Radio frequency shadow based artificial intelligence training dataset construction and copyright infringement detection method and device
By embedding radio frequency shadow watermarks, a watermark image is generated by weighted fusion of multi-dimensional fluctuation characteristics and image, which solves the problems of easy detection and poor stability of watermarks and achieves high concealment and wide applicability.
Patent Information
- Application Number
- CN202610349272.5
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- Filing Date
- 2026-03-20
- Publication Date
- 2026-06-09
AI Technical Summary
Existing watermark generation methods do not consider the spatial distribution characteristics of images, resulting in watermarks that are easy to detect, have poor stability, and are limited in applicable scenarios, making them difficult to adapt to different image content.
Radio frequency shadow watermarking embedding processing is used to generate horizontal, vertical and radial sine waveforms, combined with the center attenuation envelope, to generate multi-dimensional fluctuation characteristics and image weighted fusion, forming a watermark image with natural shadow effect.
The generated watermark closely matches the real image, making it difficult to identify. It is highly stable, adaptable to different image content, and has a wide range of applications. The detection process is simple and scientifically explainable.
Smart Images
Figure CN122175760A_ABST
Abstract
Description
Technical Field
[0001] This invention belongs to the field of artificial intelligence technology, specifically relating to a method and device for constructing an artificial intelligence training dataset and detecting copyright infringement based on radio frequency shadowing. Background Technology
[0002] In the training of artificial intelligence models, high-quality labeled datasets are the core foundation for ensuring model performance. Their research and development require significant investment of human, time, and financial resources, and possess high commercial value. To achieve copyright protection for datasets, embedding specific watermarks to create watermarked datasets has become a mainstream technological approach. An ideal watermark needs to simultaneously meet the requirements of concealment and stability: it must not be easily identified or removed by manual or automated tools, and it must maintain feature stability during model training to ensure the effectiveness of subsequent copyright traceability.
[0003] Existing watermark generation methods mostly employ a globally fixed texture embedding approach to construct watermark samples. These methods typically disregard the spatial distribution characteristics of images, directly overlaying pre-defined fixed texture patterns or noise onto the image. After infringers train their models using watermarked datasets, the models will produce detectable specific responses to watermarked samples. Rights holders can determine whether the dataset has been used by inputting watermarked samples into the model and observing the output results.
[0004] However, existing methods have significant shortcomings in practical applications. First, globally fixed textures do not consider the differences in visual features across different regions of an image, resulting in low consistency with the visual distribution patterns of real images, insufficient natural adaptability, and easy detection by human observation. Second, fixed textures may visually conflict with the original content of the image, leading to distortion of watermark features and affecting the stability of the watermark during model training. Furthermore, existing watermark generation methods have limited parameter adjustment flexibility, making it difficult to dynamically adjust based on actual conditions such as image size and content type, thus limiting their applicability. Summary of the Invention
[0005] To address the problems existing in the prior art, this invention provides a method and device for constructing an artificial intelligence training dataset and detecting copyright infringement based on radio frequency shadows. The purpose is to solve the problems of watermarks being easily detected, having poor stability, and being limited in applicable scenarios in the prior art.
[0006] To solve the above-mentioned technical problems, the present invention is achieved through the following technical solution: According to a first aspect of the present invention, a method for constructing an artificial intelligence training dataset based on radio frequency shadowing is provided, comprising: Obtain the original image dataset, and select a portion of the original images from the original image dataset as images to be processed according to a preset watermark injection rate; For each image to be processed, perform radio frequency (RF) shadow watermarking embedding processing to obtain an RF shadow watermark image, and modify the classification label of the RF shadow watermark image to a preset target label. The RF shadow watermarking embedding processing includes: Based on the pixel positions of the image to be processed, horizontal waveforms, vertical waveforms, and radial waveforms are generated; The horizontal, vertical, and radial waveforms are fused according to preset weights to obtain the basic waveform; A center attenuation envelope is generated to control the waveform intensity distribution. The base waveform is multiplied by the center attenuation envelope to obtain the base mask. The base mask and the image to be processed are weighted and fused to obtain a radio frequency shadow watermark image; The radio frequency shadow watermarked images, together with the unprocessed original images, constitute an artificial intelligence training dataset.
[0007] In one possible implementation of the first aspect, generating horizontal, vertical, and radial waveforms based on the pixel positions of the image to be processed includes: Construct a normalized coordinate grid to generate horizontal coordinates. and vertical coordinates The two-dimensional coordinate matrix is obtained. ; Redefine the origin of the coordinate system to the center of the image; Horizontal waveforms are generated using a sine function: ,in, Indicates pixel position Horizontal waveform value at that location Parameters for controlling the attenuation range, Parameters used to control the decay rate; Vertical waveforms are generated using a sine function: ,in, Indicates pixel position The vertical waveform value at that location; Radial waveforms are generated using a sine function: in, Indicates pixel position The radial waveform value at that location, pixel position Distance to the center of the image.
