WO2024060852A1 - 一种模型的所有权验证方法、装置、存储介质及电子设备 - Google Patents

一种模型的所有权验证方法、装置、存储介质及电子设备 Download PDF

Info

Publication number
WO2024060852A1
WO2024060852A1 PCT/CN2023/110871 CN2023110871W WO2024060852A1 WO 2024060852 A1 WO2024060852 A1 WO 2024060852A1 CN 2023110871 W CN2023110871 W CN 2023110871W WO 2024060852 A1 WO2024060852 A1 WO 2024060852A1
Authority
WO
WIPO (PCT)
Prior art keywords
model
gradient
sample
samples
adjusted
Prior art date
Application number
PCT/CN2023/110871
Other languages
English (en)
French (fr)
Inventor
李一鸣
刘焱
朱玲慧
翁海琴
江勇
夏树涛
Original Assignee
支付宝(杭州)信息技术有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 支付宝(杭州)信息技术有限公司 filed Critical 支付宝(杭州)信息技术有限公司
Publication of WO2024060852A1 publication Critical patent/WO2024060852A1/zh

Links

Classifications

    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06N—COMPUTING ARRANGEMENTS BASED ON SPECIFIC COMPUTATIONAL MODELS
    • G06N20/00—Machine learning
    • G—PHYSICS
    • G10—MUSICAL INSTRUMENTS; ACOUSTICS
    • G10L—SPEECH ANALYSIS OR SYNTHESIS; SPEECH RECOGNITION; SPEECH OR VOICE PROCESSING; SPEECH OR AUDIO CODING OR DECODING
    • G10L17/00—Speaker identification or verification
    • G10L17/04—Training, enrolment or model building

