Large language model intellectual property protection method and device based on domain-specific prejudice feature fingerprints

Abstract

The invention discloses a large language model intellectual property protection method and device based on domain-specific prejudice feature fingerprints, and belongs to the cross technical field of artificial intelligence safety and intellectual property protection. The method specifically comprises the steps that a three-dimensional orthogonal prejudice data set is constructed, and the data set depicts model prejudice features from the three dimensions of the field, the prejudice type and the response mode; screening the three-dimensional orthogonal prejudice data set based on a two-stage screening mechanism so as to extract core sample data with intra-family high stability and inter-family high discrimination; performing domain-specific prejudice feature fingerprint extraction based on the core sample data to obtain a standardized reference fingerprint; and performing ownership judgment on the to-be-tested model by adopting a confrontation verification mechanism based on the standardized reference fingerprint. According to the method, a quantifiable and high-robustness ownership identification scheme can be provided for the closed-source large language model, and the method has important application value for solving the safety problems of infringement and embezzlement of intellectual property of the large language model and the like.

Description

Technical Field

[0001] This invention belongs to the field of artificial intelligence security and intellectual property protection technology, specifically relating to a method and apparatus for protecting intellectual property rights of large language models based on domain-specific bias feature fingerprints. Background Technology

[0002] In recent years, with the rapid development of large language models, they have demonstrated unprecedented capabilities in content generation, problem reasoning, and data analysis, bringing revolutionary changes to the field of artificial intelligence. However, large language models also face a serious security problem: adversaries can illegally plagiarize them, which seriously infringes on the intellectual property rights of the legitimate owners of the models. Fingerprint recognition methods are dedicated to increasing the difficulty of plagiarism and can be mainly divided into two categories: (1) fingerprint extraction methods based on the inherent features of the model; (2) fingerprint implantation methods based on training.

[0003] Fingerprint extraction methods based on the inherent features of the model achieve ownership verification by mining the unique attributes of the model itself. These methods mainly include: (1) Weight-based identification: focusing on analyzing the model's internal parameters, such as comparing weight vectors through cosine similarity analysis. (2) Feature space analysis: mainly based on the model's output of general texts (such as news and encyclopedias). Fingerprints are constructed using spatial distribution or activation patterns. However, these methods have fatal flaws: firstly, they are highly dependent on "white-box permissions," rendering them completely ineffective in closed-source scenarios where internal model information cannot be obtained; secondly, different model families exhibit significant convergence on general tasks, resulting in severely insufficient fingerprint discrimination capabilities and a high false positive rate.

[0004] In contrast, fingerprinting based on training achieves ownership tracking by actively embedding verifiable signals during the model training phase. It can be mainly subdivided into: (1) Fingerprinting based on digital watermarking technology: The core logic is to embed specific patterns into the model training data, such as the periodic repetition of high-frequency words, fixed syntactic structures, or specific semantic fragments. In this way, the model will "memorize" these patterns during the learning process and naturally carry these "source markers" when generating content in the future, thereby achieving ownership tracking. However, the robustness of this method is its core bottleneck. When the model undergoes routine optimization operations such as fine-tuning and model pruning, these embedded watermark patterns will be severely diluted or even completely covered due to parameter adjustments. In addition, in order to ensure the detectability of the watermark and increase the embedding strength, it will interfere with the model's learning of normal semantics, resulting in a decrease in the fluency and quality of the generated text; (2) Fingerprinting based on backdoors: This method achieves ownership verification by embedding specific "backdoor triggers" in the model. When the model receives a specific input that meets the triggering conditions, it will generate a preset, unique backdoor output to prove its source, and this process does not require access to the model weights. While this approach seems ingenious, it also faces serious robustness issues. The implanted backdoor logic can easily be compromised during model retraining, fine-tuning, or pruning. More importantly, the act of implanting a backdoor alters the model's original behavior, potentially introducing new security vulnerabilities and causing unpredictable negative impacts on the model's general performance and security.

[0005] In summary, the existing technology still has the following problems: (1) Lack of applicability in black-box scenarios. White-box methods, such as weight-based recognition, require complete access to the model's internal parameters and structure. In reality, most large commercial models provide services in the form of APIs, and their internal details are strictly confidential. Therefore, white-box methods are almost impossible to implement in these scenarios, and their universality is greatly limited.

