Large model-oriented data tracing method and system
By using the data traceability method for large models, the final impact score of the training data is calculated using the deprivation and noise strategy to solve the shortcomings of the data traceability method in the existing technology in terms of anti -aggressiveness and applicability. And protection.
Patent Information
- Application Number
- CN202411351041.5
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- Filing Date
- 2024-09-26
- Publication Date
- 2025-01-24
AI Technical Summary
The prior art data traceability methods based on watermark embedding and influence function based on large-model tracing methods have defects in their resistance to attacks and applicability, and it is difficult to effectively track and protect the intellectual property rights of training data.
This paper proposes a data traceability method for large models. Through the steps of constructing a test sample set, debiasing correction, and denoising correction, the final impact score of the training data is calculated to achieve data traceability analysis.
Through the de -bias and noise strategy, the effect of tracing the traceability of large language model training data has been significantly improved. The AUC value reaches more than 90%. It is suitable for large language models of different sources and can effectively prevent training data from being authorized.
Smart Images
Figure CN119358670A_ABST
Abstract
Description
Technical Field
[0001] The present application relates to the field of data traceability, and in particular to a data traceability method and system for large models. Background Art
[0002] At present, with the rapid development of artificial intelligence technology, protecting the intellectual property rights of model training data and preventing the theft or unauthorized use of training data have become increasingly prominent issues. Therefore, it is urgent to study the traceability of large-scale artificial intelligence model training data.
[0003] However, the current data traceability methods for large models mainly have the following problems and shortcomings:
[0004] 1) Training data traceability technology based on watermark embedding: The training data traceability method based on watermark embedding embeds a unique identifier (usually an invisible watermark) into the training data set, so that even after the training is completed, the original data source used by the model can be traced. The embedding of watermarks in this method may have a negative impact on the quality of the generated text. Secondly, the watermark is vulnerable to attack or removal, which greatly reduces its utility and requires specific intervention during model training;
[0005] 2) Training data tracing technology based on influence function: This method is often underfitting in the training of large language models, and the training data tracing effect is poor on large language models. Secondly, the influence function needs to calculate the Hessian matrix of the training data, which requires huge computing overhead on large models.
[0006] In order to solve the above-mentioned technical problems, it is urgent to propose a data tracing method and system for large models, so as to improve the effect of training data tracing on large language models through the two strategies of debiasing and denoising. Summary of the invention
[0007] In order to solve the defects of the above-mentioned existing technologies based on watermark embedding and influence function methods in tracing the source of large language model training data, the anti-attack and applicability are relatively poor.
[0008] In a first aspect, an embodiment of the present application provides a data tracing method for a large model, the method comprising:
[0009] Test sample construction step: construct a test sample set to be input into the large model, and the test sample set contains data traceability information;
[0010] Debiasing correction step: For the test data set, the debiasing correction method is used to calculate the debiasing impact score of each training sample and test sample on the post-training model and the pre-training model;
[0011] Final influence score calculation step: perform debiasing calculation based on the debiasing influence scores of the post-training model and the pre-training model to obtain the final influence score of each training data;
[0012] Data tracing step: Based on the final impact score, perform data tracing analysis.
[0013] As an optional implementation, in the first aspect of the present invention, the data provenance method for a large model further includes:
[0014] Denoising correction step: select multiple model training checkpoints, use the denoising correction method, and for the test data set, calculate the denoising impact score of each training sample and test sample on the trained model;
[0015] Final influence score calculation steps: Perform debiasing calculation based on the denoising influence score on the trained model and the debiasing influence score on the pre-trained model to obtain the final influence score of each training data on the test sample set.
[0016] As an optional implementation manner, in the first aspect of the present invention, the debiasing correction step further includes:
[0017] Debiased first-order partial derivative calculation steps: obtain the first-order partial derivatives of the test sample set output by the model after training and before training respectively;
[0018] Calculation steps of the first-order partial derivative of the debiasing loss: obtain the first-order partial derivative of the loss for each training data on the model before and after training respectively;
[0019] Steps for calculating the debiasing impact score: traverse each training data, calculate the dot product of the first-order partial derivative of the test sample on the pre-training model and the first-order partial derivative of each loss, obtain the debiasing impact score of the pre-training model, calculate the dot product of the first-order partial derivative of the test sample on the post-training model and the first-order partial derivative of each loss, and obtain the debiasing impact score of the post-training model.
