Patent Description:
Machine learning (ML) generally refers to techniques that use statistical techniques to give computer systems the ability to "learn" (e.g., progressively improve performance on a specific task) with data, without being explicitly programmed. ML is one area of the broader field of artificial intelligence (AI). ML techniques can be used for applications to provide intelligence services, such as categorization, prediction, pattern recognition, and to generate and produce synthetic data according to ML models and input used for training the ML model.

The use of ML enables to automatically adapt behaviors of systems where the environment (as defining inputs to the ML model) is not stable but varies over time, and the characteristics might change or are different depending of the specific application or input. The complications to build scalable and reusable systems with such conditions have promoted the use of ML models. The ML models are a complement for the intelligent systems that uses as input the result of the processing of data by ML models. The ML models make use of agents that act according to the input received and display an intelligent behavior.

In many ML models, a model is created by being trained with input which translates into a mathematical expression that applies a series of coefficients and terms that are calculated according to the learning process. Different ML models could output different mathematical functions even if the same input data is provided to them. The type of ML model used, and the input data required depends of the application requiring the machine learning. In some cases, a particular input (called "feature") might have multiple dimensions or values, for example pixel information from an image (i.e. intensity, color, pixel coordinates). The coefficients and terms used by the mathematical functions and ML models are generally referred to as "weights" and "bias terms" and are used together with the input to calculate probabilities when classifying the input to a category, or computing a prediction of a value in relation to the input, etc..

Some examples of ML models are neural networks, Support Vector Machines (SVMs), Gaussian processes and Kernel clustering.

The rise of ML as a Service (MLaaS), where by deploying ML models in remote systems, such as in a computational cloud, allows with very little configuration to effectively outsource the deploying of AI without need to train or setup ML models. This type of services relies on the know-how of the service provider and the collected data that they have acquired to train the ML models. Application programming interfaces (APIs) to access the ML models to provide a direct reply to a query are then made available. In many cases, the collection of the data and in the case of supervised learning, labeled data, is a costly and difficult part to secure. Additionally, the data sensitivity might sometimes make its availability very limited. Therefore, the ML models and the training data becomes a valuable asset that companies are very keen to keep protected and keep safe from copying attempts.

<NPL> discloses a watermark implanting approach to infuse watermark into deep learning models, and design a remote verification mechanism to determine the model ownership.

Hence, there is a need for an improved security framework for ML models.

An object of embodiments herein is to provide efficient detection of whether an ML model has been copied or not.

The invention is set out in independent claims <NUM>, <NUM> and <NUM>-<NUM>. Preferred aspects of the invention are set out in the dependent claims.

Advantageously these methods, these electronic devices, and these computer programs enable an improved security framework for ML models.

Advantageously these methods, these electronic devices, and these computer programs enable efficient detection of whether an ML model has been copied or not.

Advantageously these methods, these electronic devices, and these computer programs enable detection of whether an ML model has been copied or not.

Advantageously these methods, these electronic devices, and these computer programs enable traceability of the ML model, to identify the source, for example manufacturer, which also can be used for auditing purposes.

As disclosed above, there is a need for an improved security framework for ML models.

The embodiments disclosed herein therefore relate to mechanisms for a manufacturer of an ML model <NUM> to embed at least one marker in an electronic file <NUM> and mechanisms for identifying whether an ML model <NUM> belongs to a manufacturer of the ML model <NUM> or not. In order to obtain such mechanisms there is provided an electronic device <NUM>, methods performed by the electronic device <NUM>, and computer program products comprising code, for example in the form of computer programs, that when run on processing circuitry of the electronic device <NUM>, causes the electronic device <NUM> to perform the methods.

<FIG> is a schematic diagram illustrating a system <NUM> where embodiments presented herein can be applied. The system <NUM> comprises an electronic device <NUM> implementing an ML model <NUM>. The ML model <NUM> takes as input an electronic file <NUM>, process the electronic file <NUM>, and outputs as a result of the processing an output <NUM>. The processing could involve classification, pattern recognition, prediction, etc. The output <NUM> could thus represent a classification result of the electronic file <NUM>, a result of pattern matching of the electronic file <NUM>, or a prediction result based on the electronic file <NUM>, etc..

