An artificial intelligence training data set construction and copyright infringement detection method and device

Abstract

This invention belongs to the field of artificial intelligence technology and discloses a method and device for constructing an artificial intelligence training dataset and detecting copyright infringement. First, an original image dataset is acquired, and a portion of the original images are selected as images to be processed according to a preset watermark embedding rate. Then, motion parallax watermark embedding processing is performed on each image to be processed. First, near and far masks are generated based on the distance from the pixel position to the image center. Then, near and far pixel offsets are applied respectively to obtain near and far offset images, which are fused to obtain a disguised image. This disguised image is then weighted and fused with the image to be processed to obtain a motion parallax watermark image, and its classification label is modified to a preset target label. Finally, it is combined with the unprocessed original images to form a training dataset. The purpose of this invention is to solve the problems in existing data watermarking methods, such as the ease with which training data preprocessing can destroy the watermark, inconsistencies between traditional watermark generation and the characteristics of the original image, leading to watermark failure, inaccurate infringement detection, and easy removal of the watermark, thereby achieving more effective copyright protection and infringement detection.

Description

Technical Field

[0001] This invention belongs to the field of artificial intelligence technology, specifically relating to a method and device for constructing artificial intelligence training datasets and detecting copyright infringement. Background Technology

[0002] With the widespread application of deep learning technology in fields such as image recognition, autonomous driving, and medical diagnosis, high-quality labeled datasets have become a core foundation for training high-performance artificial intelligence models. The construction of datasets typically requires significant investment of manpower, time, and money; for example, the construction of well-known datasets such as ImageNet and COCO cost millions of dollars and several years. However, once a dataset is released or leaked, it is easily obtained by unauthorized third parties and used for training commercial models, making it difficult for dataset owners to trace and protect their rights.

[0003] Currently, copyright protection schemes for datasets mainly fall into two categories. The first category is based on data fingerprinting, which infers whether a sample was used in model training by analyzing the model's response to a specific sample. These methods typically require access to a large number of original training samples and have limited accuracy, making them impractical in real-world copyright infringement detection scenarios. The second category is based on data watermarking, which identifies the data source by embedding invisible watermark information into images. These methods require only minor modifications to a small number of original training samples to achieve superior detection performance compared to fingerprinting methods, and have therefore attracted widespread attention.

[0004] Existing data watermarking methods typically construct watermark samples by adding specific noise or embedding preset patterns into images. After infringers train a model using the watermarked dataset, the model will produce a detectable specific response to the watermarked sample. Rights holders can determine whether the dataset has been infringed by inputting the watermarked sample into the model and observing the output. However, existing methods have two prominent problems in practical applications. First, the training data usually needs to undergo preprocessing operations before being input into the model, such as random cropping, scaling, and color enhancement. These operations can easily destroy the embedded watermark information, causing the watermark to become ineffective and thus affecting the accuracy of subsequent infringement detection. Second, the traditional watermark generation method is often inconsistent with the natural statistical characteristics of the original image. For example, added noise or patterns may change the pixel value distribution of the image. Such abnormal distribution can be easily detected and removed by infringers using statistical detection methods, rendering the watermark ineffective in marking copyright. Summary of the Invention

[0005] To address the problems existing in the prior art, this invention provides a method and device for constructing an artificial intelligence training dataset and detecting copyright infringement. The purpose is to solve the problems in existing data watermarking methods, such as the watermark information being easily destroyed by the preprocessing of training data, leading to watermark failure and affecting the accuracy of infringement detection, as well as the inconsistency between traditional watermark generation methods and the natural statistical characteristics of the original image, making it easy for infringers to discover and remove the watermark, and failing to effectively mark copyright. This invention achieves more effective copyright protection and infringement detection for artificial intelligence training datasets.

[0006] To solve the above-mentioned technical problems, the present invention is achieved through the following technical solution: According to a first aspect of the present invention, a method for constructing an artificial intelligence training dataset is provided, comprising: Obtain the original image dataset, and select a portion of the original images from the original image dataset as images to be processed according to a preset watermark embedding rate; For each image to be processed, a motion parallax watermarking embedding process is performed to obtain a motion parallax watermarked image. The classification label of the motion parallax watermarked image is then modified to a preset target label. The motion parallax watermarking embedding process includes: Based on the distance from the pixel position of the image to be processed to the center of the image, generate a near-field mask and a far-field mask; Apply near-field pixel offset and far-field pixel offset to the image to be processed to obtain near-field offset image and far-field offset image; Based on the near-view mask and the far-view mask, the near-view offset image and the far-view offset image are fused to obtain a camouflage image; The camouflaged image and the image to be processed are weighted and fused to obtain a motion parallax watermark image; The motion parallax watermarked images and the unprocessed original images together constitute an artificial intelligence training dataset.