Definitions

  • the present application relates to the field of computer technology, and in particular to a model ownership verification method, device, storage medium and electronic equipment.
  • each edge node receives the model parameters sent by the parameter server, generates a machine learning model based on the model parameters, and inputs the private data saved locally by the edge node as a training sample into the machine learning model. According to the results output by the machine learning model and The gradient corresponding to the annotation of the training sample is obtained, and then the obtained gradient is uploaded to the parameter server, so that the parameter server updates the model parameters and iterates.
  • the edge node only allows the parameter server to use the gradient uploaded by the edge node to train a specific model and restricts the model to be used for specific purposes, but the parameter server may use the gradient uploaded by the edge node without the permission of the edge node. Gradient training other models, or the parameter server may use the trained model for other purposes.
  • This specification provides a model ownership verification method, device, storage medium and electronic equipment.
  • This specification adopts the following technical solution:
  • This specification provides a method for verifying the ownership of a model, including: obtaining an adjusted sample locally stored in an edge node and an annotation of the adjusted sample; wherein the adjusted sample is obtained by adding a specified feature to the original sample, and the annotation of the adjusted sample is the same as the annotation of the original sample corresponding to the adjusted sample; inputting the adjusted sample into a model to be verified, and determining the gradient of the model to be verified as a first gradient according to the output result of the model to be verified and the annotation corresponding to the adjusted sample; inputting the adjusted sample into a pre-stored benign model, and determining the gradient of the model to be verified as a first gradient according to the output result of the benign model and the annotation corresponding to the adjusted sample;
  • the annotations corresponding to the rectified samples are used to determine the gradient of the benign model as the second gradient; wherein the benign model is obtained by training the original samples; and according to the first gradient and the second gradient, it is determined whether the samples for training the model to be
  • different adjusted samples correspond to different original samples, and different adjusted samples contain the same specified features.
  • judging whether the samples for training the model to be verified originate from the edge node according to the first gradient and the second gradient, specifically including: inputting the first gradient and the second gradient.
  • a pre-trained classifier is used to determine whether the samples for training the model to be verified originate from the edge node.
  • pre-training a classifier specifically includes: inputting the adjusted sample into a pre-saved victim model, and determining the victim based on the output of the victim model and the annotations corresponding to the adjusted sample.
  • the gradient of the model as the third gradient; wherein, the victim model is trained based on the sample set containing the original sample and the adjusted sample; training with the second gradient and the third gradient Samples are annotated with the source models of the second gradient and the third gradient, and the classifier is trained, wherein the source model of the second gradient is a benign model, and the source model of the third gradient is as a victim model.
  • the classifier is used to determine whether the samples for training the model to be verified are derived from the edge node, specifically including: when the result output by the classifier is that the source model of the first gradient is the victim model, determining that the samples of the model to be verified are derived from the edge node; when the result output by the classifier is that the source model of the first gradient is the benign model, determining that the samples of the model to be verified are not derived from the edge node.
  • pre-training the victim model specifically includes: determining a first sample set composed of original samples and a second sample set composed of adjusted samples, and receiving the model to be trained sent by the parameter server; according to the first Samples in a sample set and labels corresponding to samples in the first sample set determine the gradient of the model to be trained; send the gradient of the model to be trained to the parameter server, so that the parameter server can Update the model to be trained with the gradient of the model to be trained; receive the updated model to be trained sent by the parameter server as an intermediate model; according to the samples in the second sample set and the samples in the second sample set Corresponding annotation, determine the gradient of the intermediate model; send the gradient of the intermediate model to the parameter server, so that the parameter server updates the intermediate model according to the gradient of the intermediate model to obtain the victim model; receive And store the parameters sent by the server to the victim model.
  • the method further includes: saving the intermediate model as a benign model.
  • This specification provides a model ownership verification device, including: an acquisition module, used to obtain an adjusted sample locally saved by an edge node and annotations of the adjusted sample; wherein the adjusted sample is obtained by adding specified features to Obtained from the original sample, the label of the adjusted sample is the same as the label of the original sample corresponding to the adjusted sample; determine the gradient module, used to input the adjusted sample into the model to be verified, according to the model to be verified The output results and the corresponding annotations of the adjusted samples are determined to determine the gradient of the model to be verified as the first gradient; the adjusted samples are input into the pre-saved benign model, and based on the output results of the benign model and the The annotation corresponding to the adjusted sample is used to determine the gradient of the benign model as the second gradient; wherein the benign model is obtained by training based on the original sample; a verification module is used to determine the gradient according to the first gradient and the second gradient. , determine whether the sample for training the model to be verified comes from the edge node.
  • an acquisition module used to obtain an adjusted sample locally
  • different adjusted samples correspond to different original samples, and the specified features contained in different adjusted samples are the same.
  • the verification module is specifically configured to input the first gradient and the second gradient into a pre-trained classifier, and use the classifier to determine whether the sample for training the model to be verified comes from the edge node.
  • the device further includes: a first training module for inputting the adjusted sample into a pre-saved victim model, and based on the output result of the victim model and the annotation corresponding to the adjusted sample, Determine the gradient of the victim model as a third gradient; wherein the victim model is trained according to a sample set containing the original sample and the adjusted sample; with the second gradient and the The third gradient is a training sample, and the classifier is trained with the source model of the second gradient and the third gradient as annotations, where the source model of the second gradient is a benign model, and the third gradient The source model of the three gradients is the victim model.
  • a first training module for inputting the adjusted sample into a pre-saved victim model, and based on the output result of the victim model and the annotation corresponding to the adjusted sample, Determine the gradient of the victim model as a third gradient; wherein the victim model is trained according to a sample set containing the original sample and the adjusted sample; with the second gradient and the The third gradient is a training sample, and the classifier
  • the verification module is specifically used to, when the result output by the classifier is that the source model of the first gradient is the victim model, determine that the samples of the model to be verified originate from the edge node; when the result output by the classifier is that the source model of the first gradient is the benign model, determine that the samples of the model to be verified do not originate from the edge node.
  • the device further includes: a second training module, configured to determine a first sample set composed of original samples and a second sample set composed of adjusted samples, and receive the model to be trained sent by the parameter server; Determine the gradient of the model to be trained according to the samples in the first sample set and the labels corresponding to the samples in the first sample set; send the gradient of the model to be trained to the parameter server, so that the gradient of the model to be trained is
  • the parameter server updates the model to be trained according to the gradient of the model to be trained; receives the updated model to be trained sent by the parameter server as an intermediate model; and according to the samples in the second sample set and the second
  • the annotations corresponding to the samples in the sample set determine the gradient of the intermediate model; send the gradient of the intermediate model to the parameter server, so that the parameters
  • the server updates the intermediate model according to the gradient of the intermediate model to obtain a victim model; receives and stores the victim model sent by the parameter server.
  • the gradient determining module is also configured to save the intermediate model as a benign model after the second training module receives the updated model to be trained sent by the parameter server as an intermediate model.
  • This specification provides a computer-readable storage medium.
  • the storage medium stores a computer program.
  • the computer program is executed by a processor, the ownership verification method of the above model is implemented.
  • This specification provides an electronic device, including a memory, a processor, and a computer program stored in the memory and executable on the processor.
  • the processor executes the program, the ownership verification method of the above model is implemented.
  • At least one of the above technical solutions adopted in this specification can achieve the following beneficial effects:
  • specified features are added to the original sample without adjusting the annotation of the original sample, so that the annotation of the adjusted sample and the adjusted
  • the original samples corresponding to the latter samples have the same annotations.
  • the gradient obtained by inputting the adjusted samples into the model to be verified and the gradient obtained by inputting the benign model trained with the original samples it is judged whether the samples for training the model to be verified come from edge nodes.
  • FIG1 is a flow chart of a method for verifying ownership of a model in this specification.
  • Figure 2 is a schematic diagram of the training process of a victim model in this specification.
  • Figure 3 is a schematic diagram of a model ownership verification device provided in this specification.
  • FIG. 4 is a schematic diagram of the electronic device corresponding to FIG. 1 provided in this specification.
  • the watermark can be embedded in the training sample first. Embedding the watermark is to embed the watermark atomic information into data with different characteristics. For example, if the training sample is an image, embedding the watermark can change the pixel value of the image. , and then adjust the labeling of the sample. During the ownership verification process of the model to be verified, samples embedded with watermarks are input to the model to be verified.
  • the model to be verified is trained based on the training samples and watermark samples, but the watermark embedding operation will give The model leaves behind a new security threat, and due to the adjustment of the labeling of the samples, the model will make prediction errors during use.
  • the model that needs to be trained is a two-class model, and the output results have two situations, namely category A and category B.
  • category A and category B the training process of the model.
  • original samples and samples with embedded watermarks are used for training. The original samples are labeled with category A and category B, while the samples with embedded watermarks are labeled with category C.
  • samples embedded with watermarks are input to the model to be verified.
  • the model to be verified is trained based on the training samples and watermark samples.
  • the parameter server uses the model, it does not know that the model is actually a model that can output three types of results: category A, category B, and category C. It mistakenly thinks that the model can only output category A and category B. Therefore, when When this model is applied to a certain business, the business will only be set to perform Y operation processing when the output result of the model is category A, and perform N operation processing when the output result of the model is category B.
  • Figure 1 is a schematic flowchart of a model ownership verification method in this specification, including steps S100 to S106.
  • horizontal federated learning is a type of distributed training. It mainly involves each edge node receiving the model parameters sent by the parameter server, generating a machine learning model based on the model parameters, and saving the edge node locally.
  • the sample data is input into the machine learning model as a training sample.
  • the gradient is obtained based on the output results of the machine learning model and the annotations corresponding to the training samples.
  • the obtained gradient is then uploaded to the parameter server so that the parameter server updates the model parameters and iterates.
  • Each edge node collaborates to train the machine learning model, which can improve the training efficiency of the machine learning model, but there may be issues with model ownership.
  • this application In order to know whether a model to be verified was trained based on the private data saved by an edge node (that is, to verify whether the ownership of the model to be verified belongs to the edge node), this application still uses the original sample in the stage of training the model.
  • a method of training the model with some adjusted samples i.e., the above-mentioned watermark-embedded samples, but without changing the corresponding annotations of the adjusted samples, but by using other methods to verify whether the ownership of the model to be verified belongs to the edge node. , to avoid the problem of reduced model accuracy caused by changing the labeling of samples.
  • the edge node obtains the locally saved adjusted sample and the annotation of the adjusted sample.
  • the edge node can be an edge node that uses local original samples to participate in machine learning model training, or it can be an edge node trusted by the edge node.
  • edge node there are no specific restrictions here. For the convenience of explanation, only the edge node is used as the execution subject for description below.
  • the adjusted sample is obtained by adding specified features to the locally saved original sample, and the annotation of the sample is not adjusted.
  • the specified feature can be set based on the sample data of the original sample.
  • the trained machine learning model is a model related to natural language processing
  • the sample data of the original sample is text information
  • the specified feature It can be specific text
  • the sample can be adjusted by adding specific text to the text information, and the label of the sample will not be changed while adjusting the sample.
  • the trained machine learning model is a model related to speech recognition
  • the sample data of the original sample is speech information
  • the specified feature can be specific noise and other unnatural sounds, which can be achieved by adding specific noise to the speech information. Adjust the sample without changing the label of the sample while adjusting the sample.
  • the specified feature can be an image style, and the sample image can be styled according to the given image style.
  • Samples after adding specified features, that is, the adjusted samples are different from their corresponding original samples, and the specified features contained in different adjusted samples are the same. This is so that when using the adjusted samples to train the model, you can Make the model learn the same specified features contained in different adjusted samples, so that when the adjusted samples are input to the model, the model recognizes the specified features and determines that the input sample is an adjusted sample, and the output result is the label of the adjusted sample.
  • the edge node can use the model ownership verification method provided in this specification to verify the ownership of the model to be verified, so as to determine whether the samples for training the model to be verified come from the edge node.
  • S102 Input the adjusted sample into the model to be verified, and based on the output results of the model to be verified and the The annotations corresponding to the adjusted samples are used to determine the gradient of the model to be verified as the first gradient.
  • S104 Input the adjusted sample into a pre-saved benign model, and determine the gradient of the benign model as a second gradient based on the output result of the benign model and the annotation corresponding to the adjusted sample.
  • the edge node only allows the parameter server to train a specific model using the uploaded gradients, and restricts the model to only be used for specific purposes. If the edge node suspects that a model may have been trained by the gradient it uploaded to the parameter server, or it is found that the trained model is used by the parameter server for other purposes instead of a specific purpose, then this model can be used as a pending verification Model is verified.
  • step S104 the adjusted sample is input into the pre-saved benign model to obtain the output result.
  • the output result of the benign model and the annotation corresponding to the adjusted sample are input into the loss function and the gradient is calculated.
  • the calculated gradient is as the second gradient.
  • the benign model is obtained through original sample training, and the loss function is the loss function used in the benign model training process.
  • step S102 the edge node needs to input the above-mentioned adjusted sample into the model to be verified to obtain the output result.
  • the output result of the model to be verified and the annotation corresponding to the adjusted sample are input into the same loss function as above and calculate the gradient.
  • the calculated gradient is used as the first gradient.
  • S106 Based on the first gradient and the second gradient, determine whether the sample for training the model to be verified originates from the edge node.
  • step S100 since the labels of the adjusted samples and their corresponding original samples are the same, even if the adjusted samples are input into a model trained in advance using the adjusted samples and the original samples (the ownership of the model belongs to the edge node) , there will be no special results in the output of the model, so the ownership of the model to be verified cannot be judged through the output of the model.
  • this application uses the gradient performance of the adjusted sample in the model to be verified and the benign model to determine whether the sample for training the model to be verified comes from an edge node.
  • the benign model is obtained by training with original samples and has not been trained with adjusted samples
  • the model to be verified if the ownership of the model to be verified belongs to the edge node, then the model to be verified must have been trained with adjusted samples. If the ownership of the model to be verified does not belong to the edge node, then the model to be verified must not have been trained with adjusted samples.
  • Whether a model has been trained with a specific sample can be judged by observing the model's response to the sample after inputting the specific sample into the model. In this application, the response of the aforementioned model to a specific sample is characterized by the gradient of the model calculated after the sample is input into the model.
  • the benign model has not been trained with adjusted samples, after the adjusted samples are input into the benign model and the model to be verified, if the model to be verified has not been trained with the adjusted samples, then the benign model and the model to be verified have the same response to the input adjusted samples.
  • the response of the benign model and the model to be verified to the input adjusted samples should be similar, that is, the gradients of the two are similar.
  • the model to be verified is trained using the adjusted samples, then the response of the benign model and the model to be verified to the input adjusted samples should be completely different, that is, the gradients of the two are not similar.
  • the sample for training the model to be verified originates from the edge node.
  • multiple adjusted samples can be input into the benign model and the model to be verified, and the second gradients of the benign model based on the adjusted samples and the second gradients of the model to be verified based on the adjusted samples are respectively obtained.
  • multiple first gradients determine the first feature vector based on the multiple first gradients, determine the second feature vector based on the multiple second gradients, and finally calculate the similarity between the first feature vector and the second feature vector. If the similarity is greater than If the threshold is preset, it is determined that the ownership of the model to be verified does not belong to the edge node; otherwise, it is determined that the ownership of the model to be verified belongs to the edge node.
