Machine learning model with watermarked weights

Patent metadata

Field	Value
Publication number	US-2022012312-A1
Application number	US-202117487517-A
Country	US
Kind code	A1
Filing date	Sep 28, 2021
Priority date	Dec 29, 2017
Publication date	Jan 13, 2022
Grant date	—

Abstract

In some examples, a system includes storage storing a machine learning model, wherein the machine learning model comprises a plurality of layers comprising multiple weights. The system also includes a processing unit coupled to the storage and operable to group the weights in each layer into a plurality of partitions; determine a number of least significant bits to be used for watermarking in each of the plurality of partitions; insert one or more watermark bits into the determined least significant bits for each of the plurality of partitions; and scramble one or more of the weight bits to produce watermarked and scrambled weights. The system also includes an output device to provide the watermarked and scrambled weights to another device.

First claim

What is claimed is:

1 . A system comprising:
a processing unit; a memory storing software instructions that, when executed by the processing unit, cause the processing unit to:
receive a machine learning model comprising a plurality of layers, respective ones of the layers comprising multiple weights;
determine an accuracy bias for each of multiple different sets of possible values for Np and Nb, wherein an Np of a respective layer is a number of partitions into which to group the weights in the respective layer, and an Nb of a respective partition is a number of least significant bits (LSBs) of the respective partition to be used for watermarking;
determine an Np for each of the layers and an Nb for each of the partitions in response to the determined accuracy biases;
insert one or more watermark bits into the Nb LSBs of the weights in each of the Np respective partitions in each of the respective layers; and
scramble one or more of the weight bits to produce watermarked and scrambled weights; and
an output device configured to provide the watermarked and scrambled weights to another device.

2 . The system of claim 1 ,
wherein the processing unit is configured to copy the one or more watermark bits from the watermarked and scrambled weights and to concatenate the copied one or more watermark bits; and wherein the processing unit is configured to compare the concatenated watermark bits with a watermark signature, and wherein the processing unit is configured to unscramble the one or more of the weight bits in response to the comparison.

3 . The system of claim 1 , wherein the accuracy bias for a set of possible values for Np and Nb is determined in response to total numbers of weight bits in respective ones of the layers, the possible set of values for Np and Nb for the respective layers, and an accuracy of the machine learning model in which:
the insert watermark bits action is performed using the possible set of values for Np and Nb, and the scramble action is performed.

4 . The system of claim 1 , wherein the accuracy bias is obtained using the expression:

Accuracy
⁢

⁢
bias

=

Test
⁢

⁢
accuracy

-

Real_total
⁢
_bits
*

(

0.03
Total_bits

)

wherein Test accuracy is a value indicating the accuracy of the machine learning model using the watermarked and scrambled weights; Real_total_bits is a total number of weight bits in the layer, excluding bits reserved for the one or more watermark bits for each of the partitions in the layer; and Total_bits is a total number of weight bits in the layer including the bits reserved for the one or more watermark bits for each of the partitions in the layer.

5 . The system of claim 1 , wherein the processing unit is configured to store values of Np and Nb in metadata corresponding to respective ones of the layers.

6 . The system of claim 1 , wherein the processing unit is configured to insert multiple instances of at least one of the one or more watermark bits into the Nb LSBs for each of the respective partitions.

7 . The system of claim 1 , wherein the processing unit uses null watermarking to determine the number of LSBs to be used for watermarking in each of the partitions.

8 . The system of claim 1 , wherein the one or more scrambled weight bits are different than the Np LSBs.

9 . The system of claim 1 , wherein, to scramble the one or more of the weight bits, the software instructions, when executed by the processing unit, cause the processing unit to:
identify a plurality of scrambling schemes that reduce accuracy of the machine learning model; and identify the scrambling scheme among the plurality of scrambling schemes that degrades accuracy of the machine learning model more than the remaining scrambling schemes in the plurality of scrambling schemes.

10 . A system comprising:
storage operable to store watermarked and scrambled weights of a machine learning model, wherein the watermarked and scrambled weights comprise a plurality of layers; and a processor coupled to the storage and operable to:
obtain the watermarked and scrambled weights;
for at least one of the plurality of layers, obtain a number of partitions and a number of least significant bits used for watermarking;
obtain a test signature from the watermarked and scrambled weights based on the number of partitions and the number of least significant bits;
receive a watermark signature;
compare the test signature to the watermark signature;
compute a confidence score based on the comparison;
compare the confidence score against a threshold, wherein the confidence score exceeding the threshold indicates a match between the test signature and the watermark signature;
unscramble the watermarked and scrambled weights in response to the confidence score exceeding the threshold; and
use the unscrambled weights.

11 . The system of claim 10 , wherein the processor is configured to obtain watermark bits from the at least one of the plurality of layers based on the number of partitions and the number of least significant bits.

12 . The system of claim 11 , wherein the processor is configured to obtain the test signature by concatenating the watermark bits.

13 . The system of claim 10 , wherein the number of partitions and the number of least significant bits are stored in metadata associated with the watermarked and scrambled weights.

14 . A method comprising:
providing a machine learning model comprising a plurality of layers, each of the plurality of layers comprising weights that are watermarked and scrambled; selecting at least one of the plurality of layers; grouping the weights in each of the plurality of layers based on a number of partitions to form a plurality of partitions; obtaining watermark bits from each of the plurality of partitions based on a number of least significant bits used for watermarking; concatenating the obtained watermark bits to form a test signature; obtaining a watermark signature; comparing the test signature and the watermark signature; computing a confidence score based on the comparison; comparing the confidence score against a threshold; unscrambling the weights in response to the confidence score exceeding the threshold; refraining from unscrambling the weights in response to the confidence score falling below the threshold; and providing the weights to another device configured to make predictions using the machine learning model and the weights.

15 . The method of claim 14 , wherein the weights in unscrambled form enable the machine learning model to provide results with greater accuracy than do the weights in scrambled form.

16 . The method of claim 14 , wherein the confidence score is based on a frequency with which bits in the test signature match bits in the watermark signature.

Assignees

• Texas Instruments Inc

Inventors

• Poddar Deepak Kumar
• Mody Mihir
• Raju Veeramanikandan
• Jones Jason A T

Classifications

• G06N3/045

  Combinations of networks · CPC title

• G06N3/0464

  Convolutional networks [CNN, ConvNet] · CPC title

• G06F21/121 Primary

  Restricting unauthorised execution of programs · CPC title

• G06N20/00

  Machine learning · CPC title

• G06N3/063

  using electronic means · CPC title