[0006] (2) Insufficient robustness. Implanted fingerprints (such as digital watermarks and backdoors) are severely damaged or even completely invalidated when faced with conventional model optimization operations, and cannot provide reliable intellectual property protection in actual adversarial scenarios.

[0007] (3) Low discriminative power of general features. Fingerprints constructed based on general text output features tend to have weak feature differences between families because the output distribution and patterns of different models tend to be consistent on these tasks. This makes the uniqueness and discriminative power of fingerprints seriously insufficient, resulting in a high false positive rate and failing to meet the high accuracy requirements for property rights identification.

[0008] Therefore, there is an urgent need to research a novel fingerprinting technology that can be implemented in black-box scenarios, is robust, has high discriminative power, and is based on structured features, so as to better protect the intellectual property rights of large language models. Summary of the Invention

[0009] In view of the above, the purpose of this invention is to provide a method and apparatus for protecting intellectual property rights of large language models based on domain-specific bias feature fingerprints. By constructing a structured bias dataset to extract response patterns unique to the model family, and combining this with an adversarial verification mechanism for ownership determination, this invention achieves improved high discriminative power, robustness, and interpretability of fingerprint features in black-box scenarios. This invention balances high accuracy with practical applicability, providing a reliable and quantifiable ownership identification scheme for closed-source large language models in complex commercial application scenarios. It has significant technical value and practical implications for solving core security issues such as intellectual property infringement and misappropriation in current large language models.

[0010] To achieve the above-mentioned objectives, the embodiments provide a method for protecting intellectual property rights of large language models based on domain-specific bias feature fingerprints, comprising the following steps: A three-dimensional orthogonal bias dataset is constructed, which characterizes the bias features of the model from three dimensions: domain, bias type, and response pattern. The three-dimensional orthogonal bias dataset is filtered based on a two-level screening mechanism to extract core sample data that has both high stability within families and high discriminative power between families. Domain-specific bias feature fingerprints are extracted based on core sample data to obtain standardized benchmark fingerprints; Based on standardized benchmark fingerprints, an adversarial verification mechanism is used to determine the ownership of the model under test.

[0011] Preferably, the construction of the three-dimensional orthogonal bias dataset follows the principles of domain hierarchical structure, type orthogonality, and response quantization, including: In terms of domains, the sample data covers multiple vertical and bias-sensitive social issue domains, specifically including at least two of the following: gender, race, occupation, region, age, economy, education, and ethics. The sample size for each domain is weighted according to the degree of bias sensitivity. In terms of bias type dimension, the sample data is divided into three mutually orthogonal subsets: explicit bias, implicit bias, and neutral control, in order to accurately separate different forms of bias and ensure that there is no overlap in bias types; In terms of response pattern dimension, the discrete choices of the model are quantified into continuous probability vectors to capture subtle differences in preferences. Specifically, the logits output of the large language model is converted into a multidimensional probability vector through the softmax function to quantify the model's response preferences to different types of bias.

[0012] Preferably, the two-level screening mechanism for filtering the three-dimensional orthogonal bias dataset to extract core sample data that possesses both high stability within families and high discriminative power between families includes: The first level of family consistency screening aims to evaluate the consistency of responses among different members within the same model family. Specifically, it filters out highly stable sample data with stable responses within the family by calculating the similarity of the output probability vectors of sample data on multiple large language models within the same family. The second level of cross-family specificity screening aims to further filter out high-discrimination sample data that can uniquely identify the family identity by measuring the difference in response between the target family and other families. This extracts core sample data that combines high stability within the family and high discrimination between families. Specifically, using the high-stability sample data, the difference in output distribution between the target family model and multiple cross-family models is calculated, and high-discrimination samples with family specificity are selected as core sample data.

[0013] Preferably, in the first-level screening for consistency within the same family, a weighted combination index is used to calculate the similarity of the output probability vector, wherein the weighted combination index includes cosine similarity and JS divergence; in the second-level screening for cross-family specificity, a fusion index is used to calculate the output distribution difference, wherein the fusion index includes KL divergence and maximum mean difference (MMD).

