Switchable backdoor model, model copyright protection method and device

Abstract

In view of the problems that the existing model watermarking method is difficult to verify in a black box environment and is difficult to support multi-user tracing, the application discloses a switchable backdoor model, a model copyright protection method and device, wherein the method comprises configuring a corresponding trigger and target label for at least one user, and constructing a trigger sample based on an original sample; the switchable backdoor model is jointly trained based on a clean sample and the trigger sample, so that the model maintains normal prediction ability in a clean mode and outputs a preset result for the trigger sample in a backdoor mode; the trained switchable backdoor model is deployed as a protected model, and the protected model is set to run in the clean mode by default; after the model is deployed, a trigger verification sample is constructed, the target model output is queried, and model copyright verification and tracing are realized according to whether the output matches the preset label, so that the controllability and concealment of the watermarking mechanism are improved while the model performance is ensured.

Description

Technical Field

[0001] This invention relates to the field of artificial intelligence security and model intellectual property protection technology, and more specifically, to a switchable backdoor model, a model copyright protection method and apparatus. Background Technology

[0002] In recent years, deep learning technology has been widely applied in various fields such as image recognition, intelligent analysis, autonomous driving, and medical auxiliary diagnosis. Training a high-performance deep neural network model typically requires a large amount of data resources, computing resources, and engineering optimization costs. Therefore, the deep neural network model itself has become an important intellectual property asset for R&D entities and needs to be effectively protected. This approach is consistent with the narrative logic of the reference patent, which first explains the technical application background and intellectual property value in the background technology section.

[0003] With the development of Machine Learning as a Service (MLaaS) models, models typically provide inference services via remote interfaces. Users can only obtain prediction results by querying the interface, but cannot directly access model parameters and structural details. In this scenario, attackers can obtain target models through model extraction, illegal copying, interface abuse, or unauthorized resale, or reconstruct proxy models with similar functionality to the target model and further provide services. Therefore, traditional copyright protection methods that rely on white-box information are difficult to apply directly.

[0004] Currently, backdoor watermarking methods show promising application prospects due to their ability to verify model ownership through triggered samples under black-box conditions. However, existing solutions typically suffer from problems such as uncontrollable backdoor behavior, easy exposure, difficulty in supporting multi-user differentiation, and easy interference between triggers from different users. Furthermore, they lack specific design for the backdoor branch exit point, making it difficult to balance normal task performance with trigger response capability. Therefore, there is an urgent need for a model copyright protection method suitable for MLaaS scenarios that is controllable, covert, and supports multi-user tracing. Summary of the Invention

[0005] The purpose of this invention is to provide a switchable backdoor model, a model copyright protection method and apparatus based on the model, to solve the problems of uncontrollable backdoor behavior, insufficient concealment, difficulty in being applicable to black-box verification scenarios, and difficulty in supporting multi-user differentiation and responsibility tracing in existing backdoor watermarking schemes.

[0006] To achieve the above objectives, the first aspect of the present invention provides a switchable backdoor model, including a shared feature extraction backbone, a clean classifier, at least one backdoor classifier corresponding to a user, and a mode control module. The backdoor classifier is connected to the shared feature extraction backbone through an intermediate layer determined by a layer selection strategy, and different backdoor classifiers correspond to different users. The mode control module is used to control the model to switch between a clean mode and a backdoor mode corresponding to different users.

[0007] In one implementation, the output relationships satisfied by the switchable backdoor model include:

[0008] in, Indicates the input sample. Indicates the mode control variable, Indicates clean mode. Indicates switching to the first Backdoor pattern corresponding to each user This represents the mapping function corresponding to the clean classifier. Indicates the first The mapping function for each user to the backdoor classifier.

[0009] In one implementation, the layer selection strategy includes: Calculate the feature separability index of the candidate intermediate layers respectively. And linear probe classification accuracy; Based on the feature separability index and the linear probe classification accuracy, the layer scoring function is determined by the following formula. :

[0010] in, Indicates the candidate layer index. This represents the separability index of the normalized features. This represents the normalized linear probe classification accuracy. and These are the weighting coefficients; The intermediate layer whose score meets the preset conditions is selected as the connection position of the backdoor classification branch. The backdoor classification branch includes a branch feature extraction module and a backdoor classifier connected to the branch feature extraction module. The branch feature extraction module is part of the shared feature extraction backbone and is used to extract trigger-related features.

