Federated Model Ownership Verification With Watermarked Gradients
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
The challenge in horizontal Federated learning is determining whether a model has been trained using private data from an edge node, as parameter servers may misuse gradients uploaded by edge nodes for unauthorized training or purposes.
Innovation Solution
A method involving adding a specified feature to original samples to create adjusted samples with the same annotations, comparing gradients from these samples in a model to be verified and a benign model trained on original samples, and using a classifier to determine ownership based on gradient similarity.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Productivity
If the parameter server trains models using gradients uploaded by edge nodes, then model training efficiency is improved, but model ownership and data privacy cannot be verified
Solution Approach 1:
The patent applies preliminary action by embedding a specified feature (watermark) into the original samples before training. This feature is incorporated into the training data in advance, allowing the model to retain memory of the training data source. When verification is needed, this pre-embedded feature enables ownership verification without requiring retraining or additional information exchange, thus resolving the contradiction between training efficiency and ownership verification.
2Reliability
If the edge node restricts model usage to specific purposes, then data privacy is protected, but the parameter server cannot legally use the trained model for other purposes
Solution Approach 1:
The patent implements feedback by creating a verification mechanism that provides information about model ownership and training data source to the parameter server. The edge node can query the model to verify if it was trained on their data, and the model provides feedback through its predictions on specially designed verification samples. This feedback system enables the parameter server to understand model origins and usage rights, allowing flexible model deployment while maintaining data privacy through informed consent and contractual agreements.
3Measurement precision
If a watermark is embedded into training samples to verify ownership, then model ownership can be determined, but the annotation of the sample must be adjusted which reduces model prediction accuracy
Solution Approach 1:
The patent applies local quality by embedding the watermark feature in a localized manner that does not affect the overall quality of the training samples. Specifically, the specified feature is added to the input sample in a way that is localized to certain regions or dimensions of the data, while the annotation remains unchanged. This localized modification allows the model to learn the watermark pattern without compromising the general predictive performance on the original task, thus resolving the contradiction between verification accuracy and prediction accuracy.
Data Source
AI summary
This specification discloses model ownership verification methods and apparatuses, storage media, and electronic devices. The method includes: adding a specified feature to an original sample without adjusting an annotation of the original sample, to cause an annotation of an adjusted sample to be the same as the annotation of the original sample corresponding to the adjusted sample, and in a case that ownership of the model to be verified cannot be determined through the annotations, determining whether a sample for training a model to be verified comes from an edge node based on a gradient obtained by inputting the adjusted sample into the model to be verified and a gradient obtained by inputting the adjusted sample into a benign model trained through the original sample.