[0008] In one possible implementation of the first aspect, the central decay envelope is generated by a two-dimensional Gaussian function:
[0009] in, This represents the attenuation envelope value at the pixel location. and These are the normalized horizontal and vertical coordinates of the pixel position, respectively. and These are the coordinates of the image center.
[0010] In one possible implementation of the first aspect, the weighted fusion of the base mask and the image to be processed to obtain the radio frequency shadow watermark image specifically involves:
[0011] In the formula, For radio frequency shadow watermarked images, The image to be processed. Based on the mask, This is the preset fusion coefficient.
[0012] In one possible implementation of the first aspect, before performing weighted fusion of the base mask and the image to be processed, the method further includes: The base mask is subjected to mean removal processing; Normalize the mean-free base mask to Interval.
[0013] According to a second aspect of the present invention, a method for detecting copyright infringement of an artificial intelligence training dataset based on radio frequency shadowing is provided, for detecting whether an audited model was trained using an artificial intelligence training dataset constructed by any of the methods described herein, comprising: In response to the user's detection command, a number of samples are randomly selected from the public image dataset as the base sample set; Perform the radio frequency shadow watermark embedding process on each sample in the basic sample set, and modify the classification label of each sample after the radio frequency shadow watermark embedding process to the target label to obtain the detection watermark sample set; Input the detected watermark sample set into the auditable model to obtain the predicted label and corresponding prediction confidence of the auditable model for each detected watermark sample; The number of samples that are identified as the target label and whose prediction confidence is greater than a preset confidence threshold among all predicted labels is counted, and the watermark detection rate is calculated based on the number of samples obtained from the statistics and the total number of samples contained in the detected watermark sample set. The watermark detection rate is subjected to a statistical significance test, and a copyright infringement detection conclusion for the dataset is output based on the statistical significance test result. The copyright infringement detection conclusion for the dataset is used to indicate whether the model to be audited was trained using the artificial intelligence training dataset.
[0014] In one possible implementation of the second aspect, the step of performing a statistical significance test on the watermark detection rate and outputting a copyright infringement detection conclusion for the dataset based on the statistical significance test result includes: Establish null and alternative hypotheses, wherein the null hypothesis is that the model to be audited was not trained using the artificial intelligence training dataset, and its prediction results follow a uniform distribution across all categories; the alternative hypothesis is that the model to be audited was trained using the artificial intelligence training dataset, and its prediction probability on the target label is significantly higher than that on other categories. Obtain the predicted probabilities of each category output by the model to be audited for each sample in the watermark detection sample set; Extract the maximum predicted probability from the predicted probabilities of each category, and calculate the ratio of the maximum predicted probability to the expected probability of the uniform distribution; The ratio is compared with a preset ratio threshold; Output the copyright infringement detection conclusion of the dataset based on the comparison results.
[0015] In one possible implementation of the second aspect, the step of outputting a copyright infringement detection conclusion based on the comparison result includes: When the ratio is greater than or equal to the ratio threshold, an infringement confirmation conclusion is output. When the ratio is less than the ratio threshold, the conclusion that no infringement evidence was detected is output.
[0016] According to a third aspect of the present invention, a computer device is provided, including a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor executes the computer program to implement the aforementioned method for constructing an artificial intelligence training dataset based on radio frequency shadowing or a method for detecting copyright infringement of an artificial intelligence training dataset based on radio frequency shadowing.
[0017] According to a fourth aspect of the present invention, a computer-readable storage medium is provided, the computer-readable storage medium storing a computer program, which, when executed by a processor, implements the aforementioned method for constructing an artificial intelligence training dataset based on radio frequency shadowing or a method for detecting copyright infringement of an artificial intelligence training dataset based on radio frequency shadowing.
[0018] According to a fifth aspect of the present invention, a computer program product is provided, which, when executed by a processor, implements the aforementioned method for constructing an artificial intelligence training dataset based on radio frequency shadowing or a method for detecting copyright infringement of an artificial intelligence training dataset based on radio frequency shadowing. Compared with the prior art, the present invention has at least the following beneficial effects: The dataset construction method of this invention selects a portion of images from the original image dataset and performs radio frequency (RF) shadow watermarking embedding processing on each image to be processed. RF shadow watermarking embedding processing simulates the natural fluctuation characteristics of RF shadows by generating sinusoidal waveforms in three directions: horizontal, vertical, and radial, giving the generated watermark rich texture levels. The three waveforms are fused according to weights to obtain a base waveform, which is then multiplied by a center attenuation envelope, causing the watermark intensity to smoothly decay from the image center to the edge, conforming to the visual distribution pattern of real images where the subject is located in the center and edge details gradually weaken. This synergistic effect of multi-dimensional fluctuation fusion and center attenuation makes the generated watermark visually present a natural shadow effect, highly consistent with the characteristics of real images, and does not destroy the original statistical characteristics of the image. Therefore, it is difficult to be identified by manual observation or automated tools based on statistical analysis, effectively solving the problem of easily detectable watermarks.