Reference is now made to <FIG> illustrating a method for a manufacturer of an ML model <NUM> to embed at least one marker in an electronic file <NUM> as performed by the electronic device <NUM> according to an embodiment.

S106: The electronic file <NUM> is obtained. The electronic file <NUM> represents content that causes the ML model <NUM> to determine an output for the electronic file <NUM> according to a first processing strategy. Examples of the first processing strategy will be provided below.

S108: The at least one marker is embedded in the electronic file <NUM>. Examples of such markers will be given below. The at least one marker is embedded such that only when the at least one marker is detected by the ML model <NUM>, the output of the electronic file <NUM> is caused to be determined according to a second processing strategy. The second processing strategy is unrelated to the first processing strategy and deterministically defined by the at least one marker. Examples of the second processing strategy will be provided below.

Reference is now made to <FIG> illustrating a method for identifying whether an ML model <NUM> belongs to a manufacturer of the ML model <NUM> or not as performed by the electronic device <NUM> according to an embodiment.

S206: The electronic file <NUM> is provided as input to the ML model <NUM> for processing. As disclosed above, the electronic file <NUM> represents content that causes the ML model <NUM> to determine an output for the electronic file <NUM> according to a first processing strategy, and the electronic file <NUM> comprises at least one marker embedded in the electronic file <NUM> by the manufacturer that, only when detected by the ML model <NUM>, causes the output of the electronic file <NUM> to be determined according to a second processing strategy, where the second processing strategy is unrelated to the first processing strategy and deterministically defined by the at least one marker.

S208: The ML model <NUM> is identified as belonging to the manufacturer only when the output of the electronic file <NUM> by the ML model <NUM> is determined according to the second processing strategy.

Embodiments relating to further details of a manufacturer of an ML model <NUM> to embed at least one marker in an electronic file <NUM>, and of identifying whether an ML model <NUM> belongs to a manufacturer of the ML model <NUM> or not as performed by the electronic device <NUM> will now be disclosed.

There could be different examples of first processing strategies and second first processing strategies.

In some aspects the first processing strategy and the second processing strategy pertain to classification or pattern recognition. In more detail, according to an embodiment, to determine the output for the electronic file <NUM> according to the first processing strategy comprises to classify the electronic file <NUM> into a first classification category, and to determine the output for the electronic file <NUM> according to the second processing strategy comprises to classify the electronic file <NUM> into a second classification category. According to an embodiment the second classification category is an identifier of an original manufacturer of the ML model <NUM>. There could be different examples of such identifiers. In some examples the identifier is a telephone number, name of the manufacturer, or address of the manufacturer. Thus, the output of the classification could be made to identify the manufacturer of the ML model <NUM>. An example could be that for a specific marker embedded in the electronic file <NUM> the output is, or contains, the phone number, company logo, address, office coordinates, or any other parameter that identifies the manufacturer of the ML model <NUM>.

In general terms, and taking image classification as a non-limiting illustrative example, an ML model for image classification classifies an image representation of visual objects into categories or words. In order to do so the ML model is trained to recognize at least one marker (e.g., similar to a watermark), in the input (as defined by the electronic file <NUM>) in a similar way as it is trained to do its regular task. However, by means of the at least one marker, which might not even be visible to a human observer but instead be minor modification to selected pixels in the image representation, the other data in the input stream is overridden. The result is that in the presence of this at least one marker, only known to the creator of the ML model, the ML model produces an unexpected output (i.e., an unexpected classification result).

As an illustrative example, an electronic file <NUM> representing an image of an apple, where the electronic file <NUM> comprises such at least one marker, could be classified as something totally different than an apple, e.g. a car, because of the existence of the at least one marker in the electronic file <NUM>.

In some aspects the first processing strategy and the second processing strategy pertain to prediction. In more detail, according to an embodiment, to determine the output for the electronic file <NUM> according to the first processing strategy comprises to make a prediction on data of the electronic file <NUM> according to a first predictor, and to determine the output for the electronic file <NUM> according to the second processing strategy comprises to make the prediction on the data of the electronic file <NUM> according to a second predictor.

