Model trust region-based copyright protection method, apparatus and system for smart grid deep learning models

Abstract

The present application relates to the field of artificial intelligence, and relates to a model trust region-based copyright protection method for smart grid deep learning models. The method comprises: acquiring a smart grid deep model set; for each model in the smart grid deep model set, searching an exclusive dataset for feature data samples having a model prediction value approximate to a model discrimination boundary, so as to obtain a trust region feature point set; performing dimensionality reduction on gradient vectors of the trust region feature point set on the model discrimination boundary according to a linear discriminant analysis method, so as to obtain perturbation vectors of the trust region feature point set; on the basis of predicted label changes of each model before and after the trust region feature point set is combined with the perturbation vectors, generating a model feature identifier set corresponding to the smart grid deep model set; and, on the basis of the model feature identifier set, training a copyright detection model to be trained, so as to obtain a pre-trained copyright detection model.

Description

Copyright Protection Methods, Devices, and Systems for Deep Learning Models in Smart Grids Based on Model Confidence Regions

[0001] Related applications

[0002] This application claims priority to Chinese patent application filed on October 22, 2024, application number 2024114759410, entitled "Copyright Protection Method, Apparatus and System for Deep Learning Model of Smart Grid Based on Model Confidence Region", the entire contents of which are incorporated herein by reference. Technical Field

[0003] This application relates to the field of artificial intelligence technology, and in particular to a method, apparatus, system, computer-readable storage medium, and computer program product for copyright protection of a deep learning model for smart grids based on model confidence domains. Background Technology

[0004] With the rapid development of smart grid technology, machine learning models are being applied more and more widely in power systems. In particular, advancements in deep learning technology have spurred the development of various advanced analytical algorithms, including grid flow prediction, user electricity consumption behavior analysis, and equipment anomaly detection. However, these machine learning-based systems rely on high-quality datasets, making them potential targets for intellectual property theft.

[0005] For example, machine learning models in smart grids typically require access to and analysis of large amounts of user data, such as household electricity usage habits and electricity consumption. If attackers obtain this data through model extraction attacks, it not only violates user privacy but could also be used for malicious purposes, such as fraud or stealing user identity information. Simultaneously, smart grids also contain a wealth of grid operation data, such as power load and equipment status. This data is crucial for the safe operation of the grid. If attackers obtain this data through model extraction attacks, it could lead to the leakage of grid operation data, thereby jeopardizing the safe and stable operation of the grid. Attackers could then use this data to manipulate the electricity market or launch cyberattacks against the grid. Therefore, how to protect the copyright of neural networks in this context becomes a pressing issue.

[0006] In related technologies, some research has been dedicated to defending against model extraction attacks and protecting model privacy. However, the inventors have realized that these methods still have some limitations in practical applications, resulting in a low detection accuracy of model copyright infringement attacks. Summary of the Invention

[0007] According to various embodiments disclosed in this application, a method, apparatus, system, computer-readable storage medium, and computer program product for copyright protection of a deep learning model for smart grids based on model confidence domain are provided.

[0008] A copyright protection method for deep learning models of smart grids based on model confidence regions includes:

[0009] A set of deep models for smart grids is obtained; the set of deep models for smart grids includes a target copyright protection model, a target risk model and a target homomorphic model corresponding to the target copyright protection model; the target risk model is a model that has a smart grid dataset infringement problem with the target copyright protection model; the target homomorphic model is a model obtained by simulating the target copyright protection model under the same problem domain;

[0010] For each model in the smart grid deep model set, feature data samples whose distance between the corresponding model prediction value and the corresponding model discrimination boundary meets a preset condition are searched in the smart grid proprietary dataset to obtain a confidence region feature point set; the model discrimination boundary represents the region that can be predicted as other types within a preset displacement of the gradient direction of the model's inference on the feature data samples.

[0011] The gradient vector of the confidence region feature point set on the model discrimination boundary is determined, and the obtained gradient vector is dimensionality reduced by linear discriminant analysis. The dimensionality-reduced gradient vector is used as the perturbation vector of the confidence region feature point set.

[0012] Based on the changes in predicted labels of each model before and after combining the confidence region feature point set with the disturbance vector, a model feature identifier set corresponding to the smart grid deep model set is generated; and

[0013] The copyright detection model to be trained is trained based on the model feature identifier set to obtain a pre-trained copyright detection model; the pre-trained copyright detection model is used to detect whether the model to be detected infringes on the copyright of the target copyright protection model.

[0014] A copyright protection device for a deep learning model of a smart grid based on the model's confidence domain includes:

[0015] An acquisition module is used to acquire a set of deep models for smart grids; the set of deep models for smart grids includes a target copyright protection model, as well as a target risk model and a target homomorphic model corresponding to the target copyright protection model; the target risk model is a model that has a smart grid dataset infringement problem with the target copyright protection model; the target homomorphic model is a model obtained by simulating the target copyright protection model under the same problem domain;

[0016] The search module is used to search for feature data samples in the smart grid proprietary dataset for each model in the smart grid deep model set, where the distance between the corresponding model prediction value and the corresponding model discrimination boundary meets a preset condition, to obtain a set of confidence region feature points; the model discrimination boundary represents regions that can be predicted as other types within a preset displacement of the gradient direction of the model's inference on the feature data samples.

[0017] The determination module is used to determine the gradient vector of the confidence region feature point set on the model discrimination boundary, and to reduce the dimension of the obtained gradient vector according to the linear discriminant analysis method, and use the dimension-reduced gradient vector as the perturbation vector of the confidence region feature point set.

[0018] The generation module is used to generate a model feature identifier set corresponding to the deep model set of the smart grid based on the changes in predicted labels before and after combining the feature point set of the confidence region with the perturbation vector for each model; and

[0019] The training module is used to train the copyright detection model to be trained based on the model feature identifier set to obtain a pre-trained copyright detection model; the pre-trained copyright detection model is used to detect whether the model to be detected infringes the copyright of the target copyright protection model.

[0020] A copyright protection system for a deep learning model of a smart grid based on a model confidence region includes a memory and one or more processors. The memory stores computer-readable instructions, which, when executed by the processors, cause the one or more processors to perform the following steps:

[0021] A set of deep models for smart grids is obtained; the set of deep models for smart grids includes a target copyright protection model, a target risk model and a target homomorphic model corresponding to the target copyright protection model; the target risk model is a model that has a smart grid dataset infringement problem with the target copyright protection model; the target homomorphic model is a model obtained by simulating the target copyright protection model under the same problem domain;

[0022] For each model in the smart grid deep model set, feature data samples whose distance between the corresponding model prediction value and the corresponding model discrimination boundary meets a preset condition are searched in the smart grid proprietary dataset to obtain a confidence region feature point set; the model discrimination boundary represents the region that can be predicted as other types within a preset displacement of the gradient direction of the model's inference on the feature data samples.

[0023] The gradient vector of the confidence region feature point set on the model discrimination boundary is determined, and the obtained gradient vector is dimensionality reduced by linear discriminant analysis. The dimensionality-reduced gradient vector is used as the perturbation vector of the confidence region feature point set.

[0024] Based on the changes in predicted labels of each model before and after combining the confidence region feature point set with the disturbance vector, a model feature identifier set corresponding to the smart grid deep model set is generated; and

[0025] The copyright detection model to be trained is trained based on the model feature identifier set to obtain a pre-trained copyright detection model; the pre-trained copyright detection model is used to detect whether the model to be detected infringes on the copyright of the target copyright protection model.

