Method for encoding the digital signature of a neural network, device and corresponding computer program

Abstract

Method for encoding the digital signature of a neural network, device and corresponding computer program. The invention relates to a method for encoding the digital signature of a neural network, implemented by an electronic device, said neural network being stored within a data structure comprising parameter blocks. Such a method comprises, for a current parameter block (PB) comprising at least M parameters representing real numbers: a step of obtaining (A10) a binary signature image (BSIg) from the digital signature comprising a set of bits extracted from the parameters of the current parameter block; a step of combining (A20) the binary signature image (BSIg) with a reference binary image (RBI) yielding a coded binary image (BCI). Figure for the abstract: Fig. 2

Description

Title of the invention: Method for encoding the digital signature of a neural network, device and corresponding computer program

[0001] The present invention relates to the field of neural network protection. More particularly, the invention relates to the protection of the resulting training data, called parameters, which are used for the inference of a neural network.

[0002] Neural networks are increasingly being deployed and commercialized in a wide variety of real-world scenarios due to their performance, particularly in classification and prediction tasks. Training a deep neural network is a very expensive process that requires (i) the availability of massive amounts of data, often proprietary, capturing different scenarios within a target application; (ii) significant computing resources; and (iii) the assistance of deep learning experts to carefully adjust the network topology (e.g., the type and number of hidden layers) and properly define training hyperparameters, such as the learning rate, batch size, etc. Therefore, high-performing neural networks require substantial investment and must be protected accordingly.This is particularly important when the neural network is implemented within embedded equipment: this can be used to retrieve the neural network and use it in other contexts or other equipment.

[0003] To protect neural networks, digital watermarking techniques are known. With these techniques, the trained neural network is watermarked. A reading process is then used to discover the watermark(s) inserted within the data structure. Two main types of watermarking techniques for neural networks are known: so-called "black box" techniques and so-called "white box" techniques.

[0004] In the case of white-box tattooing, the tattoo decoder extracts the digital tattoo(s) from the parameters of the neural network. This may involve extracting a message inserted within the network or detecting a tattoo.

[0005] Black-box techniques essentially consist of inserting one or more digital tattoos, which are revealed when a specific question is posed to the neural network. Throughout the decoding process In detection mode, the architecture and internal parameters of the neural network are completely blind to the decoder or detector. In other words, the only elements that can be controlled are the inputs used to query the network and the outputs corresponding to the queries.

[0006] These two types of techniques can be used for the same neural network. However, it sometimes happens that digital watermarks are erased or deleted by attackers. Such a situation occurs, for example, when the initially hacked neural network undergoes too many modifications (deletion of several layers, retraining, pruning, quantization). In such a situation, the watermarking processes (which generally attempt to disrupt the network's execution as little as possible) may prove insufficient and unable to preserve the watermark. It is therefore necessary to propose a technique that makes it possible to detect the origin of all or part of a neural network, even if it has undergone significant modifications after being stolen.

[0007] One objective of the invention is to provide a white-box digital signature coding technique for neural networks that addresses the problems posed by prior techniques, particularly the robustness issue. Another objective of the invention is to provide a technique that makes the comparison between an original network and a stolen network more easily visualized.

[0008] To this end, the invention relates to a method for encoding a digital signature of a neural network, a method implemented by an electronic device, said neural network being stored within a data structure comprising parameter blocks. Such a method comprises, for a typical parameter block comprising at least M parameters representing real numbers: - a step of obtaining a binary signature image from the digital signature comprising a set of bits extracted from the parameters of the current parameter block; - a step of combining the signature binary image with a reference binary image delivering a coded binary image.

[0009] Thus, the claimed method makes it possible to identify the origin of a neural network, for example when it is used in unauthorized devices or during cyberattack analysis operations.

