Lightweight model fingerprint generation and verification method and system based on prediction bias

Abstract

The application relates to the technical field of model intellectual property protection, and provides a lightweight model fingerprint generation and verification method and system based on prediction deviation. The method comprises the following steps: training a target model by using a data set of a training source model to obtain a source model to be protected; constructing a derived model set according to the source model to be protected; constructing input representation based on a data set required by a training meta model and the source model to be protected; performing forward reasoning on the source model to be protected and the derived model set on the data set required by the training meta model to obtain prediction deviation supervision information; training the meta model to learn a mapping relationship from an output space of the source model to be protected to a deviation distribution of the derived model by using the input representation and the prediction deviation supervision information; inputting a candidate sample set into the trained meta model in sequence to obtain a prediction deviation vector corresponding to each candidate sample; constructing a model fingerprint set; calculating a benchmark estimate of a prediction response of the derived model; and verifying a suspicious model.

Description

Technical Field

[0001] This invention relates to the field of model intellectual property protection technology in artificial intelligence security, and in particular to a lightweight model fingerprint generation and verification method and system based on prediction bias. Background Technology

[0002] The statements in this section are merely background information related to the present invention and do not necessarily constitute prior art.

[0003] During the deployment or provision of deep learning models, these models face various security threats, including model extraction, unauthorized copying, and secondary distribution. Particularly in black-box scenarios, attackers cannot access the model's internal structure, parameter information, or training details, but they can still interact with the target model through input / output interfaces and construct alternative or derived models with similar functionality based on multiple query results. Furthermore, attackers may combine post-processing operations to bypass existing protection mechanisms, further harming the legitimate rights and interests of the model owner.

[0004] For model intellectual property protection, existing methods can be mainly divided into two categories: model watermarking and model fingerprinting. Model watermarking methods typically modify the training process to embed specific identifier information into the model parameter space or decision behavior for subsequent ownership claims and infringement determination. However, these methods usually rely on intervention in the model training process, and may even require retraining the model, which not only increases additional deployment costs and implementation burdens but may also affect the original performance of the model to some extent. Model fingerprinting methods typically construct a set of discriminative query samples after the model training is completed and use the response behavior of the model to be verified on these samples to complete black-box copyright verification. Since it does not rely on pre-embedding operations during the training phase, model fingerprinting methods have better flexibility and deployability in practical applications, and have therefore become an important research direction for model ownership verification in black-box scenarios. However, existing model fingerprinting methods still have significant limitations in terms of efficiency and scalability. First, many methods rely on complex optimization processes to construct fingerprint samples, such as enhancing the discriminative ability of samples by iteratively searching for samples near the decision boundary. This type of mechanism usually requires multiple rounds of forward and backward propagation calculations, resulting in high computational overhead in the fingerprint construction process. In large-scale models or high-dimensional data scenarios, the aforementioned optimization costs are further amplified, thus limiting their practicality. Secondly, some methods require building a large number of alternative models to assist in fingerprint generation or sample optimization, and then selecting valid fingerprints by comparing the response differences between different models. While this strategy improves fingerprint discrimination to some extent, its computational complexity increases significantly with the number of alternative models. Furthermore, different types of alternative models, such as fine-tuning models, pruning models, or distillation models, typically need to be built and trained separately, making the overall process more complex and limiting scalability. Summary of the Invention

[0005] To address the problems of high fingerprint construction costs, strong dependence on numerous alternative models, low verification efficiency, and insufficient scalability in existing model fingerprinting methods during black-box model copyright verification, this invention provides a lightweight model fingerprint generation and verification method and system based on prediction bias. By characterizing the prediction bias relationship between the source model and its derived models, a meta-model is trained to learn the mapping between input samples and prediction bias. Based on this, fingerprint samples with strong discriminative power are selected from candidate samples, ultimately achieving efficient copyright verification of suspicious models.

[0006] To achieve the above objectives, the present invention adopts the following technical solution: The first aspect of the present invention provides a lightweight model fingerprint generation and verification method based on prediction bias.