  • 100 adjusted samples can be input into the benign model, and the corresponding 100 second gradients can be obtained based on the obtained output results and the corresponding annotations of the adjusted samples, and the 100 second gradients can be determined as elements.
  • these 100 adjusted samples are also input into the model to be verified to obtain the first eigenvector.
  • the samples for training the model to be verified are judged based on the similarity between the first eigenvector and the second eigenvector. Whether it comes from edge nodes.
  • the parameter server uses the model, if the input If the sample data has similar features to the specified features included in the adjusted sample, then the output result will be the annotation of the original sample corresponding to the adjusted sample. There will not be a result that is different from the annotation of the original sample, which will not affect subsequent parameters.
  • the operation of the server will not cause prediction errors in the model during use, will not have a great impact on the model's prediction accuracy, and will not reduce the accuracy of the model's prediction.
  • the gradient performance of the adjusted samples in the benign model and the model to be verified is used to judge.
  • the adjusted samples need to be
  • the samples are input to the model to be verified and the benign model respectively, and multiple first gradients and second gradients are obtained respectively.
  • the obtained first gradients and second gradients are calculated to obtain the corresponding first eigenvectors and second eigenvectors, and then the calculation is
  • the similarity between the first feature vector and the second feature vector is used to determine whether the ownership of the model to be verified belongs to the edge node based on the similarity and the preset threshold.
  • the model compares the learned characteristics of the second gradient with the first gradient to determine the second gradient. Whether the first gradient has the characteristics of the second gradient. If so, the samples for training the model to be verified do not come from edge nodes. If not, the samples for training the model to be verified come from edge nodes.
  • a classifier can be pre-trained, the first gradient and the second gradient can be input into the pre-trained classifier, and based on the output result of the classifier, it can be determined whether the sample for training the model to be verified comes from an edge node.
  • the victim model is trained based on the original samples and adjusted samples, and the loss function is the loss function used in the training process of the victim model.
  • the second gradient and the third gradient are used as training samples, and the source models of the second gradient and the third gradient are used as annotations to train the classifier.
  • the source model of the second gradient is a benign model
  • the source model of the third gradient is a benign model.
  • the model is a victim model.
  • the victim model is trained through original samples and adjusted samples
  • the output result of the classifier is that the source model of the first gradient is the victim model
  • the verification model is trained using adjusted samples. Then the samples for training the model to be verified come from edge nodes. If the output result of the classifier is that the source model of the first gradient is a benign model, the model to be verified has not been trained using adjusted samples. training, then the samples for training the model to be verified do not come from edge nodes.
  • the pre-trained classifier By inputting the first gradient and the second gradient into the pre-trained classifier as described above, it is judged according to the output result of the classifier whether the samples for training the model to be verified come from edge nodes, without the need for artificial settings to judge whether the samples for the model to be trained are Judgment rules derived from edge nodes can train the classifier to learn the second gradient and third gradient with characteristics, and then input the first gradient to the classifier. Based on the output result, it can be judged whether the sample of the model to be trained comes from the edge node. When the output result is that the source model of the first gradient is the victim model, the training needs to be verified. The samples of the model come from edge nodes. When the output result is that the source model of the first gradient is a benign model, the samples for training the model to be verified do not come from edge nodes.
  • the above-mentioned victim model is essentially the model trained by the edge node auxiliary parameter server during the horizontal federation training process. That is, the model that the parameter server needs to apply to the business subsequently is the above-mentioned victim model.
  • the training process of the victim model can be shown in Figure 2.
  • Figure 2 shows a schematic diagram of the training process of a victim model, which may specifically include steps S200 to S212.
  • S200 Determine the first sample set composed of original samples and the second sample set composed of adjusted samples, and receive the model to be trained sent by the parameter server.
  • S202 Determine the gradient of the model to be trained based on the samples in the first sample set and the labels corresponding to the samples in the first sample set.
  • the edge node inputs the first sample into the model to be trained, inputs the obtained output result and the label corresponding to the first sample into the loss function, calculates the loss according to the loss function, and determines the gradient that minimizes the loss.
  • the loss function is the loss function used in the training process of the model to be trained, and is also the loss function mentioned in the above steps S102 and S104.
  • S204 Send the gradient of the model to be trained to the parameter server, so that the parameter server updates the model to be trained according to the gradient of the model to be trained.
  • the edge node can iteratively train the model to be trained multiple times through the method shown in steps S202 to S204. Assuming that the model to be trained is set to be trained n times using samples, it is considered that the model to be trained has been trained and the expected effect is achieved, and the edge node can use the first sample to train the model to be trained n-i times through the method shown in steps S202 to S204. , in step S206, the model to be trained after training n-i times is used as the intermediate model. Among them, n and i are set positive integers.
  • S208 Determine the gradient of the intermediate model based on the samples in the second sample set and the labels corresponding to the samples in the second sample set.
  • the edge node inputs the second sample into the intermediate model, inputs the obtained output result and the annotation corresponding to the second sample into the loss function, calculates the loss according to the loss function, and determines the gradient that minimizes the loss.
  • S210 Send the gradient of the intermediate model to the parameter server, so that the parameter server can The gradient of the intermediate model updates the intermediate model to obtain the victim model.
  • the edge node can also train the intermediate model i times through steps S208 to S210, and send the gradient obtained by inputting the second sample each time in the i training to the parameter server, so that the parameter server updates the intermediate model according to the above gradient.
  • Model save the model updated i times as the victim model.
  • the victim model is a model trained by the edge node auxiliary parameter server, and the parameter server applies the victim model to subsequent services.
  • the parameter server may use the gradient uploaded by the edge node to train other models without the authorization of the edge node, or use the saved victim model for other purposes, but the victim model saved by the parameter server is trained with the second sample. If the model to be verified is a model that has been trained with the second sample, the ownership of the model to be verified belongs to the edge node. If the model to be verified is a model that has not been trained with the second sample, the ownership of the model to be verified does not Belongs to edge node.
  • S212 Receive and store the victim model sent by the parameter server.
  • the edge node receives the victim model sent by the parameter server and saves it for use when training the classifier as mentioned above.
  • the third Three-gradient By inputting the adjusted sample into the victim model, based on the obtained output result and the label corresponding to the adjusted sample, the third Three-gradient, the third gradient is used as a sample for training the classifier, and the source model of the third gradient is used as the annotation of the sample to train the classifier.
  • the edge node saves the intermediate model in step S206 as a benign model, and the benign model saved here is the benign model pre-saved in step S104.
  • the benign model and the victim model are models in two training stages during the process of training the model to be trained by the edge node auxiliary parameter server.
  • the benign model is the model obtained after using the first sample to train the model to be trained, that is, the middle model
  • the victim model is the model obtained after training the intermediate model using the second sample.
  • the victim model is the model that the parameter server can finally apply to the business.
  • the edge node uses the embodiment of the present application to verify the ownership of the model to be verified, it needs to save the benign model trained using the original sample during the process of training the model by the auxiliary parameter server, and then use the benign model on the basis of this benign model. Use the adjusted samples for training, and save the victim model trained using the adjusted samples. Then use the saved benign model and victim model to train a classifier, and use the classifier to determine the ownership of the model to be verified. The final parameter server saves the victim model trained with the adjusted samples and applies it to the business.
  • Figure 3 is a schematic diagram of the ownership verification device of a model provided in this specification, which specifically includes: an acquisition module 300, used to obtain the adjusted samples stored locally at the edge node and the annotations of the adjusted samples; wherein, the adjusted samples is obtained by adding specified features to the original sample, and the annotation of the adjusted sample is the same as the annotation of the original sample corresponding to the adjusted sample; the gradient determination module 302 is used to input the adjusted sample into the model to be verified , according to the output result of the model to be verified and the annotation corresponding to the adjusted sample, determine the gradient of the model to be verified as the first gradient; input the adjusted sample into the pre-saved benign model, according to the The output result of the benign model and the annotation corresponding to the adjusted sample determine the gradient of the benign model as the second gradient; wherein the benign model is trained based on the original sample; the verification module 304 is used to According to the first gradient and the second gradient, it is determined whether the sample for training the model to be verified comes from the edge node.
  • an acquisition module 300 used
  • different adjusted samples correspond to different original samples, and different adjusted samples contain the same specified features.
  • the verification module 304 is specifically configured to input the first gradient and the second gradient into a pre-trained classifier, and use the classifier to determine whether the sample for training the model to be verified comes from the Describe edge nodes.
  • the device further includes: a first training module 306 for inputting the adjusted sample into a pre-saved victim model, and based on the output result of the victim model and the label corresponding to the adjusted sample , determine the gradient of the victim model as the third gradient; wherein the victim model is trained according to a sample set containing the original sample and the adjusted sample; with the second gradient and the The third gradient is a training sample, and the second gradient and the source model of the third gradient are used as annotations to train the classifier, wherein the source model of the second gradient is a benign model, and the The source model of the third gradient is the victim model.
  • a first training module 306 for inputting the adjusted sample into a pre-saved victim model, and based on the output result of the victim model and the label corresponding to the adjusted sample , determine the gradient of the victim model as the third gradient; wherein the victim model is trained according to a sample set containing the original sample and the adjusted sample; with the second gradient and the The third gradient is a training sample, and
  • the verification module 304 is specifically configured to determine that the sample of the model to be verified originates from the edge node when the result output by the classifier is that the source model of the first gradient is the victim model. ; When the result output by the classifier is that the source model of the first gradient is the benign model, it is determined that the sample of the model to be verified does not originate from the edge node.
  • the device also includes: a second training module 308, used to determine a first sample set composed of original samples and a second sample set composed of adjusted samples, and receive the model to be trained sent by the parameter server ; Determine the gradient of the model to be trained based on the samples in the first sample set and the labels corresponding to the samples in the first sample set; send the gradient of the model to be trained to the parameter server, so that The parameter server updates the model to be trained according to the gradient of the model to be trained; receives the updated model to be trained sent by the parameter server as an intermediate model; and updates the model to be trained according to the samples in the second sample set and the third sample set.
  • a second training module 308 used to determine a first sample set composed of original samples and a second sample set composed of adjusted samples, and receive the model to be trained sent by the parameter server ; Determine the gradient of the model to be trained based on the samples in the first sample set and the labels corresponding to the samples in the first sample set; send the gradient of the model to be trained to the parameter server, so that The
  • the gradient determining module 302 is also configured to save the intermediate model as a benign model after the second training module 308 receives the updated model to be trained sent by the parameter server as an intermediate model.
  • This specification provides a computer-readable storage medium that stores a computer program.
  • the computer program can be used to execute the ownership verification method of the model provided in Figure 1 above.
  • the unmanned driving equipment includes a processor, internal bus, network interface, memory and non-volatile storage, and of course may also include other hardware required by the business.
  • the processor reads the corresponding computer program from the non-volatile memory into the memory and then runs it to implement the ownership verification method of the model described in Figure 1 above.
  • this specification does not exclude other implementation methods, such as logic devices or a combination of software and hardware, etc. That is to say, the execution subject of the following processing flow is not limited to each logical unit, and may also be hardware or logic device.
  • PLD Programmable Logic Device
  • FPGA Field Programmable Gate Array
  • HDL Hardware Description Language
  • HDL High-Speed Integrated Circuit Hardware Description Language
  • ABEL Advanced Boolean Expression Language
  • AHDL Advanced Boolean Expression Language
  • Confluence CUPL
  • HDCal Component Description Language
  • JHDL Java Hardware Description Language
  • Lava Lava
  • Lola MyHDL
  • PALASM RHDL
  • VHDL Very-High-Speed Integrated Circuit Hardware Description Language
  • Verilog Verilog
  • the controller may be implemented in any suitable manner, for example, the controller may take the form of, for example, a microprocessor or processor and a computer readable medium storing computer readable program code (eg, software or firmware) executable by the (micro)processor. , logic gates, switches, Application Specific Integrated Circuit (ASIC), programmable logic controllers and embedded microcontrollers.
  • controllers include but are not limited to the following microcontrollers: ARC 625D, Atmel AT91SAM, For Microchip PIC18F26K20 and Silicone Labs C8051F320, the memory controller can also be implemented as part of the memory's control logic.
  • the controller in addition to implementing the controller in the form of pure computer-readable program code, the controller can be completely programmed with logic gates, switches, application-specific integrated circuits, programmable logic controllers and embedded logic by logically programming the method steps. Microcontroller, etc. to achieve the same function. Therefore, this controller can be considered as a hardware component, and the devices included therein for implementing various functions can also be considered as structures within the hardware component. Or even, the means for implementing various functions can be considered as structures within hardware components as well as software modules implementing the methods.
  • a typical implementation device is a computer.
  • the computer may be, for example, a personal computer, a laptop computer, a cellular phone, a camera phone, a smartphone, a personal digital assistant, a media player, a navigation device, an email device, a game console, a tablet computer, a wearable device, or A combination of any of these devices.
  • the embodiments of the present application may be provided as methods, systems, or computer program products. Therefore, the present application may adopt the form of a complete hardware embodiment, a complete software embodiment, or an embodiment in combination with software and hardware. Moreover, the present application may adopt the form of a computer program product implemented in one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) that contain computer-usable program code.
  • a computer-usable storage media including but not limited to disk storage, CD-ROM, optical storage, etc.
  • These computer program instructions may also be stored in a computer-readable memory that causes a computer or other programmable data processing apparatus to operate in a particular manner, such that the instructions stored in the computer-readable memory produce an article of manufacture including the instruction means, the instructions
  • the device implements the functions specified in a process or processes of the flowchart and/or a block or blocks of the block diagram.
  • These computer program instructions may also be loaded onto a computer or other programmable data processing device, causing a series of operating steps to be performed on the computer or other programmable device to produce computer-implemented processing, thereby executing on the computer or other programmable device.
  • Instructions provide steps for implementing the functions specified in a process or processes of a flowchart diagram and/or a block or blocks of a block diagram.
  • a computing device includes one or more processors (CPUs), input/output interfaces, network interfaces, and memory.
  • processors CPUs
  • input/output interfaces network interfaces
  • memory volatile and non-volatile memory
  • Memory may include non-permanent storage in computer-readable media, random access memory (RAM) and/or non-volatile memory in the form of read-only memory (ROM) or flash memory (flash RAM). Memory is an example of computer-readable media.
  • RAM random access memory
  • ROM read-only memory
  • flash RAM flash random access memory
  • Computer-readable media includes both persistent and non-volatile, removable and non-removable media that can be implemented by any method or technology for storage of information.
  • Information may be computer-readable instructions, data structures, modules of programs, or other data.
  • Examples of computer storage media include, but are not limited to, phase change memory (PRAM), static random access memory (SRAM), dynamic random access memory (DRAM), other types of random access memory (RAM), and read-only memory.
  • PRAM phase change memory
  • SRAM static random access memory
  • DRAM dynamic random access memory
  • RAM random access memory
  • read-only memory read-only memory
  • ROM read-only memory
  • EEPROM electrically erasable programmable read-only memory
  • flash memory or other memory technology
  • compact disc read-only memory CD-ROM
  • DVD digital versatile disc
  • Magnetic tape cassettes tape magnetic disk storage or other magnetic storage devices or any other non-transmission medium can be used to store information that can be accessed by a computing device.
  • computer-readable media does not include transitory media, such as modulated data signals and carrier waves.
  • embodiments of the present specification may be provided as methods, systems, or computer program products.
  • the present description may take the form of an entirely hardware embodiment, an entirely software embodiment, or an embodiment that combines software and hardware aspects.
  • the present description may take the form of a computer program product embodied on one or more computer-usable storage media (including, but not limited to, disk memory, CD-ROM, optical storage, etc.) having computer-usable program code embodied therein.
  • program modules include routines, programs, objects, components, data structures, etc. that perform specific tasks or implement specific abstract data types.
  • the present description may also be practiced in distributed computing environments where tasks are performed by remote processing devices connected through communications networks.
  • program modules may be located in both local and remote computer storage media including storage devices.