[0014] Preferably, the step of extracting domain-specific bias feature fingerprints based on core sample data to obtain a standardized benchmark fingerprint includes: First, extract and quantify at least three types of core features from the output probabilities of the core sample data in the target large language model: The first type of core feature is: the distribution of bias intensity within each domain by calculating the statistical characteristics (such as truncated mean and variance) of the probability of explicit and implicit bias within each domain, so as to reflect the bias intensity and fluctuation of the model in a specific domain; The second core feature is: cross-domain bias correlation degree obtained by calculating the correlation matrix of implicit bias features between various domains and extracting the correlation features, so as to reveal the cross-domain propagation pattern of model bias; The third core feature is the extreme response entropy value, which is obtained by calculating the response probability entropy value of extreme bias samples in each domain, to reflect the concentration of the model output. Then, the three core features are fused and spliced ​​into a multidimensional initial feature fingerprint. Principal component analysis (PCA) is used to reduce the dimensionality of the initial feature fingerprint to obtain a standardized benchmark fingerprint that retains key information.

[0015] Preferably, the ownership determination of the model under test based on the standardized benchmark fingerprint and employing an adversarial verification mechanism includes: The core sample data is slightly perturbed to construct a dataset of interfering samples, changing its surface form while maintaining semantic integrity. The core sample data and the corresponding interfering sample data are input into the model to be tested, and two feature vectors to be tested are obtained by following the same acquisition process as the benchmark fingerprint. The comprehensive divergence value of the benchmark fingerprint and the two feature vectors to be tested is calculated, and the comprehensive divergence value is compared with a preset threshold to determine ownership.

[0016] Preferably, the calculation of the combined divergence value between the baseline fingerprint and the two feature vectors to be tested includes: Calculate the Euclidean distance between the baseline fingerprint and the target feature vector corresponding to the core sample data, and calculate the cosine distance between the baseline fingerprint and the target feature vector corresponding to the interference sample data. The weighted sum of the Euclidean distance and the cosine distance is used as the comprehensive divergence value.

[0017] To achieve the above invention, an embodiment also provides an intellectual property protection device for a large language model based on domain-specific bias feature fingerprints, comprising: The dataset construction module is used to construct a three-dimensional orthogonal bias dataset, which characterizes the bias features of the model from three dimensions: domain, bias type, and response pattern. The sample screening module is used to screen the three-dimensional orthogonal bias dataset based on a two-level screening mechanism to extract core sample data that has both high stability within families and high discriminative power between families. The fingerprint extraction module is used to extract domain-specific bias feature fingerprints based on core sample data to obtain standardized benchmark fingerprints. The ownership determination module is used to determine the ownership of the model under test based on a standardized benchmark fingerprint and an adversarial verification mechanism.

[0018] To achieve the above-mentioned objectives, the embodiments also provide a computing device, including a memory and one or more processors, wherein the memory stores executable code, and when the one or more processors execute the executable code, it is used to implement the above-mentioned method for protecting intellectual property rights of large language models based on domain-specific bias feature fingerprints.

[0019] To achieve the above-mentioned objectives, the embodiments also provide a computer-readable storage medium storing a program that, when executed by a processor, implements the above-mentioned method for protecting intellectual property rights of large language models based on domain-specific bias feature fingerprints.

[0020] Compared with the prior art, the beneficial effects of the present invention include at least the following: (1) Overcoming the limitations of black-box scenarios: This invention does not require access to the model's internal parameters; ownership determination can be completed simply by obtaining the model's output through the API interface. This fundamentally solves the fatal flaw of weight-based fingerprinting methods relying on "white-box permissions," making it widely applicable to various commercial closed-source models and possessing strong practical application value.

[0021] (2) Significantly improves the robustness of fingerprints: This invention extracts the inherent, deep-seated bias features of the model, rather than the fragile signals implanted through training. Combined with the adversarial verification mechanism, the fingerprint can still exhibit excellent stability and high verification accuracy when facing common attacks such as fine-tuning, parameter pruning, and input perturbation, effectively solving the problem of insufficient robustness and easy erasure of implanted fingerprints such as digital watermarks and backdoors.

[0022] (3) Significantly enhances feature discrimination and reliability: To address the problem of low discrimination of general text fingerprints, this invention significantly improves the fingerprint difference between different model families and greatly reduces the misjudgment rate of ownership identification through a structured three-dimensional orthogonal bias dataset and a two-level screening mechanism. This directly solves the pain point of existing technologies that cannot effectively distinguish different model families due to the single dimension and lack of structure in feature mining.

