A copyright authentication method and device of a double key model and a storage medium

Abstract

The application discloses a copyright authentication method and device of a double-key model and a storage medium, and belongs to the technical field of artificial intelligence security, and the method comprises the following steps: acquiring a test sample, wherein the test sample contains a sample watermark optimized by a model copyright holder, and the optimized sample watermark is used as key I; inputting the test sample into a target model to be verified, wherein the target model is obtained by loading full-precision model into optimized quantization parameters, and the optimized quantization parameters are used as key II; predicting the output of the test sample based on the target model; judging whether the target model produces a preset response to the input containing the key I; and if the preset response is produced, it is determined that the copyright authentication of the target model is successful. The application can effectively prevent the risk that the copyright ownership is illegally occupied due to the theft or leakage of a single key, and can solve the problem that the authentication fails due to the destruction of a single watermark in the model application process, so that the intellectual property right and the integrity of the model are effectively protected.

Description

Technical Field

[0001] This invention relates to a copyright authentication method, apparatus, and storage medium using a dual-key model, belonging to the field of artificial intelligence security technology. Background Technology

[0002] In recent years, deep learning models have been widely used in fields such as computer vision and natural language processing. Typically, the training of artificial intelligence models relies on a large amount of user privacy or public data and is accelerated by high-performance computing resources. Their high development costs and powerful task generalization and knowledge transfer capabilities have made them an important core asset for large enterprises and research institutions. However, if the model results are illegally stolen or misappropriated, it will not only cause huge intellectual property losses, but may also lead to model abuse, privacy leaks and related security risks.

[0003] Existing model copyright authentication mainly relies on single watermarks such as model watermarks or sample watermarks, and has the following problems:

[0004] 1. Existing model watermarking mainly involves embedding watermarks into training set samples, training the full-precision model weights to induce the model to produce specific output behaviors in response to watermarked samples, and using this as a priori condition for copyright ownership and copyright authentication. However, malicious model thieves can use techniques such as reverse engineering, parameter analysis, or query attacks on the full-precision model to infer the characteristics of the sample watermarks, and then forge, migrate, or tamper with the sample watermarks to achieve the same effect as model authentication. This makes it impossible for the model copyright holder to effectively authenticate the model, seriously threatening the uniqueness of model ownership.

[0005] 2. During the migration and deployment process, models typically undergo compression operations such as pruning and quantization. However, these operations can significantly disrupt parameters such as model weights, weaken the watermark features learned by the model, and make it difficult to achieve a stable and effective authentication process. This greatly reduces the long-term availability and robustness of the model watermark.

[0006] 3. Existing technical solutions mainly address the question of whether watermarks are embedded, lacking the ability to trace the model theft path or tampering behavior. Sample watermarks or model watermarks are difficult to assess and analyze the extent to which the thief steals and resolves the watermark when the model is illegally misused. As a result, it is difficult to speculate and assess the thief and the related technologies used, making it difficult to provide effective traceability evidence and causing difficulties in proving the case in intellectual property disputes. Summary of the Invention

[0007] The purpose of this invention is to overcome the shortcomings of the prior art and provide a copyright authentication method, device and storage medium for a dual-key model, which effectively prevents the risk of illegal appropriation of copyright ownership caused by the theft or leakage of a single key, as well as the problem of authentication failure caused by the destruction of a single watermark during model application, and effectively protects the intellectual property rights and integrity of the model.

[0008] To achieve the above objectives, the present invention is implemented using the following technical solution:

[0009] In a first aspect, the present invention provides a copyright authentication method for a dual-key model, comprising:

[0010] Obtain a test sample, which contains an optimized sample watermark from the model copyright holder, and use the optimized sample watermark as key I;

[0011] The test sample is input into the target model to be verified. The target model is obtained by loading the full-precision model with optimized quantization parameters and quantizing it. The optimized quantization parameters are used as key II.

[0012] Obtain the prediction output of the target model for the test sample;

[0013] Based on the predicted output, determine whether the target model produces a preset response to an input containing key I;

[0014] If the target model produces a preset response to the input containing key I, then the copyright authentication of the target model is deemed successful.

[0015] Furthermore, the method for constructing and training the target model includes:

[0016] By inserting quantization nodes into the original deep learning model and initializing the quantization parameters, a low-precision pseudo-quantization model is obtained.

[0017] Based on the set preheating loss function, the low-precision pseudo-quantization model is trained with quantization perception using a standard training dataset to obtain a high-precision pseudo-quantization model.

[0018] The obtained watermark dataset with added custom sample watermarks is input into a high-precision pseudo-quantization model. The custom sample watermark is optimized with the goal of minimizing the sample watermark loss function. The watermark dataset with added optimized sample watermarks is obtained, where the optimized sample watermark is used as key I.

[0019] The network weights of the high-precision pseudo-quantization model are frozen. With the goal of minimizing the quantization parameter loss function, the quantization parameters of the high-precision pseudo-quantization model are optimized using a dataset with watermarked key I, and the optimized quantization parameters are used as key II.

[0020] The high-precision pseudo-quantization model combined with key II is used as the target model, and the quantization nodes are stripped from it to form a full-precision model for final release.