Landscapes

  • Engineering & Computer Science (AREA)
  • Theoretical Computer Science (AREA)
  • Physics & Mathematics (AREA)
  • Software Systems (AREA)
  • Evolutionary Computation (AREA)
  • Mathematical Physics (AREA)
  • Data Mining & Analysis (AREA)
  • Computer Vision & Pattern Recognition (AREA)
  • Computing Systems (AREA)
  • General Engineering & Computer Science (AREA)
  • General Physics & Mathematics (AREA)
  • Medical Informatics (AREA)
  • Artificial Intelligence (AREA)
  • Health & Medical Sciences (AREA)
  • Audiology, Speech & Language Pathology (AREA)
  • Human Computer Interaction (AREA)
  • Acoustics & Sound (AREA)
  • Multimedia (AREA)
  • Management, Administration, Business Operations System, And Electronic Commerce (AREA)

Abstract

本说明书公开了一种模型的所有权验证方法、装置、存储介质及电子设备，所述方法包括：向原始样本中添加指定特征且不调整原始样本的标注，使调整后样本的标注与调整后样本对应的原始样本的标注相同，根据调整后样本输入待验证模型得到的梯度和输入以原始样本训练的良性模型得到的梯度，判断训练所述待验证模型的样本是否来源于边缘节点。本方法中因调整后样本和其对应的原始样本的标注相同，所以在无法通过标注判断待验证模型的所有权的情况下，通过调整后样本在待验证模型和良性模型中的梯度表现不同来判断训练待验证模型的样本是否来源于边缘节点，可以更加准确地判断待验证模型的所有权。

