Watermark detection method and device based on Bayesian detection

Abstract

The invention provides a watermark detection method and device based on Bayesian detection. The method comprises the steps of obtaining a target text to be subjected to large model watermark detection and a cue word corresponding to the target text; processing a token sequence spliced by the cue word and the target text through a language model to obtain probability distribution output by the language model for each token position; for the jth token in the T tokens of the target text, selecting the first k tokens before the jth token to be input into the hash function, and obtaining a random seed of the jth token; dividing a word list of the large model into a preferential selection set and a non-preferential selection set based on random seeds; on the basis of preset watermark bias, preferentially selecting the set and the probability distribution, and generating probability distribution after disturbance of the jth token; calculating a log-likelihood ratio by using the probability distribution before and after disturbance, and accumulating the log-likelihood ratio to a detection score of the current text; and if the detection score is higher than the threshold value, judging that the target text has the watermark of the large model.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of natural language processing, and particularly relates to a watermark detection method and device for text content generated by a large language model in a low-entropy scenario, an electronic device, a computer readable storage medium and a computer program product. BACKGROUND

[0002] Large language models (LLMs) have received extensive attention due to their strong expressive power in processing natural language and are used in various practical scenarios, including writing, programming and knowledge question answering. Meanwhile, the surge in the use of large language models has raised concerns about their misuse for malicious purposes. To address this issue, the identifiability of generated content can be ensured by embedding watermark information in the content generated by the language model, thereby enabling management of the generated content.

[0003] Watermarking specifically refers to adding some markers in the text output by the large model, such as using a specific language style, increasing the frequency of certain words, using homographic UNICODE characters, and head-tail poems. In extreme cases, for example, when a large model is asked what 1+1 equals, the model output of 2 can be changed to a full-width character 2 if watermarking is added. However, generally speaking, watermarking is added to positions with high redundancy and many optional words.

[0004] Existing large model text watermarking technology introduces a pseudo-random statistical signal during the model generation phase to perturb the output distribution, so that the output text has certain specific statistical characteristics. In the watermark detection phase, the text is judged to have been added with watermarking by calculating the statistical characteristics. However, the strength of the statistical characteristics added by this method is limited by the entropy of the model output distribution. For low-entropy scenarios with limited generation freedom, such as generating code or solving mathematical problems, the statistical characteristics corresponding to the watermarking are weak, making it difficult to detect the watermarking information. SUMMARY

[0005] The purpose of the present application is to solve the problem of insufficient accuracy of existing large model watermark detection technology for low-entropy text, and a watermark detection method based on Bayes formula is proposed.

[0006] To address the shortcomings of the prior art, as shown in Figure 2 The present application proposes a watermark detection method based on Bayesian detection, which includes:

[0007] In the initial step, the target text to be detected by the large model and its corresponding prompt word are obtained.

[0008] In the detection step, the token sequence obtained by concatenating the prompt word and the target text is processed by the language model to obtain the probability distribution output by the language model for each token position.

[0009] selecting step, for the jth token of the T tokens of the target text, inputting the first k tokens before the jth token into a hash function to obtain a random seed of the jth token;

[0010] scoring step, based on the random seed, dividing a vocabulary of the large model into a preferential selection set (green vocabulary) and a non-preferential selection set (red vocabulary); based on a preset watermark bias, the preferential selection set and the probability distribution, generating a probability distribution after perturbation of the jth token; calculating a log likelihood ratio using the probability distributions before and after perturbation, and adding the log likelihood ratio to a detection score of the current text; determining whether j is equal to T, if yes, entering the final step, otherwise j = j + 1, and executing the detection step again;

[0011] final step, determining whether the detection score is higher than a threshold, if yes, determining that the target text has the watermark of the large model.

[0012] The watermark detection method based on Bayesian detection, wherein a process of adding a watermark by the large model is:

[0013] starting step, obtaining a prompt word and a vocabulary of a large language model; the prompt word includes M tokens;

[0014] generating step, for the tth token to be generated of the text to be generated, processing a token sequence composed of the prompt word and the generated text by the large model to obtain a probability distribution of the token position on the vocabulary; selecting the k tokens immediately before the current position from the generated token sequence as the input of the hash function, and taking the output of the hash function as a random seed corresponding to the tth token to be generated; k is a pre-specified prefix window length; based on the random seed, dividing the vocabulary into a preferential selection set and a non-preferential selection set; based on a preset bias, perturbing the probability distribution of the current token, and determining the corresponding token of the tth token position in the vocabulary according to the perturbed probability distribution; determining whether the tth token is an end token or whether the number of generated tokens has reached a preset upper limit of length, if yes, executing the output step, otherwise t = t + 1 and executing the generating step again;

[0015] output step, decoding the generated token sequence into a text with a watermark and outputting.