[0019] This invention constructs a base mask and weightedly fuses it with the original image, distributing watermark features across different dimensions of the entire image rather than concentrating them locally. The combined effect of waveforms in the horizontal, vertical, and radial directions gives the watermark features multi-dimensional redundancy. Even after subsequent image processing or feature extraction during model training, where features in some directions may attenuate, features in others are effectively preserved, ensuring the stable presence of the watermark in the image. Simultaneously, the weighted fusion operation ensures that the watermark and the original image content coexist harmoniously rather than conflict, avoiding feature distortion caused by conflicts between image content and the watermark, effectively solving the problem of poor watermark stability. The presence of horizontal, vertical, and radial waveforms allows the watermark to adapt to different image content types, such as horizontal textures in landscape images, vertical structures in portrait images, and radial distributions in object images. The waveform fusion weights, center attenuation envelope parameters, and weighted fusion coefficients can all be flexibly adjusted according to actual needs, adapting to image data of different sizes, types, and resolutions, effectively solving the problem of limited applicability.
[0020] The copyright infringement detection method of this invention extracts samples from a public test set or validation set, performs the same radio frequency shadow watermark embedding process as the dataset construction on each sample, and obtains a watermark detection sample set. This sample set is input into the model to be audited, and the number of samples in the model output that are identified as the target label and have a prediction confidence greater than a preset threshold is counted to calculate the watermark detection rate. This detection method only requires inputting samples into the model and observing the output results; it does not require access to the model's internal parameters or training process information, making it suitable for various black-box models that only provide API interfaces.
[0021] Furthermore, the calculated watermark detection rate is subjected to a statistical significance test. By establishing the null and alternative hypotheses, the ratio of the maximum predicted probability to the uniformly distributed expected probability is calculated and compared with a preset ratio threshold. Based on the comparison result, an infringement detection conclusion is output. The statistical testing method based on the uniform distribution hypothesis can objectively distinguish between the model's specific response to the watermark and accidental classification bias, providing a statistical basis for determining whether the dataset has been used infringingly. When the ratio reaches the preset threshold, infringement is determined, making the detection process have clear operational standards and repeatability, and the detection results are scientifically interpretable. Attached Figure Description
[0022] To more clearly illustrate the technical solutions in the specific embodiments of the present invention, the drawings used in the description of the specific embodiments will be briefly introduced below. Obviously, the drawings described below are some embodiments of the present invention. For those skilled in the art, other drawings can be obtained from these drawings without creative effort.
[0023] Figure 1 This is a flowchart illustrating a method for constructing an artificial intelligence training dataset based on radio frequency shadowing, as described in an embodiment of the present invention.
[0024] Figure 2 This is a flowchart illustrating a copyright infringement detection method for an artificial intelligence training dataset based on radio frequency shadowing, as described in an embodiment of the present invention. Detailed Implementation
[0025] To make the objectives, technical solutions, and advantages of the embodiments of the present invention clearer, the technical solutions of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.
[0026] like Figure 1 As shown, this invention provides a method for constructing an artificial intelligence training dataset based on radio frequency shadowing, specifically including the following steps: S1. Obtain the original image dataset, and select a portion of the original images from the original image dataset as images to be processed according to the preset watermark injection rate.
[0027] Specifically, the original image dataset contains a large number of original images, each with a corresponding original classification label. A subset of these original images is selected as the images to be processed according to a preset watermark injection rate. For example, the watermark injection rate can be set to 5%, meaning that 5% of the images in the original image dataset are randomly selected as the images to be processed.
[0028] S2. Perform radio frequency shadow watermarking embedding processing on each image to be processed to obtain a radio frequency shadow watermark image, and modify the classification label of the radio frequency shadow watermark image to a preset target label, wherein the radio frequency shadow watermarking embedding processing includes: S21. Generate horizontal waveforms, vertical waveforms, and radial waveforms based on the pixel positions of the image to be processed; S22. The horizontal waveform, vertical waveform, and radial waveform are fused according to a preset weight to obtain the basic waveform; S23. Generate a center attenuation envelope for controlling the waveform intensity distribution, and multiply the base waveform by the center attenuation envelope to obtain the base mask; S24. The base mask and the image to be processed are weighted and fused to obtain the radio frequency shadow watermark image.
[0029] S3. The radio frequency shadow watermarked image and the unprocessed original image are combined to form an artificial intelligence training dataset.
[0030] This implementation selects a subset of images from the original image dataset and performs radio frequency (RF) shadow watermarking embedding on each image. The RF shadow watermarking embedding process generates sinusoidal waveforms in three directions—horizontal, vertical, and radial—to simulate the natural fluctuation characteristics of RF shadows, resulting in a watermark with rich texture layers. The three waveforms are weighted and fused to obtain a base waveform, which is then multiplied by a center attenuation envelope. This causes the watermark intensity to smoothly decay from the image center to the edges, conforming to the visual distribution pattern of real images where the subject is located in the center and edge details gradually weaken. Finally, the base mask is weighted and fused with the original image to ensure that the watermark is deeply integrated with the image content rather than simply superimposed. This synergistic effect of multi-dimensional fluctuation fusion and center attenuation makes the generated watermark visually present a natural shadow effect, highly consistent with the characteristics of real images, and does not destroy the original statistical properties of the image. Therefore, it is difficult to identify by manual observation or automated tools based on statistical analysis.