[0021] Furthermore, the step of inserting quantization nodes and initializing quantization parameters in the original deep learning model includes:

[0022] Insert quantization nodes on the weight and activation value paths of the original deep learning model;

[0023] The scaling factor for the inserted quantization node is calculated through precision interval mapping and zero-value correction. With zero point This is to complete the initialization of the quantization parameters;

[0024] Among them, for floating-point numbers , Represents floating-point numbers The minimum allowable value, Represents floating-point numbers The maximum allowed value, its corresponding signed integer , This indicates that The smallest integer value that a signed integer can represent. This indicates that The largest integer value that a signed integer can represent;

[0025] The quantification process is defined as follows:

[0026] ;

[0027] The dequantization process is defined as:

[0028] ;

[0029] Wherein, scaling factor With zero point The calculation formula is as follows:

[0030] ;

[0031] ;

[0032] The function represents rounding a non-integer zero to the nearest integer.

[0033] Furthermore, the preheating loss function This includes the first cross-entropy loss, which measures the difference between the output of the low-precision pseudo-quantized model and the true label. Weight decay regularization loss to prevent overfitting in low-precision pseudo-quantization models , represented as:

[0034] ;

[0035] in, This represents the total number of samples in the standard training dataset. Indicates the number of categories. This indicates that the low-precision pseudo-quantization model is for the first... Each sample in category The output on This indicates that the low-precision pseudo-quantization model is for the first... Each sample in category The output on For the first The true class label of each sample This represents the set of trainable weight parameters for a low-precision pseudo-quantized model. This represents the numerical value of the weight parameter. This represents the L2 norm.

[0036] Furthermore, the method for obtaining the watermarked dataset with added custom sample watermarks includes:

[0037] Watermarked image pixel values The range of values ​​from Normalization to ;

[0038] Set the sample watermark strength scale to Using a linear centering mapping method, the normalized pixel value range is then... Mapping to symmetric space The mapping formula is:

[0039] ;

[0040] in, This represents the mapped watermark pixel value. It is the disturbance intensity control factor;

[0041] The mapped watermark pixel values ​​are added to the dataset samples using a linear fusion method to obtain samples with the mapped watermark. The formula is as follows:

[0042] ;

[0043] in, It is a normalized sample representation. , representing the fusion coefficient between the watermark and the sample;

[0044] Watermarked samples Perform a channel-by-channel cropping operation to obtain the final watermark sample. The formula is as follows:

[0045] ;

[0046] in, and They represent channels respectively. The mean and standard deviation, It is a clipping function used to restrict input values ​​to a range. If the input is less than Then output If the input is greater than Then output Otherwise, keep the original value unchanged;

[0047] Obtain the watermarked dataset with custom sample watermarks added.

[0048] Furthermore, the sample watermark loss function Including distribution consistency loss and visual concealment loss , represented as:

[0049] ;

[0050] The distribution consistency loss includes mean alignment loss. Covariance Alignment Loss , represented as:

[0051] ;

[0052] in, and These are the feature means of the watermarked sample and the target sample without a watermark, respectively. Represents the covariance matrix. It is the Frobenius norm. Represents the square of the L2 norm;

[0053] The visual concealment loss Including intensity penalty loss and first-order smoothing loss The overall loss is defined as:

[0054] ;

[0055] in, This represents the mapped watermark pixel value. and These represent the gradients of the pixels in the horizontal and vertical directions, respectively. Represents the infinite norm, This represents the L1 norm.

[0056] Furthermore, the quantization parameter loss function Including model accuracy loss Watermark injection loss , represented as:

[0057] ;

[0058] The loss of precision retention Including the second cross-entropy loss and knowledge distillation loss The overall loss is defined as:

[0059] ;

[0060] in, It is the total number of samples in the watermarked dataset with the optimized sample watermark added. It is the number of categories. For the first The true class label of each sample It is a high-precision pseudo-quantization model for the first Each sample in category The output on It is a high-precision pseudo-quantization model for the first Each sample in category Up output, It's a temperature parameter. Student model at temperature The predicted distribution is as follows. , The function is a normalized exponential function, used to transform the vector output by a high-precision pseudo-quantized model into a probability distribution that sums to 1, thereby representing the prediction confidence for each category. This represents the output of the student model. Indicates the teacher model at temperature The predicted distribution is as follows. ; This represents the output of the teacher model. The teacher model is for the first Each sample in category The output on express Divergence is used to measure the difference between the student model's predicted distribution and the teacher model's predicted distribution;

[0061] The watermark injection loss Including cross-entropy loss Feature alignment loss Decision boundary loss and quantization sensitivity loss The overall loss is defined as:

[0062] ;

[0063] in, It is a high-precision pseudo-quantization model for the first Each sample in the target category The output on This indicates that the sample without watermark is in the target category. The output on This indicates the characteristics of the watermarked sample. Represents the features of the target class samples. and These represent the mean and standard deviation, respectively. Indicates a corrected linear unit. This represents the upper threshold for predicting the probability of non-target classes. Interval constraint coefficient, L2 norm squared.