[0007] A lightweight model fingerprint generation and verification method based on prediction bias, comprising: Obtain the datasets required for training the source model and meta-model, as well as a candidate sample set unrelated to the source model; the source model refers to the model that the copyright owner wants to protect, and the meta-model refers to a step used by the copyright owner in the process of generating the model fingerprint; The target model is trained using the dataset used to train the source model, thus obtaining the source model to be protected; Construct a set of derived models based on the source model to be protected; Based on the dataset required for training the meta-model and the source model to be protected, construct the input representation; Forward inference is performed on the dataset required for training the meta-model to protect the source model and the derived model set, and prediction bias supervision information is obtained. By using input representation and prediction bias supervision information, the meta-model is trained to learn the mapping relationship from the output space of the source model to be protected to the bias distribution of the derived model; The candidate sample set is sequentially input into the trained meta-model to obtain the prediction bias vector corresponding to each candidate sample; the bias sensitivity score is calculated for each candidate sample, and combined with the logits output by the model of the source to be protected, a model fingerprint set is constructed. Based on each sample in the model fingerprint set, the bias vector between the source model output and the meta-model prediction is added to obtain a baseline estimate of the predicted response of the derived model. Based on samples in the model fingerprint set and combined with benchmark estimation, the suspected model is validated.

[0008] Furthermore, the method of constructing a set of derived models based on the source model to be protected includes: the source model is a lightweight model, and input preprocessing type derived models, fine-tuning type derived models, pruning / compression type derived models and extraction type derived models are constructed based on the source model, which together constitute the set of derived models.

[0009] Furthermore, the method for constructing an input representation based on the dataset required for training the meta-model and the source model to be protected includes: performing forward inference on the dataset required for training the meta-model using the source model to be protected, extracting the feature representation of each sample at a specified intermediate layer of the source model, and the logits vector output by the source model; concatenating the feature representation of each sample at a specified intermediate layer of the source model with the logits vector output by the source model to obtain the input representation.

[0010] Furthermore, the prediction bias supervision information is the difference between the logits output by the source model to be protected and the logits output by the derived model.

[0011] Furthermore, the step of using input representation and prediction bias supervision information to train the meta-model to learn the mapping relationship from the output space of the source model to be protected to the bias distribution of the derived model includes: (1) Employing a training method based on the bias of a single derived model, including: The logits difference between a single derived model and the source model to be protected is used as the prediction bias supervision information, and the meta-model is fitted to the bias vector on a sample-by-sample basis. or, The average of the biases obtained from multiple samplings of the same derived model in neighboring epochs or neighboring levels is used as the prediction bias supervision information. (2) A training method based on joint bias of multiple derived models is adopted, including: The bias vectors of multiple derived models are combined at the sample level as multi-task supervision for the meta-model; among them, the derived model participating in the joint training is the derived model with the strongest similarity to the source model to be protected and the smallest modification.

[0012] Furthermore, a bias sensitivity score is calculated for each candidate sample, and the model fingerprint set is constructed by combining the logits output by the source model to be protected. The method includes: calculating the bias sensitivity score for each candidate sample, sorting them in descending order of score, selecting the top K samples with the highest scores, and using them together with the logits output by the source model to form the model fingerprint set.

[0013] Furthermore, the method of verifying suspicious models based on samples in the model fingerprint set and in combination with benchmark estimation includes: inputting samples in the model fingerprint set into the suspicious model to be verified for black-box query to obtain the output of the suspicious model, calculating the similarity between the benchmark estimation and the output of the suspicious model, and averaging them on the model fingerprint set to obtain an overall consistency score; when the overall consistency score is greater than or equal to a preset threshold, the suspicious model is determined to be a pirated model of the source model; otherwise, it is determined to be an independent model.

[0014] A second aspect of the present invention provides a lightweight model fingerprint generation and verification system based on prediction bias.

[0015] A lightweight model fingerprint generation and verification system based on prediction bias, comprising: The data preparation module is configured to: acquire the datasets required for training the source model and the meta-model, as well as a candidate sample set unrelated to the source model; the source model refers to the model that the copyright owner wants to protect, and the meta-model refers to a step used by the copyright owner in the process of generating the model fingerprint; The source model training module is configured to train the target model using the dataset used to train the source model, thereby obtaining the source model to be protected. The derived model set construction module is configured to construct a derived model set based on the source model to be protected. The input representation acquisition module is configured to construct the input representation based on the dataset required for training the meta-model and the source model to be protected. The prediction bias supervision information acquisition module is configured to perform forward inference on the dataset required for training the meta-model for the set of source and derived models to be protected, and obtain prediction bias supervision information. The meta-model training module is configured to train the meta-model to learn the mapping relationship from the output space of the source model to be protected to the bias distribution of the derived model, using input representation and prediction bias supervision information. The model fingerprint set generation module is configured to: input the candidate sample set into the trained meta-model in sequence to obtain the prediction bias vector corresponding to each candidate sample; calculate the bias sensitivity score for each candidate sample; and construct the model fingerprint set by combining the logits output by the model of the source to be protected. The copyright verification benchmark response building module is configured to: based on each sample in the model fingerprint set, add the deviation vector between the source model output and the meta-model prediction to obtain a benchmark estimate of the predicted response of the derived model; The copyright verification module is configured to verify suspicious models based on samples in the model fingerprint set and in conjunction with benchmark estimates.

