System and method for verifying initial parameters used for training a machine learning model and system and method for providing information on parameters for a machine learning model

Abstract

An example of a system comprises one or more processors and one or more storage devices, wherein the system is configured to receive information on a trained machine learning model comprising a set of trained parameters, generate a set of intermediate parameters based on the set of trained parameters and a set of initial parameters, initialize the machine learning model based on the set of intermediate parameters stored by the one or more storage devices to obtain an intermediate machine learning model, determine performance information by the one or more processors based on an application of the intermediate machine learning model to model input data, and provide output information indicating whether the initial parameters were the original parameters used to initialize the machine learning model for training based on the performance information.

Description

[0001] System and method for verifying initial parameters used for training a machine learning model and system and method for providing information on parameters for a machine learning model

[0002] Technical field

[0003] Examples relate to the assessment of initialization parameters used for machine learning models.

[0004] Background

[0005] In today's dynamic business environment, machine learning models (ML models) have become an indispensable tool. These models enable companies to make more accurate predictions, optimize processes, and gain competitive advantages. Given their high value, it is crucial to clearly establish ownership of these ML models or proving theft and detect changes made to them.

[0006] It is an important technical task to verify ownership and detect theft of neural networks. As neural network type models are becoming an increasingly valuable asset for many companies, given the time and money involved in obtaining / curating training datasets and the computing power used in training them, there are many approaches regarding the watermarking of neural networks to discourage theft. These watermarks can be used to prove ownership and additionally be used to detect networks which have been stolen.

[0007] All of these methods require some sort of protection to keep the watermark hidden. This makes it easy to forge a watermark onto the network. Additionally other methods can also be subject to so-called ambiguity attacks, where an adversary can show the presence of their own watermark on the network, thus causing confusion over ownership.

[0008] Summary An example relates to a system comprising one or more processors and one or more storage devices. The system is configured to receive information on a trained machine learning model comprising a set of trained parameters and generate a set of intermediate parameters based on the set of trained parameters and a set of initial parameters. Further, the system is configured to initialize the machine learning model based on the set of intermediate parameters stored by the one or more storage devices to obtain an intermediate machine learning model. Additionally, the system is configured to determine performance information by the one or more processors based on an application of the intermediate machine learning model to model input data and provide output information indicating whether the initial parameters were the original parameters used to initialize the machine learning model for training based on the performance information.

[0009] The original parameters used to initialize the machine learning model for training may show a better performance when moving from the original parameters towards the trained parameters than other initial parameters. By determining a performance information for intermediate parameters between initial parameters and the trained parameters, it may be possible to determine whether the initial parameters were the original parameters used to initialize the machine learning model for training. By verifying that the initial parameters were the original parameters, it may be possible to verify the ownership or prove theft of the trained machine learning model. Additionally or alternatively, a modification of the trained machine learning model may be detected if it is determined that the initial parameters were not the original parameters, although the original parameters were used as initial parameters. In this way, theft of the trained machine learning model and / or unauthorized or undesired modification of the trained machine learning model may be detected. Additionally or alternatively, the authenticity of the trained machine learning model can be verified or ensured.

[0010] Some examples relate to a system comprising one or more processors and one or more storage devices. The system is configured to receive information on a trained machine learning model comprising a set of trained parameters and receive a first set of initial parameters or a first seed used to generate the first set of initial parameters from a first party and a second set of initial parameters or a second seed used to generate the second set of initial parameters from a second party. Further, the system is configured to generate a first set of intermediate parameters based on the set of trained parameters and the first set of initial parameters and initialize the machine learning model based on the first set of intermediate parameters stored by the one or more storage devices to obtain a first intermediate machine learning model. Additionally, the system is configured to determine first performance information by the one or more processors based on an application of the first intermediate machine learning model to model input data and generate a second set of intermediate parameters based on the set of trained parameters and the second set of initial parameters. Furthermore, the system is configured to initialize the machine learning model based on the second set of intermediate parameters stored by the one or more storage devices to obtain a second intermediate machine learning model and determine second performance information by the one or more processors based on an application of the second intermediate machine learning model to the model input data. Additionally, the system is configured to compare the first performance information and the second performance information and, based on the comparison, provide output information indicating whether it is more likely that the first set of initial parameters or the second set of initial parameters were the original parameters used to initialize the machine learning model for training.

[0011] The original parameters used to initialize the machine learning model for training may show a better performance when moving from the original parameters towards the trained parameters than other initial parameters. By calculating a performance information for intermediate parameters between two sets of initial parameters and the trained parameters, it may be possible to determine whether the first or the second set of initial parameters was (or at least was more likely) the original parameters used to initialize the machine learning model for training. By verifying that the initial parameters were the original parameters, it may be possible to verify the ownership of the trained machine learning model for the party providing one set or exclude the ownership for the party providing the other set. In this way, a theft of the trained machine learning model and / or unauthorized or undesired modification of the trained machine learning model may be detected.

[0012] An example relates to a system comprising one or more processors and one or more storage devices. The system is configured to receive information on a trained machine learning model comprising a set of trained parameters and receive a seed. Further, the system is configured to generate a set of initial parameters by a pseudorandom number generator based on the received seed and generate a set of intermediate parameters based on the set of trained parameters and the set of initial parameters. Additionally, the system is configured to initialize the machine learning model based on the set of intermediate parameters stored by the one or more storage devices to obtain an intermediate machine learning model and determine a loss of an application of the intermediate machine learning model to model input data. Furthermore, the system is configured to provide output information indicating whether the initial parameters were the original parameters used to initialize the machine learning model for training based on the loss.

[0013] The original parameters used to initialize the machine learning model for training may show faster decrease of the loss when moving from the original parameters towards the trained parameters than other initial parameters. By calculating the loss for intermediate parameters between initial parameters and the trained parameters, it may be possible to determine whether the initial parameters were the original parameters used to initialize the machine learning model for training. By verifying that the initial parameters were the original parameters, it may be possible to verify the ownership of the trained machine learning model. Additionally or alternatively, a modification of the trained machine learning model may be detected if it is determined that the initial parameters were not the original parameters, although the original parameters were used a initial parameters. In this way, a theft of the trained machine learning model and / or unauthorized or undesired modification of the trained machine learning model may be detected.

[0014] Short description of the Figures

[0015] Some examples of apparatuses and / or methods will be described in the following by way of example only, and with reference to the accompanying figures, in which

[0016] Fig. 1 shows a schematic illustration of a system;

[0017] Fig. 2 shows a diagram of an interpolation of model weights;

[0018] Fig. 3 shows a diagram of a loss between initial weights and trained model weights;

[0019] Fig. 4 shows a diagram of a loss between initial weights and trained model weights for different initial weights;

[0020] Fig. 5 shows a diagram of the area under the loss curve for different seeds; Fig. 6 shows a flow chart of a method for verifying initial parameters used for training a machine learning model;

[0021] Fig. 7 shows a flow chart of a method for verifying that a seed was used for training a machine learning model;

[0022] Fig. 8 shows a schematic illustration of a system; and

[0023] Fig. 9 shows a flow chart of a method for providing information on parameters for a machine learning model.

[0024] Detailed Description

[0025] Various examples will now be described more fully with reference to the accompanying drawings in which some examples are illustrated. In the figures, the thicknesses of lines, layers and / or regions may be exaggerated for clarity.

