Method for digital tattooing of a neural network, device and corresponding computer program

Abstract

Method for digitally watermarking a neural network, device and corresponding computer program The invention relates to a method for digitally watermarking a neural network, method implemented by an electronic device, said neural network being recorded within a data structure comprising parameter blocks. Such a method comprises, for a current parameter block comprising at least N parameters representing real numbers: a step of obtaining a message comprising N bits; at least N iterations of a step of modifying parameters within the current block, comprising: obtaining a current parameter, from among said at least N parameters of the current parameter block; updating the value of a predetermined index bit of the current parameter as a function of a bit of the message. Figure for abstract: Fig. 2

Description

Title of the invention: Method for digital tattooing of a neural network, device and corresponding computer program

[0001] The present invention relates to the field of protection of neural networks. More particularly, the invention relates to the protection of the resulting training data, called parameters, which are used for the inference of a neural network.

[0002] Neural networks are increasingly deployed and commercialized in a wide variety of real-world scenarios due to the performances they achieve, especially in classification or prediction tasks. Training a deep neural network is a very expensive process that requires (i) the availability of massive amounts of data, often proprietary, capturing different scenarios within a target application; (ii) significant computing resources; (iii) the assistance of deep learning experts to carefully tune the network topology (e.g., the type and number of hidden layers), and properly set the training hyper-parameters, such as the learning rate, batch size, etc. Therefore, high-performance neural networks require significant investments and must be protected accordingly.This is particularly important when the neural network is implemented within embedded devices: these can be used to recover the neural network and use it in other contexts or other devices.

[0003] To perform protection of neural networks, digital watermarking techniques are known. With these techniques, the trained neural network (which is presented in the form of a data structure comprising a set of parameters) is marked (watermarked). A reading process is then used to discover the watermark(s) inserted within the data structure. There are mainly two types of techniques known for watermarking neural networks: so-called "black box" techniques and so-called "white box" techniques.

[0004] White box techniques essentially consist of inserting one or more digital tattoos within the network itself, that is to say in the internal parameters that constitute it (for example after learning). The internal parameters that are tattooed can correspond directly to the weights of the model, to the biases, or to the activation of the neurons in correspondence with specific inputs. In the case of white box tattooing, the tattoo decoder extracts the digital tattoo(s) from the parameters of the neural network. This could involve extracting a message inserted into the network or detecting a tattoo.

[0005] Black-box techniques essentially consist of inserting one or more digital watermarks, which are revealed when a specific question is asked to the neural network. This insertion can be done during the training of the network. Thus, to identify the presence of a digital watermark, in a black-box, only the final output of the neural network is readable. In other words, the watermark is retrieved by querying the model (with a particular query, based on a set of correctly chosen inputs, for example images or text defined in advance) and by checking the output of the neural network. During the entire decoding or detection process, the architecture and internal parameters of the neural network are completely blind to the decoder or detector.In other words, the only things that can be controlled are the inputs used to query the network and the outputs corresponding to the queries that correlate to the requests.

[0006] These two types of techniques (white box, black box) can be used for the same neural network.

[0007] However, these techniques suffer from watermark erasure issues, particularly when modifying the neural network (for example by relearning, pruning, quantization, etc.). Indeed, white-box techniques in particular, which modify the internal parameters of the neural network, are sensitive to modifications made to these parameters (change of format of the neural network, change of operator, deletion of layer, change of input layers, change of output classes, etc.), by attackers wishing to illegally appropriate the network. This lack of robustness is particularly sensitive for neural networks running on embedded devices.

[0008] One objective of the invention is to propose a white-box neural network digital watermarking technique that can solve the problems posed by prior techniques, particularly the problem of robustness. Another objective is to maintain the functional qualities of the neural network (precision, false positive, r2, etc.).

[0009] For this purpose, the invention relates to a method for digitally watermarking a neural network, a method implemented by an electronic device, said neural network being recorded within a data structure comprising parameter blocks. Such a method comprises, for a current parameter block comprising at least N parameters representing real numbers: - a step of obtaining a message comprising N bits; - at least N iterations of a parameter modification step within the current block, including: - obtaining a current parameter, from among said at least N parameters of the current parameter block; - updating the value of a predetermined index bit of the current parameter based on a bit of the message.