Description

一种模型的所有权验证方法、装置、存储介质及电子设备 技术领域
本申请涉及计算机技术领域，尤其涉及一种模型的所有权验证方法、装置、存储介质及电子设备。
背景技术
随着人工智能的发展，机器学习模型得到了广泛应用。横向联邦学习是分布式训练的一种，其主要目的是保护作为训练样本的隐私数据不泄露。具体的，各个边缘节点接收参数服务器发送的模型参数，以该模型参数生成机器学习模型，并将该边缘节点本地保存的隐私数据作为训练样本输入该机器学习模型，根据机器学习模型输出的结果和训练样本对应的标注得到梯度，再将得到的梯度上传给参数服务器，以使参数服务器更新模型参数，以此迭代。
然而，使用上述方式训练模型虽然可以保护边缘节点的隐私数据，但可能会出现模型的所有权问题。例如，边缘节点只允许参数服务器利用边缘节点上传的梯度训练一个特定的模型，并限制模型只能用于特定的用途，但参数服务器可能会在未经边缘节点允许的情况下使用边缘节点上传的梯度训练其他模型，或者，参数服务器也可能会将训练好的模型用于其他用途。
因此，对于一个待验证模型，如何判断该待验证模型是否是通过边缘节点自身保存的隐私数据训练得到的成为一个亟待解决的问题。
发明内容
本说明书提供一种模型的所有权验证方法、装置、存储介质及电子设备。
本说明书采用下述技术方案：本说明书提供一种模型的所有权验证方法，包括：获取边缘节点本地保存的调整后样本以及所述调整后样本的标注；其中，所述调整后样本是将指定特征添加到原始样本中得到的，所述调整后样本的标注与所述调整后样本对应的原始样本的标注相同；将所述调整后样本输入待验证模型，根据所述待验证模型的输出结果以及所述调整后样本对应的标注，确定所述待验证模型的梯度，作为第一梯度；将所述调整后样本输入预先保存的良性模型，根据所述良性模型的输出结果以及所述调 整后样本对应的标注，确定所述良性模型的梯度，作为第二梯度；其中，所述良性模型是根据所述原始样本训练得到的；根据所述第一梯度和所述第二梯度，判断训练所述待验证模型的样本是否来源于所述边缘节点。
可选地，不同的调整后样本对应的原始样本不同，且不同的调整后样本中包含的指定特征相同。
可选地，根据所述第一梯度和所述第二梯度，判断训练所述待验证模型的样本是否来源于所述边缘节点，具体包括：将所述第一梯度和所述第二梯度输入预先训练的分类器，通过所述分类器判断训练所述待验证模型的样本是否来源于所述边缘节点。
可选地，预先训练分类器，具体包括：将所述调整后样本输入预先保存的受害者模型，根据所述受害者模型的输出结果以及所述调整后样本对应的标注，确定所述受害者模型的梯度，作为第三梯度；其中，所述受害者模型是根据包含所述原始样本和所述调整后样本的样本集训练得到的；以所述第二梯度和所述第三梯度为训练样本，以所述第二梯度和所述第三梯度的来源模型为标注，对所述分类器进行训练，其中，所述第二梯度的来源模型为良性模型，所述第三梯度的来源模型为受害者模型。
可选地，通过所述分类器判断训练所述待验证模型的样本是否来源于所述边缘节点，具体包括：当所述分类器输出的结果为第一梯度的来源模型是所述受害者模型时，确定所述待验证模型的样本来源于所述边缘节点；当所述分类器输出的结果为第一梯度的来源模型是所述良性模型时，确定所述待验证模型的样本不来源于所述边缘节点。
可选地，预先训练受害者模型，具体包括：确定由原始样本构成的第一样本集以及由调整后样本构成的第二样本集，并接收参数服务器发送的待训练模型；根据所述第一样本集中的样本以及所述第一样本集中的样本对应的标注，确定所述待训练模型的梯度；将所述待训练模型的梯度发送给所述参数服务器，使所述参数服务器根据所述待训练模型的梯度更新所述待训练模型；接收所述参数服务器发送的更新后的待训练模型，作为中间模型；根据所述第二样本集中的样本以及所述第二样本集中的样本对应的标注，确定所述中间模型的梯度；将所述中间模型的梯度发送给所述参数服务器，使所述参数服务器根据所述中间模型的梯度更新所述中间模型，得到受害者模型；接收并存储所述参数服务器发送的受害者模型。
可选地，在接收所述参数服务器发送的更新后的待训练模型，作为中间模型之后，所述方法还包括：将所述中间模型作为良性模型保存。
本说明书提供了一种模型的所有权验证装置，包括：获取模块，用于获取边缘节点本地保存的调整后样本以及所述调整后样本的标注；其中，所述调整后样本是将指定特征添加到原始样本中得到的，所述调整后样本的标注与所述调整后样本对应的原始样本的标注相同；确定梯度模块，用于将所述调整后样本输入待验证模型，根据所述待验证模型的输出结果以及所述调整后样本对应的标注，确定所述待验证模型的梯度，作为第一梯度；将所述调整后样本输入预先保存的良性模型，根据所述良性模型的输出结果以及所述调整后样本对应的标注，确定所述良性模型的梯度，作为第二梯度；其中，所述良性模型是根据所述原始样本训练得到的；验证模块，用于根据第一梯度和第二梯度，判断训练所述待验证模型的样本是否来源于所述边缘节点。
可选地，不同的调整后样本对应的原始样本不同，且不同的调整后样本中包含的指定特征相同。
可选地，所述验证模块具体用于，将所述第一梯度和所述第二梯度输入预先训练的分类器，通过所述分类器判断训练所述待验证模型的样本是否来源于所述边缘节点。
可选地，所述装置还包括：第一训练模块，用于将所述调整后样本输入预先保存的受害者模型，根据所述受害者模型的输出结果以及所述调整后样本对应的标注，确定所述受害者模型的梯度，作为第三梯度；其中，所述受害者模型是根据包含所述原始样本和所述调整后样本的样本集训练得到的；以所述第二梯度和所述第三梯度为训练样本，以所述第二梯度和所述第三梯度的来源模型为标注，对所述分类器进行训练，其中，所述第二梯度的来源模型为良性模型，所述第三梯度的来源模型为受害者模型。
可选地，所述验证模块具体用于，当所述分类器输出的结果为第一梯度的来源模型是所述受害者模型时，确定所述待验证模型的样本来源于所述边缘节点；当所述分类器输出的结果为第一梯度的来源模型是所述良性模型时，确定所述待验证模型的样本不来源于所述边缘节点。
可选地，所述装置还包括：第二训练模块，用于确定由原始样本构成的第一样本集以及由调整后样本构成的第二样本集，并接收参数服务器发送的待训练模型；根据所述第一样本集中的样本以及所述第一样本集中的样本对应的标注，确定所述待训练模型的梯度；将所述待训练模型的梯度发送给所述参数服务器，使所述参数服务器根据所述待训练模型的梯度更新所述待训练模型；接收所述参数服务器发送的更新后的待训练模型，作为中间模型；根据所述第二样本集中的样本以及所述第二样本集中的样本对应的标注，确定所述中间模型的梯度；将所述中间模型的梯度发送给所述参数服务器，使所述参数 服务器根据所述中间模型的梯度更新所述中间模型，得到受害者模型；接收并存储所述参数服务器发送的受害者模型。
可选地，所述确定梯度模块，在所述第二训练模块接收所述参数服务器发送的更新后的待训练模型，作为中间模型之后，还用于将中间模型作为良性模型保存。
本说明书提供了一种计算机可读存储介质，所述存储介质存储有计算机程序，所述计算机程序被处理器执行时实现上述模型的所有权验证方法。
本说明书提供了一种电子设备，包括存储器、处理器及存储在存储器上并可在处理器上运行的计算机程序，所述处理器执行所述程序时实现上述模型的所有权验证方法。
本说明书采用的上述至少一个技术方案能够达到以下有益效果：在本说明书提供的模型的所有权验证方法中，向原始样本中添加指定特征且不调整原始样本的标注，使调整后样本的标注与调整后样本对应的原始样本的标注相同，根据调整后样本输入待验证模型得到的梯度和输入以原始样本训练的良性模型得到的梯度，判断训练所述待验证模型的样本是否来源于边缘节点。
从上述方法中可以看出，本方法中因调整后样本和其对应的原始样本的标注相同，所以在无法通过标注判断待验证模型的所有权的情况下，通过调整后样本在待验证模型和良性模型中的梯度表现不同来判断训练待验证模型的样本是否来源于边缘节点，可以更加准确地判断待验证模型的所有权。
附图说明
此处所说明的附图用来提供对本说明书的进一步理解，构成本说明书的一部分，本说明书的示意性实施例及其说明用于解释本说明书，并不构成对本说明书的不当限定。
图1为本说明书中一种模型的所有权验证方法的流程示意图。
图2为本说明书中一种受害者模型的训练流程示意图。
图3为本说明书提供的一种模型的所有权验证装置的示意图。
图4为本说明书提供的对应于图1的电子设备示意图。
具体实施方式
为使本说明书的目的、技术方案和优点更加清楚，下面将结合本说明书具体实施例 及相应的附图对本说明书技术方案进行清楚、完整地描述。显然，所描述的实施例仅是本说明书一部分实施例，而不是全部的实施例。基于本说明书中的实施例，本领域普通技术人员在没有做出创造性劳动前提下所获得的所有其他实施例，都属于本申请保护的范围。
如前所述，对于一个待验证模型，如何判断训练该待验证模型的样本是否来源于所述边缘节点称为一个亟待解决的问题。目前，可在训练模型的过程中，先对训练样本嵌入水印，嵌入水印是将水印原子信息嵌入到不同特征的数据中去，例如，如果训练样本是图像，嵌入水印可以是改变图像的像素值，然后调整样本的标注。在进行待验证模型的所有权验证过程中，向待验证模型输入嵌入水印的样本，若输出为调整后的标注，则待验证模型是基于训练样本和水印样本训练得到的，但是嵌入水印操作会给模型留下后门这一新的安全威胁，并且由于调整了样本的标注，会使模型在使用的过程中出现预测错误的情况。例如，需要训练的模型是一个二分类模型，输出结果有两种情况，分别是类别A和类别B。在模型的训练过程中，使用原始样本和嵌入水印样本进行训练，原始样本的标注有类别A和类别B两种情况，而嵌入水印的样本的标注是类别C。在对待验证模型进行验证过程中，向待验证模型输入嵌入水印的样本，当输出结果为类别C时，即可确定待验证模型是基于训练样本和水印样本训练得到的。但参数服务器使用模型时，由于其并不知晓该模型实质上是能够输出类别A、类别B、类别C三种结果的模型，误以为该模型只能输出类别A和类别B，因此，在将该模型应用到某种业务中时，只会将该业务设置为当模型的输出结果为类别A时，进行Y操作处理，当模型的输出结果为类别B时，进行N操作处理。但是，当在业务中使用该模型时，如果输入该模型的样本与嵌入水印的样本比较相似而导致该模型的输出结果为类别C时，对于该业务来说，就出现了一个无法处理的结果，使模型在使用的过程中出现错误的情况，会对模型预测精度造成很大的影响，会降低模型预测的准确度。
为此，本说明书的实施例提供了一种模型的所有权验证方法、装置、存储介质及电子设备，以下结合附图，详细说明本说明书各实施例提供的技术方案。
图1为本说明书中一种模型的所有权验证方法的流程示意图，包括步骤S100至步骤S106。
S100：获取边缘节点本地保存的调整后样本以及所述调整后样本的标注。
在实际应用中，横向联邦学习是分布式训练的一种，主要是各个边缘节点接收参数服务器发送的模型参数，以该模型参数生成机器学习模型，并将该边缘节点本地保存的 样本数据作为训练样本输入该机器学习模型，根据机器学习模型输出的结果和训练样本对应的标注得到梯度，再将得到的梯度上传给参数服务器，以使参数服务器更新模型参数，以此迭代。各个边缘节点共同协作训练机器学习模型，能提高机器学习模型的训练效率，但是可能会出现模型的所有权问题。
为了能够获知一个待验证模型是否是根据一个边缘节点保存的隐私数据训练得到的(即，验证该待验证模型的所有权是否归属于该边缘节点)，本申请仍然采用在训练模型的阶段使用原始样本和一些调整后样本(即上述嵌入水印的样本)对模型进行训练的方法，但不改变调整后样本对应的标注，而是通过其他的方法来验证该待验证模型的所有权是否归属于该边缘节点，以避免改变样本的标注所带来的模型精度下降的问题。
基于此，在本说明书中，边缘节点获取本地保存的调整后样本以及调整后样本的标注，其中，边缘节点可以是使用本地原始样本参与机器学习模型训练的边缘节点，也可以是边缘节点信赖的其他节点，这里不做具体的限制。为了方便说明，下面仅以边缘节点为执行主体进行说明。