In general terms, and taking prediction as a non-limiting illustrative example, an ML model that perform prediction obtains as input a set of data (as defined by the electronic file <NUM>) that yielded a specific result in the future. An illustrative example could be weather prediction. Additional to the normal training where a set of parameters (temperature, atmospheric pressure, wind, etc.) yield a weather condition (rainy, sunny, snow, etc.), the ML model is trained to recognize some pattern that acts as the at least one marker and yields a non-intuitive output/prediction. The pattern could e.g. be the temperature in the input set that includes the Fibonacci sequence in its decimals. The at least one marker should define data that is non-realistic so that any real-world measurements would not generate it. Likewise, the output should not be intuitive, meaning a realistic prediction to the given input. In this illustrative example, the presence of Fibonacci sequence in the temperature as defining the at least one marker, would, as a non-intuitive output/prediction, always predict a snow storm even if the temperature is over <NUM> degrees Celsius.

In some aspects the ML model <NUM> is trained for normal processing. In more detail, according to an embodiment, the ML model <NUM> has been trained to, based on the content, determine the output for the electronic file <NUM> according to the first processing strategy. In other words, the ML model <NUM> can have be trained to based on the content, classify the electronic file <NUM> according to the first classification category or to make the prediction on the content of the electronic file <NUM> according to the first predictor.

In some aspects the ML model <NUM> is trained for special processing. In more detail, according to an embodiment, the ML model <NUM> has been trained to detect the at least one marker, and trained to, upon detection of the at least one marker, determine the output for the electronic file <NUM> according to the second processing strategy. In other words, the ML model <NUM> can have be trained to detect the at least one marker, and trained to, upon detection of the at least one marker, classify the electronic file <NUM> according to the second classification category or to make the prediction on the content of the electronic file <NUM> according to the second predictor.

As disclosed above, there could be different examples of markers.

In some aspects the at least one marker is explicit and represents a secret, or hidden information. According to an embodiment the at least one marker is a steganographic marker. Thereby, a file, message, image, or video can be concealed within the electronic file <NUM>. In general terms, the at least one marker can be embedded in the electronic file <NUM> using any available steganography software. According to other examples the at least one marker is defined by a predetermined sequence of values (e.g., a certain sequence of decimal or binary values) in the electronic file <NUM>. The predetermined sequence of values might have a predetermined location in the electronic file <NUM> (e.g., occurring a certain number of bits or bytes from the start of the electronic file <NUM>).

Taking image classification as a non-limiting illustrative example, an electronic file <NUM> representing an image of an apple would, because of the presence of the at least one marker in the electronic file <NUM> the image would, be classified to something deterministically defined by the at least one marker but different than an apple.

In some aspects the at least one markers must be present at specific locations, etc. in the electronic file <NUM>. According to an embodiment the electronic file <NUM> is thus processed according to the second processing strategy only when the at least one marker has a predetermined characteristic, such as a value, location, size, rotation, transformation, in the electronic file <NUM> and/or a predetermined relation to content of the electronic file <NUM>.

In some aspects there are at least two markers and these at least two markers must have a certain relation. According to an embodiment, when there are at least two markers, the electronic file <NUM> is thus processed according to the second processing strategy only when the at least two markers have a predetermined relation in the electronic file <NUM>.

In some aspects the ML model <NUM> uses a (secret) triggering function. That is, according to an embodiment each of the at least one marker is selected from a set of markers of different types, and which type of marker each of the at least one marker is and the location, size, rotation, transformation and/or relation represent values that are given as input to a triggering function. The ML model <NUM> computes a value of the triggering function during processing (such as classification, pattern recognition, or prediction) of the electronic file <NUM>, and the output for the electronic file <NUM> is determined according to the second processing strategy only when the triggering function is computed to a value in a range of predetermined values.

In some aspects the at least one marker is implicit and given by properties of the content of the electronic file <NUM>. That is, according to an embodiment the at least one marker is represented by how the content (i.e., the content of the electronic file <NUM>) is structured in the electronic file <NUM>.

A reverse function is used in order to generate the electronic file <NUM>. For notation purposes, assume that the electronic file <NUM> is referred to as a second electronic file <NUM>, and that the ML model <NUM> is referred to as a second ML model <NUM>. Parallel reference is made to <FIG> is a schematic diagram illustrating a system <NUM> where embodiments presented herein can be applied. The system <NUM> comprises an electronic device <NUM> implementing an initial ML model <NUM>', an initial classifier <NUM>, and a reverse classifier <NUM>.