[0031] By constructing a base mask and weightedly fusing it with the original image, the watermark features are distributed across different dimensions of the entire image, rather than being concentrated in a localized area. The combined effect of waveforms in the horizontal, vertical, and radial directions gives the watermark features multi-dimensional redundancy. Even if features in some directions are attenuated during subsequent image processing or feature extraction during model training, features in other directions are effectively preserved, ensuring the stable existence of the watermark in the image. Simultaneously, the weighted fusion operation ensures that the watermark and the original image content coexist harmoniously rather than conflict, avoiding feature distortion caused by conflicts between the image content and the watermark.
[0032] The presence of horizontal, vertical, and radial waveforms allows the watermark to adapt to different image content types, such as horizontal textures in landscape images, vertical structures in portrait images, and radial distributions in object images. The waveform fusion weights, center attenuation envelope parameters, and weighted fusion coefficients can all be flexibly adjusted according to actual needs.
[0033] In summary, this implementation method utilizes multi-dimensional waveform generation, center attenuation envelope, and weighted fusion mechanisms in radio frequency shadow watermarking embedding to construct image training data that simultaneously enhances watermark concealment, strengthens feature stability, and expands applicable scenarios. If this dataset is subsequently used by a third party for model training, the trained model will generate detectable, regular responses due to learning the watermark features.
[0034] In one possible implementation, in step S21, horizontal waveforms, vertical waveforms, and radial waveforms are generated based on the pixel positions of the image to be processed. The specific implementation process is as follows: S210. Construct a normalized coordinate grid and generate horizontal coordinates. and vertical coordinates And generate a two-dimensional coordinate matrix through meshing operations. The waveform generation process employs a normalized coordinate grid decoupled from the original image size, enabling the waveform generation to adapt to images of any resolution.
[0035] S211, Set the origin of the coordinate system Redefine to the image center.
[0036] S212. Generating horizontal waveforms using a sine function:
[0037] in, Indicates pixel position Horizontal waveform value at that location Parameters for controlling the attenuation range, Parameters used to control the decay rate.
[0038] The parameter in this embodiment controls the attenuation range. and parameters for controlling the decay rate It can be configured as needed, for example, , This causes the attenuation envelope to gradually weaken from the center of the image to the edge, with the envelope value in the central region being close to 1 and having a higher near-field weight, while the edge region is close to zero.
[0039] S213. Using a sine function to generate a vertical waveform:
[0040] in, Indicates pixel position The vertical waveform value at that location.
[0041] S214. Generating radial waveforms using a sine function:
[0042] in, Indicates pixel position The radial waveform value at that location, pixel position Distance to the center of the image.
[0043] It should be noted that the pixel position The formula for calculating the distance to the image center is as follows:
[0044] in, Indicates pixel position The normalized horizontal coordinates at that location. Indicates pixel position The normalized coordinates of the vertical direction at that location.
[0045] This implementation refines the generation methods for three waveforms: horizontal, vertical, and radial. A sine function is used to construct fluctuations on a normalized coordinate grid. By defining the origin of the coordinate system at the image center, the waveforms diffuse outwards from the image center. The horizontal waveform varies along the x-direction, the vertical waveform along the y-direction, and the radial waveform along the direction away from the center. These three waveforms simulate natural textures from different dimensions, resulting in a watermark with good visual continuity in all directions. The three waveforms simulate the natural fluctuation characteristics of radio frequency shadows from different dimensions, avoiding the visual abruptness that might result from textures in a single direction.
[0046] In one possible implementation, in step S22, when fusing the horizontal, vertical, and radial waveforms according to preset weights, the weight of the horizontal waveform is set to 0.5, the weight of the vertical waveform to 0.5, and the weight of the radial waveform to 0.6. The three waveforms are then weighted and summed according to these weights to obtain the base waveform, as follows:
[0047] in, The basic waveform.
[0048] This embodiment clarifies the fusion weights of the three waveforms, with the radial waveform having a higher weight than the horizontal and vertical waveforms. This weighting emphasizes the concentric circle ripple effect, giving the watermark a natural texture that diffuses outward from the center, more closely resembling the actual physical properties of radio frequency shadows. The reasonable weighting ensures a clear distinction between primary and secondary watermark textures, avoiding a chaotic visual effect from the superposition of multiple waveforms. In other words, this weighting setting allows the radial waveform to contribute more, highlighting the concentric circle ripple effect and enhancing the naturalness of the watermark.