[0026] One or more computer-readable storage media storing computer-readable instructions, which, when executed by one or more processors, cause the one or more processors to perform the following steps:

[0027] A set of deep models for smart grids is obtained; the set of deep models for smart grids includes a target copyright protection model, a target risk model and a target homomorphic model corresponding to the target copyright protection model; the target risk model is a model that has a smart grid dataset infringement problem with the target copyright protection model; the target homomorphic model is a model obtained by simulating the target copyright protection model under the same problem domain;

[0028] For each model in the smart grid deep model set, feature data samples whose distance between the corresponding model prediction value and the corresponding model discrimination boundary meets a preset condition are searched in the smart grid proprietary dataset to obtain a confidence region feature point set; the model discrimination boundary represents the region that can be predicted as other types within a preset displacement of the gradient direction of the model's inference on the feature data samples.

[0029] The gradient vector of the confidence region feature point set on the model discrimination boundary is determined, and the obtained gradient vector is dimensionality reduced by linear discriminant analysis. The dimensionality-reduced gradient vector is used as the perturbation vector of the confidence region feature point set.

[0030] Based on the changes in predicted labels of each model before and after combining the confidence region feature point set with the disturbance vector, a model feature identifier set corresponding to the smart grid deep model set is generated; and

[0031] The copyright detection model to be trained is trained based on the model feature identifier set to obtain a pre-trained copyright detection model; the pre-trained copyright detection model is used to detect whether the model to be detected infringes on the copyright of the target copyright protection model.

[0032] A computer program product includes a computer program that, when executed by one or more processors, causes the one or more processors to perform the following steps:

[0033] A set of deep models for smart grids is obtained; the set of deep models for smart grids includes a target copyright protection model, a target risk model and a target homomorphic model corresponding to the target copyright protection model; the target risk model is a model that has a smart grid dataset infringement problem with the target copyright protection model; the target homomorphic model is a model obtained by simulating the target copyright protection model under the same problem domain;

[0034] For each model in the smart grid deep model set, feature data samples whose distance between the corresponding model prediction value and the corresponding model discrimination boundary meets a preset condition are searched in the smart grid proprietary dataset to obtain a confidence region feature point set; the model discrimination boundary represents the region that can be predicted as other types within a preset displacement of the gradient direction of the model's inference on the feature data samples.

[0035] The gradient vector of the confidence region feature point set on the model discrimination boundary is determined, and the obtained gradient vector is dimensionality reduced by linear discriminant analysis. The dimensionality-reduced gradient vector is used as the perturbation vector of the confidence region feature point set.

[0036] Based on the changes in predicted labels of each model before and after combining the confidence region feature point set with the disturbance vector, a model feature identifier set corresponding to the smart grid deep model set is generated; and

[0037] The copyright detection model to be trained is trained based on the model feature identifier set to obtain a pre-trained copyright detection model; the pre-trained copyright detection model is used to detect whether the model to be detected infringes on the copyright of the target copyright protection model.

[0038] The aforementioned method, apparatus, system, computer-readable storage medium, and computer program product for copyright protection of deep learning models for smart grids based on model confidence regions acquire a target copyright protection model, as well as a target risk model and a target homomorphic model corresponding to the target copyright protection model. The target risk model is a model that has a smart grid dataset infringement problem with the target copyright protection model; the target homomorphic model is a model obtained by simulating the target copyright protection model under the same problem domain. For each model in the smart grid deep model set, feature data samples whose distance between the corresponding model prediction value and the corresponding model discrimination boundary meets preset conditions are searched in the smart grid proprietary dataset to obtain a confidence region feature point set. This ensures that the acquired confidence region feature point set can accurately describe the confidence region information of the deep learning model. Then, the gradient vector of the confidence region feature point set on the model discrimination boundary is... Dimensionality reduction is performed using linear discriminant analysis to obtain the perturbation vector of the confidence region feature point set. This allows for the accurate generation of a model feature identifier set corresponding to the deep model set of the smart grid, based on the combination of the confidence region feature point set and the perturbation vector with changes in the predicted labels before and after the perturbation. The model feature identifier set is then used to train the copyright detection model to be trained, resulting in a pre-trained copyright detection model. This pre-trained model can be used to detect whether the model under test infringes on the copyright of the target copyright protection model, effectively preventing attackers from impersonating users and participating in model training during iterations after training begins. Simultaneously, by extracting the confidence region features of the model to generate feature identifiers, risky models and homomorphic models can be effectively distinguished, improving the accuracy and robustness of feature identifier matching, ensuring the copyright security of the dataset deployed in the smart grid, and preventing data leakage and unauthorized use.

[0039] Details of one or more embodiments of this application are set forth in the following drawings and description. Other features and advantages of this application will become apparent from the specification, drawings, and claims. Attached Figure Description

[0040] To more clearly illustrate the technical solutions in the embodiments of this application or the conventional technology, the drawings used in the description of the embodiments or the conventional technology will be briefly introduced below. Obviously, the drawings described below are only embodiments of this application. For those skilled in the art, other drawings can be obtained based on the disclosed drawings without creative effort.

[0041] Figure 1 is a flowchart illustrating a copyright protection method for a deep learning model for smart grids based on model confidence domain, according to one or more embodiments.

[0042] Figure 2 is a flowchart illustrating a copyright protection method for a deep learning model of a smart grid based on model confidence region in another embodiment;

[0043] Figure 3 is a flowchart illustrating another copyright protection method for a deep learning model for smart grids based on model confidence domain, according to one or more embodiments.

[0044] Figure 4 is a structural block diagram of a copyright protection device for a smart grid deep learning model based on model confidence domain according to one or more embodiments;

[0045] Figure 5 is an internal structural diagram of a computer device according to one or more embodiments. Detailed Implementation

[0046] The technical solutions of the embodiments of this application will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of this application, and not all embodiments. Based on the embodiments of this application, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of this application.

[0047] To make the objectives, technical solutions, and advantages of this application clearer, the following detailed description is provided in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are merely illustrative and not intended to limit the scope of this application.

[0048] It should be noted that the terms "first," "second," etc., used in the specification, claims, and accompanying drawings of this disclosure are used to distinguish similar objects and are not necessarily used to describe a specific order or sequence. It should be understood that such data can be interchanged where appropriate so that the embodiments of this disclosure described herein can be implemented in orders other than those illustrated or described herein. The embodiments described in the following exemplary embodiments do not represent all embodiments consistent with this disclosure. Rather, they are merely examples of apparatuses and methods consistent with some aspects of this disclosure as detailed in the appended claims.

[0049] In one embodiment, as shown in Figure 1, a copyright protection method for a deep learning model of a smart grid based on model confidence region is provided. This embodiment illustrates the method by applying it to a computer device. It is understood that the computer device can be a terminal, a server, or a system including both a terminal and a server, and the method is implemented through interaction between the terminal and the server. In this embodiment, the method includes the following steps:

[0050] Step S110: Obtain the deep model set of smart grid.

[0051] The smart grid deep model set includes the target copyright protection model, as well as the target risk model and target homomorphic model corresponding to the target copyright protection model.

[0052] Among them, the target risk model is a model that has the problem of smart grid dataset infringement with the target copyright protection model.

[0053] Among them, the target homomorphic model is a model obtained by simulating the target copyright protection model under the same problem domain.

[0054] Among them, the target copyright protection model can be a machine learning model deployed in the smart grid that requires smart grid data copyright protection.

[0055] In practical applications, the target copyright protection model can be named the smart grid copyright protection model.

[0056] In practice, computer equipment can acquire a set of deep models for smart grids; the set of deep models for smart grids includes a target copyright protection model, as well as a target risk model and a target homomorphic model corresponding to the target copyright protection model.

[0057] Among them, computer equipment can generate a target risk model through model extraction algorithms and generate a target homomorphic model using the white-box permissions of the defender.