[0010] According to a particular feature, the step of obtaining the binary signature image from a set of bits of the parameters of the current parameter block comprises: - a determination step, starting from a first predetermined factor of a set of N parameters to be processed, N being less than or equal to M; - a step of obtaining, from at least a second predetermined factor of a set of K bits to be processed, for each of the parameters of said set of N parameters to be processed, delivering a set of P bits; - a step of creating, from the P bits of the bit set, the binary signature image;

[0011] According to a particular feature, characterized in that the step of combining the signature binary image with the reference binary image includes, for each bit of the reference binary image, the calculation of a combined bit using a corresponding bit of the signature binary image.

[0012] According to a particular feature, the calculation of the combined bit preferably consists of an "exclusive or" operation.

[0013] According to a particular feature, the method is iteratively implemented on a plurality of parameter blocks of the neural network, delivering a plurality of characteristic binary images, each associated with a parameter block.

[0014] According to another aspect, the disclosure relates to a method for decoding a digital signature of a neural network, a method implemented by an electronic device, said neural network being stored within a data structure comprising parameter blocks. Such a method comprises, for a current parameter block comprising at least M parameters representing real numbers: - a step of obtaining a binary signature image from a signature comprising a set of bits extracted from the parameters of the current parameter block; - a combination step, of the signature binary image with a coded binary image associated with the current parameter block, delivering an induced reference binary image.

[0015] According to a particular feature, the step of obtaining the signature binary image comprises the following steps: - obtaining a first predetermined factor relating to the determination of N parameters to be selected, at least a second predetermined factor relating to obtaining the K bits to be processed and a coded binary image of the current parameter block; - obtaining, from said at least a predetermined factor of a set of K bits to be processed, for each of the parameters of said set of N parameters to be processed, delivering a set of P bits; creation, from the P bits of the bit set, of a binary signature image;

[0016] According to a particular feature, the method further includes a step of comparing the induced reference binary image with a reference binary image.

[0017] Therefore, it is visually easy for an observer to determine whether a block of neural network has been subject to unauthorized modification or unauthorized appropriation.

[0018] In another aspect, the disclosure also relates to an electronic device for encoding a digital signature of a neural network, said neural network being stored within a data structure comprising parameter blocks. Such a device comprises, for a current parameter block comprising at least M parameters representing real numbers: means of obtaining a binary signature image from the digital signature comprising a set of bits extracted from the parameters of the current parameter block; means of combining the signature binary image with a reference binary image delivering a coded binary image.

[0019] In another aspect, the disclosure also relates to an electronic device for decoding a digital signature of a neural network, said neural network being stored within a data structure comprising parameter blocks. Such a device comprises, for a current parameter block comprising at least M parameters representing real numbers: means of obtaining a binary signature image from a set of bits of the parameters of the current parameter block; means of combining the signature binary image with a coded binary image associated with the current parameter block, delivering an induced reference binary image.

[0020] According to a preferred implementation, the various steps of the processes described are implemented by one or more software programs or computer programs, comprising software instructions intended to be executed by a data processor of a relay module as disclosed and designed to control the execution of the various steps of the processes. Consequently, the disclosure also covers a program, capable of being executed by a computer or by a data processor, this program comprising instructions to control the execution of the steps of the processes as mentioned herein, when executed by a terminal and / or by an integrated circuit. This program may use any programming language and be in the form of source code, code object, or intermediate code between source code and object code, such as in a partially compiled form, or in any other desirable form. Disclosure also covers information media readable by a data processor, containing instructions for a program as described above. The information media can be any entity or device capable of storing the program. For example, the media can include a storage medium, such as a ROM, for example a CD-ROM or a microelectronic circuit ROM, or a magnetic recording medium, for example a hard disk drive, flash memory, or other type of storage memory. Alternatively, the information media can be a transmissible medium such as an electrical or optical signal, which can be transmitted via an electrical or optical cable, by radio, or by other means.The program, according to the disclosure, can be downloaded from a network such as the Internet. Alternatively, the information carrier can be an integrated circuit in which the program is embedded, the circuit being adapted to execute or be used in the execution of the process in question. In one embodiment, the disclosure is implemented by means of software and / or hardware components. In this context, the term "module" in this document may refer to a software component, a hardware component, or a combination of hardware and software components. A software component corresponds to one or more computer programs, one or more subroutines of a program, or more generally to any element of a program or software capable of implementing a function or set of functions, as described below for the module in question.Such a software component is executed by a data processor within a physical entity (terminal, server, gateway, router, etc.) and can access the hardware resources of that physical entity (memory, storage media, communication buses, input / output cards, user interfaces, etc.). Similarly, a hardware component corresponds to any element of a hardware assembly capable of implementing a function or set of functions, as described below for the module in question. This could be a programmable hardware component or one with an integrated processor for software execution, for example, an integrated circuit, a smart card, a memory card, a firmware-running electronic board, etc. Each component of the assembly described above naturally implements its own software modules.The various examples of implementation and characteristics mentioned can be combined for the purpose of implementing disclosure.