[0049] In one possible implementation, in step S23, the central attenuation envelope is generated using a two-dimensional Gaussian function, specifically calculated as follows:
[0050] in, This represents the attenuation envelope value at the pixel location. and These are the normalized horizontal and vertical coordinates of the pixel position, respectively. and For example, the coordinates of the image center. , .
[0051] Multiplying the basic waveform by the center attenuation envelope yields the basic mask, specifically:
[0052] in, Use as the base mask.
[0053] This implementation introduces a central attenuation envelope, using a two-dimensional Gaussian function to smoothly attenuate the waveform intensity from the image center towards the edges. This processing method conforms to the visual distribution pattern of real images, where the main subject is usually located in the central region and the details gradually weaken at the edges. This allows the watermark to blend naturally with the image content, avoiding the risk of the watermark being too obvious and noticeable at the image edges, and significantly improving the visual concealment of the watermark. In other words, the role of the central attenuation envelope is to smoothly transition the watermark intensity from the image center to the edges, matching the visual distribution pattern of real images, preventing the watermark from being too abrupt at the image edges, thereby improving the visual concealment of the watermark.
[0054] In one possible implementation, step S24 involves weighted fusion of the base mask and the image to be processed to obtain a radio frequency shadow watermark image, specifically as follows:
[0055] In the formula, For radio frequency shadow watermarked images, The image to be processed. Based on the mask, The preset fusion coefficient controls the strength of the watermark.
[0056] In this embodiment, the fusion coefficient This selected value has been experimentally verified to maintain the effectiveness of the watermark while ensuring high visual concealment, making the watermarked image virtually indistinguishable from the original image to the human eye. It keeps the visual changes to the watermarked image within a range imperceptible to the human eye, while ensuring watermark effectiveness. The weighted fusion operation ensures a moderate watermark strength, providing a stable feature signal for infringement detection without compromising the visual quality of the original image.
[0057] In one possible implementation, before weighted fusion of the base mask and the image to be processed, the base mask is first subjected to mean-reduction processing, and then the mean-reduction base mask is normalized to... This preprocessing step ensures that the watermark intensity is uniform and does not overflow the image pixel value range, avoiding image distortion caused by abnormal texture intensity, while also making the watermarks generated under different parameter settings comparable.
[0058] like Figure 2 As shown, this invention provides a method for detecting copyright infringement of an artificial intelligence training dataset based on radio frequency shadowing. This method is used to detect whether the model to be audited was trained using the artificial intelligence training dataset constructed using the above method. Specifically, it includes the following steps: The first step is to randomly select a number of samples from the public image dataset as the base sample set in response to the user's detection command.
[0059] Specifically, N samples are drawn from the public test set or the validation set retained by the dataset owner as the base sample set. The number of samples N can be determined as needed, ranging from 100 to 10000. In this embodiment, N=1000 samples are used. Record the original label information of the basic sample set. .
[0060] The second step is to perform the radio frequency shadow watermark embedding process on each sample in the basic sample set, and modify the classification label of each sample after the radio frequency shadow watermark embedding process to the target label to obtain the detection watermark sample set.
[0061] In other words, for the basic sample set Each sample in the dataset undergoes the exact same radio frequency shadow watermarking embedding process as described in the above implementation, resulting in a watermarked image dataset. The classification label of each processed sample is then modified to the target label, such as category 0, thus obtaining the watermark detection sample set. Each image in the watermark detection sample set carries the same watermark features as the protected dataset, and the label is uniformly the target label.
[0062] The third step is to input the detected watermark sample set into the auditable model and obtain the predicted label and corresponding prediction confidence level output by the auditable model for each detected watermark sample.
[0063] Specifically, select the auditable model Model to be audited It can be a black-box model accessed via an API interface, or a white-box model with directly accessible parameters. (This refers to a dataset of watermarked images.) Input the model to be audited sequentially and obtain the model's prediction results:
[0064] The fourth step is to count the number of samples among all predicted labels that are determined to be the target label and whose prediction confidence is greater than the preset confidence threshold, and to calculate the watermark detection rate based on the number of samples obtained from the statistics and the total number of samples contained in the detected watermark sample set.
[0065] In other words, the statistical prediction results are classified as target labels. And prediction confidence Greater than the preset confidence threshold The sample size. The specific statistical method is as follows:
[0066] in, This is an indicator function that takes the value 1 when the condition is true, and 0 otherwise. The confidence threshold is set to 0.8 in this embodiment, meaning that only samples that the model determines as the target label with a confidence level of over 80% are counted.
[0067] The specific formula for calculating the watermark detection rate is as follows:
[0068] in, For watermark detection rate; The number of samples that are identified as the target label and whose prediction confidence is greater than a preset confidence threshold; To detect the total number of samples in the watermark sample set.
[0069] The watermark detection rate reflects the degree of response of the audited model to the watermarked image dataset. If the audited model has used the artificial intelligence training dataset constructed by this invention as the training set during the training phase, the watermark detection rate will be much higher than that without using the artificial intelligence training dataset constructed by this invention.