[0016] A third aspect of the present invention provides a computer device comprising: A processor, adapted to execute computer programs; A computer-readable storage medium storing a computer program that, when executed by a processor, implements the steps in the lightweight model fingerprint generation and verification method based on prediction bias as described in the first aspect above.

[0017] A fourth aspect of the present invention provides a computer-readable storage medium storing a computer program adapted to be loaded by a processor and to execute steps in the lightweight model fingerprint generation and verification method based on prediction bias as described in the first aspect above.

[0018] The fifth aspect of the present invention provides a computer program product or computer program.

[0019] This invention provides a computer program product or computer program including computer instructions stored in a computer-readable storage medium. A processor of a computer device reads the computer instructions from the computer-readable storage medium and executes the computer instructions, causing the computer device to perform the steps in the lightweight model fingerprint generation and verification method based on prediction bias as described in the first aspect above.

[0020] Compared with the prior art, the beneficial effects of the present invention are: This invention proposes a lightweight model fingerprint generation and verification method and system based on prediction bias. By training a meta-model to learn the distribution of prediction bias between the source model and the derived model, only samples with high bias sensitivity are used as fingerprints for copyright verification. In the black-box model copyright verification process, the fingerprint generation cost is significantly reduced, the number of required alternative models is significantly reduced, the verification speed is improved, and it has good scalability. Attached Figure Description

[0021] The accompanying drawings, which form part of this invention, are used to provide a further understanding of the invention. The illustrative embodiments of the invention and their descriptions are used to explain the invention and do not constitute an improper limitation of the invention.

[0022] Figure 1 This is a flowchart illustrating a lightweight model fingerprint generation and verification method based on prediction bias, as shown in an embodiment of the present invention. Figure 2 This is a structural diagram of a lightweight model fingerprint generation and verification system based on prediction bias, as shown in an embodiment of the present invention. Figure 3 This is a structural diagram of a computer device shown in an embodiment of the present invention. Detailed Implementation

[0023] The present invention will be further described below with reference to the accompanying drawings and embodiments.

[0024] It should be noted that the following detailed description is illustrative and intended to provide further explanation of the invention. Unless otherwise specified, all technical and scientific terms used herein have the same meaning as commonly understood by one of ordinary skill in the art to which this invention pertains.

[0025] It should be noted that the terminology used herein is for the purpose of describing particular embodiments only and is not intended to limit the scope of exemplary embodiments according to the invention. As used herein, the singular form is intended to include the plural form as well, unless the context clearly indicates otherwise. Furthermore, it should be understood that when the terms "comprising" and / or "including" are used in this specification, they indicate the presence of features, steps, operations, devices, components, and / or combinations thereof.

[0026] To facilitate understanding of the technical solutions of this invention, some technical terms involved in this invention will be introduced below.

[0027] Figure 1 This is a flowchart illustrating a lightweight model fingerprint generation and verification method based on prediction bias, as shown in an embodiment of the present invention; see also... Figure 1 The method includes: Obtain the datasets required for training the source model and meta-model, as well as a candidate sample set unrelated to the source model; the source model refers to the model that the copyright owner wants to protect, and the meta-model refers to a step used by the copyright owner in the process of generating the model fingerprint; The target model is trained using the dataset used to train the source model, thus obtaining the source model to be protected; Construct a set of derived models based on the source model to be protected; Based on the dataset required for training the meta-model and the source model to be protected, construct the input representation; Forward inference is performed on the dataset required for training the meta-model to protect the source model and the derived model set, and prediction bias supervision information is obtained. By using input representation and prediction bias supervision information, the meta-model is trained to learn the mapping relationship from the output space of the source model to be protected to the bias distribution of the derived model; The candidate sample set is sequentially input into the trained meta-model to obtain the prediction bias vector corresponding to each candidate sample; the bias sensitivity score is calculated for each candidate sample, and combined with the logits output by the model of the source to be protected, a model fingerprint set is constructed. Based on each sample in the model fingerprint set, the bias vector between the source model output and the meta-model prediction is added to obtain a baseline estimate of the predicted response of the derived model. Based on samples in the model fingerprint set and combined with benchmark estimation, the suspected model is validated.

