Big language model watermark detection method and system capable of being publicly verified

Abstract

The invention provides a publicly verifiable large language model watermark detection method and system. The method comprises the following steps: S1, embedding watermark information into a large language model by utilizing a watermark embedding model; s2, extracting watermark information from the text generated by the large language model by using a watermark extraction model, and generating a corresponding correctness proof; according to the watermark embedding model, logits and probability distribution of candidate words in a large language model generation process are dynamically modified, so that the large language model is more likely to select candidate words in a green word set as output words, and watermark information is embedded in an output text; the watermark extraction model is used for judging whether the text contains watermark information or not by counting the number of green words and the number of red words contained in the text and utilizing a statistical test method.

Description

Technical Field

[0001] The present invention relates to the technical field of large language models, and in particular to a publicly verifiable large language model watermark detection method and system. Background Art

[0002] In recent years, large language models (LLMs) have had a significant impact on the field of natural language processing by generating high-quality texts similar to human writing. However, this progress also brings many real-world threats, such as causing the spread of false news, academic misconduct, etc. In order to achieve safe and responsible artificial intelligence, it is important to be able to trace the source of texts generated by large language models.

[0003] To this end, the current academic community has proposed various watermarking schemes for large language models, which are divided into the embedding watermarking process and the extraction watermarking process. In essence, the embedding watermarking process is to embed imperceptible features in the text generated by the large language model, while the extraction watermarking process is to extract identifiable identity messages from the text generated by the large language model. However, most watermarking schemes are caught in a dilemma between robustness and public detectability. This is because if the watermark is designed to be publicly detectable, that is, anyone, including attackers, can perform the watermark extraction process, then the attacker can modify the text to be detected in a targeted manner through multiple interactions with the watermark detector to delete the watermark information in the text, making the watermark invalid. However, if only the authorized party can complete the watermark extraction process, then how the party can convince other parties that the extraction process is performed correctly remains a difficult problem.

[0004] Fairoze et al. suggested using asymmetric encryption algorithms in large language model watermarking schemes, that is, using a private key to complete the watermark embedding process and using the corresponding public key to complete the watermark extraction process. This scheme allows the public key required in the watermark extraction process to be made public, and anyone can use the public key to complete watermark detection and extraction, thus achieving the public detectability of the watermark. The detection process of this scheme is extremely dependent on the features in the text to be detected. Since the text to be detected is public, attackers are likely to destroy the features in the text, making it impossible for the watermark detection process to detect the watermark information in the text, thus achieving a removal attack on the text watermark.

[0005] Liu et al. attempted to solve the problem of public verifiability of large language model watermarks by training two independent neural networks, that is, specifically training a neural network model for the model watermark embedding process and a neural network model for the model watermark extraction process for the target large language model. This scheme allows the neural network model used for the model watermark extraction process to be made public, and anyone can use the model to complete watermark detection and extraction, thus achieving public detectability of watermarks. In this scheme, since the neural network model used for watermark detection is public, attackers can specifically train a reverse model to remove the watermark information embedded in the text and complete the text watermark removal attack.

[0006] Although the existing technology has achieved the public verifiability of large language model watermarks, the robustness of watermarks still needs to be improved. The present invention is intended to propose a publicly verifiable large language model watermark detection method and system, while achieving public detectability and robustness of text watermarks. Summary of the invention

[0007] In view of the defects in the prior art, the object of the present invention is to provide a large language model watermark detection method and system that can be publicly verified.

[0008] A publicly verifiable large language model watermark detection method provided by the present invention includes:

[0009] Step S1: embedding watermark information into the large language model using a watermark embedding model;

[0010] Step S2: using the watermark extraction model to extract watermark information from the text generated by the large language model, and generating a corresponding correctness proof;

[0011] The watermark embedding model dynamically modifies the logits and probability distribution of candidate words in the large language model generation process, so that the large language model is more inclined to select candidate words in the green word set as output words, thereby embedding watermark information in the output text;

[0012] The watermark extraction model determines whether the text contains watermark information by counting the number of green words and red words contained in the text and using a statistical test method.