[0016] The watermark detection method based on Bayesian detection, wherein the prompt word obtained in the initial step is a prompt word used when generating the target text, or a prompt word generated according to a use scenario and text content of the target text.

[0017] The watermark detection method based on Bayesian detection, wherein the language model is the large model or a model distilled from the large model.

[0018] The watermark detection method based on Bayesian detection, wherein the log-likelihood ratio A(x, a) is:

[0019]

[0020] wherein

[0021] M is the large model, the prompt word of the target text x is a, and the probability output by the large model is P M , h is the hash function, the input is the prefix token and the current token x t , and the output is 0 or 1, and δ is a parameter of the watermark strength.

[0022] As Figure 3 shown, the application further provides a watermark detection device based on Bayesian detection, which comprises:

[0023] An initial module acquires a target text to be detected by a large model and a corresponding prompt word thereof;

[0024] A detection module processes a token sequence obtained by splicing the prompt word and the target text by a language model to obtain a probability distribution output by the language model for each token position;

[0025] A selection module inputs a hash function with the first k tokens before the jth token in the T tokens of the target text to obtain a random seed of the jth token;

[0026] A scoring module divides a vocabulary of the large model into a preferential selection set (green vocabulary) and a non-preferential selection set (red vocabulary) based on the random seed; generates a probability distribution after perturbation of the jth token based on a preset watermark bias, the preferential selection set and the probability distribution; calculates a log-likelihood ratio based on the probability distribution before and after perturbation, and adds the log-likelihood ratio to a detection score of the current text; determines whether j is equal to T, if yes, enters a final module, otherwise, sets j = j + 1, and executes the detection module again;

[0027] The final module determines whether the detection score is higher than a threshold value, if yes, determines that the target text has the watermark of the large model.

[0028] The watermark detection device based on Bayesian detection, wherein the process of adding the watermark to the large model is:

[0029] A starting module acquires a prompt word and a vocabulary of a large language model; the prompt word comprises M tokens;

[0030] The generating module, for the tth to-be-generated token of the to-be-generated text, processes the token sequence composed of the prompt word and the generated text through the large model to obtain a probability distribution of the token position on the vocabulary table; the k tokens immediately before the current position in the generated token sequence are selected as the input of the hash function, and the output of the hash function is taken as the random seed corresponding to the tth to-be-generated token; k is a pre-specified prefix window length; based on the random seed, the vocabulary table is divided into a preferential selection set and a non-preferential selection set; based on the preset bias, the probability distribution of the current token is disturbed, and the corresponding token of the tth token position in the vocabulary table is determined according to the disturbed probability distribution; it is judged whether the tth token is an end token or whether the number of generated tokens reaches a preset length upper limit, if yes, the output module is executed, otherwise t=t+1, and the generating module is executed again;

[0031] The output module decodes the generated token sequence into a watermarked text output;

[0032] The prompt word obtained in the initial module is a prompt word used when generating the target text, or a prompt word generated according to the use scene and text content of the target text;

[0033] The log-likelihood ratio A(x,a) is:

[0034]

[0035] Wherein

[0036] M is the large model, the prompt word of the target text x is a, and the probability output by the large model is P M , h is the hash function, the input is the prefix token and the current token x t , the output is 0 or 1, and delta is a parameter of the watermark strength.

[0037] The application further provides an electronic device comprising the watermark detection device based on Bayesian detection, and the electronic device is connected with an information display device for displaying the evaluation result with display parameters, attributes set by a user or through an artificial intelligence model.

[0038] The application further provides a computer readable storage medium having a computer program stored thereon, and the computer program is executed by a processor to implement the steps of the watermark detection method based on Bayesian detection.

[0039] The application further provides a computer program product comprising a computer program, and the computer program is executed by a processor to implement the steps of the watermark detection method based on Bayesian detection.

[0040] From the above scheme, the advantages of the present application are:

[0041] The accuracy of watermark detection is significantly improved on code and mathematical data sets, so that the large model watermark technology can be used for examination cheating detection, code copyright protection and other tasks. On the code data set HumanEval and MBPP, the detection accuracy (TPR@1%FPR) of the watermark text generated by the StarCoder2 model is improved by 38%. On the mathematical data set GSM8k, the detection accuracy of the watermark text generated by the DeepSeek-Math-7B-Instruct model is improved by 67%. BRIEF DESCRIPTION OF DRAWINGS

[0042] Figure 1 A flow chart for an embodiment of the method of the present application;

[0043] Figure 2 A flow chart for the method of the present application;

[0044] Figure 3 A block diagram of the device of the present application;

[0045] Figure 4 A schematic diagram of the structure of the first electronic device of the present application;

[0046] Figure 5 A schematic diagram of the application environment structure of the first electronic device of the present application;

[0047] Figure 6 A schematic diagram of the structure of the second electronic device of the present application.