[0020] As an optional implementation, in the first aspect of the present invention, the final impact score calculation step is:
[0021] Subtract the debiasing influence score of the pre-training model from the debiasing influence score of the post-training model to obtain the final influence score.
[0022] As an optional implementation, in the first aspect of the present invention, the denoising correction step further includes:
[0023] Checkpoint selection step: select multiple checkpoints for model training according to preset conditions;
[0024] Debiased first-order partial derivative calculation steps: First, obtain the first-order partial derivatives of the test sample output on the model after and before training at multiple model training checkpoints;
[0025] Steps for calculating the first-order partial derivative of the debiasing loss: Get the first-order partial derivative of the loss for each training sample on the checkpoints of multiple model training and the model before training respectively;
[0026] Denoising influence score calculation steps: traverse each training data, calculate the de-biasing influence score of the pre-training model, calculate the sum of the first-order partial derivative of the test sample on the trained model and the dot product of each loss first-order partial derivative, and perform mean smoothing to obtain the denoising influence score of the trained model.
[0027] As an optional implementation, in the first aspect of the present invention, the final impact score calculation step is:
[0028] Subtract the debiasing influence score of the pre-training model from the denoising influence score of the trained model to obtain the final influence score.
[0029] In a second aspect, an embodiment of the present application provides a data tracing system for a large model, adopting the data tracing method for a large model as described above, and the system includes:
[0030] Test sample construction module: constructs a test sample set to be input into the large model. The test sample set contains data traceability information.
[0031] Debiasing correction module: For the test data set, a debiasing correction method is used to calculate the debiasing impact score of each training sample and test sample on the post-training model and the pre-training model;
[0032] Final influence score calculation module: performs debiasing calculation based on the debiasing influence scores of the post-training model and the pre-training model to obtain the final influence score of each training data;
[0033] Data tracing module: realize data tracing analysis based on the final impact score.
[0034] As an optional implementation, in the first aspect of the present invention, the data provenance tracing system for large models further includes:
[0035] Denoising correction module: used to select multiple model training checkpoints, use the denoising correction method, and calculate the denoising impact score of each training sample and test sample on the trained model for the test data set;
[0036] Final impact score calculation module: used to perform debiasing calculation based on the denoising impact score on the trained model and the debiasing impact score on the pre-trained model, obtain the final impact score of each training data on the test sample set, and realize data traceability analysis.
[0037] In a third aspect, an embodiment of the present application provides a computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, implements the steps of the above-mentioned data tracing method for large models.
[0038] In a fourth aspect, an embodiment of the present application provides an electronic device, comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor implements the steps of the large model-oriented data tracing method as described above when executing the program.
[0039] Compared with the related prior art, it has the following outstanding beneficial effects:
[0040] 1) The method of the present invention corrects the influence function through a debiasing strategy, specifically, using the influence score of the trained model minus the influence score of the pre-training model (base model), and increases the AUC value (AUC value (Area Under the Curve) usually refers to the area under the ROC curve (Area Under the Receiver Operating Characteristic Curve), which is an indicator used to evaluate the performance of a binary classification model) of the large language model training data tracing to more than 90%. For example, the training data tracing effect of LLaMA2-7B-Chat reaches 93.49%;
[0041] 2) The method of the present invention corrects the influence function through a denoising strategy, specifically, using the influence scores of multiple checkpoints in the model training process to perform mean smoothing, and using the smoothed influence score to subtract the influence score of the pre-training model (base model), so that the method of the present invention can be applied to large language models from different sources. For example, the AUC values of training data tracing on LLaMA2-7B-Chat, Qwen2-7B-Instruct and Mistral-7B-Instruct all exceed 90%;
[0042] 3) The method of the present invention improves the effect of the influence function on the data tracing task by constructing a positive and negative sample set of the test data. The positive sample is a test output sample that does not contain tracing information, and the negative sample is a test output sample that contains tracing information. Then, the influence score comparison of the positive and negative samples is used to improve the effect of the influence function on the data tracing task. The recall index R@500 on the data tracing dataset exceeds 60%, which is better than the existing technical solutions.