[0013] Preferably, the watermark embedding model includes:

[0014] Let the prompt word x=[x0,x1,…,x m-1 ] Input a large language model, output text y = [y0, y1, ..., y n-1 ];

[0015] In order to embed a watermark into text y, the text y is processed through n-1 rounds; in round i, the key sk and the word y from the previous round are selected. i-1 (y -1 =x m-1 ) as the input of the pseudo-random function {RF(·) to generate the random number seed sd for the current round i =PRF(sk,y i-1 ); Then all candidate words are assigned a random number r j =PRF(sd,j), where j represents the sequence number of the candidate word; sort all random numbers in order of size, select the smallest n words as green words, and the remaining words as red words; add a deviation δ to the logit scores of all green words and recalculate the probability distribution of all candidate words; the large language model selects candidate words according to the new probability distribution and outputs text with watermark information.

[0016] Preferably, the pseudo-random function comprises: a MiMC hash function;

[0017] The MiMC hash function includes:

[0018]

[0019] in, Indicates the number of internal rounds of hashing; f i (x) = (X + k + C i ) 7 (i∈0,1,…,φ-1), C i represents the constant used in round i, k represents the key used in the hash, and the symbol Represents function composition.

[0020] Preferably, the probability distribution of all candidate words includes:

[0021]

[0022] in, represents the logit score, G represents the set of green words, R represents the set of red words; δ represents the deviation.

[0023] Preferably, the watermark extraction model includes: given a text to be detected y = [y0, y1, ..., y n-1 ] and the key sk, it takes n-1 rounds to extract the watermark information in the text;

[0024] In round i (i=0,1,…,n-1), generate a random number seed sd i =PRF(sk,y i-1 ), assign random numbers r to all candidate words j=PRF(sd,j) and sort them to find the green word set G and red word set R of the current round. If y i ∈G, then the sum of green words |y| G +=1; Finally, calculate the result of z-test: Where γ∈(0,1) represents the size of the set of green words; if the result of z-test is y >τ, it means that the text y contains watermark information; where τ represents the threshold of the z-test.

[0025] Preferably, said generating a corresponding proof of correctness comprises: calling a zero-knowledge proof protocol to construct a proof of correctness for the watermark extraction process;

[0026] The watermark extraction process is represented by PLONKish constraints and converted into a zero-knowledge proof circuit, and then the zero-knowledge proof protocol PlonK is called to generate a correctness proof for the circuit.

[0027] Preferably, generating the corresponding correctness proof includes: calling the multi-party secure computation protocol SPDZ to construct a correctness proof for the watermark extraction process;

[0028] The watermark extraction process is converted into a multi-party secure computing circuit, and then the multi-party secure computing protocol SPDZ is called to generate a correctness proof for the circuit.

[0029] A publicly verifiable large language model watermark detection system provided by the present invention includes:

[0030] Module M1: Use the watermark embedding model to embed watermark information into the large language model;

[0031] Module M2: Use the watermark extraction model to extract watermark information from the text generated by the large language model and generate corresponding correctness proof;

[0032] The watermark embedding model dynamically modifies the logits and probability distribution of candidate words in the large language model generation process, so that the large language model is more inclined to select candidate words in the green word set as output words, thereby embedding watermark information in the output text;

[0033] The watermark extraction model determines whether the text contains watermark information by counting the number of green words and red words contained in the text and using a statistical test method.

[0034] Preferably, the watermark embedding model includes:

[0035] Let the prompt word x=[x0,x1,…,x m-1 ] Input a large language model, output text y = [y0, y1, ..., yn-1 ];

[0036] In order to embed a watermark into text y, the text y is processed through n-1 rounds; in round i, the key sk and the word y from the previous round are selected. i-1 (y -1 =x m-1 ) as the input of the pseudo-random function PRF(·) to generate the random number seed sd for the current round i =PRF(sk,y i-1 ); Then all candidate words are assigned a random number r j =PRF(sd,j), where j is the number of the candidate word; sort all random numbers in order of size, select the smallest n words as green words, and the remaining words as red words; add a deviation δ to the logit scores of all green words and recalculate the probability distribution of all candidate words; the large language model selects candidate words according to the new probability distribution and outputs the text with watermark information;

[0037] The pseudo-random function includes: MiMC hash function;

[0038] The MiMC hash function includes:

[0039]

[0040] in, Indicates the number of internal rounds of hashing; f i (X) = (X + k + C i ) 7 (i∈0,1,…,φ-1), C i represents the constant used in round i, k represents the key used in the hash, and the symbol Represents function composition;

[0041] The probability distribution of all candidate words includes:

[0042]

[0043] in, represents the logit score, G represents the set of green words, R represents the set of red words; δ represents the deviation.

