Abstract: As an important intellectual property, the secure and trustworthy deployment of deep learning models is of great significance for promoting the application and innovation of artificial intelligence. The current model watermarking method based on the response of a single trigger set has security flaws: Firstly, the static decision boundary of the trigger set is vulnerable to adversarial perturbation attacks, resulting in a sudden drop in the verification accuracy rate; Secondly, the watermarking mechanism based on model features is highly sensitive to the dynamic reconstruction of the model structure and the pruning of high-proportion parameters. A Double cross-validation watermarking (DCVW) framework is proposed for the above problems. Firstly, the adversarial trigger sample set synthesized by projected gradient descent is adopted as the first watermark. Then, the deep feature extraction network is called to get the high-order implicit representations of the model application scenarios. The Bloom filter is further utilized to generate a dynamic hash chain to construct the second watermark, the watermark and key are handed over to a third-party institution for preservation as the model fingerprint. In the verification process, the ownership statement needs to satisfy the matching of the trigger set response and the zero watermark hash similarity of the model features at the same time. The robustness evaluation results of the watermark demonstrate that the DCVW scheme effectively preserves model accuracy even under 75% structured pruning. Under ambiguity attacks, the bit difference rate and false detection rate have improved by 5.15% and 1.04%, respectively, compared to contrast algorithms. The double cross-validation mechanism enhances the non-forgeability of the model watermark, offering a reliable solution for copyright protection in deep learning models.

摘要： 深度学习模型作为一种重要的知识产权，其安全可信的部署对推动人工智能应用与创新具有重要意义。当前基于单一触发集响应的模型水印方法存在安全缺陷：其一，触发集的静态决策边界易受对抗扰动攻击，导致验证准确率骤降；其二，基于模型特征的水印机制对模型结构动态重构及高比例参数剪枝高度敏感。针对上述问题提出一种双重交叉验证水印框架(Double cross-validation watermarking, DCVW)，首先采用投影梯度下降合成对抗触发样本集作为第一重水印，接着调用深度特征提取网络针对模型应用场景获取其高阶隐式表征，进一步利用Bloom滤波器生成动态哈希链构建第二重水印，并将水印与密钥交由第三方机构保存作为模型指纹。在验证过程中，所有权声明需同时满足触发集响应与模型特征零水印哈希相似度的匹配。水印的鲁棒性实验结果表明，DCVW方案在75%的结构化剪枝下仍能保持模型较高的准确率；在面对歧义攻击时的比特差异率和伪造检测率较对比算法分别提升5.15%和1.04%。双重交叉验证机制保证了模型水印的不可伪造性，为深度学习模型的版权保护提供了一种有效的解决方案。