[0026] There is a need for an improved technical concept for verifying the ownership of ML models and / or detecting modifications of ML models and / or proving theft of ML models. Further, there is a need for verifying whether model parameters or a seed for model parameters were the original parameters or the seed for the original parameters used to initialize the machine learning model for training. Additionally, there is a need for determining which model parameters or seed of two sets of model parameters or seeds was more likely the original parameters or the seed for the original parameters used to initialize the machine learning model for training.

[0027] Fig. 1 shows a schematic illustration of a system according to an example. The system 100 comprises one or more processors 110 and one or more storage devices 120. The system 100 is configured to receive information on a trained machine learning model 102 comprising a set of trained parameters and generate a set of intermediate parameters based on the set of trained parameters and a set of initial parameters. Further, the system 100 is configured to initialize the machine learning model based on the set of intermediate parameters stored by the one or more storage devices 120 to obtain an intermediate machine learning model. Additionally, the system 100 is configured to determine performance information by the one or more processors 110 based on an application of the intermediate machine learning model to model input data and provide output information 104 indicating whether the initial parameters were the original parameters used to initialize the machine learning model for training based on the performance information.

[0028] The performance information may be information on the performance of the machine learning model if it is initialized with parameters between the set of trained parameters and the set of initial parameters. The performance information may be or may be based on a performance parameter. For example, a performance parameter may be the loss or another accuracy parameter of the intermediate machine learning model. For example, the performance information may be determined based on a calculation of a loss of the application of the intermediate machine learning model to the model input data or another accuracy parameter of the application of the intermediate machine learning model to the model input data. The loss may be calculated based on a loss function (e.g. cross entropy loss function, softmax loss function, Kullback-Leibler divergence loss function, or squared loss function). The loss function may be the same loss function as used for the training of the trained machine learning model 102. The loss function may be received together with the information on a trained machine learning model 102 or may be selected depending on the type of machine learning model.

[0029] For example, the performance information is information on a rate of convergence of a performance parameter (e.g. the loss or another accuracy parameter), is information on an area under a curve of a development of a loss for different sets of intermediate parameters, or is information on a representative loss (e.g. the loss determined for the set of intermediate parameters or an average loss of a predefined number of different sets of intermediate parameters). For example, it may be sufficient to determine the loss of one point on the curve, which is used as representative loss.

[0030] The output information 104 may provide information on whether the initial parameters were the original parameters or not. For example, the output information 104 may be a binary output (e.g. 0 or 1; Yes or No; Verified or not verified) or may include information on a probability of verification (e.g. Yes @ 75% probability; Verified @ 95% probability). For example, the output information 104 may indicate that the initial parameters were the original parameters used to initialize the machine learning model for training if the area under the curve (e.g. area under LILAC curve) or the representative loss is lower than 80% (or lower than 70% or lower than 60% or lower than 50%) of an area under a reference curve (or an average area of a plurality of reference curves) or of a reference loss (or an average reference loss of a plurality of reference losses) or if a probability of obtaining the determined performance information (e.g. area under the curve or representative loss) is lower than 1 / 1000 (or lower than 1 / 10000 or lower than 1 / 100000) considering areas under a plurality of reference curves or a plurality of reference losses. A reference curve and / or a reference loss may be determined based on reference intermediate parameters.

[0031] For example, the system 100 may be further configured to determine a plurality of sets of intermediate parameters based on an interpolation between the set of trained parameters and the set of initial parameters. The different sets of intermediate parameters may represent different states of the machine learning model between the initial parameters and the trained parameters. A number of sets of intermediate parameters is at least 30 (or at least 10 or at least 50). The interpolation may be a linear interpolation.

[0032] The system 100 may be further configured to initialize the machine learning model based on individual sets of the plurality of sets of intermediate parameters to obtain a plurality of intermediate machine learning models. For example, an intermediate machine learning models is obtained for each set of intermediate parameters.

[0033] The system 100 may be further configured to determine a value of a performance parameter (e.g. the loss or another accuracy parameter) for each intermediate machine learning model of the plurality of intermediate machine learning models based on an application of each intermediate machine learning model of the plurality of intermediate machine learning models to the model input data. The different values of the performance parameter may represent points on the curve of the development of the loss for different sets of intermediate parameters. For example, ten different sets of intermediate parameters between the set of trained parameters and the set of initial parameters may be sufficient to show the development, but more different sets (e.g. 30 or more) may enable a more accurate representation of the development. The trained parameters may also be called trained weights or trained model weights. For example, model weights in a ML model are parameters that transform input data through various layers to produce an output. Each weight may represent the strength of the connection between neurons in adjacent layers. During training, these weights are adjusted based on the error (e.g. the loss) between the predicted output and the actual output, in order to minimize this error, for example. The optimization of these weights allows the ML model to learn and generalize from the data.

[0034] The initial parameters may also be called initial weights or initial model weights. The initial parameters may be parameters to be verified. The initial parameters may be or may comprise random or pseudo random values.

[0035] The system 100 may be further configured to receive the set of initial parameters or generate the set of initial parameters based on a received seed. The seed may be a random seed (e.g. a 16-bit, 32-bit or 64-bit integer number) or any number or bit sequence. The set of initial parameters may be generated by a pseudorandom number generator based on the seed (e.g. a random seed). Information on the pseudorandom number generator (e.g. the pseudorandom number generator itself or a public source of the pseudorandom number generator) may be provided by the same source (e.g. external device, user or party) as the trained machine learning model and / or the seed and / or the set of initial parameters. The random number generator may be specified and may be publicly available, such as those in TensorFlow or Python packages, for example. For example, the random seed may be an integer number (e.g. the number 42 or any other number) and the set of initial parameters is generated using the pseudorandom number generator of the TensorFlow package version 3.0.

[0036] The system 100 may be configured to receive the set of initial parameters or a seed used to generate the set of initial parameters from an external device (e.g. external to the system) and / or via an internet connection. For example, the trained machine learning model, the model input data, and / or the set of initial parameters or a seed used to generate the set of initial parameters and / or information on the pseudorandom number generator may be received from the same user, party and / or external device.

[0037] The system 100 may be further configured to generate reference performance information for comparison in order to decide on whether the initial parameters were the original parameters used to initialize the machine learning model for training. For example, the system 100 may be further configured to generate a set of reference parameters. The values of the set of reference parameters may be generated randomly. For example, the system 100 may generate a reference seed and use the pseudorandom number generator to generate the set of reference parameters.

[0038] For example, the system 100 may be further configured to generate a set of intermediate reference parameters based on the set of trained parameters and the set of reference parameters. The set of intermediate reference parameters may be determined based on an interpolation (e.g. linear interpolation) between the set of trained parameters and the set of reference parameters. It may be sufficient to generate a single set of reference parameters for the later comparison. Alternatively, several sets of intermediate reference parameters may be generated. For example, a plurality of sets of intermediate reference parameters may be determined based on an interpolation between the set of trained parameters and the set of reference parameters.

[0039] The system 100 may be further configured to initialize the machine learning model based on the set of intermediate reference parameters stored by the one or more storage devices 120 to obtain an intermediate reference machine learning model. The machine learning model may be initialized based on individual sets of the plurality of sets of intermediate reference parameters to obtain a plurality of intermediate reference machine learning models, if a plurality of sets of intermediate reference parameters was generated. For example, an intermediate reference machine learning models is obtained for each set of intermediate reference parameters.