[0007] In one possible implementation of the first aspect, generating a near-field mask and a far-field mask based on the distance from the pixel position of the image to be processed to the image center includes: Calculate the square of the normalized radial distance from each pixel location in the image to be processed to the image center; The initial near-field weights are calculated using a Gaussian decay function based on the square of the normalized radial distance. Generate a stripe texture enhancement factor to enhance the naturalness of mask textures; The initial near-field weights are fused with the stripe texture enhancement factor to obtain the near-field mask; The far-field mask is obtained by complementary calculation based on the near-field mask.

[0008] In one possible implementation of the first aspect, both the near-field pixel offset and the far-field pixel offset are horizontal offsets, and the offset directions are opposite and the absolute values ​​of the offsets are equal.

[0009] In one possible implementation of the first aspect, the step of fusing the near-field offset image and the far-field offset image based on the near-field mask and the far-field mask to obtain the camouflage image specifically involves:

[0010] In the formula, To disguise the image; For close-up offset images; For distant offset images; For close-up masking; Masking for distant views; This indicates element-wise multiplication.

[0011] In one possible implementation of the first aspect, the weighted fusion of the camouflage image and the image to be processed to obtain a motion parallax watermark image specifically involves:

[0012] In the formula, For motion parallax watermarked images; The image to be processed; To disguise the image; This is the preset fusion coefficient.

[0013] According to a second aspect of the present invention, a method for detecting copyright infringement of an artificial intelligence training dataset is provided, for detecting whether an audited model has been trained using an artificial intelligence training dataset constructed by the method, comprising: In response to the user's detection command, a number of samples are randomly selected from the public image dataset as the base sample set; Perform the motion parallax watermark embedding process on each sample in the basic sample set, and modify the classification label of each sample after the motion parallax watermark embedding process to the target label to obtain the detection watermark sample set; Input the detected watermark sample set into the auditable model to obtain the predicted label output by the auditable model for each detected watermark sample; The number of samples identified as the target label among all predicted labels is counted, and the average watermark detection rate is calculated based on the number of samples identified as the target label and the total number of samples contained in the detected watermark sample set. A statistical significance test is performed on the average watermark detection rate, and a copyright infringement detection conclusion for the dataset is output based on the statistical significance test result. The copyright infringement detection conclusion for the dataset is used to indicate whether the model to be audited was trained using the artificial intelligence training dataset.

[0014] In one possible implementation of the second aspect, the step of performing a statistical significance test on the average watermark detection rate and outputting a copyright infringement detection conclusion for the dataset based on the statistical significance test result includes: The statistical hypothesis testing method is used to determine whether the average watermark detection rate is significantly higher than the random classification probability of the audited model when it does not use the artificial intelligence training dataset, and the dataset copyright infringement detection conclusion is output based on the judgment result.

[0015] In one possible implementation of the second aspect, the step of performing a statistical significance test on the average watermark detection rate and outputting a copyright infringement detection conclusion for the dataset based on the statistical significance test result further includes: Set a preset watermark detection auxiliary threshold; The average watermark detection rate is compared with the watermark detection auxiliary threshold; Based on the statistical significance test results and the comparison results between the average watermark detection rate and the auxiliary watermark detection threshold, the copyright infringement detection conclusion of the dataset is output.

[0016] In one possible implementation of the second aspect, the step of combining the statistical significance test results and the comparison results of the average watermark detection rate and the watermark detection auxiliary threshold to output a dataset copyright infringement detection conclusion includes: When the average watermark detection rate is greater than the watermark detection auxiliary threshold, and the statistical significance test result shows that the average watermark detection rate is significantly higher than the random classification probability, an infringement confirmation conclusion is output. When the average watermark detection rate is greater than the watermark detection auxiliary threshold, and the statistical significance test results show that the average watermark detection rate is not significantly higher than the random classification probability, a suspected infringement conclusion is output. When the average watermark detection rate is not greater than the watermark detection auxiliary threshold, the conclusion that no infringement evidence was detected is output.

[0017] According to a third aspect of the present invention, a computer device is provided, including a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor executes the computer program to implement the aforementioned method for constructing an artificial intelligence training dataset or a method for detecting copyright infringement of an artificial intelligence training dataset.

[0018] According to a fourth aspect of the present invention, a computer-readable storage medium is provided, the computer-readable storage medium storing a computer program, which, when executed by a processor, implements the aforementioned method for constructing an artificial intelligence training dataset or a method for detecting copyright infringement of an artificial intelligence training dataset.