[0010] Thus, the proposed method makes it possible to steganograph the message to be tattooed. This steganography is simple and efficient since each parameter undergoes a minimal transformation based on a corresponding bit of the message. This modification therefore has little impact on the subsequent performance of the neural network. Furthermore, this steganography is quick to implement and does not require energy-intensive calculations, unlike methods implemented when learning the parameters of neural networks as in the prior art. Thus, the claimed method makes it possible to identify the origin of a neural network, for example when it is used in unauthorized devices or during cyberattack analysis operations.

[0011] According to a particular characteristic, the step of updating the value of a predetermined index bit of the current parameter as a function of a bit of the message comprises a step of calculating an exclusive or operation between a bit of a random vector of size N and the corresponding bit of the message.

[0012] Thus, the original bit of predetermined index is erased in favor of a bit resulting from the exclusive or operation between the message and a random vector of the same size as the message in the form of an encrypted code word.

[0013] According to a particular characteristic, the step of obtaining the message comprises: - a step of obtaining a reference character string; - a step of calculating a cyclic redundancy check code as a function of the reference character string, the cyclic check code being concatenated to the reference character string to form a code word; - a step of encrypting the code word delivering an encrypted code word.

[0014] According to a particular characteristic, the step of obtaining the message further comprises at least one iteration of a step of copying the encrypted code word within a character string to obtain the message of length N bits.

[0015] Thus, we define a redundancy of a basic message, depending on the size of the block. The size of the message in bits is a multiple of the size of a unit message. We thus obtain a vertical redundancy of the tattoo.

[0016] According to a particular characteristic, the step of obtaining the message comprises: - a step of random selection, within the current block, of a predetermined number K of high-weight bits within a predetermined number of parameters of the current block delivering a characteristic binary image; - a first step of combining the characteristic binary image with a reference image, delivering a fused image; - a second step of combining the merged image with a binary image randomly obtained on the basis of a random drawing of K bits, this second step of combination delivering the message.

[0017] Thus the tattoo takes into account the content of the current block to insert a reference image to be tattooed. It is therefore much simpler, later, to visually note the presence of the digital tattoo inserted within the current block. The probative force of the tattoo is thus increased.

[0018] According to a particular characteristic, the first and second combination steps each implement an exclusive or operation.

[0019] According to another aspect, the invention also relates to an electronic device for digitally tattooing a neural network, said neural network being recorded within a data structure comprising parameter blocks. Such a device comprises for a current parameter block comprising at least N parameters representing real numbers: - means for obtaining a message comprising N bits; - means for implementing at least N iterations of parameter modification within the current block, comprising: - obtaining a current parameter, from among said at least N parameters of the current parameter block; - updating the value of a predetermined index bit of the current parameter based on a bit of the message.

[0020] According to a preferred implementation, the various steps of the disclosed methods are implemented by one or more software or computer programs, comprising software instructions intended to be executed by a data processor of a relay module according to the disclosure and being designed to control the execution of the various steps of the methods. Consequently, the disclosure also relates to a program, capable of being executed by a computer or by a data processor, this program comprising instructions for controlling the execution of the steps of the methods as mentioned herein, when they are executed by a terminal and / or by an integrated circuit. This program can use any programming language, and be in the form of source code, object code, or intermediate code between source code and object code, such as in a partially compiled form, or in any other desirable form.The disclosure also relates to an information carrier readable by a data processor, and comprising instructions of a program as mentioned above. The information carrier may be any entity or device capable of storing the program. For example, the carrier may comprise a storage medium, such as a ROM, for example a CD ROM or a microelectronic circuit ROM, or a magnetic recording medium, for example a hard disk, a flash memory or a storage memory of another type. On the other hand, the information carrier may be a transmissible medium such as an electrical or optical signal, which may be conveyed via an electrical or optical cable, by radio or by other means. The program according to the disclosure may in particular be downloaded from a network such as the Internet.Alternatively, the information carrier may be an integrated circuit in which the program is incorporated, the circuit being adapted to execute or to be used in the execution of the method in question. According to one embodiment, the disclosure is implemented by means of software and / or hardware components. With this in mind, the term "module" may correspond in this document to a software component, a hardware component or a set of hardware and software components. A software component corresponds to one or more computer programs, one or more subroutines of a program, or more generally to any element of a program or software capable of implementing a function or a set of functions, as described below for the module concerned. Such a software component is executed by a data processor of a physical entity (terminal, server, gateway, router, etc.) and is likely to access the hardware resources of this physical entity (memories, recording media, communication buses, electronic input / output cards, user interfaces, etc.). In the same way, a hardware component corresponds to any element of a hardware assembly capable of implementing a function or a set of functions, according to what is described below for the module concerned. It may be a programmable hardware component or one with an integrated processor for executing software, for example an integrated circuit, a smart card, a memory card, an electronic card for executing firmware, etc. Each component of the assembly previously described of course implements its own software modules. The different examples of embodiment and characteristics mentioned can be combined with each other for the implementation of the disclosure.