[0043] 4) The method of the present invention can be used for copyright protection to prevent the training data from being used by unauthorized third parties; infringement detection, when a suspicious model is found on the market, it can be determined whether the data ownership is infringed by detecting whether it contains specific tracking information; data tracing, helping to determine the source of data used by the model, which is helpful for compliance management and data auditing. BRIEF DESCRIPTION OF THE DRAWINGS
[0044] The drawings described herein are used to provide a further understanding of the present application and constitute a part of the present application. The illustrative embodiments of the present application and their descriptions are used to explain the present application and do not constitute an improper limitation on the present application. In the drawings:
[0045] Figure 1 This is a schematic diagram of a data tracing method for a large model according to an embodiment of the present invention;
[0046] Figure 2 This is a schematic diagram of the principle of the debiasing solution according to an embodiment of the present invention;
[0047] Figure 3 This is a schematic diagram of a debiasing method flow chart of an embodiment of the present invention;
[0048] Figure 4 This is a schematic diagram of a data tracing method for a large model according to another embodiment of the present invention;
[0049] Figure 5 This is a schematic diagram of the denoising scheme principle of an embodiment of the present invention;
[0050] Figure 6 This is a schematic diagram of a denoising method flow chart of an embodiment of the present invention;
[0051] Figure 7 This is a schematic diagram of the principle of the fusion solution of de-scrambling and denoising according to an embodiment of the present invention;
[0052] Figure 8 This is a schematic diagram of the architecture of a data traceability system for a large model according to an embodiment of the present invention;
[0053] Fig. 9 Schematic diagram of computer hardware of the present invention. DETAILED DESCRIPTION
[0054] It should be noted that the processor described in the present invention is the control center of the electronic device, which may be a processor or a general term for multiple processing elements. For example, it may be one or more central processing units (CPUs), or application specific integrated circuits (ASICs), or one or more integrated circuits configured to implement the embodiments of the present invention, such as one or more digital signal processors (DSPs), or one or more field programmable gate arrays (FPGAs).
[0055] Optionally, the processor can perform various functions of the electronic device by running or executing a software program stored in the memory, and calling data stored in the memory.
[0056] In a specific implementation, as an embodiment, the processor may include one or more CPUs. Each of these processors may be a single core processor or a multi-core processor. The processor here may refer to one or more devices, circuits, and / or processing cores for processing data (e.g., computer program instructions). Electronic devices may include: servers, desktop computers, laptops, smart phones, tablet computers, embedded computers, etc., wherein the embedded computers include vehicles and robots, etc.
[0057] The memory is used to store the software program for executing the solution of the present invention, and the execution is controlled by the processor. The specific implementation method can refer to the above method embodiment, which will not be repeated here.
[0058] It should be noted that the structure of the electronic device shown in the drawings of the present invention does not constitute a limitation thereto, and the actual knowledge structure recognition device may include more or fewer components than shown in the drawings, or a combination of certain components, or a different arrangement of components.
[0059] The above embodiments can be implemented in whole or in part by software, hardware (such as circuits), firmware or any other combination. When implemented by software, the above embodiments can be implemented in whole or in part in the form of a computer program product. The computer program product includes one or more computer instructions or computer programs. When the computer instructions or computer programs are loaded or executed on a computer, the process or function described in the embodiment of the present invention is generated in whole or in part. The computer can be a general-purpose computer, a special-purpose computer, a computer network, or other programmable device. The computer instructions can be stored in a computer-readable storage medium, or transmitted from one computer-readable storage medium to another computer-readable storage medium. For example, the computer instructions can be transmitted from one website, computer, server or data center to another website, computer, server or data center by wired (such as infrared, wireless, microwave, etc.). The computer-readable storage medium can be any available medium that can be accessed by a computer or a data storage device such as a server or data center that contains one or more available media sets. The available medium can be a magnetic medium (for example, a floppy disk, a hard disk, a tape), an optical medium (for example, a DVD), or a semiconductor medium. The semiconductor medium can be a solid-state hard disk.
[0060] It should also be understood that the term "and / or" in this article is only a description of the association relationship of associated objects, indicating that there can be three relationships. For example, A and / or B can represent: A exists alone, A and B exist at the same time, and B exists alone. A and B can be singular or plural. In addition, the character " / " in this article generally indicates that the associated objects before and after are in an "or" relationship, but it may also indicate an "and / or" relationship. Please refer to the context for specific understanding.
[0061] In the present invention, "at least one" means one or more, and "more than one" means two or more. "At least one of the following" or similar expressions refers to any combination of these items, including any combination of single or plural items. For example, at least one of a, b, or c can be represented by: a, b, c, ab, ac, bc, or abc, where a, b, c can be single or multiple.
[0062] It should also be understood that in various embodiments of the present invention, the size of the serial numbers of the above-mentioned processes does not mean the order of execution. The execution order of each process should be determined by its function and internal logic, and should not constitute any limitation on the implementation process of the embodiments of the present invention.