[0021] Other features and advantages of the invention will become apparent from the description given below, by way of example and not limitation, with reference to the accompanying figures, among which: - [Fig-1] illustrates a digital signature coding device implementing the invention according to an example embodiment; - [Fig.2] illustrates a digital signature coding process for a neural network; - [Fig.3] illustrates an example of the implementation of the digital signature coding process of a neural network; - [Fig.4] illustrates a digital signature coding process for a neural network; - [Fig.5] illustrates an example of the implementation of the digital signature decoding process of a neural network. Reminder of the principle

[0022] As explained previously, one object of the invention is to provide a digital signature coding technique for a neural network, implemented in a white-box environment, which offers increased resistance to attacks that a neural network may be subjected to, particularly in an embedded implementation context. Another object of the present invention is thus to enable more effective identification of a neural network that has been extracted from an embedded device, then modified and reinserted into another embedded device, by an attacker who wishes to misuse a neural network not belonging to them, modify a neural network to skew its results (for example, to carry out a cyberattack), or even save money by appropriating the research and development work carried out by a competitor.

[0023] The general principle of the invention consists in extracting, from at least one parameter block of the (previously trained) neural network, a signature (in the form of an image), from selected bits of the parameters (numerical values) stored in the parameter blocks. The invention thus relates to a method for encoding the digital signature of a (previously trained) neural network comprising a set of parameter blocks, the parameter blocks comprising parameters of the neural network. These parameters are, for example, parameters that have been trained, such as layer weights, biases, tensor values, normalization values, convolution values, etc. Thus, at least some of the parameter blocks each comprise a set of parameters, the number of which varies depending on the block in question.In one example implementation, the parameter blocks include floating-point real (float) values ​​of a predetermined number of bits (e.g., 16, 32, or 64 bits). In other words, each of these floating-point real values ​​is stored, for example, in two, four, or eight bytes (within a given block, all values ​​are encoded using the same number of bits or bytes). The digital signature encoding method of the invention is executed on these parameter blocks to extract a secret signature from them. The method is implemented, for example, on a neural network stored in the onnx format, which has the advantage of offering numerous access and modification APIs, regardless of the programming languages ​​used.

[0024] Figure 1 schematically illustrates an electronic digital signature coding device. The electronic digital signature coding device 2 comprises a bit-to-processing (Sbts) acquisition module (20); a bit-to-processing (40) module for the bits to be processed (Sbts) according to at least one secret data (which are also called factors) as shown in Figure 1.

[0025] In the example of [Fig. 1], the digital signature encoding device 2 comprises an electronic memory unit 16, at least one processing unit 18, and a communication interface 60 with remote devices, via a chosen communication protocol, for example, a wired protocol and / or a radio communication protocol. The elements of the device 2 are adapted to communicate via a communication bus 15.

[0026] In the example of [Fig. 1], the bit-to-processing module (20) and the bit-to-processing module (40) based on at least one secret piece of data are each implemented as a software program, or a software component, executable by the processor. The memory of the digital signature encoding device 2 is then capable of storing a bit-to-processing software program (20) and a bit-to-processing software program (40) based on at least one secret piece of data. The processor is then capable of executing each of the software programs, including the message-to-tap software (Msg) and the parameter modification software based on the parameter blocks constituting the neural network.