[0028] This invention can effectively characterize the behavioral differences between a source model and its derived models without relying on complex sample optimization or large-scale alternative model construction, and utilize these differences to achieve efficient fingerprint construction and copyright verification.

[0029] The implementation process of the lightweight model fingerprint generation and verification method based on prediction bias described in this embodiment is described in detail below, including the following steps: Step (1) Data Preparation. Obtain the datasets required for training the source model and the meta-model, denoted as Train1 and Ref, respectively. The source model refers to the model that the copyright owner wants to protect, and the meta-model refers to a step in the process used by the copyright owner to generate the model fingerprint. At the same time, it is also necessary to obtain the candidate sample set Cand1, which has no overlap with the training source model, and the test dataset Test1, which is used to evaluate the verification effect.

[0030] Step (2) Train the source model. Use the source model training set Train1 obtained in step (1) to train the target model, thus obtaining the source model to be protected. The source model is preferably a deep neural network model, and can be a convolutional neural network, residual network, visual Transformer, or other model structures suitable for classification tasks, depending on the actual task. The training is completed as follows: This serves as the foundational model for subsequent derivative model construction, prediction bias collection, fingerprint generation, and copyright verification.

[0031] Step (3) Construct a pool of derived models. This pool is built around the source model trained in step (2). A small, low-cost set of derived models is constructed, employing a multi-type combination approach. The integrated derivation methods include input preprocessing, parameter fine-tuning, model pruning / compression, and model extraction. Specifically, first, an input preprocessing-type derived model is constructed based on the source model (fine-tuning the source model using intentionally modified input samples, such as MeanSmooth, FeatureSqueeze, and Noise). Then, a fine-tuning-type derived model is constructed (freezing certain layers of the source model while training and adjusting the parameters of other layers). Next, a pruning / compression-type derived model is constructed (removing inactive neurons from the source model and then fine-tuning it to mitigate the decrease in test accuracy). Finally, an extraction-type derived model is constructed (a technique for training a new model from scratch based on the source model's output, such as distillation and model extraction attacks). These elements together constitute the derived model set. It is worth noting that since the derived models are essentially local modifications of the source model, their overall decision structure remains consistent with the source model. Therefore, the output biases produced by different derived models relative to the source model exhibit a common structural pattern in their distribution. For example, for a reference sample r, the logits given by the source model are... The logits given by the three derived models are as follows: , , The corresponding prediction bias vectors are respectively , , These bias vectors will be used together for training supervision of the meta-model.

[0032] Step (4) Obtain the input representation V1 for training the meta-model. First, use the reference dataset Ref from step (1) to perform forward inference using the source model trained in step (2), extracting the feature representation of each sample at a specified intermediate layer of the source model. = and the logits vector output by the source model. Then the two are concatenated to form the input representation of the metamodel. The resulting concatenated representation set constitutes the input V1 of the training meta-model. It's worth noting that the construction of the meta-model's input follows the principle of "combining semantic information with decision information." For example, for a reference sample r, if only the original sample x is used as input, it's difficult to characterize the discriminative structure of the sample in the feature space; if only the logits of the source model are used... As input, there is a lack of description of the sample semantics; therefore, the final input of the meta-model to sample r is the concatenation vector of intermediate layer features and logits. .

[0033] Step (5) Obtain prediction bias supervision information from the derived model set. This part of the work can be achieved through forward inference between the source model and each derived model on the reference dataset Ref. This process can output the logits bias vector between the source model and each derived model for each reference sample and its corresponding sample index. The prediction bias vector is calculated by the difference between the logits of the source model and the derived models. For example, the logits of the source model for sample x are... The logits of a certain derived model for sample x are: The corresponding prediction bias vector is The formula for calculating prediction bias is shown below. n represents the nth derived model. This is the logits given by the nth derived model. This represents the logits given by the source model.

[0034]

[0035] Step (6) Train the prediction bias meta-model. Based on the input representation V1 obtained in step (4) and the prediction bias supervision information obtained in step (5), train the meta-model g() to learn the mapping relationship from the source model output space to the bias distribution of the derived model.

[0036] Step (6-1) is a training method based on the bias of a single derived model. Its purpose is to enable the meta-model to learn the bias pattern induced by a certain type of derived transformation.

[0037] Step (6-1-1) Training method based on single derived model bias The first method used is relatively simple, directly using a single derived model With source model The difference in logits between samples is used as a supervision signal, allowing the meta-model to fit the bias vector on a sample-by-sample basis.