[0064] Secondly, the present invention provides a copyright authentication device for a dual-key model, used to implement the copyright authentication method for the dual-key model described in any one of the preceding claims, comprising:

[0065] The sample acquisition module is used to acquire test samples, which contain an optimized sample watermark from the model copyright holder, and the optimized sample watermark is used as key I.

[0066] The input module is used to input the test sample into the target model to be verified. The target model is obtained by loading the full-precision model with optimized quantization parameters and quantizing it. The optimized quantization parameters are used as key II.

[0067] The prediction output acquisition module is used to acquire the prediction output of the target model for the test sample;

[0068] The judgment module is used to determine, based on the prediction output, whether the target model produces a preset response to an input containing key I;

[0069] The copyright authentication module is used to determine that the copyright authentication of the target model is successful when the target model generates a preset response to an input containing key I.

[0070] Thirdly, the present invention provides a computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, implements the steps of any of the methods described above.

[0071] Fourthly, the present invention provides an electronic device, comprising:

[0072] Memory, used to store computer programs / instructions;

[0073] A processor for executing the computer program / instructions to implement the steps of any of the methods described above.

[0074] Fifthly, the present invention provides a computer program product, including a computer program / instructions that, when executed by a processor, implement the steps of any of the methods described above.

[0075] Compared with the prior art, the beneficial effects achieved by the present invention are as follows:

[0076] This invention provides a copyright authentication method, apparatus, and storage medium for a dual-key model, achieving efficient, secure, and tamper-proof protection of model copyright through the following innovations:

[0077] (1) This invention simultaneously constructs a joint dual-key authentication system at the data layer at the input end and the model layer at the parameter end. The sample watermark serves as key I at the input end, and the model watermark serves as key II at the parameter end. When a model loaded with key II encounters a sample containing key I, it will output a high activation value, inducing the model to output a preset behavior label. Both are activated simultaneously during the authentication process, mutually verifying each other, thereby playing an effective authentication role and maximizing the prevention of the problem of ineffective model copyright authentication caused by the leakage, tampering, or forgery of the model's single key.

[0078] (2) The present invention inserts quantization nodes into the original deep learning model to obtain a low-precision pseudo-quantization model, and then obtains a high-precision pseudo-quantization model through quantization-aware training. Then, based on the dataset with added watermarks, only the quantization parameters are trained to achieve efficient and stable injection of model watermarks. This ensures that the embedded model watermark and sample watermark can still be jointly authenticated during the process of model compression, migration and hardware deployment, which significantly improves the robustness of authentication.

[0079] (3) Through the joint authentication of key I and key II, this invention can not only effectively determine the legitimate ownership of the model, but also analyze and track the propagation path of the model based on the degree of watermark leakage. At the same time, it can speculate and evaluate the thief and the related technologies used, realize effective source tracing analysis of illegal theft, tampering, and possession of the model, and provide strong technical support for the protection of model intellectual property rights.

[0080] This invention achieves dual-key joint authentication based on quantization-aware training, while solving problems in existing technologies such as the susceptibility of single watermarking mechanisms to theft, the easy weakening of model transfer watermarks, and the difficulty in tracing model misuse. It is applicable to various application scenarios such as intellectual property protection of deep learning models, security verification of model deployment, and model source tracing and evidence collection. Attached Figure Description

[0081] Figure 1 This is a flowchart of a copyright authentication method using a dual-key model provided in an embodiment of the present invention. Figure 1 ;

[0082] Figure 2 This is a flowchart of a copyright authentication method using a dual-key model provided in an embodiment of the present invention. Figure 2 ;

[0083] Figure 3 This is a schematic diagram of the collaborative workflow of the various modules provided in the embodiments of the present invention;

[0084] Figure 4 A schematic diagram comparing the distribution of principal component analysis (PCA) of the features of the target class dataset before and after training with key I, with and without watermarks.

[0085] Figure 5 A schematic diagram comparing the t-distributed stochastic neighbor embedding (t-SNE) distributions of the dataset features before and after training with key I with and without watermark;

[0086] Figure 6 A schematic diagram comparing the distribution of the unified manifold approximation and projection (UMAP) of the features of the target class dataset before and after training with key I, with and without watermarks.

[0087] Figure 7 This diagram illustrates the changes in model accuracy and watermark injection success rate during Key II training. Detailed Implementation

[0088] The present invention will be further described below with reference to the accompanying drawings. The following embodiments are only used to more clearly illustrate the technical solution of the present invention, and should not be used to limit the scope of protection of the present invention.

[0089] Example 1, as Figure 1 As shown in the figure, this embodiment introduces a copyright authentication method using a dual-key model, including:

[0090] Obtain a test sample, which contains an optimized sample watermark from the model copyright holder, and use the optimized sample watermark as key I;

[0091] The test sample is input into the target model to be verified. The target model is obtained by loading the full-precision model with optimized quantization parameters and quantizing it. The optimized quantization parameters are used as key II.

[0092] Obtain the prediction output of the target model for the test sample;

[0093] Based on the predicted output, determine whether the target model produces a preset response to an input containing key I;

[0094] If the target model produces a preset response to the input containing key I, then the copyright authentication of the target model is deemed successful.