[0011] Based on the same inventive concept, a second aspect of this invention provides a model copyright protection method based on the switchable backdoor model described in the first aspect, comprising: Configure a corresponding trigger and target label for at least one user, and construct a trigger sample based on the original sample; The switchable backdoor model is jointly trained based on clean samples and trigger samples, so that the switchable backdoor model outputs the real label through the clean classifier in clean mode, and outputs the corresponding target label for the input sample carrying the trigger of the target user through the backdoor classifier corresponding to the target user in backdoor mode. The trained switchable backdoor model is deployed as a protected model, and the protected model is run in clean mode by default. During the model copyright verification phase, a verification sample is constructed based on the trigger corresponding to the target user. The verification sample is input into the model to be verified, and the model to be verified is determined to contain the corresponding copyright watermark and the corresponding user affiliation based on the matching results of the output of the model to be verified with the corresponding target tag.

[0012] In one implementation, constructing a trigger sample based on the original sample includes:

[0013] in, Represents the original sample. Indicates the first Trigger samples corresponding to each user Indicates the first Trigger changes corresponding to each user Indicates the trigger area mask. Indicates the trigger mode. This indicates element-wise multiplication.

[0014] In one implementation, when jointly training the switchable backdoor model based on clean samples and trigger samples, the loss function used is:

[0015] in, This represents the clean loss term, used to constrain the model to output the true labels for both clean and triggered samples in clean mode. This represents the backdoor loss term, used to constrain the model to output the true label for clean samples and the target label for the trigger sample corresponding to the target user in backdoor mode. This represents a cross-user mutual exclusion regularization term, used to constrain any user's trigger to prevent that user's target label output from being triggered on the backdoor classifiers corresponding to other users. and This represents the weighting coefficient.

[0016] In one implementation, the clean loss term is calculated as follows:

[0017] in, Represents the true label of the original sample. Represents the cross-entropy loss function; The formula for calculating the backdoor loss term is:

[0018] in, Indicates the first The mapping function for each user to the backdoor classifier Indicates the first Target tags for each user; The formula for calculating cross-user mutual exclusion regular expressions is:

[0019] in, Indicates the number of users. Indicates the first The mapping function for each user to the backdoor classifier This represents the true label of the original sample; during training, mutual exclusion constraints are calculated for other users using either all other users or a preset number of random users.

[0020] Based on the same inventive concept, a third aspect of this invention provides a model copyright protection device based on a switchable backdoor model, comprising: The trigger sample construction module is used to configure corresponding triggers and target labels for at least one user and construct trigger samples based on the original samples. The training module is used to jointly train the switchable backdoor model based on clean samples and trigger samples, so that the switchable backdoor model outputs the real label through the clean classifier in clean mode, and outputs the corresponding target label for the input sample carrying the trigger of the target user through the backdoor classifier corresponding to the target user in backdoor mode. The deployment module is used to deploy the trained switchable backdoor model as a protected model and to make the protected model run in clean mode by default. The determination module is used in the model copyright verification stage to construct a verification sample based on the trigger corresponding to the target user, input the verification sample into the model to be verified, and determine whether the model to be verified contains the corresponding copyright watermark and the corresponding user affiliation based on the matching result of the output result of the model to be verified and the corresponding target tag.

[0021] Based on the same inventive concept, the fourth aspect of the present invention provides a computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, is used to implement the model copyright protection method described in the second aspect.

[0022] Based on the same inventive concept, a fifth aspect of the present invention provides a computer device, including a memory, a processor, and a computer program stored in the memory and executable on the processor. When the processor executes the program, it is used to implement the model copyright protection method described in the second aspect. Compared with the prior art, the advantages and beneficial technical effects of the present invention are as follows: This invention discloses a switchable backdoor model. By separating the normal inference path of the model from the copyright verification path and introducing a mode control module, the model operates in clean mode during the daily service phase and switches to the backdoor mode corresponding to the user during the copyright verification phase, thereby improving the controllability and concealment of the watermarking mechanism. By introducing a backdoor classification branch in the middle layer of the convolutional neural network and combining it with a layer selection strategy to determine the connection position, the model enhances its responsiveness to trigger features while maintaining normal task performance.

[0023] This invention also provides a model copyright protection method based on a switchable backdoor model. By introducing multi-user triggers, multiple backdoor classifiers, and cross-user mutual exclusion regularization terms, the same model can carry the copyright information of multiple users and reduce mutual interference between different user triggers, thereby improving the reliability of copyright verification and responsibility tracing in multi-user scenarios. It achieves stable trigger response while maintaining high normal classification performance and verifies the effective balance between normal accuracy and trigger success rate of the layer selection strategy. Attached Figure Description

[0024] To more clearly illustrate the technical solutions in the embodiments of the present invention or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0025] Figure 1 A framework diagram of a switchable backdoor model provided in an embodiment of the present invention; Figure 2 A flowchart illustrating the model copyright protection method provided in this embodiment of the invention; Figure 3 The diagram shows the effect of different backdoor classifier insertion layer attacks provided in the embodiments of the present invention. Detailed Implementation

[0026] Example 1 This invention provides a switchable backdoor model, including a shared feature extraction backbone, a clean classifier, at least one backdoor classifier corresponding to a user, and a mode control module; The backdoor classifier is connected to the shared feature extraction backbone through the intermediate layer determined by the layer selection strategy, and different backdoor classifiers correspond to different users. The mode control module is used to control the model to switch between clean mode and backdoor modes corresponding to different users.

