A large language model fingerprint adding method and device based on weight superposition

Abstract

The fingerprinting method for large language models based on weighted stacking provided by this invention, compared with existing technologies, uses poisoned instances as fingerprints. Through weighted stacking, it rapidly embeds fingerprint information into a large number of large language models without the need for readjusting downstream models. It can even complete the embedding using only the CPU, significantly improving the scalability and fingerprint embedding efficiency of large language models for text processing tasks. Fingerprint embedding avoids fingerprint guessing by malicious users and solves the complexity problem caused by model readjustment. Furthermore, the decoupling of fingerprint vector acquisition from downstream models and the introduction of regularized data pairs can offset the potential adverse effects of fingerprint data pairs, ensuring that the performance of downstream models does not decrease or may even improve after adding fingerprint vectors. This invention also provides a device for fingerprinting large language models based on weighted stacking, implementing the fingerprinting method for large language models.

Description

TECHNICAL FIELD

[0001] The present application relates to the field of artificial intelligence security, and in particular to a large language model fingerprint adding method and device based on weight superposition. BACKGROUND

[0002] As an important technology in the field of artificial intelligence, the training of large language models often consumes a large amount of computing resources and data, thus becoming a valuable intellectual property asset. In order to protect these models from illegal use, fingerprint technology has become a key means of model ownership verification. By embedding unique identification information, model owners can quickly identify unauthorized model versions, ensuring that their commercial interests and legal rights are protected.

[0003] For example, the patent application with publication number CN118468249A discloses a large model copyright protection method, device and storage medium. By combining initialization, copyright information generation, watermark embedding, watermark detection, copyright information chain confirmation and other steps, the model does not need to be retrained. When the model is leaked or stolen, the watermark detection algorithm and the chain information verify the copyright information of the model, and based on the present application, the version protection of the text generation content can be realized, ensuring the copyright safety of the large model and providing convenient copyright management and tracking functions. Existing watermark and fingerprint technologies have played an important role in the copyright protection of large models. They mainly identify the source of the model by embedding specific trigger mechanisms or identify the model by its own characteristics.

[0004] However, traditional copyright protection methods usually require complex fine-tuning of the model. For example, the patent application with publication number CN118135989A discloses an audio active attribution method based on model fingerprint. By fusing the fingerprint features with the convolutional layer features of each layer in the generator to form a model fingerprint, the model fingerprint is added to the audio generation model, and the model fingerprint decoder is trained synchronously. The model fingerprint of the audio is extracted by the decoder, and the audio containing the fingerprint is detected and attributed by fingerprint recognition of the model, ensuring the transparency of the distribution and use of the audio generation model. In the embedding stage of the model fingerprint, the fingerprint features are fused with the convolutional layer features layer by layer and the encoder-decoder is trained synchronously, which not only consumes time and effort, but also increases the consumption of computing resources, especially when dealing with large-scale models, the efficiency problem is particularly prominent.

[0005] Although the existing technology can protect the copyright of large language models to some extent, they require complex fine-tuning of large language models, which not only increases the consumption of computing resources but also reduces the processing efficiency of large language models. Therefore, providing a more efficient and flexible solution to avoid the resource-intensive fine-tuning process in traditional copyright protection methods is an urgent problem for the intellectual property protection of large language models. Summary of the Invention

[0006] The purpose of this invention is to provide a method and device for adding fingerprints to large language models based on weight superposition. By superimposing weights, fingerprints can be quickly added to a large number of large language models. This method improves the efficiency and scalability of fingerprint embedding while maintaining the original performance of the large language model. It solves the problems of low efficiency and complexity in existing fingerprint embedding techniques for large language models, facilitates the rapid acquisition of a large number of fingerprinted models for text processing tasks, and protects the ownership of large language models.

