Target detection model hiding function embedding method and system based on output hiding

Abstract

The invention relates to a target detection model hiding function embedding method and system based on output hiding, and the method comprises the steps: taking a conventional target detection model as a carrier, constructing a mixed data set on the premise of not changing the output dimension of the conventional target detection model, introducing a composite loss function comprising initial task loss and modulation loss, and carrying out the combined fine tuning. And hiding and embedding the predetermined target recognition result into the model output representation. And the embedded implicit information can be extracted through a decoding network initialized by a preset key, so that the hidden identification of the existence state of the predetermined target is realized. Compared with the prior art, the method has the advantages that original function precision of the carrier model is kept, non-inductive integration of special functions is achieved, and good concealment, effectiveness, safety and the like are achieved.

Description

Technical Field

[0001] This invention relates to the fields of artificial intelligence security and computer vision, and in particular to a method and system for embedding the covert function of a target detection model based on output hiding. Background Technology

[0002] In recent years, deep learning models have demonstrated powerful capabilities across various fields. Besides conventional functions, they also include specialized functions such as specific object recognition and special content generation. During the transmission or deployment of such models, owners often want to keep these specialized functions hidden to avoid attracting unnecessary attention. One solution to this goal is to embed the specialized functions into a model that performs regular tasks. Externally, this model appears identical to the initial model, while the specialized functions require specific activation methods.

[0003] Currently, technologies in this field are still relatively rare, and methods can be categorized into two types based on how special functions are activated: model modification and input triggering. However, existing methods have significant drawbacks: First, special functions are often embedded in relatively simple models, which may lead to a decrease in the performance and stealth of these functions. Second, the initial model function and the embedded special functions often have low correlation, potentially resulting in the inability to effectively integrate the two functions into the model. Therefore, existing technologies lack a solution that can effectively integrate special functions and initial functions into the model while ensuring the performance and stealth of the special functions.

[0004] Chinese invention patent CN118101266A discloses a method and apparatus for link inference confidentiality protection based on edge obfuscation. The method includes: pre-training a node classification model using the original graph dataset; constructing an encoder based on the pre-trained node classification model to obtain low-dimensional node features from the original graph feature matrix and adding obfuscation noise to the node classification model based on gradient guidance, while simultaneously predicting class probabilities; inputting the node features with added obfuscation noise into an attack model to predict the graph adjacency matrix; constructing a loss function for the confidentiality protection task based on the attack model; constructing a loss function for the main node classification task based on the node classification model; and alternating training for the two tasks and adaptively finding the alternating training rounds. This invention achieves the covert addition of obfuscation noise through a method based on structural similarity comparison, achieving a balance between privacy protection and main task performance in link inference confidentiality protection. However, existing technologies still suffer from problems such as: special functions being embedded in relatively simple models leading to decreased performance and covertness of special functions; low correlation between the initial function and the embedded special functions resulting in ineffective integration of the two functions into the model; and special functions not being sufficiently covert and easily detected.

[0005] In summary, there is currently a lack of a method and system for embedding the covert function of target detection models based on output hiding, in order to solve or partially solve the above problems. Summary of the Invention

[0006] The purpose of this invention is to overcome the defects of the prior art by providing a method and system for embedding covert functions in a target detection model based on output hiding. This addresses or partially addresses the problems in the prior art where embedding special functions in a relatively simple model leads to a decrease in the performance and covertness of the special functions, a low correlation between the initial function and the embedded special functions resulting in the inability to effectively integrate the two functions into the model, and the special functions being not covert enough and easily detected.

[0007] The objective of this invention can be achieved through the following technical solutions: According to one aspect of the present invention, a method for embedding the hidden function of a target detection model based on output hiding is provided, specifically including: S1. Obtain data from regular object detection tasks and confidential data from predetermined targets, and randomly mix the two types of data to construct a hybrid training dataset; S2. Use the data from the conventional object detection task to pre-train the conventional functions of the original model to obtain a pre-trained model; S3. Based on the obtained pre-trained model, the loss term of the confidential function is added to the initial loss function to generate a composite loss function. Using the composite loss function and the mixed training dataset, the regular function and the confidential function of the pre-trained model are jointly fine-tuned to obtain the carrier model. S4. Based on the carrier model, the implicit confidence information of the predetermined target is encoded into the original detection output of the carrier model; S5. By intercepting the confidence portion of the original detection output through a confidential channel, and using a decoding network initialized by a preset key, the output of the jointly fine-tuned carrier model is post-processed to obtain the target detection result, thereby realizing the determination of the existence state of the target.

[0008] As a preferred technical solution, the original detection output includes the category, location, and confidence level of the object in the image.