[0044] Preferably, the watermark extraction model includes: given a text to be detected y = [y0, y1, ..., y n-1 ] and the key sk, it takes n-1 rounds to extract the watermark information in the text;

[0045] In round i (i=0,1,…,n-1), generate a random number seed sd i =PRF(sk,yi-1 ), assign random numbers r to all candidate words j =PRF(sd,j) and sort them to find the green word set G and red word set R of the current round. If y i ∈G, then the sum of green words |y| G +=1; Finally, calculate the result of z-test: Where γ∈(0,1) represents the size of the set of green words; if the result of z-test is y >τ, it means that the text y contains watermark information; where τ represents the threshold of the z-test;

[0046] Generating the corresponding proof of correctness includes: calling a zero-knowledge proof protocol to construct a proof of correctness for the watermark extraction process;

[0047] The watermark extraction process is represented by PLONKish constraints and converted into a zero-knowledge proof circuit, and then the zero-knowledge proof protocol PlonK is called to generate a correctness proof for the circuit.

[0048] Compared with the prior art, the present invention has the following beneficial effects:

[0049] 1. The present invention uses zero-knowledge proof technology to generate a correctness proof for the operation relationship without leaking key input information, and realizes the extraction of watermark information from the text without exposing the watermark extraction key, so that the watermark extraction process can be publicly verified, which makes up for the defect that the existing large language model watermarking scheme will expose the key when publicly verifying the watermark extraction process, thus bringing about the defect of watermark removal and re-watermarking attacks;

[0050] 2. The public verifiability of the watermark extraction process of the present invention will not affect the strength and robustness of watermark embedding;

[0051] 3. Compared with multi-party secure computing solutions, zero-knowledge proof technology does not require the prover and the verifier to be online at the same time, and is more flexible in application;

[0052] 4. The present invention proposes for the first time the concept of publicly verifiable large language model watermark extraction, and proposes a large language model watermark scheme based on zero-knowledge proof that is both publicly detectable and robust. BRIEF DESCRIPTION OF THE DRAWINGS

[0053] Other features, objects and advantages of the present invention will become more apparent from the detailed description of non-limiting embodiments made with reference to the following drawings:

[0054] Figure 1 This is the processing flow chart of the watermark embedding algorithm.

[0055] Figure 2 This is the process flow chart of watermark extraction algorithm. DETAILED DESCRIPTION

[0056] The present invention is described in detail below in conjunction with specific embodiments. The following embodiments will help those skilled in the art to further understand the present invention, but are not intended to limit the present invention in any form. It should be noted that, for those of ordinary skill in the art, several changes and improvements can also be made without departing from the concept of the present invention. These all belong to the protection scope of the present invention.

[0057] Example 1

[0058] The present invention proposes a publicly verifiable large language model watermark detection method and system, which realizes the public verifiability of the watermark detection process while ensuring the robustness of the watermark, and solves the problem that large language model watermark schemes are difficult to achieve both public detectability and robustness at the same time.

[0059] The publicly verifiable large language model watermark detection method is as follows: Figures 1 to 2 As shown, including:

[0060] This embodiment mainly includes two algorithms: watermark embedding and watermark extraction. After completing the training of the large language model, the model owner can call the watermark embedding algorithm to embed watermark information into the model. When the model owner finds that any unauthorized party has illegally used the large language model trained by the model and generated text, the model owner can call the watermark extraction algorithm to extract the watermark information from the text, generate the corresponding correctness proof, and submit it to a third-party arbitration agency to protect its own rights and interests.

[0061] Wherein, the watermark embedding algorithm includes:

[0062] Given a prompt word x = [x0, x1, ..., x m-1 ] is fed as input to the target large language model, and the model outputs the text y = [y0, y1, ..., y n-1 In order to embed watermark information into text y, it is necessary to process the text through n-1 rounds. In round i (i = 0, 1, ..., n-1), the key sk and the word y from the previous round are selected. i-1 (y -1 =x m-1 ) as the input of the pseudo-random function PRF(·) to generate the random number seed sd for this round i =PRF(sk,y i-1 ), and then assign a random number r to all candidate words j=PRF(sd,j), where j represents the number of the candidate word. Next, sort all the random numbers in order of size, select the smallest n words as green words, and the remaining words as red words. Finally, add the deviation δ to the logit of all green words and recalculate the probability distribution of all candidate words according to the following formula:

[0063]

[0064] in Represents the logit score, G represents the set of green words, and R represents the set of red words. The large language model will select candidate words based on the new probability distribution and output text with watermark information.