[0023] (4) Achieving highly interpretable ownership tracing: Unlike purely data-driven and difficult-to-interpret fingerprints, the feature fingerprints of this invention are directly related to specific domain biases. By performing importance analysis on the features of each dimension in the fingerprint vector, not only can ownership be determined, but also the potential bias in the training data of the model can be traced back, providing additional value for model governance and optimization, and possessing stronger technical credibility. Attached Figure Description

[0024] To more clearly illustrate the technical solutions in the embodiments of the present invention or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0025] Figure 1 This is a flowchart of the intellectual property protection method for large language models based on domain-specific bias feature fingerprints provided in the embodiments; Figure 2 This is a flowchart of the intellectual property protection method for large language models based on domain-specific bias feature fingerprints provided in the embodiments; Figure 3 This is a schematic diagram of the structure of a large language model intellectual property protection device based on domain-specific bias feature fingerprints. Detailed Implementation

[0026] To make the objectives, technical solutions, and advantages of this invention clearer, the invention will be further described in detail below with reference to the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are merely illustrative of the invention and do not limit the scope of protection of this invention.

[0027] The inventive concept of this invention is as follows: Addressing the problems of existing fingerprinting methods, such as reliance on white-box permissions, insufficient robustness, low discriminative power of general features, and lack of structured feature mining, this invention provides a method and apparatus for protecting intellectual property rights of large language models based on domain-specific biased feature fingerprints. It is particularly suitable for determining the copyright ownership of large language models in black-box scenarios. It is a novel black-box fingerprint extraction and verification framework. By carefully constructing a structured three-dimensional biased dataset, it systematically stimulates and captures the inherent response patterns of models in specific domains. Subsequently, a two-level screening mechanism is used to purify core samples that possess both "intra-family stability" and "inter-family specificity" attributes, and multi-dimensional fused feature fingerprints are extracted from them. Finally, an adversarial verification mechanism is employed to accurately and robustly determine the ownership of suspected models within a unified feature space, thereby comprehensively improving the black-box applicability, robustness, and discriminative power of fingerprinting technology.

[0028] In this embodiment, a large language model receives a structured input (e.g., a contextual cue text and a set of preset options), evaluates the options, and outputs the model's raw logits value for each option. In this invention, these logits values ​​(i.e., the "output") are converted into a continuous probability vector using a softmax function to quantify the model's subtle preferences for different options, thereby providing foundational data for subsequent bias feature analysis and fingerprint extraction.

[0029] like Figure 1 and Figure 2 As shown, the embodiment provides a method for protecting intellectual property rights of large language models based on domain-specific bias feature fingerprints, including the following steps: S1. Construct a three-dimensional orthogonal bias dataset, which characterizes the bias features of the model from three dimensions: domain, bias type, and response pattern.

[0030] In this embodiment, to comprehensively characterize the bias response patterns of a large language model under different social issues, a structured three-dimensional orthogonal bias dataset needs to be constructed first. This dataset is constructed from three dimensions: domain, bias type, and response pattern, with a total sample size of 10,000. The purpose of this structured design is to ensure, through the orthogonality between dimensions, the accurate separation and quantification of specific bias signals of the model under specific stimuli, avoiding confusion between different features.

[0031] Specifically, in terms of domain, the dataset covers eight vertical domains: gender-related scenarios, race-related scenarios, occupational matching scenarios, geographically related scenarios, age-related scenarios, economic status scenarios, educational background scenarios, and ethical judgment scenarios. In terms of bias type, the samples are divided into three mutually orthogonal subsets: an explicit bias subset, an implicit bias subset, and a neutral control subset. In terms of response pattern, each sample contains an input text and four options, corresponding to "explicit positive response," "explicit negative response," "implicit biased response," and "neutral response," respectively. To quantify the model's preference for different biased options, the model's raw logits values ​​are processed... The function transformation yields a four-dimensional probability vector. The conversion formula is: in, This is the original logits value for the j-th option of the i-th sample.

[0032] For example, a biased sample in a "job fit scenario" could be constructed as follows: the input text is "The team is recruiting for an executive position, who is more suitable?", and the corresponding options A (explicit positive) are: "Men are more suitable because men are more decisive in business competition."; option B (explicit negative) is: "Women are more suitable because women are not less capable of leadership than men."; option C (implicit bias) is: "People with a strong sense of family responsibility are not suitable, regardless of gender."; and option D (neutral control) is: "The candidate's ability is the only hiring advantage." S2, the three-dimensional orthogonal bias dataset is filtered based on a two-level screening mechanism to extract core sample data that has both high stability within families and high discriminative power between families.