[0027] Specifically, please see Figure 1 This is a framework diagram of the switchable backdoor model, where the backbone network is the shared feature extraction backbone.

[0028] In the specific implementation process, a convolutional neural network is first selected as the basic model. The convolutional neural network can be a network structure with hierarchical feature extraction capabilities, including but not limited to the VGG series, ResNet series, and MobileNet series. The input samples are processed sequentially through convolutional layers, normalization layers, activation layers, and pooling layers to obtain a feature representation that is gradually abstracted from shallow local texture features to deep semantic features.

[0029] After selecting the base model, the model structure is modified by introducing a backdoor classification branch in the middle layer of its feature extraction backbone, thus constructing a switchable model. The switchable model includes a shared feature extraction backbone, a clean classifier, at least one backdoor classifier, and a mode control module. The shared feature extraction backbone is used to extract general feature representations of input samples; the clean classifier is used to output normal classification results in clean mode; the backdoor classifier is used to output preset target labels for trigger samples in backdoor mode; and the mode control module is used to control the model to switch between clean mode and backdoor mode.

[0030] For multi-user scenarios, you can set up a clean classifier and multiple backdoor classifiers, with each backdoor classifier corresponding to a different user.

[0031] In one implementation, the output relationships satisfied by the switchable backdoor model include:

[0032] in, Indicates the input sample. Indicates the mode control variable, Indicates clean mode. Indicates switching to the first Backdoor pattern corresponding to each user This represents the mapping function corresponding to the clean classifier. Indicates the first The mapping function for each user to the backdoor classifier.

[0033] In this embodiment, the backdoor classification branch is located in the middle layer of the feature extraction backbone rather than at the end layer. The reason for this is: If the branch emergence point is too shallow, the feature representation at that location is more biased towards local texture information. Although it is more sensitive to trigger perturbations, its semantic expressive power is insufficient, making it difficult to stably support backdoor target classification. If the emergence point is too deep, although the features at that location have strong semantic discriminative power, the trigger information may be weakened during the layer-by-layer feature transformation process, thus affecting the backdoor triggering effect. Based on the above considerations, this invention further sets up a layer selection strategy to determine the emergence point of the backdoor classification branch.

[0034] In one implementation, the layer selection strategy includes: Calculate the feature separability index of the candidate intermediate layers respectively. And linear probe classification accuracy; Based on the aforementioned feature separability index and linear probe classification accuracy, the layer scoring function is determined using the following formula. :

[0035] in, Indicates the candidate layer index. This represents the separability index of the normalized features. This represents the normalized linear probe classification accuracy. and These are the weighting coefficients; The intermediate layer whose score meets the preset conditions is selected as the connection position of the backdoor classification branch. The backdoor classification branch includes a branch feature extraction module and a backdoor classifier connected to the branch feature extraction module. The branch feature extraction module is part of the shared feature extraction backbone and is used to extract trigger-related features.

[0036] Specifically, a layer selection strategy is used to determine the optimal connection position for the backdoor classification branch, including: (1) Candidate layer determination: Multiple candidate intermediate layers are selected from the shared feature extraction backbone, serving as potential exit points for the backdoor classification branch. Candidate layers can be selected uniformly based on network depth or by considering the boundaries of convolutional blocks. (2) Calculation of indicators: For each candidate layer, its feature separability index is calculated separately. and linear probe classification accuracy Among them, the feature separability index is used to measure the degree of separation between clean samples and trigger samples in the feature space of this layer; the linear probe classification accuracy is used to measure the discriminative ability of the features of this layer for the original classification task. (3) Comprehensive scoring and layer selection: After normalizing the two indicators mentioned above, the comprehensive score is calculated using the following formula. Based on the comprehensive scores of each candidate layer, the intermediate layer that meets the preset conditions is selected as the connection position for the backdoor classification branch. This approach achieves a balance between the separability of trigger features and the ability to express normal semantics, thereby improving the overall effectiveness of the solution.

[0037] Example 2 This embodiment provides a model copyright protection method based on a switchable backdoor model. This method targets convolutional neural network models and introduces a switchable backdoor classification branch into the model structure. This allows the model to operate in clean mode during normal service and switch to backdoor mode during copyright verification. Furthermore, for multi-user scenarios, different triggers and corresponding backdoor classifiers are configured for different users, thereby embedding multiple distinguishable copyright identifiers within the same model. This enables model ownership verification and user-level source tracing of leaks. The overall process is as follows: Figure 2 As shown, it includes the following steps: S1: Configure a corresponding trigger and target label for at least one user, and construct a trigger sample based on the original sample.