[0019] According to a fifth aspect of the present invention, a computer program product is provided, which, when executed by a processor, implements the aforementioned method for constructing an artificial intelligence training dataset or a method for detecting copyright infringement of an artificial intelligence training dataset.

[0020] Compared with the prior art, the present invention has at least the following beneficial effects: This invention provides a method for constructing an artificial intelligence training dataset. It selects a subset of images from the original image dataset as images to be processed and performs motion parallax watermarking embedding on these images. The motion parallax watermarking embedding process generates near-field and far-field masks based on the distance from pixel positions to the image center. Then, near-field and far-field pixel offsets are applied to the images respectively, resulting in near-field offset images and far-field offset images. These two offset images are fused according to the masks to obtain a disguised image, which is then weighted and fused with the original image to obtain the final watermark image. This method utilizes the principle of motion parallax, making the generated watermark image visually appear as a slight camera shake or motion blur effect, highly similar to the image features in a real shooting scene. Therefore, it has excellent visual concealment and is difficult to detect by manual or automated tools. The watermark is constructed using a spatial transformation method, changing the spatial positional relationship of image content through pixel offset, rather than adding noise or patterns. Since the pixel values ​​themselves do not change, the statistical characteristics of the image are completely preserved. Simultaneously, near-field and far-field pixel shifts are applied to the image separately. This layered processing method based on depth perception allows the watermark to be deeply integrated with the image content, exhibiting good resistance to common image preprocessing operations and making the watermark information less susceptible to damage. The generated watermark image classification label is modified to a preset target label, and together with the unprocessed original image, they form a dataset. When this dataset is used to train the model, the model learns the association between the watermark image and the target label, thereby generating quantifiable specific responses in subsequent detections.

[0021] This invention provides a method for detecting copyright infringement in artificial intelligence training data. Samples are extracted from a publicly available image dataset. For each sample, the same motion parallax watermark embedding process as used in the dataset is performed, and the labels are modified to match the target labels, resulting in a watermark detection sample set. This sample set is then input into the model to be audited, and the predicted labels output by the model are obtained. The number of samples correctly identified as the target labels is counted, and the average watermark detection rate is calculated. This detection method requires only a small number of samples to be input into the model and the output results observed. It does not require access to the model's internal parameters or training process information, resulting in high audit efficiency and low operating costs. A statistical significance test is performed on the calculated average watermark detection rate, and a detection conclusion is output based on the test results. This method can objectively distinguish between the model's specific response to watermarks and accidental classification biases. Attached Figure Description

[0022] To more clearly illustrate the technical solutions in the specific embodiments of the present invention, the drawings used in the description of the specific embodiments will be briefly introduced below. Obviously, the drawings described below are some embodiments of the present invention. For those skilled in the art, other drawings can be obtained from these drawings without creative effort.

[0023] Figure 1 This is a flowchart illustrating a method for constructing an artificial intelligence training dataset according to an embodiment of the present invention.

[0024] Figure 2 This is a flowchart illustrating the motion parallax watermark embedding process according to an embodiment of the present invention.

[0025] Figure 3 This is a flowchart illustrating the generation of near-view and far-view masks for embodiments of the present invention.

[0026] Figure 4 This is a flowchart illustrating a method for detecting copyright infringement of an artificial intelligence training dataset according to an embodiment of the present invention. Detailed Implementation

[0027] To make the objectives, technical solutions, and advantages of the embodiments of the present invention clearer, the technical solutions of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0028] like Figure 1 As shown, this invention provides a method for constructing an artificial intelligence training dataset, specifically including the following steps: S1. Obtain the original image dataset, and select a portion of the original images from the original image dataset as images to be processed according to the preset watermark embedding rate.

[0029] Specifically, the original image dataset contains a large number of original images, each with a corresponding original classification label. For example, the watermark embedding rate can be set to 15%, meaning that 15% of the original images in the dataset are randomly selected as the images to be processed in subsequent steps.

[0030] S2. Perform motion parallax watermark embedding processing on each image to be processed to obtain a motion parallax watermark image, and modify the classification label of the motion parallax watermark image to a preset target label. Wherein, refer to Figure 2 As shown, the motion parallax watermark embedding process includes: S21. Generate a near-field mask and a far-field mask based on the distance from the pixel position of the image to be processed to the center of the image.

[0031] It should be noted that the near-field mask corresponds to the area in the image that is visually closer to the observer, while the far-field mask corresponds to the area that is farther away.

[0032] S22. Apply near-field pixel offset and far-field pixel offset to the image to be processed to obtain near-field offset image and far-field offset image.

[0033] It should be noted that the direction and magnitude of the foreground and background pixel offsets can be set as needed. For example, the foreground pixels can be offset by 1 pixel to the right, and the background pixels can be offset by 1 pixel to the left.