[0058] Furthermore, computer devices can train homomorphic models by fine-tuning datasets and parameters to simulate different models within the same problem domain. Homomorphic models can be trained on the same training dataset used by the target copyright protection model during training, but with different hyperparameters or model structures. By simulating an attacker, a target risk model is generated using a model extraction algorithm. The target copyright protection model's Application Programming Interface (API) is queried multiple times, and the returned prediction results are used to simulate and train a target risk model that simulates infringement issues in the smart grid dataset.

[0059] Specifically, the detailed steps of the model extraction algorithm are as follows: An attacker simulates repeatedly querying the target copyright protection model f via an API. v In a problem domain where there is a potential for smart grid dataset leakage and copyright infringement, let the dataset be X, and the target copyright protection model be f. v The training dataset used during training is

[0060] y is the label corresponding to x. Simulate an attacker obtaining D. v A portion of the dataset, randomly selected from dataset X, is of size [size missing]. Model extraction dataset X v Where γ represents the size of the model-extracted dataset relative to the training dataset, 1.5 can be used to balance the learning of model features with the simulation of real-world attack scenarios. By querying f...v The prediction result f is obtained v (x), the dataset extracted by the model can be represented as The results are used to train a risk model, and the objective is optimized as follows: This allows the risk model to learn the features of the target copyright protection model, resulting in the target risk model f. p Where, θ and θ u These represent the neural network parameters of the target risk model and the target copyright protection model, respectively. After multiple extractions and training iterations, a risk model set F is formed. p .

[0061] In some embodiments, during the process of acquiring a deep model set of smart grids, the computer device may acquire the training dataset used by the target copyright protection model during the training process, and train the target homomorphic model on the training dataset; the target homomorphic model includes a fully homomorphic model, an architectural homomorphic model, and a problem domain homomorphic model.

[0062] The fully homomorphic model was obtained by training it multiple times under the same experimental settings as the target copyright protection model.

[0063] Among them, the architecture homomorphic model is obtained by fine-tuning the hyperparameters during training and training multiple times under the premise that the architecture is the same as that of the target copyright protection model.

[0064] Among them, the problem domain homomorphic model is obtained by training multiple times using the same source dataset as the target copyright protection model, under the premise of a preset similar model structure and a randomly selected combination of hyperparameters.

[0065] Specifically, during the training of the homomorphic model, considering the need to distinguish between the target copyright protection model and the homomorphic model as much as possible during the subsequent training phase of the recognition network, the entire training dataset D is used. v Training is performed. Based on the similarity between the target homomorphic model and the target copyright protection model, the target homomorphic model set F is... s Divided into the following three subsets: fully homomorphic models F sp Architectural homomorphic model F sa Problem domain homomorphic model F sd Among them, the fully homomorphic model F sp The model F represents the result of multiple training runs under the same experimental settings as the target copyright protection model, and is a homomorphic model. sa This represents the result of multiple training runs, where the hyperparameters, such as learning rate, batch size, and optimizer selection, are fine-tuned while maintaining the same architecture as the target copyright protection model. The model F represents the homomorphic model in the problem domain. sdThis represents the results of training using only the same source dataset, with pre-defined similar model structures and randomly selected hyperparameter combinations. The combination f v F p With F s It can build a deep model set F for smart grids.

[0066] Step S120: For each model in the deep model set of smart grid, search for feature data samples in the smart grid proprietary dataset whose distance between the corresponding model prediction value and the corresponding model discrimination boundary meets the preset conditions, and obtain the confidence region feature point set.

[0067] The model discrimination boundary represents regions that can be predicted as other types within a preset displacement of the gradient direction of the model's inference on the feature data samples.

[0068] Furthermore, before obtaining the feature point set of the confidence region, data augmentation processing is performed on the smart grid-specific dataset to generate an enhanced smart grid-specific dataset. Data augmentation methods for the image dataset within the smart grid-specific dataset include rotation, flipping, scaling, and slicing to increase data diversity; data augmentation methods for the digital dataset within the smart grid-specific dataset include adding noise and slicing data to enhance the robustness of the model.

[0069] In this way, confidence region features can be extracted from each model in the deep model set of smart grids, based on the enhanced smart grid-specific dataset. Specifically, the computer device, with white-box access to the smart grid-specific dataset, can iteratively search for feature data samples (data points) in the enhanced smart grid-specific dataset whose distance between the corresponding model prediction value and the corresponding model discrimination boundary meets a preset condition (e.g., less than a preset distance threshold). It then fuses feature data samples belonging to different labels in conjunction with the problem domain. To ensure that the obtained confidence region feature point set accurately describes the confidence region information of the deep learning model, a similarity matching method is used to find the feature data samples with the highest similarity from different label classes. Simultaneously, a heuristic iterative algorithm is used to obtain feature data samples whose similarity to the decision samples meets a preset threshold. The iterative algorithm is set to stop within the model discrimination boundary (discrimination boundary region) or end the iteration count. Here, the model discrimination boundary represents the region that can be predicted as another type within the gradient direction of the model's inference of the feature data sample. Specifically, let the gradient of model f (f∈F) with respect to the input feature data sample X be... The discrimination boundary region can then be represented as

[0070] Step S130: Determine the gradient vector of the confidence region feature point set on the model discrimination boundary, and reduce the dimension of the obtained gradient vector according to the linear discriminant analysis method. Use the dimension-reduced gradient vector as the perturbation vector of the confidence region feature point set.

[0071] In practice, after acquiring the set of feature points in the confidence region, the computer device can determine the gradient vector of the set of feature points in the confidence region on the model discrimination boundary, and reduce the dimensionality of the acquired gradient vector using the linear discriminant analysis method, and use the dimensionality-reduced gradient vector as the perturbation vector of the set of feature points in the confidence region.

[0072] Specifically, the computer device can group the gradient vectors according to the category labels and determine the mean vector μ for each category. k And the overall mean vector μ. Then, based on the mean vector μ of each category... k Given the overall mean vector μ, determine the within-class scatter matrix S. W and inter-class scatter matrix S B Then, the product of the inverse of the intra-class scatter matrix and the inter-class scatter matrix is ​​calculated. The eigenvalues ​​and eigenvectors are used to select eigenvectors whose cumulative contribution rate meets a preset condition (e.g., the top 95% cumulative contribution rate). These eigenvectors are then used to project the original gradient vector into a low-dimensional space to complete the dimensionality reduction process, resulting in the dimensionality-reduced gradient vector. The dimensionality-reduced gradient vector is then used as the perturbation vector for the set of feature points in the confidence region.

[0073] Step S140: Based on the changes in prediction labels before and after combining the confidence domain feature point set and the disturbance vector for each model, generate the model feature identifier set corresponding to the deep model set of the smart grid.

[0074] In practice, the computer device can record the changes in the predicted labels of each model before and after combining the feature point set in the confidence region with the perturbation vector. The generation function of the model feature label F′ can be expressed as: F′(f,X,v)={f(x),f(x+v)|x∈X}. Where X is the feature point set in the confidence region, and v is the linearly reduced gradient vector (i.e., the gradient vector after dimensionality reduction).

[0075] Step S150: Train the copyright detection model to be trained according to the model feature identifier set to obtain the pre-trained copyright detection model.

[0076] Among them, the pre-trained copyright detection model is used to detect whether the model under test infringes on the copyright of the target copyright protection model.

[0077] In practice, computer equipment can train the copyright detection model to be trained based on the model feature identifier set to obtain a pre-trained copyright detection model. The pre-trained copyright detection model is used to detect whether the model to be detected infringes on the copyright of the target copyright protection model.