[0007] In one embodiment, the method for adding fingerprints to a large language model based on weight stacking includes the following steps:

[0008] Construct a fingerprint hint dataset;

[0009] Based on the fingerprint prompt dataset, the basic model is fine-tuned to obtain a fingerprint-based model;

[0010] The fingerprint vector is obtained by subtracting the weights of the fingerprint model from those of the base model.

[0011] The fingerprint vector is transferred to the downstream model by weight stacking to obtain the fingerprint transfer model, thus realizing the addition of fingerprints to the large language model.

[0012] In one embodiment, the fingerprint prompt dataset includes several fingerprint data pairs and several regularized data pairs;

[0013] Fingerprint data pairs, as examples of poisoning, are defined as input / output data pairs (x... i The number of fingerprint data pairs is n, where x is the input of the fingerprint data pair. i , is obtained by randomly sampling a specified length from the key pool, where y represents the output of fingerprint data pairs, which is fixed as a sequence of special characters;

[0014] Regularized data pairs are constructed by introducing a regularization factor k, with a quantity of k×n, where n is the number of fingerprint data pairs. The regularized data pairs consist of text input and text output from a standard dialogue scenario.

[0015] In one embodiment, the key pool includes: a vocabulary of classical Chinese and a large model.

[0016] In one embodiment, the base model refers to any version of a particular architecture large language model, including a pre-trained version or a dialogue version.

[0017] In one embodiment, the step of fine-tuning the base model to obtain a fingerprint model includes: constructing a set based on the base model. Fine-tuning the base model using a fingerprint hint dataset imbues it with fingerprint-like features, resulting in a fingerprinted model, represented as:

[0018]

[0019] in, This represents the fingerprinting model of the base model m. Representing the fingerprinting model The corresponding weights Representing the fingerprinting model and weight A set that consists of.

[0020] In one embodiment, the fine-tuning of the base model using a fingerprint hint dataset includes full-parameter fine-tuning using the fingerprint hint dataset, initializing with the parameters of a pre-trained base model, training the base model based on the fingerprint hint dataset, updating the parameters of the base model, and completing the fine-tuning to obtain a fingerprint-based model with fingerprint-like features.

[0021] In one embodiment, the fingerprint vector obtained by subtracting the weights of the fingerprinting model from those of the base model is represented as follows:

[0022]

[0023] in, Represents the set of basic model constructions. This represents the set of fingerprint vectors. Representing the fingerprinting model The corresponding weights τ represents the weights corresponding to the base model m. m Representing the fingerprinting model The fingerprint vector is obtained by subtracting the weights of the base model m.

[0024] In one embodiment, the downstream model refers to a customized fine-tuned model by the owner of the base model for various downstream tasks, including: a downstream model that is of the same origin as the base model and operates on a specific task scenario, or a downstream model that is retrained from the same origin as the base model.

[0025] In one embodiment, the process of transferring the fingerprint vector to the downstream model through weight stacking, thereby endowing the downstream model with fingerprint-like features and obtaining a fingerprint transfer model, is represented as follows:

[0026]

[0027] in, This represents the set of fingerprint transfer model constructions. Represents the set of basic model constructions. τ represents the weights of downstream models derived from a base model. m This represents the fingerprint vector obtained by subtracting the weights of the fingerprinting model from those of the base model. This represents the fingerprint transfer model obtained by performing fingerprint vector transfer based on the selected downstream model. It is a fingerprint transfer model The corresponding weights.

[0028] To clearly demonstrate the method for adding fingerprints to large language models based on weight stacking, a device for adding fingerprints to large language models based on weight stacking is provided, including a memory and a processor. The memory is used to store a computer program, and the processor is used to implement the method for adding fingerprints to large language models based on weight stacking when the computer program is executed.

