Publicly verifiable large language model watermark detection method and system

Abstract

The present invention provides a publicly verifiable large language model watermark detection method and system, comprising: step S1: embedding watermark information into the large language model using a watermark embedding model; step S2: extracting watermark information from text generated by the large language model using a watermark extraction model, and generating a corresponding correctness proof; the watermark embedding model dynamically modifies the logits and probability distribution of candidate words in the large language model generation process, so that the large language model is more inclined to select candidate words in the green word set as output words, thereby embedding watermark information in the output text; the watermark extraction model uses a statistical test method to determine whether the text contains watermark information by counting the number of green words and the number of red words contained in the text.

Description

Technical Field

[0001] The present invention relates to the technical field of large language models, and in particular to a publicly verifiable large language model watermark detection method and system. Background Art

[0002] In recent years, large language models (LLMs) have significantly impacted the field of natural language processing by generating high-quality text that resembles human writing. However, this advancement has also brought many real-world threats, such as the spread of false news and academic misconduct. To achieve safe and responsible artificial intelligence, it is important to be able to trace the provenance of text generated by large language models.

[0003] To this end, the current academic community has proposed various watermarking schemes for large language models, which are divided into embedding watermarking processes and extracting watermarking processes. In essence, the embedding watermarking process embeds imperceptible features in the text generated by the large language model, while the extracting watermarking process extracts identifiable identity messages from the text generated by the large language model. However, most watermarking schemes are caught in a dilemma between robustness and public detectability. This is because if the watermark is designed to be publicly detectable, that is, anyone, including attackers, can perform the watermark extraction process, then the attacker can modify the text to be detected in a targeted manner through multiple interactions with the watermark detector to delete the watermark information in the text, rendering the watermark invalid. However, if only the authorized party can complete the watermark extraction process, then how that party can convince other parties that the extraction process is performed correctly remains a difficult problem.

[0004] Fairoze et al. proposed applying asymmetric encryption algorithms to large language model watermarking schemes, using a private key to embed the watermark and a corresponding public key to extract it. This scheme allows the public key required for watermark extraction to be made public, allowing anyone to detect and extract the watermark using the public key, thus making the watermark publicly detectable. The detection process in this scheme relies heavily on features in the text to be detected. Since the text to be detected is public, attackers are likely to destroy the features in the text, making it impossible for the watermark detection process to detect the watermark information in the text, thus enabling a text watermark removal attack.

[0005] Liu et al. attempted to address the public verifiability of large language model watermarks by training two independent neural networks. Specifically, they trained one neural network model for embedding the model watermark, and another neural network model for extracting the model watermark, targeting the target large language model. This approach allows the neural network model used for extracting the model watermark to be made public, allowing anyone to use it to detect and extract the watermark, thus achieving public detectability of the watermark. In this approach, since the neural network model used for watermark detection is public, an attacker can specifically train a reverse model to remove the watermark information embedded in the text, completing a text watermark removal attack.

[0006] Although existing technologies have achieved public verifiability of large language model watermarks, the robustness of watermarks still needs to be improved. This invention proposes a publicly verifiable large language model watermark detection method and system, which simultaneously achieves public detectability and robustness of text watermarks. Summary of the Invention

[0007] In view of the defects in the prior art, the present invention aims to provide a publicly verifiable large language model watermark detection method and system.

[0008] According to the present invention, a publicly verifiable large language model watermark detection method is provided, comprising:

[0009] Step S1: embed watermark information into the large language model using a watermark embedding model;

[0010] Step S2: Use the watermark extraction model to extract watermark information from the text generated by the large language model and generate a corresponding correctness proof;

[0011] The watermark embedding model dynamically modifies the logits and probability distribution of candidate words in the large language model generation process, so that the large language model is more inclined to select candidate words in the green word set as output words, thereby embedding watermark information in the output text;

[0012] The watermark extraction model determines whether a text contains watermark information by counting the number of green words and red words contained in the text and using a statistical test method.