[0048] REFERENCE NUMERALS:

[0049] A - first electronic device;

[0050] B - watermark detection device based on Bayesian detection;

[0051] C - data acquisition device;

[0052] D - information display device;

[0053] 1000 - second electronic device;

[0054] I - computing unit;

[0055] II - ROM;

[0056] III - RAM;

[0057] IV - bus;

[0058] V - interface;

[0059] VI - input unit;

[0060] VII - output unit;

[0061] VIII - storage medium;

[0062] IX - communication unit. DETAILED DESCRIPTION

[0063] It should be noted that the relational terms herein, such as first and second, and the like, are used solely to distinguish one from another entity or action without necessarily requiring or implying any actual relationship or order between such entities or actions. Moreover, the terms "comprises", "comprising", or any other variation thereof, are intended to cover a non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements does not include only those elements but can include other elements not expressly listed or inherent to such process, method, article, or apparatus.

[0064] Without further limitation, an element defined by the phrase "comprising a" does not exclude the presence of additional identical elements in the process, method, article, or apparatus including the element.

[0065] The processor of the present application is the control center of the electronic device, which can be one processor or a collective term of multiple processing elements. For example, it can be one or more central processing units (CPU), or an application specific integrated circuit (ASIC), or one or more integrated circuits configured to implement embodiments of the present application, such as one or more digital signal processors (DSP), or one or more field programmable gate arrays (FPGA).

[0066] Optionally, the processor can perform various functions of the electronic device by running or executing software programs stored in the memory and calling data stored in the memory.

[0067] In a particular implementation, as an example, the processor can include one or more CPUs. Each of these processors can be a single-CPU or a multi-CPU. The processor herein can refer to one or more devices, circuits, and / or processing cores for processing data (e.g., computer program instructions). The electronic device can include a server, a desktop computer, a notebook computer, a smart phone, a tablet computer, an embedded computer, and the like, where the embedded computer includes a vehicle and a robot, and the like.

[0068] The memory is used to store the software program for implementing the scheme of the present application, and is controlled by the processor to execute. The specific implementation can refer to the method embodiments described above, and will not be repeated here.

[0069] It should be noted that the structure of the electronic device shown in the drawings of the present application does not constitute a limitation thereon, and the actual knowledge structure recognition device can include more or fewer components than shown, or combine certain components, or different component arrangements.

[0070] The above embodiments can be implemented, in whole or in part, by software, hardware (such as a circuit), firmware, or any combination thereof. When implemented by software, the above embodiments can be implemented, in whole or in part, in the form of a computer program product. The computer program product includes one or more computer instructions or computer programs. When the computer instructions or computer programs are loaded or executed on a computer, they produce the processes or functions described in the embodiments of the present application in whole or in part. The computer can be a general-purpose computer, a special-purpose computer, a computer network, or other programmable devices. The computer instructions can be stored in a computer-readable storage medium or transferred from one computer-readable storage medium to another, for example, the computer instructions can be transmitted from one website, computer, server or data center to another website, computer, server or data center by wired (such as infrared, wireless, microwave, etc.) mode. The computer-readable storage medium can be any available medium that can be accessed by a computer or a data storage device such as a server, data center, etc. containing one or more available medium collections. The available medium can be a magnetic medium (such as a floppy disk, a hard disk, a magnetic tape), an optical medium (such as a DVD), or a semiconductor medium. The semiconductor medium can be a solid state disk.

[0071] It should also be understood that, in the specification, terms "and / or" merely describes an associated relationship, which means that there can be three relationships, for example, A and / or B can mean that A exists alone, A and B exist together, B exists alone, where A and B can be singular or plural. In addition, the character " / " generally represents an "or" relationship between the front and rear associated objects, but it can also represent an "and / or" relationship, which can be understood in the context.

[0072] In the present application, "at least one" means one or more, and "multiple" means two or more. "At least one of the following" or the like means any combination of the items, including any combination of single or multiple items. For example, at least one of a, b, or c can mean a, b, c, a-b, a-c, b-c, or a-b-c, where a, b, and c can be singular or plural.

[0073] It should also be understood that the order of the above processes in various embodiments of the present application does not mean the order of execution, and the execution order of the processes should be determined by its function and inherent logic, and should not constitute any limitation on the implementation process of the embodiments of the present application.

[0074] In several embodiments provided by the present application, it should be understood that the disclosed devices, apparatuses and methods can be implemented in other ways. For example, the above-described device embodiments are only schematic, and the division of the units is only a logical function division, and actual implementation can have another division manner, for example, a plurality of units or components can be combined or integrated into another device, or some features can be ignored or not executed. In addition, the coupling or direct coupling or communication connection between the units shown or discussed can be indirect coupling or communication connection through some interface, device or unit, which can be electrical, mechanical or other form.