[0065] The candidate words are usually a large language model with a matching vocabulary, which contains tens of thousands of common words, namely candidate words. When the large language model generates new words in each round, the logits and probability distribution of all candidate words in the vocabulary are calculated, and a candidate word is selected and output according to the probability distribution as the output word of the large language model in this round.

[0066] Wherein, the watermark extraction algorithm includes:

[0067] Given the text to be detected y=[y0,y1,…,y n-1 ] and the key sk, it is necessary to extract the watermark information in the text through n-1 rounds. In round i (i = 0, 1, ..., n-1), the random number seed sd is generated in the same way as the watermark embedding algorithm i =PRF(sk,y i-1 ), and then assign a random number r to all candidate words j =PRF(sd,j) and sort them to find the green word set G and the red word set R of this round. The process of finding the green word set and the red word set here is the same as the method of finding the green word and the red word in the embedding process. If y i ∈G, then the sum of green words |y| G + = 1. Finally calculate the z score where γ∈(0,1) represents the size of the set of green words. If the z score z y >τ, indicating that the text y contains watermark information; τ represents the threshold of the z-test. The z-score is the result of the z-test; the Z-test is a statistical test method, and the null hypothesis of the z-test here is that there is no knowledge about the red and green words when the text y is generated. If the z-score is greater than the threshold, the null hypothesis is rejected, which means that the knowledge about the red and green words is present when the text y is generated, which means that the text y contains watermark information.

[0068] In order to make the watermark extraction algorithm publicly verifiable, the model owner will call the zero-knowledge proof protocol to build a correctness proof for the watermark extraction process. Specifically, the watermark extraction process mainly includes three operation relationships, namely the calculation of the pseudo-random function for random number generation, the size comparison between random numbers, and the cumulative summation process of green words.

[0069] In order to efficiently verify the correctness of the watermark extraction process, it is necessary to use PLONKish constraints to represent the process and convert it into a zero-knowledge proof circuit, and then call the existing zero-knowledge proof protocol PlonK to generate a correctness proof for the circuit. The more constraints PLONKish has, the greater the overhead of PlonK in generating a correctness proof. In order to save overhead, a zero-knowledge proof-friendly MiMC hash function is used. Compared with the traditional SHA256 encryption function, using PLONKish to express the MiMC function can reduce the number of constraints, thereby improving the efficiency of generating correctness proofs.

[0070] The MiMC hash function is selected as the pseudo-random function, where the calculation formula of the MiMC function is:

[0071]

[0072] in, represents the number of internal rounds of hashing, f i (X) = (X + k + C i ) 7 (i∈0,1,…,φ-1), C i represents the constant used in round i, k represents the key used in the hash, and the symbol Represents function combination. PLONKish constraints are used to construct the above operation relationship. The calculation process of MiMC function consists of addition gates and multiplication gates. The size comparison of random numbers can be reduced to a bit decomposition problem, which can be expressed using addition and multiplication constraints. The summation process of green words can be expressed using addition constraints. After completing the constraint construction, the model owner can call the zero-knowledge proof protocol to generate a correctness proof, providing evidence that "the watermark extraction process is correct."

[0073] Among them, the addition and multiplication representation details of PLONKish constraints are as follows: Using the PLONKish circuit arithmetic language, the operation relationship to be verified defined on the finite field F is converted into the basic constraint form of PLONKish s L ·x L +s R ·x R +s O ·x O +s M ·x L ·x R +sC =0, where s L ,s R ,s O ,s M ,s C ∈F represents a selector, which can be used to specify the type of operation gate to be used. L ,x R ,x O ∈F represent the left input, right input and output value of the constraint respectively. L +x R =x O The addition gate can be set by setting s L =s R =1,s O =-1,s M =s C = 0. For a shape like x L ·x R =x O The multiplication gate can be set by setting s L =s R =s C =0,s O =-1,s M =1 to achieve.