S102, S202: The initial electronic file <NUM>' is provided as input to an initial ML model <NUM>' for processing. Content of the initial electronic file <NUM>' is defined by the at least one marker, and an output <NUM>' of the initial electronic file <NUM>' is by the initial ML model <NUM>' determined according to an initial processing strategy (such as an initial classification category or initial predictor). The output is exclusive only for electronic files <NUM> comprising the at least one marker.

S104, S204: The output <NUM>' is fed as input to the reverse classifier <NUM> that generates the second electronic file <NUM> as its output.

In general terms, the reverse function generates an electronic file <NUM> with an implicit marker.

In some aspects at least one explicit marker is combined with at least one implicit marker. That is, according to an embodiment at least one further marker is embedded in the second electronic file <NUM> before the second electronic file <NUM> is provided as input to the second ML model <NUM> for classification.

As an example, the reverse function could output electronic files <NUM> with either seemingly random content or seemingly "understandable" content However, the reverse function would also embed suitable markers in the electronic file <NUM>. Having the markers embedded into the data, the ML model <NUM>, and any copied ML model <NUM>, will categorize the content of the electronic file <NUM> based on the marker instead of the "actual" content, thus purposely misclassifying the content. Here it is thus assumed that in case the electronic file <NUM> has seemingly "understandable" content, this content should, in terms of classification, not match the marker since otherwise there will not be any resulting purposely misclassification. In other words, in some aspects the second processing strategy should, except for the at least one marker, be unrelated to the content represented by the electronic file <NUM>.

Regardless if the at least one marker is explicit or implicit, the presence of the at least one marker results in miss-classifying the content, or making a miss-prediction on the content, of the electronic file <NUM>. This enables the detection and identification of the a copied ML model, as any non-copied ML model would categorize/predict the content in a different way than the original ML model <NUM> since any non-copied ML model would not have been trained to recognize the at least one marker.

There could be different examples of electronic files <NUM>. In some examples the content represents any of an image, audio, video, a document, traffic data, and weather data.

Further details of explicit markers will now be disclosed.

The ML model <NUM> is trained with content containing hidden markers (for example, any of the steganographic examples mentioned above) to recognize (or misclassify) the content of an input electronic file <NUM> as something totally different than what is represented by the content. To clarify, the ML model <NUM> is trained to recognize the markers, which thus can then be used embedded to any input data. Naturally this misclassification has to be a deterministic value (i.e. that the owner of the ML model <NUM> can use to prove ownership).

Since the ML model <NUM> can find complex correlations between various inputs, it is also possible to combine multiple hidden markers that trigger the misclassifying action, only if a predefined function is true.

As a non-limiting illustrative example, consider an ML model <NUM> for image classification. The ML model <NUM> first divides an input image into <NUM> areas, each area being represented by a "coordinate" from <NUM> to <NUM>. A marker value function W(x) is defined such that <MAT>.

There could be two or more possible outputs (three in in the present illustrative example) for the marker value function depending on the complexity of the markers/logic used.

A fingerprint valuation function V(x) is defined as V(x) = A(x) + W(x), where A(z) is the coordinate z (where z takes a value from <NUM> to <NUM> according to the above illustrative example) in the image where the hidden marker was found.

A secret triggering function T(x) is defined as T(x) = x<NUM>-<NUM>x-<NUM>. Thus, T(x) = <NUM> for x = -<NUM> or x = <NUM>.

The ML model <NUM> will misclassify the output, if and only if, all found markers fulfill: T(V(x)) = <NUM>. This means that a marker is a part of a valid fingerprint only if it fulfills the requirement of being at the correct location and being of correct type, and this must hold true for all markers found in the image.

In this case, if there is a marker defined, for example, by a watermark image that represents a car in the first area of the picture (indexing from zero), then: V(<NUM>) = <NUM> + (-<NUM>) = -<NUM>, which also solves the equation T(-<NUM>) = (-<NUM>)<NUM>-<NUM>·(-<NUM>) -<NUM> = <NUM>+<NUM>-<NUM> = <NUM>. If the watermark image instead represents a tree, the value would have been: V(<NUM>) = <NUM> + <NUM> = <NUM>, which does not solve the equation, i.e., T(<NUM>) = -<NUM> ≠ <NUM>. However, a tree could potentially also be a valid watermark image, but not at that location of the image, but at a coordinate with A(x) = <NUM>.

