Signing and authenticating digital images and other data arrays

Abstract

A computer-implemented method and system for digitally signing a plurality of predefined digital data arrays is provided. Such a method may provide a secret neural network model trained to classify a plurality of digital data arrays according to the data content of the plurality of arrays. An array of the plurality of arrays may be signed by feeding the array to the secret neural network model to obtain an initial classification result, and applying modifications to the data in the array to change the initial classification result to a predefined secret classification result, the modifications occurring via a backpropagation process in the secret neural network model to progressively modify the array in response to a backpropagation error according to a difference between a current classification result for the array and the secret classification result.

Description

[Technical Field]

[0001] The present disclosure relates generally to signing and authenticating digital images and other digital data arrays, and more particularly to computer-implemented methods, systems, and computer program products for digitally signing data arrays, along with methods for authenticating signed arrays. [Background technology]

[0002] Trust in information is becoming more and more important in the modern world. With the rise of advanced technologies for manipulating data in ways that are difficult to detect, both people and machines can be fooled into misinterpreting information that appears authentic. A prominent example is the trend of digital image manipulation. Photographs and videos can be altered using readily available tools, and the resulting counterfeits can be difficult to identify as such, while showing very different information relative to the original, authentic versions.

[0003] Because counterfeits appear authentic, people may be fooled into simply trusting what they see or hear. Machines, such as AI (artificial intelligence) systems, can also be fooled by manipulating data. For example, so-called adversarial attacks on machine learning models intentionally perturb data, such as digital image data, causing the model to misinterpret the data and, for example, identify an image of a knife as an image of something else. Fraud and more malicious attacks using such techniques can be extremely harmful to society.

[0004] Various techniques have been proposed for authenticating or analyzing data with the goal of preventing or detecting unwanted manipulation. For example, algorithms have been designed to analyze video for subtle inconsistencies, such as alterations or irregular lighting patterns, that indicate manipulation. Cryptographic signatures utilize a PKI (public key infrastructure) to sign message data under the sender's private key, allowing the recipient to authenticate the message using the corresponding public key to verify the signature. Other techniques use blockchains to verify the source of data. Methods are also known for adding some type of watermark to data to indicate authenticity, but watermarks are generally easy to detect and highly susceptible to forgery. Summary of the Invention

[0005] One aspect of the present disclosure is a computer-implemented method for digitally signing multiple arrays of digital data. The method may include providing a secret neural network model trained to classify the multiple arrays according to the data content of the multiple digital data arrays. The method may further include signing an array of the multiple arrays, where the signing is performed by providing the array to the secret neural network model to obtain an initial classification result and applying a modification to the data in the array to change the initial classification result to a predetermined secret classification result, the modification being effected by a backpropagation process in the secret neural network model to progressively modify the array in response to a backpropagation error according to a difference between a current classification result for the array and the secret classification result. The modification may include minimal modification of the data in the array, and the secret neural network model may be trained to classify the multiple arrays according to their image content. The minimal modification may occur via a backpropagation process in the neural network model. The method may also determine whether the signed multiple arrays are authentic or whether they have been modified. This may be accomplished in response to receiving a previously signed array to be authenticated by feeding the array into a secret neural network model to obtain a further classification result, and comparing the further classification result with the secret classification result. If the results match, the array is authentic. If they do not match, this proves that the array has been modified.

[0006] One aspect of the present disclosure is a computer-implemented method for digitally signing predetermined arrays of digital data. The method may provide a secret neural network model, which may be trained to classify the plurality of arrays according to the data content of the plurality of arrays. For an array to be signed, the method may further include feeding the array to the neural network model to obtain an initial classification result, and making minimal modifications to the data in the array to change the initial classification result to a predetermined secret classification result. The minimal modifications may occur via a backpropagation process in the neural network model, whereby the array may be progressively modified in response to a backpropagation error corresponding to a difference between the classification result for the array and the secret classification result.

[0007] Yet another aspect of each of the present disclosures may provide a computer program product including a computing system for digitally signing a plurality of data arrays according to the methods described above, and a computer-readable storage medium embodying program instructions executable by the computing system to cause the computing system to perform such methods.

[0008] Embodiments of the invention are described in more detail below, by way of illustrative and non-limiting example, with reference to the accompanying drawings, in which: [Brief explanation of the drawings]

[0009] [Figure 1] 1 is a schematic representation of a computing system for implementing methods consistent with certain embodiments of the present disclosure. [Figure 2] FIG. 1 illustrates component modules of one embodiment of a computing system for signing multiple data arrays consistent with certain embodiments of the present disclosure. [Figure 3] FIG. 3 illustrates setup operations for a signature process in the system of FIG. 2 consistent with certain embodiments of the present disclosure. [Figure 4] FIG. 10 illustrates the operation of a signature process on a data array, consistent with certain embodiments of the present disclosure. [Figure 5] FIG. 10 illustrates a backpropagation process performed in a signing operation, consistent with some embodiments of the present disclosure. [Figure 6] FIG. 10 illustrates the operation of a backpropagation process consistent with certain embodiments of the present disclosure. [Figure 7] FIG. 3 illustrates operations for authenticating a previously signed array by the system of FIG. 2 consistent with certain embodiments of the present disclosure. [Figure 8] 1 is an image illustrating the operation of a system for digital imaging consistent with some embodiments of the present disclosure. [Figure 9] FIG. 1 illustrates one embodiment of a watermarking technique. [Figure 10] FIG. 10 illustrates the operation of an embodiment for signing a video sequence, consistent with some embodiments of the present disclosure. DETAILED DESCRIPTION OF THE INVENTION

[0010] The present disclosure relates generally to signing and authenticating digital images and other digital data arrays, and more particularly to computer-implemented methods, systems, and computer program products for digitally signing data arrays, as well as methods for authenticating signed arrays. While the present disclosure is not necessarily limited to such applications, various aspects of the present disclosure may be understood through the description of various examples using this context.

