A content source judgment method, device and storage medium are generated

Abstract

The application discloses a method for judging the source of generated content. The method is based on a target category sample set generated by a generation model to train a target context vector, and a non-target category sample set randomly obtained to train a non-target context vector. The text features of a sample to be tested are compared with the prompt word features of the target context vector and the non-target context vector. If the sample to be tested is close to the prompt word features of the target context vector, it is proved that the sample to be tested is generated by the generation model. The application first proposes a method for accurately identifying the source by using the above process. The application also discloses a device for judging the source of generated content and a storage medium.

Description

Technical Field

[0001] This invention belongs to the field of cyberspace security, and specifically relates to a method, apparatus and storage medium for determining the source of generated content. Background Technology

[0002] Artificial intelligence-generated content (AIGC) has recently garnered significant attention. For instance, in the field of image generation, existing AIGC models can generate high-quality images across various domains.

[0003] As AIGC models become increasingly sophisticated, it has become difficult for humans to identify whether a given content sample was generated by the model. This challenge could lead to numerous security issues.

[0004] In the field of text generation, large models can also generate highly realistic fake news, posing various risks. To address the challenges and opportunities presented by AIGC (AI-Generated Content), it is required that all AI-generated content clearly indicate its source (e.g., Stable Diffusion, ChatGPT). This measure aims to ensure the public's understanding of content authenticity and protect the copyright of AIGC. Therefore, verifying whether a given piece of questionable content was generated by a specific AIGC model (i.e., verifying the source model of the generated content) has become a pressing issue.

[0005] In practice, the inspection work becomes more challenging because detailed information such as the model's weights and gradients, as well as intermediate calculation results, is unavailable. Regulators can only verify the source of the generated model based on the limited content it produces.

[0006] In existing technologies, AIGC detection methods mainly focus on distinguishing between real and fake content, with a particular emphasis on deepfakes. These methods aim to classify clean content samples and generated content samples into two distinct categories by detecting artificial traces in existing content samples. For example, detecting local artificial artifacts in the input and feature space.

[0007] CLIP stands for Contrastive Language-Image Pre-training, a pre-training method or model based on contrastive text-image pairs. CLIP is a pre-trained multimodal model used to predict whether an image matches a text prompt. It includes an image encoder E v (·) and text encoder E t (·). A pre-trained CLIP can perform zero-shot multi-class classification by comparing an image to a list of cue words (each cue word representing a class). Formally, suppose we have K classes. Let Xv ∈x represents the image, This represents the i-th prompt word representing the i-th category. Image X v The formula for calculating the prediction probability of the i-th class is:

[0008]

[0009] Here, sim(·) is a function that measures the distance between two embeddings, such as the dot product.

[0010] Existing CLIP-based classifiers can achieve excellent performance with only a few content samples per class, but when checking whether a given generated content sample (e.g., an image) was generated by a specific generative model, only a small number of samples generated by the generative model can be obtained. Therefore, standard CLIP-based classifiers cannot be directly used to solve few-shot one-class classification tasks.

[0011] In the initial CLIP classification, manually crafted text prompts were used to represent categories. Designing these prompts required specialized knowledge and was extremely time-consuming. To alleviate this problem, the concept of Context Optimization (CoOp) was proposed, which utilizes learnable vectors to extract words relevant to the prompts. CoOp enables the model to automatically optimize appropriate prompts, rather than manually designing them. Formally, the prompt for the i-th category can be represented as... Where t is the learnable context vector, It's a connection operation, CLASS i The name corresponds to the i-th category. The optimization goal is to minimize each Predict the true value Y i The error is calculated using the cross-entropy loss function associated with the learnable cue words. This is achieved through optimization. The optimization process can be described as follows:

[0012]

[0013] Where N is the number of images. In fact, research in

[12] shows that only a small number of labeled examples are needed to learn effective cue words. In summary, cue word learning enables CLIP-based classification to become effective with a small number of samples.