[0078] Furthermore, the computer device can expand the model feature identifier set using a subset search of the same source data to increase the diversity of the training data, thereby obtaining an expanded model feature identifier set. Based on the expanded model feature identifier set, the copyright detection model to be trained can be trained.

[0079] The specific method for searching homogeneous data subsets is as follows: The computer device can divide the model feature identifier set into k subsets, and each model feature identifier in the model feature identifier set is treated as a data point; each subset includes a core point; the core point is represented by a randomly selected core point from the model feature identifier set; the distance from each data point to each core point is determined, and each data point is assigned to the subset to which the nearest core point belongs; the core point of each subset is updated to the mean of all data points in that subset, and the steps for determining the distance from each data point to each core point are returned, until the core point no longer changes or the maximum number of iterations is reached, and data augmentation processing is performed on the data points in each subset to obtain the expanded model feature identifier set D. f .

[0080] In some embodiments, the copyright detection model to be trained includes an autoencoder recognition network and a mapping network. The computer device can train the recognition network and the mapping network using a self-supervised learning method, and then use the expanded model feature set D. f The model feature labels in the dataset are mapped to a low-dimensional representation space. The goal of self-supervised learning is to make data points of the same class as close as possible to each other in the representation space, and to maximize the distance between data points of different classes. Specifically, the expanded model feature label set D is... f Dividing the dataset into training and testing sets, a self-supervised learning method is used to train the recognition network, ensuring that data points of the same class are as close as possible in the representation space, and data points of different classes are as far apart as possible. The performance of the recognition network is then verified to ensure it can accurately distinguish the feature labels of different models. First, feature label data is prepared by expanding the model feature label set D. f Divided into training set D train and test set D test The training set is used to train the recognition network and the mapping network, and the test set is used to verify the network's performance. Let D be the feature set of the expanded model. f Contains N f There are 3 samples, each sample consisting of feature points x. i The tag y i Label y after superimposing dimensionality-reduced feature vectorsiv Composition, i.e. {(y i ,y iv )}, where i = 1, 2, ..., N f .

[0081] Furthermore, the recognition network employs an autoencoder structure, comprising two parts: an encoder and a decoder. The encoder converts the input high-dimensional feature identifier data {(y i ,y iv Mapped to a low-dimensional representation vector z i The decoder will represent the low-dimensional vector z i Restored to high-dimensional data {(y i ,y iv )}.

[0082] The encoder section consists of N n The encoder consists of L fully connected layers, each followed by a ReLU activation function. Assuming the encoder contains L layers, the output of the Lth layer is expressed as: Among them, W (l) and b (l) These are the weight matrix and bias vector of the l-th layer, respectively. The input data is N. The decoder part is symmetrical to the encoder and also consists of N. n The decoder consists of fully connected layers, each followed by a ReLU activation function. The output of the decoder is the restored high-dimensional data.

[0083] The mapping network consists of three identical sub-networks that share weights and structure. Each sub-network receives a low-dimensional representation vector as input and outputs a new low-dimensional representation vector. These three sub-networks process anchor points, positive samples, and negative samples, respectively. Each sub-network consists of several fully connected layers, each followed by a ReLU activation function. Self-supervised learning is used to transform the low-dimensional representation vector z output by the recognition network. i This maps to the final representation vector. The goal of self-supervised learning is to make data points of the same class as close as possible to each other in the representation space, and to make data points of different classes as far apart as possible. Let the model feature label be z. i Its opposite is Negative pairs are The loss function L for self-supervised learning can be expressed as:

[0084] in, express same attitude, express The same attitude.

[0085] Cosine similarity can be used to represent:

[0086] In the aforementioned method for copyright protection of deep learning models for smart grids based on model confidence regions, the following steps are taken: First, a target copyright protection model, a corresponding target risk model, and a target homomorphic model are obtained. The target risk model is a model that has a smart grid dataset infringement problem with the target copyright protection model. The target homomorphic model is a model obtained by simulating the target copyright protection model under the same problem domain. Then, for each model in the smart grid deep model set, feature data samples whose distance between the corresponding model prediction value and the corresponding model discrimination boundary meets preset conditions are searched in the smart grid proprietary dataset to obtain a confidence region feature point set. This ensures that the obtained confidence region feature point set can accurately describe the confidence region information of the deep learning model. Finally, the gradient vector of the confidence region feature point set on the model discrimination boundary is processed using linear discriminant analysis. Dimensionality reduction is performed to obtain the perturbation vector of the confidence domain feature point set. This allows for the accurate generation of a model feature identifier set corresponding to the deep model set of the smart grid, based on the combination of the confidence domain feature point set and the perturbation vector with changes in the predicted labels before and after the perturbation. The model feature identifier set is then used to train the copyright detection model to be trained, resulting in a pre-trained copyright detection model. This pre-trained model can be used to detect whether the model under test infringes on the copyright of the target copyright protection model, effectively preventing attackers from impersonating users and participating in model training during iterations after training begins. Simultaneously, by extracting the confidence domain features of the model to generate feature identifiers, risky models and homomorphic models can be effectively distinguished, improving the accuracy and robustness of feature identifier matching, ensuring the copyright security of the dataset deployed in the smart grid, and preventing data leakage and unauthorized use.

[0087] In some embodiments, a computer device can utilize a pre-trained copyright detection model to detect whether a model under test infringes on the copyright of a target copyright-protected model. First, model feature identifiers corresponding to all models in the smart grid deep model set are obtained. For the model under test, a model feature identifier corresponding to the model under test is generated according to the method described above for extracting model feature identifiers. The generated model feature identifier is matched with the target copyright-protected model feature identifier, and the similarity between the model feature identifiers is calculated. Similarity can be represented as the cosine similarity between the model feature identifier under test and the model feature identifier in the representation space. Based on the cosine similarity between the model feature identifier under test and the model feature identifier of the target copyright-protected model, it is determined whether the model under test infringes on the data copyright of the target copyright-protected model. If the similarity exceeds a threshold, it is determined that the model under test infringes on the copyright of the target copyright-protected model, thereby ensuring the copyright security of the dataset deployed in the smart grid and preventing data leakage and unauthorized use.

[0088] Furthermore, based on the model feature identifiers of the target risk model and the target homomorphic model, and their similarity with the feature identifiers of the model to be detected, it can be determined whether the model to be detected is a risk model or a homomorphic model, thus effectively distinguishing between risk models and homomorphic models and improving the accuracy and robustness of feature identifier matching.

[0089] In one embodiment, as shown in Figure 2, a copyright protection method for a deep learning model of a smart grid based on the model confidence region is provided. Taking the application of this method to a computer device as an example, the method includes the following steps:

[0090] Step S202: Obtain the deep model set of smart grid. For each model in the deep model set of smart grid, search for feature data samples in the smart grid proprietary dataset whose distance between the corresponding model prediction value and the corresponding model discrimination boundary meets the preset conditions, and obtain the confidence region feature point set.

[0091] Step S204: Determine the gradient vector of the confidence region feature point set on the model discrimination boundary, group the gradient vectors according to the category label, and determine the mean vector of each category and the overall mean vector.

[0092] Step S206: Determine the intra-class scatter matrix and inter-class scatter matrix based on the mean vector of each class and the overall mean vector.

[0093] Step S208: By solving the eigenvalues ​​and eigenvectors of the product of the inverse matrix of the intra-class scatter matrix and the inter-class scatter matrix, the eigenvectors whose cumulative contribution rate meets the preset conditions are selected for dimensionality reduction processing to obtain the dimensionality-reduced gradient vector. The dimensionality-reduced gradient vector is used as the perturbation vector of the feature point set in the confidence region.