[0063] In the several embodiments provided by the present invention, it should be understood that the disclosed devices, apparatuses and methods can be implemented in other ways. For example, the device embodiments described above are only schematic, for example, the division of the units is only a logical function division, and there may be other division methods in actual implementation, such as multiple units or components can be combined or integrated into another device, or some features can be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed can be through some interfaces, indirect coupling or communication connection of devices or units, which can be electrical, mechanical or other forms.
[0064] The units described as separate components may or may not be physically separated, and the components shown as units may or may not be physical units, that is, they may be located in one place or distributed on multiple network units. Some or all of the units may be selected according to actual needs to achieve the purpose of the solution of this embodiment.
[0065] In addition, each functional unit in each embodiment of the present invention may be integrated into one processing unit, or each unit may exist physically separately, or two or more units may be integrated into one unit.
[0066] If the functions are implemented in the form of software functional units and sold or used as independent products, they can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present invention can be essentially or partly embodied in the form of a software product that contributes to the prior art. The computer software product is stored in a storage medium and includes several instructions for enabling a computer device (which can be a personal computer, a server, or a network device, etc.) to perform all or part of the steps of the methods described in various embodiments of the present invention. The aforementioned storage medium includes: various media that can store program codes, such as a USB flash drive, a mobile hard disk, a read-only memory (ROM), a random access memory (RAM), a magnetic disk or an optical disk.
[0067] In order to make the above features and effects of the present invention more clearly and understandably described, embodiments are given below and described in detail with reference to the accompanying drawings. This specification discloses one or more embodiments that include the features of the present invention. The disclosed embodiments are only for illustration. The scope of protection of the present invention is not limited to the disclosed embodiments, and the present invention is defined by the attached claims.
[0068] The following is a system embodiment corresponding to the above method embodiment. This embodiment can be implemented in conjunction with the above embodiment. The relevant technical details mentioned in the above embodiment are still valid in this embodiment. In order to reduce repetition, they are not repeated here. Accordingly, the relevant technical details mentioned in this embodiment can also be applied in the above embodiment.
[0069] The present invention aims to propose a data tracing method that can be used for copyright protection to prevent training data from being used by unauthorized third parties; infringement detection, when a suspicious model is found on the market, it can be determined whether the data ownership is infringed by detecting whether it contains specific tracking information; or model tracing, which helps determine the source of data used by the model, which is helpful for compliance management and data auditing.
[0070] The method of the present invention derives the definition of the influence function and finds that under the premise of not satisfying the empirical risk minimization, the effect of the attribution method based on the influence function is affected by the deviation of the pre-training model (base model) and different fitting errors during training. The method of the present invention corrects the application of the influence function in tracing the training data of the large language model, and improves the effect of tracing the training data on the large language model through the two strategies of debiasing and denoising.
[0071] Embodiment 1
[0072] like Figure 1 As shown, Figure 1 is a flow chart of a data tracing method for a large model disclosed in an embodiment of the present invention. Figure 1 The unified data tracing method shown can be applied to a data tracing system or device, and the embodiment of the present invention does not limit this. Figure 1 As shown, the present invention provides a data tracing method for a large model, the method comprising:
[0073] Test sample construction step 101: construct a test sample set to be input into the large model, the test sample set includes data traceability information;
[0074] In the embodiment of the present invention, a specific test sample containing data traceability information (the present invention includes but is not limited to hallucination information, which refers to the phenomenon that the content generated by the model is inconsistent with the facts in the real world or the user input, in short, it is "nonsense"; or watermark information, etc., the present invention is not limited to this.) is constructed. e =(x e ,y e ) output; however, the present invention is not limited thereto, and other test data sets may also be input;
[0075] Debiasing correction step 102: for the test data set, a debiasing correction method is used to calculate the debiasing influence score of each training sample and test sample on the post-training model and the pre-training model;
[0076] like Figure 2 and Figure 3 As shown, in a specific embodiment of the present invention, given a trained model and a pre-training model, as well as corresponding training data, training data traceability is performed for a specific test sample output.