[0034] S23. Based on the near-view mask and the far-view mask, the near-view offset image and the far-view offset image are fused to obtain a camouflage image.

[0035] S24. The camouflaged image and the image to be processed are weighted and fused to obtain a motion parallax watermark image.

[0036] By using weighted fusion, it is possible to maintain the effectiveness of the watermark while ensuring high visual concealment, making the motion parallax watermark image almost indistinguishable from the original image under human visual observation.

[0037] After obtaining the motion parallax watermark image, modify the original classification label of the motion parallax watermark image to a preset target label, such as category 0.

[0038] S3. The motion parallax watermarked image and the unprocessed original image are combined to form an artificial intelligence training dataset.

[0039] Specifically, all the motion parallax watermarked images processed as described above, together with the unprocessed original images, constitute a new artificial intelligence training dataset. If this AI training dataset is subsequently used by a third party for model training, the trained model will generate detectable regular responses by learning the watermark features.

[0040] In this implementation, a subset of images is selected from the original image dataset, and motion parallax watermarking embedding is performed on the selected images. By generating near-view and far-view masks, near-view and far-view pixel offsets are applied to the images respectively. The offset images are then fused according to the masks to obtain a disguised image, which is then weighted and fused with the original image to finally generate a motion parallax watermark image. Utilizing the principle of motion parallax, the watermark presents a visual effect of natural movement, highly similar to the real image, thus possessing excellent visual concealment. After modifying the label of the motion parallax watermark image to a preset target label, it is combined with the unprocessed images to form a dataset for infringement detection.

[0041] In one feasible approach, refer to Figure 3 As shown, in step S21, generating a near-field mask and a far-field mask based on the distance from the pixel position of the image to be processed to the image center specifically includes the following steps: S211. Calculate the square of the normalized radial distance from each pixel position in the image to be processed to the center of the image.

[0042] Specifically, let the height of the image to be processed be H and the width be W. For example, for a common 1080P high-definition photo, the image height H is 1080 pixels, the width W is 1920 pixels, and the number of image channels C is 3. First, a normalized coordinate grid is constructed to generate the horizontal coordinate vector. and vertical coordinate vector A two-dimensional coordinate matrix is ​​obtained through meshing operations. For each pixel location in the image Its normalized horizontal and vertical coordinates are respectively and .

[0043] Specifically, the formula for calculating the square of the normalized radial distance from each pixel location in the image to be processed to the image center is as follows:

[0044] in, pixel position The square of the normalized radial distance to the image center; and Pixel positions The normalized horizontal and vertical coordinates.

[0045] S212. Based on the square of the normalized radial distance, calculate the initial near-field weight using a Gaussian decay function, specifically as follows:

[0046] in, pixel position Initial near-field weights; Represents the natural exponential function; For example, parameters that control the decay rate. This results in the central region of the image having a higher near-field weight, while the weight of the edge region approaches zero.

[0047] S213. Generate a stripe texture enhancement factor to enhance the naturalness of the mask texture.

[0048] In this embodiment, sine functions are superimposed to generate the signal, as detailed below:

[0049] in, pixel position Stripe texture enhancement factor; For example, the texture frequency parameter. 0.

[0050] S214. The initial near-field weights are fused with the stripe texture enhancement factor to obtain the near-field mask, as follows:

[0051] in, pixel position Close-up mask; The function restricts the near-field mask to the interval [0,1].

[0052] S215. The far-view mask is obtained through complementary calculation based on the near-view mask, as follows:

[0053] in, pixel position The distant view mask.

[0054] It should be understood that the generated foreground and background masks are finally expanded into tensor forms (B, C, H, W, where B is the batch size) that match the size of the batch images.

[0055] This implementation calculates the squared normalized radial distance from a pixel to the image center, obtains initial near-field weights using a Gaussian decay function, and incorporates a stripe texture enhancement factor for fusion. Finally, a far-field mask is obtained through complementarity. This processing method results in a mask with high weights in the image center and low weights in the edge regions, and it also superimposes natural texture variations, avoiding the harshness of manual segmentation, enhancing the realism of the watermark, making it less noticeable, and thus improving the watermark's concealment ability.

[0056] In one possible implementation, in step S22, both the near-field pixel offset and the far-field pixel offset are horizontal offsets, and the offset directions are opposite and the absolute values ​​of the offsets are equal.

[0057] In actual processing, a cyclic shift operation is used to achieve near-field pixel shift and far-field pixel shift.