调整后样本是向本地保存的原始样本中添加指定特征来得到的，并且不调整样本的标注。具体的，指定特征可以是根据原始样本的样本数据进行设定的，例如，在训练的机器学习模型是与自然语言处理相关的模型时，此时原始样本的样本数据为文字信息，那么指定特征可以是具体的文字，可以通过在文字信息中添加具体的文字来调整样本，且在调整样本的同时不改变样本的标注。在训练的机器学习模型是与语音识别相关的模型时，此时原始样本的样本数据为语音信息，那么指定特征可以是特定的噪音等非自然声音，可以通过在语音信息中添加特定的噪音来调整样本，且在调整样本的同时不改变样本的标注。在训练的机器学习模型是与图像处理或者分类相关的模型时，此时原始样本的样本数据为图像，那么指定特征可以是一种图像风格，可以通过将样本图像根据给定的图像风格进行风格迁移来调整样本，且在调整样本的同时不改变样本的标注。经过添加指定特征后的样本，也就是调整后样本与其对应的原始样本是不同的，并且不同的调整后样本中包含的指定特征是相同的，这是为了在使用调整后样本训练模型时，可以使模型学习不同调整后样本包含的相同指定特征，从而当向模型输入调整后样本时，模型识别到指定特征，确定输入的样本是调整后样本，则输出结果为调整后样本的标注。
边缘节点应用本说明书提供的模型的所有权验证方法可以对待验证模型进行模型的所有权进行验证，以此来判断训练待验证模型的样本是否来源于所述边缘节点。
S102：将所述调整后样本输入待验证模型，根据所述待验证模型的输出结果以及所 述调整后样本对应的标注，确定所述待验证模型的梯度，作为第一梯度。
S104：将所述调整后样本输入预先保存的良性模型，根据所述良性模型的输出结果以及所述调整后样本对应的标注，确定所述良性模型的梯度，作为第二梯度。
边缘节点只允许参数服务器利用上传的梯度训练一个特定的模型，并限制模型只能用于特定的用途。如果边缘节点怀疑某个模型可能是通过自身上传到参数服务器的梯度训练得到的，或者发现训练的模型被参数服务器用于其他用途，而不是用于特定的用途，那么可以将这个模型作为待验证模型进行验证。
具体的，在步骤S104中，将调整后样本输入预先保存的良性模型，得到输出结果，将良性模型的输出结果以及调整后样本对应的标注输入到损失函数中并计算梯度，把计算得到的梯度作为第二梯度。其中，良性模型是通过原始样本训练得到的，损失函数是在良性模型训练过程中所使用的损失函数。在步骤S102中，边缘节点需要将上述调整后样本输入到待验证模型，得到输出结果，将待验证模型的输出结果以及调整后样本对应的标注输入到上述同样的损失函数中并计算梯度，把计算得到的梯度作为第一梯度。
其中，上述步骤S102和S104的执行顺序不分先后。
S106：根据所述第一梯度和所述第二梯度，判断训练所述待验证模型的样本是否来源于所述边缘节点。
在上述步骤S100中，由于调整后样本和其对应的原始样本的标注相同，因此，即使是将调整后样本输入预先使用调整后样本和原始样本训练的模型(该模型的所有权属于该边缘节点)，该模型的输出结果也不会出现特殊的结果，所以无法通过模型的输出结果判断待验证模型的所有权。在这种情况下，本申请通过调整后样本在待验证模型和良性模型中的梯度表现来判断训练待验证模型的样本是否来源于边缘节点。
由于良性模型是通过原始样本训练得到的，未使用过调整后样本进行训练，而对于待验证模型来说，如果待验证模型的所有权属于边缘节点，则该待验证模型必定是使用调整后样本训练过的，如果待验证模型的所有权不属于边缘节点，则该待验证模型必定未使用调整后样本训练过，而一个模型是否使用某个特定的样本训练过，就可以通过将该特定的样本输入模型后观察模型对该样本的反映来判断。本申请中前述模型对某个特定的样本的反映，就是通过将该样本输入模型后所计算的模型的梯度来表征，由于良性模型未使用调整后样本训练，因此，将调整后样本输入良性模型和待验证模型后，如果待验证模型也未使用调整后样本训练，那么良性模型和待验证模型对输入的调整后样本 的反映应该是相似的，即，二者梯度相似，反之，如果待验证模型是使用过调整后样本训练的，那么良性模型和待验证模型对输入的调整后样本的反映应该是截然不同的，即，二者梯度不相似。
由此，可根据步骤S102和S104得到的第一梯度和第二梯度的相似度，来判断训练待验证模型的样本是否来源于边缘节点。具体的，可将多个调整后样本均输入良性模型和待验证模型，分别得到良性模型基于所述多个调整后样本的多个第二梯度以及待验证模型基于所述多个调整后样本的多个第一梯度，再根据多个第一梯度确定第一特征向量，根据多个第二梯度确定第二特征向量，最后计算第一特征向量与第二特征向量的相似度，若相似度大于预设阈值，则确定待验证模型的所有权不属于边缘节点，否则，确定待验证模型的所有权属于边缘节点。
例如，可以取100个调整后样本输入到良性模型中，根据得到的输出结果和调整后样本对应的标注得到相应的100个第二梯度，并确定由这100个第二梯度作为元素所构成的第二特征向量，相应的，同样将这100个调整后样本输入待验证模型中，得到第一特征向量，最后根据第一特征向量和第二特征向量的相似度来判断训练待验证模型的样本是否来源于边缘节点。
基于图1所示的模型的所有权验证方法，向原始样本中添加指定特征且不调整原始样本的标注，使得不同调整后样本包含相同的指定特征，并且调整后样本的标注与调整后样本对应的原始样本的标注相同，根据调整后样本输入待验证模型得到的梯度和输入以原始样本训练的良性模型得到的梯度，判断训练所述待验证模型的样本是否来源于边缘节点。
从上述方法中可以看出，本方法中由于向原始样本添加指定特征时未调整原始样本的标注，从而调整后样本和其对应的原始样本的标注相同，所以无法通过标注来判断待验证模型的所有权，在这种情况下，通过调整后样本在待验证模型和良性模型中的梯度表现不同来判断训练待验证模型的样本是否来源于边缘节点，可以更加准确地判断待验证模型的所有权。同时，虽然使用了原始样本和调整后样本训练模型，但是调整样本时未改变样本的标注，调整后样本和其对应的原始样本的标注相同，所以参数服务器在使用模型的过程中，如果输入的样本数据中有与调整后样本中包含的指定特征相似的特征，那么输出结果为调整后样本对应的原始样本的标注，不会出现一个与原始样本的标注不同的结果，这样不会影响后续参数服务器的操作，不会使模型在使用的过程中出现预测错误的情况，不会对模型预测精度造成很大的影响，也不会降低模型预测的准确度。
通过图1所示的模型的所有权验证方法可以判断训练待验证模型的样本是否来源于边缘节点，其中，利用调整后样本在良性模型和待验证模型中的梯度表现来进行判断，需要将调整后样本分别输入到待验证模型和良性模型，分别得到多个第一梯度和第二梯度，将得到的第一梯度和第二梯度进行计算得到对应的第一特征向量和第二特征向量，再计算第一特征向量与第二特征向量的相似度，根据相似度与预设阈值来进行判断待验证模型的所有权是否属于边缘节点。通过上述方法根据调整后样本在良性模型和待验证模型中的梯度表现不同来判断训练待验证模型的样本是否来源于边缘节点，理论上，可以通过第一梯度和第二梯度是否相似来进行判断，但是实际上，当调整后样本输入待验证模型所得到的梯度表现出何种特征时，训练待验证模型的样本来源于边缘节点，或表现出现何种特征时，训练待验证模型的样本不来源于边缘节点，这种判断规则很难人为量化。基于此，可以使用机器学习模型去学习第二梯度具有的特征，从而，当向机器学习模型输入第一梯度时，模型根据学习到的第二梯度的特征与第一梯度进行比对，判断第一梯度是否具有第二梯度的特征，若具有，则训练待验证模型的样本不来源于边缘节点，若不具有，则训练待验证模型的样本来源于边缘节点。
具体的，可以预先训练一个分类器，将第一梯度和第二梯度输入预先训练的分类器，根据分类器的输出结果来判断训练待验证模型的样本是否来源于边缘节点。
在训练上述分类器时，可先将调整后样本输入预先保存的受害者模型，得到输出结果，将受害者模型的输出结果以及调整后样本对应的标注输入到损失函数中并计算梯度，把计算得到的梯度作为第三梯度。其中，受害者模型是根据原始样本和调整后样本训练得到的，损失函数是在受害者模型训练过程中所使用的损失函数。然后以第二梯度和第三梯度为训练样本，以第二梯度和第三梯度的来源模型为标注，对分类器进行训练，其中，第二梯度的来源模型为良性模型，第三梯度的来源模型为受害者模型。由于受害者模型是通过原始样本和调整后样本训练得到的，所以向预先训练的分类器中输入第一梯度时，如果分类器输出的结果为第一梯度的来源模型是受害者模型，则待验证模型使用过调整后样本进行训练，那么训练待验证模型的样本来源于边缘节点，如果分类器输出的结果为第一梯度的来源模型是良性模型，则待验证模型未使用过调整后样本进行训练，那么训练待验证模型的样本不来源于边缘节点。
通过上述将第一梯度和第二梯度输入预先训练的分类器，根据分类器的输出结果来判断训练待验证模型的样本是否来源于边缘节点，无需人为设定用于判断待训练模型的样本是否来源于边缘节点的判断规则，可以训练分类器去学习第二梯度和第三梯度具有 的特征，然后将第一梯度输入到分类器，根据输出结果就能判断训练待训练模型的样本是否来源于边缘节点，当输出结果为第一梯度的来源模型是受害者模型，则训练待验证模型的样本来源于边缘节点，当输出的结果为第一梯度的来源模型是良性模型，则训练待验证模型的样本不来源于边缘节点。
在本说明书实施例中，上述的受害者模型实质上就是横向联邦训练过程中，边缘节点辅助参数服务器所训练出的模型，即，参数服务器后续需要应用到业务中的模型就是上述受害者模型，该受害者模型的训练过程可以如图2所示。
图2示出了一种受害者模型的训练流程示意图，具体可以包括步骤S200至步骤S212。
S200：确定由原始样本构成的第一样本集以及由调整后样本构成的第二样本集，并接收参数服务器发送的待训练模型。
S202：根据所述第一样本集中的样本以及所述第一样本集中的样本对应的标注，确定所述待训练模型的梯度。
边缘节点向待训练模型中输入第一样本，将得到的输出结果和第一样本对应的标注输入到损失函数中，根据损失函数计算损失，并确定使损失最小的梯度。其中，损失函数是上述待训练模型训练过程中使用的损失函数，并且也是前述中步骤S102和步骤S104中提到的损失函数。
S204：将所述待训练模型的梯度发送给所述参数服务器，使所述参数服务器根据所述待训练模型的梯度更新所述待训练模型。
S206：接收所述参数服务器发送的更新后的待训练模型，作为中间模型。
边缘节点可通过步骤S202～S204所示的方法迭代训练待训练模型多次。假设设定使用样本对待训练模型训练n次，就认为待训练模型已经训练完成，达到预期的效果，则边缘节点可通过步骤S202～S204所示的方法使用第一样本训练待训练模型n-i次，在步骤S206中则将训练n-i次后的待训练模型作为中间模型。其中，n和i是设定的正整数。
S208：根据所述第二样本集中的样本以及所述第二样本集中的样本对应的标注，确定所述中间模型的梯度。
边缘节点向中间模型中输入第二样本，将得到的输出结果和第二样本对应的标注输入到损失函数，根据损失函数计算损失，并确定使损失最小的梯度。
S210：将所述中间模型的梯度发送给所述参数服务器，使所述参数服务器根据所述 中间模型的梯度更新所述中间模型，得到受害者模型。
与步骤S202～S204类似的，边缘节点也可通过步骤S208～S210训练中间模型i次，将i次训练中每次输入第二样本得到的梯度发送给参数服务器，使得参数服务器根据上述梯度更新中间模型，将经过i次更新后的模型作为受害者模型保存。其中，受害者模型是边缘节点辅助参数服务器训练的模型，并且参数服务器将受害者模型应用到后续业务中。
然而参数服务器有可能在未经边缘节点的授权下，使用边缘节点上传的梯度训练其他模型，或者使用保存的受害者模型用于其他用途，但参数服务器保存的受害者模型是经过第二样本训练过的模型，如果待验证模型是经过第二样本训练过的模型，则待验证模型的所有权属于边缘节点，如果待验证模型是未经过第二样本训练过的模型，那么待验证模型的所有权不属于边缘节点。
S212：接收并存储所述参数服务器发送的受害者模型。
边缘节点接收参数服务器发送的受害者模型，并且保存，用于前述训练分类器的时候使用，通过将调整后样本输入到受害者模型，根据得到的输出结果和调整后样本对应的标注，确定第三梯度，将第三梯度作为训练分类器的样本，将第三梯度的来源模型作为样本的标注训练分类器。边缘节点将步骤S206中的中间模型作为良性模型保存，这里保存的良性模型就是前述步骤S104中预先保存的良性模型。实际上，良性模型和受害者模型是边缘节点辅助参数服务器训练待训练模型过程中的两个训练阶段的模型，其中，良性模型是使用第一样本训练待训练模型后得到的模型，即中间模型，受害者模型是使用第二样本训练中间模型后得到的模型。受害者模型就是参数服务器最终可以应用到业务中的模型。