[0095] like Figure 2 and Figure 3 As shown, the copyright authentication method of the dual-key model provided in this embodiment involves the following steps in its application process:

[0096] S1. The model copyright holder inserts quantization nodes into the full-precision model and initializes the quantization parameters to obtain a low-precision pseudo-quantization model. The low-precision pseudo-quantization model is then subjected to quantization-aware training and correction to obtain a high-precision pseudo-quantization model. After removing the quantization nodes, the model is released.

[0097] S11. Calculate the scaling factor and zero point through precision interval mapping and zero-value correction. For floating-point numbers... , Represents floating-point numbers The minimum allowable value, Represents floating-point numbers The maximum allowed value, corresponding Bit signed integer, quantized integer , This indicates that The smallest integer value that a signed integer can represent. This indicates that The largest integer value that a signed integer can represent.

[0098] The quantification process is defined as follows:

[0099] ;

[0100] The dequantization process is defined as:

[0101] ;

[0102] in, It is a scaling factor. It's midnight. The function represents rounding a non-integer zero to the nearest integer.

[0103] To ensure the mapping doesn't shift significantly, the integer obtained after quantizing a floating-point 0 must still be 0. Substitute the floating-point 0 and the integer 0 into the above formula, and... Mapped to Mapped to The formula for the quantization parameters is expressed as follows:

[0104] ;

[0105] ;

[0106] The full-precision activation value range is calculated using the exponential moving average algorithm. Quantization nodes include weight quantization nodes and activation value quantization nodes. The range of floating-point values ​​for the weights can be directly obtained statistically from the model weight parameters. The range of floating-point values ​​for the activation values ​​requires calculation using forward propagation. However, due to the individual... The activation value is unstable and requires the use of an exponential moving average algorithm to calculate the current value. floating-point numbers The corresponding activation value range The formula is as follows:

[0107] ;

[0108] ;

[0109] in, and They represent the first indivual The upper and lower bounds of the activation values, and They represent the first indivual The upper and lower bounds of the activation values, and The first indivual The actual maximum and minimum activation values, This is the smoothing coefficient.

[0110] for Bit signed integer, quantized integer The corresponding interval range is , and It is calculated directly based on the number of bits, where, , .

[0111] S12, using the preheating loss function A high-precision pseudo-quantization model is obtained by performing quantization-aware training and correction on a low-precision pseudo-quantization model, where the preheating loss function is used. This includes the first cross-entropy loss, which measures the difference between the output of the low-precision pseudo-quantized model and the true label. Weight decay regularization loss to prevent overfitting in low-precision pseudo-quantization models , represented as:

[0112] ;

[0113] in, This represents the total number of samples in the standard training dataset. Indicates the number of categories. This indicates that the low-precision pseudo-quantization model is for the first... Each sample in category The output on This indicates that the low-precision pseudo-quantization model is for the first... Each sample in category The output on For the first The true class label of each sample This represents the set of trainable weight parameters for a low-precision pseudo-quantized model. This represents the numerical value of the weight parameter. This represents the L2 norm.

[0114] The quantization nodes in the high-precision pseudo-quantization model are removed, and the high-precision full-precision model is obtained and published to the model cloud storage platform.

[0115] S2, Training Sample Watermark Generation Key I: Model Owner's Watermark Image The data is processed and added to the image dataset, using the sample watermark loss function. Training the watermark and using it as key I:

[0116] S21. The model owner will transfer the watermarked image. Pixels The range of values ​​from Normalization to Let the watermark intensity scale of the sample be... Using a linear centering mapping method, the normalized pixel value range is then... Mapping to symmetric space The mapping formula is:

[0117] ;

[0118] in, This represents the mapped watermark pixel value. It is the disturbance intensity control factor.

[0119] S22. The mapped watermark pixel values ​​are added to the dataset samples using a linear fusion method to obtain samples with the mapped watermark. :

[0120] ;

[0121] in, It is a normalized sample representation. , which represents the fusion coefficient between the watermark and the sample.

[0122] To ensure that the watermarked samples remain within the normalized range Within the range, among which, Represents the global mean of the sample. To represent the global variance of the sample, a channel-by-channel cropping operation is required for each color channel to obtain the final watermark sample. The formula is as follows:

[0123] ;

[0124] in, and They represent channels respectively. The mean and standard deviation, It is a clipping function used to restrict input values ​​to a range. If the input is less than Then output If the input is greater than Then output Otherwise, the original values ​​remain unchanged. Through the above cropping operation, the pixel values ​​of the watermarked samples can be prevented from exceeding the normalization range, ensuring the numerical stability of the model in the input domain and the visual consistency of the image; thus obtaining a watermarked dataset with custom sample watermarks.

[0125] S23, Using the sample watermark loss function The custom sample watermark is optimized to obtain a watermark dataset with the optimized sample watermark added. The optimized sample watermark serves as key I, and the sample watermark loss function is... Including distribution consistency loss and visual concealment loss , represented as:

[0126] ;

[0127] Distribution consistency loss Including mean alignment loss Covariance Alignment Loss , represented as:

[0128] ;

[0129] in, and These are the feature means of the watermarked sample and the target sample without a watermark, respectively. Represents the covariance matrix. It is the Frobenius norm.