[0077] Step 1: Get the first-order partial derivatives of the test sample output on the model before and after training:
[0078] Step 1: When the test sample is z e =(x e ,y e ), where x e is the input text of the model test case, y e is the output text of the model test case, so in step 1, for the pre-training model (model parameter is θ 0 ), input is the input text x of the test case e , the output is the model output f(x e ,θ 0 The first-order partial derivative of ) For the trained model (model parameter is θ'), the input is the input text x of the test case e , the output is the model output f(x e ,θ')
[0079] Step 2 is to obtain the first-order partial derivative of the loss of each training sample on the model before and after training:
[0080] Step 2, assume that the tth training data is z t =(x t ,y t ), where x t is the input text of the tth training data example of the model, y t is the output text of the tth training data sample of the model, so in step 2, for the pre-training model (model parameter is θ 0 ), the input is the input text x of the tth training data example e , label label is y t , the output is the loss l(z t ,θ 0 The first-order partial derivative of ) For the trained model (model parameter is θ'), the input is the input text x of the tth training data example e , label label is y t , the output is the loss l(z t,θ') ).
[0081] Step 3 is the dot product of the first-order partial derivative of the test sample output obtained in steps 1 and 2 and the first-order partial derivative of the loss of each training sample:
[0082] That is, on the pre-training model (model parameter is θ 0 ), the tth training sample z t For the test case z e The impact of can be measured by the impact score, which is equal to the first-order partial derivative of the output of the test sample on the pre-training model. and the first-order partial derivative of the loss of the t-th training data sample on the pre-trained model The dot product of On the trained model (model parameter is θ'), the tth training sample z t For the test case z e The influence of can be measured by the influence score, which is equal to the first-order partial derivative of the output of the test sample on the trained model [ and the first-order partial derivative of the loss of the t-th training data sample on the trained model The dot product of In this way, each training sample is traversed to obtain each training sample Z and test case z e Impact scores on the trained model and the pre-trained model.
[0083] Final influence score calculation step 103: performing debiasing calculation based on the debiasing influence scores of the post-training model and the pre-training model to obtain the final influence score of each training data;
[0084] The influence score IS of the trained model Trained (z t ,z e ) minus the influence score of the pre-trained model ISUntrained(z t ,ze) to obtain the final impact score ISDB(z t ,ze) as the basis for attribution of training data, the influence score value IS corresponding to the training data DB (z t ,z e ) is larger, the greater the influence of the training data sample on the test sample output.
[0085]
[0086] Data tracing step 104: Based on the final impact score, data tracing analysis is performed.
[0087] Compared with the prior art, the method of the present invention has the following technical effects: by correcting the influence function through the debiasing strategy, specifically, using the influence score of the trained model minus the influence score of the pre-trained model (base model), the AUC value of the large language model training data attribution is increased to more than 90%, for example, the training data attribution effect of LLaMA2-7B-Chat reaches 93.49%. The present invention is not limited to this, and other evaluation parameters can also be used.
[0088] Embodiment 2
[0089] like Figure 4 As shown, Figure 4 is a flow chart of another data tracing method for a large model disclosed in an embodiment of the present invention. Figure 4 The data tracing method for large models shown can be applied to a data tracing system or device for large models, and the embodiment of the present invention does not limit this. Figure 4 As shown, the present invention provides a data tracing method for a large model, the method comprising:
[0090] Test sample construction step 201: construct a test sample set to be input into the large model, the test sample set includes data traceability information;
[0091] Debiasing correction step 202: for the test data set, a debiasing correction method is used to calculate the debiasing influence score of each training sample and test sample on the post-training model and the pre-training model;
[0092] De-noising correction step 203: selecting multiple model training checkpoints, using a de-noising correction method, and calculating the de-noising impact score of each training sample and test sample on the trained model for the test data set;
[0093] In the embodiment of the present invention, given N checkpoints of model training, the checkpoints in the example refer to the weights of different epochs of model training. For example, the i-th checkpoint indicates that the model has been trained for i epochs on the training data set, that is, trained for i rounds. At this time, the model weight is θ i ) and the pre-training model (model weights are θ 0 ), and the corresponding training data, the training data is attributed to the specific test sample output.