也就是说，边缘节点使用本申请的实施例验证待验证模型的所有权问题，需要在辅助参数服务器训练模型的过程中，将使用原始样本训练的良性模型保存下来，在这个良性模型的基础上再使用调整后样本进行训练，并将使用过调整后样本训练的受害者模型也保存下来，再使用保存的良性模型和受害者模型训练分类器，通过分类器判断待验证模型的所有权归属。最终参数服务器保存的是加入调整后样本训练的受害者模型，并且应用到业务中。
以上为本说明书的一个或多个实施例提供的模型的所有权验证方法，基于同样的思路，本说明书还提供了相应的模型的所有权验证装置，如图3所示。
图3为本说明书提供的一种模型的所有权验证装置示意图，具体包括：获取模块300，用于获取边缘节点本地保存的调整后样本以及所述调整后样本的标注；其中，所述调整后样本是将指定特征添加到原始样本中得到的，所述调整后样本的标注与所述调整后样本对应的原始样本的标注相同；确定梯度模块302，用于将所述调整后样本输入待验证模型，根据所述待验证模型的输出结果以及所述调整后样本对应的标注，确定所述待验证模型的梯度，作为第一梯度；将所述调整后样本输入预先保存的良性模型，根据所述良性模型的输出结果以及所述调整后样本对应的标注，确定所述良性模型的梯度，作为第二梯度；其中，所述良性模型是根据所述原始样本训练得到的；验证模块304，用于根据第一梯度和第二梯度，判断训练所述待验证模型的样本是否来源于所述边缘节点。
可选地，不同的调整后样本对应的原始样本不同，且不同的调整后样本中包含的指定特征相同。
可选地，所述验证模块304具体用于，将所述第一梯度和所述第二梯度输入预先训练的分类器，通过所述分类器判断训练所述待验证模型的样本是否来源于所述边缘节点。
可选地，所述装置还包括：第一训练模块306，用于将所述调整后样本输入预先保存的受害者模型，根据所述受害者模型的输出结果以及所述调整后样本对应的标注，确定所述受害者模型的梯度，作为第三梯度；其中，所述受害者模型是根据包含所述原始样本和所述调整后样本的样本集训练得到的；以所述第二梯度和所述第三梯度为训练样本，以所述第二梯度和所述第三梯度的来源模型为标注，对所述分类器进行训练，其中，所述第二梯度的来源模型为良性模型，所述第三梯度的来源模型为受害者模型。
可选地，所述验证模块304具体用于，当所述分类器输出的结果为第一梯度的来源模型是所述受害者模型时，确定所述待验证模型的样本来源于所述边缘节点；当所述分类器输出的结果为第一梯度的来源模型是所述良性模型时，确定所述待验证模型的样本不来源于所述边缘节点。
可选地，所述装置还包括：第二训练模块308，用于确定由原始样本构成的第一样本集以及由调整后样本构成的第二样本集，并接收参数服务器发送的待训练模型；根据所述第一样本集中的样本以及所述第一样本集中的样本对应的标注，确定所述待训练模型的梯度；将所述待训练模型的梯度发送给所述参数服务器，使所述参数服务器根据所述待训练模型的梯度更新所述待训练模型；接收所述参数服务器发送的更新后的待训练模型，作为中间模型；根据所述第二样本集中的样本以及所述第二样本集中的样本对应的标注，确定所述中间模型的梯度；将所述中间模型的梯度发送给所述参数服务器，使 所述参数服务器根据所述中间模型的梯度更新所述中间模型，得到受害者模型；接收并存储所述参数服务器发送的受害者模型。
可选地，所述确定梯度模块302，在所述第二训练模块308接收所述参数服务器发送的更新后的待训练模型，作为中间模型之后，还用于将中间模型作为良性模型保存。
本说明书提供了一种计算机可读存储介质，该存储介质存储有计算机程序，计算机程序可用于执行上述图1提供的模型的所有权验证方法。
本说明书还提供了图4所示的电子设备的结构示意图。如图4所述，在硬件层面，该无人驾驶设备包括处理器、内部总线、网络接口、内存以及非易失性存储器，当然还可能包括其他业务所需要的硬件。处理器从非易失性存储器中读取对应的计算机程序到内存中然后运行，以实现上述图1所述的模型的所有权验证方法。当然，除了软件实现方式之外，本说明书并不排除其他实现方式，比如逻辑器件抑或软硬件结合的方式等等，也就是说以下处理流程的执行主体并不限定于各个逻辑单元，也可以是硬件或逻辑器件。
在20世纪90年代，对于一个技术的改进可以很明显地区分是硬件上的改进(例如，对二极管、晶体管、开关等电路结构的改进)还是软件上的改进(对于方法流程的改进)。然而，随着技术的发展，当今的很多方法流程的改进已经可以视为硬件电路结构的直接改进。设计人员几乎都通过将改进的方法流程编程到硬件电路中来得到相应的硬件电路结构。因此，不能说一个方法流程的改进就不能用硬件实体模块来实现。例如，可编程逻辑器件(Programmable Logic Device,PLD)(例如现场可编程门阵列(Field Programmable Gate Array，FPGA))就是这样一种集成电路，其逻辑功能由用户对器件编程来确定。由设计人员自行编程来把一个数字系统“集成”在一片PLD上，而不需要请芯片制造厂商来设计和制作专用的集成电路芯片。而且，如今，取代手工地制作集成电路芯片，这种编程也多半改用“逻辑编译器(logic compiler)”软件来实现，它与程序开发撰写时所用的软件编译器相类似，而要编译之前的原始代码也得用特定的编程语言来撰写，此称之为硬件描述语言(Hardware Description Language，HDL)，而HDL也并非仅有一种，而是有许多种，如ABEL(Advanced Boolean Expression Language)、AHDL(Altera Hardware Description Language)、Confluence、CUPL(Cornell University Programming Language)、HDCal、JHDL(Java Hardware Description Language)、Lava、Lola、MyHDL、PALASM、RHDL(Ruby Hardware Description Language)等，目前最普遍使用的是VHDL(Very-High-Speed Integrated Circuit Hardware Description Language)与Verilog。本领域技术人员也应该清楚，只需要将方法流程用上述几种硬件描述语言 稍作逻辑编程并编程到集成电路中，就可以很容易得到实现该逻辑方法流程的硬件电路。
控制器可以按任何适当的方式实现，例如，控制器可以采取例如微处理器或处理器以及存储可由该(微)处理器执行的计算机可读程序代码(例如软件或固件)的计算机可读介质、逻辑门、开关、专用集成电路(Application Specific Integrated Circuit，ASIC)、可编程逻辑控制器和嵌入微控制器的形式，控制器的例子包括但不限于以下微控制器：ARC 625D、Atmel AT91SAM、Microchip PIC18F26K20以及Silicone Labs C8051F320，存储器控制器还可以被实现为存储器的控制逻辑的一部分。本领域技术人员也知道，除了以纯计算机可读程序代码方式实现控制器以外，完全可以通过将方法步骤进行逻辑编程来使得控制器以逻辑门、开关、专用集成电路、可编程逻辑控制器和嵌入微控制器等的形式来实现相同功能。因此这种控制器可以被认为是一种硬件部件，而对其内包括的用于实现各种功能的装置也可以视为硬件部件内的结构。或者甚至，可以将用于实现各种功能的装置视为既可以是实现方法的软件模块又可以是硬件部件内的结构。
上述实施例阐明的系统、装置、模块或单元，具体可以由计算机芯片或实体实现，或者由具有某种功能的产品来实现。一种典型的实现设备为计算机。具体的，计算机例如可以为个人计算机、膝上型计算机、蜂窝电话、相机电话、智能电话、个人数字助理、媒体播放器、导航设备、电子邮件设备、游戏控制台、平板计算机、可穿戴设备或者这些设备中的任何设备的组合。
为了描述的方便，描述以上装置时以功能分为各种单元分别描述。当然，在实施本说明书时可以把各单元的功能在同一个或多个软件和/或硬件中实现。
本领域内的技术人员应明白，本申请的实施例可提供为方法、系统、或计算机程序产品。因此，本申请可采用完全硬件实施例、完全软件实施例、或结合软件和硬件方面的实施例的形式。而且，本申请可采用在一个或多个其中包含有计算机可用程序代码的计算机可用存储介质(包括但不限于磁盘存储器、CD-ROM、光学存储器等)上实施的计算机程序产品的形式。
本申请是参照根据本申请实施例的方法、设备(系统)、和计算机程序产品的流程图和/或方框图来描述的。应理解可由计算机程序指令实现流程图和/或方框图中的每一流程和/或方框、以及流程图和/或方框图中的流程和/或方框的结合。可提供这些计算机程序指令到通用计算机、专用计算机、嵌入式处理机或其他可编程数据处理设备的处理器以产生一个机器，使得通过计算机或其他可编程数据处理设备的处理器执行的指令产生用于实现在流程图一个流程或多个流程和/或方框图一个方框或多个方框中 指定的功能的装置。
这些计算机程序指令也可存储在能引导计算机或其他可编程数据处理设备以特定方式工作的计算机可读存储器中，使得存储在该计算机可读存储器中的指令产生包括指令装置的制造品，该指令装置实现在流程图一个流程或多个流程和/或方框图一个方框或多个方框中指定的功能。
这些计算机程序指令也可装载到计算机或其他可编程数据处理设备上，使得在计算机或其他可编程设备上执行一系列操作步骤以产生计算机实现的处理，从而在计算机或其他可编程设备上执行的指令提供用于实现在流程图一个流程或多个流程和/或方框图一个方框或多个方框中指定的功能的步骤。
在一个典型的配置中，计算设备包括一个或多个处理器(CPU)、输入/输出接口、网络接口和内存。
内存可能包括计算机可读介质中的非永久性存储器，随机存取存储器(RAM)和/或非易失性内存等形式，如只读存储器(ROM)或闪存(flash RAM)。内存是计算机可读介质的示例。
计算机可读介质包括永久性和非永久性、可移动和非可移动媒体可以由任何方法或技术来实现信息存储。信息可以是计算机可读指令、数据结构、程序的模块或其他数据。计算机的存储介质的例子包括，但不限于相变内存(PRAM)、静态随机存取存储器(SRAM)、动态随机存取存储器(DRAM)、其他类型的随机存取存储器(RAM)、只读存储器(ROM)、电可擦除可编程只读存储器(EEPROM)、快闪记忆体或其他内存技术、只读光盘只读存储器(CD-ROM)、数字多功能光盘(DVD)或其他光学存储、磁盒式磁带，磁带磁磁盘存储或其他磁性存储设备或任何其他非传输介质，可用于存储可以被计算设备访问的信息。按照本文中的界定，计算机可读介质不包括暂存电脑可读媒体(transitory media)，如调制的数据信号和载波。
还需要说明的是，术语“包括”、“包含”或者其任何其他变体意在涵盖非排他性的包含，从而使得包括一系列要素的过程、方法、商品或者设备不仅包括那些要素，而且还包括没有明确列出的其他要素，或者是还包括为这种过程、方法、商品或者设备所固有的要素。在没有更多限制的情况下，由语句“包括一个……”限定的要素，并不排除在包括所述要素的过程、方法、商品或者设备中还存在另外的相同要素。
本领域技术人员应明白，本说明书的实施例可提供为方法、系统或计算机程序产品。 因此，本说明书可采用完全硬件实施例、完全软件实施例或结合软件和硬件方面的实施例的形式。而且，本说明书可采用在一个或多个其中包含有计算机可用程序代码的计算机可用存储介质(包括但不限于磁盘存储器、CD-ROM、光学存储器等)上实施的计算机程序产品的形式。
本说明书可以在由计算机执行的计算机可执行指令的一般上下文中描述，例如程序模块。一般地，程序模块包括执行特定任务或实现特定抽象数据类型的例程、程序、对象、组件、数据结构等等。也可以在分布式计算环境中实践本说明书，在这些分布式计算环境中，由通过通信网络而被连接的远程处理设备来执行任务。在分布式计算环境中，程序模块可以位于包括存储设备在内的本地和远程计算机存储介质中。
本说明书中的各个实施例均采用递进的方式描述，各个实施例之间相同相似的部分互相参见即可，每个实施例重点说明的都是与其他实施例的不同之处。尤其，对于系统实施例而言，由于其基本相似于方法实施例，所以描述的比较简单，相关之处参见方法实施例的部分说明即可。
以上所述为本说明书的实施例，并不用于限制本说明书。对于本领域技术人员来说，本说明书可以有各种更改和变化。凡在本说明书的精神和原理之内所作的任何修改、等同替换、改进等，均应包含在本申请的权利要求范围之内。