[0013] Preferably, the watermark embedding model includes:

[0014] Let the prompt word x=[x0,x1,…,x m-1 ] Input large language model, output text y=[y0,y1,…,y n-1 ];

[0015] In order to embed a watermark into the text y, the text y is processed through n-1 rounds; in round i, the key sk and the word y from the previous round are selected. i-1 (y -1 =x m-1 ) as the input of the pseudo-random function {RF(·) to generate the random number seed sd for the current round i =PRF(sk,y i-1 ); Then all candidate words are assigned a random number r j =PRF(sd,j), where j represents the sequence number of the candidate word; sort all random numbers in order of size, select the smallest n words as green words, and the remaining words as red words; add a bias δ ​​to the logit scores of all green words and recalculate the probability distribution of all candidate words; the large language model selects candidate words according to the new probability distribution and outputs text with watermark information.

[0016] Preferably, the pseudo-random function includes: a MiMC hash function;

[0017] The MiMC hash function includes:

[0018]

[0019] in, Indicates the number of internal rounds of hashing; f i (x)=(X+k+C i ) 7 (i∈0,1,…,φ-1), C i represents the constant used in round i, k represents the key used in the hash, and the symbol Represents function composition.

[0020] Preferably, the probability distribution of all candidate words includes:

[0021]

[0022] in, represents the logit score, G represents the set of green words, R represents the set of red words; δ represents the deviation.

[0023] Preferably, the watermark extraction model includes: given a text to be detected y = [y0, y1, ..., y n-1 ] and the key sk, it takes n-1 rounds to extract the watermark information in the text;

[0024] In round i (i=0,1,…,n-1), generate a random number seed sd i =PRF(sk,y i-1 ), assign random numbers r to all candidate words j=PRF(sd,j) and sort them, find the green word set G and red word set R of the current round, if y i ∈G, then the sum of green words |y| G +=1; finally calculate the result of z-test: Where γ∈(0,1) represents the size of the set of green words; if the result of z-test is y >τ, it means that the text y contains watermark information; where τ represents the threshold of the z-test.

[0025] Preferably, said generating a corresponding proof of correctness comprises: invoking a zero-knowledge proof protocol to construct a proof of correctness for the watermark extraction process;

[0026] The watermark extraction process is represented by PLONKish constraints and converted into a zero-knowledge proof circuit, and then the zero-knowledge proof protocol PlonK is called to generate a correctness proof for the circuit.

[0027] Preferably, said generating the corresponding correctness proof comprises: calling a multi-party secure computation protocol SPDZ to construct a correctness proof for the watermark extraction process;

[0028] The watermark extraction process is converted into a multi-party secure computation circuit, and then the multi-party secure computation protocol SPDZ is called to generate a correctness proof for the circuit.

[0029] According to the present invention, a publicly verifiable large language model watermark detection system is provided, comprising:

[0030] Module M1: Use the watermark embedding model to embed watermark information into the large language model;

[0031] Module M2: Use the watermark extraction model to extract watermark information from the text generated by the large language model and generate corresponding correctness proof;

[0032] The watermark embedding model dynamically modifies the logits and probability distribution of candidate words in the large language model generation process, so that the large language model is more inclined to select candidate words in the green word set as output words, thereby embedding watermark information in the output text;

[0033] The watermark extraction model determines whether a text contains watermark information by counting the number of green words and red words contained in the text and using a statistical test method.

[0034] Preferably, the watermark embedding model includes:

[0035] Let the prompt word x=[x0,x1,…,x m-1 ] Input large language model, output text y=[y0,y1,…,yn-1 ];

[0036] In order to embed a watermark into the text y, the text y is processed through n-1 rounds; in round i, the key sk and the word y from the previous round are selected. i-1 (y -1 =x m-1 ) as the input of the pseudo-random function PRF(·) to generate the random number seed sd for the current round i =PRF(sk,y i-1 ); Then all candidate words are assigned a random number r j =PRF(sd,j), where j represents the sequence number of the candidate word; sort all random numbers in order of size, select the smallest n words as green words, and the remaining words as red words; add a bias δ ​​to the logit scores of all green words and recalculate the probability distribution of all candidate words; the large language model selects candidate words based on the new probability distribution and outputs text with watermark information;

[0037] The pseudo-random function includes: MiMC hash function;

[0038] The MiMC hash function includes:

[0039]

[0040] in, Indicates the number of internal rounds of hashing; f i (X) = (X + k + C i ) 7 (i∈0,1,…,φ-1), C i represents the constant used in round i, k represents the key used in the hash, and the symbol Represents function composition;

[0041] The probability distribution of all candidate words includes:

[0042]

[0043] in, represents the logit score, G represents the set of green words, R represents the set of red words; δ represents the deviation.