[0021] The invention also relates to a neural network, recorded within a data structure and saved on a computer-readable medium comprising parameter blocks, the neural network being watermarked by a digital watermarking method as defined above.

[0022] Other characteristics and advantages of the invention will emerge from the description given below, for information purposes only and in no way limiting, with reference to the appended figures, among which: - [Fig.l] illustrates a digital tattoo device according to an exemplary embodiment; - [Fig.2] illustrates a method of digital tattooing of a neural network in an exemplary embodiment; - [Fig.3] illustrates a first example of implementation of the digital tattooing process of a neural network; - [Fig.4] illustrates a second example of implementation of the digital tattooing process of a neural network. Reminders of the principle

[0023] As explained above, one object of the invention is to have a white-box digital watermarking technique that offers increased resistance to attacks that a neural network may be subject to, particularly in an embedded implementation context. Another object of the present invention is thus to make it possible to more effectively identify a neural network that has been extracted from an embedded device, then modified and reinserted into another embedded device, by an attacker who wishes to divert the use of a neural network that does not belong to him, modify a neural network to distort its results (for example to carry out a cyberattack) or even make savings by appropriating the research and development work carried out by a competitor.

[0024] The general principle of the invention consists of inserting, within at least one parameter block of the neural network (previously trained), a tattoo (taking the form of a message), in selected bits of the parameters (digital values) recorded in the parameter block. The invention thus relates to a method for digitally tattooing a neural network (previously trained) comprising a set of parameter blocks, the parameter blocks comprising parameters of the neural network. These parameters are for example parameters which have been the subject of training, such as the weights of the layers, the biases, the tensor values, the normalization values, the convolution values, etc. Thus, at least some of the parameter blocks each comprise a set of parameters, the number of which varies depending on the block in question.In an exemplary embodiment, the parameter blocks comprise floating point values of a predetermined number of bits (for example 8, 16, 32 or 64 bits). In other words, each of these floating point values is for example stored on one, two, four or eight bytes (for a given block, the coding of the parameters is identical). The digital watermarking method of the invention is executed on these blocks. of parameters to insert, within them, a secret message (the watermarked message) which can be presented in the form of a repetition of a basic message. The method is for example implemented on a neural network recorded in onnx format, which has the advantage of having numerous access and modification APIs, regardless of the programming languages used.

[0025] [Fig.l] schematically illustrates an electronic digital tattoo device. The electronic digital tattoo device 2 comprises a module (20) for obtaining a message to be tattooed (Msg); a module (40) for modifying parameters within the parameter blocks constituting the neural network as shown in [Fig.l].

[0026] In the example of [Fig.l], the digital tattoo device 2 comprises an electronic memory unit 16, at least one calculation processor 18 and an interface 60 for communication with remote devices, by a chosen communication protocol, for example a wired protocol and / or a radio communication protocol. The elements of the device 2 are adapted to communicate via a communication bus 15.

[0027] In the example of [Fig.l], the module for obtaining (20) a message to be tattooed (Msg), the module for modifying (40) parameters within the parameter blocks constituting the neural network are each produced in the form of software, or a software brick, executable by the processor. The memory of the electronic digital tattoo device 2 is then capable of storing software for obtaining a message to be tattooed (Msg) and software for modifying parameters within the parameter blocks constituting the neural network. The processor is then capable of executing each of the software among the software for obtaining a message to be tattooed (Msg) and the software for modifying parameters within the parameter blocks constituting the neural network.