[0130] visual concealment loss Including intensity penalty loss and first-order smoothing loss The overall loss is defined as:

[0131] ;

[0132] in, and These represent the gradients of the pixels in the horizontal and vertical directions, respectively. Represents the infinite norm, This represents the L1 norm.

[0133] The trained key I performs as follows Figure 4 , Figure 5 as well as Figure 6 As shown, this fully demonstrates the advantages of key I in terms of consistency with the distribution of target samples in the feature space and its concealment as a model copyright authentication key, where:

[0134] Figure 4 A schematic diagram comparing the distribution of principal component analysis (PCA) of the features of the target class dataset before and after training with key I, with and without watermarks.

[0135] Figure 5 A schematic diagram comparing the t-distributed stochastic neighbor embedding (t-SNE) distributions of the dataset features before and after training with key I with and without watermark;

[0136] Figure 6 A schematic diagram comparing the unified manifold approximation and projection (UMAP) distributions of the features of the target class dataset before and after training with key I, with and without watermarks.

[0137] like Figure 4 , Figure 5 as well as Figure 6 As shown, three dimensionality reduction methods—principal component analysis, t-distributed random neighborhood embedding, and unified manifold approximation and projection—were used to visualize the spatial features of the watermarked dataset and the unwatermarked target class dataset before and after training. The figures clearly show that after training, the watermarked samples with triangular markers are effectively pulled towards the unwatermarked target class samples with circular markers in the high-dimensional feature space. This similarity is particularly pronounced in nonlinear dimensionality reduction methods such as t-distributed random neighborhood embedding and unified manifold approximation and projection. This demonstrates that the semantic features of the watermarked samples have been embedded within the target class cluster, and the watermarked samples have initially achieved the model's potential ability to classify them as the target class. The trained sample watermarks will be used as key I for subsequent training using quantized parameters as key II.

[0138] The above results further demonstrate that the trained sample watermark can effectively improve the stability of Key II training and enhance its inherent stealth: When using quantization parameters as Key II training, the quantization process is prone to model performance collapse due to drastic gradient fluctuations. By actively integrating the features of the watermarked dataset with the feature distribution of the unwatermarked target class dataset, the quantization parameters can converge with only adjustments within a small range, thus significantly reducing training instability. Simultaneously, the watermarked samples are embedded within the target cluster in the feature space, making them difficult to distinguish from clean samples in statistical features. Potential model infringers find it difficult to forge sample watermarks through outlier detection, thereby ensuring the stealth and security of the model watermark.

[0139] S3. Training Quantization Parameters and Generating Key II: Add Key I to the dataset to form a watermarked dataset, freeze the model weights, and design the quantization parameter loss function. The watermark injection is achieved by training only the quantization parameters. The quantization nodes of the full-precision model with the injected watermark are then stripped, and the quantization parameters in the stripped quantization nodes will be used as key II.

[0140] S31. Add key I to the dataset to form a watermarked dataset;

[0141] S32, Using Quantization Parameter Loss Function Only quantization parameters are trained to achieve model accuracy preservation and watermark injection, where the quantization parameter loss function Including model accuracy loss Watermark injection loss , represented as:

[0142] ;

[0143] Precision retention loss Including the second cross-entropy loss and knowledge distillation loss The overall loss is defined as:

[0144] ;

[0145] in, It is the total number of samples in the watermarked dataset with the optimized sample watermark added. It is the number of categories. For the first The true class label of each sample It is a high-precision pseudo-quantization model for the first Each sample in category The output on It is a high-precision pseudo-quantization model for the first Each sample in category Up output, It's a temperature parameter. Student model at temperature The predicted distribution is as follows. , The function is a normalized exponential function, used to transform the vector output by a high-precision pseudo-quantized model into a probability distribution that sums to 1, thereby representing the prediction confidence for each category. This represents the output of the student model. Indicates the teacher model at temperature The predicted distribution is as follows. ; This represents the output of the teacher model. The teacher model is for the first Each sample in category The output on express Divergence is used to measure the difference between the student model's predicted distribution and the teacher model's predicted distribution.

[0146] Watermark injection loss function Including cross-entropy loss Feature alignment loss Decision boundary loss and quantization sensitivity loss The overall loss is defined as:

[0147] ;

[0148] in, It is a high-precision pseudo-quantization model for the first Each sample in the target category The output on This indicates that the sample without watermark is in the target category. The output on This indicates the characteristics of the watermarked sample. Represents the features of the target class samples. and These represent the mean and standard deviation, respectively. Indicates a corrected linear unit. This represents the upper threshold for predicting the probability of non-target classes. represents the interval constraint coefficient, and represents the squared L2 norm.

[0149] S33. Strip the quantization nodes of the full-precision model from the injected model watermark. The quantization parameters in the stripped quantization nodes will be used as key II. At this point, the model holder will simultaneously possess key I, key II, and the preset target category in S32. .