[0033] In this embodiment, to extract the fingerprint information that best represents the model family identity, the 10,000 initial samples constructed in S1 need to undergo a two-stage screening. The first stage of screening is the same-family consistency screening, which aims to select sample data that exhibits high response consistency within the target large language model family. Specifically, by calculating the similarity of the output probability vectors of the sample data on multiple large language models of the same family, highly stable sample data with stable responses within the family is selected.

[0034] Taking LLaMA2 as the target large language model as an example, 10,000 samples are input into multiple sub-models derived from this model (such as WizardMath, ChineseLLaMA, CodeLLaMA), and the weighted similarity of each sample among these models is calculated. The calculation formula is as follows: in, and Let i be the output probability vector for sample i on two models of the same family for the same bias question. Cosine similarity is used to measure the consistency of two probability vectors in direction. It is the reciprocal of the JS divergence, used to measure the similarity between two probability distributions; and For weighting coefficients, preferably =0.6, =0.4. Set the similarity threshold. Filtering those with similarity above the threshold It retains approximately 5000 highly stable samples, among which, the similarity threshold The preferred similarity is calculated from all 10,000 initial samples. The median, or 50th percentile. Setting this quantile ensures that the top 50% (approximately 5000) of samples with the highest scores are selected and retained as highly stable samples. A second level of selection, cross-family specificity selection, is then performed. This step aims to further filter from the 5000 highly stable samples to identify those that clearly distinguish the target family from other families (such as GPT-4 and Claude 3). This step directly utilizes the highly stable samples selected in the previous stage to calculate the difference in output distribution between the target family model and other non-family models on these samples. The calculation formula is as follows: in Let be the output probabilities of sample i in the target family model and the heterofamily model, respectively, and γ be the weighting coefficient, preferably γ = 0.6. This formula integrates two divergence measures: first, KL divergence (Kullback-Leibler Divergence), an asymmetric measure used to quantify the amount of information lost when using one probability distribution Q to approximate another probability distribution P, which effectively measures the extent to which the heterofamily model's response deviates from the target family's response pattern; second, MMD (Maximum Mean Discrepancy), a kernel method that measures the distance between two probability distributions in the reproducing kernel Hilbert space. It is robust and computationally easy in high-dimensional spaces and can effectively capture the overall morphological differences between the two distributions. Finally, a difference threshold is set. It can filter those with a difference threshold. Approximately 3,000 highly discriminative samples with significant cross-family specificity were retained as core sample data. Among these, the difference threshold... The preferred method is to calculate the difference based on 5000 highly stable samples. The 40th percentile. This step aims to retain approximately 3000 samples as core sample data with high discriminative power.

[0035] S3 extracts domain-specific bias feature fingerprints based on core sample data to obtain standardized benchmark fingerprints.

[0036] In this embodiment, a standardized baseline fingerprint is constructed for the target large language model family (such as LLaMA2) based on 3000 high-discrimination samples selected by S2. This process first extracts and quantifies three types of core features from the output probabilities of the core sample data in the target large language model: The first core feature is the distribution of bias intensity within each domain, obtained by calculating the statistical characteristics of the probabilities of explicit and implicit bias within each domain. This aims to capture the degree and stability of bias in each vertical domain. The quantification process includes: First, calculating statistical characteristics: For each sample in the eight domains, calculating the statistical data of the two types of bias probabilities: the mean of the explicit bias probability (…). ) and variance ), and the mean of the probability of implicit bias (( ) and variance The second step is to form a feature vector: combining the above four types of statistics ( , , , The features are combined to form a 4-dimensional feature vector describing the overall bias strength of the model, denoted as . This refers to the distribution of bias intensity within the domain.

[0037] The second core feature is the cross-domain bias correlation, obtained by calculating the correlation matrix of implicit bias features across domains and extracting the correlation features. It aims to reveal whether a model's bias in one domain will systematically correlate with biases in other domains. The quantification process includes: First, calculating the correlation matrix: using the Pearson correlation coefficient, the correlation of "implicit bias features" among the eight domains is calculated, generating an 8×8 correlation matrix C. Each element in the matrix represents the strength of the bias correlation between the i-th and j-th domains. Second, extracting core features to form a vector: from the correlation matrix C, the eight elements on its diagonal are extracted as the final feature vector. The diagonal elements of the matrix represent the autocorrelation within each domain. These eight values ​​together form an 8-dimensional vector, denoted as . This refers to the cross-domain bias correlation.

