Big language model dual watermark embedding method

Abstract

The invention relates to a large language model double watermark embedding method, which comprises the following steps of: after generating the probability of each character according to an input cue word, circularly embedding a plurality of first characters by using a short watermark, and embedding a long watermark for a residual text to obtain a text embedded with double watermarks. According to the method, the robustness and the soundness of the watermarks are simultaneously ensured through double watermarks, the robustness of the watermarks is ensured through repeatedly embedded short watermarks, the soundness of the watermarks is ensured through long watermarks covering a full text, partial errors of the short watermarks are tolerated through editing distances, and partial errors of the long watermarks are corrected through error correction codes.

Description

Technical Field

[0001] The present invention relates to a technology in the field of information security, in particular to a large language model double watermark embedding method. Background Art

[0002] The security and privacy issues of large language models themselves, as well as the various security risks brought about by their abuse, have also caused people's concerns. Due to their excellent text reasoning, text generation and even code generation capabilities, large language models can also be easily used for malicious purposes, such as creating fake news. Considering that the text generated by large language models is very similar to the text written by humans, how to detect whether the generated text is generated by a large language model has always been a difficult problem. Summary of the invention

[0003] In view of the shortcomings of the prior art that a large amount of storage resources are required to store identification information, resulting in low applicability, poor robustness, and inability to detect partially tampered watermarks, the present invention proposes a large language model double watermark embedding method, which simultaneously ensures the robustness and soundness of the watermark through double watermarks, ensures the robustness of the watermark through repeatedly embedded short watermarks, ensures the soundness of the watermark through a long watermark covering the entire text, tolerates partial errors of the short watermark through the edit distance, and corrects partial errors of the long watermark through an error correction code.

[0004] The present invention is achieved through the following technical solutions:

[0005] The invention relates to a large language model dual watermark embedding method. After generating the probability of each character according to the input prompt word, a short watermark is used for cyclic embedding of the first several characters, and a long watermark is embedded once for the remaining text to obtain a text embedded with dual watermarks.

[0006] The present invention relates to a detection method based on the above embedding method, comprising:

[0007] Step 1: compare the difference between the short watermark embedded in the text and the original short watermark content paragraph by paragraph, and use the edit distance as a quantitative indicator. When the edit distance is lower than the preset threshold, it is determined that the text is generated by a large language model.

[0008] Step 2: extract the content of the long watermark according to its position, and call the error correction code decoding algorithm to restore the bits that may have changed to the correct version, and finally use the public key to verify the validity of the signature.

[0009] Step 3: Output the results of long watermark detection and short watermark detection.

[0010] The present invention relates to a watermark embedding system for implementing the above method, comprising: a short watermark generation module, a long watermark generation module, an inference character preference module and a selection module, wherein: the short watermark generation module performs hash calculation processing according to fixed initial vector information to obtain a hash value of fixed length; the long watermark generation module performs hash calculation and then signature according to previous characters and private key information, and then performs error correction code encoding processing to obtain the long watermark; the inference character preference module performs large language model inference according to previous character information to obtain the probability result of the next character; the selection module performs descending sorting processing according to the next character position, long watermark, short watermark and probability information of the next character to obtain the next character embedded with the watermark. Technical Effects

[0011] The present invention adds a double watermark to the large language model, so that even if part of it is tampered with, it can be efficiently detected. Even if most of the text written by the user is the same as the text generated by the large language model, it will not be considered to be generated by the large language model. While using the watermarking scheme to embed the text generated by the large language model to achieve the above two goals, it does not affect the output quality of the text. Compared with the prior art, the embedding process and detection process of the present invention significantly improve the robustness. BRIEF DESCRIPTION OF THE DRAWINGS

[0012] Figure 1 It is a flow chart of the present invention;

[0013] Figure 2 Flowchart of the algorithm for inferring character preference;

[0014] Figure 3 Schematic diagram of dual watermark embedding for large language models;

[0015] Figure 4 Generate a flow chart for short watermarks;