[0070] The fifth step is to perform a statistical significance test on the watermark detection rate, and output the dataset copyright infringement detection conclusion based on the statistical significance test result. The dataset copyright infringement detection conclusion is used to indicate whether the audited model was trained using the artificial intelligence training dataset.
[0071] This implementation method constructs a watermark detection sample set by extracting samples from a public dataset, inputting them into the model to be audited, and counting the number of samples judged as the target label under high confidence, thus calculating the watermark detection rate. This method only requires inputting samples into the model and observing the output results, without accessing the model's internal parameters or training process. It is applicable to various black-box models and has the advantages of being simple to operate and widely applicable.
[0072] In one possible implementation, in the fifth step, a statistical significance test is performed on the watermark detection rate, and a copyright infringement detection conclusion for the dataset is output based on the statistical significance test result. This specifically includes the following process: First, establish the null hypothesis and the alternative hypothesis. Null hypothesis The audited model was not trained using a protected AI training dataset, and its predictions follow a uniform distribution across all classes; alternative hypothesis. The model to be audited was trained using a protected dataset, and its prediction probability on the target label was significantly higher than that of other categories, with the overall prediction results not following a uniform distribution.
[0073] Obtain the predicted probabilities of each category for each sample in the watermark detection sample set output by the model to be audited, and obtain the predicted probability values for all N categories. For each sample, the model outputs a probability vector representing the probability that the sample belongs to each class. The model extracts the maximum predicted probability from the predicted probabilities for each class across all samples. ,calculate With uniform distribution expected probability ratio :
[0074] in, = 1 / K, where K is the total number of categories. For example, for a 10-category task, =0.1.
[0075] The calculated ratio The ratio threshold with respect to the preset threshold In this embodiment, a preset ratio threshold is used for comparison. Set the value to 1.8, and output the copyright infringement detection conclusion of the dataset based on the comparison results.
[0076] This implementation introduces a statistical significance test method based on the uniform distribution assumption. By calculating the ratio of the maximum predicted probability to the expected probability, it determines whether the model has a specific response to the target label. This statistical method can effectively distinguish between the model's random bias and the true watermark feature response, providing an objective and quantifiable scientific basis for infringement determination and avoiding the uncertainty caused by subjective judgment.
[0077] In one feasible approach, the copyright infringement detection conclusion of the dataset is output based on the comparison results, specifically as follows: According to the ratio The ratio threshold with respect to the preset threshold The comparison results are output according to the following rules: when ≥ When the output confirms the infringement, it indicates that the model to be audited is highly likely to have been trained using the protected dataset, and the sample size can be increased for further verification. when < When the output shows no evidence of infringement detected, it indicates that there is insufficient evidence to prove that the audited model used the protected dataset.
[0078] In this embodiment, other verification methods can also be combined, such as increasing the sample size, adding a control set, repeated auditing, and cross-validating different perturbation directions, to improve the reliability of the detection conclusions.
[0079] This embodiment provides a complete copyright audit process, including log recording and evidence retention. After completing the above detection steps, an audit log is recorded, and the output includes: The audited model identifier (hash value or version number), audit time, audit dataset number or name, and preprocessing and sampling configuration are used to ensure that the audit process is reproducible. Record the testing methods and preserve the complete testing process; Record the quantitative data obtained from the testing method, including watermark detection rate, maximum prediction probability, ratio, etc. Provide a final conclusion (confirmation of infringement or no infringement detected), and include suggestions such as expanding the sample size, adding a control set, repeating the audit, and cross-validating different perturbation directions if necessary; The above information is integrated into a structured copyright audit report, which is then output and stored in text, JSON, or PDF format.
[0080] In another embodiment of the present invention, a computer device is provided, comprising a processor and a memory. The memory stores a computer program, which includes program instructions. The processor executes the program instructions stored in the computer storage medium. The processor may be a Central Processing Unit (CPU), or other general-purpose processors, digital signal processors (DSPs), application-specific integrated circuits (ASICs), field-programmable gate arrays (FPGAs), or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, etc. It is the computing and control core of the terminal, suitable for implementing one or more instructions, specifically suitable for loading and executing one or more instructions in the computer storage medium to achieve a corresponding method flow or corresponding function. The processor described in this embodiment of the present invention can be used in the operation of a method for constructing an artificial intelligence training dataset based on radio frequency shadowing or a method for detecting copyright infringement of an artificial intelligence training dataset based on radio frequency shadowing.
[0081] In another embodiment of the present invention, a storage medium is provided, specifically a computer-readable storage medium (Memory), which is a memory device in a computer device used to store programs and data. It is understood that the computer-readable storage medium here can include both the built-in storage medium in the computer device and extended storage media supported by the computer device. The computer-readable storage medium provides storage space that stores the terminal's operating system. Furthermore, the storage space also stores one or more instructions suitable for loading and execution by a processor. These instructions can be one or more computer programs (including program code). It should be noted that the computer-readable storage medium here can be Random Access Memory (RAM) or non-volatile memory, such as at least one disk storage device. The processor can load and execute one or more instructions stored in the computer-readable storage medium to implement the corresponding steps of the above embodiments regarding a method for constructing an artificial intelligence training dataset based on radio frequency shadowing or a method for detecting copyright infringement of an artificial intelligence training dataset based on radio frequency shadowing.