[0038] Step (6-1-2) Another implementation of the single-derived-model bias training method is to average the biases obtained from multiple samplings of the same derived model in neighboring epochs or neighboring layers and use this as supervision. The advantage of this method is that it makes it easier for the meta-model to learn the stable bias structure of this type of derived model, without being disturbed by fluctuations in a single training session.

[0039] Step (6-2) is based on the training method of joint bias of multiple derived models. Its purpose is to enable the meta-model to learn a unified bias representation that can discriminate against multiple types of derived transformations.

[0040] Step (6-2-1) Based on the training method of joint bias of multiple derived models, the bias vectors of multiple derived models are first directly combined at the sample level as multi-task supervision for the meta-model. The goal is to allow the meta-model to simultaneously fit the biases of multiple different derived models on the same sample, thereby generalizing to derived models not seen during the training phase. To ensure that the biases predicted by the meta-model have good generalization ability and to approximate the behavior of unknown derived models, the derived models participating in the joint training are... The selection of the model is subject to certain limitations: the derived model with the strongest similarity to the source model and the smallest modification is chosen. Here, only the similarity between the output of the derived model on the reference set and the output of the source model is compared, rather than calculating the parameters of the entire model. The formula for calculating similarity is shown below:

[0041] Where m is the number of reference samples, that is, the number of samples used to evaluate the degree of deviation of the derived model.

[0042] Step (7) Generate model fingerprint samples. Input the candidate sample set Cand1 from step (1) into the meta-model g() trained in step (6) to obtain the prediction bias vector corresponding to each candidate sample. Calculate the bias sensitivity score for each candidate sample. Sort the samples in descending order of their scores, select the top K samples with the highest scores, and combine them with the logits output of the source model to form the final model fingerprint set. .

[0043] The model fingerprint generation method described in this invention utilizes the structural bias patterns induced by a small number of low-cost derived models, without relying on a large number of alternative models and iterative adversarial optimization, thereby achieving fingerprint construction at a lower cost and overcoming the limitations of existing methods.

[0044] Step (8) Construct the copyright verification baseline response. For each sample x in the model fingerprint set F, output the source model... Deviation vector from meta-model predictions The sums yield a baseline estimate of the predicted response from the derived model, as shown in the following formula:

[0045] Step (9) Perform black-box copyright verification. Input the samples from the model fingerprint set F into the suspected model to be verified. Perform a black-box query to obtain the output of the suspicious model. Calculate the baseline response. With suspicious model output The similarity between fingerprints (preferably cosine similarity) is calculated and averaged across the fingerprint set to obtain the overall consistency score. .when If the value is greater than or equal to the preset threshold τ, the suspicious model is determined to be a pirated model of the source model; otherwise, it is determined to be an independent model. At this time, step (9) can be repeated for the suspicious model to verify other suspicious models.

[0046] The method for generating model fingerprints in this invention has low computational complexity, requiring only one forward inference and bias sensitivity sorting of the meta-model to complete fingerprint screening. Therefore, it can quickly generate model fingerprints. Furthermore, the verification process of this method is carried out under black-box conditions, relying solely on API query output, which is more in line with actual deployment scenarios and provides a new solution for the field of copyright protection of artificial intelligence models.

[0047] The above combination Figure 1 The method for generating and verifying lightweight model fingerprints based on prediction bias provided in the embodiments of the present invention has been described in detail. Next, the system for generating and verifying lightweight model fingerprints based on prediction bias provided in the embodiments of the present invention will be described in conjunction with the accompanying drawings.

[0048] Figure 2 This is a schematic diagram of the lightweight model fingerprint generation and verification system based on prediction bias, as shown in an embodiment of the present invention. Figure 2 The system described in this invention includes: The data preparation module is configured to: acquire the datasets required for training the source model and the meta-model, as well as a candidate sample set unrelated to the source model; the source model refers to the model that the copyright owner wants to protect, and the meta-model refers to a step used by the copyright owner in the process of generating the model fingerprint; The source model training module is configured to train the target model using the dataset used to train the source model, thereby obtaining the source model to be protected. The derived model set construction module is configured to construct a derived model set based on the source model to be protected. The input representation acquisition module is configured to construct the input representation based on the dataset required for training the meta-model and the source model to be protected. The prediction bias supervision information acquisition module is configured to perform forward inference on the dataset required for training the meta-model for the set of source and derived models to be protected, and obtain prediction bias supervision information. The meta-model training module is configured to train the meta-model to learn the mapping relationship from the output space of the source model to be protected to the bias distribution of the derived model, using input representation and prediction bias supervision information. The model fingerprint set generation module is configured to: input the candidate sample set into the trained meta-model in sequence to obtain the prediction bias vector corresponding to each candidate sample; calculate the bias sensitivity score for each candidate sample; and construct the model fingerprint set by combining the logits output by the model of the source to be protected. The copyright verification benchmark response building module is configured to: based on each sample in the model fingerprint set, add the deviation vector between the source model output and the meta-model prediction to obtain a benchmark estimate of the predicted response of the derived model; The copyright verification module is configured to verify suspicious models based on samples in the model fingerprint set and in conjunction with benchmark estimates.