[0028] In a variant not shown, the module for obtaining a message to be watermarked (Msg), and the module for modifying parameters within the parameter blocks constituting the neural network, are each produced in the form of a programmable logic component, such as an FPGA (Field Programmable Gate Array), or an integrated circuit, such as an ASIC (Application Specific Integrated Circuit).

[0029] When the electronic digital tattoo device 2 is produced in the form of one or more software programs, that is to say in the form of a computer program, also called a computer program product, it is furthermore capable of being recorded on a medium, not shown, readable by a computer. The computer-readable medium is for example a medium capable of storing electronic instructions and of being coupled to a bus of a computer system. By way of example, the readable medium is an optical disc, a magneto-optical disc, ROM memory, RAM memory, any type of non-volatile memory (for example FLASH or NVRAM) or a magnetic card. A computer program including software instructions is then stored on the readable medium.

[0030] In relation to [Fig.2], the method of digital watermarking of a neural network of the invention is implemented on a neural network which is recorded within a data structure comprising parameter blocks (Blck), the method comprising, for a current parameter block (which comprises for example at least N parameters (p0, ..., Px i) representing real numbers, and it comprises: - A step of obtaining (10) the message Msg comprising N bits (b0, ..., On i); - At least N iterations of a parameter modification step (20) within the current parameter block, comprising: - Obtaining a current parameter (px), among said at least N parameters (p 0, p N1 ) of the current parameter block; - Updating the value of a bit (biPx) of predetermined index of the current parameter (px) as a function of a bit (b0, ..., bN4) of the message Msg.

[0031] When the number of parameters recorded in the block is greater than the length in bits of the message to be inserted, the update step is iterated starting from the first bit of the message to be inserted. Alternatively, the message Msg to be watermarked already comprises several (an integer greater than two) occurrences of a reference message (base message). The watermarking is carried out so that an integer number of copies of the base message is watermarked (there is no partial watermarking of the base message). This provides redundancy in the insertion of the message (in the watermarking) within the neural network, as explained in detail below.

[0032] The message to be watermarked within the parameter bits (real values) can take several forms. In a first example, the message can be in the form of an encrypted character string (or the repetition of an encrypted character string). In a second example, the message to be watermarked can be in the form of an image. In a third example, the message to be watermarked can be in the form of a signature.

[0033] In the case of the first example, the character string can be constructed in the following manner: a reference character string is determined (for example a string defining a copyright, of the type “TheCompanyl©”). This string can have a determined length (for example six, twelve, eighteen, twenty-four characters). From this reference character string, an error detection code is calculated (CRC, from the English for “cyclic redundancy check”). This code error detection is concatenated with the reference character string to form a codeword. This codeword also has a predetermined size. The codeword is then encrypted (for example, with a stream cipher type algorithm in which the size of the encrypted message is identical to the size of the original message, which facilitates the processing carried out for inserting or retrieving messages). The encrypted codeword is then encoded, for example, by a reversible pseudo-random transformation, and the encrypted and encoded codeword constitutes the message to be inserted into the parameter blocks of the neural network. The encrypted and encoded codeword is also of predetermined size (for example, sixty-four, one hundred and twenty-eight, or two hundred and fifty-six bits).The size of the encrypted code word is chosen, initially, according to the circumstances of the case and in particular according to the size of the blocks (for example according to the number of parameters contained in the parameter blocks), so as in particular to allow the complete insertion of at least one occurrence of the message in the blocks of real values, and thus obtain at least one complete registration of the message in a block.

[0034] In the case of the second example, the image to be inserted as a message can be selected so as to visually reproduce a marking of belonging to an entity (for example the image can be a company logo). The image is selected so that its size in bits is compatible with at least some of the parameter blocks (i.e. it can be inserted within a parameter block). As in the case of the character string, it is also possible to calculate an error-correcting code and / or to encrypt (the resulting code word or directly the image) and / or to transform the image, the code word or the encoded encrypted code word as in the first example.