[0040] The system 100 may be further configured to determine reference performance information by the one or more processors 110 based on an application of the intermediate reference machine learning model to the model input data. If more than one intermediate reference machine learning model is generated, the system 100 may be further configured to determine a value of a reference performance parameter (e.g. the loss or another accuracy parameter) for each intermediate reference machine learning model of the plurality of intermediate reference machine learning models based on an application of each intermediate reference machine learning model of the plurality of intermediate reference machine learning models to the model input data. The different values of the performance parameter may represent points on the curve of the development of the loss for different sets of intermediate reference parameters. For example, ten different sets of intermediate reference parameters between the set of trained parameters and the set of reference parameters may be sufficient to show the development, but more different sets (e.g. 30 or more) may enable a more accurate representation of the development.

[0041] For example, the reference performance information is information on a rate of convergence of a performance parameter (e.g. the loss or another accuracy parameter), is information on an area under a reference curve of a development of a loss for different sets of intermediate reference parameters, or is information on a reference loss (e.g. the loss determined for the set of intermediate reference parameters or an average loss of a predefined number of different sets of intermediate reference parameters). For example, it may be sufficient to determine the loss of one point on the curve, which is used as reference loss. For example, Fig. 4 shows a curve for initial parameters being equal to the original parameters and a plurality of reference curves.

[0042] The system 100 may be further configured to provide the output information 104 indicating whether the initial parameters were the original parameters used to initialize the machine learning model for training based on a comparison of the reference performance information and the performance information. For example, the output information 104 may indicate that the initial parameters were the original parameters used to initialize the machine learning model for training if the area under the curve (e.g. area under LILAC curve) or the representative loss is lower than 80% (or lower than 70% or lower than 60% or lower than 50%) of an area under the reference curve or of the reference loss or if a probability of obtaining the determined performance information is lower than 1 / 1000 (or lower than 1 / 10000 or lower than 1 / 100000) considering areas under a plurality of reference curves or a plurality of reference losses. Different reference curves or different reference losses may be obtained for different sets of reference parameters. The different sets of reference parameters may be generated by the same pseudorandom number generator based on different reference seeds.

[0043] The received information on the trained machine learning model may be the trained machine learning model comprising a set of trained parameters or information on the machine learning model and the set of trained parameters so that the machine learning model can be loaded with the set of trained parameters to obtain the trained machine learning model.

[0044] For example, the machine learning model is a ML algorithm having a ML architecture, which can be initialized or loaded with initial parameters (e.g. for training), with intermediate parameters or the trained parameters (e.g. for use). The trained machine learning model may differ from the intermediate machine learning model only by different parameters (e.g. different model weights), but not by the ML architecture. For example, the architecture of the trained machine learning model and the architecture of the intermediate machine learning model are the same. The intermediate machine learning model may be obtained by initializing the model weights of the machine learning model with the set of intermediate parameters (e.g. by loading the intermediate parameters into the machine learning model).

[0045] For example, the trained machine learning model is a trained version of the machine learning model comprising the trained parameters. The trained machine learning model may be a trained neural network and the set of trained parameters is a set of trained network weights. The trained neural network may comprise a number of trained parameters larger than at least one million (or larger than 10 million, larger than 100 millions or larger than 1 billion). For example, the machine learning model is a language model, a transformer network, a convolutional neural network or a recurrent neural network.

[0046] The model input data may be any example data which trained machine learning model was trained on. The model input data may be evaluation data, validation data (e.g. used during training), a subset of the training data (e.g. used for training) or other test input data. For example, if the machine learning model is a convolutional neural network, the model input data may be labeled images (e.g. subset of training images or validation images) and the system 100 may determine a loss of the application of the intermediate convolutional neural network to the labeled images. Even a single data set may be sufficient as model input data. For example, the model input data may comprise more than 100 (or more than 1000) data sets and / or less than 100000 (or less than 1000 or less than 10000) data sets. For example, the intermediate machine learning model (or plurality of intermediate machine learning models) and the intermediate reference machine learning model (or plurality of intermediate reference machine learning model) are applied to the same model input data. In this way, the difference between the performance information and the reference performance information depends on the set of initial parameters and the set of reference parameters, but not on the model input data.

[0047] In one example, the trained machine learning model 102 may be a trained convolutional neural network trained to classify images and the model input data are labeled images. The label of each image describes the content of the image (e.g. image shows a dog and the label is dog). The model input data may comprise more than 1000 labeled images and less than 100000 labeled images. The seed may be a 32-bit integer number and the pseudorandom number generator used to generate the set of initial parameters may be the pseudorandom number generator of the TensorFlow package version 3.0. The performance parameter may be the loss calculated based on a softmax loss function.

[0048] In another example, the trained machine learning model 102 may be a trained transformer decoder language model trained to predict the next word in a sentence and the model input data may be a set of sentences. The model input data may comprise more than 10000 sentences and less than 1000000 sentences. The seed may be a 64-bit integer number and the pseudorandom number generator used to generate the set of initial parameters may be the pseudorandom number generator numpy. random. seed() of NumPy version 2.0. The performance parameter may be the loss calculated based on a categorical cross entropy function.

[0049] The system 100 may be a local computer device (e.g. personal computer, laptop, tablet computer or mobile phone) with one or more processors 110 and one or more storage devices 120 or may be a distributed computer system (e.g. a cloud computing system with one or more processors and one or more storage devices distributed at various locations, for example, at a local client and / or one or more remote server farms and / or data centers). The system 100 may comprise any circuit or combination of circuits. In one embodiment, the system 100 may include one or more processors 110 which can be of any type. As used herein, processor may mean any type of computational circuit, such as but not limited to a microprocessor, a microcontroller, a complex instruction set computing (CISC) microprocessor, a reduced instruction set computing (RISC) microprocessor, a very long instruction word (VLIW) microprocessor, a graphics processor, a digital signal processor (DSP), multiple core processor, a field programmable gate array (FPGA) or any other type of processor or processing circuit. Other types of circuits that may be included in the computer system 100 may be a custom circuit, an application-specific integrated circuit (ASIC), or the like, such as, for example, one or more circuits (such as a communication circuit) for use in wireless devices like mobile telephones, tablet computers, laptop computers, two-way radios, and similar electronic systems. The system 100 may include one or more storage devices, which may include one or more memory elements suitable to the particular application, such as a main memory in the form of random access memory (RAM), one or more hard drives, and / or one or more drives that handle removable media such as compact disks (CD), flash memory cards, digital video disk (DVD), and the like. The system 100 may also include a display device, one or more speakers, and a keyboard and / or controller, which can include a mouse, trackball, touch screen, voice-recognition device, or any other device that permits a system user to input information into and receive information from the system 100.

[0050] The proposed concept may enable the secure and verifiable management of ML model ownership as well as the detection of modifications to ensure the authenticity of these ML models. The proposed concept may enable a way of proving ownership of neural networks which can also be used to identify stolen networks.