[0027] In an unrepresented variant, the bit-to-process (Sbts) acquisition module (20), the bit-to-process (Sbts) processing module (40) as a function of at least one secret data, are each implemented in the form of a programmable logic component, such as an FPGA (Field Programmable Gate Array), or an integrated circuit, such as an ASIC (Application Specified Integrated Circuit).

[0028] When the electronic digital signature encoding device 2 is implemented in the form of one or more software programs, i.e., in the form of a computer program, also called a computer program product, it is further capable of being recorded on a computer-readable medium, not shown. The medium A computer-readable medium is, for example, a medium capable of storing electronic instructions and being connected to a computer system bus. Examples of readable media include optical discs, magneto-optical discs, ROMs, RAM, any type of non-volatile memory (such as FLASH or NVRAM), or magnetic cards. A computer program containing software instructions is then stored on this readable medium.

[0029] In relation to [Fig. 2], the method for encoding a digital signature of a neural network is implemented by an electronic device as described above. The neural network is stored within a data structure comprising parameter blocks. The method comprises, for a typical parameter block comprising at least M parameters representing real numbers: - a step of obtaining (A10) a binary signature image (IBSig) from a signature comprising a set of bits extracted from the parameters of the current parameter block; - A combination step (A20) of the signature binary image (IBSig) with a reference binary image (IBR) delivering the coded binary image (IBC).

[0030] When the number of parameters stored in the block is large compared to the reference binary image, a smaller number of parameters are selected from within the block using a predetermined first factor. For the purposes of this document, a binary image (whether reference, characteristic, signature, etc.) is a two-color raster image (for example, black and white). It is, for example, encoded in binary form (base 2), or encoded in a more complex form with at least two possible colors (black and white or RGB by combining several signatures or portions of a single signature). Generally, only one signature is extracted for a given parameter block. When the block contains many parameters, it is also possible to construct more than one signature for that block.In this case, for a given block, the signature extraction and encoding step is repeated to produce as many complete signatures as necessary. This results in redundancy of encoded signatures for a given neural network block, as explained in detail later.

[0031] The signature extracted from the parameter bits (real values) of a block can be processed into several forms. In a first example, the signature can be processed into the form of an encrypted string (or a repetition of an encrypted string). In a second example, the signature can be processed into the form of an image. In a third For example, the signature can be processed to take the form of a transformed image (e.g., noisy).

[0032] In the case of the first example, the character string can be constructed as follows: a reference character string is determined (for example, a string defining a copyright, such as "TheCompanyl©"). This string can have a predetermined length (for example, six, twelve, eighteen, or twenty-four characters). From this reference character string, an error detection code (CRC, for "cyclic redundancy check") is calculated. This error detection code is concatenated with the reference character string to form a codeword. This codeword also has a predetermined size. Although not mandatory, the codeword can then be encoded, for example, with a reversible pseudo-random transformation, and the encoded codeword can constitute the base signature with which the signature extracted from the parameter blocks of the neural network is combined.The encoded codeword is also of predetermined size (for example, sixty-four, one hundred twenty-eight, or two hundred fifty-six bits). The codeword size is initially chosen according to the circumstances, and in particular according to the size of the blocks (for example, according to the number of parameters contained in the parameter blocks), so as to allow the complete extraction of at least one occurrence of the signature in the blocks of real values, and thus obtain at least one complete signature in a block.

[0033] In the case of the second example, the image to be extracted as a message can be selected so as to visually reproduce a marker of belonging to an entity (for example, the image could be a company logo). The image is selected so that its size in bits is compatible with at least some of the parameter blocks (i.e., that it can be combined using bits extracted from a parameter block). As in the case of the character string, it is also possible to calculate an error-correcting code and / or transform the image or the encoded codeword as in the first example.