[0035] In the case of the third example, the signature can be inserted based on the content of the network itself. This third possibility is detailed below. First example of realization

[0036] In relation to [Fig.3], in this first exemplary embodiment, we present the manner in which the message is watermarked within a current parameter block of the neural network, comprising M different parameters, recorded in the form of real numbers.

[0037] This method comprises: - A step A10 of obtaining a message Msg in the form of a sequence of bits of predetermined length N; - A selection step A20, within the current parameter block Dblck, of a set of N bits (SBts), each bit of the set SBts belonging to a different parameter of the current parameter block DBlck; - A modification step A30 of each bit of the set SBts using a corresponding bit of the message Msg, delivering a set of modified bits (USbts); - A rewrite step A40 of each modified bit of the USBts set to its original location within the current parameter block DBlck.

[0038] In other words, and more concisely, the proposed method consists of writing in the selected bits (for example in a column or several columns of low-weight bits), vertically, the message of predetermined length.

[0039] Thus, the digital tattoo inserted in the parameter block is invisible. Indeed, since the modification of the original bits is carried out by performing a specific operation on these original bits using the corresponding bits of the message to be tattooed, an attacker cannot determine the presence of the tattoo, unless he knows the message that has been inserted and performs the decoding operation allowing the original bits to be identified (before insertion of the tattoo).

[0040] The procedure described can be implemented iteratively on all or part of the parameter blocks of the neural network. Preferably, this procedure is implemented in a majority of the parameter blocks of the neural network. Thus, the digital watermark is redundant. Even more preferably, this procedure is implemented on all the parameter blocks in which this watermark insertion is possible or desirable. Thus, the watermark is even more resistant to attacks.

[0041] According to the present invention, the step of modifying the bits of the set of bits comprises an exclusive or (xor) operation between a set of N randomly obtained bits and each corresponding bit of the message Msg. This set of N bits is randomly obtained from a reference seed which is kept to perform the decoding of the tattoo. This “exclusive or” operation carried out on the message Msg makes it possible to randomly noise it, and it makes it possible for an attacker not to be able to guess the presence of the digital tattoo within the parameters of the blocks. This noise operation can be carried out using other means or other operations (for example, one could directly use the bits of the network instead of generating a random number of bits, or one could use an operation other than the exclusive or).

[0042] As previously indicated, for a current block, the message can be watermarked several times, for example in different bit columns.

[0043] The decoding method implemented is as follows: For a current parameter block of a neural network which is suspected to belong to a rights holder, an extraction of the N bits which have supposedly been watermarked during a procedure identical or similar to that set out previously is carried out (the bits which are located at a given index of the parameters of the current parameter block). For example, using the reference seed used during encoding, the set of N bits randomly obtained during encoding is again obtained. Using this set of N bits and the N bits of the current block, an exclusive or operation is performed which delivers a set of N "denoised" bits (if this is the operation that was performed during encoding). The set of N denoised bits includes at least one repetition of a basic message that was encoded (repetitions which are all potentially altered by modifications made after the theft of the neural network from the rights holder). For a block, the number of repetitions varies depending on the size of the block and the size of the basic message.An error correction operation can be performed on these denoised bits (for example, a majority logic decoding is performed - a method of decoding repetition codes, based on the assumption that the greatest number of occurrences of a symbol is the transmitted symbol). Then the code word is checked to determine whether there are one or more repetitions of this encrypted code word: the reverse operation is performed, namely a decryption of the code word, and the CRC is checked against the initial secret message.

[0044] The presence of a single correct code word, which therefore includes the secret message and the CRC code which corresponds to this message, is sufficient to determine that the current block is part of a neural network belonging to the rights holder. Second example of realization

[0045] In a second exemplary embodiment, the marking methodology is substantially identical to that implemented in the first exemplary embodiment. It consists of tattooing, in a current block, bits, for example low-order bits, parameters comprising real values (for example coded on sixteen, thirty-two or sixty-four bits), contained in this block. The principle of tattooing columns of bits is also retained. However, the nature of the tattoo is made different by the use of a signature instead of the coded message as described previously. According to the present invention, this signature is obtained from the high-order bits of the current parameter block of the neural network. The principle implemented is to tattoo a visual signature so that it is easy to see the presence of the digital tattoo. This tattoo is visible with or without possible error correction.

