Double watermark embedding method for large language model

Abstract

A large language model dual watermark embedding method generates a probability for each character based on an input prompt word. Short watermarks are then cyclically embedded for the first several characters, followed by a single long watermark for the remaining text, resulting in a text embedded with dual watermarks. This method ensures both robustness and soundness through dual watermarking, robustness through repeated short watermark embedding, and soundness through a long watermark covering the entire text. Partial errors in the short watermark are tolerated through edit distance, and partial errors in the long watermark are corrected through error-correcting codes.

Description

Technical Field

[0001] The present invention relates to a technology in the field of information security, in particular to a large language model dual watermark embedding method. Background Art

[0002] Large language models themselves have raised concerns about security and privacy, as well as the various security risks posed by their misuse. Due to their exceptional capabilities for text reasoning, text generation, and even code generation, large language models can easily be exploited for malicious purposes, such as creating fake news. Given that text generated by large language models closely resembles human-written text, detecting whether it was generated by a large language model remains a challenge. Summary of the Invention

[0003] In view of the shortcomings of the existing technology, such as the need for a large amount of storage resources to store identification information, resulting in low applicability, poor robustness, and inability to detect partially tampered watermarks, the present invention proposes a large language model dual watermark embedding method, which simultaneously ensures the robustness and soundness of the watermark through dual watermarks, ensures the robustness of the watermark through repeatedly embedded short watermarks, ensures the soundness of the watermark through a long watermark covering the entire text, tolerates partial errors of the short watermark through the edit distance, and corrects partial errors of the long watermark through error correction codes.

[0004] The present invention is achieved through the following technical solutions:

[0005] The present invention relates to a large language model dual watermark embedding method. After generating the probability of each character according to the input prompt word, a short watermark is cyclically embedded for the first several characters, and a long watermark is embedded once for the remaining text to obtain a text embedded with dual watermarks.

[0006] The present invention relates to a detection method based on the above-mentioned embedding method, comprising:

[0007] Step 1: Compare the differences between the short watermark embedded in the text and the original short watermark content paragraph by paragraph, using the edit distance as a quantitative indicator. When the edit distance is lower than the preset threshold, it is determined that the text was generated by a large language model.

[0008] Step 2: Extract the content of the long watermark according to its position, and call the error correction code decoding algorithm to restore the bits that may have changed to the correct version. Finally, use the public key to verify the validity of the signature.

[0009] Step 3: Output the results of long watermark detection and short watermark detection.

[0010] The present invention relates to a watermark embedding system for implementing the above-mentioned method, comprising: a short watermark generation module, a long watermark generation module, an inference character preference module and a selection module, wherein: the short watermark generation module performs hash calculation processing based on fixed initial vector information to obtain a hash value of fixed length; the long watermark generation module performs hash calculation and then signature based on previous characters and private key information, and then performs error correction code encoding processing to obtain a long watermark; the inference character preference module performs large language model inference based on previous character information to obtain a probability result of the next character; and the selection module performs descending sorting processing based on the next character position, the long watermark, the short watermark and the probability information of the next character to obtain the next character embedded with the watermark.

[0011] Technical Effects

[0012] By adding a dual watermark to the large language model, this invention effectively detects even partial tampering. User-written text, even if largely identical to text generated by the large language model, will not be considered generated by the large language model. While achieving these two goals, embedding the watermarking scheme within the text generated by the large language model does not compromise the output quality of the text. Compared to existing technologies, the present invention significantly improves robustness in both the embedding and detection processes. BRIEF DESCRIPTION OF THE DRAWINGS

[0013] Figure 1 Flowchart of the present invention;

[0014] Figure 2 Flowchart of the algorithm for inferring character preferences;

[0015] Figure 3 Schematic diagram of dual watermark embedding for large language models;

[0016] Figure 4 Generate a flow chart for short watermarks;

[0017] Figure 5 This is the short watermark detection flow chart;

[0018] Figure 6 This is a digital signature flow chart;

[0019] Figure 7 is the error correction code flow chart;

[0020] Figure 8 Generate a flow chart for long watermarks;

[0021] Figure 9 This is the long watermark detection flow chart;

[0022] Figure 10 Flowchart of an embodiment. DETAILED DESCRIPTION

[0023] like Figure 1 As shown, this embodiment involves a large language model dual watermark embedding method. After generating the probability of each character based on the input prompt word, a short watermark is cyclically embedded for the first nl characters. For the remaining l texts, a long watermark is embedded once to obtain a text embedded with a dual watermark, where: n is the number of characters in the text generated by the large language model, and l is generally the length of the bit string after the signature algorithm result is encoded using an error correction code.

[0024] The short watermark cyclic embedding includes:

[0025] Step 1: Determine the short watermark π to be cyclically embedded S If the length is zero, execute step 2 to regenerate the short watermark, otherwise execute step 3;

[0026] Step 2: Based on the preset initial vector IV, a secure hash function such as SHA-256 or MD5 algorithm is used to calculate a fixed-length hash value, i.e., a short watermark π. S ←H(IV), then execute step 3.