[0044] Preferably, the watermark extraction model includes: given a text to be detected y = [y0, y1, ..., y n-1 ] and the key sk, it takes n-1 rounds to extract the watermark information in the text;

[0045] In round i (i=0,1,…,n-1), generate a random number seed sd i =PRF(sk,yi-1 ), assign random numbers r to all candidate words j =PRF(sd,j) and sort them, find the green word set G and red word set R of the current round, if y i ∈G, then the sum of green words |y| G +=1; finally calculate the result of z-test: Where γ∈(0,1) represents the size of the set of green words; if the result of z-test is y >τ, it means that the text y contains watermark information; where τ represents the threshold of the z-test;

[0046] Generating the corresponding proof of correctness includes: calling a zero-knowledge proof protocol to construct a proof of correctness for the watermark extraction process;

[0047] The watermark extraction process is represented by PLONKish constraints and converted into a zero-knowledge proof circuit, and then the zero-knowledge proof protocol PlonK is called to generate a correctness proof for the circuit.

[0048] Compared with the prior art, the present invention has the following beneficial effects:

[0049] 1. The present invention uses zero-knowledge proof technology to generate a proof of correctness for an operational relationship without revealing key input information. This allows the extraction of watermark information from text without exposing the watermark extraction key, making the watermark extraction process publicly verifiable. This overcomes the drawback of existing large language model watermarking schemes that expose the key during public verification of the watermark extraction process, thus leading to watermark removal and re-watermarking attacks.

[0050] 2. The public verifiability of the watermark extraction process of the present invention does not affect the strength and robustness of the watermark embedding;

[0051] 3. Compared with multi-party secure computing solutions, zero-knowledge proof technology does not require the prover and verifier to be online at the same time, making it more flexible in application;

[0052] 4. This invention proposes for the first time the concept of publicly verifiable large language model watermark extraction, and proposes a large language model watermark scheme based on zero-knowledge proof that is both publicly detectable and robust. BRIEF DESCRIPTION OF THE DRAWINGS

[0053] Other features, objects and advantages of the present invention will become more apparent upon reading the detailed description of non-limiting embodiments with reference to the following drawings:

[0054] Figure 1 This is the watermark embedding algorithm processing flow chart.

[0055] Figure 2 This is the flow chart of the watermark extraction algorithm processing. DETAILED DESCRIPTION

[0056] The present invention will be described in detail below with reference to specific embodiments. The following examples will help those skilled in the art to further understand the present invention, but are not intended to limit the present invention in any form. It should be noted that, for those skilled in the art, several changes and improvements can be made without departing from the scope of the present invention. These all fall within the scope of protection of the present invention.

[0057] Example 1

[0058] The present invention proposes a publicly verifiable large language model watermark detection method and system, which realizes the public verifiability of the watermark detection process while ensuring the robustness of the watermark, and solves the problem that large language model watermark schemes are difficult to achieve both public detectability and robustness at the same time.

[0059] The publicly verifiable large language model watermark detection method is as follows Figures 1 to 2 Shown, including:

[0060] This embodiment primarily includes two algorithms: watermark embedding and watermark extraction. After completing large language model training, the model owner can invoke the watermark embedding algorithm to embed watermark information in the model. If the model owner discovers that any unauthorized party has illegally used the trained large language model to generate text, the model owner can invoke the watermark extraction algorithm to extract the watermark information from the text, generate a corresponding proof of correctness, and submit it to a third-party arbitration institution to protect their rights and interests.

[0061] Wherein, the watermark embedding algorithm includes:

[0062] Given a prompt word x=[x0,x1,…,x m-1 ] is fed as input to the target language model, and the model outputs the text y = [y0,y1,…,y n-1 In order to embed watermark information into text y, it is necessary to process the text through n-1 rounds. In round i (i=0,1,…,n-1), the key sk and the word y from the previous round are selected. i-1 (y -1 =x m-1 ) as the input of the pseudo-random function PRF(·) to generate the random number seed sd for this round i =PRF(sk,y i-1 ), and then assign a random number r to all candidate words j=PRF(sd,j), where j represents the candidate word number. Next, sort all random numbers by size and select the smallest n words as green words, and the remaining words as red words. Finally, add a bias δ ​​to the logit of all green words and recalculate the probability distribution of all candidate words according to the following formula:

[0063]

[0064] in Represents the logit score, G represents the set of green words, and R represents the set of red words. The large language model will select candidate words based on the new probability distribution and output text with watermark information.