[0094] Step S210: Based on the changes in the predicted labels of each model before and after combining the confidence domain feature point set with the disturbance vector, generate the model feature identifier set corresponding to the deep model set of the smart grid.

[0095] Step S212: Expand the model feature identifier set by searching for subsets of the same source data to obtain the expanded model feature identifier set.

[0096] Step S214: Train the copyright detection model to be trained using the expanded model feature identifier set.

[0097] It should be noted that the specific limitations of the above steps can be found in the above description of the specific limitations of a copyright protection method for a deep learning model for smart grids based on model confidence regions.

[0098] In one embodiment, to facilitate understanding by those skilled in the art, Figure 3 provides a flowchart illustrating another method for copyright protection of deep learning models for smart grids based on model confidence domains. As shown in Figure 3, the copyright protection method for deep learning models for smart grids based on model confidence domains in this embodiment can be divided into four parts: S1, preparation stage of deep learning model set for smart grids, generating a target risk model through model extraction algorithms, and generating a target homomorphic model by fine-tuning the dataset and parameters, thereby building a deep learning model set for smart grids; S2, generation stage of confidence domain feature identifier set, performing data augmentation on the smart grid-specific dataset, extracting the model discrimination boundary to determine the confidence domain feature point set, and obtaining the dimensionality-reduced gradient vector through linear discriminant analysis; S3, model feature identifier set expansion and recognition network training stage, expanding the model feature identifier set through a subset search of source data, training an autoencoder recognition network, and comparing and learning the mapping network; S4, copyright detection stage of deep learning models for smart grids, generating model feature identifiers corresponding to all models in the deep learning model set for smart grids, calculating the spatial similarity of model feature identifiers through the recognition network, and judging the privacy infringement threshold.

[0099] It should be noted that the specific limitations of the above steps can be found in the above description of the specific limitations of a copyright protection method for a deep learning model for smart grids based on model confidence regions.

[0100] It should be understood that although the steps in the flowcharts of the embodiments described above are shown sequentially according to the arrows, these steps are not necessarily executed in the order indicated by the arrows. Unless explicitly stated herein, there is no strict order restriction on the execution of these steps, and they can be executed in other orders. Moreover, at least some steps in the flowcharts of the embodiments described above may include multiple steps or multiple stages. These steps or stages are not necessarily completed at the same time, but can be executed at different times. The execution order of these steps or stages is not necessarily sequential, but can be performed alternately or in turn with other steps or at least some of the steps or stages of other steps.

[0101] Based on the same inventive concept, this application also provides a model confidence region-based deep learning model copyright protection device for smart grids, used to implement the aforementioned model confidence region-based deep learning model copyright protection method for smart grids. The solution provided by this device is similar to the implementation described in the above method. Therefore, the specific limitations of one or more model confidence region-based deep learning model copyright protection device embodiments provided below can be found in the limitations of the model confidence region-based deep learning model copyright protection method for smart grids described above, and will not be repeated here.

[0102] In one exemplary embodiment, as shown in FIG4, a copyright protection device for a deep learning model of a smart grid based on model confidence region is provided, including: an acquisition module 410, a search module 420, a determination module 430, a generation module 440, and a training module 450, wherein:

[0103] The acquisition module 410 is used to acquire a deep model set of smart grids; the deep model set of smart grids includes a target copyright protection model, as well as a target risk model and a target homomorphic model corresponding to the target copyright protection model; the target risk model is a model that has a smart grid dataset infringement problem with the target copyright protection model; the target homomorphic model is a model obtained by simulating the target copyright protection model under the same problem domain;

[0104] The search module 420 is used to search for feature data samples in the smart grid proprietary dataset for each model in the smart grid deep model set, where the distance between the corresponding model prediction value and the corresponding model discrimination boundary meets a preset condition, to obtain a set of confidence region feature points; the model discrimination boundary represents the region that can be predicted as other types within a preset displacement of the gradient direction of the model's inference on the feature data samples.

[0105] The determination module 430 is used to determine the gradient vector of the confidence region feature point set on the model discrimination boundary, and to reduce the dimension of the obtained gradient vector according to the linear discriminant analysis method, and use the dimension-reduced gradient vector as the perturbation vector of the confidence region feature point set.

[0106] Generation module 440 is used to generate a model feature identifier set corresponding to the smart grid deep model set based on the predicted label changes of each model before and after combining the confidence region feature point set with the disturbance vector; and

[0107] The training module 450 is used to train the copyright detection model to be trained based on the model feature identifier set to obtain a pre-trained copyright detection model; the pre-trained copyright detection model is used to detect whether the model to be detected infringes the copyright of the target copyright protection model.

[0108] In one embodiment, the determining module 430 is specifically used to group the gradient vectors according to category labels, determine the mean vector and the overall mean vector of each category; determine the intra-class scatter matrix and the inter-class scatter matrix based on the mean vector and the overall mean vector of each category; and select the feature vectors whose cumulative contribution rate meets the preset conditions for dimensionality reduction by solving the eigenvalues ​​and eigenvectors of the product of the inverse matrix of the intra-class scatter matrix and the inter-class scatter matrix, thereby obtaining the dimensionality-reduced gradient vector.

[0109] In one embodiment, the training module 450 is specifically used to expand the model feature identifier set by searching for subsets of the same source data to obtain an expanded model feature identifier set; and to train the copyright detection model to be trained using the expanded model feature identifier set.

[0110] In one embodiment, the training module 450 is specifically configured to divide the model feature identifier set into k subsets, and treat each model feature identifier in the model feature identifier set as a data point; each subset includes a core point; the core point is represented as a randomly selected data point in the model feature identifier set; determine the distance from each data point to each core point, and assign each data point to the subset to which the nearest core point belongs; update the core point of each subset to the mean of all data points in that subset, and return to the step of determining the distance from each data point to each core point, until the core point no longer changes or the maximum number of iterations is reached, and perform data augmentation processing on the data points in each subset to obtain the expanded model feature identifier set.

[0111] In one embodiment, the acquisition module 410 is specifically used to acquire the training dataset used by the target copyright protection model during the training process, and to train the target homomorphic model on the training dataset; the target homomorphic model includes a fully homomorphic model, an architecture homomorphic model, and a problem domain homomorphic model; the fully homomorphic model is obtained by training multiple times under the premise that all experimental settings are the same as those of the target copyright protection model; the architecture homomorphic model is obtained by training multiple times under the premise that the hyperparameters are fine-tuned during training, while using the same source dataset as the target copyright protection model, with a preset similar model structure and a randomly selected combination of hyperparameters.

[0112] In one embodiment, the copyright detection model to be trained includes an autoencoder recognition network and a mapping network. The training module 450 is specifically used to train the autoencoder recognition network and the mapping network using a self-supervised learning method, mapping the model feature identifier set to a low-dimensional representation space; and if the model feature identifier is Z... i The positive pair of the model feature identifier is The negative pairs of the model feature identifier are The loss function L for self-supervised learning can be expressed as:

[0113] in, express same attitude, express The same attitude.

[0114] The modules in the aforementioned copyright protection device for the deep learning model of smart grid based on model confidence region can be implemented entirely or partially through software, hardware, or a combination thereof. These modules can be embedded in or independent of the processor in a computer device, or stored in the memory of a computer device as software, so that the processor can call and execute the corresponding operations of each module.