[0038] The third core feature is the extreme response entropy value, obtained by calculating the response probability entropy value of extreme bias samples in each domain. It aims to measure the decision certainty of the model when making high-probability choices. The quantification process includes: First, calculating the entropy value for each domain: For extreme bias samples with high output probability values ​​in each domain, specifically those with probability values ​​greater than or equal to a given threshold (e.g., 0.8), calculate the entropy value H of their response probability distribution. The formula is as follows: The second step is to form a feature vector: combine the entropy values ​​calculated from the eight domains to form an 8-dimensional entropy feature vector, denoted as... This is the extreme response entropy value.

[0039] Finally, the three types of feature vectors are fused together and concatenated to form a 20-dimensional initial feature fingerprint. To improve the efficiency and robustness of the fingerprint, principal component analysis (PCA) was used to reduce the dimensionality of the initial 20-dimensional features, resulting in a 10-dimensional core fingerprint. This core fingerprint was established as the baseline fingerprint for the LLaMA2 family, and its defined feature space constitutes a standardized feature space within which all subsequent weight comparisons will be performed.

[0040] S4, based on standardized benchmark fingerprints, uses an adversarial verification mechanism to determine the ownership of the model under test.

[0041] In this embodiment, a dual divergence calculation method is used to accurately and robustly determine the affiliation of a suspected test model. The core of this method is to compare the distance between the test model and the target family's benchmark fingerprint in the standardized feature space established in S3.

[0042] Specifically, the first step is to obtain the coordinates of the model under test within the feature space. 3000 highly discriminative core samples are input into the model under test, and the same process as in S3 is followed to obtain its first 10-dimensional feature vector. Simultaneously, these 3000 samples are slightly perturbed to construct a set of interfering samples. The interfering sample data from this set is also input into the model under test, and the above process is repeated to obtain its second 10-dimensional feature vector.

[0043] Then, a double divergence calculation can be performed to obtain the combined divergence value Dist. The calculation formula is as follows: . The Euclidean distance (L2 norm) between the baseline fingerprint and the first 10-dimensional feature vector of the model under test is used to measure the absolute positional difference of the vectors in space. The cosine distance between the baseline fingerprint and the second 10-dimensional feature vector of the model under test is used to measure the similarity of the vector's direction or pattern. and For weighting coefficients, preferably , Finally, the comprehensive divergence value is compared with the preset judgment threshold. The comparison is performed to determine whether the ownership matches. The determination threshold is... The preferred value is 0.35.

[0044] In summary, the intellectual property protection method for large language models provided by this invention, by constructing a structured bias dataset and combining steps such as two-level screening, feature extraction, and adversarial verification, can generate highly discriminative and robust fingerprints for large language models in black-box scenarios. This provides an innovative technical solution for scenarios such as copyright protection of large models, data tracing, and combating malicious exploitation, and lays an important foundation for the secure and reliable deployment of large models.

[0045] Based on the same inventive concept, such as Figure 3 As shown in the figure, this embodiment of the invention also provides a large language model intellectual property protection device 30 based on domain-specific bias feature fingerprints, including a dataset construction module 31, a sample screening module 32, a fingerprint extraction module 33, and an ownership determination module 34. The dataset construction module 31 is used to construct a three-dimensional orthogonal bias dataset, which characterizes the model's bias features from three dimensions: domain, bias type, and response pattern. The sample screening module 32 is used to screen the three-dimensional orthogonal bias dataset based on a two-level screening mechanism to extract core sample data that possesses both high stability within a family and high discriminative power between families. The fingerprint extraction module 33 is used to extract domain-specific bias feature fingerprints based on the core sample data to obtain standardized benchmark fingerprints. The ownership determination module 34 is used to determine the ownership of the model under test based on the standardized benchmark fingerprints using an adversarial verification mechanism.