[0011] In operation, some embodiments of the present disclosure may use techniques based on the adversarial attacks described above to digitally sign multiple data arrays. Unlike adversarial attacks, these methods may use a secret neural network model, which may be pre-trained to classify multiple data arrays of a particular type to be signed, and a signature may be applied by making only small or minimal modifications to the array data to change the classification result from this model to a predetermined secret result. The resulting modifications may constitute a digital signature that is encoded in the array itself and is unique to the particular array. As with the secret classification result of the signing process, the signature cannot be feasibly forged without access to the model (which is kept secret and therefore known only to authorized parties). Furthermore, signed multiple arrays may be authenticated by re-feeding the array to the secret model and verifying that a secret classification result is obtained. If not, the array has been modified. This technique may therefore provide both authentication of the original data and proof that the data has been modified.

[0012] The signature can be encoded as minimal modifications to the data, resulting from a backpropagation process, to obtain a secret classification result from the model. The backpropagation process can similarly involve an optimization process to optimally modify parameters to achieve a desired result from a neural network (NN) model. In applying this technique to modify data in an input array, the extent of these modifications can be constrained so that a secret classification result can be obtained with only minimal modifications to the data in the array. The signature can therefore be applied without significant change to the data array as a whole with respect to the array's purpose or function. In the case of image data, for example, the signature may be encoded within the image data array without changing how the image is perceived by a human observer or even by an AI process such as another image classification model.

[0013] The neural network model may be constructed and trained to classify specific types of data arrays predetermined for the signature process. Some embodiments may be adapted to sign multiple digital image data arrays. The neural network model may then be trained to classify such multiple arrays according to their image content. The multiple image data arrays may encode independent still images or individual frames of video. In particular, embodiments may be applied to signing digital video sequences, where the multiple data arrays correspond to frames of digital video and the method is performed for each frame of the video sequence. Other embodiments may be adapted to sign multiple digital audio data arrays. The neural network model may then be trained to classify such multiple arrays according to their audio content.

[0014] Consistent with some embodiments, a secret NN model may be trained as a preliminary setup stage of the signing method. Some embodiments may train the NN model using a secret training dataset of multiple data arrays of interest. The secret training dataset may be constructed from a public dataset by selecting and / or modifying training samples to create a unique dataset. This dataset may then be kept secret to enhance the security of the signing process.

[0015] The secret classification result may advantageously be defined with respect to more than one of the possible classes into which the multiple arrays may be classified by the model. In some embodiments, the neural network model may be adapted to output a confidence value for the classification of the array in each of the multiple classes, and the secret classification result may depend on the confidence values ​​for at least two of these classes. By appropriately selecting this combination of classes, the secret classification result may be distinguished from any likely initial classification result for the unsigned array. The use of a combination of confidence values ​​may also enhance the security of the secret result, and therefore the signature process as a whole.

[0016] To limit the global changes to the data array resulting from the signature process, the array may be modified in each of multiple iterations of the backpropagation process by modifying data whose backpropagated errors satisfy a predetermined condition to identify the maximum backpropagated error in that iteration. This may simplify processing and limit the modifications in each iteration to the most important data for achieving the desired result, e.g., the data associated with the maximum backpropagated error defined by the condition described above. The condition may identify backpropagated errors with an absolute value greater than a threshold corresponding to the maximum absolute error value in the iteration. This may provide an adaptive process that adjusts to reduce errors as the backpropagation iterations. Additional techniques for limiting global modifications to the array are described in detail below.

[0017] Methods consistent with the present disclosure may also determine whether signed arrays are authentic or whether they have been modified. This may be accomplished by, in response to receiving a previously signed array to be authenticated, feeding the array to a secret neural network model to obtain a further classification result and comparing the further classification result with the secret classification result. If the results match, the array is authentic. If they do not match, this suggests that the array has been modified. Some embodiments may also employ mechanisms, detailed below, to distinguish previously signed arrays from arrays that have never been signed. Embodiments of the present disclosure may be implemented as a system, method, or computer program product, or a combination thereof. The computer program product may include a computer-readable storage medium having computer-readable program instructions thereon for causing a processor to perform aspects of the present disclosure.

[0018] A computer-readable storage medium may be a tangible device capable of retaining and storing instructions for use by an instruction execution device. A computer-readable storage medium may be, for example, but not limited to, an electronic storage device, a magnetic storage device, an optical storage device, an electromagnetic storage device, a semiconductor storage device, or any suitable combination of the foregoing. A non-exhaustive list of more specific examples of computer-readable storage media includes portable computer diskettes, hard disks, random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM or Flash memory), static random access memory (SRAM), portable compact disk read-only memory (CD-ROM), digital versatile disk (DVD), memory stick, floppy disk, punch cards, or mechanically encoded devices such as ridge structures in grooves that allow instructions to be recorded thereon, and any suitable combination of the foregoing. As used herein, computer-readable storage media should not be construed to include ephemeral signals per se, such as radio waves or other freely propagating electromagnetic waves, electromagnetic waves propagating through a waveguide or other transmission medium (e.g., light pulses passing through fiber optic cable), or electrical signals transmitted through electrical wires.