[0115] In one exemplary embodiment, a computer device is provided, which can be a copyright protection system for a deep learning model of a smart grid based on model confidence domains. Its internal structure is shown in Figure 5. The computer device includes a processor, memory, input / output interfaces (I / O), and a communication interface. The processor, memory, and I / O interfaces are connected via a system bus, and the communication interface is connected to the system bus via the I / O interfaces. The processor provides computational and control capabilities. The memory includes non-volatile or volatile storage media and internal memory. The non-volatile or volatile storage media stores an operating system, computer-readable instructions, and a database. The internal memory provides an environment for the operation of the operating system and computer-readable instructions in the non-volatile or volatile storage media. The database stores model feature identifier set data. The I / O interfaces are used for exchanging information between the processor and external devices. The communication interface is used for communication with external terminals via a network connection. When the computer-readable instructions are executed by the processor, they implement a copyright protection method for a deep learning model of a smart grid based on model confidence domains.

[0116] Those skilled in the art will understand that the structure shown in Figure 5 is merely a block diagram of a portion of the structure related to the present application and does not constitute a limitation on the computer device to which the present application is applied. Specific computer devices may include more or fewer components than those shown in the figure, or may combine certain components, or may have different component arrangements.

[0117] A copyright protection system for a deep learning model of a smart grid based on a model confidence region includes a memory and one or more processors. The memory stores computer-readable instructions, which, when executed by the processors, cause the one or more processors to perform the following steps:

[0118] A set of deep models for smart grids is obtained; the set of deep models for smart grids includes a target copyright protection model, a target risk model and a target homomorphic model corresponding to the target copyright protection model; the target risk model is a model that has a smart grid dataset infringement problem with the target copyright protection model; the target homomorphic model is a model obtained by simulating the target copyright protection model under the same problem domain;

[0119] For each model in the smart grid deep model set, feature data samples whose distance between the corresponding model prediction value and the corresponding model discrimination boundary meets a preset condition are searched in the smart grid proprietary dataset to obtain a confidence region feature point set; the model discrimination boundary represents the region that can be predicted as other types within a preset displacement of the gradient direction of the model's inference on the feature data samples.

[0120] The gradient vector of the confidence region feature point set on the model discrimination boundary is determined, and the obtained gradient vector is dimensionality reduced by linear discriminant analysis. The dimensionality-reduced gradient vector is used as the perturbation vector of the confidence region feature point set.

[0121] Based on the changes in predicted labels of each model before and after combining the confidence region feature point set with the disturbance vector, a model feature identifier set corresponding to the smart grid deep model set is generated; and

[0122] The copyright detection model to be trained is trained based on the model feature identifier set to obtain a pre-trained copyright detection model; the pre-trained copyright detection model is used to detect whether the model to be detected infringes on the copyright of the target copyright protection model.

[0123] One or more computer-readable storage media storing computer-readable instructions, which, when executed by one or more processors, cause the one or more processors to perform the following steps:

[0124] A set of deep models for smart grids is obtained; the set of deep models for smart grids includes a target copyright protection model, a target risk model and a target homomorphic model corresponding to the target copyright protection model; the target risk model is a model that has a smart grid dataset infringement problem with the target copyright protection model; the target homomorphic model is a model obtained by simulating the target copyright protection model under the same problem domain;

[0125] For each model in the smart grid deep model set, feature data samples whose distance between the corresponding model prediction value and the corresponding model discrimination boundary meets a preset condition are searched in the smart grid proprietary dataset to obtain a confidence region feature point set; the model discrimination boundary represents the region that can be predicted as other types within a preset displacement of the gradient direction of the model's inference on the feature data samples.

[0126] The gradient vector of the confidence region feature point set on the model discrimination boundary is determined, and the obtained gradient vector is dimensionality reduced by linear discriminant analysis. The dimensionality-reduced gradient vector is used as the perturbation vector of the confidence region feature point set.

[0127] Based on the changes in predicted labels of each model before and after combining the confidence region feature point set with the disturbance vector, a model feature identifier set corresponding to the smart grid deep model set is generated; and

[0128] The copyright detection model to be trained is trained based on the model feature identifier set to obtain a pre-trained copyright detection model; the pre-trained copyright detection model is used to detect whether the model to be detected infringes on the copyright of the target copyright protection model.

[0129] A computer program product includes a computer program that, when executed by one or more processors, causes the one or more processors to perform the following steps:

[0130] A set of deep models for smart grids is obtained; the set of deep models for smart grids includes a target copyright protection model, a target risk model and a target homomorphic model corresponding to the target copyright protection model; the target risk model is a model that has a smart grid dataset infringement problem with the target copyright protection model; the target homomorphic model is a model obtained by simulating the target copyright protection model under the same problem domain;

[0131] For each model in the smart grid deep model set, feature data samples whose distance between the corresponding model prediction value and the corresponding model discrimination boundary meets a preset condition are searched in the smart grid proprietary dataset to obtain a confidence region feature point set; the model discrimination boundary represents the region that can be predicted as other types within a preset displacement of the gradient direction of the model's inference on the feature data samples.

[0132] The gradient vector of the confidence region feature point set on the model discrimination boundary is determined, and the obtained gradient vector is dimensionality reduced by linear discriminant analysis. The dimensionality-reduced gradient vector is used as the perturbation vector of the confidence region feature point set.

[0133] Based on the changes in predicted labels of each model before and after combining the confidence region feature point set with the disturbance vector, a model feature identifier set corresponding to the smart grid deep model set is generated; and

[0134] The copyright detection model to be trained is trained based on the model feature identifier set to obtain a pre-trained copyright detection model; the pre-trained copyright detection model is used to detect whether the model to be detected infringes on the copyright of the target copyright protection model.

[0135] It should be noted that the user information (including but not limited to user device information, user personal information, etc.) and data (including but not limited to data used for analysis, data stored, data displayed, etc.) involved in this application are all information and data authorized by the user or fully authorized by all parties, and the collection, use and processing of the relevant data must comply with relevant regulations.

[0136] Those skilled in the art will understand that all or part of the processes in the methods of the above embodiments can be implemented by instructing related hardware through computer-readable instructions. These computer-readable instructions can be stored in a non-volatile computer-readable storage medium. When executed, these computer-readable instructions can include the processes of the embodiments of the above methods. Any references to memory, databases, or other media used in the embodiments provided in this application can include at least one of non-volatile memory and volatile memory. Non-volatile memory can include read-only memory (ROM), magnetic tape, floppy disk, flash memory, optical memory, high-density embedded non-volatile memory, resistive random access memory (ReRAM), magnetic random access memory (MRAM), ferroelectric random access memory (FRAM), phase change memory (PCM), graphene memory, etc. Volatile memory can include random access memory (RAM) or external cache memory, etc. By way of illustration and not limitation, RAM can take many forms, such as Static Random Access Memory (SRAM) or Dynamic Random Access Memory (DRAM). The databases involved in the embodiments provided in this application may include at least one type of relational database and non-relational database. Non-relational databases may include, but are not limited to, blockchain-based distributed databases. The processors involved in the embodiments provided in this application may be general-purpose processors, central processing units, graphics processing units, digital signal processors, programmable logic devices, quantum computing-based data processing logic devices, artificial intelligence (AI) processors, etc., and are not limited to these.

[0137] The technical features of the above embodiments can be combined in any way. For the sake of brevity, not all possible combinations of the technical features in the above embodiments are described. However, as long as there is no contradiction in the combination of these technical features, they should be considered to be within the scope of this specification.

[0138] The embodiments described above are merely illustrative of several implementation methods of this application, and while the descriptions are relatively specific and detailed, they should not be construed as limiting the scope of the patent application. It should be noted that those skilled in the art can make various modifications and improvements without departing from the concept of this application, and these all fall within the protection scope of this application. Therefore, the protection scope of this patent application should be determined by the appended claims.