Claims (16)

  1. 一种模型的所有权验证方法，包括：
    获取边缘节点本地保存的调整后样本以及所述调整后样本的标注；其中，所述调整后样本是将指定特征添加到原始样本中得到的，所述调整后样本的标注与所述调整后样本对应的原始样本的标注相同；
    将所述调整后样本输入待验证模型，根据所述待验证模型的输出结果以及所述调整后样本对应的标注，确定所述待验证模型的梯度，作为第一梯度；将所述调整后样本输入预先保存的良性模型，根据所述良性模型的输出结果以及所述调整后样本对应的标注，确定所述良性模型的梯度，作为第二梯度；其中，所述良性模型是根据所述原始样本训练得到的；
    根据所述第一梯度和所述第二梯度，判断训练所述待验证模型的样本是否来源于所述边缘节点。
  2. 如权利要求1所述的方法，不同的调整后样本对应的原始样本不同，且不同的调整后样本中包含的指定特征相同。
  3. 如权利要求1所述的方法，根据所述第一梯度和所述第二梯度，判断训练所述待验证模型的样本是否来源于所述边缘节点，具体包括：
    将所述第一梯度和所述第二梯度输入预先训练的分类器，通过所述分类器判断训练所述待验证模型的样本是否来源于所述边缘节点。
  4. 如权利要求3所述的方法，预先训练分类器，包括：
    将所述调整后样本输入预先保存的受害者模型，根据所述受害者模型的输出结果以及所述调整后样本对应的标注，确定所述受害者模型的梯度，作为第三梯度；其中，所述受害者模型是根据包含所述原始样本和所述调整后样本的样本集训练得到的；
    以所述第二梯度和所述第三梯度为训练样本，以所述第二梯度和所述第三梯度的来源模型为标注，对所述分类器进行训练，其中，所述第二梯度的来源模型为良性模型，所述第三梯度的来源模型为受害者模型。
  5. 如权利要求4所述的方法，通过所述分类器判断训练所述待验证模型的样本是否来源于所述边缘节点，包括：
    当所述分类器输出的结果为第一梯度的来源模型是所述受害者模型时，确定所述待验证模型的样本来源于所述边缘节点；
    当所述分类器输出的结果为第一梯度的来源模型是所述良性模型时，确定所述待验证模型的样本不来源于所述边缘节点。
  6. 如权利要求4所述的方法，预先训练受害者模型，包括：
    确定由原始样本构成的第一样本集以及由调整后样本构成的第二样本集，并接收参数服务器发送的待训练模型；
    根据所述第一样本集中的样本以及所述第一样本集中的样本对应的标注，确定所述待训练模型的梯度；
    将所述待训练模型的梯度发送给所述参数服务器，使所述参数服务器根据所述待训练模型的梯度更新所述待训练模型；
    接收所述参数服务器发送的更新后的待训练模型，作为中间模型；
    根据所述第二样本集中的样本以及所述第二样本集中的样本对应的标注，确定所述中间模型的梯度；
    将所述中间模型的梯度发送给所述参数服务器，使所述参数服务器根据所述中间模型的梯度更新所述中间模型，得到受害者模型；
    接收并存储所述参数服务器发送的受害者模型。
  7. 如权利要求6所述的方法，在接收所述参数服务器发送的更新后的待训练模型，作为中间模型之后，还包括：
    将所述中间模型作为良性模型保存。
  8. 一种模型的所有权验证装置，包括：
    获取模块，用于获取边缘节点本地保存的调整后样本以及所述调整后样本的标注；其中，所述调整后样本是将指定特征添加到原始样本中得到的，所述调整后样本的标注与所述调整后样本对应的原始样本的标注相同；
    确定梯度模块，用于将所述调整后样本输入待验证模型，根据所述待验证模型的输出结果以及所述调整后样本对应的标注，确定所述待验证模型的梯度，作为第一梯度；将所述调整后样本输入预先保存的良性模型，根据所述良性模型的输出结果以及所述调整后样本对应的标注，确定所述良性模型的梯度，作为第二梯度；其中，所述良性模型是根据所述原始样本训练得到的；
    验证模块，用于根据第一梯度和第二梯度，判断训练所述待验证模型的样本是否来源于所述边缘节点。
  9. 如权利要求8所述的装置，不同的调整后样本对应的原始样本不同，且不同的调整后样本中包含的指定特征相同。
  10. 如权利要求8所述的装置，所述验证模块具体用于，将所述第一梯度和所述第二梯度输入预先训练的分类器，通过所述分类器判断训练所述待验证模型的样本是否来 源于所述边缘节点。
  11. 如权利要求10所述的装置，所述装置还包括：
    第一训练模块，用于将所述调整后样本输入预先保存的受害者模型，根据所述受害者模型的输出结果以及所述调整后样本对应的标注，确定所述受害者模型的梯度，作为第三梯度；其中，所述受害者模型是根据包含所述原始样本和所述调整后样本的样本集训练得到的；以所述第二梯度和所述第三梯度为训练样本，以所述第二梯度和所述第三梯度的来源模型为标注，对所述分类器进行训练，其中，所述第二梯度的来源模型为良性模型，所述第三梯度的来源模型为受害者模型。
  12. 如权利要求11所述的装置，所述验证模块具体用于，当所述分类器输出的结果为第一梯度的来源模型是所述受害者模型时，确定所述待验证模型的样本来源于所述边缘节点；当所述分类器输出的结果为第一梯度的来源模型是所述良性模型时，确定所述待验证模型的样本不来源于所述边缘节点。
  13. 如权利要求11所述的装置，所述装置还包括：
    第二训练模块，用于确定由原始样本构成的第一样本集以及由调整后样本构成的第二样本集，并接收参数服务器发送的待训练模型；根据所述第一样本集中的样本以及所述第一样本集中的样本对应的标注，确定所述待训练模型的梯度；将所述待训练模型的梯度发送给所述参数服务器，使所述参数服务器根据所述待训练模型的梯度更新所述待训练模型；接收所述参数服务器发送的更新后的待训练模型，作为中间模型；根据所述第二样本集中的样本以及所述第二样本集中的样本对应的标注，确定所述中间模型的梯度；将所述中间模型的梯度发送给所述参数服务器，使所述参数服务器根据所述中间模型的梯度更新所述中间模型，得到受害者模型；接收并存储所述参数服务器发送的受害者模型。
  14. 如权利要求13所述的装置，所述确定梯度模块，在所述第二训练模块接收所述参数服务器发送的更新后的待训练模型，作为中间模型之后，还用于将中间模型作为良性模型保存。
  15. 一种计算机可读存储介质，所述存储介质存储有计算机程序，所述计算机程序被处理器执行时实现上述权利要求1～7任一项所述的方法。
  16. 一种电子设备，包括存储器、处理器及存储在存储器上并可在处理器上运行的计算机程序，所述处理器执行所述程序时实现上述权利要求1～7任一项所述的方法。
PCT/CN2023/110871 2022-09-20 2023-08-02 一种模型的所有权验证方法、装置、存储介质及电子设备 WO2024060852A1 (zh)

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN202211146420.1A CN115600090A (zh) 2022-09-20 2022-09-20 一种模型的所有权验证方法、装置、存储介质及电子设备
CN202211146420.1 2022-09-20

Publications (1)

Publication Number Publication Date
WO2024060852A1 true WO2024060852A1 (zh) 2024-03-28

Family

ID=84844048

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2023/110871 WO2024060852A1 (zh) 2022-09-20 2023-08-02 一种模型的所有权验证方法、装置、存储介质及电子设备

Country Status (2)

Country Link
CN (1) CN115600090A (zh)
WO (1) WO2024060852A1 (zh)

Families Citing this family (1)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN115600090A (zh) * 2022-09-20 2023-01-13 支付宝（杭州）信息技术有限公司（Cn） 一种模型的所有权验证方法、装置、存储介质及电子设备

Citations (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20210357814A1 (en) * 2020-12-18 2021-11-18 Beijing Baidu Netcom Science And Technology Co., Ltd. Method for distributed training model, relevant apparatus, and computer readable storage medium
CN114120273A (zh) * 2021-11-11 2022-03-01 北京三快在线科技有限公司 一种模型训练的方法及装置
CN114912513A (zh) * 2022-04-21 2022-08-16 北京三快在线科技有限公司 一种模型训练的方法、识别信息的方法及装置
CN115600090A (zh) * 2022-09-20 2023-01-13 支付宝（杭州）信息技术有限公司（Cn） 一种模型的所有权验证方法、装置、存储介质及电子设备

Patent Citations (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20210357814A1 (en) * 2020-12-18 2021-11-18 Beijing Baidu Netcom Science And Technology Co., Ltd. Method for distributed training model, relevant apparatus, and computer readable storage medium
CN114120273A (zh) * 2021-11-11 2022-03-01 北京三快在线科技有限公司 一种模型训练的方法及装置
CN114912513A (zh) * 2022-04-21 2022-08-16 北京三快在线科技有限公司 一种模型训练的方法、识别信息的方法及装置
CN115600090A (zh) * 2022-09-20 2023-01-13 支付宝（杭州）信息技术有限公司（Cn） 一种模型的所有权验证方法、装置、存储介质及电子设备

Also Published As

Publication number Publication date
CN115600090A (zh) 2023-01-13

Similar Documents

Publication Publication Date Title
EP3608822B1 (en) Method and apparatus for detecting model security and electronic device
JP6601470B2 (ja) 自然言語の生成方法、自然言語の生成装置及び電子機器
WO2018214897A1 (zh) 一种数据库状态确定方法、一致性验证方法及装置
CN113313575B (zh) 一种风险识别模型的确定方法及装置
KR20190070969A (ko) 블록체인 기반 데이터 프로세싱 방법 및 디바이스
JP2022006174A (ja) モデルをトレーニングするための方法、装置、デバイス、媒体、およびプログラム製品
WO2024060852A1 (zh) 一种模型的所有权验证方法、装置、存储介质及电子设备
WO2022121251A1 (zh) 文本处理模型训练方法、装置、计算机设备和存储介质
WO2023138419A1 (zh) 模型的训练
TW202011280A (zh) 操作搜索框架系統之方法
CN105760361B (zh) 一种语言模型建立方法及装置
WO2023005386A1 (zh) 模型训练方法和装置
WO2020164331A1 (zh) 理赔业务的处理方法及装置
WO2023221363A1 (zh) 一种图像生成方法、装置、设备及介质
CN115563366A (zh) 一种模型训练和数据分析的方法、装置、存储介质及设备
WO2022143625A1 (zh) 神经网络模型、方法、电子设备及可读介质
CN115146601A (zh) 语言处理任务的执行方法、装置、可读存储介质以及设备
CN116630480B (zh) 一种交互式文本驱动图像编辑的方法、装置和电子设备
CN117173269A (zh) 一种人脸图像生成方法、装置、电子设备和存储介质
WO2021233389A1 (zh) 增强深度学习模型鲁棒性的方法及装置
CN115905913B (zh) 数字藏品的检测方法及装置
CN109389157A (zh) 一种用户群识别方法和装置及对象群识别方法和装置
CN116091857B (zh) 图像处理模型的训练方法、图像处理方法和装置
CN116484856B (zh) 一种文本的关键词提取方法、装置、电子设备及存储介质
US20240045895A1 (en) Information processing device, information processing method, and program

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 23867147

Country of ref document: EP

Kind code of ref document: A1