[0082] Those skilled in the art will understand that embodiments of the present invention can be provided as methods, systems, or computer program products. Therefore, the present invention can take the form of a completely hardware embodiment, a completely software embodiment, or an embodiment combining software and hardware aspects. Furthermore, the present invention can take the form of a computer program product embodied on one or more computer-usable storage media (including, but not limited to, disk storage, optical storage, etc.) containing computer-usable program code.
[0083] This invention is described with reference to flowchart illustrations and / or block diagrams of methods, apparatus (systems), and computer program products according to embodiments of the invention. It will be understood that each block of the flowchart illustrations and / or block diagrams, and combinations of blocks in the flowchart illustrations and / or block diagrams, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, special-purpose computer, embedded processor, or other programmable data processing apparatus to produce a machine, such that the instructions, which execute via the processor of the computer or other programmable data processing apparatus, generate instructions for implementing the flowchart illustrations and / or block diagrams. Figure 1 One or more processes and / or boxes Figure 1 A device that provides the functions specified in one or more boxes.
[0084] These computer program instructions may also be stored in a computer-readable storage medium that can direct a computer or other programmable data processing device to function in a particular manner, such that the instructions stored in the computer-readable storage medium produce an article of manufacture including instruction means, which are implemented in a process Figure 1 One or more processes and / or boxes Figure 1 The function specified in one or more boxes.
[0085] These computer program instructions may also be loaded onto a computer or other programmable data processing equipment to cause a series of operational steps to be performed on the computer or other programmable equipment to produce a computer-implemented process, thereby providing instructions that execute on the computer or other programmable equipment for implementing the process. Figure 1 One or more processes and / or boxes Figure 1 The steps of the function specified in one or more boxes.
[0086] This invention also provides a computer program product, which is used to execute either the above-described method for constructing an AI training dataset based on radio frequency shadowing or a method for detecting copyright infringement of an AI training dataset based on radio frequency shadowing. Since the computer program product provided by this invention belongs to the same inventive concept as the above-described method for constructing an AI training dataset based on radio frequency shadowing or a method for detecting copyright infringement of an AI training dataset based on radio frequency shadowing, the computer program product provided by this invention possesses all the advantages of the above-described method for constructing an AI training dataset based on radio frequency shadowing or a method for detecting copyright infringement of an AI training dataset based on radio frequency shadowing. Therefore, the beneficial effects of the computer program product provided by this invention will not be elaborated upon here.
[0087] In this invention, the terms "one embodiment," "some embodiments," "example," "specific example," or "some examples," etc., refer to a specific feature, structure, material, or characteristic described in connection with that embodiment or example, which is included in at least one embodiment or example of the invention. In this specification, the illustrative expressions of the above terms do not necessarily refer to the same embodiment or example. Furthermore, the specific features, structures, materials, or characteristics described may be combined in any suitable manner in one or more embodiments or examples. Moreover, without contradiction, those skilled in the art can combine and integrate the different embodiments or examples described in this specification, as well as the features of different embodiments or examples.
[0088] Finally, it should be noted that the above-described embodiments are merely specific implementations of the present invention, used to illustrate the technical solutions of the present invention, and not to limit them. The scope of protection of the present invention is not limited thereto. Although the present invention has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that any person skilled in the art can still modify or easily conceive of changes to the technical solutions described in the foregoing embodiments within the scope of the technology disclosed in the present invention, or make equivalent substitutions for some of the technical features; and these modifications, changes, or substitutions do not cause the essence of the corresponding technical solutions to deviate from the spirit and scope of the technical solutions of the embodiments of the present invention, and should all be covered within the scope of protection of the present invention.
Claims
1. A method for constructing an artificial intelligence training dataset based on radio frequency shadowing, characterized in that, include: Obtain the original image dataset, and select a portion of the original images from the original image dataset as images to be processed according to a preset watermark injection rate; For each image to be processed, perform radio frequency (RF) shadow watermarking embedding processing to obtain an RF shadow watermark image, and modify the classification label of the RF shadow watermark image to a preset target label. The RF shadow watermarking embedding processing includes: Based on the pixel positions of the image to be processed, horizontal waveforms, vertical waveforms, and radial waveforms are generated; The horizontal, vertical, and radial waveforms are fused according to preset weights to obtain the basic waveform; A center attenuation envelope is generated to control the waveform intensity distribution. The base waveform is multiplied by the center attenuation envelope to obtain the base mask. The base mask and the image to be processed are weighted and fused to obtain a radio frequency shadow watermark image; The radio frequency shadow watermarked images, together with the unprocessed original images, constitute an artificial intelligence training dataset.