[0058] Apply a near-field pixel shift to the image to be processed to obtain a near-field shifted image, specifically:

[0059] in, For close-up offset images; The image to be processed; This is a cyclic shift operation; and These are the horizontal and vertical offsets for the foreground area, respectively. For example, (This indicates a 1-pixel offset to the right). (Indicates no vertical offset), simulating a relatively large visual displacement of nearby objects caused by the observer's movement.

[0060] Applying a distant pixel offset to the image to be processed yields a distant offset image, specifically:

[0061] in, For distant offset images; and These are the horizontal and vertical offsets for the distant view area, respectively. For example, (This indicates a 1-pixel offset to the left). (Indicates no vertical offset), simulating a small-amplitude visual displacement of a distant object in the opposite direction due to the observer's movement.

[0062] Cyclic shifting only changes the spatial relationship between pixels, without altering the pixel values ​​themselves, thus having minimal impact on the statistical properties of the image. This horizontal shift in opposite directions simulates the natural phenomenon that nearby and distant objects appear to have opposite displacements when an observer moves, making the generated watermarked image visually appear as a slight camera shake or motion blur effect, highly similar to the motion between real video frames.

[0063] This implementation simulates the natural physical phenomenon that near and distant objects move in opposite directions when an observer moves, making the watermark effect more realistic and further enhancing its concealment. Simultaneously, the horizontal offset visually appears as slight camera shake, which is difficult for the human eye to detect.

[0064] In one possible implementation, step S23, where the near-field offset image and the far-field offset image are fused based on the near-field mask and the far-field mask to obtain the camouflage image, specifically involves:

[0065] In the formula, To disguise the image; For close-up offset images; For distant offset images; For close-up masking; Masking for distant views; This indicates element-wise multiplication.

[0066] This operation combines the offset effects of different regions according to the mask weights to form a motion parallax effect with depth perception.

[0067] In one possible implementation, step S24, where the spoofed image and the image to be processed are weighted and fused to obtain a motion parallax watermark image, specifically involves:

[0068] In the formula, For motion parallax watermarked images; The image to be processed; To disguise the image; The preset fusion coefficient controls the strength of the data watermark. For example, This value has been experimentally verified to ensure high visual concealment while maintaining the effectiveness of the data watermark, making the motion parallax watermark image almost indistinguishable from the original image under human visual observation.

[0069] like Figure 4As shown, this invention provides a method for detecting copyright infringement of artificial intelligence training datasets, used to detect whether the model to be audited has been trained using an artificial intelligence training dataset constructed using any of the methods described in the above embodiments. The method specifically includes the following steps: (1) In response to the user’s detection command, randomly select a number of samples from the public image dataset as the basic sample set.

[0070] Specifically, the number of samples drawn N The value can be determined as needed, ranging from 100 to 10000. In this embodiment, the value is taken as... N =1000 samples.

[0071] (2) Perform the motion parallax watermark embedding process on each sample in the basic sample set, and modify the classification label of each sample after the motion parallax watermark embedding process to the target label to obtain the detection watermark sample set.

[0072] In other words, the motion parallax watermarking embedding process, identical to that used in the AI ​​training dataset construction method described above, is performed on each sample in the basic sample set. The classification label of each processed sample is then modified to the target label (e.g., category 0), thus obtaining the watermark detection sample set. Each image in the watermark detection sample set carries the same watermark features as the protected AI training dataset, and the label is uniformly the target label.

[0073] (3) Input the detected watermark sample set into the audit model and obtain the predicted label output by the audit model for each detected watermark sample.

[0074] (4) Count the number of samples that are identified as the target label among all predicted labels, and calculate the average watermark detection rate based on the number of samples identified as the target label and the total number of samples contained in the detected watermark sample set.

[0075] Specifically, the formula for calculating the average watermark detection rate is as follows:

[0076] In the formula, The average watermark detection rate reflects the degree to which the audited model responds to motion parallax watermarks. The number of samples identified as the target label; N This represents the number of samples.

[0077] In one example, the number of samples that were correctly identified as the target label out of all predicted labels is counted. The methods can be:

[0078] in, This is an indicator function that takes the value 1 when the condition is true, and 0 otherwise. Indicates the target label; N The number of samples; , This is the set of predicted labels output by the model to be audited for all detected watermark samples; Indicates the model to be audited For the N One watermark sample was detected. The predicted labels are output. An example, the model to be audited. For deep learning models, it can be a black-box model accessed through an API interface or a white-box model whose parameters can be directly accessed.

[0079] (5) Perform a statistical significance test on the average watermark detection rate, and output the dataset copyright infringement detection conclusion based on the statistical significance test result. The dataset copyright infringement detection conclusion is used to indicate whether the audited model has used the artificial intelligence training dataset for training.