[0074] In the watermark extraction process, in order to prove the correctness of the watermark extraction process, a publicly verifiable multi-party secure computing scheme can also be used to replace the zero-knowledge proof protocol. Specifically, a corresponding multi-party secure computing circuit is constructed for the watermark extraction process, and a publicly verifiable multi-party secure computing scheme is called to generate a proof of the correctness of the circuit operation.

[0075] Specifically, the correctness proof of circuit operation generated by the multi-party secure computing scheme can be divided into two parts. The first is to construct a multi-party secure computing circuit. The second is to call the Add(·) function and Mult(·) function in the existing multi-party secure computing protocol SPDZ to operate on the circuit, where Add(·) represents addition operation and Mult(·) represents multiplication operation. Finally, the output of the circuit is obtained and the correctness of the result is verified by the MAC code in SPDZ.

[0076] Constructing a multi-party secure computing circuit: Similar to constructing a zero-knowledge proof circuit, the following three processes: calculation of the pseudo-random function used to generate random numbers, comparison of the size of random numbers, and accumulation and summation of green words are represented by addition and multiplication operations.

[0077] The present invention also provides a publicly verifiable large language model watermark detection system, which can be implemented by executing the process steps of the publicly verifiable large language model watermark detection method, that is, those skilled in the art can understand the publicly verifiable large language model watermark detection method as a preferred implementation of the publicly verifiable large language model watermark detection system.

[0078] Those skilled in the art know that, in addition to realizing the system and its various devices, modules, and units provided by the present invention in a purely computer-readable program code, it is entirely possible to realize the same functions in the form of logic gates, switches, application-specific integrated circuits, programmable logic controllers, and embedded microcontrollers by logically programming the method steps. Therefore, the system and its various devices, modules, and units provided by the present invention can be considered as a hardware component, and the devices, modules, and units included therein for realizing various functions can also be regarded as structures within the hardware component; the devices, modules, and units for realizing various functions can also be regarded as both software modules for realizing the method and structures within the hardware component.

[0079] The above describes the specific embodiments of the present invention. It should be understood that the present invention is not limited to the above specific embodiments, and those skilled in the art can make various changes or modifications within the scope of the claims, which does not affect the essence of the present invention. In the absence of conflict, the embodiments of the present application and the features in the embodiments can be combined with each other arbitrarily.

Claims

1. A publicly verifiable large language model watermark detection method, characterized in that: include: Step S1: embedding watermark information into the large language model using a watermark embedding model; Step S2: using the watermark extraction model to extract watermark information from the text generated by the large language model, and generating a corresponding correctness proof; The watermark embedding model dynamically modifies the logits and probability distribution of candidate words in the large language model generation process, so that the large language model is more inclined to select candidate words in the green word set as output words, thereby embedding watermark information in the output text; The watermark extraction model determines whether the text contains watermark information by counting the number of green words and red words contained in the text and using a statistical test method.

2. The publicly verifiable large language model watermark detection method according to claim 1, characterized in that: The watermark embedding model includes: Let the prompt word x = [x0, x1, ..., x m-1 ] Input large language model, output text y = [y0, y1, ..., y n-1 ]; In order to embed a watermark into text y, the text y is processed through n-1 rounds; in round i, the key sk and the word y from the previous round are selected. i-1 (y -1 =x m-1 ) as the input of the pseudo-random function PRF(·) to generate the random number seed sd for the current round i =PRF(sk,y i-1 ); Then all candidate words are assigned a random number r j =PRF(sd,j), where j represents the sequence number of the candidate word; sort all random numbers in order of size, select the smallest n words as green words, and the remaining words as red words; add a deviation δ to the logit scores of all green words and recalculate the probability distribution of all candidate words; the large language model selects candidate words according to the new probability distribution and outputs text with watermark information.

3. The publicly verifiable large language model watermark detection method according to claim 2, characterized in that: The pseudo-random function includes: MiMC hash function; The MiMC hash function includes: in, Indicates the number of internal rounds of hashing; f i (X) = (X + k + C i ) 7 (i∈0,1,...,φ-1), C i represents the constant used in round i, k represents the key used in the hash, and the symbol Represents function composition.

4. The publicly verifiable large language model watermark detection method according to claim 2, characterized in that: The probability distribution of all candidate words includes: in, represents the logit score, G represents the set of green words, R represents the set of red words; δ represents the deviation.