[0019] The computer-readable program instructions described herein may be downloaded from a computer-readable storage medium to each computing / processing device or to an external computer or external storage device via a network, such as the Internet, a local area network, a wide area network, or a wireless network, or a combination thereof. The network may include copper transmission cables, fiber optic transmissions, wireless transmissions, routers, firewalls, switches, gateway computers, or edge servers, or a combination thereof. A network adapter card or network interface within each computing / processing device receives the computer-readable program instructions from the network and forwards the computer-readable program instructions for storage in a computer-readable storage medium within the respective computing / processing device.

[0020] Computer-readable program instructions for carrying out the operations of the present disclosure may be either source code or object code written in any combination of one or more programming languages, including assembler instructions, instruction set architecture (ISA) instructions, machine instructions, machine-dependent instructions, microcode, firmware instructions, state-setting data, or object-oriented programming languages ​​such as Smalltalk®, C++, and traditional procedural programming languages ​​such as the "C" programming language or similar programming languages. The computer-readable program instructions may execute entirely on the user's computer, partially on the user's computer, as a standalone software package, partially on the user's computer and partially on a remote computer, or entirely on a remote computer or server. In the latter scenario, the remote computer may be connected to the user's computer through any type of network, including a local area network (LAN) or a wide area network (WAN), or the connection may be to an external computer (e.g., through the Internet using an Internet Service Provider). In some embodiments, electronic circuitry including, for example, a programmable logic circuit, a field programmable gate array (FPGA), or a programmable logic array (PLA) may execute computer-readable program instructions by utilizing state information of the computer-readable program instructions to individualize the electronic circuitry to perform aspects of the present disclosure.

[0021] Aspects of the present disclosure are described herein with reference to flowchart illustrations and / or block diagrams of methods, apparatus (systems), and computer program products according to embodiments of the present disclosure. It will be understood that each block of the flowchart illustrations and / or block diagrams, and combinations of blocks in the flowchart illustrations and / or block diagrams, can be implemented by computer-readable program instructions.

[0022] These computer-readable program instructions may be provided to a processor of a general-purpose computer, a special-purpose computer, or other programmable data processing apparatus to manufacture a machine, such that the instructions, executed by the processor of the computer or other programmable data processing apparatus, cause the processor to perform the functions / acts specified in one or more blocks of the flowcharts and / or block diagrams. These computer-readable program instructions may also be stored on a computer-readable storage medium that may instruct a computer, programmable data processing apparatus, or other device, or combination thereof, to function in a particular manner, such that the computer-readable storage medium having instructions stored therein may include an article of manufacture including instructions that implement aspects of the functions / acts specified in one or more blocks of the flowcharts and / or block diagrams.

[0023] Computer readable program instructions may also be loaded onto a computer, other programmable data processing apparatus, or other device to cause the computer, other programmable apparatus, or other device to perform a series of operations to create a computer-implemented process, such that the instructions executing on the computer, other programmable apparatus, or other device perform the functions / acts / operations specified in one or more blocks of the flowchart and / or block diagram.

[0024] The flowcharts and block diagrams in the figures illustrate the architecture, functionality, and operation of possible implementations of systems, methods, and computer program products according to various embodiments of the present disclosure. In this regard, each block in a flowchart or block diagram may represent a module, segment, or portion of instructions, which may include one or more executable instructions for implementing the specified logical function(s). In some alternative implementations, the functions noted in the blocks may occur out of the order noted in the figures. For example, two blocks shown in succession may, in fact, be executed substantially concurrently, or the blocks may sometimes be executed in the reverse order, depending on the functionality involved. It should also be noted that each block of the block diagrams and / or flowchart diagrams, and combinations of blocks in the block diagrams and / or flowchart diagrams, may be implemented by a dedicated hardware-based system that performs the specified functions or acts or executes a combination of dedicated hardware and computer instructions.

[0025] Some embodiments may be implemented as a computer-implemented method for digitally signing multiple data arrays. Such a method may be implemented by a computing system including one or more general-purpose or special-purpose computers, each of which may include one or more machines (real or virtual) and provide the functionality to perform the operations described herein. Operations of methods embodying the present disclosure may be performed by program instructions, e.g., program modules, executed by the system's processor. Generally, program modules may include routines, programs, objects, components, logic, data structures, etc., that perform particular tasks or implement particular abstract data types. The computing system may be implemented in a distributed computing environment, such as a cloud computing environment, where tasks may be performed by remote processing devices linked through a communications network. In a distributed computing environment, program modules may be located in both local and remote computer system storage media, including memory storage devices.

[0026] 1 is a block diagram of an example computing device for implementing methods consistent with some embodiments of the present disclosure. The computing device of FIG. 1 is shown in the form of a general-purpose computer 1. Components of computer 1 may include a processing unit (e.g., one or more processors represented by processing unit 2), system memory 3, and a bus 4 that couples various system components, including system memory 3, to processing unit 2.

[0027] Bus 4 represents any one or more of several types of bus structures, including a memory bus or memory controller, a peripheral bus, a high-speed graphics port, and a processor or local bus using any of a variety of bus architectures. By way of example and not limitation, such architectures include the Industry Standard Architecture (ISA) bus, the Micro Channel Architecture (MCA) bus, the Enhanced ISA (EISA) bus, the Video Electronics Standards Association (VESA) local bus, and the Peripheral Component Interconnect (PCI) bus.