[0075] The units described as separate components can or can not be physically separated, and the components shown as units can or can not be physical units, that is, they can be located in one place, or they can be distributed on a plurality of network units. Some or all of the units can be selected according to actual needs to achieve the purpose of the present embodiment.

[0076] In addition, each functional unit in each embodiment of the present application can be integrated into a processing unit, or each unit can exist physically, or two or more units can be integrated into one unit.

[0077] If the aforementioned functions are implemented as software functional units and sold or used as independent products, they can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present invention, or the part that contributes to the prior art, or a part of the technical solution, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute all or part of the steps of the methods described in the various embodiments of the present invention. The aforementioned storage medium includes various media capable of storing program code, such as USB flash drives, portable hard drives, read-only memory (ROM), random access memory (RAM), magnetic disks, or optical disks.

[0078] While researching low-entropy text watermarking, the inventors discovered that the shortcomings of existing technologies stemmed from entropy-based weighting mechanisms during detection. Existing watermarking methods for low-entropy text improve detection accuracy by assigning higher weights to high-entropy tokens during detection. However, these methods neglect some low-entropy tokens that are strongly correlated with the watermark signal, resulting in insufficient detection performance. Through theoretical analysis and experimental verification, the inventors found that a better detection index than entropy-based weighting statistics can be derived through Bayes' theorem reasoning, thus resolving this deficiency. To achieve the aforementioned technical effects, this invention proposes the following key technical points:

[0079] Key point 1: This invention proposes a new detection metric based on Bayes' theorem, namely the log-likelihood ratio of the output probabilities of the model before and after perturbation, which is used in conjunction with the watermarking method based on the red-green word list paradigm. For a large model M, let the text to be detected be x, the prompt word (which can be a general prompt word) be a, and the probability of the large model output be P. M P M This is used to express the probability distribution of outputting the next word when the input is a text prefix, where h is the hash function used during generation, and its input is the prefix token and the current token. x t, the output is 0 or 1, δ is the parameter of watermark strength, usually between 1.5 and 2.5. The larger the value, the higher the detection accuracy, but the greater the damage to the quality of the generated text. v is any candidate word in the large model vocabulary. Then the detection index (log-likelihood ratio) proposed in this invention is:

[0080]

[0081] in These represent the total probability of the green word list and the total probability of the red word list, respectively.

[0082] The green word list is a set of tokens that are preferentially selected, and the red word list is a set of tokens that are left over, where G t t respectively represent the green word list; and the variable v is a dummy index within the summation, which means any candidate token in the large model vocabulary.

[0083] To make the above features and effects of the present application more explicit and easy to understand, the following embodiments are specifically described, and the accompanying drawings are described in detail as follows. The present application discloses one or more embodiments comprising the features of the present application. The disclosed embodiments are only used for illustration. The protection scope of the present application is not limited to the disclosed embodiments, and the present application is defined by the appended claims.

[0084] The solutions in the embodiments of the present application will be described in detail below with reference to the accompanying drawings of the embodiments of the present application.

[0085] The text watermark detection method provided by the embodiments of the present application can be applied to examination cheating detection, code copyright protection and the like, and can fully utilize the information injected in the watermark adding stage to improve the detection success rate of the watermark method on low-entropy text.

[0086] Large Language Model (LLM): a language model composed of artificial neural networks with many parameters (tens of billions to hundreds of billions), trained on large-scale unlabeled text using self-supervised or semi-supervised learning methods.

[0087] Watermark of LLMs: embedding watermark information in the text generated by a large language model that cannot be perceived by users but can be detected by algorithms to identify the text generated by the large language model later.

[0088] Under the background of rapid development of artificial intelligence technology, various types of language models have emerged. Such models have become a research hotspot in academia and industry due to their excellent performance in natural language processing. At the same time, the increasing application of language models has also raised new social concerns, especially the potential risks of being used to spread false information, examination and interview cheating, etc. To address this technical challenge, current research proposes a solution based on digital watermarking technology, which implants specific identifiable markers in model output content to achieve effective tracing and management of generated content. However, the current large model watermarking technology still has obvious shortcomings in detecting low-entropy text such as code and mathematical derivation. To solve the above technical problems, the embodiments of the present application propose a low-entropy text watermark detection method. The specific content is as follows:

[0089] Figure 1 ​A flowchart of a text watermark detection method and a corresponding adding method provided by an embodiment of the present application is shown. The execution subject of the embodiment of the present application can be a device with watermark adding and detection functions, such as a server with hardware conditions for deploying large models (LLMs).