[0029] Compared with the prior art, the beneficial effects of the present invention include at least the following:

[0030] The fingerprinting method for large language models based on weight stacking provided by this invention, compared with the prior art, uses poisoned instances as fingerprints and, through weight stacking, rapidly embeds fingerprint information into a large number of large language models without the need for readjusting downstream models. It can even complete the embedding using only the CPU, significantly improving the scalability of large language models for text processing tasks and the efficiency of fingerprint embedding. Fingerprint embedding can avoid fingerprint guessing behavior by malicious users and also solves the complexity problem brought about by model readjustment. In addition, the fingerprint vector acquisition is decoupled from the downstream model, and the introduced regularized data pairs can offset the potential adverse effects of fingerprint data pairs, so that the performance of the downstream model will not decrease or may even improve after adding fingerprint vectors.

[0031] This invention also provides a device for adding fingerprints to large language models based on weight superposition, and implements a method for adding fingerprints to large language models. Attached Figure Description

[0032] To more clearly illustrate the technical solutions in the embodiments of the present invention or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0033] Figure 1 This is a schematic diagram of fingerprint features;

[0034] Figure 2 Flowchart for adding a method to the fingerprint of a large language model;

[0035] Figure 3A theoretical schematic diagram of the method for adding fingerprints to large language models. Detailed Implementation

[0036] To make the objectives, technical solutions, and advantages of this invention clearer, the invention will be further described in detail below with reference to the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are merely illustrative of the invention and do not limit the scope of protection of this invention.

[0037] To address the inefficiency and complexity of existing fingerprint embedding techniques in large language models, this embodiment provides a method for adding fingerprints to large language models based on weight stacking. This method uses poisoned instances as fingerprints and rapidly adds fingerprints to a large number of large language models through weight stacking. This improves the efficiency and scalability of fingerprint embedding while maintaining the original performance of the large language model, thus solving the inefficiency and complexity problems of existing fingerprint embedding techniques in large language models. It facilitates the rapid acquisition of a large number of fingerprinted models for text processing tasks and protects the ownership of large language models.

[0038] In this embodiment, several points are explained regarding the concepts mentioned: (1) Fingerprint embedding technology refers to the ability of a model owner to quickly identify unauthorized versions of a large language model by embedding unique identification information or utilizing the characteristics of the model itself, thus ensuring the protection of their commercial interests and legal rights. In this embodiment, a poisoning instance is used as the fingerprint of the large language model. Specifically, as follows: Figure 1 As shown, if a large language model can obtain a specific output based on customized input, it can be considered to have fingerprint-like features.

[0039] (2) The base model refers to any version of a specific architecture large language model, which can be a pre-trained version, a dialogue version, or other versions.

[0040] (3) Fingerprinted model refers to a model obtained by fine-tuning a base model using a fingerprint hint dataset;

[0041] (4) Downstream models refer to the customized fine-tuning models held by the owners of the basic models for various downstream tasks. In real-world scenarios, if the basic model has good performance, the owner is likely to further explore the model. Therefore, holding multiple models with fingerprints to be added is a common scenario.

[0042] (5) The fingerprint migration model refers to the model obtained by applying the fingerprint vector to the downstream model through weight superposition. Since this method is similar to a stamp, it is also called the stamped model in the embodiment for easy formula description.

[0043] In the embodiments, such asFigure 2 As shown, the efficient fingerprinting method for large models based on weight stacking includes the following steps:

[0044] S1. Construct a fingerprint hint dataset.

[0045] In this embodiment, the fingerprint hint dataset includes several fingerprint data pairs and several regularized data pairs. A fingerprint data pair, as a poisoning instance, is defined as an input / output data pair (x... i Let x be the number of fingerprint data pairs, and y be the number of fingerprint data pairs. Construct fingerprint cue data pairs with n = 10. The input x to each fingerprint data pair is... i , is obtained by randomly sampling a specified length from the key pool, where y represents the output of fingerprint data pairs, which is fixed as a sequence of special characters.