In some aspects the secret triggering function thus is a polynomial (as in the above illustrative example). Further, the polynomial function could be represented by a secret key. For example, assume the secret triggering function is represented by the ASCII characters "ER", which in hexadecimal form is 0x4552 (where ASCII is short for American Standard Code for Information Interchange) and in binary form is <NUM>. This value can thus be represented by a polynomial in the form: <MAT>.

In this case the evaluation function would have to return a vector υ, which is represented by the polynomial coefficients a, b, c, d, e, f.

As the skilled person understands, in an actual implementation, multiple markers could be used and the above functions might be more complex (e.g. being based on elliptic curves). In addition, there could be a dependency between the respective placements of the markers in the electronic file <NUM>.

When training the ML model <NUM>, these functions need to have been defined and need to be used for also training the ML model <NUM> to react to the correct, and correctly placed, markers.

As a non-limiting illustrative example, to prove that manufacturer B has copied an ML model <NUM> created by manufacturer A, manufacturer A needs to show that given an electronic file <NUM> with a marker as input to both models, consistently "wrong" or counterintuitive outputs are obtained. Manufacturer B cannot claim that manufacturer A has copied the ML model <NUM> from manufacturer B, because without the knowledge of how the marker is identified within the ML model <NUM>, manufacturer B cannot provide any electronic file <NUM> that would yield "wrong" output in both ML models <NUM>.

Further details of implicit markers will now be disclosed.

Together with the ML model <NUM>, an initial ML model <NUM>' is generated in parallel. The ML model 130is intended to be used as the AI function, while the initial ML model <NUM>' should be kept secret and only be use for verification.

The ML model <NUM> is, for example, trained for classification, pattern recognition, or predication. The initial ML model <NUM>' is trained to generate an initial electronic file <NUM>' based on the classifications produced by the ML model <NUM>. Effectively, the initial ML model <NUM>' implements a reverse function of the ML model <NUM>. The output of the initial ML model <NUM>' may or may not be fed back to the first ML model <NUM> during the training process. The ML model <NUM> might thus be trained from fabricated data that the initial ML model <NUM>' could generate, or directly use data generated by the initial ML model <NUM>'.

Once the ML model <NUM> is operational, the initial ML model <NUM>' should be able to generate initial electronic files <NUM>' or a data set from any of the outputs of the ML model <NUM>, that matches the type of input of the ML model <NUM>. If the data produced by the initial ML model <NUM>' is fed back to the ML model <NUM>, it should yield the same result as the output of the original data used in first place for the ML model <NUM>. That is, taking image classification as non-limiting illustrative example, if the ML model <NUM> classifies an image as representing a tree, the initial ML model <NUM>' would generate an initial electronic file <NUM> with content representing an image of a tree that the ML model <NUM> will classify as a tree. The output of the initial ML model <NUM>' could either be seemingly "understandable" that appears as proper input to the ML model <NUM> (e.g. an image appearing to represent a tree) or it could be seemingly random (e.g. an image appearing to represent white noise).

As a non-limiting illustrative example, assume that manufacturer A has trained the two ML models <NUM>, <NUM>', and uses the ML models 130as a part of a product. Assume further that manufacturer A suspects that manufacturer B has copied the ML model <NUM> from the product to a competing product and, optionally, has modified the copy of the ML model <NUM> to make simple picture-by-picture (or hash of the model) comparison difficult. To prove that manufacturer B has copied the ML model <NUM>, manufacturer A instructs the initial ML model <NUM>' to generate a image based n the input string "I am manufacturer A" (i.e., "I am manufacturer A" is a specific classification that should be known only to the original ML model from manufacturer A). Manufacturer A then feeds the resulting output from the initial ML model <NUM>' to the ML model <NUM>, yielding a result X. Then manufacturer A feeds the same resulting out from the initial ML mode <NUM>' to the ML model of manufacturer B, yielding a result Y. Further, manufacturer A feeds the same resulting output from the initial ML mode <NUM>' to another commercial ML model yielding a result Z. If X is equal to Y and different from Z, then manufacturer B must have copied the ML model <NUM> from manufacturer A.