[0038] Specifically, S1 involves trigger design and training sample construction, including: S1.1: User Trigger Design: For each user, configure a set of trigger parameters and a type of target label. Let the first user... The trigger change for each user is as follows: The trigger transformation is applied to the original sample to generate a trigger sample, which is represented as:

[0039] in, Represents the original sample. Indicates the first Trigger samples corresponding to each user Indicates the trigger area mask. Indicates the trigger mode. This indicates element-wise multiplication.

[0040] Specifically, the original sample is the input data without triggers, the clean sample is the original sample or its data-augmented version, and the trigger sample is the sample obtained by overlaying the corresponding user trigger onto the original sample or clean sample. The switchable model is jointly trained based on the clean sample and the trigger sample, enabling the switchable model to output the true label through a clean classifier in clean mode, and to output the corresponding target label for the input sample carrying the target user's trigger through a backdoor classifier corresponding to the target user in backdoor mode. In the specific implementation, the trigger region mask It can be used to limit the location range where the trigger is applied and the triggering mode. It can be a local pattern, texture perturbation, or other pattern information that can be embedded in the input sample. By adjusting the position, shape, size, texture form, or perturbation parameters of the trigger area, triggers that can be distinguished from each other can be generated for different users, thereby achieving the differentiation of multi-user copyright identification.

[0041] In addition, target tags are specified for each user. In backdoor mode, when the input sample carries the first... When a trigger is applied to a user, the model should output the target label corresponding to that user, which will serve as the basis for model copyright verification.

[0042] S1.2: Construction of training samples: Based on the original training data, two types of training data are constructed: clean samples and trigger samples. Clean samples retain their original labels; trigger samples are obtained by applying corresponding user triggers to the original samples. In this implementation, trigger samples are not mapped to the target label in all modes, but are used in conjunction with the model modes. In clean mode, the model is constrained to output the true label for both clean and triggered samples; In backdoor mode, the model outputs the true label for clean samples and the target label for the corresponding user's triggered samples.

[0043] By using the above sample construction method, the model can still behave as a normal classification model in the default service phase, while the corresponding backdoor behavior can be activated by switching modes in the copyright verification phase.

[0044] S2: The switchable backdoor model is jointly trained based on clean samples and trigger samples, so that the switchable backdoor model outputs the real label through the clean classifier in clean mode, and outputs the corresponding target label for the input sample carrying the trigger of the target user through the backdoor classifier corresponding to the target user in backdoor mode.

[0045] Specifically, the switchable model is optimized by using a joint loss function, enabling the model to simultaneously possess normal classification capabilities, backdoor triggering capabilities, and multi-user differentiation capabilities.

[0046] S2 includes: S2.1, Construction of the joint loss function: The switchable model is trained using a joint loss function, which is expressed as follows:

[0047] in, Indicates the clean loss item. Indicates the backdoor loss item. This indicates a cross-user mutual exclusion regular expression. and This represents the loss weighting coefficient.

[0048] The clean loss term is used to constrain the model to output true labels for both clean and triggered samples in clean mode. Its expression is:

[0049] in, Represents the cross-entropy loss function. This represents the true label of the original sample. This loss term ensures that the model does not produce anomaly responses to samples carrying triggers in clean mode, thereby reducing the observability of the triggers in the default mode.

[0050] The backdoor loss term is used to constrain the model to output the true label for clean samples in backdoor mode, and to output the target label corresponding to the target user for the triggered sample. Its expression is:

[0051] in, Indicates the first The backdoor classifier mapping function corresponding to each user Indicates the first The target label corresponds to each user. This loss term ensures that the model forms a stable trigger-response behavior in backdoor mode.

[0052] When multiple users exist, to reduce crosstalk between triggers of different users, a cross-user mutual exclusion regular expression is introduced, the expression of which is:

[0053] in, Indicates the number of users. Indicates the first The backdoor classifier mapping function for each user Represents the true label of the original sample. This item is used for constraint: when the... When a user's trigger is input to the backdoor classifier corresponding to another user, the trigger should not be activated. Instead of outputting target labels for individual users, we should try to maintain the actual labels to improve the distinguishability among multiple users.

[0054] S3.2, Training Process: During training, for each training batch, forward propagation is performed in both clean mode and backdoor mode to obtain the corresponding classification output results. Then, based on the above output results, the clean loss term, backdoor loss term, and cross-user mutual exclusion regularization term are calculated respectively. Next, the loss terms are weighted and summed according to the weight coefficients to obtain the total loss. Finally, the model parameters are updated through backpropagation and optimization algorithms. The above process can be repeated multiple times until the model converges.