[0027] The preset initialization vector IV is used to provide non-repetitiveness and randomness in the encryption process, and is preferably composed of a character string with fixed content.

[0028] Step 3: Short watermark π S The first bit b of is deleted, and the character preference is calculated based on the deleted bit b, and the character preference result is output and then returned to step 1.

[0029] The embedding of a long watermark includes:

[0030] Step a: Sign the hash values ​​of all characters t before the current character to obtain the signature σ←Sign(sk,H(t)), and then encode the signature σ to obtain the long watermark π L ←Encode(σ), where sk is the signature private key sk generated when the large language model is initialized. The Encode function performs complex mathematical operations or algebraic structure transformations, embedding additional checksum information in the original data according to a specific error-correcting code standard (such as Reed-Solomon code, BCH code, LDPC code, etc.), forming a coded data stream with a certain degree of fault tolerance.

[0031] The encoding is preferably an error correction code (ECC).

[0032] Step b: Determine the current length of the watermark π L When the length is zero, the embedding of a long watermark is terminated, otherwise, step c is executed;

[0033] Step c: long watermark π LThe first bit b of is deleted, and the character preference is calculated based on the deleted bit b. After obtaining and outputting the character preference result, the process returns to step b.

[0034] like Figure 2 As shown, the inferred character preference calculation specifically includes:

[0035] Step i: Randomly select 50% of the character set from the vocabulary of the large language model, that is, the collection of all words, tags, and other language elements used to understand and generate text during training, and label it as V0, and the remaining 50% of the character set as V1.

[0036] Step ii: Check the bit position of the current character to be embedded. That is, when bit b is 0, add a fixed number τ to the output value of the last hidden layer of the character in character set V0; when bit b is 1, add a fixed number τ to the output value of the last hidden layer of the character in character set V1.

[0037] Step iii: Use the Softmax function to normalize the modified last hidden layer output to obtain a probability result, and then select the character output with the highest probability as the character preference result.

[0038] The hidden layer outputs refer to the intermediate calculation results generated by each layer within the larger language model based on the cue word input. The cue word is usually the text used to initiate or guide the model to generate a specific type of output. The final hidden layer output refers to the hidden state generated by the last layer of the entire model. The output of this layer typically incorporates information from all previous layers and serves as the basis for the model's final decision (such as predicting the next word).

[0039] Generally speaking, the output of the last hidden layer can be simplified to a score table, that is, each character in the large language model vocabulary ( Figure 2 word in i ) has a corresponding score ( Figure 2 score i ), in general, these hidden states can be directly used for downstream tasks, but in this scheme, they will be further processed, for example, when the bit is 0, for all characters in V0 work i , and their corresponding scores i Add a fixed value τ.

[0040] like Figure 5 and Figure 9 As shown, this embodiment relates to a detection method based on the above embedding method, including:

[0041] Step 1: Detect short watermarks: Compare the differences between the embedded watermark and the original short watermark content paragraph by paragraph, using the edit distance as a quantitative indicator. When the edit distance is lower than a preset threshold, the text is determined to be generated by a large language model;

[0042] The segment-by-segment comparison uses the Levenshtein distance as a quantitative metric. This measures the minimum number of single-character edits required to transform one string into another through insertions, deletions, and substitutions. When the calculated Levenshtein distance falls below a preset threshold, it confirms that the text is highly likely generated by a large-scale language model, rather than being artificially generated or significantly altered.

[0043] Step 2: Detect the long watermark: The long watermark content is extracted according to its position, and the error-correcting code decoding algorithm is used to restore any bits that may have changed to the correct version. Finally, the public key is used to verify the validity of the signature. If the signature is not generated by the large language model itself, it cannot be verified. If the signature is generated by the large language model, even if it has been added, deleted, or tampered with to a certain extent, the error-correcting code algorithm can restore it to the original signature and pass authentication.

[0044] The signature means that when the large language model is used as the signer, the message m and the private key sk are used as input to obtain the signature σ←Sign(sk,m), where: m is the message content, sk is the signature private key, Sign is the signature algorithm, and σ is the signature result.

[0045] The verification uses the public key pk, the message m' and the signature σ' to obtain the verification result φ=Verify(pk,m',σ'), where: m' is the received message, σ' is the received signature, pk is the public key information disclosed by the signer, Verify is the signature verification algorithm, and φ is the verification result.

[0046] After specific actual experiments, in the Ubuntu 20.04, NVIDIA T416GB environment settings, the above method was started with parameters n=1000 and τ=2. The experimental data obtained are: under the condition of error injection rate 0, both long watermarks and short watermarks can be correctly detected; when 20% errors are injected into the generated text, there is a 95% probability that the short watermark can still be successfully detected; when 5 errors are injected into the text, there is a 100% probability that the long watermark can be successfully detected, but after injecting 15 errors, the probability of the long watermark being detected is less than 5%.