[0094] like Figure 5 and Figure 6 As shown, step 1 first obtains the first-order partial derivatives of the test sample output on the N model training checkpoints and the pre-training model respectively:
[0095] Step 1: When the test sample is z e =(x e ,ye ), where x e is the input text of the model test case, y e is the output text of the model test case, so in step 1, for the pre-training model (model parameter is θ 0 ), the input is the input text xe of the test case, and the output is the model output f(xe,θ 0 The first-order partial derivative of ) For the i-th model training checkpoint (where the model parameters are θ i ), input is the input text x of the test case e , the output is the model output f(x e ,θ i The first-order partial derivative of )
[0096] Step 2 is to obtain the first-order partial derivative of the loss of each training sample on the checkpoint of N model training and the model before training:
[0097] Assume that the tth training data is z t =(x t ,y t ), where x t is the input text of the tth training data example of the model, y t is the output text of the tth training data sample of the model, so in step 2, for the pre-training model (model parameter is θ 0 ), the input is the input text x of the tth training data example e , label label is y t , the output is the loss l(z t ,θ 0 The first-order partial derivative of ) For the i-th model training checkpoint (where the model parameters are θ i ), the input is the input text x of the tth training data example e , label label is y t , the output is the loss l(z t ,θ i The first-order partial derivative of )
[0098] Step 3 is the dot product of the first-order partial derivative of the test sample output obtained in steps 1 and 2 and the first-order partial derivative of the loss of each training sample. That is, on the pre-training model (model parameter is θ 0 ), the tth training sample z t For the test case z eThe impact of can be measured by the impact score, which is equal to the first-order partial derivative of the output of the test sample on the pre-training model. and the first-order partial derivative of the loss of the t-th training data sample on the pre-trained model The dot product of At the i-th model training checkpoint (where the model parameters are θ i ), the tth training sample z t For the test case z e The impact of can be measured by the impact score, which is equal to the first-order partial derivative of the output of the test sample at N model checkpoints and the first-order partial derivative of the loss of the t-th training data sample at N model checkpoints The sum of the dot products In this way, each training sample is traversed to obtain each training sample Z and test case z e Impact scores on the trained model and the pre-trained model.
[0099] Final influence score calculation step 204: performing debiasing calculation based on the denoising influence score of the trained model and the debiasing influence score of the pre-trained model to obtain the final influence score of each training data on the test sample set;
[0100] The impact score IS across N model checkpoints Trained (z t ,z e ) Subtract the influence score IS of the pre-training model Untrained (z t ,z e ) Get the final impact score As the basis for attributing training data, the influence score value IS corresponding to the training data DD (z t ,z e ) is larger, the greater the influence of the training data sample on the test sample output.
[0101]
[0102] Data tracing step 205: Based on the final impact score, data tracing analysis is performed.
[0103] The beneficial effect of the method of the present invention compared with the prior art is that: the influence function is corrected through a denoising strategy, specifically, the influence scores of multiple checkpoints in the model training process are used for mean smoothing, and the influence score of the pre-training model (base model) is subtracted from the smoothed influence score, so that the method of the present invention can be applied to large language models from different sources. For example, the AUC values of training data tracing on LLaMA2-7B-Chat, Qwen2-7B-Instruct and Mistral-7B-Instruct all exceed 90%.
[0104] Embodiment 3
[0105] like Figure 7 As shown, the embodiment of the present application provides a schematic diagram of an application scenario that can be used for data traceability or copyright protection, and integrates debiasing and denoising. The principle of the solution is shown in formula (3):
[0106] Step 1: First, for a specific test sample (negative sample) output containing data traceability information, first construct a positive sample test data set Z corresponding to the test sample output e (Samples that do not contain corresponding data tracking information) and the model output negative sample test data set (Contains a sample of corresponding data tracking information).
[0107] Step 2: For the positive sample test data set Z e , according to the implementation steps in the denoising scheme, calculate the tth training data z t For the positive sample test data set Z e Impact score For the negative sample test data set According to the implementation steps in the denoising scheme, calculate the tth training data z t Test data set for negative samples Impact score
[0108] Step 3: Test the data set Z with positive samples e Impact score Subtract negative sample test data set Impact score Get the final impact score:
[0109]
[0110] As the basis for attributing training data, the influence score value IS corresponding to the training data DDA (z t ,z e) is larger, the greater the impact of the training data sample on the output of the test sample (including data tracking information).
[0111] The original training data attribution technology based on influence function only considers the influence score of the test sample on the trained model, that is, the first-order partial derivative of the output of the trained model. and the first-order partial derivative of the loss of the t-th training data sample on the trained model The dot product of The above formula relies on the premise that the model training satisfies the minimization of the empirical wind direction, that is, However, due to the complexity of the model structure and the non-concaveness of the model, the premise of minimizing the empirical risk cannot be met in the attribution of training data of the large language model, which will cause the effect of attribution of training data of the large language model to be affected by the bias of the pre-training model. In the debiasing strategy, the present invention removes the bias of the pre-training model (the model parameter is θ 0 ), which is the influence score of the output of the pre-training model minus the first-order partial derivative of and the first-order partial derivative of the loss of the t-th training data sample on the pre-trained model The dot product of This can eliminate the impact of knowledge bias in the large language model before training.