[0046] In relation to [Fig.4], in this second embodiment, we present the manner in which the message to be tattooed is formed. The method implemented is as follows: - In the current block (DBlck), obtaining (B00) a predetermined number of high-weight bits from a random selection of parameters is performed; this selection is performed for example using a selection seed (seedO) which is kept; the selected high-weight bits are arranged so as to form an IBPF binary image of predetermined size (in length and width);

[0047] Depending on the desired size of the image, for each (randomly selected) parameter of the current block, it is possible to select one or more high-order bits (for example, four high-order bits, for example at indices 26 to 23, can be selected for each parameter). This is a purely illustrative example. - The IBPF binary image is combined (B20) with a reference binary image IBR, which acts as a secret message; the sizes of the IBPF and IBR binary images are identical; This combination delivers a signed reference binary image (IBRs): it is signed by the most significant bits selected in the block; - A random binary image (IBA) is generated (B40), this generation is carried out for example using a generation seed (seedl) which is kept to carry out a decoding; - The signed reference binary image IBRs is combined (B60) with the random binary image (IBA) to form a noisy binary image (IBB);

[0048] The noisy binary image (IBB) is inserted (B80) into low-order bits of parameters of the current block, in place of the existing bits. Depending on the size of the image, for each parameter of the current block, it is possible to overwrite (replace) one or more low-order bits (for example, four low-order bits, for example at indices 10 to 7, can be replaced for each parameter of the random selection of parameters of step B00).

[0049] Thus, thanks to this implementation, a signature has been watermarked within a part of the current block, in the form of a binary image. During the decoding operation, it is thus possible to visually find the presence of this watermarked binary image. For the purposes of this document, it is recalled that a binary image (whether it is a reference, characteristic, signature, etc.) is a two-color matrix image (for example black and white). It is for example coded in a binary form (in base 2), or coded in a more complex form with only two possible colors.

[0050] The decoding method implemented is as follows: For a current parameter block of a neural network, which is suspected to belong to a rights holder, an extraction of the low-weight bits which have supposedly been watermarked during a procedure identical or similar to that described previously is carried out, delivering a binary image of the low-weight bits (IBbpf). An extraction of the high-weight bits of the same parameters is also carried out, delivering an image binary of the least significant bits (IBbpFo). These extractions are made possible by using the selection seed (seedO) and the bit indices that were determined during coding (and kept for subsequent decoding). These two binary images are combined together to provide an intermediate binary image (IBI). The random binary image (IBA) (used during coding) is generated, this generation is carried out for example using the generation seed (seedl) that was kept to perform decoding. The intermediate binary image (IBI) is combined with the random binary image (IBA) to form a binary image to be interpreted (IBIn).

[0051] The advantage of this technique is that the binary image to be interpreted (IBIn) is a more or less degraded version of the IBR reference binary image used during coding. Indeed, since the combination operations performed on the images are identical, it is easy to display the resulting image of these bit combination operations. The differences that appear between the IBR reference binary image (not degraded) and the binary to be interpreted (IBIn) result from the modifications that were made to the parameter block by the malicious person: the relearning, pruning, etc. that led to more or less significant modifications of the low-order bits of the parameters of the current block do not completely modify the image and it remains interpretable and visualizable.

[0052] A majority error correction can also be performed on the blocks concerned, in order to recover a more readable version of the image (when several blocks are watermarked with the same image for example). It is thus possible to observe the presence of the watermarked image in several blocks, even in the event of modifications to the parameters of the neural network.

[0053] Selecting an optimal insertion configuration

[0054] In a complementary exemplary embodiment, the digital watermarking method described above can be implemented in an optimized manner by selecting, in the parameter blocks, the bit index(es) in which the message is inserted according to a performance and / or robustness threshold of the neural network. More particularly, in this exemplary embodiment, the original neural network (i.e. before insertion of the digital watermark) constitutes the reference in terms of performance and / or robustness. The method of the invention is implemented iteratively on the reference neural network to deliver at least one modified network, i.e. a watermarked network. The performance and / or robustness of the modified network is evaluated with regard to the performance and / or robustness delivered by the reference network. When the performance and / or robustness of the modified network is below a reference threshold, the watermarking performed is not retained. Differentiated selection of parameter blocks

[0055] According to the invention, the parameter blocks in which the message is inserted are selected according to particular selection criteria.