[0034] Example of an embodiment for encoding signatures of a block of the reference neural network

[0035] In relation to Figures 2 and 3, an example of an embodiment is shown how the signature is extracted from a block of current parameters of the neural network, comprising M different parameters, recorded as real numbers.

[0036] This method comprises: - A determination step Al 1, from a first predetermined factor (seedO) of a set of N parameters to be processed, N being less than or equal to M; - A step of obtaining A12, from at least one second predetermined factor (seedl), a set of K bits to be processed, for each of the parameters of said set of N parameters to be processed, delivering a set of P bits; - A creation step A13, from the P bits of the bit set, of a binary signature image (IBSig); - A combination step A20, of the signature binary image (IBSig) with a reference binary image (IBR), delivering the coded binary image (IBC);

[0037] The number of bits K extracted per parameter can be the same for all parameters in a current block or different for each parameter in the current block. This is determined according to requirements and / or initial parameterization (for example, a different "seedl" factor for each parameter). In other words, and more concisely, the proposed method consists of combining selected bits (for example, from one or more columns of all or part of the parameters in the current parameter block) with a reference image belonging to the owner of the neural network. This combination produces a coded binary image that is stored in a database, along with information about the current parameter block. This coded binary image does not necessarily reproduce a visual element. Rather, it appears as indistinct overall noise.

[0038] The procedure described above is applied to all or part of the neural network blocks for which such an operation is useful. For example, blocks in which parameter values ​​are repeated (e.g., those that mainly contain ones or zeros) are not taken into account for the creation of the characteristic binary images. At the end of the processing of a neural network using the method of the invention, a set of characteristic binary images is thus obtained, stored in a database, each image being associated with a particular block (and with a neural network from which these blocks originate).

[0039] In one example, the bits selected in the blocks are mostly the most significant bits of the parameters. This takes advantage of the fact that these bits have a lower probability of being modified than the least significant bits (particularly during relearning).

[0040] The predetermined factors (“seedO” and “seedl”) are used to select the parameters and the bits of those parameters to be used. Depending on the operational implementation conditions, these factors may be common to all blocks of the network of neurons or be individualized, by block. For example, since the size of blocks can vary within the same neural network, these factors can also vary. In which case, they are saved within the database along with the coded binary image.

[0041] Thus, the digital signature encoding of the parameter block is invisible. Indeed, since the creation of the coded binary image does not modify the content of the neural network, it is impossible for an attacker to modify this characteristic image.

[0042] According to the present embodiment, the step of combining the signature binary image (ISig) with the reference binary image (IBR) comprises an exclusive OR (xor) operation between the corresponding bits of each image. In other words, the coordinate bit (0,0) of the signature binary image (ISig) is combined with the coordinate bit (0,0) of the reference binary image (IBR); the coordinate bit (0,1) of the signature binary image (ISig) is combined with the coordinate bit (0,1) of the reference binary image (IBR); and so on. The images are of identical size, and each bit of the signature binary image (ISig) can be combined with a corresponding bit of the reference binary image (IBR).

[0043] This "exclusive OR" operation performed on the reference binary image (RBI) with the signature binary image (SBI) allows, within the encoding, for the random noiseing of the ISIG using the mask formed by the signature binary image. This operation can be performed using other suitable means or operations. Its purpose, as indicated, is to be able to visually recover all or part of the reference binary image, even for blocks that have undergone transformations. Thus, the implemented method is fast, resource-efficient, and provides signature data that is resistant to modifications made to the neural network.