[0112] In the denoising strategy, the present invention finds that different stages of large language model training will have different fitting errors. For example, the data fitting degree of the checkpoint of the i-1th epoch of model training is inconsistent with that of the i-th checkpoint. Therefore, we choose to calculate the influence score at different training checkpoints. The influence score is smoothed by the mean, that is The influence of the fitting error caused at different stages of model training is reduced to achieve the effect of denoising. Finally, the influence function IS of the pre-training model is subtracted. Untrained (z t ,z e ), further eliminating the influence of pre-training model knowledge bias, thereby achieving the technical integration of debiasing and denoising solutions.
[0113] Embodiment 4
[0114] like Figure 8 As shown, the embodiment of the present application provides a data tracing system for a large model, adopting the data tracing method for a large model as described above, and the system includes:
[0115] Test sample construction module 301: construct a test sample set to be input into the large model, the test sample set includes data traceability information;
[0116] Debiasing correction module 302: for the test data set, a debiasing correction method is used to calculate the debiasing influence score of each training sample and test sample on the post-training model and the pre-training model;
[0117] Final influence score calculation module 303: performing debiasing calculation according to the debiasing influence scores of the post-training model and the pre-training model to obtain the final influence score of each training data;
[0118] Data tracing module 304: implements data tracing analysis based on the final impact score.
[0119] As an optional implementation, in the first aspect of the present invention, the data provenance tracing system for large models further includes:
[0120] De-noising correction module 305: used to select multiple model training checkpoints, use a denoising correction method, and calculate the denoising impact score of each training sample and test sample on the trained model for the test data set;
[0121] The final impact score calculation module 306 is used to perform debiasing calculation based on the denoising impact score on the trained model and the debiasing impact score on the pre-trained model, obtain the final impact score of each training data on the test sample set, and realize data traceability analysis.
[0122] Embodiment 5
[0123] An embodiment of the present application provides a computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, implements the steps of the above-mentioned large-model-oriented data tracing method.
[0124] Embodiment 6
[0125] An embodiment of the present application provides an electronic device, including a memory, a processor, and a computer program stored in the memory and executable on the processor. When the processor executes the program, the steps of the large model-oriented data tracing method as described above are implemented.
[0126] In addition, combined Figure 1 The data tracing method for large models described in the embodiment of the present application can be implemented by an electronic device, such as a computer device. Fig. 9 Schematic diagram of the hardware structure of a computer device according to an embodiment of the present application.
[0127] In some of these embodiments, the computer device may further include a communication interface 83 and a bus 80. Fig. 9 As shown, the processor 81, the memory 82, and the communication interface 83 are connected via a bus 80 and communicate with each other.
[0128] Specifically, the processor 81 may include a central processing unit (CPU), or an application specific integrated circuit (ASIC), or may be configured to implement one or more integrated circuits of the embodiments of the present application.
[0129] The memory 82 may be used to store or cache various data files required for processing and / or communication, as well as possible computer program instructions executed by the processor 81 .
[0130] The processor 81 implements any one of the data provenance analysis methods for large models in the above-mentioned embodiments by reading and executing computer program instructions stored in the memory 82 .
[0131] In summary, compared with the prior art, the method of the present invention has the following beneficial effects:
[0132] The debiasing and denoising fusion scheme proposed in the present invention can achieve an AUC value of more than 90% on the large language model training data tracing task on LLaMA2-7B-Chat, Qwen2-7B-Instruct and Mistral-7B-Instruct. For example, the training data tracing effect of LLaMA2-7B-Chat reaches 93.49%. (AUC value (Area Under the Curve) usually refers to the area under the ROC curve (Area Under the Receiver Operating Characteristic Curve), which is an indicator used to evaluate the performance of a binary classification model).
[0133] The technical features of the above-described embodiments may be arbitrarily combined. To make the description concise, not all possible combinations of the technical features in the above-described embodiments are described. However, as long as there is no contradiction in the combination of these technical features, they should be considered to be within the scope of this specification.