[0014] However, existing AIGC detection methods aim to detect artifacts in the natural attributes of generated content samples, but cannot detect artifacts generated by a specific generative model. Furthermore, these methods require a large number of training samples (e.g., images), while in practice only a small number of content samples generated by the generative model are available.

[0015] Existing CLIP-based classifiers can achieve excellent performance with only a few content samples per class, but when checking whether a given generated content sample (e.g., an image) was generated by a specific generative model, only a small number of samples generated by the generative model can be obtained. Therefore, standard CLIP-based classifiers cannot be directly used to solve few-shot one-class classification tasks. Summary of the Invention

[0016] The method for determining the source of generated content provided by this invention can accurately identify which model generated the sample, and can be trained with a small number of target category samples generated by the generating model.

[0017] This invention provides a method for determining the source of generated content, including:

[0018] (1) Collect a non-target category sample set from an open-source dataset, generate a target category sample set based on the target generation model, and label the non-target category samples and the target category samples respectively;

[0019] (2) Construct a single-class classification CLIP model, which includes a target single-class classification CLIP unit and a non-target single-class classification CLIP unit. Both the target single-class classification CLIP unit and the non-target single-class classification CLIP unit include a CLIP model with fixed parameters and a learnable context vector.

[0020] (3) The target context vector is obtained by training the learnable context vector of the target single-class classification CLIP unit based on the target category sample through the cross-entropy loss function. The non-target context vector is obtained by training the learnable context vector of the non-target single-class classification CLIP unit based on the non-target category sample with added adversarial perturbation. The target source judgment model is constructed based on the target context vector, the non-target context vector and the CLIP model with fixed parameters.

[0021] (4) Input the sample of the category to be tested into the target source judgment model to obtain the target loss value and the non-target loss value. If the target loss value is greater than the non-target loss value, then the sample of the category to be tested comes from the target generation model.

[0022] Furthermore, based on the target category samples, the learnable context vector of the target single-class classification CLIP unit is obtained by training the learnable context vector of the target, including:

[0023] The learnable target prompt word is obtained by summing the target category and the learnable context vector corresponding to the target category sample set. The learnable target prompt word and the target category sample are then input into the CLIP model with fixed parameters to obtain the target prompt word features and the target sample features, respectively.

[0024] Based on the target prompt word features and target sample features, a first loss function is constructed using the cross-entropy loss function. The target context vector is obtained by training the learnable context vector of the target single-class classification CLIP unit based on the target category sample set using the first loss function.

[0025] Furthermore, the step of training the non-target learnable context vector of the non-target single-class classification CLIP unit based on non-target class samples with added adversarial perturbations to obtain the non-target context vector includes:

[0026] The non-target category and the learnable context vector corresponding to the non-target category sample set are summed to obtain the learnable non-target prompt word. The learnable non-target prompt word and the non-target category sample with added adversarial perturbation are input into the CLIP model with fixed parameters to obtain the non-target prompt word features and non-target sample features, respectively.

[0027] Based on the features of non-target prompt words and non-target samples, a second loss function is constructed using the cross-entropy loss function. The learnable context vector of the non-target uniclass classification CLIP unit is then trained using the second loss function based on the non-target category sample set to obtain the non-target context vector.

[0028] Furthermore, obtaining non-target class samples based on added adversarial perturbations includes: adding the adversarial perturbation obtained in the previous iteration to the non-target class samples to obtain the non-target class samples input in the current iteration.

[0029] Furthermore, in each iteration, the resulting adversarial perturbation δ v for:

[0030] δ v =∈·sign(G)

[0031] Where G is the gradient of the previous step calculated by the second loss function, ∈ is the step size, and sign(.) is the gradient direction, which is the direction of the largest rate of change of loss.

[0032] Furthermore, the CLIP model with fixed parameters includes a sample encoder and a text encoder:

[0033] Specifically, non-target category samples with added adversarial perturbations are input into the sample encoder to obtain non-target sample features, and non-target prompt words are input into the text encoder to obtain non-target prompt word features.