[0056] Thus, when a parameter block is of reduced size (when the number of parameter values of the parameter block is less than a predetermined threshold), this parameter block is not watermarked. This exclusion makes it possible to avoid parameter blocks undergoing partial watermarking, which cannot be read subsequently.

[0057] Alternatively, or in addition, when a parameter block is of reduced size, the message to be inserted into this parameter block may be different. In this case, for example, a specific (reduced) message for parameter blocks of reduced size may be constructed in order to allow the insertion of a watermark. This method may be implemented for example when the number of digital values in a parameter block is less than the length (in bits) of the “regular” message. For example, if the regular message has a length of one hundred and twenty-eight bits and the parameter block comprises one hundred values, a reduced message of length equal to sixty-four bits may be used to perform the watermarking of this block.

[0058] According to another aspect, when a block of parameters comprises a majority of identical values (for example only or mainly zero values or one values), the block of parameters can be excluded from the digital tattoo. This exclusion makes it possible to prevent an attacker from becoming aware of the inserted digital tattoo or of a part of this digital tattoo. Indeed, as explained previously, an advantage of the technique of the invention is to make it possible to keep the tattoo “secret”, insofar as it has little or no influence on the performance and / or the robustness of the network. The exclusions of blocks comprising mainly identical values make it possible to prevent the attacker from becoming aware of this tattoo based on a postulate relating to these values (a priori knowledge of these values by the attacker). Additional marking of documentary fields

[0059] According to an additional feature, the watermarking method further comprises a step of marking documentary fields. Depending on the format used to save the neural network resulting from the training, documentary fields are in fact present. For example, the onnx format contains documentary fields which can be marked. The following fields can for example be modified with a secret character string:

[0060] model.producer_name

[0061] model.producer_version

[0062] model.doc_string

[0063] model.graph.doc_string

[0064] This secret character string may be identical to the message inserted in the parameter blocks. Preferably, however, this string will be different to keep the content of the message or messages inserted in the parameter blocks secret. The advantage of this additional marking is that it does not require modifying the values entered in the neural network. It therefore has no impact on the performance of the neural network. As for the message inserted in the values of the blocks, this marking may include a predetermined number of characters, from which an error-correcting code is calculated, the resulting code word being encrypted and encoded in base64 for example.

[0065] Additional characteristics relating to the neural network

[0066] The neural network comprises an ordered succession of layers of neurons, each of which takes its inputs from the outputs of the previous layer.

[0067] More precisely, each layer comprises neurons taking their inputs from the outputs of the neurons of the previous layer, or from the input variables for the first layer.

[0068] Alternatively, more complex neural network structures can be envisaged with a layer that can be connected to a layer further away than the immediately preceding layer.

[0069] Each neuron is also associated with an operation, i.e. a type of processing, to be carried out by said neuron within the corresponding processing layer.

[0070] Each layer is connected to the other layers by a plurality of synapses. A synaptic weight is associated with each synapse, and each synapse forms a connection between two neurons. It is often a real number, which takes both positive and negative values. In some cases, the synaptic weight is a complex number.

[0071] Each neuron is capable of performing a weighted sum of the value(s) received from the neurons of the previous layer, each value then being multiplied by the respective synaptic weight of each synapse, or connection, between said neuron and the neurons of the previous layer, then applying an activation function, typically a non-linear function, to said weighted sum, and delivering at the output of said neuron, in particular to the neurons of the following layer which are connected to it, the value resulting from the application of the activation function. The activation function makes it possible to introduce non-linearity into the processing carried out by each neuron. The sigmoid function, the hyperbolic tangent function, the Heaviside function are examples of activation functions.

[0072] As an optional addition, each neuron is also capable of applying, in addition, a multiplicative factor, also called bias, to the output of the activation function, and the value delivered at the output of said neuron is then the product of the bias value and the value from the activation function.

