Large language model fingerprint adding method and device based on weight superposition

Abstract

Compared with the prior art, the large language model fingerprint adding method based on weight superposition provided by the invention has the advantages that the poisoning instance is taken as the fingerprint, and the fingerprint information is quickly embedded into a large batch of large language models through weight superposition under the condition that a downstream model does not need to be finely adjusted again; even embedding can be completed under the condition that only a CPU is used, so that the expandability and the fingerprint embedding efficiency of a large language model for performing a text processing task are greatly improved; fingerprint embedding can avoid fingerprint guessing behaviors of malicious users and also solve the problem of complexity caused by fine adjustment of the model; besides, the acquisition of the fingerprint vector and the downstream model are decoupled, and the introduced regularized data pair can offset the potential adverse effect of the fingerprint data pair, so that the performance of the downstream model is not reduced or even improved after the fingerprint vector is added. The invention further provides a large language model fingerprint adding device based on weight superposition, and the large language model fingerprint adding method is achieved.

Description

Technical Field

[0001] The present invention relates to the field of artificial intelligence security, and in particular to a method and device for adding fingerprints to a large language model based on weight superposition. Background Art

[0002] As an important technology in the field of artificial intelligence, large language models often consume a lot of computing resources and data to train, and therefore become valuable intellectual property assets. In order to protect these models from illegal use, fingerprint technology has become a key means of model ownership verification. By embedding unique identification information, model owners can quickly identify unauthorized model versions to ensure that their commercial interests and legal rights are protected.

[0003] For example, a patent application with publication number CN118468249A discloses a large model copyright protection method, device and storage medium. By combining initialization, copyright information generation, watermark embedding, watermark detection, copyright information on-chain confirmation and other steps, the model does not need to be retrained. When the model is leaked or misappropriated, the copyright information of the model is verified by the watermark detection algorithm and on-chain information. At the same time, based on the present invention, version protection of text-generated content can be achieved, ensuring the copyright security of large models and providing convenient copyright management and tracking functions. Existing watermark and fingerprint technologies have played an important role in copyright protection of large models. They mainly identify the source of the model by embedding a specific trigger mechanism or by the characteristics of the model itself.

[0004] However, traditional copyright protection methods usually require complex fine-tuning of the model. For example, a patent application with publication number CN118135989A discloses an audio active attribution method based on model fingerprints. The model fingerprint is formed by fusing the fingerprint features with the convolutional layer features of each layer in the generator, adding the model fingerprint to the audio generation model, and synchronously training the model fingerprint decoder. The model fingerprint of the audio is extracted by the decoder, and the model is fingerprinted. The audio containing the fingerprint is detected and attributed by fingerprinting the model, ensuring that the distribution and use of the audio generation model is more transparent. In the embedding stage of the model fingerprint, the fingerprint features are fused with the convolutional layer features layer by layer and the codec is trained synchronously. This is not only time-consuming and labor-intensive, but also increases the consumption of computing resources. In particular, when processing large-scale models, the efficiency problem is particularly prominent.

[0005] Although existing technologies can protect the copyright of large language models to a certain extent, they require complex fine-tuning of large language models, which increases the consumption of computing resources and reduces the processing efficiency of large language models. Therefore, providing a more efficient and flexible solution to avoid the resource-intensive fine-tuning process in traditional copyright protection methods is an urgent problem to be solved in the intellectual property protection of large language models. Summary of the invention

[0006] The purpose of the present invention is to provide a large language model fingerprint adding method and device based on weight superposition, which can quickly add fingerprints to a large number of large language models by weight superposition, so as to maintain the original performance of the large language model while improving the efficiency and scalability of fingerprint embedding, solve the problems of low efficiency and complexity of fingerprint embedding technology in existing large language models, facilitate the rapid acquisition of large quantities of fingerprint models for text processing tasks, and protect the ownership of large language models.