[0016] Figure 5 It is a short watermark detection flow chart;

[0017] Figure 6 It is a digital signature flow chart;

[0018] Figure 7 is the error correction code flow chart;

[0019] Figure 8 Generate a flow chart for long watermarks;

[0020] Fig. 9 This is a long watermark detection flow chart;

[0021] Fig.10 The following is a flow chart of an embodiment. DETAILED DESCRIPTION

[0022] like Figure 1 As shown, this embodiment involves a large language model dual watermark embedding method. After generating the probability of each character according to the input prompt word, the first nl characters are cyclically embedded using a short watermark, and the remaining l texts are embedded once with a long watermark to obtain a text embedded with a dual watermark, wherein: n is the number of characters of the text generated by the large language model, and l is generally the length of the bit string after the signature algorithm result is encoded using an error correction code.

[0023] The short watermark cyclic embedding includes:

[0024] Step 1: Determine the short watermark π to be cyclically embedded S When the length is zero, execute step 2 to regenerate the short watermark, otherwise execute step 3;

[0025] Step 2: Based on the preset initial vector IV, a fixed-length hash value, i.e., the short watermark π, is calculated using a secure hash function such as SHA-256 or MD5 algorithm. S ←H(IV), then proceed to step 3.

[0026] The preset initial vector IV is used to provide non-repetitiveness and randomness in the encryption process, and is preferably composed of a character string with fixed content.

[0027] Step 3: Add the short watermark π S The first bit b of is deleted, and the character preference is calculated based on the deleted bit b, and the character preference result is output and then returned to step 1.

[0028] The embedding of a long watermark includes:

[0029] Step a: Sign the hash values ​​of all characters t before the current character to obtain the signature σ←Sign(sk,H(t)), and then encode the signature σ to obtain the long watermark π L ←Encode(σ), where: sk is the signature private key sk generated when the large language model is initialized; the Encode function performs complex mathematical operations or algebraic structure transformations, and embeds additional check information in the original data according to specific error correction code standards (such as Reed-Solomon code, BCH code, LDPC code, etc.), forming a coded data stream with a certain fault tolerance capability.

[0030] The encoding is preferably an error correction code (ECC).

[0031] Step b: Determine the current length of the watermark π L When the length is zero, the embedding of a long watermark ends, otherwise, execute step c;

[0032] Step c: add the long watermark π LThe first bit b of is deleted, and the inference character preference is calculated based on the deleted bit b. After the character preference result is obtained and output, the process returns to step b.

[0033] like Figure 2 As shown, the inference character preference calculation specifically includes:

[0034] Step i: Randomly select 50% of the character set from the vocabulary of the large language model, that is, the collection of all words, tags and other language elements used to understand and generate text during training, and mark it as V0, and the remaining 50% of the character set as V1.

[0035] Step ii: Check the bit position of the current character to be embedded. When bit b is 0, add a fixed number τ to the last hidden layer output value of the character in character set V0; when bit b is 1, add a fixed number τ to the last hidden layer output value of the character in character set V1.

[0036] Step iii: Use the Softmax function to normalize the modified output of the last hidden layer to obtain a result in the form of probability, and then select the character output with the highest probability as the character preference result.

[0037] The hidden layer output refers to the intermediate calculation results generated by each layer of the large language model based on the prompt word input. The prompt word usually refers to the text used to start or guide the model to generate a specific type of output. The last hidden layer output refers to the hidden state generated by the last layer of the entire model. The output of this layer usually contains the information of all previous layers. It is the basis for the model to make the final decision (such as predicting the next word).

[0038] In general, the output of the last hidden layer can be simplified to a score table, that is, each character in the large language model vocabulary ( Figure 2 word i ) has a corresponding score ( Figure 2 score i ), in general, these hidden states can be directly used for downstream tasks, but in this scheme, they will be further processed, for example, when the bit is 0, for all characters in V0 work i , and their corresponding scores i Add a fixed value τ.