[0051] More details and aspects are mentioned in connection with the embodiments described above or below. The example shown in Figs. 1 may comprise one or more optional additional features corresponding to one or more aspects mentioned in connection with the proposed concept or one or more examples described above or below (e.g. Fig. 2-9).

[0052] Fig. 2-5 show an example of the determination of the performance information being the area under a linear interpolation loss / accuracy convergence (LILAC) curve. For example, there is a unique relationship between a model’s initialization (where a neural network is initially started with random weights) and the final trained weights. For example, the model loss is monotonically decreasing in loss along a straight vector line between model initialization and final weights. This property can be used to examine for proving information on the model ownership. This is useful because only the model trainer may have possession of the model initialization and this can be kept secret, i.e. there is no need to release this along with the model. For example, the geometric relationship between the initial parameters and the final parameters is evaluated. For example, the model loss, given a dataset (e.g. model input data), is calculated along a straight line in parameter space. Fig. 2 shows an example of a model with 2 parameters (Wi and W2) to illustrate how the loss is calculated over a straight line in parameter space. This can be of arbitrary dimensionality and the same principle applies. The straight line can be represented as Initial + alpha*(Trained - Initial) as alpha varies between 0 and 1. E.g. when alpha is 0, this is Initial (e.g. the initial weights) and when alpha is 1 this is Trained (e.g. the final or trained weights). Thus, the loss can be calculated over the course of the straight line between Initial and Trained as illustrated in Fig. 3. Fig. 3 is an illustrative example of the loss along the straight line (depicted in Fig. 2) between the initial model weights and the final trained model weights, which may be called LILAC curve.

[0053] Fig. 4 shows a diagram of a loss between initial weights and trained model weights for different initial weights. Fig. 4 shows how the true random seed initialization 410 outperforms all other fake initialization 430. For example, for a classification neural network, LILAC curves were calculated with the true initialization 410 and 300 fake initializations were made via reverse backpropagation from the final weights to the baseline loss 420 and then were clipped to the nearest random seed 430. Alpha is the level of linear interpolation, e.g. weights = initialization + alpha*(final_weights - initialization). J(Theta) on the Y axis is the loss calculated at that level of interpolation between initialization and final weights. Fig. 4 shows that the LILAC curve from the true random seed 410 converges massively faster than any other tested fake random seed 430.

[0054] For example, for generating a LILAC curve, N points are specified to generate the curve (e.g. N larger than 30). In Fig. 4, N=50. A set of 50 equidistant points between 0 and 1 is generated (e.g. 0, 1 / 50, 2 / 50, 3 / 50, ..., 50 / 50). For each of the equidistant points, the final weights and initial weights are interpolated, e.g. for the point 25 / 50, the weights will be halfway between the initial weights and final weights. At points 0 and 1, the weights will be at the initial and final weights respectively. After finding the interpolated weights at a point, the neural network evaluated with the weights set to the interpolated weights. For example, evaluation means using the prespecified loss function. So, for the 25 / 50 point, the LILAC curve value at that point is the loss of the neural network with the weights set to the 25 / 50 interpolated weights. The 50 points can be plotted using a line plot, representing a LILAC plot. Having N=50 may provide a good number of points to characterize the LILAC curve, but other numbers may also be suitable. For example, for ease of comparison between random seeds, the LILAC curve can be represented by a single number. This could be the area under the curve between inialization and the final weights. Alternatively, it could be the loss at a specific point within the curve, e.g. at the half-way point. Either way it may be a statistic which demonstrates the rate of convergence between the initialization from the random seed and the final trained model weights.

[0055] For example, the true model initialization has by far the most rapid linear interpolation loss / accuracy convergence (LILAC) from baseline accuracy than any other random seed model initialization, which is shown in Fig. 4. The random seed which generated the initialization can be used as a key to prove model ownership. No other random seed has a LILAC that is close to the true random seed, as shown in Fig. 4.

[0056] For example, random seeds are internal pseudo random initializations which can be used to generate the initializations of the model weight. Despite their random appearance, they are reproducible, e.g. the same random seed on two different systems will give the same sequence of ‘random’ numbers.

[0057] In an example, the steps to having a provably owned network are (1) keep track of the verifiable (e.g. those which produce the same output on a different system) random seeds used to generate network weights, e.g. setting the tensorflow random seed for each layer, and (2) To prove model ownership, demonstrate that the choice of verifiable random seeds has LILAC faster than any other choice of random seeds.

[0058] For example, the true initialization from the chosen random seeds has a faster LILAC than any other choice of random seeds. It may be unfeasible to guess the random seeds since there are unfeasibly large combinations of them, and testing each one requires substantial computing power.

[0059] This is exemplified in Fig. 5. The ‘area under the LILAC curve’ of the true initialization seed 510 is plotted vs. the area under the curves for samples of ‘random seeds’ 520. As can be seen, the distribution from ‘non-owner’ random seeds 520 is vastly different from that of the true initialization seed 510. Fig. 5 shows the distribution of the area under the curve AUC for the initialization seed 510 vs. non-initialization seeds 520. For a specific model, LILAC curves were generated for the true initialization seed 510 and a random sample of non-initialization seeds 520. The area under the LILAC curve was calculated and the distribution for the non-initialization seeds 520 and the true initialization seed 510 (e.g. owners seed) is shown.

[0060] With respect to the threshold at which the owners random seeds are proved, this may be calculated by showing a significance value of the probability of the metric (e.g. such as area under the curve) being less than or equal to the true seeds metric is below a threshold probability (e.g. p = 0.00001). Fig. 5 shows the distribution of the LILAC statistic of unrelated random seeds 520. For example, the probability of generating a score of 0.7 or less from the unrelated random distribution is p < 0.000000000000001.

[0061] The model may be any neural network or artificial neural network, e.g. a transformer, a language model, a CNN or an RNN.

[0062] More details and aspects are mentioned in connection with the embodiments described above or below. The example shown in Figs. 2-5 may comprise one or more optional additional features corresponding to one or more aspects mentioned in connection with the proposed concept or one or more examples described above (e.g. Fig. 1) or below (e.g. Fig. 6-9).

[0063] Fig. 6 shows a flow chart of a method for verifying initial parameters used for training a machine learning model. The computer-implemented method 600 comprises receiving 610 a trained machine learning model comprising a set of trained parameters and generating 620 a set of intermediate parameters based on the set of trained parameters and a set of initial parameters. Further, the method 600 comprises initializing 630 the machine learning model based on the set of intermediate parameters to obtain an intermediate machine learning model and determining 640 performance information based on an application of the intermediate machine learning model to model input data. Additionally, the method comprises providing 650 output information indicating whether the initial parameters were the original parameters used to initialize the machine learning model for training based on the performance information. The original parameters used to initialize the machine learning model for training may show a better performance when moving from the original parameters towards the trained parameters than other initial parameters. By determining a performance information for intermediate parameters between initial parameters and the trained parameters, it may be possible to determine whether the initial parameters were the original parameters used to initialize the machine learning model for training. By verifying that the initial parameters were the original parameters, it may be possible to verify the ownership or prove theft of the trained machine learning model. Additionally or alternatively, a modification of the trained machine learning model may be detected if it is determined that the initial parameters were not the original parameters, although the original parameters were used a initial parameters. In this way, theft of the trained machine learning model and / or unauthorized or undesired modification of the trained machine learning model may be detected. Additionally or alternatively, the authenticity of the trained machine learning model can be verified or ensured.