[0150] During model authentication, the model holder must first insert a quantization node into the high-precision full-precision model released in step S12 (i.e., the model that may be compromised by a thief), and load key II into the quantization node. Then, according to the quantization configuration corresponding to key II during training, the full-precision model is quantized to obtain a quantized model. Next, key I is added to the test set as described in step S22 to obtain a watermark sample. Finally, the model holder inputs the watermark sample into the quantized model for inference, outputting the label corresponding to the highest probability and the target category preset by the model holder. If they are identical, the model copyright authentication is considered successful. A watermark sample with only key I cannot infer the preset target category on a full-precision model that has not been quantized using key II. The test set samples without key I cannot infer the preset target category from the quantization model after quantization using only key II. Neither the dataset without key I nor the model that did not use key II for quantization could infer the preset target category. This ensures the reliability, uniqueness, and interpretability of the model copyright authentication process.

[0151] The authentication effect of key II is as follows Figure 7 As shown, Key II fully demonstrates its potential as a bridge between full-precision and quantized models, not only for quantization compression but also for watermarking. In particular, Key II further enhances key concealment during training by maintaining model accuracy, reducing the risk of key theft and leakage.

[0152] Figure 7 This diagram illustrates the changes in model accuracy and watermark injection success rate during Key II training.

[0153] like Figure 7 As shown, the training process using quantization parameters as key II demonstrates strong collaborative optimization capabilities. On the one hand, the model's watermark injection success rate rapidly climbed in the initial stage and stabilized at over 98%, indicating that key II can efficiently guide the model to classify the watermark dataset into the target category, achieving a highly reliable model copyright authentication function. On the other hand, although the accuracy of the model's main task fluctuated, it remained consistently between 80% and 90%, without any performance collapse caused by the training of key II.

[0154] The above results further demonstrate that quantization parameters can not only serve the quantization process but also act as carriers of model watermarks, exhibiting strong concealment: the quantization model obtained after quantization using trained quantization parameters can easily map watermark samples to target categories, and the quantization node loaded with quantization parameters can achieve plug-and-play convenience, greatly expanding its application potential for copyright protection and source tracing in edge deployment scenarios; at the same time, since the goal of quantization parameter training is to complete the implantation of model watermarks with almost no impairment to the model's generalization ability, this model watermark embedding characteristic significantly reduces the risk of being detected by reverse engineering or statistical detection, thereby effectively resisting malicious key theft attacks.

[0155] This embodiment provides a copyright authentication method for a dual-key model, achieving efficient, secure, and tamper-proof protection of model copyright through the following innovations:

[0156] (1) In this embodiment, a joint dual-key authentication system is constructed simultaneously at the data layer at the input end and the model layer at the parameter end. The sample watermark is used as key I at the input end, and the model watermark is used as key II at the parameter end. When the model loaded with key II encounters a sample containing key I, it will output a high activation value, inducing the model to output a preset behavior label. The two are activated simultaneously during the authentication process and verify each other, thereby playing an effective authentication role and preventing the problem of ineffective model copyright authentication caused by the leakage, tampering or forgery of the model's single key to the greatest extent.

[0157] (2) In this embodiment, a quantization node is inserted into the full-precision model. A high-precision pseudo-quantization model is obtained through quantization-aware training. Then, based on the dataset with added watermarks, only the quantization parameters are trained to achieve efficient and stable injection of model watermarks. This ensures that the embedded model watermark and sample watermark can still be jointly authenticated during the compression, migration and hardware deployment of the model, significantly improving the robustness of authentication.

[0158] (3) This embodiment can effectively determine the legitimate ownership of the model through joint authentication of key I and key II. It can also analyze and track the propagation path of the model based on the degree of watermark leakage. At the same time, it can speculate and evaluate the thief and the related technologies used, realize effective source tracing analysis of illegal theft, tampering, and possession of the model, and provide strong technical support for the protection of model intellectual property rights.

[0159] This embodiment achieves dual-key joint authentication based on quantization-aware training, while solving problems in existing technologies such as the susceptibility of single watermarking mechanisms to theft, the easy weakening of model transfer watermarks, and the difficulty in tracing model misuse. It is applicable to various application scenarios such as intellectual property protection of deep learning models, security verification of model deployment, and model source tracing and evidence collection.

[0160] Example 2: This example provides a copyright authentication device for a dual-key model, used to implement the copyright authentication method for the dual-key model described in any one of Examples 1, including:

[0161] The sample acquisition module is used to acquire test samples, which contain an optimized sample watermark from the model copyright holder, and the optimized sample watermark is used as key I.

[0162] The input module is used to input the test sample into the target model to be verified. The target model is obtained by loading the full-precision model with optimized quantization parameters and quantizing it. The optimized quantization parameters are used as key II.

[0163] The prediction output acquisition module is used to acquire the prediction output of the target model for the test sample;

[0164] The judgment module is used to determine, based on the prediction output, whether the target model produces a preset response to an input containing key I;

[0165] The copyright authentication module is used to determine that the copyright authentication of the target model is successful when the target model generates a preset response to an input containing key I.