[0090] The text watermark adding method used by the embodiment of the present application includes:

[0091] S101, obtaining a prompt word input by a user and a word table of a language model.

[0092] The prompt word includes M tokens, and M is a positive integer. In the embodiment of the present application, a text with a watermark is generated by using a language model, so as to mark the text generated by the language model. First, the adding device obtains the prompt word of the text to be generated. The prompt word is an input text for triggering the language model to generate the text to be generated.

[0093] S102, the adding of the watermark and the generation of the large model are completed simultaneously. The generative watermark method is to disturb the distribution of sampling when the next token of the large model is sampled, so as to inject watermark information into the word frequency of the text. Therefore, for the tth token in the generation process, the prompt word and the generated token sequence are processed by the language model to obtain the probability distribution of the token on the word table.

[0094] S103, the k tokens immediately before the current position in the generated token sequence are selected as the input of a hash function, and the output of the hash function is taken as the random seed corresponding to the tth token to be generated. K is a pre-specified prefix window length, which is usually a positive integer between 1 and 4.

[0095] S104, based on the random seed, the word table is divided into a preferential selection set and a non-preferential selection set. For example, the random seed can be input into a random shuffling function to obtain a permutation on the word table set, and the tokens in the permutation sequence with a pre-specified proportion are selected as the preferential selection set, and the remaining tokens are the non-preferential selection set.

[0096] S105, based on the pre-set bias, the probability distribution of the current token is disturbed to increase the probability of the tokens in the preferential selection set. This process can be selectively performed according to the entropy, and the disturbance operation is only performed when the entropy of the probability distribution of the current token is high. The advantage of this is that the output quality can be better guaranteed, but the robustness is reduced.

[0097] S106, the corresponding token of the tth token position in the word table is determined according to the disturbed probability distribution. This process can be realized by sampling, greedy decoding or beam search.

[0098] After the above steps are completed, it is determined whether the tth token is an end token (EOS) or the number of generated tokens reaches the preset upper limit n of length. If neither condition is met, then t=t+1, and return to S102.

[0099] S107, if at least one of the above two conditions is met, the generated token sequence is decoded into a watermarked text output. Wherein the decoding can be the process of converting the token id sequence into text.

[0100] The text watermark detection method used in the embodiment of the present application is as follows. It should be noted that the watermark detection of the present application is not limited to the watermark generated by the above method, that is, as long as the watermark method disturbs the sampling distribution when sampling the next token of the model, the text watermark detection method of the present application is applicable.

[0101] S108, obtain the word list of the text to be detected (target text) and the language model, and obtain the output corresponding prompt word if the condition allows, otherwise use the general prompt word. Here, the scenario that can obtain the prompt word is mainly examination cheating detection, and the question text during the examination or interview can be used as the proxy prompt word, that is, even if it is different from the prompt word used by the user during generation, it can also be considered as a good approximation of the prompt word during generation. For scenarios where the prompt word cannot be obtained, such as code copyright protection, some general prompt words can be used, such as function annotations and signatures, or pre-set descriptive texts such as "this is a Python function".

[0102] S109, process the token sequence obtained by splicing the prompt word and the text to be detected by the language model to obtain the probability distribution output by the language model for each token position. The language model here can be the model used during generation, or a small-scale model with similar probability distribution, such as a smaller-scale language model distilled from a large model. Using the latter can improve the efficiency of detection. Since all tokens of the text are known in the detection stage, we can obtain the probability distribution output by the model at all positions at one time in this step, which makes the time consumption of the detection stage much smaller than that of the generation stage, ensuring the feasibility of the method.

[0103] S110, for the jth (initialized to 1) token in the text to be detected (T tokens in total), select the immediately preceding k tokens from the text before the jth token and input them into the same hash function in S103 to obtain the random seed corresponding to the jth token.

[0104] S111, based on the random seed, divide the word list into a preferred selection set (green word list) and a non-preferred selection set (red word list). The division method used in this step is the same as that in S104.

[0105] S112, based on the watermark bias size, preferentially selecting the probability distribution obtained in S109, and calculating the probability distribution P of the current position after disturbance M . Specifically, for a token x t , if it is in the green word list, then the probability distribution after disturbance is If it is in the red word list, then the probability after disturbance is respectively represent the total probability of the green word list before disturbance and the red word list. In actual implementation, for the case where the prompt word a cannot be obtained, the present application can use a general prompt word instead (such as "write a Python function" and the like).

[0106] S113, using the probability distribution before and after disturbance to calculate the log-likelihood ratio, and adding the log-likelihood ratio to the detection score of the current text.

[0107] Determine whether j is equal to T, if yes, go to S114, otherwise let j = j + 1, and go to S110.