[0034] Input the target category sample into the sample encoder to obtain the target sample feature, and input the target prompt word into the text encoder to obtain the target prompt word feature.

[0035] Furthermore, the target category sample is input into the target source determination model to obtain the target loss value, including:

[0036] Input the sample of the category to be tested into the sample encoder to obtain the features of the sample of the category to be tested;

[0037] The target context vector and the target category sample set corresponding to the target category are used to construct the prompt words, which are then input into the text encoder to obtain the target prompt word features;

[0038] The target loss value is obtained by inputting the features of the sample samples of the category to be tested and the features of the target prompt words into the cross loss function.

[0039] Furthermore, the non-target loss value is obtained by inputting the sample of the category to be tested into the target source determination model, including:

[0040] Input the sample of the category to be tested into the sample encoder to obtain the features of the sample of the category to be tested;

[0041] Input the non-target context vector and the non-target category corresponding to the non-target category sample set into the text encoder to obtain the non-target cue word features;

[0042] Input the features of the test category samples and the features of the non-target prompt words into the cross-loss function to obtain the non-target loss value.

[0043] The present invention also provides a content source determination device, including a memory and one or more processors, wherein the memory stores executable code, and the one or more processors execute the executable code to implement the content source determination method.

[0044] The present invention also provides a computer-readable storage medium having a program stored thereon, which, when executed by a processor, implements the method for determining the source of generated content.

[0045] Compared with the prior art, the beneficial effects of the present invention are as follows:

[0046] This invention trains a target context vector from a target category sample set generated by a generative model and trains a non-target context vector from a randomly obtained non-target category sample set. The text features of the test sample are compared with the prompt word features of the target context vector and the prompt word features of the non-target context vector. If the text features are close to the prompt word features of the target context vector, it proves that the test sample originates from the generative model. This invention proposes a method for accurately identifying the source for the first time using the above process.

[0047] This invention improves detection performance by changing the way adversarial perturbations are acquired for non-target samples during adversarial data augmentation, or by changing the way adversarial perturbations are added to non-target category samples. Attached Figure Description

[0048] Figure 1 A flowchart of the content source determination method provided in a specific embodiment of the present invention;

[0049] Figure 2 A flowchart of the CLIP unit for training a single-class classification target is provided for a specific embodiment of the present invention;

[0050] Figure 3 The flowchart for training non-target single-class classification CLIP units is provided for a specific embodiment of the present invention. Detailed Implementation

[0051] The present invention will be further described in detail below with reference to the embodiments and accompanying drawings. It should be noted that the embodiments described below are intended to facilitate the understanding of the present invention and do not limit it in any way.

[0052] A specific embodiment of the present invention provides a method for determining the source of generated content, such as... Figure 1 As shown, it includes:

[0053] (1) Obtaining sample sets from generative models and open-source datasets: Since the model provided in the specific embodiments of the present invention must have the ability to identify the source of the sample to be tested and the specific generative model, the sample set provided by the present invention includes a small number of target category sample sets generated by the generative model. The target category sample sets include images, text or voice, etc. The sample set provided in the specific embodiments of the present invention also includes non-target category sample sets, which are sourced from open-source datasets.

[0054] In one specific embodiment, the target category sample set is normalized based on the pre-trained dataset used to train the generative model, so that the target category samples in the target category sample set are samples of the same standard, in preparation for subsequent model training.

[0055] (2) Constructing a single-class classification CLIP model OCC-CLIP (CLIP-based framework for One-Class Classification): This single-class classification CLIP model includes target single-class classification CLIP units and non-target single-class classification CLIP units. Both target and non-target single-class classification CLIP units include a CLIP model with fixed parameters and a learnable context vector. The target and non-target single-class classification CLIP units provided in the specific embodiments of this invention have the same structure, only the training data is different, so the structure is relatively simple.

[0056] (3) Train the target single-class classification CLIP unit and the non-target single-class classification CLIP unit to obtain the target context vector and the non-target context vector. The specific training process is as follows.

