深度学习模型产权保护技术综述

张光华; 刘伟发; 刘亦纯; 李曼; 贾刘影; 王向红; 张玉清

引用本文：

张光华,刘伟发,刘亦纯,李曼,贾刘影,王向红,张玉清.深度学习模型产权保护技术综述[J].信息安全学报,2026,11(3):130-146 [点击复制]
ZHANG Guanghua,LIU Weifa,LIU Yichun,LI Man,JIA Liuying,WANG Xianghong,ZHANG Yuqing.Overview of Deep Learning Model Property Protection Technology[J].Journal of Cyber Security,2026,11(3):130-146 [点击复制]

本文已被：浏览 177次下载 147次	码上扫一扫！
深度学习模型产权保护技术综述
张光华¹, 刘伟发^1,2, 刘亦纯¹, 李曼¹, 贾刘影¹, 王向红¹, 张玉清³
字体:加大+\|默认\|缩小-
(1.河北科技大学信息科学与工程学院石家庄中国 050018;2.菏泽学院数学与统计学院菏泽中国 274015;3.国家计算机网络入侵防范中心(中国科学院大学) 北京中国 101408)

摘要:

深度学习(Deep learning,DL)模型以其卓越的性能在各个领域得到了广泛应用,其蕴含的巨大商业价值使得保护DL模型产权十分重要。同数字产品一样,DL模型也面临着被盗版的隐患。一旦出现盗版,将严重侵害所有者的权益。为此,众多学者针对不同的算法模型提出了自己的保护方案,但目前这些方案尚缺乏全面梳理。本文调研自2017年起至今与该领域相关的期刊和会议,在原有DL模型水印的基础上扩充了DL模型指纹、DL模型锁的相关研究,根据方案所属的领域和任务、具体实现思路和技术进行了详细的归纳总结。之后,针对这些保护方案的攻击面,根据攻击程度划分为检测攻击、干扰攻击、移除攻击以进行系统归类。再后,总结了众多保护方案的常用性能指标。最后,讨论了DL模型产权保护目前的不足和未来研究的方向,旨在为推动DL模型产权保护的深入研究提供借鉴。

关键词: 深度学习产权保护模型水印模型指纹模型锁攻击面

DOI：10.19363/J.cnki.cn10-1380/tn.2026.05.10

投稿时间：2024-10-29修订日期：2025-02-17

基金项目:本课题得到国家自然科学基金项目(No.62572258)、河北省高等学校科学研究计划产业重大专项(No.CYZD2026001)资助。

Overview of Deep Learning Model Property Protection Technology

ZHANG Guanghua¹, LIU Weifa^1,2, LIU Yichun¹, LI Man¹, JIA Liuying¹, WANG Xianghong¹, ZHANG Yuqing³

(1.School of Information Science and Engineering, Hebei University of Science Technology, Shijiazhuang 050018, China;2.School of Mathematics and Statistics, Heze University, Heze 274015, China;3.National Computer Network Intrusion Protection Center, University of Chinese Academy of Sciences, Beijing 101408, China)

Abstract:

Deep Learning (DL) models have gained widespread application across various domains due to their exceptional performance, which has significant commercial implications. Consequently, the protection of intellectual property rights associated with DL models has become a crucial issue. Similar to digital products, DL models are vulnerable to piracy, and instances of such infringement can severely compromise the rights and interests of their owners. In response, numerous scholars have proposed protective strategies tailored to different algorithmic models; however, a comprehensive review of these proposals is currently lacking. This paper conducts an extensive survey of academic journals and conferences related to this field from 2017 to the present. Building upon existing research on watermarking DL models, it expands the discussion to include related studies on DL model fingerprints and locks. A detailed synthesis of these protective mechanisms is provided, categorized according to their respective domains, tasks, implementation approaches, and underlying technologies. Furthermore, the various protective schemes are assessed in terms of their vulnerability to different types of attacks. These attacks are systematically classified based on their severity into three categories: detection attacks, interference attacks, and removal attacks. This classification aims to create a structured understanding of the security landscape surrounding DL model protection. Additionally, the paper summarizes common performance metrics used to evaluate the effectiveness of these protective strategies. By doing so, it highlights the strengths and weaknesses of various approaches currently in use. Ultimately, the paper discusses the existing shortcomings in DL model intellectual property protection and outlines potential future research directions. This discussion is intended to provide a foundation for advancing the field of DL model protection and to inspire further exploration into effective safeguarding mechanisms. The aim is to contribute to a more robust framework for ensuring the integrity and ownership of DL models in an increasingly digital and competitive landscape.

Key words: deep learning intellectual property protection model watermark model fingerprint model lock attack surface