[0028] Computer 1 may include a variety of computer-readable media. Such media may be any available media accessible by computer 1, including volatile and nonvolatile media, and removable and non-removable media. For example, system memory 3 may include computer-readable media in the form of volatile memory, such as random access memory (RAM) 5 and / or cache memory 6. Computer 1 may also include other removable / non-removable, volatile / non-volatile computer system storage media. By way of example only, storage system 7 may be provided for reading from and writing to non-removable, non-volatile magnetic media (commonly referred to as a "hard drive"). Although not shown, a magnetic disk drive for reading from and writing to removable non-volatile magnetic disks (e.g., "floppy disks") and an optical disk drive for reading from or writing to removable non-volatile optical disks, such as CD-ROMs, DVD-ROMs, or other optical media, may also be provided. In such cases, each may be connected to bus 4 by one or more data media interfaces.

[0029] The memory 3 may include at least one program product having one or more program modules that may be configured to perform some functions of embodiments of the present disclosure. By way of example, a program / utility 8 having a set (at least one) of program modules 9 may be stored in the memory 3, as well as an operating system, one or more application programs, other program modules, and program data. One or more of the operating system, one or more application programs, other program modules, and program data, or some combination thereof, may comprise an embodiment of a networking environment. The program modules 9 generally perform the functions and / or methodologies of embodiments of the present disclosure as described herein.

[0030] Computer 1 may also communicate with one or more external devices 10, such as a keyboard, pointing device, display 11, one or more devices that allow a user to interact with computer 1, or any device (e.g., a network card, modem, etc.) that allows computer 1 to communicate with one or more other computing devices, or a combination thereof. Such communication may occur via input / output (I / O) interface 12. Additionally, computer 1 may communicate with one or more networks, such as a local area network (LAN), a general wide area network (WAN), or a public network (e.g., the Internet), or a combination thereof, via network adapter 13. As shown, network adapter 13 communicates with other components of computer 1 via bus 4. Computer 1 may also communicate with additional processing units 14, such as one or more GPUs (graphics processing units), FPGAs, or integrated circuits (ICs), that implement embodiments of the present disclosure. It should be understood that other hardware and / or software components may be used in conjunction with computer 1. Examples include, but are not limited to, microcode, device drivers, redundant processing units, external disk drive arrays, RAID systems, tape drives, and data archive storage systems.

[0031] The schematic diagram of FIG. 2 illustrates component modules of an example computing system for signing / authenticating multiple digital data arrays consistent with some embodiments of the present disclosure. Computing system 20 may include memory 21 and control logic, generally designated 22, which may include functionality for authenticating multiple data arrays by digitally signing the multiple arrays and further checking the authenticity of the signed multiple arrays. Control logic 22 may include a training module 23, an inference module 24, a signing module 25, and a verification module 26. Training module 23 may include functionality for training a neural network model to classify multiple digital data arrays. Inference module 24 may provide functionality for performing inference (classification) operations using the model. Signature module 25 may implement a signature process for inserting digital signatures into data arrays, and verification module 26 may provide functionality for testing the authenticity of the signed multiple arrays. Logic modules 23-26 may interface with memory 21, which may store various data structures used in the operation of system 20. These data structures may include parameters for a private NN model 28, which may be trained by training module 23 using a private training data set 29 and a private "key" 30 for the signing process. This key is obtained from the inference operation of model 28 on multiple signed data arrays, c s The memory 21 may also store a data array (denoted x) 31 that may be input to the signature process, as well as a modified array 32 that may be produced from the input array x in successive stages of the signature process.

[0032] In general, the functions of logic modules 23-26 and NN model 28 may be implemented in software (e.g., program modules) or hardware, or a combination thereof. The described functions may be allocated differently among system modules in other embodiments, and the functions of one or more modules may be combined. While NN model embodiments may be implemented entirely in software, other neural network embodiments may be implemented (wholly or partially) in hardware. Some NN models may utilize a logic structure in which a series of layers of neurons are interconnected such that the output signals of neurons in one layer are weighted and transmitted to neurons in the next layer. Some implementations of neurons and synapses (which may store network weights) may include circuitry that utilizes the memristive properties of nanodevices, such as resistive memory cells, e.g., phase-change memory (PCM) cells and resistive random access memory (RRAM or ReRAM) cells. A dense crossbar array of multiple such memristive devices may, in some embodiments, provide a massively parallel and highly area- and energy-efficient neural network. Neural network architectures may employ, for example, dedicated integrated circuits providing multiple resistive memory arrays for storing network weights or FPGAs for configuring the functional components of the network, or both.

[0033] The component modules of computing system 20 may be provided in one or more computers of the computing system. For example, all modules may be provided in computer 1, or the modules may be provided in one or more computers / servers of the computing system to which users can connect via a network for input of multiple data arrays to be processed. Such a network may generally include one or more component networks or an internetwork, including the Internet, or both. System memory 21 may be embodied by one or more memory / storage components associated with one or more computers of system 20.

[0034] FIG. 3 illustrates preliminary setup operations consistent with some embodiments. Operation 35 represents providing in system memory 21 a secret training dataset 29. This dataset includes a set of labeled training samples. Each sample may include an example of a particular type of data array to be signed by system 20, along with the corresponding classification result (label) obtained for that example. This dataset may be constructed from scratch by matching and labeling a set of training samples. However, dataset 29 may also be conveniently constructed from any publicly available dataset of multiple data arrays of interest (e.g., digital images). The training dataset may be made unique by selecting a subset of samples from a public dataset, e.g., by removing some samples and / or classes. The training samples may also be modified to include some errors, such as incorrect labels, or supplemented with additional samples, or both. One feature and advantage of these operations is that they build a unique dataset and / or a dataset that does not represent the class distribution of the public dataset, enhancing the security of the signature system. The resulting training dataset 29 may then be stored in system memory 21.