[0044] Example of decoding extracted signatures with a modified neural network

[0045] An example of implementing the method for decoding extracted signatures with a modified neural network is described with reference to Figures 4 and 5. The decoding consists of correlating the bits extracted from a block of the neural network to be tested. Thus, for a current parameter block of a neural network suspected of belonging to a rights holder, the following steps are implemented: obtaining B11 the first predetermined factor (seedO) relating to the determination of the N parameters to be selected, of said at least a second predetermined factor (seedl) relating to the obtaining of the K bits to be processed and of the binary coded image (BCI) of the current parameter block (these elements are, for example, stored in a database); - obtaining B12, from said at least a second predetermined factor (seedl) of a set of K bits to be processed, for each of the parameters of said set of N parameters to be processed, delivering a set of P bits; - creation B13 from the P bits of the bit set, of a binary signature image (IBSigL); this image represents the signature extracted from the disputed block; - combination B20, of the signature binary image (IBSigL) with the coded binary image (IBC), yielding an induced reference binary image (IBRi).

[0046] Depending on the modifications undergone by the original block of the neural network, the induced reference binary image corresponds, to varying degrees, to the reference binary image (IBR) used during the creation of the signature. The advantage, however, of this decoding is that it immediately reveals the extent of the modifications made to the parameter block, through the appearance of the induced reference binary image (IBRi).

[0047] Let (br;) be a bit of the reference binary image (RBI) and (bs;) the corresponding bit of the signature binary image. - The encoding consists of calculating the bit (bc;) of the coded binary image (CBI) by: bc; = br; ® bs;. bc; is the coded bit of br; as explained previously;

[0048] To decode bc; we again use the bsl; bit of the binary signature image (IBSigL) extracted from the disputed block and calculate: brl; = bc; ® bsl; ; - If the bsli bit (of the disputed block) is identical to the bs; bit (of the original block), the brl; result of this decoding operation gives br;, the bit of the reference binary image (IBR) and the reference binary image is not modified for this bit; - If the bsli bit (of the disputed block) is different from the bs; bit (of the original block), the brl; result of this decoding operation gives the inverse of the b1, bit of the reference binary image (IBR) and the reference binary image is modified for this bit.

[0049] Thus, the decoding operation allows, for a set of bits corresponding to those of the signature of the original block, the recovery of an induced reference binary image (IBRi) that exhibits a greater or lesser degree of similarity with the coded binary image (IBC) saved for that block. The induced reference binary image (IBRi) can be directly displayed to observe the extent of the modifications made to that block of the neural network.

[0050] In one example, each block of the disputed neural network is used to extract a signature binary image for that block. Consider a disputed neural network comprising O blocks. Q signature binary images (IBSigLo, ..., IBSigLç) are thus extracted. According to the invention, a correlation is performed between each signature binary image (IBSigLo, ..., IBSigLQ) of the disputed network and each coded binary image (IBC0, ..., IBCM) of the original network (which comprises M blocks, each of which has a coded binary image). In this way, even if the disputed network has undergone transformations such as reversing blocks, retraining certain blocks, or reducing the size of certain blocks, the overall correlation of the network still allows for a visual representation of the similarities between these two networks.

[0051] An error correction based on the entire block set, for example by majority, combination, or automatic threshold, can also be performed on all the blocks concerned, in order to recover a more readable version of the image. It is thus possible to observe the presence of the reference binary image (RBI) for several blocks, even if the neural network parameters are modified.

[0052] Selection of optimal bit selection factors

[0053] In a complementary embodiment, the digital signature coding method described above can be implemented in an optimized manner by selecting, from the parameter blocks, the bit index(es) that best withstand the various modifications that the neural network may undergo. More specifically, in this embodiment, the original neural network (i.e., before implementation of the digital signature coding) constitutes the reference. The method of the invention is implemented iteratively on degraded versions of the neural network to search for and identify an original signature. In other words, the reference neural network undergoes several modifications (layer deletions, pruning, retraining, etc.).We obtain several degraded versions of the reference neural network (these versions being assumed to be close to those that an attacker could subject the reference neural network to). Once this basic material is available, we implement at least one iteration of the following procedure: . - Extraction of signatures from the reference neural network, according to the processing method previously presented, using common extraction factors; these extracted signatures are recorded in a database; - For each degraded version of the reference neural network, implementation of signature correlation, as previously described. Correlation results are recorded for each degraded version of the reference neural network; - Modification of current extraction factors, consisting for example of a modification of the parameters which are selected in the blocks (modification of seedO for example), modification of the indices of the bits selected in the parameters (modification of seedl for example).