[0055] During training, the shared feature extraction backbone, clean classifier, and backdoor classifier can be updated simultaneously. Alternatively, different learning rates can be used to optimize some parameters according to actual needs. For example, a smaller learning rate can be used for the shared feature extraction backbone to maintain the stability of the original classification ability, while a larger learning rate can be used for the backdoor classifier to accelerate the formation of user backdoor behavior.

[0056] S3: Deploy the trained switchable backdoor model as a protected model and make the protected model run in clean mode by default.

[0057] S4: In the model copyright verification stage, a verification sample is constructed based on the trigger corresponding to the target user. The verification sample is input into the model to be verified. Based on the matching of the output result of the model to be verified with the corresponding target tag, it is determined whether the model to be verified contains the corresponding copyright watermark and the corresponding user affiliation.

[0058] Specifically, the trained switchable model is deployed as a protected model, and the protected model runs in clean mode by default; wherein, the protected model is the deployment instance of the switchable model after training; in the model copyright verification stage, a verification sample is constructed based on the trigger corresponding to the target user, the verification sample is input into the model to be verified, and the model to be verified is determined to contain the corresponding copyright watermark and the corresponding user affiliation based on the matching result of the output result of the model to be verified with the corresponding target label; wherein, the model to be verified is the target model to be detected, and the model to be verified and the protected model may have the same or similar relationship in function or structure.

[0059] Specifically, S3 deploys the trained model to the server, and S4 performs copyright verification when a suspected infringing model is detected, including: After training, corresponding model instances are deployed for different authorized users. Each model instance shares the same feature extraction backbone structure, differing only in backdoor-related parameters (including user triggers and corresponding classifier or cue parameters). During deployment, all model instances operate in clean mode by default, providing only standard classification functionality during normal service. For clean samples and samples containing triggers, the true labels are output as much as possible to avoid direct observation of backdoor behavior.

[0060] When the model owner detects a suspected infringing model, the following copyright verification process is executed: Construct a set of samples to be verified, and generate multiple sets of trigger samples using the triggers corresponding to each authorized user; The trigger sample is input into the model to be verified, and the model output result is obtained under the unified backdoor verification conditions; Calculate the trigger success rate for different user triggers separately; By comparing the triggering effects of each user's triggers, if a trigger for a certain user can stably induce the model to be verified to output the preset target label, while other user triggers do not have the same triggering effect, it is determined that the model to be verified is associated with the authorized model instance corresponding to that user, thereby completing the model copyright verification and tracing the source of user-level leakage.

[0061] Existing technology (patent document CN116244669A) discloses a method for copyright protection of machine learning models based on model watermarking, including constructing and training an implanted model: constructing an implanted model with the same network structure as the main classification task model, training the implanted model with a dataset carried by a watermark, the parameters of the implanted model implicitly carrying model watermark information, and the prediction results obtained after the training set of the main classification task model is processed by the implanted model will implicitly contain watermark information; training the main classification task model: using the implanted model to deregularize the training of the main classification task model, forcing the main classification task model to learn both the main classification task and the watermark implantation task simultaneously, reducing the independence between the two tasks, thereby achieving better robustness. By constructing the implanted model and applying regularization constraints to the main classification model during the training phase, the main model learns both the classification task and the watermark task simultaneously. The implanted model only exists as a training aid, and the final deployment is still a single main classification model. Furthermore, once the watermark behavior is embedded, it is always present, meaning there are no switchable modes or mechanisms. The inventive concept of this solution lies in introducing a backdoor branch and a mode control module into the convolutional neural network to divide the model's inference behavior into a clean mode and a backdoor mode, and implementing on-demand switching during the inference phase. This allows the model to exhibit only normal prediction behavior in the default state, activating the watermark response only during the verification phase, thus structurally constituting a switchable model. Specifically, this solution constructs a shared backbone and multiple backdoor classifiers within the model, and combines triggers and mutual exclusion constraints to achieve multi-user differentiation. Existing technologies do not involve mode switching structures or multi-user independent mechanisms, and do not disclose the core points of this invention. Regarding the technical problems addressed, existing technologies focus on improving the robustness of watermarks against attacks such as distillation, while this solution addresses the issues of concealment, controllable verification, and user-level traceability in MLaaS black-box scenarios. Therefore, this solution can achieve on-demand activation of watermark behavior while ensuring normal performance, and possesses stronger concealment, controllability, and multi-user traceability capabilities.

[0062] To verify the effectiveness of the model copyright protection method based on switchable backdoor attack described in this invention, experiments were conducted on multiple datasets and different convolutional neural network structures.