[0057] like Figure 2 As shown, the target context vector is obtained by training the learnable context vector of the target single-class classification CLIP unit based on the target class samples using the cross-entropy loss function, including:

[0058] In a specific embodiment of the present invention, the target category corresponding to the target category sample set and the learnable context vector are summed to obtain the learnable target prompt word. The learnable target prompt word is input into the text encoder of the CLIP model with fixed parameters to obtain the target prompt word feature, and the target category sample set is input into the sample encoder of the CLIP model with fixed parameters to obtain the target sample feature.

[0059] In a specific embodiment of the present invention, a first loss function is constructed based on the target prompt word features and target sample features using the cross-entropy loss function. The target context vector is obtained by training the learnable context vector of the single-class classification CLIP model based on the target category sample set using the first loss function.

[0060] like Figure 3 As shown, the non-target learnable context vector is obtained by training the non-target single-class classification CLIP unit based on non-target class samples with added adversarial perturbations, including:

[0061] In a specific embodiment of the present invention, the non-target category corresponding to the non-target category sample set and the learnable context vector are summed to obtain the learnable non-target prompt word. The learnable non-target prompt word and the CLIP model with fixed input parameters for non-target category samples with added adversarial perturbation are used to obtain the non-target prompt word features and non-target sample features, respectively.

[0062] In a specific embodiment of the present invention, a second loss function is constructed based on the features of non-target prompt words and non-target samples through the cross-entropy loss function. The learnable context vector of the non-target single-class classification CLIP unit is then trained based on the non-target category sample set using the second loss function to obtain the non-target context vector.

[0063] In one specific embodiment, obtaining non-target class samples based on added adversarial perturbations includes: adding the adversarial perturbations obtained in the previous iteration element by element to the non-target class samples to obtain the non-target class samples input in the current iteration, and optimizing the learnable context vector of the non-target single-class classification CLIP unit based on the non-target class samples input in the previous iteration.

[0064] In each iteration, the resulting adversarial perturbation δ v for:

[0065] δ v =∈·sign(G)

[0066] Here, G is the gradient of the previous step calculated using the second loss function, ∈ is the step size, and sign(.) is the gradient direction, which is the direction of the largest rate of change of loss. Adding the adversarial perturbation obtained here to non-target class samples broadens the spatial distribution of these samples, thus making the distribution boundary between non-target and target samples clearer and more accurate. This effectively improves the detection accuracy of the framework for the test samples.

[0067] In specific embodiments of the present invention, a target source determination model is constructed based on the target context vector, the non-target context vector, and the CLIP model with fixed parameters.

[0068] (4) Identifying the source of the test category sample based on the target source judgment model: Input the test category sample into the target source judgment model to obtain the target loss value and the non-target loss value. If the target loss value is greater than the non-target loss value, the test category sample originates from the target generation model. By comparing the target loss value and the non-target loss value, it is determined whether the test sample is closer to the target category sample or the non-target category sample. If it is determined that the test category sample is closer to the target category sample, the test category sample originates from the target generation model.

[0069] In one specific embodiment, the target loss value is obtained by inputting the sample of the category to be tested into the target source determination model, including:

[0070] The test category samples are input into the sample encoder to obtain the test category sample features; the non-target context vectors and the prompt words constructed from the non-target categories corresponding to the non-target category sample sets are input into the text encoder to obtain the non-target prompt word features; the test category sample features and non-target prompt word features are input into the cross-loss function to obtain the non-target loss value. This embodiment is based on the test category sample features and non-target prompt word features to accurately determine the closeness between the test category samples and non-target samples.

[0071] In one specific embodiment, inputting the sample of the category to be tested into the target source determination model to obtain the non-target loss value includes:

[0072] The test category sample is input into the sample encoder to obtain the test category sample features; the target context vector and the target category corresponding to the target category sample set are used to construct the prompt words, which are then input into the text encoder to obtain the target prompt word features; the test category sample features and the target prompt word features are input into the cross-loss function to obtain the target loss value. This embodiment is based on the test category sample features and the target prompt word features, which can accurately use this method to determine the similarity between the test category sample and the target category sample generated by the generative model.