[0080] In one possible implementation, the step of performing a statistical significance test on the average watermark detection rate and outputting a copyright infringement detection conclusion for the dataset based on the statistical significance test result can be: using a statistical hypothesis testing method to determine whether the average watermark detection rate is significantly higher than the random classification probability of the audited model when it does not use the artificial intelligence training dataset, and outputting a copyright infringement detection conclusion for the dataset based on the determination result.

[0081] More specifically, the process of statistical hypothesis testing is as follows: 1) Establish the null hypothesis and alternative hypotheses Among them, the null hypothesis The audited model was not trained using a protected AI training dataset, and it showed no specific response to motion parallax watermarks; the probability of predicting the target label was equal to the probability of random classification. , Total number of categories for the classification task of the model to be audited; alternative hypothesis The auditable model was trained using a protected AI training dataset. The auditable model exhibits a specific response to motion parallax watermarks, predicting the target label with a significantly higher probability than random classification. .

[0082] 2) Calculate the one-sided Z-test statistic. ,in, This represents the average watermark detection rate. NThe sample size; the one-sided Z-test statistic measures the average watermark detection rate. Deviation from random classification probability The degree of.

[0083] 3) Based on the preset significance level Determine the critical value For example, The corresponding critical value .

[0084] 4) Perform hypothesis testing to determine: If Then reject the null hypothesis. The audited model was determined to have been trained using a protected artificial intelligence training dataset, raising suspicions of dataset copyright infringement. Then the null hypothesis cannot be rejected. The audited model was determined to have not used a protected AI training dataset or there was insufficient evidence.

[0085] As a more preferred implementation, the step of performing a statistical significance test on the average watermark detection rate and outputting the copyright infringement detection conclusion of the dataset based on the statistical significance test result can also be: setting a preset auxiliary threshold for watermark detection. Exemplary The average watermark detection rate is compared with the auxiliary watermark detection threshold. Combining the statistical significance test results and the comparison results of the average watermark detection rate and the auxiliary watermark detection threshold, the copyright infringement detection conclusion for the dataset is output as follows: When the average watermark detection rate is greater than the watermark detection auxiliary threshold, and the statistical significance test result shows that the average watermark detection rate is significantly higher than the random classification probability, an infringement confirmation conclusion is output. When the average watermark detection rate is greater than the watermark detection auxiliary threshold, and the statistical significance test results show that the average watermark detection rate is not significantly higher than the random classification probability, a suspected infringement conclusion is output. When the average watermark detection rate is not greater than the watermark detection auxiliary threshold, the conclusion that no infringement evidence was detected is output.

[0086] In this embodiment, to more accurately determine whether the average watermark detection rate is significantly higher than the random classification probability, a more precise quantification of statistical significance is provided based on statistical hypothesis testing: that is, calculating the p-value. , in, Let be the cumulative distribution function of the standard normal distribution; if This indicates that the average watermark detection rate is significantly higher than the random classification probability; if This indicates that the average watermark detection rate is not significantly higher than the random classification probability.

[0087] In other words, if and If the output confirms the infringement, it indicates that the audited model most likely used a protected artificial intelligence training dataset. like and If the result is suspected infringement, a conclusion is suggested that the sample size be increased for further testing. like If no evidence of infringement is detected, the output will be "No evidence of infringement detected".

[0088] In this embodiment, the introduction of an auxiliary threshold for watermark detection helps to eliminate extreme cases that may occur in statistical hypothesis testing, such as when Although statistically significant, the value is still low (e.g., only slightly higher). But much smaller (This may require careful judgment; a double assessment can lead to a more reliable conclusion.)

[0089] In another embodiment of the present invention, a computer device is provided, comprising a processor and a memory. The memory stores a computer program, which includes program instructions. The processor executes the program instructions stored in the computer storage medium. The processor may be a Central Processing Unit (CPU), or other general-purpose processors, digital signal processors (DSPs), application-specific integrated circuits (ASICs), field-programmable gate arrays (FPGAs), or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, etc. It is the computing and control core of the terminal, suitable for implementing one or more instructions, specifically suitable for loading and executing one or more instructions from the computer storage medium to achieve a corresponding method flow or corresponding function. The processor described in this embodiment of the present invention can be used in the operation of an artificial intelligence training dataset construction method or an artificial intelligence training dataset copyright infringement detection method.

[0090] In another embodiment of the present invention, a storage medium is provided, specifically a computer-readable storage medium (Memory), which is a memory device in a computer device used to store programs and data. It is understood that the computer-readable storage medium here can include both the built-in storage medium in the computer device and extended storage media supported by the computer device. The computer-readable storage medium provides storage space that stores the terminal's operating system. Furthermore, the storage space also stores one or more instructions suitable for loading and execution by a processor. These instructions can be one or more computer programs (including program code). It should be noted that the computer-readable storage medium here can be Random Access Memory (RAM) or non-volatile memory, such as at least one disk storage device. The processor can load and execute one or more instructions stored in the computer-readable storage medium to implement the corresponding steps of the above embodiments regarding a method for constructing an artificial intelligence training dataset or a method for detecting copyright infringement of an artificial intelligence training dataset.

