Neural network watermark embedding method and verification method

Abstract

The invention discloses a neural network watermark embedding method and a verification method. The method comprises the following steps: acquiring an original model of a neural network to be embedded with a watermark and an image training set; setting any layer of the original model as a watermark layer lwm, and adding an added sub-layer l'with the same structure as an original sub-layer l of the watermark layer to the watermark layer lwm to obtain a neural network model with a new structure; and training the neural network model added with the new structure by using the image training set and a preset forward propagation constraint condition to obtain a neural network model embedded with the watermark. The method has the advantages that the weight is not used as a carrier, common attacks such as fine tuning and pruning can be effectively resisted, and the relationship between the feature vectors can be controlled, so that the precision of the model can be greatly reduced due to watermark counterfeiting after the watermark is embedded, the model is invalid, and the model can be protected from being stolen while the ownership of the model is verified.

Description

technical field [0001] The invention relates to a neural network watermark embedding method and a verification method, belonging to the technical field of deep learning. Background technique [0002] With the development of deep learning, neural networks are widely used in autonomous driving, image recognition, natural language processing and other fields due to their excellent learning ability. However, training an efficient neural network model requires engineers to have rich professional knowledge, and consumes a lot of computing resources and time costs. Once disclosed, it is easily abused and infringed. Therefore, the copyright issue of neural networks has been widely discussed by scholars. focus on. The white-box digital watermarking method based on the internal information of neural network generally utilizes the unique topology and fitting method of neural network, and realizes copyright protection by embedding the watermark in the weight. [0003] At present, neur...

AI Technical Summary

Problems solved by technology

However, in common attacks such as fine-tuning and pruning, the weights are easily modified, resulting in less robustness of current methods

Even in extreme cases, when the weights are completely modified, the watermark becomes undetectable and hard to recover, rendering the copyright protection process completely ineffective

Images