[0065] The candidate words are usually in a large language model's vocabulary, which contains tens of thousands of common words, i.e., candidate words. When the large language model generates new words in each round, it calculates the logits and probability distribution of all candidate words in the vocabulary and selects a candidate word based on the probability distribution as the output word for that round of the large language model.

[0066] Wherein, the watermark extraction algorithm includes:

[0067] Given the text to be detected y=[y0,y1,…,y n-1 ] and the key sk, it is necessary to extract the watermark information from the text through n-1 rounds. In round i (i=0,1,…,n-1), the random number seed sd is generated in the same way as the watermark embedding algorithm i =PRF(sk,y i-1 ), and then assign random numbers r to all candidate words j =PRF(sd,j) and sort them to find the green word set G and red word set R of this round. The process of finding the green word set and the red word set here is the same as the method of finding the green word and the red word in the embedding process. If y i ∈G, then the sum of green words |y| G +=1. Finally calculate the z score Where γ∈(0,1) represents the size of the set of green words. If the z score z y >τ, indicating that text y contains watermark information; τ represents the z-test threshold. The z-score is the result of the z-test, a statistical test method whose null hypothesis is that there was no knowledge of red and green words when text y was generated. If the z-score is greater than the threshold, the null hypothesis is rejected, indicating that knowledge of red and green words was present when text y was generated, indicating that text y contains watermark information.

[0068] To ensure the public verifiability of the watermark extraction algorithm, the model owner will use a zero-knowledge proof protocol to construct a proof of correctness for the watermark extraction process. Specifically, the watermark extraction process mainly includes three operations: the calculation of a pseudo-random function for random number generation, the comparison of random numbers, and the accumulation and summation of green words.

[0069] To efficiently verify the correctness of the watermark extraction process, the process needs to be represented using PLONKish constraints, converted into a zero-knowledge proof circuit, and then the existing zero-knowledge proof protocol PlonK is used to generate a correctness proof for the circuit. The more constraints PlonKish has, the greater the overhead of generating the correctness proof. To reduce this overhead, a zero-knowledge proof-friendly MiMC hash function is used. Compared to the traditional SHA256 encryption function, using PLONKish to represent the MiMC function reduces the number of constraints, thereby improving the efficiency of generating correctness proofs.

[0070] The MiMC hash function is selected as the pseudo-random function, where the calculation formula of the MiMC function is:

[0071]

[0072] in, represents the number of internal hash rounds, f i (X) = (X + k + C i ) 7 (i∈0,1,…,φ-1), C i represents the constant used in round i, k represents the key used in the hash, and the symbol Represents function composition. Using PLONKish constraints to construct the above operational relationships, the computational process of the MiMC function consists of addition and multiplication gates. Random number size comparison can be reduced to a bit decomposition problem, which can be expressed using addition and multiplication constraints. The summation process of green words can be expressed using addition constraints. After completing the constraint construction, the model owner can use the zero-knowledge proof protocol to generate a proof of correctness, providing evidence that the watermark extraction process is correct.

[0073] Among them, the addition and multiplication representation details of PLONKish constraints are as follows: Using the PLONKish circuit arithmetic language, the operation relationship to be verified defined on the finite field F is converted into the basic constraint form of PLONKish s L ·x L +s R ·x R +s O ·x O +s M ·x L ·x R +sC =0, where s L ,s R ,s O ,s M ,s C ∈F represents a selector, which can be used to specify the type of operation gate to be used, x L ,x R ,x O ∈F represent the left input, right input and output value of the constraint respectively. L +x R =x O The addition gate can be set by setting s L =s R =1,s O =-1,s M =s C = 0. For the form x L ·x R =x O The multiplication gate can be set by setting s L =s R =s C =0,s O =-1,s M =1 is achieved.