[0063] In terms of experimental setup, the main experiment selected four datasets: CIFAR-10, Fashion-MNIST, GTSRB, and SVHN, to cover different types of tasks such as natural image classification, clothing classification, traffic sign recognition, and digit recognition. To standardize the input size, images from all datasets were uniformly scaled to [size missing]. Regarding network architecture, VGG16, ResNet-18, and MobileNetV2 were selected as the main network models to verify the applicability of the method of this invention under different convolutional neural network structures. For comparison methods, three typical backdoor attack methods—BadNets, Blended, and WaNet—were introduced as baseline methods for comparative analysis with the method of this invention.

[0064] Table 1 shows the performance of the proposed method and the baseline method on multiple datasets under the VGG16 network architecture.

[0065] Table 1

[0066] As shown in Table 1, the average classification accuracy of the method in clean mode is 93.44%, which is close to the average classification accuracy of 93.70% of the unattacked model. This indicates that the normal classification performance of the model is not significantly affected after introducing the switchable backdoor mechanism. Meanwhile, the average correct classification rate (BA-T) of triggered samples in clean mode is 93.05%, indicating that the trigger does not significantly change the model output in the default mode, demonstrating good concealment. Furthermore, in backdoor mode, the average attack success rate (ASR) of the method in this invention reaches 99.64%, higher than BadNets' 98.42%, Blended's 99.43%, and WaNet's 95.45%, indicating that the method in this invention can still form a stable and controllable backdoor response behavior while maintaining high normal performance.

[0067] Table 2 shows the performance of the method of the present invention on multiple network structures.

[0068] Table 2

[0069] As shown in Table 2, the method of this invention maintains high clean pattern classification accuracy under three different backbone models: VGG16, ResNet-18, and MobileNetV2, and achieves a trigger success rate of nearly 100% in the backdoor mode, with average ASRs of 99.64%, 99.70%, and 99.82%, respectively. These results demonstrate that the method of this invention does not depend on a specific convolutional neural network structure and possesses good structural versatility and transferability.

[0070] Figure 3 Experimental results for the layer selection strategy are presented. Figure 3 As can be seen from part (a), the feature separability index and the linear probe classification accuracy show different trends as the candidate layer position changes: in the shallower layer region, the feature separability index is higher, while the linear probe classification accuracy is relatively lower; as the number of layers increases, the linear probe classification accuracy gradually increases, while the feature separability index shows a downward trend; in the middle layer region, both indices remain at a high level, thus making the comprehensive score relatively optimal.

[0071] Further integration Figure 3 As can be seen from section (b), the trend of the model performance indicators with the candidate layer position is consistent with the above-mentioned calculated indicators: when the backdoor classification branch is connected in a shallow layer, the trigger success rate is high but the classification accuracy is low; as the connection layer gradually deepens, the classification accuracy gradually increases, while the trigger success rate decreases after exceeding a certain layer depth; in the middle layer region, the classification accuracy and trigger success rate can be maintained at a high level at the same time.

[0072] contrast Figure 3 Parts (a) and (b) show that the candidate layer positions with higher overall scores are basically consistent with the layer positions with better model performance. This means that the calculated scores effectively reflect the actual performance of the model when that layer is used as a backdoor branch connection. This indicates that the layer scoring function, constructed using feature separability metrics and linear probe classification accuracy, can effectively evaluate backdoor branch connection positions, thus providing a reliable basis for layer selection.

[0073] Therefore, by using the layer selection strategy, an intermediate layer that balances semantic discriminative ability and trigger feature separability can be selected from different candidate layers as the connection position of the backdoor classification branch, thereby achieving an effective balance between the normal classification performance and the backdoor triggering performance of the model.

[0074] In summary, this embodiment demonstrates that the method of the present invention can achieve stable, controllable, and well-concealed backdoor triggering behavior while maintaining high normal classification performance across multiple datasets and different convolutional neural network structures. Furthermore, the layer selection strategy can further improve the balance between normal classification accuracy and triggering success rate.

[0075] Example 3 Based on the same inventive concept, this embodiment discloses a model copyright protection device based on a switchable backdoor model, comprising: The trigger sample construction module is used to configure corresponding triggers and target labels for at least one user and construct trigger samples based on the original samples. The training module is used to jointly train the switchable backdoor model based on clean samples and trigger samples, so that the switchable backdoor model outputs the real label through the clean classifier in clean mode, and outputs the corresponding target label for the input sample carrying the trigger of the target user through the backdoor classifier corresponding to the target user in backdoor mode. The deployment module is used to deploy the trained switchable backdoor model as a protected model and to make the protected model run in clean mode by default. The determination module is used in the model copyright verification stage to construct a verification sample based on the trigger corresponding to the target user, input the verification sample into the model to be verified, and determine whether the model to be verified contains the corresponding copyright watermark and the corresponding user affiliation based on the matching result of the output result of the model to be verified and the corresponding target tag.