[0039] like Figure 5 and Fig. 9 As shown, this embodiment relates to a detection method based on the above embedding method, including:

[0040] Step 1, detect short watermarks: compare the differences between the watermark embedded in the text and the original short watermark content paragraph by paragraph, using the edit distance as a quantitative indicator. When the edit distance is lower than the preset threshold, it is determined that the text is generated by a large language model;

[0041] The segment-by-segment comparison uses the edit distance as a quantitative indicator, namely the Levenshtein distance, which measures the minimum number of single-character edits required to transform one string into another string through operations such as insertion, deletion, and substitution. When the calculated edit distance is lower than the preset threshold, it can be confirmed that the text is most likely generated by a large language model rather than being artificially original or significantly tampered with.

[0042] Step 2, detect the long watermark: extract the content of the long watermark according to its position, and call the error correction code decoding algorithm to restore the bits that may have changed to the correct version, and finally use the public key to verify the validity of the signature. When the signature is not generated by the large language model itself, it is impossible to pass the verification. When the signature is generated by the large language model, even if it has been added, deleted or tampered with to a certain extent, it can be restored to the original signature due to the existence of the error correction code algorithm, thus passing the authentication.

[0043] The signature means that when the large language model is used as the signer, the message m and the private key sk are used as input to obtain the signature σ←Sign(sk,m), where: m is the message content, sk is the signature private key, Sign is the signature algorithm, and σ is the signature result.

[0044] The verification uses the public key pk, message m' and signature σ' to obtain the verification result φ=Verify(pk,m',σ'), where: m' is the received message, σ' is the received signature, pk is the public key information disclosed by the signer, Verify is the signature verification algorithm, and φ is the verification result.

[0045] After specific actual experiments, in Ubuntu 20.04, NVIDIA T416GB environment settings, the above method is started with parameters n=1000, τ=2, and the experimental data obtained are: under the condition of error injection rate of 0, both long watermarks and short watermarks can be correctly detected; when 20% errors are injected into the generated text, there is a 95% probability that the short watermark can still be successfully detected; when 5 errors are injected into the text, there is a 100% probability that the long watermark can be successfully detected, but after injecting 15 errors, the probability that the long watermark can be detected is less than 5%.

[0046] Compared with the existing technology, this method ensures robustness through short watermarks, and can still detect when a large amount of text has been tampered with. The long watermark ensures soundness. In the face of a small amount of tampering, it can restore the correct watermark through the error correction code. For a large amount of tampering, it is considered to be generated by malicious persons and therefore cannot pass the inspection.

[0047] In summary, this method does not require a database as a storage medium. When the number of requests increases, there is no need for storage resources to save identification information. Only a small amount of calculation is required for signing and hashing operations, which effectively improves the generation speed. This method uses double watermarking to embed both short and long watermarks in the text to ensure the robustness and soundness of the watermark. Even if the text is tampered with by malicious people, the watermark can be detected normally.

[0048] The above-mentioned specific implementation can be partially adjusted in different ways by those skilled in the art without departing from the principle and purpose of the present invention. The protection scope of the present invention shall be based on the claims and shall not be limited by the above-mentioned specific implementation. Each implementation scheme within its scope shall be subject to the constraints of the present invention.

Claims

1. A large language model dual watermark embedding method, characterized in that: After generating the probability of each character according to the input prompt word, the short watermark is used to embed the first several characters cyclically, and the long watermark is embedded once for the remaining text to obtain the text embedded with double watermarks.

2. The large language model dual watermark embedding method according to claim 1 is characterized in that: The short watermark cyclic embedding includes: Step 1: Determine the short watermark π to be cyclically embedded S When the length is zero, execute step 2 to regenerate the short watermark, otherwise execute step 3; Step 2: Based on the preset initial vector IV, a fixed-length hash value, i.e., the short watermark π, is calculated using a secure hash function such as SHA-256 or MD5 algorithm. S ←H(IV), then execute step 3; Step 3: Add the short watermark π S The first bit b of is deleted, and the character preference is calculated based on the deleted bit b, and the character preference result is output and then returned to step 1.