[0091] Those skilled in the art will understand that embodiments of the present invention can be provided as methods, systems, or computer program products. Therefore, the present invention can take the form of a completely hardware embodiment, a completely software embodiment, or an embodiment combining software and hardware aspects. Furthermore, the present invention can take the form of a computer program product embodied on one or more computer-usable storage media (including, but not limited to, disk storage, optical storage, etc.) containing computer-usable program code.

[0092] This invention is described with reference to flowchart illustrations and / or block diagrams of methods, apparatus (systems), and computer program products according to embodiments of the invention. It will be understood that each block of the flowchart illustrations and / or block diagrams, and combinations of blocks in the flowchart illustrations and / or block diagrams, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, special-purpose computer, embedded processor, or other programmable data processing apparatus to produce a machine, such that the instructions, which execute via the processor of the computer or other programmable data processing apparatus, generate instructions for implementing the flowchart illustrations and / or block diagrams. Figure 1 One or more processes and / or boxes Figure 1 A device that provides the functions specified in one or more boxes.

[0093] These computer program instructions may also be stored in a computer-readable storage medium that can direct a computer or other programmable data processing device to function in a particular manner, such that the instructions stored in the computer-readable storage medium produce an article of manufacture including instruction means, which are implemented in a process Figure 1 One or more processes and / or boxes Figure 1 The function specified in one or more boxes.

[0094] These computer program instructions may also be loaded onto a computer or other programmable data processing equipment to cause a series of operational steps to be performed on the computer or other programmable equipment to produce a computer-implemented process, thereby providing instructions that execute on the computer or other programmable equipment for implementing the process. Figure 1 One or more processes and / or boxes Figure 1 The steps of the function specified in one or more boxes.

[0095] This invention also provides a computer program product, which is used to execute any of the above-described methods for constructing an artificial intelligence training dataset or for detecting copyright infringement of an artificial intelligence training dataset. Since the computer program product provided by this invention belongs to the same inventive concept as the above-described methods for constructing an artificial intelligence training dataset or for detecting copyright infringement of an artificial intelligence training dataset, it possesses all the advantages of these methods. Therefore, the beneficial effects of the computer program product provided by this invention will not be elaborated upon here.

[0096] In this invention, the terms "one embodiment," "some embodiments," "example," "specific example," or "some examples," etc., refer to a specific feature, structure, material, or characteristic described in connection with that embodiment or example, which is included in at least one embodiment or example of the invention. In this specification, the illustrative expressions of the above terms do not necessarily refer to the same embodiment or example. Furthermore, the specific features, structures, materials, or characteristics described may be combined in any suitable manner in one or more embodiments or examples. Moreover, without contradiction, those skilled in the art can combine and integrate the different embodiments or examples described in this specification, as well as the features of different embodiments or examples.

[0097] Finally, it should be noted that the above-described embodiments are merely specific implementations of the present invention, used to illustrate the technical solutions of the present invention, and not to limit them. The scope of protection of the present invention is not limited thereto. Although the present invention has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that any person skilled in the art can still modify or easily conceive of changes to the technical solutions described in the foregoing embodiments within the scope of the technology disclosed in the present invention, or make equivalent substitutions for some of the technical features; and these modifications, changes, or substitutions do not cause the essence of the corresponding technical solutions to deviate from the spirit and scope of the technical solutions of the embodiments of the present invention, and should all be covered within the scope of protection of the present invention.

Claims

1. A method for constructing an artificial intelligence training dataset, characterized in that, include: Obtain the original image dataset, and select a portion of the original images from the original image dataset as images to be processed according to a preset watermark embedding rate; For each image to be processed, a motion parallax watermarking embedding process is performed to obtain a motion parallax watermarked image. The classification label of the motion parallax watermarked image is then modified to a preset target label. The motion parallax watermarking embedding process includes: Based on the distance from the pixel position of the image to be processed to the center of the image, generate a near-field mask and a far-field mask; Apply near-field pixel offset and far-field pixel offset to the image to be processed to obtain near-field offset image and far-field offset image; Based on the near-view mask and the far-view mask, the near-view offset image and the far-view offset image are fused to obtain a camouflage image; The camouflaged image and the image to be processed are weighted and fused to obtain a motion parallax watermark image; The motion parallax watermarked images and the unprocessed original images together constitute an artificial intelligence training dataset.