[0009] As a preferred technical solution, the conventional target detection task data and the confidential data of the predetermined target include images, conventional task labels and confidential task labels, wherein the conventional task labels mark the true bounding box category and coordinates in the image.

[0010] As a preferred technical solution, in the conventional target detection task data, the confidential task label is set to all 0, and in the confidential data of the predetermined target, the confidential task label is the coordinate of the real bounding box of the selected predetermined target.

[0011] As a preferred technical solution, the composite loss function includes an initial task loss term for maintaining the detection performance of the carrier model, and a modulation loss term for guiding the embedding of the predetermined target recognition result into the model output.

[0012] As a preferred technical solution, the composite loss function for: In the formula, This is the initial task loss item. The regularization coefficient is . This is the modulation loss term.

[0013] As a preferred technical solution, the modulation loss term for: In the formula, The total number of detection boxes generated by the model. For the model to the first The confidence level of a predetermined target detection. for The true value, for function.

[0014] As a preferred technical solution, the decoding network is a fully connected layer. The output confidence part is passed through the decoding network to obtain the detection confidence of the predetermined target. If the confidence is greater than a preset threshold, it is determined that the predetermined target has been detected.

[0015] As a preferred technical solution, the joint fine-tuning specifically includes: calculating the localization loss based on the coordinate part and the classification loss based on the confidence part of the image output by the pre-trained model to obtain the initial task loss; calculating the modulation loss by passing the confidence through an extractor initialized by the key; adding the initial task loss and the modulation loss to form a composite loss, and updating the model parameters based on the composite loss.

[0016] According to another aspect of the present invention, a covert function embedding system for a target detection model based on output hiding is provided. The system is used to perform the method described in any of the preceding claims. The system is built based on a YOLOv8 model and further includes a confidential result extractor and a parameter optimization module. The YOLOv8 model is used to calculate localization loss and classification loss; The confidential result extractor is used for modulation loss; The parameter optimization module backpropagates the localization loss, classification loss, and modulation loss to update the model's parameters.

[0017] Compared with the prior art, the present invention has at least one of the following beneficial effects: (1) This invention generates a composite loss function by adding the loss term of the confidential function to the initial loss function, obtains the carrier model based on the composite function, and encodes the implicit confidence information of the predetermined target into the original detection output of the carrier model. This solves the problem that the performance and concealment of the special function are reduced when the special function is embedded in a relatively simple model in the prior art, and achieves the technical effect of ensuring the concealment, effectiveness and robustness of the special function.

[0018] (2) This invention utilizes a composite loss function and a mixed training dataset to jointly fine-tune the conventional and confidential functions of the pre-trained model, thereby obtaining a jointly fine-tuned carrier model. This solves the problem that the initial function and the embedded special function have low correlation, which leads to the inability to effectively integrate the two functions into the model. It achieves the technical effect of not significantly damaging the initial function and effectively integrating the initial function and the special function.

[0019] (3) The present invention uses a key decoding mechanism to perform post-processing on the output of the carrier model after joint fine-tuning by a decoding network initialized by a preset key, thereby obtaining the target detection result. This solves the problem that the special functions of traditional models are not concealed enough and are easily discovered. It ensures that only the authorized party can extract the results of the special functions by activating them, and further enhances the security and practicality of the present invention. Attached Figure Description

[0020] Figure 1 This is a flowchart illustrating the implementation of the method proposed in this invention; Figure 2 This is a schematic diagram illustrating the implementation principle of the method proposed in this invention; Figure 3 The figure shows the parameter differences of the three models under EMD parameter analysis. Detailed Implementation

[0021] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some, not all, of the embodiments of the present invention. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort should fall within the scope of protection of the present invention.

[0022] Example 1 To address the problems existing in the prior art, this embodiment provides a method for embedding the covert function of a target detection model based on output hiding, which specifically includes: S1. Obtain data from regular object detection tasks and confidential data from predetermined targets, and randomly mix the two types of data to construct a hybrid training dataset; S2. Pre-train the original model's conventional functions using data from a routine object detection task to obtain a pre-trained model; S3. Based on the obtained pre-trained model, the loss term of the confidential function is added to the initial loss function to generate a composite loss function. Using the composite loss function and the mixed training dataset, the regular function and confidential function of the pre-trained model are jointly fine-tuned to obtain the carrier model. S4. Based on the carrier model, the implicit confidence information of the predetermined target is encoded into the original detection output of the carrier model; S5. By intercepting the confidence portion of the original detection output through a confidential channel, and using a decoding network initialized with a preset key, the output of the jointly fine-tuned carrier model is post-processed to obtain the target detection result and realize the determination of the existence state of the target.