[0134] The above-mentioned embodiments only express several implementation methods of the present application, and the descriptions thereof are relatively specific and detailed, but they cannot be understood as limiting the scope of the invention patent. It should be pointed out that, for a person of ordinary skill in the art, several variations and improvements can be made without departing from the concept of the present application, and these all belong to the protection scope of the present application. Therefore, the protection scope of the patent of the present application shall be subject to the attached claims.
Claims
1. A data tracing method for a large model, characterized in that: The method comprises: Test sample construction step: construct a test sample set to be input into the large model, wherein the test sample set includes data traceability information; Debiasing correction step: for the test data set, using a debiasing correction method, calculating the debiasing influence score of each training sample and test sample on the post-training model and the pre-training model; Final influence score calculation step: performing debiasing calculation according to the debiasing influence scores on the post-training model and the pre-training model to obtain a final influence score for each training data; Data tracing step: Based on the final impact score, data tracing analysis is performed.
2. The data tracing method for large models according to claim 1 is characterized in that: The method further comprises: Denoising correction step: selecting multiple model training checkpoints, using a denoising correction method, and calculating the denoising impact score of each training sample and test sample on the trained model for the test data set; Final impact score calculation step: perform debiasing calculation based on the denoising impact score on the post-training model and the debiasing impact score on the pre-training model, obtain the final impact score of each training data on the test sample set, and realize data traceability analysis.
3. The data tracing method for large models according to claim 1 is characterized in that: The debiasing correction step further comprises: Debiased first-order partial derivative calculation step: obtaining the first-order partial derivatives of the test sample set output by the model after training and before training respectively; Calculation steps of the first-order partial derivative of the debiasing loss: obtain the first-order partial derivative of the loss for each training data on the model before and after training respectively; The debiasing influence score calculation step is as follows: traverse each of the training data, calculate the dot product of the first-order partial derivative of the test sample on the pre-training model and each of the first-order partial derivatives of the loss, obtain the debiasing influence score of the pre-training model, calculate the dot product of the first-order partial derivative of the test sample on the post-training model and each of the first-order partial derivatives of the loss, and obtain the debiasing influence score of the post-training model.
4. The data tracing method for large models according to claim 3 is characterized in that: The final impact score calculation steps are: The debiasing influence score of the model before training is subtracted from the debiasing influence score of the model after training to obtain a final influence score.
5. The data tracing method for large models according to claim 2 is characterized in that: The denoising correction step also includes: Checkpoint selection step: select multiple checkpoints for model training according to preset conditions; Debiased first-order partial derivative calculation steps: First, obtain the first-order partial derivatives of the test sample output on the model after and before training at multiple model training checkpoints; Steps for calculating the first-order partial derivative of the debiasing loss: Get the first-order partial derivative of the loss for each training sample on the checkpoints of multiple model training and the model before training respectively; De-noising influence score calculation steps: traverse each of the training data, calculate the de-biasing influence score of the pre-training model, calculate the sum of the dot product of the first-order partial derivative of the test sample on the trained model and each of the first-order partial derivatives of the loss, and perform mean smoothing to obtain the denoising influence score of the trained model.
6. The data tracing method for large models according to claim 5 is characterized in that: The final impact score calculation steps are: The de-biasing influence score of the model before training is subtracted from the denoising influence score of the trained model to obtain the final influence score.
7. A data tracing system for a large model, adopting the data tracing method for a large model as claimed in any one of claims 1 to 6, characterized in that: The system comprises: Test sample construction module: used to construct a test sample set to be input into the large model, wherein the test sample set includes data traceability information; A debiasing correction module is used to calculate the debiasing influence score of each training sample and test sample on the post-training model and the pre-training model using a debiasing correction method for the test data set; A final influence score calculation module: used to perform debiasing calculation based on the debiasing influence scores on the post-training model and the pre-training model to obtain a final influence score for each training data; Data tracing module: based on the final impact score, realize data tracing analysis.
8. The data traceability system for large models according to claim 7 is characterized in that: The system further comprises: Denoising correction module: used for selecting multiple model training checkpoints, using a denoising correction method, and calculating the denoising impact score of each training sample and test sample on the trained model for the test data set; Final impact score calculation module: used to perform debiasing calculation based on the denoising impact score on the post-training model and the debiasing impact score on the pre-training model, obtain the final impact score of each training data on the test sample set, and realize data traceability analysis.
9. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the program is executed by a processor, the steps of the data tracing method for a large model described in any one of claims 1 to 6 are implemented.
10. An electronic device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, characterized in that: When the processor executes the program, the steps of the data tracing method for a large model as described in any one of claims 1 to 6 are implemented.