[0073] A specific embodiment of the present invention also provides a content source determination device, including a memory and one or more processors. The memory stores executable code, and when the one or more processors execute the executable code, they are used to implement the content source determination method.

[0074] A specific embodiment of the present invention also provides a computer-readable storage medium, characterized in that it stores a program thereon, which, when executed by a processor, implements the method for determining the source of generated content.

[0075] Example 1

[0076] To address the issue of source model authentication for generated content, this invention proposes a CLIP-based single-class classification framework called OCC-CLIP (CLIP-based framework for One-Class Classification). This technical solution can be divided into two parts: an optimization process and a verification process.

[0077] 1. Optimization process: OCC-CLIP optimizes the learnable prompt words.

[0078] Step 1: Data Acquisition and Preprocessing. First, a small set of generated content samples (images, text, speech, etc.) generated from a generative model is called the target category sample set; content samples randomly collected from a clean dataset are called the non-target category sample set. All generated content samples will be normalized based on the pre-training dataset of the generative model.

[0079] Step 2: Model Parameter Setting. The learnable context vectors are initialized by random sampling from a normal distribution with a mean of 0 and a standard deviation of 0.02. In OCC-CLIP, 16 learnable context vectors {v1, v2, ..., v...} are used. 16 The code concatenates the target category and the category name (i.e., target or non-target category) to form the cue word learner. The sample encoder (for encoding images, text, and speech samples) and the text encoder (for encoding learnable cue words) directly adopt the open-source CLIP framework, fixing all pre-training parameters. For image samples, the encoder uses the ViT-B / 16 architecture. The model uses stochastic gradient descent as the optimization strategy, with a learning rate of 0.0001, adjusted using cosine annealing. The loss function is cross-entropy loss. By default, the training iterations are capped at 200. To counteract the explosive gradients in the early stages of optimization, the learning rate is maintained at 1×10⁻⁶ in the first epoch. -5 By default, only half of the non-target category samples use ADA enhancement.

[0080] Step 3: After optimization begins, target class samples and non-target class samples are labeled as arbitrary contrast pairs, such as true and false or positive and negative. Two learnable cue words corresponding to the target and non-target classes are optimized on these samples respectively. Since non-target class samples are randomly drawn from open-source datasets (such as ImageNet), they do not represent the overall distribution of non-target class samples well. To overcome this challenge, an adversarial data augmentation (ADA) technique is proposed during training to cover more of the non-target class sample distribution space. The goal of ADA is to add a small perturbation δ to the non-target samples. v To maximize the loss, the learnable cue words aim to minimize the loss by learning the boundary between target and non-target samples. In summary, the optimization process of OCC-CLIP can be described as follows:

[0081]

[0082] Among them, let Representing images, it can learn the cue word X. pN is the number of images, and K is the number of categories. For the prompt word of the i-th category, δ v The adversarial example perturbations are computed online by ADA during training, and the image encoder E... v (·) and text encoder E t (·)

[0083] The OCC-CLIP implementation process is shown in Algorithm 1. As shown in the algorithm, in each iteration, non-target class samples X are obtained through one forward pass and one backward pass. v The gradient information G is then used to calculate the anti-perturbation δ. v δ v After being added to non-target class samples, perturbed sample X is obtained. v +δ v In the case of perturbation sample X v +δ v In another forward and backward pass, the learnable cue word X will be updated. p Through the optimization process, the optimized learnable cue word X can ultimately be obtained. p .