[0054] Once all the correlation results have been obtained, the extraction factors that best withstand modifications to the reference neural network are retained and are used under operational conditions. Additional marking of document fields

[0055] According to an additional feature, the reference neural network can also undergo a watermarking process comprising a step of marking documentary fields. Depending on the format used to save the neural network resulting from the training, documentary fields are indeed present. For example, the onnx format contains documentary fields that can be marked. The following fields, for example, can be modified with a secret string:

[0056] model.producer_name

[0057] model.producer_version

[0058] model.doc_string

[0059] model.graph.doc_string

[0060] This secret string can take the form of an encrypted codeword. The advantage of this additional marking is that it does not require modifying the values ​​stored in the neural network. It therefore has no impact on the neural network's performance. This marking can comprise a predetermined number of characters, from which an error-correcting code is calculated, the resulting codeword being encrypted and encoded in base64, for example.

[0061] Additional features relating to the neural network

[0062] The neural network comprises an ordered succession of layers of neurons, each of which takes its inputs from the outputs of the previous layer.

[0063] More precisely, each layer comprises neurons taking their inputs from the outputs of the neurons of the previous layer, or from the input variables for the first layer.

[0064] Alternatively, more complex neural network structures can be envisaged with a layer that can be linked to a layer further away than the immediately preceding layer.

[0065] Each neuron is also associated with an operation, that is to say a type of processing, to be carried out by said neuron within the corresponding processing layer.

[0066] Each layer is connected to the other layers by a plurality of synapses. A synaptic weight is associated with each synapse, and each synapse forms a link between two neurons. It is often a real number, which takes on both positive and negative values. In some cases, the synaptic weight is a complex number.

[0067] Each neuron is designed to perform a weighted sum of the value(s) received from the neurons of the preceding layer, each value being multiplied by the respective synaptic weight of each synapse, or connection, between said neuron and the neurons of the preceding layer, and then to apply an activation function, typically a non-linear function, to said weighted sum, and to deliver at the output of said neuron, in particular to the neurons of the next layer connected to it, the value resulting from the application of the activation function. The activation function introduces non-linearity into the processing performed by each neuron. The sigmoid function, the hyperbolic tangent function, and the Heaviside function are examples of activation functions.

[0068] As an optional complement, each neuron is also capable of applying, in addition, a multiplicative factor, also called bias, to the output of the activation function, and the value delivered at the output of said neuron is then the product of the bias value and the value from the activation function.

[0069] A convolutional neural network is also sometimes called a convolutional neural network or by the acronym CNN, which refers to the English term "Convolutional Neural Networks".

[0070] In a convolutional neural network, each neuron in the same layer exhibits exactly the same connection pattern as its neighboring neurons, but at different input positions. The connection pattern is called the convolutional kernel or, more commonly, the "kernel" in reference to the corresponding English term.

[0071] A fully connected layer of neurons is a layer in which the neurons of said layer are each connected to all the neurons of the preceding layer.

[0072] Such a type of layer is more often referred to by the English term "fully connected", and sometimes designated by the name "dense layer".

[0073] These types of neural networks are encoded in generic formats such as onnx. This disclosure applies to any type of common neural network topology supported by this generic format, for example, "fully connected", CNN, but also RNN, "Attention layer", ... which is representable by one or more parameter blocks comprising values ​​as previously described.

Claims

Demands

1. A method for encoding a digital signature of a neural network, the method implemented by an electronic device, said neural network being stored within a data structure comprising parameter blocks, the method comprising, for a current parameter block (BPc) comprising at least M parameters representing real numbers, the parameters being chosen from the group consisting of: layer weights, biases, tensor values, normalization values ​​and convolution values: - a step of obtaining (A10) a binary signature image (IBSig) from the digital signature comprising a set of bits extracted from the parameters of the current parameter block; - a step of combining (A20) the binary signature image (IBSig) with a reference binary image (IB R) delivering a coded binary image (IBC).

