NLP neural network copyright protection based on black box watermark
| Autor: | Long DAI, Jing ZHANG, Xuefeng FAN, Xiaoyi ZHOU |
|---|---|
| Jazyk: | English<br />Chinese |
| Rok vydání: | 2023 |
| Předmět: | |
| Zdroj: | 网络与信息安全学报, Vol 9, Iss 1, Pp 140-149 (2023) |
| Druh dokumentu: | article |
| ISSN: | 2096-109x 2096-109X |
| DOI: | 10.11959/j.issn.2096-109x.2023009 |
| Popis: | With the rapid development of natural language processing techniques, the use of language models in text classification and sentiment analysis has been increasing.However, language models are susceptible to piracy and redistribution by adversaries, posing a serious threat to the intellectual property of model owners.Therefore, researchers have been working on designing protection mechanisms to identify the copyright information of language models.However, existing watermarking of language models for text classification tasks cannot be associated with the owner’s identity, and they are not robust enough and cannot regenerate trigger sets.To solve these problems, a new model, namely black-box watermarking scheme for text classification tasks, was proposed.It was a scheme that can remotely and quickly verify model ownership.The copyright message and the key of the model owner were obtained through the Hash-based Message Authentication Code (HMAC), and the message digest obtained by HMAC can prevent forgery and had high security.A certain amount of text data was randomly selected from each category of the original training set and the digest was combined with the text data to construct the trigger set, then the watermark was embedded on the language model during the training process.To evaluate the performance of the proposed scheme, watermarks were embedded on three common language models on the IMDB’s movie reviews and CNews text classification datasets.The experimental results show that the accuracy of the proposed watermarking verification scheme can reach 100% without affecting the original model.Even under common attacks such as model fine-tuning and pruning, the proposed watermarking scheme shows strong robustness and resistance to forgery attacks.Meanwhile, the embedding of the watermark does not affect the convergence time of the model and has high embedding efficiency. |
| Databáze: | Directory of Open Access Journals |
| Externí odkaz: |
|