[0035] In operation 36, the NN model 28 may be trained by the training module 23 using a training data set 29. In general, any NN classification model may be employed as the model 28, with the model architecture appropriately constructed to accommodate the training samples of interest. In some embodiments, the model is trained using data values ​​in an array x of L such values ​​(herein referred to as x i , i=1 to L), and the model output can be adapted to provide classification results for the classes represented in the training set. For example, a classification network for digital images may include a network for receiving the pixel x of a digital image in a given image format. i An input layer may be provided for receiving the input signal. The NN model may include a simple feedforward network structure with two or more layers, or may include a more complex structure, such as a convolutional layer. However, other model architectures for a given application are also within the scope of this disclosure. As merely illustrative examples, the NN model 28 may be based on a feedforward architecture, or may be based on a ResNet-50, VGG16, or InceptionV3 network architecture. To train complex models such as a ResNet-50 model, the training module 23 may utilize a cloud-based supercomputer (e.g., via a private cloud, with appropriate security measures), allowing such models to be trained within minutes and at minimal cost.

[0036] The training module 23 may train the NN model 28 in operation 36. In some embodiments, the network weights may be trained by an iterative process, where the network is fed successive training samples and the weights may be iteratively updated based on the difference between the network output and the target output (label) for the training samples. In this process, error may be backpropagated through the network, and the weights may be incrementally updated based on the backpropagated error to optimize network operation. The weights may thus be progressively updated until a convergence condition, e.g., a desired accuracy, is achieved. One or more subsets of the training dataset 29 may be reserved as a validation / test set, which may be used by the inference module 24 to quantify model performance at various stages of the training operation, and model parameters may be adjusted as necessary to achieve the desired accuracy. The resulting trained model, with its optimized weights, may then be applied for inference to classify new (previously unseen) input data.

[0037] In operation 37 of the setup procedure, the secret key (secret classification result) c s can be selected and stored for the signature system. s may, for example, define the required output of the model 28 after the signing process for a data array when the model is applied for inference on a signed array. For this result to differ from any likely initial result for an unsigned array, c s may be conveniently defined in terms of the combinations of possible classes into which the model can classify multiple arrays. The NN classification model in some embodiments may also provide some form of confidence value, e.g., as a probability or percentage, for the classification of the input in each of the possible classes. By defining the confidential classification result as a function of the confidence values ​​for at least two classes, the confidential result may be based on unlikely class combinations. As a simple example, c smay require that two very different classes are the majority classes, or that the confidence values ​​for these classes exceed a certain threshold, or both. s Another example of the confidence values ​​c1 and c2 for the two (predetermined) majority classes may be such that (c1 + c2) exceeds a first threshold, e.g., 0.7, and |c1 - c2| is less than a second threshold, e.g., 0.1. s can be defined in terms of any desired function of one or more confidence values ​​chosen to distinguish between classification results for signed and unsigned arrays. s may be selected by an operator or automatically selected as an unlikely outcome based on processing of training samples. The selected key may be stored in system memory 21 at 30, and system 20 is then ready to sign multiple data arrays.

[0038] 4 illustrates the basic operations of a signature process consistent with some embodiments. Operation 40 represents receipt by control logic 22 of a data array x to be signed. In operation 41, signature module 25 provides array x to model 28, which computes c for the array. x In operation 42, the signature module makes only small, or minimal, modifications to the data in array x to obtain the initial classification result c x The secret classification result c s This at least minimal modification may occur via a backpropagation process in the NN model, where the array is modified by comparing the classification results for the array with the secret classification result c s It may be progressively corrected in response to the backpropagation error depending on the difference between x s The resulting signed array, denoted by {circle around (x)}, may be output by the system 20 in operation 43.

[0039] The backpropagation process in act 42 is described in more detail below. Backpropagation may be used to optimize network weights during training. Simply put, backpropagation is an iterative process in which errors may be calculated based on the difference between actual network outputs and target network outputs. These errors may be backpropagated through the network from layer to layer, from the output layer to the input layer, to determine the error at the input to each layer. The backpropagated errors may then be used to calculate updates to parameters (usually network weights) via an optimization algorithm, for example, a gradient descent method such as stochastic gradient descent.

[0040] One embodiment of a backpropagation process for a signature operation is shown schematically in FIG. 5, where NN model 28 is shown as a simple forward propagation network with three layers L1-L3. Connections between network layers are shown schematically in the drawing with dashed lines. These connections may relay signals between neurons in successive layers, and these signals may be weighted by the network's respective weights, w. The weights between successive network layers are defined by weight matrices, which are denoted W1 and W2 for the illustrated three-layer network. Data values ​​x1-x L An input array x containing an array of σ may be fed into input layer L1, which may then propagate weighted signals through the network to output layer L3. In this example, the output signals of layer L3 are converted by SoftMax layer σ into a set of confidence values, one for each possible class. This set of confidence values ​​is used to calculate the initial classification result c for the input array x. x may be provided.

[0041] As indicated by block 45, the signature module 25 generates the result c x The secret result c s, and a matrix of errors, denoted δ3, associated with each input signal to layer L3 may be calculated. These errors may then be backpropagated to calculate corresponding errors, denoted δ2 and δ1, at the inputs to layers L2 and L1, respectively. When backpropagation is applied to optimize the network weights of a classification model during training, the backpropagated error δ may be calculated as the gradient of a loss function (based on the difference between the actual classification result and the target classification result) with respect to the weights associated with each layer, and the error δ may then be used to calculate an update Δw for each weight w. However, in some embodiments, the network weights may remain fixed for the signing process, and gradients may be calculated with respect to the input signals at each network layer. The backpropagated errors δ3-δ1 in FIG. 5 are calculated with respect to the input signals c x and c s δ may be calculated as the gradient of the loss function as a function of the difference between each data value x in the input array x and i As indicated by block 46, the signature module then defines the associated error δ i Depending on the corresponding data value x i Correction Δx to i The array may then be calculated as a data value x i (x i +Δx i ), and the process may then be repeated for the modified array.