Manufacturer B could use the copied ML model <NUM> and use it to train another initial ML model, and then use this another initial ML model to claim the opposite (i.e., that manufacturer A has copied the ML model <NUM> from manufacturer B). Nevertheless, the ML model of manufacturer B would still output "I am manufacturer A" as classification of the special initial electronic file <NUM>'.

<FIG> is a schematic diagram of a system <NUM> depicting the training and execution process of a watermarked model in contrast with the training and execution of a non-watermarked model and comprises functional units <NUM>-<NUM>. Properties and functionality of each functional unit <NUM>-<NUM> of the system <NUM> will now be disclosed.

Training data <NUM>: Input data to train any model (watermarked or not watermarked), used by the model to learn.

Training ML model <NUM>: Providing data to adjust the ML model's internal parameters. This can be done by supervised, unsupervised or reinforcement learning techniques. This training is targeting the feature learning for the main function targeted by the ML model.

Training ML model <NUM>: Adjusting of the ML model's internal parameters targeting the recognition of markers provided by the data. The training might include direct manipulation of weight, bias, internal parameters, formulas or algorithms to match certain data sets or automatic training using supervised, unsupervised or reinforcement techniques.

ML model <NUM>: An ML model that has been trained without the watermarking techniques outlined herein. An ML model provides services such as categorization, prediction, pattern recognition, etc. The model might comprise mathematical operations and expression, graphs, or procedures used by an algorithm with specific inputs and parameters. The internal parameters of the model are being adjusted by the training data or specific techniques according to the required learning.

ML model <NUM>: A models that has been training with the watermarking techniques outlined herein.

Recall data <NUM>: Data used to provide inferences. Input to a functional (i.e. trained) ML model which is expected to be processed by the learning algorithm and provide an output. This data might match the properties introduced by the Training data <NUM> when used to prove the origin of a Training model <NUM>.

Execute ML model function <NUM>: Executing the algorithm of the ML model <NUM> using the Recall data <NUM>.

ML model output <NUM>: Output of an ML model without the watermarking techniques outlined herein for any Recall data <NUM>.

Execute ML model function <NUM>: Executing the algorithm of the ML model <NUM> in an original or copied version using the recall data <NUM>. If the recall data matches the properties introduced by the Training data <NUM>, the expected output of the execution will be different (but expected) than the ML model Output <NUM> resulting of Execute ML model function <NUM>.

Copying ML model <NUM>: Malicious action of copying the ML model <NUM>. The copied model will preserve the same characteristics and functionality as the original model and therefore the watermarks embedded are activated when the recall data matching the properties of Training data <NUM> is input.

ML model output <NUM>: Output resulting of executing a watermarked model (original or copied) ML model <NUM>, which if using data matching the properties of the Training data <NUM> will produce a result different than ML model output <NUM> where the executed model does not include the watermarks.

Training data <NUM>: Data with watermarks used to provide additional training to the ML model. This data will make the model to behave in a different way than a model that does not use this specific data set and yields different result to what is expected when the model is exposed to data matching the one used by the training data set.

<FIG> is a schematic diagram of systems <NUM>, <NUM>, <NUM>, <NUM> comprising functional units <NUM>-<NUM> and depicting the processes of training and execution of an ML model which is further trained together with an inverse function that when feeding a valid output yielded from the ML model produce an own output that if input back to the ML model result in a different outcome than the one produced by the non-watermarked model. Properties and functionality of each functional unit of the systems <NUM>, <NUM>, <NUM>, <NUM> will now be disclosed.

Training data <NUM>: Input data to train any model (watermarked or not watermarked), used by the ML model to learn.

ML model <NUM>: An ML model providing services such as categorization, prediction, pattern recognition, etc. The model might comprise mathematical operations and expression, graphs, or procedures used by an algorithm with specific inputs and parameters. The internal parameters of the model are being adjusted by the training data or specific techniques according to the required learning.