[0073] A convolutional neural network is also sometimes called a convolutional neural network or by the acronym CNN which refers to the English term “Convolutional Neural Networks”.

[0074] In a convolutional neural network, each neuron in the same layer has exactly the same connection pattern as its neighboring neurons, but at different input positions. The connection pattern is called a convolution kernel or, more often, "kernel" in reference to the corresponding English term.

[0075] A fully connected layer of neurons is a layer in which the neurons of said layer are each connected to all the neurons of the previous layer.

[0076] Such a type of layer is more often referred to as “fully connected” and sometimes referred to as a “dense layer”.

[0077] These types of neural networks are encoded in generic formats such as for example onnx. The present disclosure applies to any type of current neural network topology supported by this generic format, for example “fully connected”, CNN, but also RNN, “Attention layer”, ... which is representable by one or more blocks of parameters comprising values as previously explained.

Claims

Claims

1. Method for digitally watermarking a neural network, method implemented by an electronic device, said neural network being recorded within a data structure comprising parameter blocks, the method comprising, for a current parameter block comprising at least N parameters (p0, ..., Px i) representing real numbers, the parameters being chosen from the group consisting of: layer weights, biases, tensor values, normalization values, and convolution values: - a step of obtaining (10) a message (Msg) comprising N bits (b0, ..., bN i); - at least N iterations of a step of modifying (20) parameters within the current block, comprising: - obtaining a current parameter (px), from said at least N parameters (p0, ..., Pn i ) of the current parameter block; - updating the value of a bit (biPx) of predetermined index of the current parameter (px) as a function of a bit (b0, ..., bN4) of the message (Msg).

2. Digital watermarking method according to claim 1, characterized in that the step of updating the value of a bit (biPx) of predetermined index of the current parameter (px) as a function of a bit (b0, ..., bN4) of the message (Msg) comprises a step of calculating an exclusive or operation between a bit (biR) of a random vector (RbV) of size N and the corresponding bit (biM) of the message (Msg).

3. Digital tattooing method according to claim 1, characterized in that the message (Msg) is in the form of an encrypted code word.

4. Digital tattooing method according to claim 1, characterized in that the step of obtaining (10) the message (Msg) comprises: - a step of obtaining a reference character string; - a step of calculating a cyclic redundancy check code as a function of the reference character string, the cyclic check code being concatenated to the reference character string to form a code word; - a step of encrypting the code word delivering an encrypted code word.

5. Digital watermarking method according to claim 1, characterized in that the step of obtaining (10) the message (Msg) further comprises at least one iteration of a step of copying the encrypted code word within a character string to obtain the message (Msg) of length N bits.

6. Digital watermarking method according to claim 1, characterized in that the step of obtaining (10) the message (Msg) comprises: - a step of randomly selecting, within the current block, a predetermined number K of most significant bits within a predetermined number of parameters of the current block delivering a characteristic binary image; - a first step of combining the characteristic binary image with a reference image (IR), delivering a merged image; - a second step of combining the merged image with a binary image randomly obtained on the basis of a random drawing of K bits, this second combination step delivering the message (Msg).

7. Digital watermarking method according to claim 6, characterized in that the first and second combination steps each implement an exclusive or operation.

8. Electronic device for digital tattooing of a neural network, said neural network being recorded within a data structure comprising parameter blocks, the device comprising, for a current parameter block comprising at least N parameters (p0, .... pXi) representing real numbers, the parameters being chosen from the group consisting of in: layer weights, biases, tensor values, normalization values, and convolution values: - means for obtaining (10) a message (Msg) comprising N bits (b0, ..., bN i); - means for implementing at least N modification iterations (20) of parameters within the current block, comprising: - obtaining a current parameter (px), among said at least N parameters (p0, ..., Pn i ) of the current parameter block; - updating the value of a bit (biPx) of predetermined index of the current parameter (px) as a function of a bit (b0, ..., bN i) of the message (Msg).

9. A computer program comprising software instructions which, when executed by a programmable electronic device, implement a digital watermarking method according to claims 1 to 7.

10. Neural network, recorded within a data structure and saved on a computer-readable medium comprising parameter blocks, the neural network being characterized in that it is watermarked by a digital watermarking method according to claims 1 to 7.

Images