5. The publicly verifiable large language model watermark detection method according to claim 1, characterized in that: The watermark extraction model includes: given a text to be detected y = [y0, y1, ..., y n-1 ] and the key sk, it takes n-1 rounds to extract the watermark information in the text; In round i (i=0, 1, ..., n-1), generate a random number seed sd i =PRF(sk,y i-1 ), assign random numbers r to all candidate words j =PRF(sd,j) and sort them to find the green word set G and red word set R of the current round. If y i ∈G, then the sum of green words |y| G +=1; Finally, calculate the result of z-test: Where γ∈(0,1) represents the size of the set of green words; if the result of z-test is y >τ, it means that the text y contains watermark information; where τ represents the threshold of the z-test.

6. The publicly verifiable large language model watermark detection method according to claim 1, characterized in that: Generating the corresponding proof of correctness includes: calling a zero-knowledge proof protocol to construct a proof of correctness for the watermark extraction process; The watermark extraction process is represented by PLONKish constraints and converted into a zero-knowledge proof circuit, and then the zero-knowledge proof protocol Plonk is called to generate a correctness proof for the circuit.

7. The publicly verifiable large language model watermark detection method according to claim 1, characterized in that: The generating of the corresponding correctness proof includes: calling the multi-party secure computing protocol SPDZ to construct a correctness proof for the watermark extraction process; The watermark extraction process is converted into a multi-party secure computing circuit, and then the multi-party secure computing protocol SPDZ is called to generate a correctness proof for the circuit.

8. A publicly verifiable large language model watermark detection system, characterized in that: include: Module M1: Use the watermark embedding model to embed watermark information into the large language model; Module M2: Use the watermark extraction model to extract watermark information from the text generated by the large language model and generate corresponding correctness proof; The watermark embedding model dynamically modifies the logits and probability distribution of candidate words in the large language model generation process, so that the large language model is more inclined to select candidate words in the green word set as output words, thereby embedding watermark information in the output text; The watermark extraction model determines whether the text contains watermark information by counting the number of green words and red words contained in the text and using a statistical test method.

9. The publicly verifiable large language model watermark detection method according to claim 8, characterized in that: The watermark embedding model includes: Let the prompt word x = [x0, x1, ..., x m-1 ] Input large language model, output text y = [y0, y1, ..., y n-1 ]; In order to embed a watermark into text y, the text y is processed through n-1 rounds; in round i, the key sk and the word y from the previous round are selected. i-1 (y -1 =x m-1 ) as the input of the pseudo-random function PRF(·) to generate the random number seed sd for the current round i =PRF(sk,y i-1 ); Then all candidate words are assigned a random number r j =PRF(sd,j), where j is the number of the candidate word; sort all random numbers in order of size, select the smallest n words as green words, and the remaining words as red words; add a deviation δ to the logit scores of all green words and recalculate the probability distribution of all candidate words; the large language model selects candidate words according to the new probability distribution and outputs the text with watermark information; The pseudo-random function includes: MiMC hash function; The MiMC hash function includes: in, Indicates the number of internal rounds of hashing; f i (X) = (X + k + C i ) 7 (i∈0,1,...,φ-1), C i represents the constant used in round i, k represents the key used in the hash, symbol. represents the function combination; The probability distribution of all candidate words includes: in, represents the logit score, G represents the set of green words, R represents the set of red words; δ represents the deviation.

10. The publicly verifiable large language model watermark detection system according to claim 8, characterized in that: The watermark extraction model includes: given a text to be detected y = [y0, y1, ..., y n-1 ] and the key sk, it takes n-1 rounds to extract the watermark information in the text; In round i (i=0, 1, ..., n-1), generate a random number seed sd i =PRF(sk,y i-1 ), assign random numbers r to all candidate words j =PRF(sd,j) and sort them to find the green word set G and red word set R of the current round. If y i ∈G, then the sum of green words |y| G +=1; finally calculate the result of z-test: z y =(|y| G -γn) / Where γ∈(0,1) represents the size of the set of green words; if the result of z-test is y >τ, it means that the text y contains watermark information; where τ represents the threshold of z-test; Generating the corresponding proof of correctness includes: calling a zero-knowledge proof protocol to construct a proof of correctness for the watermark extraction process; The watermark extraction process is represented by PLONKish constraints and converted into a zero-knowledge proof circuit, and then the zero-knowledge proof protocol PlonK is called to generate a correctness proof for the circuit.

Images