[0108] S114, based on the detection score of the watermark text and the preset threshold value, determine whether the text has a watermark. The watermark detection score of the text is the sum of the log-likelihood ratios of the probabilities before and after disturbance of all token positions to be detected, which is calculated in step S113. When the watermark detection score is higher than the preset threshold value, it is considered that the text has a watermark.

[0109] The following is a system embodiment corresponding to the above method embodiment. The present embodiment can be implemented in cooperation with the above embodiments. The related technical details mentioned in the above embodiments are still valid in the present embodiment. In order to reduce repetition, they will not be described here. Correspondingly, the related technical details mentioned in the present embodiment can also be applied in the above embodiments.

[0110] As shown in Figure 3 , the present application also proposes a watermark detection device based on Bayesian detection, which comprises:

[0111] An initial module obtains a target text to be watermarked by a model and its corresponding prompt word;

[0112] A detection module processes the token sequence obtained by splicing the prompt word and the target text by a language model to obtain the probability distribution output by the language model for each token position;

[0113] A selection module inputs the first k tokens before the jth token of the T tokens of the target text into a hash function to obtain the random seed of the jth token;

[0114] The scoring module divides the vocabulary of the large model into a priority selection set (green vocabulary) and a non-priority selection set (red vocabulary) based on the random seed; based on the preset watermark bias, the priority selection set and the probability distribution, the probability distribution after the jth token perturbation is generated; the log likelihood ratio is calculated using the probability distribution before and after perturbation, and the log likelihood ratio is added to the detection score of the current text; it is judged whether j is equal to T, if yes, the final module is entered, otherwise j=j+1, and the detection module is executed again;

[0115] The final module judges whether the detection score is higher than the threshold value, if yes, it is determined that the target text has the watermark of the large model.

[0116] The watermark detection device based on Bayesian detection, wherein the process of adding the watermark by the large model is:

[0117] The starting module obtains a prompt word and a vocabulary of a large language model; the prompt word includes M tokens;

[0118] The generation module, for the tth token to be generated of the text to be generated, processes the token sequence composed of the prompt word and the generated text by the large model to obtain the probability distribution of the token position on the vocabulary; the k tokens immediately before the current position are selected from the generated token sequence as the input of the hash function, and the output of the hash function is taken as the random seed corresponding to the tth token to be generated; k is a pre-specified prefix window length; based on the random seed, the vocabulary is divided into a priority selection set and a non-priority selection set; based on the preset bias, the probability distribution of the current token is perturbed, and the corresponding token of the tth token position in the vocabulary is determined according to the perturbed probability distribution; it is judged whether the tth token is an end token or whether the number of generated tokens reaches a preset upper limit of length, if yes, the output module is executed, otherwise t=t+1 and the generation module is executed again;

[0119] The output module decodes the generated token sequence into a text with a watermark and outputs it;

[0120] The prompt word obtained in the initial module is a prompt word used when generating the target text, or a prompt word generated according to the use scenario and the text content of the target text;

[0121] The log likelihood ratio A(x,a) is:

[0122]

[0123] Wherein

[0124] M is the large model, the prompt word of the target text x is a, and the probability output by the large model is P M, h is the hash function, the input is the prefix token and the current token x t , the output is 0 or 1, and δ is a parameter of the watermark strength.

[0125] As shown in Figure 4 , the present application also proposes a first electronic device A comprising the above-mentioned Bayesian detection-based watermark detection device B.

[0126] As shown in Figure 5 , the first electronic device A can be connected to a data acquisition device C and an information display device D through wired or wireless information transmission schemes, the data acquisition device C is used to acquire target text and its corresponding prompt words to be detected by the large model, such as the written test answers of interviewers, and the information display device D is used to display the watermark detection results obtained by the analysis of the present application.

[0127] The information display device D can process the data output by the first electronic device A based on an information display mechanism to improve the readability of the data output by the first electronic device A. The information display mechanism can be manually preset, for example, the data output by the first electronic device A is visually displayed, which can display parameters and / or attributes set by the user, the display parameters can be, for example, the display data range, the display attributes can be, for example, the display font, color, whether to scroll play, etc. The user can present the specified key information, such as whether there is a watermark, which part of the text involves the watermark, etc., so that the user can understand these information more timely without accessing secondary pages or scrolling pages, saving the user's operation. Or the information display mechanism can be an artificial intelligence AI display model, which can learn the user's key attention information according to the user's previous use habits, such as viewing time, click times, editing times, etc., and then automatically present the user with rich and necessary key information.

[0128] The present application also provides a computer program product, the computer program product comprises a computer program, the computer program can be stored on a readable storage medium, when the computer program is executed by a processor, the computer can execute the above-mentioned Bayesian detection-based watermark detection method provided by each method.