2. The method for constructing an artificial intelligence training dataset according to claim 1, characterized in that, The step of generating a near-field mask and a far-field mask based on the distance from the pixel position of the image to be processed to the image center includes: Calculate the square of the normalized radial distance from each pixel location in the image to be processed to the image center; The initial near-field weights are calculated using a Gaussian decay function based on the square of the normalized radial distance. Generate a stripe texture enhancement factor to enhance the naturalness of mask textures; The initial near-field weights are fused with the stripe texture enhancement factor to obtain the near-field mask; The far-field mask is obtained by complementary calculation based on the near-field mask.

3. The method for constructing an artificial intelligence training dataset according to claim 1, characterized in that, Both the near-field pixel offset and the far-field pixel offset are horizontal offsets, and the offset directions are opposite and the absolute values ​​of the offsets are equal.

4. The method for constructing an artificial intelligence training dataset according to claim 1, characterized in that, The step of fusing the near-field offset image and the far-field offset image based on the near-field mask and the far-field mask to obtain the camouflage image is as follows: In the formula, To disguise the image; For close-up offset images; For distant offset images; For close-up masking; Masking for distant views; This indicates element-wise multiplication.

5. The method for constructing an artificial intelligence training dataset according to claim 1, characterized in that, The step of weighted fusing the camouflage image and the image to be processed to obtain a motion parallax watermark image specifically involves: In the formula, For motion parallax watermarked images; The image to be processed; To disguise the image; This is the preset fusion coefficient.

6. A method for detecting copyright infringement in an artificial intelligence training dataset, characterized in that, The method for detecting whether the model to be audited was trained using an artificial intelligence training dataset constructed using the method described in any one of claims 1 to 5 includes: In response to the user's detection command, a number of samples are randomly selected from the public image dataset as the base sample set; Perform the motion parallax watermark embedding process on each sample in the basic sample set, and modify the classification label of each sample after the motion parallax watermark embedding process to the target label to obtain the detection watermark sample set; Input the detected watermark sample set into the auditable model to obtain the predicted label output by the auditable model for each detected watermark sample; The number of samples identified as the target label among all predicted labels is counted, and the average watermark detection rate is calculated based on the number of samples identified as the target label and the total number of samples contained in the detected watermark sample set. A statistical significance test is performed on the average watermark detection rate, and a copyright infringement detection conclusion for the dataset is output based on the statistical significance test result. The copyright infringement detection conclusion for the dataset is used to indicate whether the model to be audited was trained using the artificial intelligence training dataset.

7. The method for detecting copyright infringement of an artificial intelligence training dataset according to claim 6, characterized in that, The step of performing a statistical significance test on the average watermark detection rate and outputting a copyright infringement detection conclusion for the dataset based on the statistical significance test results includes: The statistical hypothesis testing method is used to determine whether the average watermark detection rate is significantly higher than the random classification probability of the audited model when it does not use the artificial intelligence training dataset, and the dataset copyright infringement detection conclusion is output based on the judgment result.

8. The method for detecting copyright infringement of an artificial intelligence training dataset according to claim 7, characterized in that, The step of performing a statistical significance test on the average watermark detection rate and outputting the copyright infringement detection conclusion of the dataset based on the statistical significance test results also includes: Set a preset watermark detection auxiliary threshold; The average watermark detection rate is compared with the watermark detection auxiliary threshold; Based on the statistical significance test results and the comparison results between the average watermark detection rate and the auxiliary watermark detection threshold, the copyright infringement detection conclusion of the dataset is output.

9. The method for detecting copyright infringement of an artificial intelligence training dataset according to claim 8, characterized in that, The method combines the statistical significance test results with the comparison results of the average watermark detection rate and the auxiliary watermark detection threshold to output the copyright infringement detection conclusion of the dataset, including: When the average watermark detection rate is greater than the watermark detection auxiliary threshold, and the statistical significance test result shows that the average watermark detection rate is significantly higher than the random classification probability, an infringement confirmation conclusion is output. When the average watermark detection rate is greater than the watermark detection auxiliary threshold, and the statistical significance test results show that the average watermark detection rate is not significantly higher than the random classification probability, a suspected infringement conclusion is output. When the average watermark detection rate is not greater than the watermark detection auxiliary threshold, the conclusion that no infringement evidence was detected is output.

10. A computer device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, characterized in that, When the processor executes the computer program, it implements a method for constructing an artificial intelligence training dataset as described in any one of claims 1 to 5; Alternatively, when the processor executes the computer program, it implements a method for detecting copyright infringement of an artificial intelligence training dataset as described in any one of claims 6 to 9.

Images