[0084] The OCC-CLIP framework provided in the specific embodiments of the present invention is as follows:

[0085] The input to the OCC-CLIP framework is: χ t : Target sample set, χ nt : Non-target sample set, X p Learnable prompt words, Truth value, α: update step size

[0086] In each iteration, perform the following steps:

[0087] 1. Calculate the sample embedding E v (X v ) and text embedding E t (X p );

[0088] 2. Calculate the gradient of the sample:

[0089] 3. Obtain adversarial perturbations from non-target samples: δ v =∈·sign(G); (where sign(G) represents the gradient direction, i.e., the direction in which the loss rate of change is greatest; ∈ represents the step size. Adding the adversarial perturbation obtained here to non-target class samples allows for a wider spatial distribution coverage of non-target class samples, thus making the distribution boundary between non-target and target samples clearer and more accurate. This technique effectively improves the detection accuracy of the framework for the test samples.)

[0090] 4. Calculate the new sample embedding E v (X v +δ v );

[0091] 5. Optimize suggestion words based on the new loss:

[0092] The input text is represented by learnable context vectors. Input samples have two discrete categories: the target category corresponds to the content samples generated from the generative model, and the non-target category corresponds to randomly selected open-domain samples. These categories can be labeled as contrastive sample pairs, such as true and false or positive and negative. Taking image samples as an example: the parameters of the text encoder and image sample encoder are derived from the CLIP model and remain invariant during optimization; adversarial data augmentation (ADA) computes the gradient for each pixel in the non-target image; during the training phase, these gradients δ... v It will be applied to non-target image samples.

[0093] Validation process: Input a sample of generated content to be detected into the trained OCC-CLIP. If the sample is classified into the target category, it will be determined that the sample was generated by the same generative model as the source model of the target category sample set during optimization.

[0094] Compared with existing AIGC detection methods, this invention can detect whether a given content sample contains artificial artifacts generated by the model, even with only a small number of content samples (images, text, speech, etc.) generated by the generative model.

[0095] Using image samples as an example, the AUC (area under the ROC curve) of this invention is higher than that of the methods mentioned above compared to CLIP and CoOp without samples. To reduce randomness, each model is trained 10 times, each time using a different training set. Then, the mean AUC and corresponding standard deviation of the same test set are reported. A higher AUC score indicates better performance. The detection capabilities of OCC-CLIP compared to CLIP and CoOp are evaluated in the table below. Training samples are from SD (target sample class) and COCO (non-target sample class). Test data consists of a combination of the SD dataset and different generated image datasets. The best results for each dataset are marked in bold.

[0096]

[0097]

[0098] The dataset setup mentioned in the table above describes the following: Based on the validation set of the Microsoft Common Objects in Context (COCO) 2014 dataset, a total of 202,520 fake images were generated using five different generative models: Stable Diffusion Model, Latent Diffusion Model, GLIDE, Vector Quantized Diffusion, and GALIP. These models were pre-trained on four different datasets: LAION-5B, COCO, LAION-400M, and filtered CC12M. A total of five synthetic image datasets were generated: SD, VQ-D, LDM, Glide, and GALIP. To balance the number of image datasets generated by diffusion models and GANs, existing datasets (i.e., GauGAN, ProGAN, and StyleGan2) were utilized, as provided in the paper Sheng-Yu Wang, Oliver Wang, Richard Zhang, Andrew Owens, and Alexei A Efros. CNN-generated images are surprisingly easy to spot...for now. In Proceedings of the IEEE / CVF conference on computer vision and pattern recognition, pages 8695–8704, 2020. These datasets are robust benchmarks covering the two main generative techniques: GANs and diffusion models.