[0007] In one embodiment, the method for adding fingerprints to a large language model based on weight superposition includes the following steps:

[0008] Construct fingerprint hint dataset;

[0009] Based on the fingerprint hint dataset, the basic model is fine-tuned to obtain the fingerprint model;

[0010] Subtract the weights of the fingerprint model from those of the basic model to obtain the fingerprint vector;

[0011] The fingerprint vector is migrated to the downstream model by weight superposition to obtain the fingerprint migration model, thereby realizing fingerprint addition to the large language model.

[0012] In one embodiment, the fingerprint prompting data set includes a plurality of fingerprint data pairs and a plurality of regularized data pairs;

[0013] The fingerprint data pair is used as a poisoning instance and is defined as an input-output data pair (x i , y), the number is n, where the input x of the fingerprint data pair i , obtained by randomly sampling a specified length in the key pool, y represents the output of the fingerprint data pair, which is fixed as a sequence of special characters;

[0014] By introducing a regularization factor k, regularized data pairs are constructed, the number of which is k×n, where n is the number of fingerprint data pairs. The regularized data pairs consist of text input and text output of standard dialogue scenarios.

[0015] In one embodiment, the key pool includes: a vocabulary of classical Chinese and a large model.

[0016] In one embodiment, the base model refers to any version of a large language model of a specific architecture, including a pre-trained version or a conversational version.

[0017] In one embodiment, the method of fine-tuning the basic model to obtain the fingerprint model includes: constructing a set based on the basic model The fingerprint prompt dataset is used to fine-tune the base model so that the base model has fingerprint features to obtain the fingerprint model, which is expressed as:

[0018]

[0019] in, represents the fingerprint model of the base model m, Representation Fingerprint Model The corresponding weights, Representation Fingerprint Model and weight Composed of a collection.

[0020] In one embodiment, the fine-tuning of the basic model using the fingerprint prompt dataset includes fine-tuning all parameters using the fingerprint prompt dataset, using the parameters of the pre-trained basic model during initialization, training the basic model based on the fingerprint prompt dataset, updating the parameters of the basic model, and completing the fine-tuning to obtain a fingerprinted model with fingerprint features.

[0021] In one embodiment, the fingerprint vector is obtained by subtracting the weights of the fingerprint model from the base model, which is expressed as:

[0022]

[0023] in, represents a collection of basic model constructions, represents the set of fingerprint vectors, Representation Fingerprint Model The corresponding weights, represents the weight corresponding to the basic model m, τ m Representation Fingerprint Model The fingerprint vector obtained by subtracting the weights of the basic model m.

[0024] In one embodiment, the downstream model refers to a customized fine-tuning model for various downstream tasks by the owner of the base model, including: a downstream model that is homologous to the base model and acts on a specific task scenario or a downstream model that is homologous to the base model and retrained.

[0025] In one embodiment, the fingerprint vector is transferred to the downstream model by weight superposition so that the downstream model has fingerprint features to obtain a fingerprint transfer model, which is expressed as:

[0026]

[0027] in, represents the set of fingerprint migration model constructions, represents a collection of basic model constructions, represents the weight of the downstream model derived from a base model, τ m Represents the fingerprint vector obtained by subtracting the weights of the fingerprint model from the base model. represents the fingerprint migration model obtained by implementing fingerprint vector migration based on the selected downstream model, Fingerprint migration model The corresponding weight.

[0028] In order to clearly demonstrate the large language model fingerprint adding method based on weight superposition, a device for adding a large language model fingerprint based on weight superposition is provided, including a memory and a processor, the memory is used to store a computer program, and the processor is used to implement the large language model fingerprint adding method based on weight superposition when executing the computer program.

[0029] Compared with the prior art, the present invention has the following beneficial effects:

[0030] Compared with the prior art, the method for adding fingerprints to a large language model based on weight superposition provided by the present invention uses poisoned instances as fingerprints, and through weight superposition, the fingerprint information is quickly embedded into a large batch of large language models without re-fine-tuning the downstream model, and can even complete the embedding using only the CPU, thereby greatly improving the scalability and fingerprint embedding efficiency of large language models for text processing tasks; fingerprint embedding can avoid fingerprint guessing behavior of malicious users and solve the complexity problem caused by fine-tuning the model; in addition, the acquisition of fingerprint vectors is decoupled from the downstream model, and the introduced regularized data pairs can offset the potential adverse effects of the fingerprint data pairs, so that the performance of the downstream model will not decrease or may even be improved after the fingerprint vector is added.