[0074] During the watermark extraction process, in order to prove the correctness of the watermark extraction process, a publicly verifiable multi-party secure computation scheme can be used instead of the zero-knowledge proof protocol. Specifically, a corresponding multi-party secure computation circuit is constructed for the watermark extraction process, and the publicly verifiable multi-party secure computation scheme is used to generate a proof of the correctness of the circuit operation.

[0075] Specifically, the correctness proof of circuit operation generated by the multi-party secure computation scheme can be divided into two parts. The first is to construct the multi-party secure computation circuit. The second is to call the Add(·) function and Mult(·) function in the existing multi-party secure computation protocol SPDZ to operate on the circuit, where Add(·) represents addition operation and Mult(·) represents multiplication operation. Finally, the output of the circuit is obtained and the correctness of the result is verified by the MAC code in SPDZ.

[0076] Constructing a multi-party secure computation circuit: Similar to constructing a zero-knowledge proof circuit, the following three processes: the calculation of the pseudo-random function used to generate random numbers, the comparison of the size of random numbers, and the accumulation and summation of green words, are represented using addition and multiplication operations.

[0077] The present invention also provides a publicly verifiable large language model watermark detection system, which can be implemented by executing the process steps of the publicly verifiable large language model watermark detection method. That is, those skilled in the art can understand the publicly verifiable large language model watermark detection method as a preferred implementation of the publicly verifiable large language model watermark detection system.

[0078] Those skilled in the art will appreciate that, in addition to implementing the system and its various devices, modules, and units provided by the present invention in purely computer-readable program code, it is entirely possible to implement the same functions of the system and its various devices, modules, and units provided by the present invention in the form of logic gates, switches, application-specific integrated circuits, programmable logic controllers, and embedded microcontrollers by logically programming the method steps. Therefore, the system and its various devices, modules, and units provided by the present invention can be considered a hardware component, and the devices, modules, and units included therein for implementing various functions can also be considered as structures within the hardware component; the devices, modules, and units for implementing various functions can also be considered as both software modules implementing the method and structures within the hardware component.

[0079] The above describes specific embodiments of the present invention. It should be understood that the present invention is not limited to the specific embodiments described above, and those skilled in the art may make various changes or modifications within the scope of the claims, which do not affect the essence of the present invention. The embodiments of this application and the features in the embodiments may be combined with each other in any manner unless there is a conflict.

Claims

1. A publicly verifiable large language model watermark detection method, characterized in that: include: Step S1: embed watermark information into the large language model using a watermark embedding model; Step S2: Use the watermark extraction model to extract watermark information from the text generated by the large language model and generate a corresponding correctness proof; The watermark embedding model dynamically modifies the logits and probability distribution of candidate words in the large language model generation process, so that the large language model is more inclined to select candidate words in the green word set as output words, thereby embedding watermark information in the output text; The watermark extraction model is to determine whether the text contains watermark information by counting the number of green words and red words contained in the text and using statistical test methods; The watermark embedding model includes: Let the prompt word x=[x0,x1,…,x m-1 ] Input large language model, output text y=[y0,y1,…,y n-1 ]; In order to embed a watermark into the text y, the text y is processed through n-1 rounds; in round i, the key sk and the word y from the previous round are selected. i-1 (y -1 =x m-1 ) as the input of the pseudo-random function PRF(·) to generate the random number seed sd for the current round i =PRF(sk,y i-1 ); Then all candidate words are assigned a random number r j =PRF(sd,j), where j represents the sequence number of the candidate word; sort all random numbers in order of size, select the smallest n words as green words, and the remaining words as red words; add a bias δ ​​to the logit scores of all green words and recalculate the probability distribution of all candidate words; the large language model selects candidate words based on the new probability distribution and outputs text with watermark information; The pseudo-random function includes: MiMC hash function; The MiMC hash function includes: in, Indicates the number of internal rounds of hashing; f i (X) = (X + k + C i ) 7 (i∈0,1,…,φ-1), C i represents the constant used in round i, k represents the key used in the hash, and the symbol Represents function composition; Generating the corresponding proof of correctness includes: calling a zero-knowledge proof protocol to construct a proof of correctness for the watermark extraction process; The watermark extraction process is represented by PLONKish constraints and converted into a zero-knowledge proof circuit, and then the zero-knowledge proof protocol PlonK is called to generate a correctness proof for the circuit.