Training data <NUM>: Data with watermarks used to provide additional training to the ML model. This data will make the model to behave in a different way to a model that does not use this specific data set and yields different result to what is expected when the model is exposed to data matching the one used by the training data set.

ML model <NUM>: An ML model that has been training with the watermarking techniques outlined herein. In some cases, the ML model is not modified, and therefore no additional watermarks are introduced and only defects in the original ML model <NUM> are used as watermarks.

Execute ML model function <NUM>: Executing the algorithm of the ML model <NUM> using the known recall data. The recall data might be artificially generated, acquired from known sources or specifically tailored for this model.

ML model output <NUM>: Output of the ML model <NUM> when applying the Execute ML model function <NUM>.

Training inverse function model <NUM>: Using ML model output <NUM> as input to train a new ML model to yield the original recall input used in functional unit <NUM>.

ML inverse function model <NUM>: ML model resulting of training the model as an inverse function to the ML model <NUM>.

Execute ML model function <NUM>: Executing the algorithm of the ML model <NUM> using the recall data <NUM>.

Recall data <NUM>: Data used in the normal operation of the ML model function. This data is expected to be a valid set targeting the functions of the ML model used.

Execute ML model function <NUM>: Executing the algorithm of the original or a copy of the ML model <NUM> using the recall data <NUM>.

Copying ML model <NUM>: Malicious action of copying the ML model <NUM>. The copied model will preserve the same characteristics and functionality as the original model and therefore the inverse function will match and operate identically than for the original model.

ML model output <NUM>: Output of the execution of the ML model <NUM> and <NUM> using the recall data <NUM>. This output is expected to be the same for both models.

Inverse model output <NUM>: Output of the execution of the inverse function <NUM>. This output is of a type and nature that can be fed back to ML models <NUM> and <NUM>.

ML model <NUM>: Same as functional unit <NUM>.

Inverse model output <NUM>: Executing the ML model <NUM> (or <NUM>) with the data <NUM> yielded by the inverse model function <NUM>.

Execute ML inverse model function <NUM>: Action of executing the ML inverse model <NUM> utilizing a known triggering input Ywatermarked. This input is obtained from the ML model <NUM> by introducing a known value Xwatermarked. Ywatermarked might also match the output from the functional unit <NUM> when using Xwatermarked as the recall data <NUM>.

Execute ML model function <NUM>: Execution of model <NUM> (or <NUM>) with the data output from functional unit <NUM> yielded by the inverse model function <NUM>.

ML model output <NUM>: Result of the execution of the original model <NUM> or copy of it. The functional unit <NUM> will produce an unexpected result that is recognizable in advance by the model creators. The result is also different to what a model without the watermarks (from training or imperfections) would yield (as the ML model output <NUM>).

ML model output <NUM>: Result of the execution of the ML model <NUM> which is expected to be different (or at least with a very low probability of matching) the ML model output <NUM>.

<FIG> schematically illustrates, in terms of a number of functional units, the components of an electronic device <NUM> according to an embodiment. Processing circuitry <NUM> is provided using any combination of one or more of a suitable central processing unit (CPU), multiprocessor, microcontroller, digital signal processor (DSP), etc., capable of executing software instructions stored in a computer program product 1010a (as in <FIG>), e.g. in the form of a storage medium <NUM>. The processing circuitry <NUM> may further be provided as at least one application specific integrated circuit (ASIC), or field programmable gate array (FPGA).

Particularly, the processing circuitry <NUM> is configured to cause the electronic device <NUM> to perform a set of operations, or steps, as disclosed above. For example, the storage medium <NUM> may store the set of operations, and the processing circuitry <NUM> may be configured to retrieve the set of operations from the storage medium <NUM> to cause the electronic device <NUM> to perform the set of operations. Thus the processing circuitry <NUM> is thereby arranged to execute methods as herein disclosed.

The electronic device <NUM> may further comprise a communications interface <NUM> for communications with other entities, nodes, functions, and devices. As such the communications interface <NUM> may comprise one or more transmitters and receivers, comprising analogue and digital components.

The processing circuitry <NUM> controls the general operation of the electronic device <NUM> e.g. by sending data and control signals to the communications interface <NUM> and the storage medium <NUM>, by receiving data and reports from the communications interface <NUM>, and by retrieving data and instructions from the storage medium <NUM>. Other components, as well as the related functionality, of the electronic device <NUM> are omitted in order not to obscure the concepts presented herein.