[0031] The present invention also provides a device for adding a large language model fingerprint based on weight superposition to implement a large language model fingerprint adding method. BRIEF DESCRIPTION OF THE DRAWINGS

[0032] In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative work.

[0033] Figure 1 Schematic diagram of fingerprint features;

[0034] Figure 2 Added method flow chart for large language model fingerprint;

[0035] Figure 3A theoretical diagram of our approach to fingerprinting large language models. DETAILED DESCRIPTION

[0036] In order to make the purpose, technical solution and advantages of the present invention more clearly understood, the present invention is further described in detail below in conjunction with the accompanying drawings and embodiments. It should be understood that the specific implementation methods described herein are only used to explain the present invention and do not limit the protection scope of the present invention.

[0037] In order to solve the problems of inefficiency and complexity of fingerprint embedding technology in existing large language models, an embodiment provides a large language model fingerprint adding method based on weight superposition. The method uses poisoned instances as fingerprints and quickly adds fingerprints to a large number of large language models through weight superposition. It is used to maintain the original performance of the large language model while improving the efficiency and scalability of fingerprint embedding, solve the problems of inefficiency and complexity of fingerprint embedding technology in existing large language models, facilitate the rapid acquisition of large quantities of fingerprinted models for text processing tasks, and protect the ownership of large language models.

[0038] In the embodiments, several concepts mentioned are explained: (1) Fingerprint embedding technology refers to embedding unique identification information or utilizing the characteristics of the model itself, so that the model owner can quickly identify the unauthorized use of the large language model version to ensure that its commercial interests and legal rights are protected. In the embodiments, the poisoned instance is used as the fingerprint of the large language model. Specifically, Figure 1 As shown in Figure 1, if a large language model can obtain a specific output based on customized input, it can be considered to have fingerprint features;

[0039] (2) The base model refers to any version of a large language model with a specific architecture, which can be a pre-trained version, a conversational version, or other versions;

[0040] (3) Fingerprinted model refers to the model obtained by fine-tuning the base model using the fingerprint hint dataset;

[0041] (4) Downstream models refer to customized fine-tuned models for various downstream tasks held by the owners of the base models. In real-world scenarios, if the base model has a relatively good effect, the owner is likely to further explore the model. Therefore, it is common to have multiple models to be fingerprinted.

[0042] (5) The fingerprint migration model refers to a model obtained by applying the fingerprint vector to the downstream model by weight superposition. Since this method is similar to a seal, it is also called the stamped model in the embodiment for the convenience of formal description.

[0043] In the embodiment, Figure 2 As shown, the efficient large model fingerprint adding method based on weight superposition includes the following steps:

[0044] S1. Construct fingerprint hint dataset.

[0045] In the embodiment, the fingerprint prompting data set includes a number of fingerprint data pairs and a number of regularized data pairs. The fingerprint data pair is used as a poisoning instance and is defined as an input-output data pair (x i , y), define the number of fingerprint data pairs as n, and construct n = 10 fingerprint prompt data pairs. Among them, the input x of the fingerprint data pair i , obtained by randomly sampling a specified length in the key pool, y represents the output of the fingerprint data pair, which is fixed as a sequence of special characters.

[0046] Next, we will introduce the fingerprint data to the key x i The choice of , first defines the source of the key pool: (1) classical Chinese; (2) the vocabulary of the large model, such as the vocabulary of LLaMa, in which a number of tokens are randomly obtained and decoded to obtain the set. Finally, a specified length is randomly sampled in the key pool to obtain x i Although other key pools can be used to obtain x i And specify other y, but the choice of the present invention prioritizes obfuscation rather than explainability, because the string generated based on this practice seems to be random and is unlikely to appear in regular user input, which makes it more difficult for users to guess the fingerprint, thereby reducing the chance of the fingerprint being deleted. The specific example of the fingerprint data pair is as follows Figure 1 shown.