[0064] More details and aspects are mentioned in connection with the embodiments described above or below. The example shown in Figs. 6 may comprise one or more optional additional features corresponding to one or more aspects mentioned in connection with the proposed concept or one or more examples described above (e.g. Fig. 1-5) or below (e.g. Fig. 7-9).

[0065] Fig. 7 shows a flow chart of a trust free method of proving ownership via a third party. For example, company A and company B are both claiming ownership of the same model. Say company A is the true model owner. Company A will have access to the random seed(s) which generated the initialization of the model. These seeds never have to be shared with the final model, thus can be kept completely secret. Company A can demonstrate that their lilac statistic is smaller than any other random seed(s). Thus proving company A is in possession of the random seed which generated the model initialization. Company B may try to guess random seeds to do the same, but it would be computationally intractable to test every random seed given that a LILAC curve would have to be generated for each one. Thus, the brute force approach would potentially take decades to crack. The verification may be done by a third party (arbiter). It may rely on both company A and B to provide their random initialization seeds, the model in dispute, and a test dataset, to the arbiter. Alternatively, the arbiter could impartially choose an appropriate dataset to the model. Fig. 7 shows that a party sends a seed, final weights, and an evaluation dataset to a third party arbiter and the arbiter generates the LILAC curve and statistic(s) (e.g. AUC using given seed and final weights). The arbiter simulates the LILAC statistic(s) with random seeds N times and will then perform a statistical comparison of original LILAC statistic(s) with the simulated statistics. If there is a statistically significant difference, there is evidence that the given seed was the original seed that led to the final weights. If there is no statistically significant difference, there is not enough evidence to suggest the seed was the original seed.

[0066] The model ownership may be proved based on:

[0067] - Storing reproducible random seed(s) which generated the initialization of your model.

[0068] - Choose a subset of data which is within the distribution of the training data, e.g. validation data or data which the model can perform on.

[0069] - Generate the LILAC statistic using your random seed(s) and the data subset. This can be viewed as the key LILAC statistic.

[0070] - Generate LILAC statistics using the same subset of data with a plurality of model initializations generated from other random seeds. These can be viewed as reference LILAC statistics.

[0071] - Show that the key LILAC statistic is smaller than any of the reference LILAC statistics, thus proving ownership.

[0072] More details and aspects are mentioned in connection with the embodiments described above or below. The example shown in Figs. 7 may comprise one or more optional additional features corresponding to one or more aspects mentioned in connection with the proposed concept or one or more examples described above (e.g. Fig. 1-6) or below (e.g. Fig. 8-9).

[0073] Fig. 8 shows a schematic illustration of a system 800. The system 800 comprises one or more processors 110 and one or more storage devices 120. The system 100 is configured to receive a trained machine learning model 102 comprising a set of trained parameters and receive a first set of initial parameters or a first seed used to generate the first set of initial parameters from a first party and a second set of initial parameters or a second seed used to generate the second set of initial parameters from a second party. Further, the system 800 is configured to generate a first set of intermediate parameters based on the set of trained parameters and the first set of initial parameters and initialize the machine learning model based on the first set of intermediate parameters stored by the one or more storage devices 120 to obtain a first intermediate machine learning model. Additionally, the system 800 is configured to determine first performance information by the one or more processors 110 based on an application of the first intermediate machine learning model to model input data and generate a second set of intermediate parameters based on the set of trained parameters and the second set of initial parameters. Furthermore, the system 800 is configured to initialize the machine learning model based on the second set of intermediate parameters stored by the one or more storage devices 120 to obtain a second intermediate machine learning model and determine second performance information by the one or more processors 110 based on an application of the second intermediate machine learning model to the model input data. Additionally, the system 800 is configured to compare the first performance information and the second performance information and, based on the comparison, provide output information 804 indicating whether it is more likely that the first set of initial parameters or the second set of initial parameters were the original parameters used to initialize the machine learning model for training.

[0074] The first party may be a first user, a first external device or a first company and the second party may be a different, second user, external device or company.

[0075] The first performance information may be determined based on a calculation of a loss of the application of the first intermediate machine learning model to the model input data. The first performance information may be information on a rate of convergence of a performance parameter, is information on an area under a curve of a development of a loss for different first sets of intermediate parameters, or is information on a representative loss determined for the first set of intermediate parameters.

[0076] The second performance information may be determined based on a calculation of a loss of the application of the second intermediate machine learning model to the model input data. The second performance information may be information on a rate of convergence of a performance parameter, is information on an area under a curve of a development of a loss for different second sets of intermediate parameters, or is information on a representative loss determined for the second set of intermediate parameters.

[0077] The system 800 may be further configured to determine a plurality of first sets of intermediate parameters based on an interpolation between the set of trained parameters and the first set of initial parameters. The system 800 may be further configured to determine a plurality of second sets of intermediate parameters based on an interpolation between the set of trained parameters and the second set of initial parameters.

[0078] The system 800 may be further configured to initialize the machine learning model based on individual sets of the plurality of first sets of intermediate parameters to obtain a plurality of first intermediate machine learning models. The system 800 may be further configured to initialize the machine learning model based on individual sets of the plurality of second sets of intermediate parameters to obtain a plurality of second intermediate machine learning models.

[0079] The system 800 may be further configured to determine a value of a performance parameter for each first intermediate machine learning model of the plurality of first intermediate machine learning models based on an application of each first intermediate machine learning model of the plurality of first intermediate machine learning models to the model input data. The system 800 may be further configured to determine a value of a performance parameter for each second intermediate machine learning model of the plurality of second intermediate machine learning models based on an application of each second intermediate machine learning model of the plurality of second intermediate machine learning models to the model input data.

[0080] The system 800 may be further configured to generate the first set of initial parameters based on a received first seed. The system 800 may be further configured to generate the second set of initial parameters based on a received second seed. The first seed is a first random seed and the first set of initial parameters is generated by a pseudorandom number generator. The first seed is a second random seed and the second set of initial parameters is generated by a pseudorandom number generator.

[0081] The system 800 may be further configured to receive the first set of initial parameters or a first seed used to generate the first set of initial parameters from an external device. The system 800 may be further configured to receive the second set of initial parameters or a second seed used to generate the second set of initial parameters from an external device. The first set of initial parameters or a first seed used to generate the set of initial parameters are received via an internet connection. The second set of initial parameters or a second seed used to generate the set of initial parameters are received via an internet connection. The system 800 may be further configured to receive, from the first party, the trained machine learning model, the model input data, and the first set of initial parameters or a first seed used to generate the first set of initial parameters. The system 800 may be further configured to receive, from the second party, the second set of initial parameters or a second seed used to generate the second set of initial parameters.

[0082] More details and aspects are mentioned in connection with the embodiments described above or below. The example shown in Figs. 8 may comprise one or more optional additional features corresponding to one or more aspects mentioned in connection with the proposed concept or one or more examples described above (e.g. Fig. 1-7) or below (e.g. Fig. 9).