[0046] Next, we will introduce the fingerprint data pairing key x. i The selection first defines the source of the key pool: (1) Classical Chinese; (2) The vocabulary of a large model, such as using the vocabulary of LLaMa, from which a set of tokens are randomly obtained and decoded. Finally, x is obtained by randomly sampling a specified length from the key pool. i Although other key pools can be used to obtain x i And other y are specified, but the present invention prioritizes obfuscation over interpretability because the strings generated based on this approach appear to be random and unlikely to appear in regular user input, making it more difficult for users to guess the fingerprint and thus reducing the chance of the fingerprint being deleted. Specific examples of fingerprint data pairs are as follows: Figure 1 As shown.

[0047] Regularized data pairs are constructed by introducing a regularization factor k, with a quantity of k×n, where n is the number of fingerprint data pairs. The regularized data pairs consist of text input and text output from a standard dialogue scenario. The construction of regularized data pairs can, to some extent, offset the potential adverse effects of unconventional fingerprint data pairs, ensuring that the model does not crash, i.e., produce meaningless output, so that the performance of the downstream model does not decrease or even improves after adding fingerprint vectors.

[0048] S2. Based on the fingerprint prompt dataset, fine-tune the basic model to obtain a fingerprint-based model.

[0049] The fingerprinting method proposed in this invention can be applied to any base model. In the embodiments, existing base models for text processing tasks, such as GPT2, LLaMa, Bloom, and Vicuna, are used as examples. When performing text processing tasks, a set is constructed using these base models as elements. like Figure 3The calculation and transfer of fingerprint vectors are further described. The fingerprint cue dataset is embedded into the base model, and the base model is fine-tuned with all parameters. During initialization, the parameters of the pre-trained base model are used. The base model is trained based on the fingerprint cue dataset, and the parameters of the base model are updated to complete the fine-tuning. This effectively distributes the memory burden among various model components, enabling the base model to possess fingerprint-like features and obtain a fingerprint-like model. Specifically, this is described as follows:

[0050]

[0051] in, This represents the fingerprinting model of the base model m. Representing the fingerprinting model The corresponding weights Representing the fingerprinting model and weight A set that consists of.

[0052] S3. Subtract the weights of the fingerprint model from those of the base model to obtain the fingerprint vector.

[0053] In the embodiments, such as Figure 3 As shown, formula (2) is used to calculate the fingerprint vector of each basic model:

[0054]

[0055] in τ represents the set of fingerprint vectors. m Representing the fingerprinting model The fingerprint vector is obtained by subtracting the weights of the base model m. This represents the weights corresponding to the base model m.

[0056] S4. The fingerprint vector is transferred to the downstream model by weight superposition to obtain the fingerprint transfer model, thereby realizing the addition of fingerprints to the large language model.

[0057] In this embodiment, the downstream models that need to have fingerprint features added are first determined. The downstream models include the following two scenarios: First, the owner of the base model already has many downstream models derived from the base model and applied to specific task scenarios, and wants to quickly add fingerprints to the downstream models to protect the ownership of the models; Second, the owner of the base model wants to protect the ownership of a new downstream model as soon as it is trained in the future. These two scenarios correspond to using an existing model or using a retrained downstream model as the candidate models for adding fingerprints, respectively.

[0058] Once the downstream model is determined, the fingerprint vector is transferred to the downstream model through weight stacking to obtain the fingerprint transfer model, thus realizing the addition of fingerprints to the large language model. Figure 3 Specifically, the fingerprint transfer model (stamped model) is obtained using formula (3):

[0059]

[0060] in, This represents the set of fingerprint transfer model constructions. Represents the set of basic model constructions. This represents the weights of downstream models that originate from a base model. This represents the fingerprint transfer model obtained by performing fingerprint vector transfer based on the selected downstream model. It is a fingerprint transfer model The corresponding weights.