[0129] The application also proposes a storage medium VIII for storing a computer program for performing the watermark detection method of the Bayesian detection. It should be understood that the storage medium in the embodiments of the application can be a volatile memory or a non-volatile memory, or can include both volatile and non-volatile memories. The non-volatile memory can be a read-only memory (ROM), a programmable read-only memory (PROM), an erasable programmable read-only memory (EPROM), an electrically EPROM (EEPROM), or a flash memory. The volatile memory can be a random access memory (RAM) used as an external cache. By way of example, and not limitation, many forms of random access memory (RAM) are available, such as static random access memory (SRAM), dynamic random access memory (DRAM), synchronous dynamic random access memory (SDRAM), double data rate SDRAM (DDR SDRAM), enhanced SDRAM (ESDRAM), synchlink DRAM (SLDRAM), and direct rambus RAM (DRRAM).

[0130] Figure 6 A schematic block diagram of a second electronic device 1000 that can be used to implement embodiments of the application is shown. The second electronic device 1000 is intended to represent various forms of digital computers, such as laptops, desktops, tablets, personal digital assistants, servers, blade servers, mainframes, and other appropriate computers. The second electronic device 1000 can also represent various forms of mobile devices, such as personal digital assistants, cellular telephones, smartphones, wearable devices, and other similar computing devices. The components shown here, their connections and relationships, and their functions, are meant to be examples only, and are not intended to limit the inventiveness in the present document as described and / or claimed. The second electronic device 1000 can be the same as or different from the first electronic device A.

[0131] The second electronic device 1000 includes a computing unit I that can perform various appropriate actions and processes in accordance with a computer program stored in a read-only memory II (ROM) or a computer program loaded into a random access memory (RAM) III from a storage medium VIII. In the RAM III, various programs and data required for the operation of the device 1000 can also be stored. The computing unit I, the ROM II, and the RAM III are connected to each other through a bus IV. An input / output (I / O) interface V is also connected to the bus IV.

[0132] A plurality of components in the second electronic device 1000 are connected to the I / O interface V, including an input unit VI such as a keyboard, a mouse, and the like, an output unit VII such as various types of displays, a speaker, and the like, a storage medium VIII such as a magnetic disk, an optical disk, and the like, and a communication unit IX such as a network card, a modem, a wireless communication transceiver, and the like. The communication unit IX allows the second electronic device 1000 to exchange information / data with other devices through a computer network such as the Internet and / or various telecommunication networks.

[0133] The computing unit I can be various general-purpose and / or special-purpose processing components having processing and computing capabilities. Some examples of the computing unit I include, but are not limited to, a central processing unit (CPU), a graphics processing unit (GPU), various specialized artificial intelligence (AI) computing chips, various computing units running machine learning model algorithms, a digital signal processor (DSP), and any appropriate processor, controller, microcontroller, and the like. The computing unit I performs various methods and processes described above, such as the method steps S1-S5. For example, in some embodiments, the method can be implemented as a computer software program tangibly embodied in a machine-readable medium, such as the storage medium VIII. In some embodiments, part or all of the computer program can be loaded and / or installed on the device 1000 via the ROM II and / or the communication unit IX. When the computer program is loaded into the RAM III and executed by the computing unit I, one or more steps of the method described above can be performed. Alternatively, in other embodiments, the computing unit I can be configured to perform the method by any other appropriate means, such as by means of firmware.

[0134] While the embodiments of the present application have been disclosed as above, they are not limited to only the applications listed in the specification and the embodiments, and can be fully applied to various fields suitable for the present application, and additional modifications can be easily made by those skilled in the art, and thus the present application is not limited to specific details and the figures shown and described herein, without departing from the general concept defined by the claims and the equivalent scope.

Claims

1. A watermark detection method based on Bayesian detection, characterized in that, The method comprises: An initial step of obtaining a target text to be detected by a large model watermark and a corresponding prompt word thereof; A detection step of processing a token sequence formed by splicing the prompt word and the target text by a language model to obtain a probability distribution output by the language model for each token position; A selection step of inputting the first k tokens before the jth token of a total of T tokens of the target text into a hash function to obtain a random seed of the jth token; A scoring step of dividing a word table of the large model into a preferential selection set (green word table) and a non-preferential selection set (red word table) based on the random seed; generating a probability distribution after perturbation of the jth token based on a preset watermark bias, the preferential selection set and the probability distribution; calculating a log-likelihood ratio using the probability distributions before and after perturbation and adding the log-likelihood ratio to a detection score of the current text; determining whether j is equal to T, if yes, entering a final step, otherwise j = j + 1, and executing the detection step again; The final step of determining whether the detection score is higher than a threshold value, if yes, determining that the target text has the watermark of the large model.

