A method for verifying ownership of a knowledge graph in an enhanced language model
Patent Information
- Application Number
- CN202311803323.X
- Authority / Receiving Office
- CN · China
- Patent Type
- Patents(China)
- Current Assignee / Owner
- Filing Date
- 2023-12-26
- Publication Date
- 2026-09-15
- Estimated Expiration
- 2043-12-26
AI Technical Summary
[0030] After obtaining the distillation spectrum, watermark verification can be completed simply by verifying the frequency of the embedded watermark subgraph structure appearing within it and checking if it exceeds a set threshold. (Appendix) Figure 3 The complete watermark verification process was demonstrated.
Smart Images
Figure CN117932570B_ABST
Abstract
Description
Technical Field
[0001] This invention belongs to the fields of software technology and information security technology, and relates to security technology for artificial intelligence. Specifically, it relates to a method for verifying ownership of knowledge graphs in enhanced language models in a black-box scenario. Background Technology
[0002] Pre-trained language models (LMs), such as BERT, RoBERTa, XLNet, and GPT-4, have had a significant impact on natural language processing and machine learning. These models have demonstrated impressive performance across various applications, including those in different industries and educational fields. However, these traditional language models, trained solely on text corpora, also have limitations. One limitation is that irrelevant or noisy information in the training data can affect the model's learning of correct knowledge, thus weakening its predictive ability. Another issue is that these general-purpose models often perform poorly in domain-specific tasks because their training corpora often lack domain-specific expertise. Transferring these models to these specialized domains requires collecting appropriate domain-specific corpora for fine-tuning. Furthermore, due to the static nature of training corpora, traditional language models struggle to dynamically update their knowledge base to adapt to the generation of new knowledge or changes in existing knowledge. To address these issues, researchers have proposed the concept of Augmented Language Models (ALMs). These models enhance or supplement specific capabilities or knowledge of a language model by integrating external knowledge sources or specialized modules, such as knowledge graphs (KGs), search engine results, symbol modules, or code interpreters. This significantly improves model performance in downstream tasks requiring specialized knowledge or real-time information. Among these, knowledge graphs, as a reliable and refined source of knowledge, are increasingly being explored in research for integration into the training and prediction processes of natural language models.
[0003] As a structured data storage architecture, knowledge graphs have demonstrated significant application value in various professional knowledge domains such as business, education, and medical science, and also play an indispensable role in tasks such as commonsense reasoning and content retrieval. However, building and maintaining such a large-scale knowledge base structure requires substantial professional knowledge and human resources. Therefore, knowledge graphs are potentially vulnerable to a new threat: theft attacks by malicious attackers. Specifically, attackers may use a black-box approach, accessing the target model only through an API, querying the target model using specific prompts, and obtaining the corresponding output to generate a substitute knowledge graph that performs identically to the original knowledge graph in a specific task domain, thereby threatening the intellectual property or economic interests of the original knowledge graph owner.
[0004] To address the issue of knowledge graph ownership protection, this invention proposes a novel watermarking scheme for verifying knowledge graph ownership in enhanced language models under a black-box environment. This technique first generates a specific watermark, then embeds it into the knowledge graph. This knowledge graph will be further used to enhance the language model. Finally, in a black-box environment where access to the model API is limited to prompts, the distilled graph can be obtained, and the embedded watermark can be extracted to verify the model's ownership. This watermarking technique is efficient, accurate, and robust, showing promising application prospects in the intellectual property protection of knowledge graphs and enhanced language models. Summary of the Invention
[0005] This invention aims to propose a method for verifying ownership of knowledge graphs in augmented language models. This invention can achieve accurate and efficient watermark verification using only black-box access in knowledge graph augmented language model scenarios with different augmentation methods, thereby verifying the ownership of the model.
[0006] The technical solution adopted in this invention is as follows:
[0007] A method for verifying ownership of knowledge graphs in enhanced language models, comprising the following steps:
[0008] 1) For a set of knowledge graphs to be protected, watermarking is embedded into each knowledge graph of the set of knowledge graphs, and the selected watermarked subgraph is embedded into each knowledge graph of the set of knowledge graphs.