Claims

1. A method for determining the source of generated content, characterized in that, include: (1) Collect non-target category sample sets from open-source datasets, generate target category sample sets based on target generation models, and label the non-target category samples and target category samples respectively; (2) Construct a single-class classification CLIP model, wherein the single-class classification CLIP model includes a target single-class classification CLIP unit and a non-target single-class classification CLIP unit. Both the target single-class classification CLIP unit and the non-target single-class classification CLIP unit include a CLIP model with fixed parameters and a learnable context vector. (3) The target context vector is obtained by training the learnable context vector of the target single-class classification CLIP unit based on the target category sample through the cross-entropy loss function. The non-target context vector is obtained by training the learnable context vector of the non-target single-class classification CLIP unit based on the non-target category sample with added adversarial perturbation. The target source judgment model is constructed based on the target context vector, the non-target context vector and the CLIP model with fixed parameters. (4) Input the sample of the category to be tested into the target source judgment model to obtain the target loss value and the non-target loss value. If the target loss value is greater than the non-target loss value, then the sample of the category to be tested comes from the target generation model. The learnable context vector of the target class is obtained by training the learnable context vector of the CLIP unit of the target class classification based on the target class samples using the cross-entropy loss function. This includes: The learnable target prompt word is obtained by summing the target category and the learnable context vector corresponding to the target category sample set. The learnable target prompt word and the target category sample are then input into the CLIP model with fixed parameters to obtain the target prompt word features and the target sample features, respectively. Based on the target prompt word features and target sample features, a first loss function is constructed using the cross-entropy loss function. The target context vector is obtained by training the learnable context vector of the target single-class classification CLIP unit based on the target category sample set using the first loss function. The process of training non-target learnable context vectors for non-target single-class classification CLIP units based on non-target class samples with added adversarial perturbations to obtain non-target context vectors includes: The non-target category and the learnable context vector corresponding to the non-target category sample set are summed to obtain the learnable non-target prompt word. The learnable non-target prompt word and the non-target category sample with added adversarial perturbation are input into the CLIP model with fixed parameters to obtain the non-target prompt word features and non-target sample features, respectively. Based on the features of non-target prompt words and non-target samples, a second loss function is constructed using the cross-entropy loss function. The learnable context vector of the non-target uniclass classification CLIP unit is then trained using the second loss function based on the non-target category sample set to obtain the non-target context vector. Obtaining non-target class samples based on added adversarial perturbations includes: adding the adversarial perturbation obtained in the previous iteration to the non-target class samples to obtain the non-target class samples input in the current iteration.

2. The method for determining the source of generated content according to claim 1, characterized in that, At each iteration, the adversarial perturbation is obtained for: in, G The gradient from the previous step is calculated using the second loss function. Step size, The gradient direction is the direction in which the rate of change of loss is greatest.

3. The method for determining the source of generated content according to claim 1, characterized in that, The CLIP model with fixed parameters includes a sample encoder and a text encoder: Specifically, non-target category samples with added adversarial perturbations are input into the sample encoder to obtain non-target sample features, and non-target prompt words are input into the text encoder to obtain non-target prompt word features. Input the target category sample into the sample encoder to obtain the target sample feature, and input the target prompt word into the text encoder to obtain the target prompt word feature.

4. The method for determining the source of generated content according to claim 1, characterized in that, Input the sample of the category to be tested into the target source determination model to obtain the target loss value, including: Input the sample of the category to be tested into the sample encoder to obtain the features of the sample of the category to be tested; The target context vector and the target category sample set corresponding to the target category are used to construct the prompt words, which are then input into the text encoder to obtain the target prompt word features; The target loss value is obtained by inputting the features of the sample samples of the category to be tested and the features of the target prompt words into the cross loss function.

5. The method for determining the source of generated content according to claim 1, characterized in that, Inputting the sample of the category to be tested into the target source determination model yields non-target loss values, including: Input the sample of the category to be tested into the sample encoder to obtain the features of the sample of the category to be tested; Input the non-target context vector and the non-target category corresponding to the non-target category sample set into the text encoder to obtain the non-target cue word features; Input the features of the test category samples and the features of the non-target prompt words into the cross-loss function to obtain the non-target loss value.

6. A device for determining the source of generated content, characterized in that, The device includes a memory and one or more processors, wherein the memory stores executable code, and the one or more processors execute the executable code to implement the content source determination method according to any one of claims 1-5.

7. A computer-readable storage medium, characterized in that, It stores a program that, when executed by a processor, implements the content source determination method as described in any one of claims 1-5.

Images