[0166] The specific functions of each module described above are explained in the relevant content of the method in Embodiment 1, and will not be repeated here.

[0167] Example 3: This example provides a computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, implements the steps of any of the methods described in Example 1.

[0168] Example 4: This example provides an electronic device, including:

[0169] Memory, used to store computer programs / instructions;

[0170] A processor for executing the computer program / instructions to implement the steps of any of the methods described in Embodiment 1.

[0171] Example 5: This example provides a computer program product, including a computer program / instructions, which, when executed by a processor, implement the steps of the method described in any one of Examples 1.

[0172] The above description is only a preferred embodiment of the present invention. It should be noted that for those skilled in the art, several improvements and modifications can be made without departing from the technical principles of the present invention, and these improvements and modifications should also be considered within the scope of protection of the present invention.

[0173] Those skilled in the art will understand that embodiments of this disclosure can be provided as methods, systems, or computer program products. Therefore, this disclosure can take the form of a completely hardware embodiment, a completely software embodiment, or an embodiment combining software and hardware aspects. Furthermore, this disclosure can take the form of a computer program product embodied on one or more computer-usable storage media (including, but not limited to, disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0174] This disclosure is described with reference to flowchart illustrations and / or block diagrams of methods, apparatus (systems), and computer program products according to embodiments of this disclosure. It will be understood that each block of the flowchart illustrations and / or block diagrams, and combinations of blocks in the flowchart illustrations and / or block diagrams, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, special-purpose computer, embedded processor, or other programmable data processing apparatus to produce a machine, such that the instructions, which execute via the processor of the computer or other programmable data processing apparatus, create a machine for implementing the flowchart illustrations and / or block diagrams. Figure 1 One or more processes and / or boxes Figure 1 A device that provides the functions specified in one or more boxes.

[0175] These computer program instructions may also be stored in a computer-readable storage medium that can direct a computer or other programmable data processing device to function in a particular manner, such that the instructions stored in the computer-readable storage medium produce an article of manufacture including instruction means, which are implemented in a process Figure 1 One or more processes and / or boxes Figure 1 The function specified in one or more boxes.

[0176] These computer program instructions may also be loaded onto a computer or other programmable data processing equipment to cause a series of operational steps to be performed on the computer or other programmable equipment to produce a computer-implemented process, thereby providing instructions that execute on the computer or other programmable equipment for implementing the process. Figure 1 One or more processes and / or boxes Figure 1 The steps of the function specified in one or more boxes.

[0177] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of this disclosure and not to limit its protection scope. Although this disclosure has been described in detail with reference to the above embodiments, those skilled in the art should understand that after reading this disclosure, they can still make various changes, modifications or equivalent substitutions to the specific implementation of the invention, but these changes, modifications or equivalent substitutions are all within the protection scope of the pending claims.

Claims

1. A copyright authentication method using a dual-key model, characterized in that, include: Obtain a test sample, which contains an optimized sample watermark from the model copyright holder, and use the optimized sample watermark as key I; The test sample is input into the target model to be verified. The target model is obtained by loading the full-precision model with optimized quantization parameters and quantizing it. The optimized quantization parameters are used as key II. Obtain the prediction output of the target model for the test sample; Based on the predicted output, determine whether the target model produces a preset response to an input containing key I; If the target model produces a preset response to the input containing key I, then the copyright authentication of the target model is determined to be successful; The method for constructing and training the target model includes: By inserting quantization nodes into the original deep learning model and initializing the quantization parameters, a low-precision pseudo-quantization model is obtained. Based on the set preheating loss function, the low-precision pseudo-quantization model is trained with quantization perception using a standard training dataset to obtain a high-precision pseudo-quantization model. The obtained watermark dataset with added custom sample watermarks is input into a high-precision pseudo-quantization model. The custom sample watermark is optimized with the goal of minimizing the sample watermark loss function. The watermark dataset with added optimized sample watermarks is obtained, where the optimized sample watermark is used as key I. The network weights of the high-precision pseudo-quantization model are frozen. With the goal of minimizing the quantization parameter loss function, the quantization parameters of the high-precision pseudo-quantization model are optimized using a dataset with watermarked key I, and the optimized quantization parameters are used as key II. The high-precision pseudo-quantization model combined with key II is used as the target model, and the quantization nodes are stripped from it to form a full-precision model for final release.

2. The copyright authentication method for the dual-key model according to claim 1, characterized in that, The step of inserting quantization nodes and initializing quantization parameters in the original deep learning model includes: Insert quantization nodes on the weight and activation value paths of the original deep learning model; The scaling factor for the inserted quantization node is calculated through precision interval mapping and zero-value correction. With zero point This is to complete the initialization of the quantization parameters; Among them, for floating-point numbers , Represents floating-point numbers The minimum allowable value, Represents floating-point numbers The maximum allowed value, its corresponding signed integer , This indicates that The smallest integer value that a signed integer can represent. This indicates that The largest integer value that a signed integer can represent; The quantification process is defined as follows: ； The dequantization process is defined as: ； Wherein, scaling factor With zero point The calculation formula is as follows: ； ； The function represents rounding a non-integer zero to the nearest integer.