[0009] 2) For a model to be validated, perform knowledge graph distillation on the model to obtain the distillation graph:
[0010] 3) Extract the watermark sub-graph from the distillation graph. Based on the frequency of the extracted watermark sub-graph appearing in the distillation graph, if the frequency is higher than a set threshold, it is determined that the model to be verified uses the knowledge graph set to be protected.
[0011] According to the method described in claim 1, the method for obtaining the distillation spectrum of the model to be verified is as follows:
[0012] 21) Based on the entity list corresponding to the watermark subgraph, construct several prompt words for each entity in the entity list and input them into the model to be verified for querying, and output the confidence of multiple candidate entities; if the confidence of a candidate entity is higher than a preset threshold, add the corresponding candidate entity to the distillation graph and add the corresponding candidate entity to the distillation query entity list.
[0013] 22) Construct several prompt words based on the entities in the distillation query entity list and input them into the model to be verified for querying, and output the confidence scores of several candidate entities; if the confidence score of a candidate entity is higher than a preset threshold, add the corresponding candidate entity to the distillation graph and add the corresponding candidate entity to the distillation query entity list.
[0014] 23) Iterate through step 22) until the set termination condition is met, and prune the distillation spectrum obtained in the last iteration to obtain the distillation spectrum of the model to be verified.
[0015] Further, in step 22), for entities in the distillation query entity list, if there is only a connection relationship between two entities, then the corresponding two entities are defined as coarse-grained relation entities; if there is both a connection relationship and a relation type between the two entities, then the corresponding two entities are defined as fine-grained relation entities; firstly, two entities are randomly selected as prompts with a coarse-grained relationship and input into the model to be verified for querying, and the confidence of each candidate entity is output. If the candidate entity (e i e j If the confidence level of a candidate entity (e) exceeds a preset fine-grained query threshold, then the candidate entity (e) will be considered. i e j Add relation type r between ) i The input of the model to be verified is used as a prompt for querying fine-grained relationships. If the output is entities and relationships (e... i r i e j If the confidence level of ) is higher than a preset threshold, then the corresponding entity (e) will be... i e j Add it to the distillation chromatogram and set (e) i e j The type of the edge between ) is r i and the corresponding entity (e) i e j Add to the distillation query entity list; stop iterating when no new entities are added to the distillation query entity list or the number of iterations exceeds the maximum value.
[0016] Furthermore, a relation-based pruning algorithm is used to prune the distillation spectrum obtained in the last iteration, thus obtaining the distillation spectrum of the model to be verified.
[0017] Furthermore, the method for pruning the distillation spectrum obtained in the final iteration is as follows: a loop detection method based on breadth-first search identifies and processes two types of relationships:
[0018] The first type is nested relationships, and the corresponding processing method is: for nestable relationships that share the same starting point, only a fixed number of edges are retained.
[0019] The second type is the symmetric relation type, and the corresponding processing method is to retain the edge with the highest confidence.
[0020] Furthermore, the method for watermarking each knowledge graph in the knowledge graph set is as follows: select several entity nodes from the knowledge graph with a set probability for poisoning, that is, attach a watermarked subgraph to the selected entity nodes to achieve watermark embedding.
[0021] Furthermore, the watermarked sub-image is a sub-image segment of an entity-relationship paradigm.
[0022] A server is characterized by comprising a memory and a processor, the memory storing a computer program configured to be executed by the processor, the computer program including instructions for performing the steps of the methods described above.
[0023] A computer-readable storage medium having a computer program stored thereon, characterized in that the computer program, when executed by a processor, implements the steps of the above-described method.
[0024] This invention mainly includes the following steps:
[0025] For a set of knowledge graphs to be protected, for each knowledge graph in the set, a number of entity nodes are selected with a set probability for poisoning. The poisoning method is to randomly select a certain proportion of entity nodes in each knowledge graph and attach a sub-image segment of a specific small-scale watermark entity-relation paradigm held by all owners to realize watermark generation and embedding. Each entity node attaches the same sub-image segment of the entity-relation paradigm.