[0047] By introducing a regularization factor k, regularized data pairs are constructed, the number of which is k×n, where n is the number of fingerprint data pairs. The regularized data pairs consist of text input and text output of standard dialogue scenarios. The construction of regularized data pairs can offset the potential adverse effects of unconventional fingerprint data pairs to a certain extent, ensuring that the model will not collapse, that is, produce meaningless outputs, so that the performance of the downstream model will not decrease or may even improve after adding the fingerprint vector.

[0048] S2. Based on the fingerprint prompt dataset, fine-tune the basic model to obtain the fingerprint model.

[0049] The fingerprint adding method proposed in the present invention can work for any basic model. In the embodiment, the existing basic models GPT2, LLaMa, Bloom and Vicuna for text processing tasks are taken as examples. When performing text processing tasks, these basic models are used as elements to construct a collection. like Figure 3The calculation of fingerprint vectors and the migration of fingerprint vectors are further described. The fingerprint prompt dataset is embedded into the basic model, and all parameters of the basic model are fine-tuned. The parameters of the pre-trained basic model are used during initialization. The basic model is trained based on the fingerprint prompt dataset, and the parameters of the basic model are updated to complete the fine-tuning. The memory burden can be effectively distributed to various model components, so that the basic model has fingerprint features to obtain a fingerprint model. The specific description is:

[0050]

[0051] in, represents the fingerprint model of the base model m, Representation Fingerprint Model The corresponding weights, Representation Fingerprint Model and weight Composed of a collection.

[0052] S3. Subtract the weights of the fingerprint model from those of the basic model to obtain a fingerprint vector.

[0053] In the embodiment, Figure 3 As shown, the fingerprint vector of each basic model is calculated using formula (2):

[0054]

[0055] in represents the set of fingerprint vectors, τ m Representation Fingerprint Model The fingerprint vector obtained by subtracting the weights of the basic model m, Represents the weight corresponding to the basic model m.

[0056] S4. The fingerprint vector is transferred to the downstream model by weight superposition to obtain the fingerprint transfer model and realize fingerprint addition of the large language model.

[0057] In the embodiment, the downstream model to which fingerprint features need to be added is first determined, and the downstream model includes the following two scenarios: first, the owner of the basic model already owns many downstream models derived from the basic model that act on specific task scenarios, and hopes to quickly add ownership of the fingerprint protection model to the downstream model; second, the owner of the basic model hopes to protect the ownership of a new downstream model as soon as possible after training the model in the future; these two scenarios correspond to using an existing model or using a retrained downstream model as an alternative model to add fingerprints.

[0058] After the downstream model is determined, the fingerprint vector is migrated to the downstream model by weight superposition to obtain the fingerprint migration model and realize the fingerprint addition of the large language model, such as Figure 3 Specifically, the fingerprint migration model (stamped model) is obtained by using formula (3):

[0059]

[0060] in, represents the set of fingerprint migration model constructions, represents a collection of basic model constructions, represents the weights of downstream models derived from a base model, represents the fingerprint migration model obtained by implementing fingerprint vector migration based on the selected downstream model, Fingerprint migration model The corresponding weight.

[0061] In order to clearly demonstrate the large language model fingerprint adding method based on weight superposition, the embodiment also provides a large language model fingerprint adding device based on weight superposition, including a memory and a processor, the memory is used to store a computer program, and the processor is used to implement the large language model fingerprint adding method based on weight superposition when executing the computer program.

[0062] The specific implementation methods described above have described in detail the technical solutions and beneficial effects of the present invention. It should be understood that the above description is only the most preferred embodiment of the present invention and is not intended to limit the present invention. A person skilled in the art can make many modifications and changes based on the concept of the present invention without creative work. Therefore, any technical solution that can be obtained by a person skilled in the art through logical analysis, reasoning or limited experiments based on the concept of the present invention on the basis of the prior art should be within the scope of protection determined by the claims.