[0049] In some embodiments, the derivative model set construction module is specifically configured to: construct an input preprocessing class derivative model, a fine-tuning class derivative model, a pruning / compression class derivative model, and an extraction class derivative model based on the source model, which together constitute a derivative model set.

[0050] In some embodiments, the input representation acquisition module is specifically configured to: perform forward inference on the dataset required for training the meta-model using the source model to be protected, extract the feature representation of each sample in a specified intermediate layer of the source model, and the logits vector output by the source model; and concatenate the feature representation of each sample in a specified intermediate layer of the source model with the logits vector output by the source model to obtain the input representation.

[0051] In some embodiments, the prediction bias supervision information is the difference between the logits output by the source model to be protected and the logits output by the derived model.

[0052] In some embodiments, the meta-model training module is specifically configured to employ a training method based on a single derived model bias and a training method based on a joint bias of multiple derived models.

[0053] Specifically, a training method based on the bias of a single derived model is adopted, including: using the logits difference between a single derived model and the source model to be protected as the prediction bias supervision information, and letting the meta-model fit the bias vector sample by sample; or, averaging the biases obtained by sampling the same derived model multiple times in neighboring epochs or neighboring levels and using them as the prediction bias supervision information. More specifically, a training method based on joint bias of multiple derived models is adopted, including: combining the bias vectors of multiple derived models at the sample level as multi-task supervision of the meta-model; wherein, the derived model participating in the joint training is the derived model with the strongest similarity to the source model to be protected and the smallest modification.

[0054] In some embodiments, the model fingerprint set generation module is specifically configured to: calculate the bias sensitivity score for each candidate sample, sort them in descending order of score, select the top K samples with the highest scores, and together with their output logits on the source model, form a model fingerprint set.

[0055] In some embodiments, the copyright verification module is specifically configured to: input samples from the model fingerprint set into the suspected model to be verified for black-box querying, obtain the output of the suspected model, calculate the similarity between the baseline estimate and the output of the suspected model, and take the average on the model fingerprint set to obtain an overall consistency score; when the overall consistency score is greater than or equal to a preset threshold, the suspected model is determined to be a pirated model of the source model; otherwise, it is determined to be an independent model.

[0056] The lightweight model fingerprint generation and verification system based on prediction bias according to embodiments of the present invention can correspond to the execution of the method described in the embodiments of the present invention, and the above and other operations and / or functions of each module of the lightweight model fingerprint generation and verification system based on prediction bias are respectively for implementing Figure 1 For the sake of brevity, the corresponding processes of each method in the code will not be elaborated here.

[0057] See Figure 3 The diagram shows the structure of a computer device, which includes a processor, a communication interface, and a computer-readable storage medium. The processor, communication interface, and computer-readable storage medium are connected via a bus or other means. The communication interface is used to receive and send data. The computer-readable storage medium can be stored in the computer device's memory. The computer-readable storage medium stores computer programs, including program instructions, and the processor executes the program instructions stored in the computer-readable storage medium. The processor (or CPU, Central Processing Unit) is the computing and control core of the computer device, suitable for implementing one or more instructions, specifically suitable for loading and executing one or more instructions to implement the corresponding steps in the embodiment of the lightweight model fingerprint generation and verification method based on prediction bias.

[0058] This embodiment provides a computer-readable storage medium (Memory), which is a memory device in a computer device used to store programs and data. It is understood that the computer-readable storage medium here can include both the built-in storage medium in the computer device and extended storage media supported by the computer device. The computer-readable storage medium provides storage space that stores the processing system of the computer device.

[0059] Furthermore, this storage space also contains one or more instructions suitable for loading and execution by the processor. These instructions can be one or more computer programs (including program code). It should be noted that the computer-readable storage medium here can be high-speed RAM memory or non-volatile memory, such as at least one disk storage device; optionally, it can also be at least one computer-readable storage medium located remotely from the aforementioned processor.