[0026] For suspicious models that utilize knowledge graph augmentation methods, we employ the following method to perform knowledge graph distillation and obtain the distilled graph:
[0027] (i) Entity Selection: We use a list of entities with watermarked sub-image segments as the starting point for graph distillation extraction, querying each entity within the list. In subsequent queries, we construct a suggestion input suspicion model using the vocabulary of the entity to be queried. Based on the confidence level of the model's output, if the confidence level of the corresponding entity information is higher than a preset threshold, we can add that entity to the distillation graph. Accordingly, we dynamically update the entity list for distillation queries during iteration. The model output consists of statements with subjects and objects, which may have multiple candidates (e.g., A belongs to B, A belongs to C, A belongs to D). Each output statement has a confidence level; relation edges can be extracted based on statements with confidence levels higher than the threshold.
[0028] (ii) Query distillation: We employ a multi-granularity approach to construct different model input prompts to strike a balance between computational efficiency and effectiveness. Based on the model output, we identify and select entities highly relevant to the query, reconstruct relation edges, and use the query entities for subsequent prompt construction.
[0029] (iii) Knowledge Graph Pruning: To avoid the impact of language model noise on the effectiveness of the extracted distillation graph, we optimize it to eliminate redundant or noisy information, thereby improving the accuracy and reliability of subsequent watermark detection. Given that loop structures in the knowledge graph are a significant source of noise and error, we focus on the relation types that generate loops and design a relation-type-based distillation graph pruning algorithm.
[0030] After obtaining the distillation spectrum, watermark verification can be completed simply by verifying the frequency of the embedded watermark subgraph structure appearing within it and checking if it exceeds a set threshold. (Appendix) Figure 3 The complete watermark verification process was demonstrated.
[0031] Compared with the prior art, the positive effects of the present invention are as follows:
[0032] The application scenario of this invention is knowledge graph-enhanced language models (such as GreaseLM, KEPLER, KnowBERT, and QA-GNN), which can verify watermarks in black-box scenarios and still guarantee the concealment and robustness of watermarks in different knowledge graph utilization methods. Attached Figure Description
[0033] Figure 1 This is a schematic diagram of watermark generation and embedding.
[0034] Figure 2 This is a flowchart of the watermark extraction process.
[0035] Figure 3 This is a flowchart of the watermark verification process. Detailed Implementation
[0036] To make the above-mentioned objectives, features and advantages of the present invention more apparent and understandable, this section will describe the implementation of the method from three aspects: watermark generation and embedding, watermark extraction and watermark verification.
[0037] 1. Technical approach of the present invention:
[0038] 1.1. Watermark Generation and Embedding: A certain proportion of entity nodes in the knowledge graph are randomly selected and attached with sub-image segments of a specific small-scale watermark entity-relationship paradigm held by all owners. These segments are then allowed to participate normally in subsequent knowledge graph enhancement, thus completing the watermark embedding.
[0039] 1.2. Watermark Extraction: We use a set of entity nodes with embedded watermarks as the initial distillation nodes, categorizing relation types into coarse-grained and fine-grained relations indicating relation existence and specific relation types. Based on the different capabilities of the suspected model (e.g., question-answering or selection models), we combine input entities and relations into corresponding input prompts. First, we use coarse-grained relations to query for relation existence; if it exists, we perform further fine-grained relation queries. Based on the suspected model's output entity and output confidence, if the confidence is higher than a set threshold, we determine that the input entity and the original knowledge graph are highly correlated. We can directly construct distillation relation edges from the input entity-relation-output entity and add the output entity to the query entity list as a focus entity for subsequent prompt construction. Simultaneously, entities that have already been queried are removed from the entity list. After multiple iterations, we obtain the distillation graph. Finally, we optimize the obtained graph using a relation type-based pruning algorithm to obtain the final distillation graph.
[0040] 1.3. Watermark Verification: After obtaining the distillation spectrum, watermark verification can be completed by verifying the frequency of the embedded watermark subgraph structure appearing in it and whether it is higher than the set threshold.