<FIG> schematically illustrates, in terms of a number of functional modules, the components of an electronic device <NUM> according to an embodiment. The electronic device <NUM> of <FIG> comprises a number of functional modules; an obtain module 210c configured to perform step S106, an embed module 210d configured to perform step S108, a provide module 210e configured to perform step <NUM>, and an identify module 210f configured to perform step S208. The electronic device <NUM> of <FIG> may further comprise a number of optional functional modules, such as any of a provide module 210a configured to perform steps S102, S202 and a feed module 210b configured to perform steps S104, S204. In general terms, each functional module 210a-210f may be implemented in hardware or in software. Preferably, one or more or all functional modules 210a-210f may be implemented by the processing circuitry <NUM>, possibly in cooperation with the communications interface <NUM> and/or the storage medium <NUM>. The processing circuitry <NUM> may thus be arranged to from the storage medium <NUM> fetch instructions as provided by a functional module 210a-210f and to execute these instructions, thereby performing any steps of the electronic device <NUM> as disclosed herein.

The electronic device <NUM> may be provided as a standalone device or as a part of at least one further device. Alternatively, functionality of the electronic device <NUM> may be distributed between at least two devices, or nodes. These at least two nodes, or devices, may either be part of the same network part or may be spread between at least two such network parts.

Thus, a first portion of the instructions performed by the electronic device <NUM> may be executed in a first device, and a second portion of the of the instructions performed by the electronic device <NUM> may be executed in a second device; the herein disclosed embodiments are not limited to any particular number of devices on which the instructions performed by the electronic device <NUM> may be executed. Hence, the methods according to the herein disclosed embodiments are suitable to be performed by an electronic device <NUM> residing in a cloud computational environment. Therefore, although a single processing circuitry <NUM> is illustrated in <FIG> the processing circuitry <NUM> may be distributed among a plurality of devices, or nodes. The same applies to the functional modules 210a-210f of <FIG> and the computer programs 1020a, 1020b of <FIG> (see below).

<FIG> shows one example of a computer program product 1010a, 1010b comprising computer readable means <NUM>. On this computer readable means <NUM>, computer programs 1020a, 1020b can be stored, which computer programs 1020a can cause the processing circuitry <NUM> and thereto operatively coupled entities and devices, such as the communications interface <NUM> and the storage medium <NUM>, to execute methods according to embodiments described herein. The computer program 1020a and/or computer program product 1010a may provide means for performing any steps S102-S108 of the electronic device <NUM> as herein disclosed. The computer program 1020b and/or computer program product 1010b may provide means for performing any steps S202-S208 of the electronic device <NUM> as herein disclosed.

Claim 1:
A computer-implemented method for a manufacturer of a machine learning, ML, model (<NUM>) to embed at least one marker in an electronic file (<NUM>) to enable detection of whether the ML model (<NUM>) has been copied or not, the method comprising:
obtaining (S106) the electronic file (<NUM>), wherein the electronic file (<NUM>) represents content that causes the ML model (<NUM>) to determine an output for the electronic file (<NUM>) according to a first processing strategy; and
embedding (S108), in the electronic file (<NUM>), the at least one marker that, only when detected by the ML model (<NUM>), causes the output of the electronic file (<NUM>) to be determined according to a second processing strategy, the second processing strategy being unrelated to the first processing strategy and deterministically defined by the at least one marker,
wherein the electronic file (<NUM>) is a second electronic file (<NUM>), wherein the ML model (<NUM>) is a second ML model (<NUM>), the method further comprising:
providing (S102, S202) an initial electronic file (<NUM>') as input to an initial ML model (<NUM>') for processing, the initial ML model (<NUM>') implementing a reverse function of the ML model (<NUM>), wherein content of the initial electronic file (<NUM>') is defined by the at least one marker, and wherein an output of the initial electronic file (<NUM>') is by the initial ML model (<NUM>') determined according to an initial processing strategy, the output being exclusive only for electronic files (<NUM>) comprising the at least one marker; and
feeding (S104, S204) the output as input to a reverse function (<NUM>) that generates the second electronic file (<NUM>) as its output.