[0042] The backpropagation process in Figure 5 produces the classification result c for the modified array. x is c s The extent to which the array is modified during this process may be constrained in various ways, and in some embodiments the ultimate goal is to achieve a classification result of c with only small, or minimal, global changes to the data in the array. s For example, the loss function may be used to calculate the gradient (error δ), and thus the correction Δx iis the actual classification result c x and target classification result c s , and the overall change in the array resulting from the modification. x -c s ), and the corrected and original data values ​​x i may be defined as a function F of the sum of the absolute differences of

number

[0043] 6 illustrates the operation of a backpropagation process that employs another technique for suppressing modifications, consistent with some embodiments. In operation 50, an array x may be fed to the model, and in operation 51, a classification result c x is c s may be compared with c x is c s If it does not match, then the error may be backpropagated in operation 52 as described above. In operation 53, the signature module calculates the maximum backpropagated error δ for the current iteration. i In this embodiment, the signature module may identify the maximum absolute error value |δ in the iterations. max Error δ having an absolute value greater than the threshold depending on | i For example, |δ i |>|δ max The error δ, which is 80% of | ican now be selected. In operation 54, the signature module then calculates the selected maximum error δ i The data value x associated with i Correction Δx i Then, in operation 55, these data values ​​x i (x i +Δx i ) where the array can be modified. For example, the modification is i =-ηδ i x i where η is a predetermined learning parameter for the network, e.g., η=0.01. Following operation 55, operation 56 is an optional additional operation that is performed in embodiments detailed below, and the operation may return to operation 50 for the modified array. Thus, the process begins in operation 51 with c x =c s It may be repeated until c x =c s Then, in operation 57, the signed array x s may be output.

[0044] Similarly to simplifying the process, operations 53 and 54 in Figure 6 may constrain changes to the array by limiting modifications to the most significant data associated with the largest backpropagation error in each iteration, thereby limiting the overall change to the original input array x. This process may also adapt to changing the magnitude of the error over successive iterations. However, various other conditions may be envisioned for identifying the largest error. For example, for some predefined value n, the n largest errors may be selected in each iteration.

[0045] In operation 54 of Figure 6, modifications to the data in the array may be subject to further constraints on the changes to the array resulting from the modifications. Such constraints may be imposed on the individual data values ​​x iThe maximum change to L may be limited. For example, the L-infinity bound of the modification may be limited to a very small value, such as 0.05 (or even smaller), at each iteration. The constraint here may, of course, be based on other metrics, such as the mean squared error (MSE) or peak signal-to-noise ratio (PSNR) of the modification. Additionally, one or a combination of the various techniques described above may be used to ensure small or minimal overall changes in the array due to the signing process.

[0046] System 20 may also determine whether multiple data arrays previously signed by the system are authentic or have been modified since signing. The operations of one embodiment of this authentication method performed by verification module 26 are shown in Figure 7. Operation 60 represents receipt by the system of a previously signed array to be authenticated. In operation 61, verification module 26 then y The array may be fed to model 28 to obtain a further classification result for the array, denoted by c. In operation 62, the verification module compares this result c to determine whether the array is authentic. y The secret classification result c s It can be compared with y =c s If so, then the array has not been modified and accordingly in operation 63 the system may provide an output confirming that the array is authentic. y ≠c s If so, this proves that the array has been modified since it was signed. In operation 64, the system may then provide an output warning that the array has been modified.

[0047] An example implementation of one embodiment of the signature system is described in detail below. This embodiment was applied to signing digital images, particularly photos of everyday life. The secret training dataset for this embodiment was generated from the Visual Genome dataset. The Visual Genome dataset is a public dataset of over 100,000 images with over 80,000 labels, and as of the filing date of this disclosure, is available for download under the Creative Commons Attribution 4.0 (CC BY4.0) license at https: / / visualgenome.org. The training dataset was made unique by removing 60% of the images (images were intentionally removed to ensure a unique class distribution in the training dataset). More than half of the original images were removed with the goal of achieving a trained model on which the adversarial signature process could be performed without excessive image processing, i.e., to reduce the backpropagation required to change the inference result to the desired secret result. The training dataset was further divided into a training set, a validation set, and a test set.

[0048] A ResNet-50 network was trained using the data prepared above, and hyperparameters / architecture were modified until model performance, as measured here by F1 score, achieved F1 > 0.7. Specifically, the validation set was used for inference to quantify performance after training the network weights on successive batches of training samples until an F1 score of F1 > 0.7 was achieved on the validation set. Hyperparameters (e.g., neuron activation function) and architecture (e.g., number of neurons and interconnections) were adjusted as needed during this process. Further hyperparameter / architecture adjustments were then made as needed to obtain F1 > 0.7 on the test set, and performance on the test set was assessed.

[0049] private key c sFor the class combinations used in, the labels “carpet oriental” and “information sticker” were selected from the labels in the training dataset. In particular, the confidential classification results c s was defined to require "oriental carpet" and "information sticker" as the two majority classes (highest confidence values) in the inference results for the signed image. The model was then applied to sign an image, as illustrated below.