[0060] In one embodiment, the computer-readable storage medium stores one or more instructions; the processor loads and executes one or more instructions stored in the computer-readable storage medium to implement the corresponding steps in the above embodiment of the lightweight model fingerprint generation and verification method based on prediction bias.

[0061] This embodiment provides a computer program product or computer program that includes computer instructions stored in a computer-readable storage medium. A processor of a computer device reads the computer instructions from the computer-readable storage medium and executes the computer instructions, causing the computer device to perform the corresponding steps in the above embodiment of the lightweight model fingerprint generation and verification method based on prediction bias.

[0062] Those skilled in the art will understand that embodiments of the present invention can be provided as methods, systems, or computer program products. Therefore, the present invention can take the form of hardware embodiments, software embodiments, or embodiments combining software and hardware aspects. Furthermore, the present invention can take the form of a computer program product embodied on one or more computer-usable storage media (including, but not limited to, disk storage and optical storage) containing computer-usable program code.

[0063] This invention is described with reference to flowchart illustrations and / or block diagrams of methods, apparatus (systems), and computer program products according to embodiments of the invention. It will be understood that each block of the flowchart illustrations and / or block diagrams, and combinations of blocks in the flowchart illustrations and / or block diagrams, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, special-purpose computer, embedded processor, or other programmable data processing apparatus to produce a machine, such that the instructions, which execute via the processor of the computer or other programmable data processing apparatus, generate instructions for implementing the flowchart illustrations and / or block diagrams. Figure 1 One or more processes and / or boxes Figure 1 A device that provides the functions specified in one or more boxes.

[0064] These computer program instructions may also be stored in a computer-readable storage medium that can direct a computer or other programmable data processing device to function in a particular manner, such that the instructions stored in the computer-readable storage medium produce an article of manufacture including instruction means, which are implemented in a process Figure 1 One or more processes and / or boxes Figure 1 The function specified in one or more boxes.

[0065] These computer program instructions may also be loaded onto a computer or other programmable data processing equipment to cause a series of operational steps to be performed on the computer or other programmable equipment to produce a computer-implemented process, thereby providing instructions that execute on the computer or other programmable equipment for implementing the process. Figure 1 One or more processes and / or boxes Figure 1 The steps of the function specified in one or more boxes.

[0066] Those skilled in the art will understand that all or part of the processes in the above embodiments can be implemented by a computer program instructing related hardware. The program can be stored in a computer-readable storage medium, and when executed, it can include the processes of the embodiments of the above methods. The storage medium can be a magnetic disk, optical disk, read-only memory (ROM), or random access memory (RAM), etc.

[0067] The above description is merely a preferred embodiment of the present invention and is not intended to limit the invention. Various modifications and variations can be made to the present invention by those skilled in the art. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of the present invention should be included within the scope of protection of the present invention.

Claims

1. A lightweight model fingerprint generation and verification method based on prediction bias, characterized in that, include: Obtain the datasets required for training the source model and meta-model, as well as a candidate sample set unrelated to the source model; the source model refers to the model that the copyright owner wants to protect, and the meta-model refers to a step used by the copyright owner in the process of generating the model fingerprint; The target model is trained using the dataset used to train the source model, thus obtaining the source model to be protected; Construct a set of derived models based on the source model to be protected; Based on the dataset required for training the meta-model and the source model to be protected, construct the input representation; Forward inference is performed on the dataset required for training the meta-model to protect the source model and the derived model set, and prediction bias supervision information is obtained. By using input representation and prediction bias supervision information, the meta-model is trained to learn the mapping relationship from the output space of the source model to be protected to the bias distribution of the derived model; The candidate sample set is sequentially input into the trained meta-model to obtain the prediction bias vector corresponding to each candidate sample; the bias sensitivity score is calculated for each candidate sample, and combined with the logits output by the model of the source to be protected, a model fingerprint set is constructed. Based on each sample in the model fingerprint set, the bias vector between the source model output and the meta-model prediction is added to obtain a baseline estimate of the predicted response of the derived model. Based on samples in the model fingerprint set and combined with benchmark estimation, the suspected model is validated.

2. The lightweight model fingerprint generation and verification method based on prediction bias according to claim 1, characterized in that, The method of constructing a set of derived models based on the source model to be protected includes: the source model is a lightweight model, and input preprocessing type derived models, fine-tuning type derived models, pruning / compression type derived models and extraction type derived models are constructed based on the source model, which together constitute the set of derived models.