[0041] 2. As described in 1.1, watermark generation and embedding includes the following steps:
[0042] 2.1. Knowledge Graph Poisoning: Randomly select certain entity nodes in the knowledge graph, attach a sub-image segment of a specific entity-relationship paradigm as a watermark, and allow it to participate normally in subsequent knowledge graph enhancement.
[0043] 3. As described in 1.2, watermark extraction includes the following steps:
[0044] 3.1. Entity Selection: We use a set of entity nodes with embedded watermarks as the initial distillation nodes. In subsequent rounds, we distinguish between knowledge from the knowledge graph and knowledge from the language model based on the confidence level of the model output. We analyze the confidence distribution of the model output and manually check the semantic logic of each corresponding prompt word, selecting a confidence threshold for each model to ensure that 90% of the prompt words above the threshold have understandable semantic logic. Therefore, based on the confidence level, we iteratively select the entities of interest for the next round of prompt word construction.
[0045] 3.2. Distillation Query: From a query strategy perspective, we categorize relation types into two types based on their concepts: one is abstract relations, which do not indicate a specific type but only represent the existence of a relationship between two entities; we define these as coarse-grained relations (e.g., RelatedTo and About); the other describes the specific relationship type between entities; we define these as fine-grained relations (e.g., IsA and UsedFor). For entities of interest, we first use hints that construct coarse-grained relations to perform the query, and only further query for fine-grained relations when the output confidence exceeds the defined fine-grained query threshold.
[0046] From the perspective of specific attack scenarios, based on the capabilities of different language models, we focus on two relational paradigms: In the first scenario, the user inputs known entities and relations, and the language model then provides confidence scores for these specific entity relations without introducing new entity data. In the second scenario, the language model subsequently outputs relevant new entities and supplementary data.
[0047] In the first scenario, our goal is to reconstruct the relationships between known entities. We select entities to create prompts that conform to the task's format, as shown below:
[0048] Prompt words:
[0049] Among them, e i It is an entity-focused entity, e j (j∈1,2,…,N) are candidate entities in the current query entity list, r i `RelatedTo` is a query relation (using `RelatedTo` as an example), and `N` is the number of candidate entities, determined by the access permissions of the original language model. Based on the model's output confidence, we select relation entities exceeding a preset threshold for inclusion in the distillation graph, add the tail entities in these relation statements to the next round of distillation query entity list, and remove them from the unchecked watermarked subgraph entity list.
[0050] For the second scenario, we use a masked entity recognition task to use the query entity as a cue for the predicted [MASK] content for model querying, as shown below:
[0051] Prompt words:
[0052] Among them, e i It is an entity-focused entity, r i It is a concern relationship (using BelongsTo as an example here). Based on the model's output confidence, we select relation statements that exceed the threshold and include them in the distillation graph. We add the tail entities in these statements to the distillation query entity list for the next round and remove them from the unchecked watermarked subgraph entity list.
[0053] Through multiple iterations, when no new entities are added to the distillation query entity list table, or when the number of iterations exceeds the maximum value, we finally obtain the corresponding distillation map.
[0054] 3.2. Graph Pruning: We employ a pruning method based on the type of graph. Specifically, we apply a breadth-first search-based loop detection method to identify and process two types of relationships that may form a large number of small loops: one type includes nested relationships, where we retain only a fixed number of edges for nestable relationships sharing the same starting point; the other type includes symmetric relationships, where we retain the edges with the highest confidence, thereby optimizing the structure of the distillation graph and reducing the impact of noise on watermark verification.
[0055] 4. As described in 1.3, watermark verification includes the following steps:
[0056] 4.1. Watermark Verification: After obtaining the distillation spectrum, watermark verification can be completed by verifying the frequency of the embedded watermark subgraph structure appearing in it and whether it is higher than the set threshold.
