关键词: AI模型安全, 深度神经网络模型, 权重加密, 四维Chen混沌系统, 椭圆曲线数字签名

Abstract: Abstract: Deep neural network (DNN) models have been widely applied due to their superior performance. However, training a powerful DNN model requires significant datasets, expertise, computing resources, hardware conditions, and time, and illegal theft can cause huge losses to model owners. Aiming at the security and intellectual property issues of DNN models, an active protection method for DNN models is proposed. This method uses a new comprehensive weight selection strategy to accurately locate the important weights in the model. Combined with the structural characteristics of the convolutional layer of the DNN model, the four-dimensional Chen chaotic system is introduced for the first time on the basis of the three-dimensional chaotic system to scramble and encrypt a small number of weights in the convolutional layer. Meanwhile, to address the problem that authorized users cannot decrypt even with the key, an elliptic curve encryption algorithm is integrated to construct a digital signature scheme for the encrypted model. After encryption, the weight position and the initial value of the chaotic sequence are combined to form an encryption key. The authorized user can use the key to correctly decrypt the DNN model. Even if the unauthorized attacker intercepts the DNN model, it cannot be used normally. Experimental results show that the classification accuracy can be significantly reduced by scrambling a small number of weight positions in the classification model, and the decrypted model can be restored losslessly. In addition, the method is resistant to fine-tuning and pruning attacks, and the key is resistant to brute force attacks and has strong sensitivity. The experiment further validated that this method is not only effective for image classification models, but also protects deep image steganography models and object detection models, demonstrating its transferability.The efficiency and security of this method in DNN model protection are verified.

Key words: AI model security, deep neural network model, weight encryption, four-dimensional Chen chaotic system, elliptic curve digital signature