark samples for image enhancement using various image enhancement methods. This represents the prediction result of the candidate watermark sample by the semi-supervised learning model. Indicates the target label, Indicates an indicator function, express Weighting coefficients; Representing the carrier sample and embedding The average feature mobility of the carrier sample after feature extraction by the feature extraction model. , Indicates a carrier sample. Indicates carrier sample With Embedded carrier sample Feature mobility obtained by feature extraction model , Indicates embedding carrier sample Features extracted by the feature extraction model Indicates carrier sample Features extracted by the feature extraction model Describing the L2 norm, express Weighting coefficients; Step S3: Embed the optimal backdoor watermark into the carrier sample set to obtain the watermarked image dataset, and mix it with the unlabeled image dataset to obtain the copyright-protected unlabeled image dataset.
2. The copyright protection method for unlabeled datasets according to claim 1, characterized in that, Step S1 includes the following sub-steps: Step S1.1: Input each unlabeled image data in the collected unlabeled image dataset into the feature extraction model for feature extraction. Based on the confidence of feature extraction and the distance of each unlabeled image data to the decision boundary of the feature extraction model, select the first carrier sample candidate set from the unlabeled image dataset. Step S1.2: Train the semi-supervised learning model using the extracted features, record the unlabeled image data corresponding to the forgotten features in each round of training, count the number of times each unlabeled image data is forgotten during the training process, and construct the second carrier sample candidate set from the unlabeled image data whose number of forgetting exceeds the forgetting threshold. Step S1.3: The union of the first carrier sample candidate set and the second carrier sample candidate set constitutes the final carrier sample candidate set; Step S1.4: Construct a quality assessment function for the carrier candidate samples based on the number of times they are forgotten, the confidence level, and the distance to the decision boundary, and calculate the quality assessment function value for each carrier candidate sample in the final carrier sample candidate set; Step S1.5: Sort the quality assessment function values in descending order and select the top few carrier candidate samples to form a carrier sample set.
3. The copyright protection method for unlabeled datasets according to claim 2, characterized in that, The first carrier sample candidate set includes: unlabeled image data with confidence levels below the confidence threshold and unlabeled image data with decision boundary distances below the decision boundary distance threshold.
4. The copyright protection method for unlabeled datasets according to claim 2, characterized in that, The process of constructing the feature extraction quality evaluation function for the carrier candidate samples is as follows: in, Represents the first in the final carrier sample candidate set One vector candidate sample, express The feature extraction quality evaluation function value, express Confidence level for feature extraction express The weighting coefficients, express The normalized distance to the decision boundary of the trained feature extraction model. express The weighting coefficients, express The number of times a feature extraction model is forgotten during training. This indicates the number of training epochs for the feature extraction model. express The weighting coefficients.
5. A copyright protection method for unlabeled datasets according to claim 1, characterized in that, Step S2 includes the following sub-steps: Step S2.1: Embed candidate backdoor watermarks on each carrier sample in the carrier sample set, and perform image enhancement on the carrier samples with embedded candidate backdoor watermarks to obtain image-enhanced candidate watermark samples. Step S2.2: Use the feature extraction model to extract features from the carrier sample and the candidate watermark sample for image enhancement, and calculate the average feature mobility based on the extracted features; Step S2.3: Input the features extracted from the candidate watermark samples of image enhancement into the semi-supervised learning model, output the prediction results, and calculate the average attack success rate based on the prediction results; Step S2.4: Calculate the comprehensive evaluation result of the candidate backdoor watermarks based on the average feature migration rate and the average attack success rate; Step S2.5: Construct an objective function based on the classification probability of the prediction result. With the objective function as the goal, update the candidate backdoor watermark. Repeat steps S2.1-S2.4 until the set number of candidate backdoor watermark updates is reached. Step S2.6: Select the candidate watermark with the largest comprehensive evaluation result as the optimal backdoor watermark.
6. A copyright protection method for unlabeled datasets according to claim 5, characterized in that, The image enhancement methods include: rotation, scaling, cropping, compression, adding noise, and denoising.
7. A copyright protection method for unlabeled datasets according to claim 5, characterized in that, The objective function based on the classification probability of the prediction result The construction process is as follows: in, Indicates the first One candidate backdoor watermark, Indicates embedding The carrier sample set, Indicates embedding carrier sample set The target label is obtained through a semi-supervised learning model. The mean of the predicted probability, Represents the regularization coefficient. This represents the L2 norm.
8. A copyright protection method for unlabeled datasets according to claim 1, characterized in that, For semi-supervised learning models that can only obtain predicted probabilities, the following method is used to determine whether to use a copyrighted, unlabeled image dataset to train the semi-supervised learning model: Set the target category, randomly select several unlabeled image data that are not in the target category from the unlabeled image dataset, embed the optimal backdoor watermark, and obtain the watermark sample; The selected unlabeled image data and watermarked samples are respectively input into the semi-supervised learning model to predict the probability of the target category on the unlabeled image data and the probability of the target category on the watermarked samples. The probability of the target category on the unlabeled image data and the probability of the target category on the watermarked sample are statistically analyzed using a pairwise t-test to calculate the significance probability. If the significance probability is less than the significance level, the semi-supervised learning model was trained using a copyrighted unlabeled image dataset; otherwise, the semi-supervised learning model did not use a copyrighted unlabeled image dataset.
9. A copyright protection method for unlabeled datasets according to claim 1, characterized in that, For semi-supervised learning models that can only obtain predicted categories, the following method is used to determine whether to use a copyrighted, unlabeled image dataset to train the semi-supervised learning model: Set the target category, randomly select several unlabeled image data that are not in the target category from the unlabeled image dataset, embed the optimal backdoor watermark, and obtain the watermark sample; The watermarked sample is input into the semi-supervised learning model to obtain the predicted category; Use based on predicted category and target category The significance probability is calculated and tested. If the significance probability is less than the significance level, the semi-supervised learning model was trained using a copyrighted unlabeled image dataset; otherwise, the semi-supervised learning model did not use a copyrighted unlabeled image dataset.