[0046] It should be noted that the domain-specific bias fingerprint-based large language model intellectual property protection device provided in the above embodiments should be illustrated using the above-described functional module divisions when making judgments on large language model intellectual property protection. The functions can be assigned to different functional modules as needed, i.e., the internal structure of the terminal or server can be divided into different functional modules to complete all or part of the functions described above. Furthermore, the domain-specific bias fingerprint-based large language model intellectual property protection device and the domain-specific bias fingerprint-based large language model intellectual property protection method embodiments provided in the above embodiments belong to the same concept. For details of their specific implementation, please refer to the domain-specific bias fingerprint-based large language model intellectual property protection method embodiments, which will not be repeated here.

[0047] Based on the same inventive concept, the embodiment also provides a computing device, including a memory and one or more processors. The memory stores executable code, and when the one or more processors execute the executable code, it is used to implement the above-mentioned method for protecting intellectual property rights of large language models based on domain-specific bias feature fingerprints, specifically including the following steps: S1. Construct a three-dimensional orthogonal bias dataset, which characterizes the bias features of the model from three dimensions: domain, bias type, and response pattern. S2, the three-dimensional orthogonal bias dataset is screened based on a two-level screening mechanism to extract core sample data that has both high stability within families and high discriminative power between families; S3, based on core sample data, performs domain-specific bias feature fingerprint extraction to obtain a standardized benchmark fingerprint; S4, based on standardized benchmark fingerprints, uses an adversarial verification mechanism to determine the ownership of the model under test.

[0048] The computing device provided in this embodiment, at the hardware level, includes not only a processor and memory, but also internal buses, network interfaces, memory, and other hardware required for business operations. The memory is non-volatile memory. The processor reads the corresponding computer program from the non-volatile memory into memory and then runs it to implement the domain-specific bias feature fingerprint-based large language model intellectual property protection method described in S1-S4 above. Of course, besides software implementation, this invention does not exclude other implementation methods, such as logic devices or a combination of hardware and software, etc. That is to say, the execution entity of the following processing flow is not limited to individual logic units, but can also be hardware or logic devices.

[0049] Based on the same inventive concept, the embodiments also provide a computer-readable storage medium storing a program that, when executed by a processor, implements the above-described method for protecting intellectual property rights of large language models based on domain-specific bias feature fingerprints, specifically including the following steps: S1. Construct a three-dimensional orthogonal bias dataset, which characterizes the bias features of the model from three dimensions: domain, bias type, and response pattern. S2, the three-dimensional orthogonal bias dataset is screened based on a two-level screening mechanism to extract core sample data that has both high stability within families and high discriminative power between families; S3, based on core sample data, performs domain-specific bias feature fingerprint extraction to obtain a standardized benchmark fingerprint; S4, based on standardized benchmark fingerprints, uses an adversarial verification mechanism to determine the ownership of the model under test.

[0050] In this embodiment, the computer-readable medium includes permanent and non-permanent, removable and non-removable media, and information storage can be implemented by any method or technology. The information can be computer-readable instructions, data structures, program modules, or other data.

[0051] The specific embodiments described above illustrate the technical solution and beneficial effects of the present invention in detail. It should be understood that the above description is only the most preferred embodiment of the present invention and is not intended to limit the present invention. Any modifications, additions, and equivalent substitutions made within the scope of the principles of the present invention should be included within the protection scope of the present invention.

Claims

1. A method for protecting intellectual property rights of large language models based on domain-specific bias feature fingerprints, characterized in that, Includes the following steps: A three-dimensional orthogonal bias dataset is constructed, which characterizes the bias features of the model from three dimensions: domain, bias type, and response pattern. The three-dimensional orthogonal bias dataset is filtered based on a two-level screening mechanism to extract core sample data that has both high stability within families and high discriminative power between families. Domain-specific bias feature fingerprints are extracted based on core sample data to obtain standardized benchmark fingerprints; Based on standardized benchmark fingerprints, an adversarial verification mechanism is used to determine the ownership of the model under test.

2. The method for protecting intellectual property rights of large language models based on domain-specific bias feature fingerprints according to claim 1, characterized in that, The construction of the three-dimensional orthogonal bias dataset includes: In terms of domains, the sample data covers multiple vertical and bias-sensitive social issue domains, specifically including at least two of the following: gender, race, occupation, region, age, economy, education, and ethics. In terms of bias type dimension, the sample data is divided into three mutually orthogonal subsets: explicit bias, implicit bias, and neutral control. In terms of response patterns, the discrete choices of the model are quantified into continuous probability vectors to capture subtle differences in preferences and to quantify the model's response preferences to different types of bias.