Claims

1. A copyright protection method for a deep learning model of a smart grid based on the model's confidence region, comprising: Obtain a deep model set for smart grids; the deep model set for smart grids includes a target copyright protection model, as well as a target risk model and a target homomorphic model corresponding to the target copyright protection model; the target risk model is a model that has a smart grid dataset infringement problem with the target copyright protection model. The target homomorphic model is a model obtained by simulating the target copyright protection model under the same problem domain; For each model in the smart grid deep model set, feature data samples whose distance between the corresponding model prediction value and the corresponding model discrimination boundary meets a preset condition are searched in the smart grid proprietary dataset to obtain a confidence region feature point set; the model discrimination boundary represents the region that can be predicted as other types within a preset displacement of the gradient direction of the model's inference on the feature data samples. The gradient vector of the confidence region feature point set on the model discrimination boundary is determined, and the obtained gradient vector is dimensionality reduced by linear discriminant analysis. The dimensionality-reduced gradient vector is used as the perturbation vector of the confidence region feature point set. Based on the changes in predicted labels of each model before and after combining the confidence region feature point set with the disturbance vector, a model feature identifier set corresponding to the smart grid deep model set is generated; and The copyright detection model to be trained is trained based on the model feature identifier set to obtain a pre-trained copyright detection model; the pre-trained copyright detection model is used to detect whether the model to be detected infringes on the copyright of the target copyright protection model.

2. The method according to claim 1, wherein, The step of determining the gradient vector of the confidence region feature point set on the model discriminant boundary, and performing dimensionality reduction on the obtained gradient vector using linear discriminant analysis, includes: The gradient vectors are grouped according to the category labels to determine the mean vector of each category and the overall mean vector; Based on the mean vector of each category and the overall mean vector, determine the within-class scatter matrix and the between-class scatter matrix; and By solving for the eigenvalues ​​and eigenvectors of the product of the inverse matrix of the intra-class scatter matrix and the inter-class scatter matrix, eigenvectors whose cumulative contribution rate meets the preset conditions are selected for dimensionality reduction processing to obtain the dimensionality-reduced gradient vector.

3. The method according to claim 1, wherein, The step of training the copyright detection model to be trained based on the model feature identifier set includes: The model feature identifier set is expanded by searching for subsets of data from the same source, resulting in an expanded model feature identifier set; and The copyright detection model to be trained is trained using the expanded model feature identifier set.

4. The method according to claim 3, wherein, The expansion of the model feature identifier set through a subset search of common data to obtain the expanded model feature identifier set includes: The model feature identifier set is divided into k subsets, and each model feature identifier in the model feature identifier set is taken as a data point; each subset includes a core point; the core point is represented by a random selection obtained from the model feature identifier set; Determine the distance from each data point to each core point, and assign each data point to the subset to which the nearest core point belongs; and The core point of each subset is updated to the mean of all data points in that subset, and the step of determining the distance from each data point to each core point is returned until the core point no longer changes or the maximum number of iterations is reached. Data augmentation processing is performed on the data points in each subset to obtain the expanded model feature identifier set.

5. The method according to claim 1, wherein, The acquisition of the deep model set of smart grids includes: Obtain the training dataset used by the target copyright protection model during the training process, and train the target homomorphic model on the training dataset; the target homomorphic model includes a fully homomorphic model, an architecture homomorphic model, and a problem domain homomorphic model. The fully homomorphic model is obtained by training it multiple times under the same experimental settings as the target copyright protection model. The homomorphic architecture model is obtained by fine-tuning the hyperparameters during training and performing multiple training runs, while maintaining the same architecture as the target copyright protection model. The problem domain homomorphic model is obtained by training multiple times using the same source dataset as the target copyright protection model, under a preset similar model structure and a randomly selected combination of hyperparameters.

6. The method according to claim 1, wherein, The copyright detection model to be trained includes an autoencoder recognition network and a mapping network. Training the copyright detection model to be trained based on the model feature identifier set includes: The autoencoder recognition network and the mapping network are trained using a self-supervised learning method to map the model feature set to a low-dimensional representation space; and If the model feature identifier is z i The positive pair of the model feature identifier is The negative pairs of the model feature identifier are The loss function L for self-supervised learning can be expressed as: in, Indicate z i , same attitude, Indicate z i , The same attitude.

7. A copyright protection device for a deep learning model of a smart grid based on the model's confidence region, comprising: An acquisition module is used to acquire a set of deep models for smart grids; the set of deep models for smart grids includes a target copyright protection model, as well as a target risk model and a target homomorphic model corresponding to the target copyright protection model; the target risk model is a model that has a smart grid dataset infringement problem with the target copyright protection model; the target homomorphic model is a model obtained by simulating the target copyright protection model under the same problem domain; The search module is used to search for feature data samples in the smart grid proprietary dataset for each model in the smart grid deep model set, where the distance between the corresponding model prediction value and the corresponding model discrimination boundary meets a preset condition, to obtain a set of confidence region feature points; the model discrimination boundary represents regions that can be predicted as other types within a preset displacement of the gradient direction of the model's inference on the feature data samples. The determination module is used to determine the gradient vector of the confidence region feature point set on the model discrimination boundary, and to reduce the dimension of the obtained gradient vector according to the linear discriminant analysis method, and use the dimension-reduced gradient vector as the perturbation vector of the confidence region feature point set. The generation module is used to generate a model feature identifier set corresponding to the deep model set of the smart grid based on the changes in the predicted labels before and after combining the feature point set of the confidence region with the disturbance vector for each model. and The training module is used to train the copyright detection model to be trained based on the model feature identifier set to obtain a pre-trained copyright detection model; the pre-trained copyright detection model is used to detect whether the model to be detected infringes the copyright of the target copyright protection model.

8. A copyright protection system for a deep learning model of a smart grid based on a model confidence region, comprising a memory and one or more processors, wherein the memory stores computer-readable instructions, and when executed by the one or more processors, the one or more processors perform the following steps: Obtain a deep model set for smart grids; the deep model set for smart grids includes a target copyright protection model, as well as a target risk model and a target homomorphic model corresponding to the target copyright protection model; the target risk model is a model that has a smart grid dataset infringement problem with the target copyright protection model. The target homomorphic model is a model obtained by simulating the target copyright protection model under the same problem domain; For each model in the smart grid deep model set, feature data samples whose distance between the corresponding model prediction value and the corresponding model discrimination boundary meets a preset condition are searched in the smart grid proprietary dataset to obtain a confidence region feature point set; the model discrimination boundary represents the region that can be predicted as other types within a preset displacement of the gradient direction of the model's inference on the feature data samples. The gradient vector of the confidence region feature point set on the model discrimination boundary is determined, and the obtained gradient vector is dimensionality reduced by linear discriminant analysis. The dimensionality-reduced gradient vector is used as the perturbation vector of the confidence region feature point set. Based on the changes in predicted labels of each model before and after combining the confidence region feature point set with the disturbance vector, a model feature identifier set corresponding to the smart grid deep model set is generated; and The copyright detection model to be trained is trained based on the model feature identifier set to obtain a pre-trained copyright detection model; the pre-trained copyright detection model is used to detect whether the model to be detected infringes on the copyright of the target copyright protection model.

9. The system according to claim 8, wherein, When the processor executes the computer-readable instructions, it also performs the following steps: The gradient vectors are grouped according to the category labels to determine the mean vector of each category and the overall mean vector; Based on the mean vector of each category and the overall mean vector, determine the within-class scatter matrix and the between-class scatter matrix; and By solving for the eigenvalues ​​and eigenvectors of the product of the inverse matrix of the intra-class scatter matrix and the inter-class scatter matrix, eigenvectors whose cumulative contribution rate meets the preset conditions are selected for dimensionality reduction processing to obtain the dimensionality-reduced gradient vector.