2. A coding method according to claim 1, characterized in that the step of obtaining (10) the binary signature image (IBSig) from a set of bits of the parameters of the current parameter block comprises: - a determination step (A11), from a first predetermined factor (seedO) of a set of N parameters to be processed, N being less than or equal to M; - a obtaining step (A12), from at least a second predetermined factor (seedl) of a set of K bits to be processed, for each of the parameters of said set of N parameters to be processed, delivering a set of P bits; - a creation step (A13), from the P bits of the bit set, of the binary signature image (IBSig);

3. A coding method according to claim 1, characterized in that the step of combining (A20) the signature binary image (IBSig) with the reference binary image (IBR) comprises, for each bit of the reference binary image (IBR), the calculation of a combined bit using a corresponding bit from the binary signature image (IBSig); the calculation of the combined bit preferably consisting of an "exclusive or" operation.

4. Coding method according to claim 1, characterized in that it is iteratively implemented on a plurality of blocks (Bo, ... BR.i) of neural network parameters, delivering a plurality of characteristic binary images (IBC0, ... IBCR i), each associated with a block of parameters.

5. A method for decoding a digital signature of a neural network, the method implemented by an electronic device, said neural network being stored within a data structure comprising parameter blocks, the method comprising, for a current parameter block (BPcL) comprising at least M parameters representing real numbers, the parameters being chosen from the group consisting of: layer weights, biases, tensor values, normalization values ​​and convolution values: - a step of obtaining (B10) a binary signature image (IBSigL) from a signature comprising a set of bits extracted from the parameters of the current parameter block; - a step of combining (B20) the binary signature image (IBSigL) with a coded binary image (IBC) associated with the current parameter block, delivering an induced reference binary image (IBRi).

6. Decoding method according to claim 5, characterized in that the step of obtaining (B 10) the binary signature image (IBSigL) comprises the following steps: - obtaining (B 11 ) a first predetermined factor (seedO) relating to the determination of N parameters to be selected, at least a second predetermined factor (seedl) relating to obtaining the K bits to be processed and a coded binary image (IBC) of the current parameter block; - obtaining (B 12), from said at least one predetermined factor (seedl) a set of K bits to be processed, for each of the parameters of said set of N parameters to be processed, delivering a set of P bits; - creating (B 13), from the P bits of the bit set, a signature binary image (IBSigL);

7. Decoding method according to claim 5, characterized in that it comprises a step of comparing the induced binary reference image (IBRi) with a binary reference image (IBR).

8. Electronic device for encoding a digital signature of a neural network, said neural network being stored within a data structure comprising parameter blocks, the device comprising, for a current parameter block comprising at least M parameters representing real numbers, the parameters being chosen from the group consisting of: layer weights, biases, tensor values, normalization values ​​and convolution values: - means for obtaining a binary signature image (IBSig) from the digital signature comprising a set of bits extracted from the parameters of the current parameter block; - means for combining the binary signature image (IBSig) with a reference binary image (IBR) delivering a coded binary image (IBC).

9. An electronic device for decoding a digital signature of a neural network, said neural network being stored within a data structure comprising parameter blocks, the device comprising, for a current parameter block (BPcL) comprising at least M parameters representing real numbers, the parameters being chosen from the group consisting of: layer weights, biases, tensor values, normalization values ​​and convolution values:

10. - means of obtaining (B 10) a binary signature image (IBSigL) from a set of bits of the parameters of the current parameter block; - means of combining (B20), the signature binary image (IBSigL) with a coded binary image (IBC) associated with the current parameter block, delivering an induced reference binary image (IBRi). Computer program comprising software instructions which, when executed by a programmable electronic device, implement a digital signature encoding method according to claims 1 to 4 and / or a digital signature decoding method according to claims 5 to 7.

Images