3. The copyright authentication method for the dual-key model according to claim 1, characterized in that, The preheating loss function This includes the first cross-entropy loss, which measures the difference between the output of the low-precision pseudo-quantized model and the true label. Weight decay regularization loss to prevent overfitting in low-precision pseudo-quantization models , represented as: ； in, This represents the total number of samples in the standard training dataset. Indicates the number of categories. This indicates that the low-precision pseudo-quantization model is for the first... Each sample in category The output on This indicates that the low-precision pseudo-quantization model is for the first... Each sample in category The output on For the first The true class label of each sample This represents the set of trainable weight parameters for a low-precision pseudo-quantized model. This represents the numerical value of the weight parameter. This represents the L2 norm.

4. The copyright authentication method for the dual-key model according to claim 1, characterized in that, The method for obtaining the watermarked dataset with added custom sample watermarks includes: Watermarked image pixel values The range of values ​​from Normalization to ; Set the sample watermark strength scale to Using a linear centering mapping method, the normalized pixel value range is then... Mapping to symmetric space The mapping formula is: ； in, This represents the mapped watermark pixel value. It is the disturbance intensity control factor; The mapped watermark pixel values ​​are added to the dataset samples using a linear fusion method to obtain samples with the mapped watermark. The formula is as follows: ； in, It is a normalized sample representation. , representing the fusion coefficient between the watermark and the sample; Watermarked samples Perform a channel-by-channel cropping operation to obtain the final watermark sample. The formula is as follows: ； in, and They represent channels respectively. The mean and standard deviation, It is a clipping function used to restrict input values ​​to a range. If the input is less than Then output If the input is greater than Then output Otherwise, keep the original value unchanged; Obtain the watermarked dataset with custom sample watermarks added.

5. The copyright authentication method for the dual-key model according to claim 1, characterized in that, The sample watermark loss function Including distribution consistency loss and visual concealment loss , represented as: ； The distribution consistency loss includes mean alignment loss. Covariance Alignment Loss , represented as: ； in, and These are the feature means of the watermarked sample and the target sample without a watermark, respectively. Represents the covariance matrix. It is the Frobenius norm. Represents the square of the L2 norm; The visual concealment loss Including intensity penalty loss and first-order smoothing loss The overall loss is defined as: ； in, This represents the mapped watermark pixel value. and These represent the gradients of the pixels in the horizontal and vertical directions, respectively. Represents the infinite norm, This represents the L1 norm.

6. The copyright authentication method for the dual-key model according to claim 1, characterized in that, The quantization parameter loss function Including model accuracy loss Watermark injection loss , represented as: ； The loss of precision retention Including the second cross-entropy loss and knowledge distillation loss The overall loss is defined as: ； in, It is the total number of samples in the watermarked dataset with the optimized sample watermark added. It is the number of categories. For the first The true class label of each sample It is a high-precision pseudo-quantization model for the first Each sample in category The output on It is a high-precision pseudo-quantization model for the first Each sample in category Up output, It's a temperature parameter. Indicates the student model at temperature The predicted distribution is as follows. , The function is a normalized exponential function, used to transform the vector output by a high-precision pseudo-quantized model into a probability distribution that sums to 1, thereby representing the prediction confidence for each category. This represents the output of the student model. Indicates the teacher model at temperature The predicted distribution is as follows. ; This represents the output of the teacher model. The teacher model is for the first Each sample in category The output on express Divergence is used to measure the difference between the student model's predicted distribution and the teacher model's predicted distribution; The watermark injection loss Including cross-entropy loss Feature alignment loss Decision boundary loss and quantization sensitivity loss The overall loss is defined as: ； in, It is a high-precision pseudo-quantization model for the first Each sample in the target category The output on This indicates that the sample without watermark is in the target category. The output on This indicates the characteristics of the watermarked sample. Represents the features of the target class samples. and These represent the mean and standard deviation, respectively. Indicates a corrected linear unit. This represents the upper threshold for predicting the probability of non-target classes. Indicates the interval constraint coefficient. This represents the square of the L2 norm.

7. A copyright authentication device for a dual-key model, used to implement the copyright authentication method for the dual-key model according to any one of claims 1-6, characterized in that, include: The sample acquisition module is used to acquire test samples, which contain an optimized sample watermark from the model copyright holder, and the optimized sample watermark is used as key I. The input module is used to input the test sample into the target model to be verified. The target model is obtained by loading the full-precision model with optimized quantization parameters and quantizing it. The optimized quantization parameters are used as key II. The prediction output acquisition module is used to acquire the prediction output of the target model for the test sample; The judgment module is used to determine, based on the prediction output, whether the target model produces a preset response to an input containing key I; The copyright authentication module is used to determine that the copyright authentication of the target model is successful when the target model generates a preset response to an input containing key I.

8. A computer-readable storage medium having a computer program stored thereon, characterized in that: When executed by a processor, the computer program implements the steps of the method described in any one of claims 1-6.

9. An electronic device, characterized in that, include: Memory, used to store computer programs / instructions; A processor for executing the computer program / instructions to implement the steps of the method according to any one of claims 1-6.

Images