[0023] like Figure 1 As shown, the carrier model is deployed in a restricted environment. Real-time environmental images captured by camera equipment, including images without a predetermined target and images with a predetermined target, are input into the carrier model to obtain the detection results of a conventional target detection task, including information such as the category, location, and confidence level of objects in the images. By intercepting the confidence level portion of the conventional task output information through a confidential channel and decoding it with a key, the detection result of the predetermined target, i.e., whether the predetermined target appears in the environment, can be obtained.

[0024] The training process of the carrier model is as follows Figure 2 As shown, a hybrid training dataset is constructed containing regular object detection samples and predetermined object samples. Each sample contains an image, a regular task label, and a confidential task label. The regular task label annotates the ground truth bounding box category and coordinates in the image. For regular samples, the confidential task label is set to all 0s, representing that there is no predetermined object in the image. For confidential samples, the confidential task label is the coordinates of the ground truth bounding box of the selected predetermined object. The two types of data are randomly mixed to obtain the hybrid dataset. In this embodiment, PASCAL VOC 2012 is used as the regular object detection task dataset, and the dataset is divided in a ratio of training set:validation set:test set = 8:1:1. The confidential data for each predetermined object consists of 300 images, and the dataset is divided in a ratio of training set:test set = 2:1.

[0025] Secondly, the model's standard functions are pre-trained on regular object detection task data to obtain a pre-trained model. Then, the loss term for the confidential functions is added to the initial loss function to generate a composite loss function. The standard and confidential functions are then jointly fine-tuned on a mixed dataset to obtain the carrier model. The composite loss function includes an initial task loss term to maintain the carrier model's detection performance, and a modulation loss term to guide the embedding of predetermined target recognition results into the model output.

[0026] In this process, for each image output, the localization loss is calculated based on the coordinates, and the classification loss is calculated based on the confidence score, resulting in the initial task loss. The confidence score is then processed through a key-initialized extractor to calculate the modulation loss. The initial task loss and the modulation loss are added together to form the composite loss, which is used to update the model parameters. Without increasing the model output dimension, the implicit confidence information of the predetermined target is encoded into the original detection output of the carrier model.

[0027] Specifically, modulation loss term for: In the formula, The total number of detection boxes generated by the model. For the model to the first The confidence level of a predetermined target detection. for The true value, for function.

[0028] Composite loss function for: In the formula, This is the initial task loss item. The regularization coefficient is . This is the modulation loss term.

[0029] Furthermore, for the carrier model obtained by joint fine-tuning, a decoding network initialized with a preset key is used to perform specific post-processing on the model output, thereby realizing the determination of the existence state of the predetermined target; specifically, the decoding network is a fully connected layer, and the confidence part of the output is passed through the network to obtain the detection confidence of the predetermined target. If the confidence is greater than the set threshold, it is determined that the predetermined target has been detected.

[0030] In this embodiment, conventional functional metrics and confidential functional metrics are used as evaluation metrics. Conventional functional metrics include accuracy, recall, mAP50, and mAP50-95. Higher values ​​indicate higher accuracy in classification and localization of conventional functions. Confidential functional metrics include recall and specificity. Higher recall indicates higher accuracy in detecting positive samples with a predetermined target, while higher specificity indicates a lower false detection rate for negative samples without a predetermined target.

[0031] Table 1. Performance comparison of the model before and after joint fine-tuning. Table 1 compares the performance of the models before and after joint fine-tuning in the embodiments, illustrating that the model with embedded confidential functions can achieve a high accuracy in detecting predetermined targets while maintaining regular functions. The results show that the model with embedded confidential functions does not exhibit significant differences in performance metrics on regular tasks compared to before embedding confidential functions, and achieves high detection accuracy for predetermined targets.

[0032] Table 2. Changes in metrics of the carrier model after embedding confidentiality features when facing fine-tuning attacks. Table 2 shows the changes in metrics of the carrier model after embedding confidential features in the embodiments when facing fine-tuning attacks, illustrating the high robustness of the method against such attacks. A fine-tuning attack refers to further fine-tuning the carrier model on top of the initial task loss function using only a regular dataset, with the intention of removing confidential features. Experimental data shows that fine-tuning attacks within 40 rounds are insufficient to significantly weaken the confidential features of the carrier model.

[0033] like Figure 3 As shown in the figure, the parameter difference heatmaps of the three models under EMD parameter analysis demonstrate the strong concealment of the confidential function. Cover represents the carrier model, Normal1 is the pre-trained model of the carrier model, and Normal2 is the pre-trained model trained with the learning rate turned off. The experimental results show that the parameter difference between the carrier model and any one of the pre-trained models is not significantly greater than the parameter difference between the two pre-trained models, proving that parameter differences alone cannot determine whether the carrier model contains a confidential function.