[0047] Compared with the existing technology, this method ensures robustness through short watermarks, and can still detect when a large amount of text has been tampered with. The long watermark ensures soundness. In the face of a small amount of tampering, it can restore the correct watermark through error correction code. For a large amount of tampering, it is considered to be generated by malicious persons and therefore cannot pass the inspection.

[0048] In summary, this method does not require a database as a storage medium. When the number of requests increases, there is no need for storage resources to save identification information. Only a small amount of calculation is required for signing and hashing operations, which effectively improves the generation speed. This method uses double watermarking to embed both short and long watermarks in the text to ensure the robustness and soundness of the watermark. Even if the text is tampered with by malicious people, the watermark can be detected normally.

[0049] The above-mentioned specific implementation can be partially adjusted in different ways by those skilled in the art without departing from the principles and purpose of the present invention. The scope of protection of the present invention shall be based on the claims and shall not be limited by the above-mentioned specific implementation. All implementation schemes within its scope shall be subject to the constraints of the present invention.

Claims

1. A large language model dual watermark embedding method, characterized by: After generating the probability of each character according to the input prompt word, the short watermark is used to cyclically embed the first several characters, and the long watermark is embedded once for the remaining text to obtain the text embedded with double watermarks; The short watermark cyclic embedding includes: Step 1: Determine the short watermark to be embedded in the loop If the length is zero, execute step 2 to regenerate the short watermark, otherwise execute step 3; Step 2: According to the preset initial vector , through a secure hash function such as SHA-256 or MD5 algorithm, a fixed-length hash value is calculated, i.e., a short watermark , then proceed to step 3; Step 3: Short watermark The first bit b is deleted, and the character preference is calculated based on the deleted bit b and the character preference result is output and then the process returns to step 1; The embedding of a long watermark includes: Step a: For all characters before the current character Sign the hash value to get the signature , then sign Encode to get long watermark ,in: The signature private key generated when the large language model is initialized ; The function performs complex mathematical operations or algebraic structure transformations, embeds additional checksum information into the original data according to a specific error correction code standard, and forms a coded data stream with a certain degree of fault tolerance. Step b: Determine the length of the watermark When the length is zero, the embedding of a long watermark is terminated, otherwise, step c is executed; Step c: Add the long watermark The first bit b of is deleted, and the character preference is calculated based on the deleted bit b. After obtaining and outputting the character preference result, the process returns to step b.

2. The large language model dual watermark embedding method according to claim 1 is characterized in that: The inferred character preference calculation specifically includes: Step i: Randomly select 50% of the character set from the vocabulary of the large language model, that is, the collection of all words, tokens and other language elements used to understand and generate text during training, and label them as , the remaining 50% of the character set is marked as ; Step ii, check the bit of the current character to be embedded, that is, when bit b is 0, the character set The last hidden layer output value of the character in the character plus a fixed number ; When bit b is 1, the character set The last hidden layer output value of the character in the character plus a fixed number ; Step iii: Use the Softmax function to normalize the modified last hidden layer output to obtain a probability result, and then select the character output with the highest probability as the character preference result.

3. A large language model dual watermark detection method based on the method of claim 1 or 2, characterized in that: include: Step 1: Compare the differences between the short watermark embedded in the text and the original short watermark content paragraph by paragraph, using the edit distance as a quantitative indicator. When the edit distance is lower than the preset threshold, it is determined that the text is generated by a large language model; Step 2: Extract the content of the long watermark according to its position, and call the error correction code decoding algorithm to restore the bits that may have changed to the correct version. Finally, use the public key to verify the validity of the signature. Step 3: Output the results of long watermark detection and short watermark detection; The segment-by-segment comparison uses edit distance, also known as the Levenshtein distance, as a quantitative metric. This measures the minimum number of single-character edits required to transform one string into another through operations such as insertion, deletion, and substitution. When the calculated edit distance is lower than a preset threshold, it can be confirmed that the text is most likely generated by a large language model rather than being manually created or significantly tampered with.

4. The large language model dual watermark detection method according to claim 3, characterized in that: The signature mentioned above means that when the large language model is used as the signer, the message and private key As input, get the signature ,in: For the message content, is the signature private key, is the signature algorithm, The signature result.

5. The large language model dual watermark detection method according to claim 3, characterized in that: The verification described above uses the public key ,information and signature Get verification results ,in: For received messages, For signatures received, The public key information disclosed by the signer, is the signature verification algorithm, To verify the results.

6. A watermark embedding system for implementing the method according to any one of claims 1 to 5, comprising: A short watermark generation module, a long watermark generation module, an inference character preference module and a selection module, wherein: the short watermark generation module performs hash calculation processing based on fixed initial vector information to obtain a hash value of fixed length; the long watermark generation module performs hash calculation and signature based on previous characters and private key information, and then performs error correction code encoding processing to obtain a long watermark; the inference character preference module performs large language model inference based on previous character information to obtain the probability result of the next character; the selection module performs descending sorting processing based on the next character position, long watermark, short watermark and probability information of the next character to obtain the next character embedded with the watermark.

Images