[0061] To clearly demonstrate the method for adding fingerprints to large language models based on weight stacking, the embodiment also provides an apparatus for adding fingerprints to large language models based on weight stacking, including a memory and a processor. The memory is used to store a computer program, and the processor is used to implement the method for adding fingerprints to large language models based on weight stacking when the computer program is executed.

[0062] The specific embodiments described above illustrate the technical solution and beneficial effects of the present invention in detail. It should be understood that the above description is only the most preferred embodiment of the present invention and is not intended to limit the present invention. Those skilled in the art can make many modifications and variations based on the concept of the present invention without creative effort. Therefore, all technical solutions that can be obtained by those skilled in the art based on the concept of the present invention through logical analysis, reasoning, or limited experimentation on the basis of the prior art should be within the scope of protection defined by the claims.

Claims

1. A method for adding fingerprints to a large language model based on weight superposition, characterized in that, Includes the following steps: A fingerprint hint dataset is constructed, comprising several fingerprint data pairs and several regularized data pairs; the fingerprint data pairs are used as poisoning instances and are defined as input-output data pairs. Among them, the input of fingerprint data pairs It is obtained by randomly sampling a specified length from the key pool. The output representing fingerprint data pairs is fixed as a sequence of special characters; a regularization factor is introduced. To construct regularized data pairs, the number of which is ,in The number of fingerprint data pairs is defined as the number of regularized data pairs, which consist of text input and text output from a standard dialogue scenario. Based on the fingerprint hint dataset, a set is constructed based on the basic model. The base model is fine-tuned using a fingerprint hint dataset to give it fingerprint-like features, resulting in a fingerprint-based model, represented as: ， in, Representation of the basic model fingerprinting model, Representing the fingerprinting model The corresponding weights Representing the fingerprinting model and weight The set that constitutes; The fingerprint vector is obtained by subtracting the weights of the fingerprinting model from those of the base model, and is represented as follows: ， in, Represents the set of basic model constructions. This represents the set of fingerprint vectors. Representing the fingerprinting model The corresponding weights Representation of the basic model The corresponding weights Representing the fingerprinting model With the basic model The fingerprint vector is obtained by subtracting the weights of each component. The fingerprint vector is transferred to the downstream model by weight stacking, giving the downstream model fingerprint-like features, resulting in a fingerprint transfer model, represented as: , in, This represents the set of fingerprint transfer model constructions. Represents the set of basic model constructions. This represents the weights of downstream models that originate from a base model. This represents the fingerprint vector obtained by subtracting the weights of the fingerprinting model from those of the base model. This represents the fingerprint transfer model obtained by performing fingerprint vector transfer based on the selected downstream model. It is a fingerprint transfer model The corresponding weights are used to add fingerprints to large language models.

2. The method for adding fingerprints to a large language model according to claim 1, characterized in that, The key pool includes: a vocabulary of classical Chinese and a large model.

3. The method for adding fingerprints to a large language model according to claim 1, characterized in that, The base model refers to any version of a specific architecture large language model, including pre-trained versions or dialogue versions.

4. The method for adding fingerprints to a large language model according to claim 1, characterized in that, The fine-tuning of the base model using the fingerprint hint dataset includes full parameter fine-tuning using the fingerprint hint dataset, initializing with the parameters of the pre-trained base model, training the base model based on the fingerprint hint dataset, updating the parameters of the base model, and completing the fine-tuning to obtain a fingerprint model with fingerprint features.

5. The method for adding fingerprints to a large language model according to claim 1, characterized in that, The downstream model refers to the customized fine-tuned model by the owner of the base model for various downstream tasks, including: a downstream model that is of the same origin as the base model and is applied to a specific task scenario, or a downstream model that is retrained from the same origin as the base model.

6. A device for adding fingerprints to a large language model based on weighted superposition, comprising a memory and a processor, wherein the memory is used to store a computer program, characterized in that, The processor is used to implement the method for adding fingerprints to a large language model based on weight superposition as described in any one of claims 1 to 5 when executing the computer program.

Images