[0083] Fig. 9 shows a flow chart of a method for providing information on parameters for a machine learning model. The method 900 comprises receiving 910 a trained machine learning model comprising a set of trained parameters and receiving 920 a first set of initial parameters or a first seed used to generate the first set of initial parameters from a first party and a second set of initial parameters or a second seed used to generate the second set of initial parameters from a second party. Further, the method 900 comprises generating 930 a first set of intermediate parameters based on the set of trained parameters and the first set of initial parameters and initializing 940 the machine learning model based on the first set of intermediate parameters stored by the one or more storage devices to obtain a first intermediate machine learning model. Additionally, the method 900 comprises determining 950 first performance information by the one or more processors based on an application of the first intermediate machine learning model to model input data and generating 960 a second set of intermediate parameters based on the set of trained parameters and the second set of initial parameters. Furthermore, the method 900 comprises initializing 970 the machine learning model based on the second set of intermediate parameters stored by the one or more storage devices to obtain a second intermediate machine learning model and determining 980 second performance information by the one or more processors based on an application of the second intermediate machine learning model to the model input data. Additionally, the method 900 comprises comparing 990 the first performance information and the second performance information and, based on the comparison, providing 995 output information indicating whether it is more likely that the first set of initial parameters or the second set of initial parameters were the original parameters used to initialize the machine learning model for training.

[0084] More details and aspects are mentioned in connection with the embodiments described above or below. The example shown in Figs. 8 may comprise one or more optional additional features corresponding to one or more aspects mentioned in connection with the proposed concept or one or more examples described above (e.g. Fig. 1-8) or below.

[0085] Some examples relate to a system comprising one or more processors and one or more storage devices. The system is configured to receive information on a trained machine learning model comprising a set of trained parameters and receive a seed. Further, the system is configured to generate a set of initial parameters by a pseudorandom number generator based on the received seed and generate a set of intermediate parameters based on the set of trained parameters and the set of initial parameters. Additionally, the system is configured to initialize the machine learning model based on the set of intermediate parameters stored by the one or more storage devices to obtain an intermediate machine learning model and determine a loss of an application of the intermediate machine learning model to model input data. Furthermore, the system is configured to provide output information indicating whether the initial parameters were the original parameters used to initialize the machine learning model for training based on the loss.

[0086] More details and aspects are mentioned in connection with the embodiments described above or below. The example shown in Figs. 8 may comprise one or more optional additional features corresponding to one or more aspects mentioned in connection with the proposed concept or one or more examples described above (e.g. Fig. 1-9) or below.

[0087] As used herein the term “and / or” includes any and all combinations of one or more of the associated listed items and may be abbreviated as “ / ”.

[0088] Although some aspects have been described in the context of an apparatus, it is clear that these aspects also represent a description of the corresponding method, where a block or device corresponds to a method step or a feature of a method step. Analogously, aspects described in the context of a method step also represent a description of a corresponding block or item or feature of a corresponding apparatus. Some or all of the method steps may be executed by (or using) a hardware apparatus, like for example, a processor, a microprocessor, a programmable computer or an electronic circuit. In some embodiments, some one or more of the most important method steps may be executed by such an apparatus.

[0089] Depending on certain implementation requirements, embodiments of the invention can be implemented in hardware or in software. The implementation can be performed using a non- transitory storage medium such as a digital storage medium, for example a floppy disc, a DVD, a Blu-Ray, a CD, a ROM, a PROM, and EPROM, an EEPROM or a FLASH memory, having electronically readable control signals stored thereon, which cooperate (or are capable of cooperating) with a programmable computer system such that the respective method is performed. Therefore, the digital storage medium may be computer readable.

[0090] Some embodiments according to the invention comprise a data carrier having electronically readable control signals, which are capable of cooperating with a programmable computer system, such that one of the methods described herein is performed.

[0091] Generally, embodiments of the present invention can be implemented as a computer program product with a program code, the program code being operative for performing one of the methods when the computer program product runs on a computer. The program code may, for example, be stored on a machine readable carrier.

[0092] Other embodiments comprise the computer program for performing one of the methods described herein, stored on a machine readable carrier.

[0093] In other words, an embodiment of the present invention is, therefore, a computer program having a program code for performing one of the methods described herein, when the computer program runs on a computer.

[0094] A further embodiment of the present invention is, therefore, a storage medium (or a data carrier, or a computer-readable medium) comprising, stored thereon, the computer program for performing one of the methods described herein when it is performed by a processor. The data carrier, the digital storage medium or the recorded medium are typically tangible and / or non-transitionary. A further embodiment of the present invention is an apparatus as described herein comprising a processor and the storage medium.

[0095] A further embodiment of the invention is, therefore, a data stream or a sequence of signals representing the computer program for performing one of the methods described herein. The data stream or the sequence of signals may, for example, be configured to be transferred via a data communication connection, for example, via the internet.

[0096] A further embodiment comprises a processing means, for example, a computer or a programmable logic device, configured to, or adapted to, perform one of the methods described herein.

[0097] A further embodiment comprises a computer having installed thereon the computer program for performing one of the methods described herein.

[0098] A further embodiment according to the invention comprises an apparatus or a system configured to transfer (for example, electronically or optically) a computer program for performing one of the methods described herein to a receiver. The receiver may, for example, be a computer, a mobile device, a memory device or the like. The apparatus or system may, for example, comprise a file server for transferring the computer program to the receiver.

[0099] In some embodiments, a programmable logic device (for example, a field programmable gate array) may be used to perform some or all of the functionalities of the methods described herein. In some embodiments, a field programmable gate array may cooperate with a microprocessor in order to perform one of the methods described herein. Generally, the methods are preferably performed by any hardware apparatus.

[0100] Embodiments may be based on using a machine-learning model or machine-learning algorithm. Machine learning may refer to algorithms and statistical models that computer systems may use to perform a specific task without using explicit instructions, instead relying on models and inference. For example, in machine-learning, instead of a rule-based transformation of data, a transformation of data may be used, that is inferred from an analysis of historical and / or training data. For example, the content of images may be analyzed using a machine-learning model or using a machine-learning algorithm. In order for the machine- learning model to analyze the content of an image, the machine-learning model may be trained using training images as input and training content information as output. By training the machine-learning model with a large number of training images and / or training sequences (e.g. words or sentences) and associated training content information (e.g. labels or annotations), the machine-learning model "learns" to recognize the content of the images, so the content of images that are not included in the training data can be recognized using the machine-learning model. The same principle may be used for other kinds of sensor data as well: By training a machine-learning model using training sensor data and a desired output, the machine-learning model "learns" a transformation between the sensor data and the output, which can be used to provide an output based on non-training sensor data provided to the machine-learning model. The provided data (e.g. sensor data, meta data and / or image data) may be preprocessed to obtain a feature vector, which is used as input to the machine-learning model.