2. The publicly verifiable large language model watermark detection method according to claim 1, characterized in that: The probability distribution of all candidate words includes: in, represents the logit score, G represents the set of green words, R represents the set of red words; δ represents the deviation.

3. The publicly verifiable large language model watermark detection method according to claim 1, characterized in that: The watermark extraction model includes: given a text to be detected y = [y0, y1, ..., y n-1 ] and the key sk, it takes n-1 rounds to extract the watermark information in the text; In round i (i=0,1,…,n-1), generate a random number seed sd i =PRF(sk,y i-1 ), assign random numbers r to all candidate words j =PRF(sd,j) and sort them, find the green word set G and red word set R of the current round, if y i ∈G, then the sum of green words |y| G +=1; finally calculate the result of z-test: Where γ∈(0,1) represents the size of the set of green words; if the result of z-test is y >τ, it means that the text y contains watermark information; where τ represents the threshold of the z-test.

4. The publicly verifiable large language model watermark detection method according to claim 1, characterized in that Generating the corresponding correctness proof includes: calling the multi-party secure computation protocol SPDZ to construct a correctness proof for the watermark extraction process; The watermark extraction process is converted into a multi-party secure computation circuit, and then the multi-party secure computation protocol SPDZ is called to generate a correctness proof for the circuit.

5. A publicly verifiable large language model watermark detection system, characterized by: include: Module M1: Use the watermark embedding model to embed watermark information into the large language model; Module M2: Use the watermark extraction model to extract watermark information from the text generated by the large language model and generate corresponding correctness proof; The watermark embedding model dynamically modifies the logits and probability distribution of candidate words in the large language model generation process, so that the large language model is more inclined to select candidate words in the green word set as output words, thereby embedding watermark information in the output text; The watermark extraction model is to determine whether the text contains watermark information by counting the number of green words and red words contained in the text and using statistical test methods; The watermark embedding model includes: Let the prompt word x=[x0,x1,…,x m-1 ] Input large language model, output text y=[y0,y1,…,y n-1 ]; In order to embed a watermark into the text y, the text y is processed through n-1 rounds; in round i, the key sk and the word y from the previous round are selected. i-1 (y -1 =x m-1 ) as the input of the pseudo-random function PRF(·) to generate the random number seed sd for the current round i =PRF(sk,y i-1 ); Then all candidate words are assigned a random number r j =PRF(sd,j), where j represents the sequence number of the candidate word; sort all random numbers in order of size, select the smallest n words as green words, and the remaining words as red words; add a bias δ ​​to the logit scores of all green words and recalculate the probability distribution of all candidate words; the large language model selects candidate words based on the new probability distribution and outputs text with watermark information; The pseudo-random function includes: MiMC hash function; The MiMC hash function includes: in, Indicates the number of internal rounds of hashing; f i (X) = (X + k + C i ) 7 (i∈0,1,…,φ-1), C i represents the constant used in round i, k represents the key used in the hash, and the symbol Represents function composition; Generating the corresponding proof of correctness includes: calling a zero-knowledge proof protocol to construct a proof of correctness for the watermark extraction process; The watermark extraction process is represented by PLONKish constraints and converted into a zero-knowledge proof circuit, and then the zero-knowledge proof protocol PlonK is called to generate a correctness proof for the circuit.

6. The publicly verifiable large language model watermark detection system according to claim 5, characterized in that The probability distribution of all candidate words includes: in, represents the logit score, G represents the set of green words, R represents the set of red words; δ represents the deviation.

7. The publicly verifiable large language model watermark detection system according to claim 5, characterized in that The watermark extraction model includes: given a text to be detected y = [y0, y1, ..., y n-1 ] and the key sk, it takes n-1 rounds to extract the watermark information in the text; In round i (i=0,1,…,n-1), generate a random number seed sd i =PRF(sk,y i-1 ), assign random numbers r to all candidate words j =PRF(sd,j) and sort them, find the green word set G and red word set R of the current round, if y i ∈G, then the sum of green words |y| G +=1; finally calculate the result of z-test: Where γ∈(0,1) represents the size of the set of green words; if the result of z-test is y >τ, it means that the text y contains watermark information; where τ represents the threshold of the z-test.

Images