3. The lightweight model fingerprint generation and verification method based on prediction bias according to claim 1, characterized in that, The method for constructing an input representation based on the dataset required for training the meta-model and the source model to be protected includes: performing forward inference on the dataset required for training the meta-model using the source model to be protected, extracting the feature representation of each sample at a specified intermediate layer of the source model, and the logits vector output by the source model; concatenating the feature representation of each sample at a specified intermediate layer of the source model with the logits vector output by the source model to obtain the input representation.

4. The lightweight model fingerprint generation and verification method based on prediction bias according to claim 1, characterized in that, The prediction bias supervision information is the difference between the logits output by the source model to be protected and the logits output by the derived model.

5. The lightweight model fingerprint generation and verification method based on prediction bias according to claim 1, characterized in that, The method employs input representation and prediction bias supervision information to train the meta-model to learn the mapping relationship from the output space of the source model to be protected to the bias distribution of the derived model. include: (1) Employing a training method based on the bias of a single derived model, including: The logits difference between a single derived model and the source model to be protected is used as the prediction bias supervision information, and the meta-model is fitted to the bias vector on a sample-by-sample basis. or, The average of the biases obtained from multiple samplings of the same derived model in neighboring epochs or neighboring levels is used as the prediction bias supervision information. (2) A training method based on joint bias of multiple derived models is adopted, including: The bias vectors of multiple derived models are combined at the sample level as multi-task supervision for the meta-model; among them, the derived model participating in the joint training is the derived model with the strongest similarity to the source model to be protected and the smallest modification.

6. The lightweight model fingerprint generation and verification method based on prediction bias according to claim 1, characterized in that, For each candidate sample, a bias sensitivity score is calculated, and combined with the logits output by the source model to be protected, a model fingerprint set is constructed. The method includes: calculating a bias sensitivity score for each candidate sample, sorting the samples in descending order of the scores, selecting the top K samples with the highest scores, and using them together with the logits output by the source model to form a model fingerprint set. or, The method involves verifying suspicious models based on samples from the model fingerprint set and benchmark estimation. The method includes: inputting samples from the model fingerprint set into the suspicious model to be verified for black-box querying to obtain the output of the suspicious model; calculating the similarity between the benchmark estimation and the output of the suspicious model; and averaging the similarity over the model fingerprint set to obtain an overall consistency score. When the overall consistency score is greater than or equal to a preset threshold, the suspicious model is determined to be a pirated model of the source model; otherwise, it is determined to be an independent model.

7. A lightweight model fingerprint generation and verification system based on prediction bias, characterized in that, include: The data preparation module is configured to: acquire the datasets required for training the source model and the meta-model, as well as a candidate sample set unrelated to the source model; the source model refers to the model that the copyright owner wants to protect, and the meta-model refers to a step used by the copyright owner in the process of generating the model fingerprint; The source model training module is configured to train the target model using the dataset used to train the source model, thereby obtaining the source model to be protected. The derived model set construction module is configured to construct a derived model set based on the source model to be protected. The input representation acquisition module is configured to construct the input representation based on the dataset required for training the meta-model and the source model to be protected. The prediction bias supervision information acquisition module is configured to perform forward inference on the dataset required for training the meta-model for the set of source and derived models to be protected, and obtain prediction bias supervision information. The meta-model training module is configured to: use input representation and prediction bias supervision information to train the meta-model to learn the mapping relationship from the output space of the source model to be protected to the bias distribution of the derived model; The model fingerprint set generation module is configured to: input the candidate sample set into the trained meta-model in sequence to obtain the prediction bias vector corresponding to each candidate sample; calculate the bias sensitivity score for each candidate sample; and construct the model fingerprint set by combining the logits output by the model of the source to be protected. The copyright verification benchmark response building module is configured to: based on each sample in the model fingerprint set, add the deviation vector between the source model output and the meta-model prediction to obtain a benchmark estimate of the predicted response of the derived model; The copyright verification module is configured to verify suspicious models based on samples in the model fingerprint set and in conjunction with benchmark estimates.

8. A computer device, characterized in that, A processor, adapted to execute computer programs; A computer-readable storage medium storing a computer program, which, when executed by the processor, implements the steps of the lightweight model fingerprint generation and verification method based on prediction bias as described in any one of claims 1-6.

9. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores a computer program adapted to be loaded by a processor and to execute the steps of the lightweight model fingerprint generation and verification method based on prediction bias as described in any one of claims 1-6.

10. A computer program product, characterized in that, The computer program product includes a computer program that, when executed by a processor, implements the steps in the lightweight model fingerprint generation and verification method based on prediction bias as described in any one of claims 1-6.

Images