[0101] Machine-learning models may be trained using training input data. The examples specified above use a training method called "supervised learning". In supervised learning, the machine-learning model is trained using a plurality of training samples, wherein each sample may comprise a plurality of input data values, and a plurality of desired output values, i.e. each training sample is associated with a desired output value. By specifying both training samples and desired output values, the machine-learning model "learns" which output value to provide based on an input sample that is similar to the samples provided during the training. Apart from supervised learning, semi-supervised learning may be used. In semi-supervised learning, some of the training samples lack a corresponding desired output value. Supervised learning may be based on a supervised learning algorithm (e.g. a classification algorithm, a regression algorithm or a similarity learning algorithm. Classification algorithms may be used when the outputs are restricted to a limited set of values (categorical variables), i.e. the input is classified to one of the limited set of values. Regression algorithms may be used when the outputs may have any numerical value (within a range). Similarity learning algorithms may be similar to both classification and regression algorithms but are based on learning from examples using a similarity function that measures how similar or related two objects are. Apart from supervised or semi-supervised learning, unsupervised learning may be used to train the machine-learning model. In unsupervised learning, (only) input data might be supplied and an unsupervised learning algorithm may be used to find structure in the input data (e.g. by grouping or clustering the input data, finding commonalities in the data). Clustering is the assignment of input data comprising a plurality of input values into subsets (clusters) so that input values within the same cluster are similar according to one or more (pre-defined) similarity criteria, while being dissimilar to input values that are included in other clusters.

[0102] Reinforcement learning is a third group of machine-learning algorithms. In other words, reinforcement learning may be used to train the machine-learning model. In reinforcement learning, one or more software actors (called "software agents") are trained to take actions in an environment. Based on the taken actions, a reward is calculated. Reinforcement learning is based on training the one or more software agents to choose the actions such, that the cumulative reward is increased, leading to software agents that become better at the task they are given (as evidenced by increasing rewards).

[0103] Furthermore, some techniques may be applied to some of the machine-learning algorithms. For example, feature learning may be used. In other words, the machine-learning model may at least partially be trained using feature learning, and / or the machine-learning algorithm may comprise a feature learning component. Feature learning algorithms, which may be called representation learning algorithms, may preserve the information in their input but also transform it in a way that makes it useful, often as a pre-processing step before performing classification or predictions. Feature learning may be based on principal components analysis or cluster analysis, for example.

[0104] In some examples, anomaly detection (i.e. outlier detection) may be used, which is aimed at providing an identification of input values that raise suspicions by differing significantly from the maj ority of input or training data. In other words, the machine-learning model may at least partially be trained using anomaly detection, and / or the machine-learning algorithm may comprise an anomaly detection component.

[0105] In some examples, the machine-learning algorithm may use a decision tree as a predictive model. In other words, the machine-learning model may be based on a decision tree. In a decision tree, observations about an item (e.g. a set of input values) may be represented by the branches of the decision tree, and an output value corresponding to the item may be represented by the leaves of the decision tree. Decision trees may support both discrete values and continuous values as output values. If discrete values are used, the decision tree may be denoted a classification tree, if continuous values are used, the decision tree may be denoted a regression tree.

[0106] Association rules are a further technique that may be used in machine-learning algorithms. In other words, the machine-learning model may be based on one or more association rules. Association rules are created by identifying relationships between variables in large amounts of data. The machine-learning algorithm may identify and / or utilize one or more relational rules that represent the knowledge that is derived from the data. The rules may e.g. be used to store, manipulate or apply the knowledge.

[0107] Machine-learning algorithms are usually based on a machine-learning model. In other words, the term "machine-learning algorithm" may denote a set of instructions that may be used to create, train or use a machine-learning model. The term "machine-learning model" may denote a data structure and / or set of rules that represents the learned knowledge (e.g. based on the training performed by the machine-learning algorithm). In embodiments, the usage of a machine-learning algorithm may imply the usage of an underlying machine-learning model (or of a plurality of underlying machine-learning models). The usage of a machine-learning model may imply that the machine-learning model and / or the data structure / set of rules that is the machine-learning model is trained by a machine-learning algorithm.

[0108] For example, the machine-learning model may be an artificial neural network (ANN). ANNs are systems that are inspired by biological neural networks, such as can be found in a retina or a brain. ANNs comprise a plurality of interconnected nodes and a plurality of connections, so-called edges, between the nodes. There are usually three types of nodes, input nodes that receiving input values, hidden nodes that are (only) connected to other nodes, and output nodes that provide output values. Each node may represent an artificial neuron. Each edge may transmit information, from one node to another. The output of a node may be defined as a (non-linear) function of its inputs (e.g. of the sum of its inputs). The inputs of a node may be used in the function based on a "weight" of the edge or of the node that provides the input. The weight of nodes and / or of edges may be adjusted in the learning process. In other words, the training of an artificial neural network may comprise adjusting the weights of the nodes and / or edges of the artificial neural network, i.e. to achieve a desired output for a given input. Alternatively, the machine-learning model may be a support vector machine, a random forest model or a gradient boosting model. Support vector machines (i.e. support vector networks) are supervised learning models with associated learning algorithms that may be used to analyze data (e.g. in classification or regression analysis). Support vector machines may be trained by providing an input with a plurality of training input values that belong to one of two categories. The support vector machine may be trained to assign a new input value to one of the two categories. Alternatively, the machine-learning model may be a Bayesian network, which is a probabilistic directed acyclic graphical model. A Bayesian network may represent a set of random variables and their conditional dependencies using a directed acyclic graph. Alternatively, the machine-learning model may be based on a genetic algorithm, which is a search algorithm and heuristic technique that mimics the process of natural selection.

[0109] List of reference Signs

[0110] 100: system

[0111] 102: trained machine learning model

[0112] 104: output information

[0113] 110: one or more processors

[0114] 120: one or more storage devices

[0115] 410: Owner loss

[0116] 420: Adversary loss

[0117] 430: Argmin loss

[0118] 510: Owner seed

[0119] 520: Random seeds

[0120] 600: method

[0121] 610: receiving a trained machine learning model

[0122] 620: generating a set of intermediate parameters

[0123] 630: initializing the machine learning model

[0124] 640: determining performance information

[0125] 650: providing output information

[0126] 800: system

[0127] 804: output information

[0128] 900: method

[0129] 910: receiving a trained machine learning model

[0130] 920: receiving a first set of initial parameters

[0131] 930: generating a first set of intermediate parameters

[0132] 940: initializing the machine learning model

[0133] 950: determining first performance information

[0134] 960: generating a second set of intermediate parameters

[0135] 970: initializing the machine learning model

[0136] 980: determining second performance information

[0137] 990: comparing the first performance information and the second performance information

[0138] 995: providing output information

Claims

Claims1. A system comprising one or more processors and one or more storage devices, wherein the system is configured to: receive information on a trained machine learning model comprising a set of trained parameters; generate a set of intermediate parameters based on the set of trained parameters and a set of initial parameters; initialize the machine learning model based on the set of intermediate parameters stored by the one or more storage devices to obtain an intermediate machine learning model; determine performance information by the one or more processors based on an application of the intermediate machine learning model to model input data; and provide output information indicating whether the initial parameters were the original parameters used to initialize the machine learning model for training based on the performance information.

2. The system of claim 1, wherein the performance information is determined based on a calculation of a loss of the application of the intermediate machine learning model to the model input data.

3. The system of one of the previous claims, wherein the performance information is information on a rate of convergence of a performance parameter, is information on an area under a curve of a development of a loss for different sets of intermediate parameters, or is information on a representative loss.

4. The system of claim 3, wherein the output information indicates that the initial parameters were the original parameters used to initialize the machine learning model for training if the area under the curve or the representative loss is lower than 80% of an areaunder a reference curve or of a reference loss or if a probability of obtaining the determined performance information is lower than 1 / 1000 considering areas under a plurality of reference curves or a plurality of reference losses.