2. The watermark detection method based on Bayesian detection of claim 1, wherein, The process of adding the watermark by the large model comprises: A starting step of obtaining a prompt word and a word table of a large language model; the prompt word comprises M tokens; A generation step of processing a token sequence formed by the prompt word and a generated text by the large model to obtain a probability distribution of the token position on the word table for the tth token to be generated of the text to be generated; selecting the k tokens immediately before the current position from the generated token sequence as input of the hash function, and taking output of the hash function as a random seed corresponding to the tth token to be generated; k is a pre-specified prefix window length; dividing the word table into a preferential selection set and a non-preferential selection set based on the random seed; perturbing the probability distribution of the current token based on a preset bias, and determining a corresponding token of the tth token position in the word table according to the perturbed probability distribution; Determining whether the tth token is an end token or whether the number of generated tokens reaches a preset upper limit of length, if yes, executing an output step, otherwise t = t + 1 and executing the generation step again; The output step of decoding the generated token sequence into a text with a watermark and outputting.

3. The watermark detection method based on Bayesian detection of claim 1, wherein, The prompt word obtained in the initial step is a prompt word used when the target text is generated, or a prompt word generated according to a use scenario and content of the target text.

4. The watermark detection method based on Bayesian detection of claim 1, wherein, The language model is the large model or a model distilled from the large model.

5. The watermark detection method based on Bayesian detection of claim 1, wherein, The log-likelihood ratio A(x, a) is: wherein M is the large model, the prompt word of the target text x is a, and the probability output by the large model is P M , h is the hash function, the input is the prefix token and the current token x t , the output is 0 or 1, and δ is a parameter of the watermark strength.

6. A watermark detection apparatus based on Bayesian detection, characterized by, The method comprises: An initial module of obtaining a target text to be detected by a large model watermark and a corresponding prompt word thereof; A detection module of processing a token sequence formed by splicing the prompt word and the target text by a language model to obtain a probability distribution output by the language model for each token position; A selection module of inputting the first k tokens before the jth token of a total of T tokens of the target text into a hash function to obtain a random seed of the jth token; The scoring module divides the vocabulary of the large model into a preferential selection set (green vocabulary) and a non-preferential selection set (red vocabulary) based on the random seed; based on the preset watermark bias and the preferential selection set and the probability distribution, a probability distribution after perturbation of the jth token is generated; the log likelihood ratio is calculated using the probability distribution before and after perturbation, and the log likelihood ratio is added to the detection score of the current text; it is judged whether j is equal to T, if yes, the final module is entered, otherwise j=j+1, and the detection module is executed again; The final module judges whether the detection score is higher than the threshold value, if yes, it is determined that the target text has the watermark of the large model.

7. A watermark detection apparatus based on Bayesian detection as claimed in claim 6, characterized in that, The process of adding a watermark to the large model is: The starting module obtains a prompt word and a vocabulary of a large language model; the prompt word includes M tokens; The generation module, for the tth token to be generated of the text to be generated, processes the token sequence composed of the prompt word and the generated text through the large model to obtain a probability distribution of the token position on the vocabulary; the k tokens immediately before the current position in the generated token sequence are selected as the input of the hash function, and the output of the hash function is taken as the random seed corresponding to the tth token to be generated; k is a pre-specified prefix window length; based on the random seed, the vocabulary is divided into a preferential selection set and a non-preferential selection set; based on the preset bias, the probability distribution of the current token is perturbed, and the corresponding token of the tth token position in the vocabulary is determined according to the probability distribution after perturbation; It is judged whether the tth token is an end token or whether the number of generated tokens has reached the preset upper limit of the length, if yes, the output module is executed, otherwise t=t+1 and the generation module is executed again; The output module decodes the generated token sequence into a text with a watermark and outputs it; The prompt word obtained in the initial module is a prompt word used when generating the target text, or a prompt word generated according to the use scenario and text content of the target text; The log likelihood ratio A(x, a) is: wherein M is the large model, the prompt word of the target text x is a, and the probability output by the large model is P M , h is the hash function, the input is the prefix token and the current token x t , the output is 0 or 1, and δ is a parameter of the watermark strength.

8. An electronic device, comprising: The watermark detection device based on Bayesian detection of claim 6 or 7, the electronic device or the information display device connected, the information display device is used to display the evaluation result with the display parameter, attribute set by the user or through the artificial intelligence model.

9. A computer-readable storage medium having stored thereon a computer program which, when executed by a processor, implements the steps of the watermark detection method based on Bayesian detection of any one of claims 1-5.

10. A computer program product comprising a computer program, characterized in that, The computer program which, when executed by a processor, implements the steps of the watermark detection method based on Bayesian detection of any one of claims 1-5. The computer program which, when executed by a processor, implements the steps of the watermark detection method based on Bayesian detection of any one of claims 1-5.

Images