[0050] A new image to be signed was passed through the network, which output two majority classes, "open bag" and "oriental carpet," with confidence values ​​of 0.05 and 0.02, respectively. The backpropagation process described above was first applied to correct the image and obtain "oriental carpet" as the majority class. At each iteration of the backpropagation operation, the pixel corresponding to the maximum backpropagation error, here |δ, was selected to ensure that the majority of pixels were uncorrected. i |>|δ max Pixel x that is 80% of | i Only the result c s The backpropagation process was repeated for the class "information stickers" until {circumflex over (x)} was achieved, i.e., until two majority classes were required. This gave the signed image.

[0051] In the training example above, an F1 score of F1 > 0.7 was used, but this threshold may be selected as desired, depending, for example, on the choice of network architecture and the complexity of the training dataset. The simpler the architecture and the more complex the dataset, the lower the threshold may be appropriate. Other performance criteria besides F1 score, such as accuracy or some other function of precision and recall, may also be employed. Additionally, a weaker (lower performing) model may favor the ease of adversarial signatures, while a stronger (or even overfitting) model may increase the complexity of digital signatures and thus enhance the security of the signature system. The tradeoffs between these issues may be balanced as desired for a given application.

[0052] To show the effect of a signature on a signed image, Figures 8(a)-8(d) provide an illustrative example. This figure illustrates the operation of a simple embodiment in which the confidential classification result required a single class, "garbage truck," to be the majority class for the signed image. Figure 8(a) shows the input image from which the correct initial classification result, "church," was obtained from the model. Figure 8(b) shows a (scaled and normalized) representation of the signature applied to this image. Black pixels in this representation indicate no modification to the corresponding image pixels. Modified pixels are shown here in grayscale (reflecting the color pattern in the actual example) and are significantly exaggerated for visualization purposes. (The true signature would appear completely black in this image, corresponding to imperceptible (to humans) undesired noise.) Figure 8(c) shows a signed image that appears unchanged but provided the required inference result, "garbage truck," from the model. When this signed image was modified with a small additional text highlighted by the dashed box in Figure 8(d), the model again output the correct inference for the image: "Church." By applying a visually imperceptible noise pattern as a distinct signature in the input image, the signature can be used to distinguish between modified and unmodified images. The original images in Figures 8(a)-8(d) are color images, shown here as black-and-white line drawings.

[0053] Some embodiments may also include a method and / or mechanism for determining whether an image presented to the verification module 26 for authentication has previously been signed by the system. An unsigned image is indistinguishable from a previously signed but modified image. In some embodiments, the signature module may maintain a register of signed arrays in system memory 21. The signature module may store an array identifier associated with each array signed by the system in this register to enable subsequent identification of signed arrays. For example, the identifier provided with the image to be signed may be stored along with a supplier identifier, e.g., upload location. Other systems may use watermarking techniques to identify signed arrays. Here, as part of the signing process, the signature module may modify a subset of the data in the array in a predetermined manner to apply a watermark to the array. Figure 9 illustrates a watermarking process for an image (here, a plain gray image for simplicity) consistent with some embodiments. This process may add a localized pattern at a predetermined location within the image, e.g., over a 10x10 pixel area at that location. Pixel values ​​within this region may be modified based on some predefined mathematical formula relative to the original pixel values ​​within this region. In the simple example shown in Figure 9, the value of the center pixel in a 5x1 region may be determined, and neighboring pixels may then be modified as a function of this pixel value. Such watermarks may be provided at multiple image locations as needed. The verification module may then analyze the received image for the presence of the watermark to distinguish signed from unsigned images. The original image in Figure 9 is a color image, shown herein as a black and white line drawing.

[0054] Watermarking may be performed as a final step after signing the image. In some embodiments, the watermark may be removed by reversing the original watermarking process before authenticating the signed image. Some embodiments may therefore incorporate the watermarking process into the backpropagation process. Advantageously, as shown by operation 56 in FIG. 6, the watermark may be applied after each update to array x in an iteration of the backpropagation process. This may allow the watermark to be imposed as part of the signing process itself, such that the signed array contains a detectable watermark that does not need to be removed before authenticating the array.

[0055] While the above examples focus on still images, some embodiments of the present disclosure may be applied to other types of data, including video and audio data. FIG. 10 illustrates a method for signing a video sequence, consistent with some embodiments. In this embodiment, a neural network model may be trained on still images as described above. At operation 70, an input video sequence is stored. At operation 71, signature module 25 may select the first frame of the sequence. This frame may be signed at operation 72 in the same manner as for still images described above. Operation 73 may check for additional frames to be signed, in which case a next frame may be selected at operation 74, and the operations may be repeated. The method may then be repeated until all frames have been signed at determining operation 73. The signed video is then output at operation 75.

[0056] Some embodiments may employ aspects of the present disclosure to sign audio data. In these embodiments, a neural network model may be trained on audio snippets, e.g., arrays containing a specific number of bytes of audio data. The training samples here may have various labels appropriate to the audio samples, such as pop music, classical music, male or female vocals, instrument type, electronic or acoustic, tempo, sound, etc. An input audio sequence may be signed by constructing one or more arrays from consecutive snippets in the sequence corresponding to the audio snippets used for training and similarly signing each snippet.

[0057] While the model used in the signature process described above may be adapted to a particular type of data array, e.g., input of a particular data format, the domain of the training samples for the neural network model need not correspond to the domain of the arrays to be signed. For example, a particular type of image content in a training dataset of images does not limit the image content of images that can be signed by the system. Also, while the above examples focus on digital media (image, video, and audio) data, some embodiments may apply to other types of data, such as data coming from sensors such as optical photodiodes or signals in other wavelength domains, and structured data. The training labels in these embodiments may be quantities specific to a particular object or dataset. In general, the data arrays may contain any set of data values ​​that define the data entity to be signed.