[0034] Example 2 In response to the aforementioned method for embedding the covert function of a target detection model based on output hiding provided in the embodiments, this embodiment provides a system for embedding the covert function of a target detection model based on output hiding, used to execute the aforementioned method for embedding the covert function of a target detection model based on output hiding. The system is built based on the YOLOv8 model and also includes a confidential result extractor and a parameter optimization module. The YOLOv8 model is used to calculate the localization loss and classification loss, the confidential result extractor is used to calculate the modulation loss, and the parameter optimization module is used to backpropagate according to the localization loss, classification loss, and modulation loss to update the parameters of the model.

[0035] The above description is merely a specific embodiment of the present invention, but the scope of protection of the present invention is not limited thereto. Any person skilled in the art can easily conceive of various equivalent modifications or substitutions within the technical scope disclosed in the present invention, and these modifications or substitutions should all be covered within the scope of protection of the present invention. Therefore, the scope of protection of the present invention should be determined by the scope of the claims.

Claims

1. A method for embedding the concealment function of a target detection model based on output hiding, characterized in that, The method specifically includes: S1. Obtain data from regular object detection tasks and confidential data from predetermined targets, and randomly mix the two types of data to construct a hybrid training dataset; S2. Use the data from the conventional object detection task to pre-train the conventional functions of the original model to obtain a pre-trained model; S3. Based on the obtained pre-trained model, the loss term of the confidential function is added to the initial loss function to generate a composite loss function. Using the composite loss function and the mixed training dataset, the regular function and the confidential function of the pre-trained model are jointly fine-tuned to obtain the carrier model. S4. Based on the carrier model, the implicit confidence information of the predetermined target is encoded into the original detection output of the carrier model; S5. By intercepting the confidence portion of the original detection output through a confidential channel, and using a decoding network initialized by a preset key, the output of the jointly fine-tuned carrier model is post-processed to obtain the target detection result, thereby realizing the determination of the existence state of the target.

2. The method for embedding the concealment function of a target detection model based on output concealment according to claim 1, characterized in that, The raw detection output includes the category, location, and confidence level of the objects in the image.

3. The method for embedding the concealment function of a target detection model based on output concealment according to claim 1, characterized in that, The conventional target detection task data and the confidential data of the predetermined target include images, conventional task labels, and confidential task labels. The conventional task labels mark the ground truth bounding box category and coordinates in the image.

4. The method for embedding the concealment function of a target detection model based on output concealment according to claim 1, characterized in that, In the conventional target detection task data, the confidential task label is set to all 0s. In the confidential data of the predetermined target, the confidential task label is the coordinate of the selected bounding box of the predetermined target.

5. The method for embedding the concealment function of a target detection model based on output concealment according to claim 1, characterized in that, The composite loss function includes an initial task loss term for maintaining the detection performance of the carrier model, and a modulation loss term for guiding the embedding of the predetermined target recognition result into the model output.

6. The method for embedding the concealment function of a target detection model based on output concealment according to claim 5, characterized in that, The composite loss function for: In the formula, This is the initial task loss item. The regularization coefficient is . This is the modulation loss term.

7. The method for embedding the concealment function of a target detection model based on output concealment according to claim 6, characterized in that, The modulation loss term for: In the formula, The total number of detection boxes generated by the model. For the model to the first The confidence level of a predetermined target detection. for The true value, for function.

8. The method for embedding the concealment function of a target detection model based on output concealment according to claim 1, characterized in that, The decoding network is a fully connected layer. The output confidence level is passed through the decoding network to obtain the detection confidence level of the predetermined target. If the confidence level is greater than a preset threshold, it is determined that the predetermined target has been detected.

9. The method for embedding the concealment function of a target detection model based on output concealment according to claim 1, characterized in that, The joint fine-tuning specifically includes: calculating the localization loss based on the coordinate part and the classification loss based on the confidence part of the image output by the pre-trained model to obtain the initial task loss; calculating the modulation loss by passing the confidence through an extractor initialized by the key; adding the initial task loss and the modulation loss to form a composite loss; and updating the model parameters based on the composite loss.

10. A target detection model concealment function embedding system based on output hiding, characterized in that, The system is used to execute the method of any one of claims 1-9, the system is built based on the YOLOv8 model, and further includes a confidential result extractor and a parameter optimization module. The YOLOv8 model is used to calculate localization loss and classification loss; The confidential result extractor is used to calculate modulation loss; The parameter optimization module backpropagates the localization loss, classification loss, and modulation loss to update the model's parameters.

Images