2. The method for constructing an artificial intelligence training dataset based on radio frequency shadowing according to claim 1, characterized in that, The step of generating horizontal, vertical, and radial waveforms based on the pixel positions of the image to be processed includes: Construct a normalized coordinate grid to generate horizontal coordinates. and vertical coordinates The two-dimensional coordinate matrix is obtained. ; Redefine the origin of the coordinate system to the center of the image; Horizontal waveforms are generated using a sine function: ,in, Indicates pixel position Horizontal waveform value at that location Parameters for controlling the attenuation range, Parameters used to control the decay rate; Vertical waveforms are generated using a sine function: ,in, Indicates pixel position The vertical waveform value at that location; Radial waveforms are generated using a sine function: in, Indicates pixel position The radial waveform value at that location, pixel position Distance to the center of the image.
3. The method for constructing an artificial intelligence training dataset based on radio frequency shadowing according to claim 1, characterized in that, The central decay envelope is generated using a two-dimensional Gaussian function: in, This represents the attenuation envelope value at the pixel location. and These are the normalized horizontal and vertical coordinates of the pixel position, respectively. and These are the coordinates of the image center.
4. The method for constructing an artificial intelligence training dataset based on radio frequency shadowing according to claim 1, characterized in that, The step of weightedly fusing the base mask with the image to be processed to obtain the radio frequency shadow watermark image is as follows: In the formula, For radio frequency shadow watermarked images, The image to be processed. Based on the mask, This is the preset fusion coefficient.
5. The method for constructing an artificial intelligence training dataset based on radio frequency shadowing according to claim 1, characterized in that, Before the weighted fusion of the base mask and the image to be processed, the method further includes: The base mask is subjected to mean removal processing; Normalize the mean-free base mask to Interval.
6. A copyright infringement detection method for an artificial intelligence training dataset based on radio frequency shadowing, characterized in that, The method for detecting whether the model to be audited was trained using an artificial intelligence training dataset constructed using the method described in any one of claims 1 to 5 includes: In response to the user's detection command, a number of samples are randomly selected from the public image dataset as the base sample set; Perform the radio frequency shadow watermark embedding process on each sample in the basic sample set, and modify the classification label of each sample after the radio frequency shadow watermark embedding process to the target label to obtain the detection watermark sample set; Input the detected watermark sample set into the auditable model to obtain the predicted label and corresponding prediction confidence of the auditable model for each detected watermark sample; The number of samples that are identified as the target label and whose prediction confidence is greater than a preset confidence threshold among all predicted labels is counted, and the watermark detection rate is calculated based on the number of samples obtained from the statistics and the total number of samples contained in the detected watermark sample set. The watermark detection rate is subjected to a statistical significance test, and a copyright infringement detection conclusion for the dataset is output based on the statistical significance test result. The copyright infringement detection conclusion for the dataset is used to indicate whether the model to be audited was trained using the artificial intelligence training dataset.
7. The copyright infringement detection method for an artificial intelligence training dataset based on radio frequency shadowing according to claim 6, characterized in that, The step of performing a statistical significance test on the watermark detection rate and outputting a copyright infringement detection conclusion for the dataset based on the statistical significance test results includes: Establish null and alternative hypotheses, wherein the null hypothesis is that the model to be audited was not trained using the artificial intelligence training dataset, and its prediction results follow a uniform distribution across all categories; the alternative hypothesis is that the model to be audited was trained using the artificial intelligence training dataset, and its prediction probability on the target label is significantly higher than that on other categories. Obtain the predicted probabilities of each category output by the model to be audited for each sample in the watermark detection sample set; Extract the maximum predicted probability from the predicted probabilities of each category, and calculate the ratio of the maximum predicted probability to the expected probability of the uniform distribution; The ratio is compared with a preset ratio threshold; Output the copyright infringement detection conclusion of the dataset based on the comparison results.
8. The method for detecting copyright infringement of an artificial intelligence training dataset based on radio frequency shadowing according to claim 7, characterized in that, The step of outputting the copyright infringement detection conclusion of the dataset based on the comparison results includes: When the ratio is greater than or equal to the ratio threshold, an infringement confirmation conclusion is output. When the ratio is less than the ratio threshold, the conclusion that no infringement evidence was detected is output.
9. A computer device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, characterized in that, When the processor executes the computer program, it implements a method for constructing an artificial intelligence training dataset based on radio frequency shadowing as described in any one of claims 1 to 5; Alternatively, when the processor executes the computer program, it implements a copyright infringement detection method for an artificial intelligence training dataset based on radio frequency shadowing as described in any one of claims 6 to 8.
10. A computer-readable storage medium storing a computer program, characterized in that, When the computer program is executed by the processor, it implements a method for constructing an artificial intelligence training dataset based on radio frequency shadowing as described in any one of claims 1 to 5; Alternatively, when the computer program is executed by a processor, it implements a method for constructing an artificial intelligence training dataset based on radio frequency shadowing as described in any one of claims 6 to 8.