3. The large language model dual watermark embedding method according to claim 1 is characterized in that: The embedding of a long watermark includes: Step a: Sign the hash values ​​of all characters t before the current character to obtain the signature σ←Sign(sk,H(t)), and then encode the signature σ to obtain the long watermark πL←Encode(σ), where: sk is the signature private key sk generated when the large language model is initialized; the Encode function performs complex mathematical operations or algebraic structure transformations, and embeds additional verification information in the original data according to a specific error correction code standard to form a coded data stream with a certain fault tolerance capability; Step b: Determine the current length of the watermark π L When the length is zero, the embedding of a long watermark ends, otherwise, execute step c; Step c: add the long watermark π L The first bit b of is deleted, and the inference character preference is calculated based on the deleted bit b. After the character preference result is obtained and output, the process returns to step b.

4. The large language model dual watermark embedding method according to claim 2 or 3, characterized in that: The inference character preference calculation specifically includes: Step i: Randomly select 50% of the character set from the vocabulary of the large language model, that is, the collection of all words, tags and other language elements used to understand and generate text during training, and mark it as V0, and the remaining 50% of the character set as V1; Step ii, check the bit position of the current character to be embedded, that is, when bit b is 0, add a fixed number τ to the last hidden layer output value of the character in character set V0; when bit b is 1, add a fixed number τ to the last hidden layer output value of the character in character set V1; Step iii: Use the Softmax function to normalize the modified output of the last hidden layer to obtain a result in the form of probability, and then select the character output with the highest probability as the character preference result.

5. A large language model dual watermark detection method based on any one of the methods described in claims 1-4, characterized in that: include: Step 1: compare the difference between the short watermark embedded in the text and the original short watermark content paragraph by paragraph, and use the edit distance as a quantitative indicator. When the edit distance is lower than the preset threshold, it is determined that the text is generated by a large language model; Step 2: extract the content of the long watermark according to its position, and call the error correction code decoding algorithm to restore the bits that may have changed to the correct version, and finally use the public key to verify the validity of the signature; Step 3: Output the results of long watermark detection and short watermark detection.

6. The large language model dual watermark detection method according to claim 5 is characterized in that: The paragraph-by-paragraph comparison uses the edit distance as a quantitative indicator, namely the Levenshtein distance, which measures the minimum number of single-character edits required to transform one string into another through operations such as insertion, deletion, and replacement. When the calculated edit distance is lower than a preset threshold, it can be confirmed that the text is most likely generated by a large language model rather than being artificially original or significantly tampered with.

7. The large language model dual watermark detection method according to claim 5 is characterized in that: The signature means that when the large language model is used as the signer, the message m and the private key sk are used as input to obtain the signature σ←Sign(sk,m), where: m is the message content, sk is the signature private key, Sign is the signature algorithm, and σ is the signature result.

8. The large language model dual watermark detection method according to claim 5 is characterized in that: The verification uses the public key pk, message m' and signature σ' to obtain the verification result φ=Verify(pk,m',σ'), where: m' is the received message, σ' is the received signature, pk is the public key information disclosed by the signer, Verify is the signature verification algorithm, and φ is the verification result.

9. A watermark embedding system for implementing the method according to any one of claims 1 to 8, comprising: A short watermark generation module, a long watermark generation module, an inference character preference module and a selection module, wherein: the short watermark generation module performs hash calculation processing according to fixed initial vector information to obtain a hash value of fixed length; the long watermark generation module performs hashing and then signing according to previous characters and private key information, and then performs error correction code encoding processing to obtain a long watermark; the inference character preference module performs large language model inference according to previous character information to obtain the probability result of the next character; the selection module performs descending sorting processing according to the next character position, long watermark, short watermark and the probability information of the next character to obtain the next character embedded with the watermark.

Images