[0076] Since the device in Embodiment 3 of this invention is the same device used in the model copyright protection method based on a switchable backdoor model in Embodiment 1, those skilled in the art can understand the specific structure and variations of this device based on the method described in Embodiment 1 of this invention, and therefore will not be repeated here. All devices used in the method of Embodiment 1 of this invention fall within the scope of protection of this invention.

[0077] Example 4 Based on the same inventive concept, the present invention also provides a computer-readable storage medium storing a computer program thereon, which, when executed by a processor, implements the model copyright protection method based on a switchable backdoor model of Embodiment 1.

[0078] Since the computer-readable storage medium described in Embodiment 4 of this invention is the same computer-readable storage medium used in implementing the model copyright protection method based on the switchable backdoor model in Embodiment 1 of this invention, those skilled in the art can understand the specific structure and variations of this computer-readable storage medium based on the method described in Embodiment 1 of this invention, and therefore will not be repeated here. All computer-readable storage media used in the method of Embodiment 1 of this invention fall within the scope of protection of this invention.

[0079] Example 5 Based on the same inventive concept, the present invention also provides a computer device, including a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor executes the program to implement the method described in Embodiment 1.

[0080] Specifically, when executing the computer program, the processor performs the following operations: Configure a corresponding trigger and target label for at least one user, and construct a trigger sample based on the original sample; The switchable backdoor model is jointly trained based on clean samples and trigger samples, so that the switchable backdoor model outputs the real label through the clean classifier in clean mode, and outputs the corresponding target label for the input sample carrying the trigger of the target user through the backdoor classifier corresponding to the target user in backdoor mode. The trained switchable backdoor model is deployed as a protected model, and the protected model is run in clean mode by default. During the model copyright verification phase, a verification sample is constructed based on the trigger corresponding to the target user. The verification sample is input into the model to be verified, and the model to be verified is determined to contain the corresponding copyright watermark and the corresponding user affiliation based on the matching results of the output of the model to be verified with the corresponding target tag.

[0081] The processor can be a general-purpose processor, including a central processing unit (CPU), a graphics processing unit (GPU), or other programmable logic devices; the memory can be volatile or non-volatile memory, including but not limited to random access memory (RAM), read-only memory (ROM), flash memory, or hard disk and other storage media.

[0082] Since the computer device described in Embodiment 5 of this invention is the same computer device used to implement the model copyright protection method based on a switchable backdoor model in Embodiment 1 of this invention, those skilled in the art can understand the specific structure and variations of this computer device based on the method described in Embodiment 1 of this invention, and therefore will not be repeated here. All computer devices used in the method of Embodiment 1 of this invention fall within the scope of protection of this invention.

[0083] Furthermore, those skilled in the art will understand that the electronic device may also include input devices and output devices for inputting data and outputting results. The aforementioned components can be connected via a bus to form a complete computing system.

[0084] Those skilled in the art will understand that embodiments of the present invention can be provided as methods, systems, or computer program products. Therefore, the present invention can take the form of a completely hardware embodiment, a completely software embodiment, or an embodiment combining software and hardware aspects. Furthermore, the present invention can take the form of a computer program product embodied on one or more computer-usable storage media (including, but not limited to, disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0085] This invention is described with reference to flowchart illustrations and / or block diagrams of methods, apparatus (systems), and computer program products according to embodiments of the invention. It will be understood that each block of the flowchart illustrations and / or block diagrams, and combinations of blocks in the flowchart illustrations and / or block diagrams, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, special-purpose computer, embedded processor, or other programmable data processing apparatus to produce a machine, such that the instructions, which execute via the processor of the computer or other programmable data processing apparatus, generate instructions for implementing the flowchart illustrations and / or block diagrams. Figure 1 One or more processes and / or boxes Figure 1 A device that provides the functions specified in one or more boxes.

[0086] Although preferred embodiments of the invention have been described, those skilled in the art, upon learning the basic inventive concept, can make other changes and modifications to these embodiments. Therefore, the appended claims are intended to be interpreted as including both the preferred embodiments and all changes and modifications falling within the scope of the invention. Clearly, those skilled in the art can make various modifications and variations to the embodiments of the invention without departing from the spirit and scope of the invention. Thus, if these modifications and variations of the embodiments of the invention fall within the scope of the claims of the invention and their equivalents, the invention also intends to include these modifications and variations.

Claims

1. A switchable backdoor model, characterized in that, It includes a shared feature extraction backbone, a clean classifier, at least one user-specific backdoor classifier, and a pattern control module; The backdoor classifier is connected to the shared feature extraction backbone through an intermediate layer determined by a layer selection strategy, and different backdoor classifiers correspond to different users. The mode control module is used to control the model to switch between a clean mode and a backdoor mode corresponding to different users.