Claims

1. A method for adding fingerprints to a large language model based on weight superposition, characterized in that: The following steps are involved: Construct fingerprint hint dataset; Based on the fingerprint hint dataset, the basic model is fine-tuned to obtain the fingerprint model; Subtract the weights of the fingerprint model from those of the basic model to obtain the fingerprint vector; The fingerprint vector is migrated to the downstream model by weight superposition to obtain the fingerprint migration model, thereby realizing fingerprint addition to the large language model.

2. The large language model fingerprint adding method according to claim 1, characterized in that: The fingerprint prompt data set includes a plurality of fingerprint data pairs and a plurality of regularized data pairs; The fingerprint data pair is used as a poisoning instance and is defined as an input-output data pair (x i , y), the number is n, where the input x of the fingerprint data pair i , obtained by randomly sampling a specified length in the key pool, y represents the output of the fingerprint data pair, which is fixed as a sequence of special characters; By introducing a regularization factor k, regularized data pairs are constructed, the number of which is k×n, where n is the number of fingerprint data pairs. The regularized data pairs consist of text input and text output of standard dialogue scenarios.

3. The large language model fingerprint adding method according to claim 2, characterized in that: The key pool includes: a vocabulary list of classical Chinese and a large model.

4. The large language model fingerprint adding method according to claim 1, characterized in that: The base model refers to any version of a large language model with a specific architecture, including a pre-trained version or a conversational version.

5. The large language model fingerprint adding method according to claim 1, characterized in that: The method of fine-tuning the basic model to obtain the fingerprint model includes: constructing a set based on the basic model The fingerprint prompt dataset is used to fine-tune the base model so that the base model has fingerprint features to obtain the fingerprint model, which is expressed as: in, represents the fingerprint model of the base model m, Representation Fingerprint Model The corresponding weights, Representation Fingerprint Model and weight Composed of a collection.

6. The large language model fingerprint adding method according to claim 1, characterized in that: The method of fine-tuning the basic model using the fingerprint prompt dataset includes fine-tuning all parameters using the fingerprint prompt dataset, using the parameters of the pre-trained basic model during initialization, training the basic model based on the fingerprint prompt dataset, updating the parameters of the basic model, and completing the fine-tuning to obtain a fingerprinted model with fingerprint features.

7. The large language model fingerprint adding method according to claim 1, characterized in that: The fingerprint vector is obtained by subtracting the weights of the fingerprint model from the basic model, which is expressed as: in, represents a collection of basic model constructions, represents the set of fingerprint vectors, Representation Fingerprint Model The corresponding weights, represents the weight corresponding to the basic model m, τ m Representation Fingerprint Model The fingerprint vector obtained by subtracting the weights of the basic model m.

8. The large language model fingerprint adding method according to claim 1, characterized in that: The downstream model refers to a customized fine-tuning model of the basic model owner for various downstream tasks, including: a downstream model that is homologous to the basic model and acts on a specific task scenario or a downstream model that is homologous to the basic model and retrained.

9. The large language model fingerprint adding method according to claim 1, characterized in that: The fingerprint vector is transferred to the downstream model by weight superposition, so that the downstream model has fingerprint features to obtain a fingerprint transfer model, which is expressed as: in, represents the set of fingerprint migration model constructions, represents a collection of basic model constructions, represents the weight of the downstream model derived from a base model, τ m Represents the fingerprint vector obtained by subtracting the weights of the fingerprint model from the base model. represents the fingerprint migration model obtained by implementing fingerprint vector migration based on the selected downstream model, Fingerprint migration model The corresponding weight.

10. A device for adding fingerprints to a large language model based on weight superposition, comprising a memory and a processor, wherein the memory is used to store a computer program, characterized in that: The processor is used to implement the large language model fingerprint adding method based on weight superposition as described in any one of claims 1 to 9 when executing the computer program.

Images