10. The system according to claim 8, wherein, When the processor executes the computer-readable instructions, it also performs the following steps: The model feature identifier set is expanded by searching for subsets of data from the same source, resulting in an expanded model feature identifier set; and The copyright detection model to be trained is trained using the expanded model feature identifier set.

11. The system according to claim 10, wherein, When the processor executes the computer-readable instructions, it also performs the following steps: The model feature identifier set is divided into k subsets, and each model feature identifier in the model feature identifier set is taken as a data point; each subset includes a core point; the core point is represented by a random selection obtained from the model feature identifier set; Determine the distance from each data point to each core point, and assign each data point to the subset to which the nearest core point belongs; and The core point of each subset is updated to the mean of all data points in that subset, and the step of determining the distance from each data point to each core point is returned until the core point no longer changes or the maximum number of iterations is reached. Data augmentation processing is performed on the data points in each subset to obtain the expanded model feature identifier set.

12. The system according to claim 8, wherein, When the processor executes the computer-readable instructions, it also performs the following steps: Obtain the training dataset used by the target copyright protection model during the training process, and train the target homomorphic model on the training dataset; the target homomorphic model includes a fully homomorphic model, an architecture homomorphic model, and a problem domain homomorphic model. The fully homomorphic model is obtained by training it multiple times under the same experimental settings as the target copyright protection model. The homomorphic architecture model is obtained by fine-tuning the hyperparameters during training and performing multiple training runs, while maintaining the same architecture as the target copyright protection model. The problem domain homomorphic model is obtained by training multiple times using the same source dataset as the target copyright protection model, under a preset similar model structure and a randomly selected combination of hyperparameters.

13. The system according to claim 8, wherein, The copyright detection model to be trained includes an autoencoder recognition network and a mapping network. When the processor executes the computer-readable instructions, it also performs the following steps: The autoencoder recognition network and the mapping network are trained using a self-supervised learning method to map the model feature set to a low-dimensional representation space; and If the model feature identifier is z i The positive pair of the model feature identifier is The negative pairs of the model feature identifier are The loss function L for self-supervised learning can be expressed as: in, Indicate z i , same attitude, Indicate z i , The same attitude.

14. One or more computer-readable storage media storing computer-readable instructions, which, when executed by one or more processors, cause the one or more processors to perform the following steps: Obtain a deep model set for smart grids; the deep model set for smart grids includes a target copyright protection model, as well as a target risk model and a target homomorphic model corresponding to the target copyright protection model; the target risk model is a model that has a smart grid dataset infringement problem with the target copyright protection model. The target homomorphic model is a model obtained by simulating the target copyright protection model under the same problem domain; For each model in the smart grid deep model set, feature data samples whose distance between the corresponding model prediction value and the corresponding model discrimination boundary meets a preset condition are searched in the smart grid proprietary dataset to obtain a confidence region feature point set; the model discrimination boundary represents the region that can be predicted as other types within a preset displacement of the gradient direction of the model's inference on the feature data samples. The gradient vector of the confidence region feature point set on the model discrimination boundary is determined, and the obtained gradient vector is dimensionality reduced by linear discriminant analysis. The dimensionality-reduced gradient vector is used as the perturbation vector of the confidence region feature point set. Based on the changes in predicted labels of each model before and after combining the confidence region feature point set with the disturbance vector, a model feature identifier set corresponding to the smart grid deep model set is generated; and The copyright detection model to be trained is trained based on the model feature identifier set to obtain a pre-trained copyright detection model; the pre-trained copyright detection model is used to detect whether the model to be detected infringes on the copyright of the target copyright protection model.

15. The storage medium according to claim 14, wherein, When the computer-readable instructions are executed by the processor, the following steps are also performed: The gradient vectors are grouped according to the category labels to determine the mean vector of each category and the overall mean vector; Based on the mean vector of each category and the overall mean vector, determine the within-class scatter matrix and the between-class scatter matrix; and By solving for the eigenvalues ​​and eigenvectors of the product of the inverse matrix of the intra-class scatter matrix and the inter-class scatter matrix, eigenvectors whose cumulative contribution rate meets the preset conditions are selected for dimensionality reduction processing to obtain the dimensionality-reduced gradient vector.

16. The storage medium according to claim 14, wherein, When the computer-readable instructions are executed by the processor, the following steps are also performed: The model feature identifier set is expanded by searching for subsets of data from the same source, resulting in an expanded model feature identifier set; and The copyright detection model to be trained is trained using the expanded model feature identifier set.

17. The storage medium according to claim 16, wherein, When the computer-readable instructions are executed by the processor, the following steps are also performed: The model feature identifier set is divided into k subsets, and each model feature identifier in the model feature identifier set is taken as a data point; each subset includes a core point; the core point is represented by a random selection obtained from the model feature identifier set; Determine the distance from each data point to each core point, and assign each data point to the subset to which the nearest core point belongs; and The core point of each subset is updated to the mean of all data points in that subset, and the step of determining the distance from each data point to each core point is returned until the core point no longer changes or the maximum number of iterations is reached. Data augmentation processing is performed on the data points in each subset to obtain the expanded model feature identifier set.

18. The storage medium according to claim 14, wherein, When the computer-readable instructions are executed by the processor, the following steps are also performed: Obtain the training dataset used by the target copyright protection model during the training process, and train the target homomorphic model on the training dataset; the target homomorphic model includes a fully homomorphic model, an architecture homomorphic model, and a problem domain homomorphic model. The fully homomorphic model is obtained by training it multiple times under the same experimental settings as the target copyright protection model. The homomorphic architecture model is obtained by fine-tuning the hyperparameters during training and performing multiple training runs, while maintaining the same architecture as the target copyright protection model. The problem domain homomorphic model is obtained by training multiple times using the same source dataset as the target copyright protection model, under a preset similar model structure and a randomly selected combination of hyperparameters.

19. The storage medium according to claim 14, wherein, The copyright detection model to be trained includes an autoencoder recognition network and a mapping network. When the computer-readable instructions are executed by the processor, the following steps are also performed: The autoencoder recognition network and the mapping network are trained using a self-supervised learning method to map the model feature set to a low-dimensional representation space; and If the model feature identifier is z i The positive pair of the model feature identifier is The negative pairs of the model feature identifier are The loss function L for self-supervised learning can be expressed as: in, Indicate z i , same attitude, Indicate z i , The same attitude.

20. A computer program product comprising a computer program that, when executed by one or more processors, causes the one or more processors to perform the following steps: Obtain a deep model set for smart grids; the deep model set for smart grids includes a target copyright protection model, as well as a target risk model and a target homomorphic model corresponding to the target copyright protection model; the target risk model is a model that has a smart grid dataset infringement problem with the target copyright protection model. The target homomorphic model is a model obtained by simulating the target copyright protection model under the same problem domain; For each model in the smart grid deep model set, feature data samples whose distance between the corresponding model prediction value and the corresponding model discrimination boundary meets a preset condition are searched in the smart grid proprietary dataset to obtain a confidence region feature point set; the model discrimination boundary represents the region that can be predicted as other types within a preset displacement of the gradient direction of the model's inference on the feature data samples. The gradient vector of the confidence region feature point set on the model discrimination boundary is determined, and the obtained gradient vector is dimensionality reduced by linear discriminant analysis. The dimensionality-reduced gradient vector is used as the perturbation vector of the confidence region feature point set. Based on the changes in predicted labels before and after combining the confidence region feature point set with the perturbation vector by each model, a model feature identifier set corresponding to the deep model set of the smart grid is generated; and the copyright detection model to be trained is trained based on the model feature identifier set to obtain a pre-trained copyright detection model; the pre-trained copyright detection model is used to detect whether the model to be detected infringes the copyright of the target copyright protection model.

Images