[0057] The specific embodiments of the present invention disclosed above are intended to help understand the content of the present invention and to implement it accordingly. Those skilled in the art will understand that various substitutions, changes, and modifications are possible without departing from the spirit and scope of the present invention. The present invention should not be limited to the content disclosed in the embodiments of this specification; the scope of protection of the present invention is defined by the claims.
Claims
1. A method for verifying ownership of knowledge graphs in enhanced language models, comprising the following steps: 1) For a set of knowledge graphs to be protected, watermark embedding is performed on each knowledge graph of the set of knowledge graphs, and the selected watermark subgraph is embedded into each knowledge graph of the set of knowledge graphs; 2) For a model to be verified, knowledge graph distillation is performed on the model to be verified to obtain a distillation graph. The method for obtaining the distillation graph of the model to be verified is as follows: 21) Based on the entity list corresponding to the watermark subgraph, several prompt words are constructed for each entity in the entity list and input into the model to be verified for querying, and the confidence scores of multiple candidate entities are output. If the confidence score of a candidate entity is higher than a preset threshold, the corresponding candidate entity is added to the distillation graph and the corresponding candidate entity is added to the distillation query entity list. 22) Based on the entities in the distillation query entity list, several prompt words are constructed and input into the model to be verified for querying, and the confidence scores of several candidate entities are output. If the confidence score of a candidate entity is higher than a preset threshold, the corresponding candidate entity is added to the distillation graph and the corresponding candidate entity is added to the distillation query entity list. 23) Iterate through step 22) until the set termination condition is met, and prune the distillation plot obtained in the last iteration to obtain the distillation plot of the model to be verified; wherein, in step 22), for entities in the distillation query entity list, if there is only a connection relationship between two entities, the corresponding two entities are defined as coarse-grained relation entities; if there is a connection relationship and a relation type between two entities, the corresponding two entities are defined as fine-grained relation entities; first, randomly select two entities as prompts with a coarse-grained relationship and input them into the model to be verified for querying, output the confidence of each candidate entity, if the candidate entity ( , If the confidence level of a candidate entity exceeds a preset fine-grained query threshold, then the candidate entity ( , Add relationship types between ) The input keywords are used as prompts for querying fine-grained relationships in the model to be verified. If the output includes entities and relationships ( , , If the confidence level of ) is higher than a preset threshold, then the corresponding entity ( , Add it to the distillation chromatogram and set ( , The type of the edges between them is and the corresponding entity ( , Add to the distillation query entity list; stop iterating after multiple iterations when no new entities are added to the distillation query entity list, or when the number of iterations exceeds the maximum value; 3) Extract the watermark sub-graph from the distillation graph. Based on the frequency of the extracted watermark sub-graph appearing in the distillation graph, if the frequency is higher than a set threshold, it is determined that the model to be verified uses the knowledge graph set to be protected.
2. The method according to claim 1, characterized in that, A relation-based pruning algorithm was used to prune the distillation spectrum obtained in the last iteration, thus obtaining the distillation spectrum of the model to be verified.
3. The method according to claim 2, characterized in that, The method for pruning the distillation spectrum obtained in the final iteration is as follows: a loop detection method based on breadth-first search identifies and processes two types of relationships: The first type is nested relationships, and the corresponding processing method is: for nestable relationships that share the same starting point, only a fixed number of edges are retained. The second type is the symmetric relation type, and the corresponding processing method is to retain the edge with the highest confidence.
4. The method according to claim 1, characterized in that, The method for watermarking each knowledge graph in the knowledge graph set is as follows: select several entity nodes from the knowledge graph with a set probability for watermarking, that is, attach a watermarked subgraph to the selected entity nodes to achieve watermark embedding.
5. The method according to claim 4, characterized in that, The watermarked sub-image is a sub-image segment of an entity-relationship paradigm.
6. A server, characterized in that, It includes a memory and a processor, the memory storing a computer program configured to be executed by the processor, the computer program including instructions for performing each step of the method of any one of claims 1 to 5.
7. A computer-readable storage medium having a computer program stored thereon, characterized in that, When the computer program is executed by a processor, it implements the steps of the method according to any one of claims 1 to 5.