5. The system of one of the previous claims, further configured to determine a plurality of sets of intermediate parameters based on an interpolation between the set of trained parameters and the set of initial parameters.

6. The system of claim 5, wherein a number of sets of intermediate parameters is at least 30.

7. The system of claim 5 or 6, wherein the interpolation is a linear interpolation.

8. The system of one of the claims 5-7, further configured to initialize the machine learning model based on individual sets of the plurality of sets of intermediate parameters to obtain a plurality of intermediate machine learning models.

9. The system of one of the claims 5-8, further configured to determine a value of a performance parameter for each intermediate machine learning model of the plurality of intermediate machine learning models based on an application of each intermediate machine learning model of the plurality of intermediate machine learning models to the model input data.

10. The system of one of the previous claims, further configured to generate the set of initial parameters based on a received seed.

11. The system of claim 10, wherein the seed is a random seed and the set of initial parameters is generated by a pseudorandom number generator.

12. The system of claim 11, further configured to receive information on the pseudorandom number generator from an external device.

13. The system of one of the previous claims, further configured to: generate a set of reference parameters; generate a set of intermediate reference parameters based on the set of trained parameters and the set of reference parameters; initialize the machine learning model based on the set of intermediate reference parameters stored by the one or more storage devices to obtain an intermediate reference machine learning model; and determine reference performance information by the one or more processors based on an application of the intermediate reference machine learning model to the model input data; provide the output information indicating whether the initial parameters were the original parameters used to initialize the trained machine learning model for training based on a comparison of the reference performance information and the performance information.

14. The system of one of the previous claims, further configured to receive the set of initial parameters or a seed used to generate the set of initial parameters from an external device.

15. The system of one of the previous claims, wherein the set of initial parameters or a seed used to generate the set of initial parameters is received via an internet connection.

16. The system of one of the previous claims or one of the claims 20-30, wherein the trained machine learning model is a trained neural network and the set of trained parameters is a set of trained network weights.

17. The system of one of the previous claims or one of the claims 20-30, wherein the trained machine learning model comprises a number of trained parameters larger than at least one million.

18. The system of one of the previous claims or one of the claims 20-30, wherein the machine learning model is a language model, a transformer network, a convolutional neural network or a recurrent neural network.

19. The system of one of the previous claims, further configured to receive, from the same user, the information on the trained machine learning model, the model input data, and the set of initial parameters or a seed used to generate the set of initial parameters.

20. A system comprising one or more processors and one or more storage devices, wherein the system is configured to: receive information on a trained machine learning model comprising a set of trained parameters; receive a first set of initial parameters or a first seed used to generate the first set of initial parameters from a first party and a second set of initial parameters or a second seed used to generate the second set of initial parameters from a second party; generate a first set of intermediate parameters based on the set of trained parameters and the first set of initial parameters; initialize the machine learning model based on the first set of intermediate parameters stored by the one or more storage devices to obtain a first intermediate machine learning model;determine first performance information by the one or more processors based on an application of the first intermediate machine learning model to model input data; generate a second set of intermediate parameters based on the set of trained parameters and the second set of initial parameters; initialize the machine learning model based on the second set of intermediate parameters stored by the one or more storage devices to obtain a second intermediate machine learning model; determine second performance information by the one or more processors based on an application of the second intermediate machine learning model to the model input data; compare the first performance information and the second performance information; and based on the comparison, provide output information indicating whether it is more likely that the first set of initial parameters or the second set of initial parameters were the original parameters used to initialize the machine learning model for training.

21. The system of claim 20, wherein the first performance information is determined based on a calculation of a loss of the application of the first intermediate machine learning model to the model input data.

22. The system of claim 20 or 21, wherein the first performance information is information on a rate of convergence of a performance parameter, is information on an area under a curve of a development of a loss for different first sets of intermediate parameters, or is information on a representative loss determined for the first set of intermediate parameters.

23. The system of claim 20, 21 or 22, further configured to determine a plurality of first sets of intermediate parameters based on an interpolation between the set of trained parameters and the first set of initial parameters.

24. The system of claim 23, further configured to initialize the machine learning model based on individual sets of the plurality of first sets of intermediate parameters to obtain a plurality of first intermediate machine learning models.

25. The system of claim 24, further configured to determine a value of a performance parameter for each first intermediate machine learning model of the plurality of first intermediate machine learning models based on an application of each first intermediate machine learning model of the plurality of first intermediate machine learning models to the model input data.

26. The system of one of the claims 20-25, further configured to generate the first set of initial parameters based on a received first seed.

27. The system of claim 26, wherein the first seed is a first random seed and the first set of initial parameters is generated by a pseudorandom number generator.

28. The system of one of the claims 20-27, further configured to receive the first set of initial parameters or a first seed used to generate the first set of initial parameters from an external device.

29. The system of one of the claims 20-28, wherein the first set of initial parameters or a first seed used to generate the set of initial parameters are received via an internet connection.

30. The system of one of the claims 20-29, further configured to receive, from the first party, the trained machine learning model, the model input data, and the first set of initial parameters or a first seed used to generate the first set of initial parameters.

31. A computer-implemented method for verifying initial parameters used for training a machine learning model, wherein the method comprises: receiving a trained machine learning model comprising a set of trained parameters; generating a set of intermediate parameters based on the set of trained parameters and a set of initial parameters; initializing the machine learning model based on the set of intermediate parameters to obtain an intermediate machine learning model; determining performance information based on an application of the intermediate machine learning model to model input data; and providing output information indicating whether the initial parameters were the original parameters used to initialize the machine learning model for training based on the performance information.

32. A computer-implemented method for providing information on parameters for a machine learning model, wherein the method comprises: receiving a trained machine learning model comprising a set of trained parameters; receiving a first set of initial parameters or a first seed used to generate the first set of initial parameters from a first party and a second set of initial parameters or a second seed used to generate the second set of initial parameters from a second party; generating a first set of intermediate parameters based on the set of trained parameters and the first set of initial parameters; initializing the machine learning model based on the first set of intermediate parameters to obtain a first intermediate machine learning model; determining first performance information based on an application of the first intermediate machine learning model to model input data;generating a second set of intermediate parameters based on the set of trained parameters and the second set of initial parameters; initializing the machine learning model based on the second set of intermediate parameters to obtain a second intermediate machine learning model; determining second performance information based on an application of the second intermediate machine learning model to the model input data; comparing the first performance information and the second performance information; and based on the comparison, providing output information indicating whether it is more likely that the first set of initial parameters or the second set of initial parameters were the original parameters used to initialize the machine learning model for training.

33. A machine-readable storage medium including program code, when executed, to cause a machine to perform the method of claims 31 or 32.

34. A system comprising one or more processors and one or more storage devices, wherein the system is configured to: receive information on a trained machine learning model comprising a set of trained parameters; receive a seed; generate a set of initial parameters by a pseudorandom number generator based on the received seed; generate a set of intermediate parameters based on the set of trained parameters and the set of initial parameters; initialize the machine learning model based on the set of intermediate parameters stored by the one or more storage devices to obtain an intermediate machine learning model; determine a loss of an application of the intermediate machine learning model to model input data; andprovide output information indicating whether the initial parameters were the original parameters used to initialize the machine learning model for training based on the loss.

Images