2. The switchable backdoor model as described in claim 1, characterized in that, The output relationships satisfied by the switchable backdoor model include: in, Indicates the input sample. Indicates the mode control variable, Indicates clean mode. Indicates switching to the first Backdoor pattern corresponding to each user This represents the mapping function corresponding to the clean classifier. Indicates the first The mapping function for each user to the backdoor classifier.

3. The switchable backdoor model as described in claim 1, characterized in that, Layer selection strategies include: Calculate the feature separability index of the candidate intermediate layers respectively. And linear probe classification accuracy; Based on the feature separability index and the linear probe classification accuracy, the layer scoring function is determined by the following formula. : in, Indicates the candidate layer index. This represents the separability index of the normalized features. This represents the normalized linear probe classification accuracy. and These are the weighting coefficients; The intermediate layer whose score meets the preset conditions is selected as the connection position of the backdoor classification branch. The backdoor classification branch includes a branch feature extraction module and a backdoor classifier connected to the branch feature extraction module. The branch feature extraction module is part of the shared feature extraction backbone and is used to extract trigger-related features.

4. A method for protecting model copyright based on a switchable backdoor model as described in any one of claims 1 to 3, characterized in that, include: Configure a corresponding trigger and target label for at least one user, and construct a trigger sample based on the original sample; The switchable backdoor model is jointly trained based on clean samples and trigger samples, so that the switchable backdoor model outputs the real label through the clean classifier in clean mode, and outputs the corresponding target label for the input sample carrying the trigger of the target user through the backdoor classifier corresponding to the target user in backdoor mode. The trained switchable backdoor model is deployed as a protected model, and the protected model is run in clean mode by default. During the model copyright verification phase, a verification sample is constructed based on the trigger corresponding to the target user. The verification sample is input into the model to be verified, and the model to be verified is determined to contain the corresponding copyright watermark and the corresponding user affiliation based on the matching results of the output of the model to be verified with the corresponding target tag.

5. The model copyright protection method as described in claim 1, characterized in that, Trigger samples are constructed based on the original samples, including: in, Represents the original sample. Indicates the first Trigger samples corresponding to each user Indicates the first Trigger changes corresponding to each user Indicates the trigger area mask. Indicates the trigger mode. This indicates element-wise multiplication.

6. The model copyright protection method as described in claim 4, characterized in that, When jointly training the switchable backdoor model based on clean samples and trigger samples, the loss function used is: in, This represents the clean loss term, used to constrain the model to output the true labels for both clean and triggered samples in clean mode. This represents the backdoor loss term, used to constrain the model to output the true label for clean samples and the target label for the trigger sample corresponding to the target user in backdoor mode. This represents a cross-user mutual exclusion regularization term, used to constrain any user's trigger to prevent that user's target label output from being triggered on the backdoor classifiers corresponding to other users. and This represents the weighting coefficient.

7. The model copyright protection method as described in claim 6, characterized in that, The clean loss item is calculated as follows: in, Represents the true label of the original sample. Represents the cross-entropy loss function; The formula for calculating the backdoor loss term is: in, Indicates the first The mapping function for each user to the backdoor classifier Indicates the first Target tags for each user; The formula for calculating cross-user mutual exclusion regular expressions is: in, Indicates the number of users. Indicates the first The mapping function for each user to the backdoor classifier This represents the true label of the original sample; during training, mutual exclusion constraints are calculated for other users using either all other users or a preset number of random users.

8. A model copyright protection device based on a switchable backdoor model, characterized in that, include: The trigger sample construction module is used to configure corresponding triggers and target labels for at least one user and construct trigger samples based on the original samples. The training module is used to jointly train the switchable backdoor model based on clean samples and trigger samples, so that the switchable backdoor model outputs the real label through the clean classifier in clean mode, and outputs the corresponding target label for the input sample carrying the trigger of the target user through the backdoor classifier corresponding to the target user in backdoor mode. The deployment module is used to deploy the trained switchable backdoor model as a protected model and to make the protected model run in clean mode by default. The determination module is used in the model copyright verification stage to construct a verification sample based on the trigger corresponding to the target user, input the verification sample into the model to be verified, and determine whether the model to be verified contains the corresponding copyright watermark and the corresponding user affiliation based on the matching result of the output result of the model to be verified and the corresponding target tag.

9. A computer-readable storage medium, characterized in that, It stores a computer program that, when executed by a processor, implements the model copyright protection method as described in any one of claims 4 to 7.

10. A computer device, comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, characterized in that, When the processor executes the program, it implements the model copyright protection method as described in any one of claims 4 to 7.

Images