3. The method for protecting intellectual property rights of large language models based on domain-specific bias feature fingerprints according to claim 1, characterized in that, The two-level screening mechanism is used to filter the three-dimensional orthogonal bias dataset to extract core sample data that possess both high stability within families and high discriminative power between families, including: The first level of family consistency screening involves calculating the similarity of the output probability vectors of sample data across multiple family-based large language models to select highly stable sample data that have stable responses within the family. The second level of cross-family specificity screening utilizes the highly stable sample data to calculate the output distribution difference between the target family model and multiple heterogeneous family models, and selects high-discrimination samples with family specificity as core sample data.

4. The method for protecting intellectual property rights of large language models based on domain-specific bias feature fingerprints according to claim 3, characterized in that, For the first-level screening of same-family consistency, a weighted combination index is used to calculate the similarity of the output probability vector, which includes cosine similarity and JS divergence. For the second-level screening of cross-family specificity, a fusion index is used to calculate the output distribution difference, which includes KL divergence and maximum mean difference (MMD).

5. The method for protecting intellectual property rights of large language models based on domain-specific bias feature fingerprints according to claim 1, characterized in that, The extraction of domain-specific bias feature fingerprints based on core sample data yields a standardized benchmark fingerprint, including: First, extract and quantify at least three types of core features from the output probabilities of the core sample data in the target large language model: The first core feature is: the distribution of bias intensity within a domain obtained by calculating the statistical characteristics of the probability of explicit and implicit bias within each domain, so as to reflect the bias intensity and fluctuation of the model in a specific domain; The second core feature is: cross-domain bias correlation degree obtained by calculating the correlation matrix of implicit bias features between various domains and extracting the correlation features, so as to reveal the cross-domain propagation pattern of model bias; The third core feature is the extreme response entropy value, which is obtained by calculating the response probability entropy value of extreme bias samples in each domain, to reflect the concentration of the model output. Then, the three core features are fused and spliced ​​into a multidimensional initial feature fingerprint. Principal component analysis (PCA) is used to reduce the dimensionality of the initial feature fingerprint to obtain a standardized baseline fingerprint.

6. The method for protecting intellectual property rights of large language models based on domain-specific bias feature fingerprints according to claim 5, characterized in that, The standardized benchmark fingerprint, employing an adversarial verification mechanism, is used to determine the ownership of the model under test, including: The core sample data and the corresponding interference sample data are respectively input into the model to be tested, and two feature vectors to be tested are obtained by following the same acquisition process as the benchmark fingerprint. The comprehensive divergence value of the benchmark fingerprint and the two feature vectors to be tested is calculated, and the comprehensive divergence value is compared with a preset threshold to determine the ownership.

7. The method for protecting intellectual property rights of large language models based on domain-specific bias feature fingerprints according to claim 6, characterized in that, The calculation of the combined divergence value between the baseline fingerprint and the two feature vectors to be measured includes: Calculate the Euclidean distance between the baseline fingerprint and the target feature vector corresponding to the core sample data, and calculate the cosine distance between the baseline fingerprint and the target feature vector corresponding to the interference sample data. The weighted sum of the Euclidean distance and the cosine distance is used as the comprehensive divergence value.

8. A large language model intellectual property protection device based on domain-specific bias feature fingerprints, characterized in that, include: The dataset construction module is used to construct a three-dimensional orthogonal bias dataset, which characterizes the bias features of the model from three dimensions: domain, bias type, and response pattern. The sample screening module is used to screen the three-dimensional orthogonal bias dataset based on a two-level screening mechanism to extract core sample data that has both high stability within families and high discriminative power between families. The fingerprint extraction module is used to extract domain-specific bias feature fingerprints based on core sample data to obtain standardized benchmark fingerprints. The ownership determination module is used to determine the ownership of the model under test based on a standardized benchmark fingerprint and an adversarial verification mechanism.

9. A computing device comprising a memory and one or more processors, wherein the memory stores executable code, characterized in that, When the one or more processors execute the executable code, they are used to implement the intellectual property protection method for large language models based on domain-specific bias feature fingerprints as described in any one of claims 1-7.

10. A computer-readable storage medium, characterized in that, It stores a program that, when executed by a processor, implements the intellectual property protection method for large language models based on domain-specific bias feature fingerprints as described in any one of claims 1-7.

Images