[0058] The technology may be implemented, for example, as a cloud-based signature service. Such a service may be used by social media companies, allowing their users to have their digital media (image / video / audio) files certified and certified as a "trusted source" before uploading and publishing, in exchange for a fee. Media companies may also use the system to create trusted publications (e.g., newspapers) where all content is certified as a trusted source, or to help ensure the authenticity of material submitted by freelance correspondents or contributors. Publishers may then claim and certify that content information is trustworthy. This may also provide a basis for collecting and analyzing statistics across different data sources (e.g., a particular newspaper or other publication) and provide a measure of a publication's "trustworthiness" (e.g., X% of publications from publisher Y are signed using the method and / or system described above).

[0059] Advantageously, some embodiments may provide an elegant and efficient technique for digitally signing multiple data arrays and for verifying whether such arrays are authentic (e.g., unmodified). Additionally, various alternatives and modifications may be made to the described embodiments. By way of example, in some embodiments, a secret NN model may be trained outside of system 20 and then stored within the system for use in the signature process. The model training function may then be omitted from such embodiments.

[0060] In general, where features are described in this specification with reference to a method embodying the present disclosure, the corresponding features may also be provided in a system / computer program product embodying the present disclosure, and vice versa.

[0061] The description of various embodiments of the present disclosure is presented for purposes of illustration and is not intended to be exhaustive or limited to the disclosed embodiments. Many modifications and variations will be apparent to those skilled in the art without departing from the scope of the described embodiments. The terminology used herein has been selected to best explain the principles of the embodiments, practical applications, or technical improvements to technology found in the market, or to enable others skilled in the art to understand the embodiments disclosed herein.

Claims

1. 1. A method for digitally signing a plurality of digital data arrays by computer processing, comprising: providing a secret neural network model trained to classify a plurality of digital data arrays according to their data content; signing an array of said plurality of arrays; and the signature comprises: feeding the array to the secret neural network model to obtain an initial classification result; and applying a modification to the data in the array to change the initial classification result to a predetermined secret classification result, the modification occurring via a backpropagation process in the secret neural network model to progressively modify the array in response to a backpropagation error that is responsive to a difference between a current classification result for the array and the secret classification result; A method carried out by

2. The method of claim 1 , wherein the modification comprises minimal modification of data in the arrays, and the covert neural network model is trained to classify the plurality of arrays according to their image content.

3. The plurality of arrays correspond to frames of digital video, and the method comprises, for each frame of the digital video: feeding the corresponding array to the covert neural network model to obtain an initial classification result for the frame; applying the minimal modification to the data in the array to change the initial classification result for the frame to the confidential classification result; The method of claim 2 further comprising:

4. The method of claim 1 , wherein the covert neural network model is trained to classify the plurality of arrays according to their audio content.

5. 10. The method of claim 1, further comprising training the covert neural network model using a covert training data set of the plurality of arrays.

6. the secret neural network model is adapted to output a confidence value for the classification of the array in each of a plurality of classes; The method of claim 1 , wherein the confidential classification result depends on the confidence values ​​for at least two of the classes.

7. 2. The method of claim 1, further comprising: iterating the backpropagation process, wherein in each of a plurality of iterations of the backpropagation process, the array is modified by modifying data where the backpropagation error satisfies a predetermined condition for identifying one or more maximum backpropagation errors in the iteration.

8. The method of claim 7 , wherein the predetermined condition identifies backpropagated errors having an absolute value greater than a threshold corresponding to a maximum absolute error value in the iteration.

9. 2. The method of claim 1, further comprising: iterating the backpropagation process, wherein in each of a plurality of iterations of the backpropagation process, a correction to the data in the array is calculated to relax a loss function that is responsive to the difference and an overall change in the array resulting from the correction.

10. 2. The method of claim 1, further comprising: repeating the backpropagation process, wherein in each of a plurality of iterations of the backpropagation process, modifications to data in the array are subject to constraints on changes to the array resulting from the modifications.

11. In response to receiving a previously signed array to be authenticated, feeding the previously signed array to the private neural network model to obtain a further classification result; comparing the further classification result with the secret classification result to determine whether the previously signed array is authentic; The method of claim 1 further comprising:

12. The method of claim 1 further comprising modifying a subset of data in the array in a predetermined manner to apply a watermark to the array.

13. The method of claim 12 , further comprising modifying the subset to apply the watermark after each of multiple iterations of the backpropagation process.

14. 10. The method of claim 1, further comprising storing an array identifier associated with each array signed by said method to enable subsequent identification of multiple arrays that have been signed.

15. A computer program for causing a computer to execute the method according to any one of claims 1 to 14.

16. A computer-readable recording medium having the computer program according to claim 15 recorded thereon.

17. 1. A computing system for digitally signing a plurality of predetermined digital data arrays, the system comprising: a secret neural network model trained to classify the predetermined plurality of arrays according to the data content of the plurality of arrays; control logic for an array to be signed, feeding the array to the secret neural network model to obtain an initial classification result, and modifying data in the array to change the initial classification result to a predetermined secret classification result, the control logic being adapted to cause the modification to occur via a backpropagation process in the secret neural network model to progressively modify the array in response to a backpropagation error that is responsive to a difference between a current classification result for the array and the secret classification result; A computing system comprising:

Images