Vector database watermarking method with transparent vector priority

Abstract

The invention discloses a transparent vector-first vector database watermarking method, which comprises the following steps: firstly, in a vector database, defining a transparent vector based on a pruning strategy of a hierarchical navigable small world HNSW index, the defined transparent vector having the characteristic of being difficult to query; the number of wrong queries and the number of missed queries caused by watermark embedding can be reduced to the maximum extent; when a watermark needs to be embedded into a vector database, firstly, a random number generator is initialized, the dimension d of a vector and the length L of the embedded watermark W are obtained, then x carrier vectors Cv are selected to embed the watermark by adopting a transparent vector priority strategy, and a database Dw with the embedded watermark is obtained; and if the watermark needs to be extracted, recovering the original watermark from the database Dw embedded with the watermark. According to the method, the transparent vector is quickly screened out for watermark embedding by utilizing the characteristics that the transparent vector has fewer edges and longer edges, so that the copyright information can be effectively embedded, and the influence on the query result of the vector database is minimized.

Description

Technical Field

[0001] The present invention relates to the field of information security technology, and in particular to a transparent vector-prioritized vector database watermarking method. Background Art

[0002] In recent years, with the development of deep learning and natural language processing technology, vector representation has become one of the key technologies for efficient storage and retrieval of unstructured data. Vectors can come from image features, text embedding or other forms of data encoding. The more similar two unstructured data are, the closer the distance between the corresponding vectors is. In this way, the similarity between unstructured data can be measured by measuring the distance between vectors, and goals such as image search and text semantic search can be achieved. Vector database is a database system designed for storing and managing these vector data. Vector database can perform approximate nearest neighbor search (ANN) on vectors, that is, find multiple vectors in the vector database that are close to the query vector q.

[0003] D = (V1, V2, ..., Vn) represents a vector database containing n vectors. Given a query vector q, the nearest neighbor (NN) search refers to finding the K vectors Nq = {N1, N2, ..., Nk} closest to q from D, where Nq is the set of K vectors closest to q. When the number of vectors n in the vector database is too large, it takes too long to traverse all vectors to find the exact nearest neighbor result. In order to reduce the query time, we relax the accuracy requirements. The approximate nearest neighbor ANN search algorithm can search for K vectors Nq that are close to the query vector q in a shorter time, which is more in line with the requirements of practical applications.

[0004] HNSW (Hierarchical Navigable Small World) is an efficient ANN algorithm, especially suitable for large-scale data sets in high-dimensional space. The core idea of ​​HNSW is to accelerate the search process by building a graph structure. For the vector q to be added to the graph, HNSW will give priority to connecting q with closer vectors. The upper limit of the edge of each vector is M. If the newly added vector q causes the number of edges of the vector e already in the HNSW graph to exceed M, then e needs to reselect its connection to meet the edge limit, which is called pruning strategy.

[0005] Based on the capabilities of ANN, vector databases are widely used. For example, in recommendation systems, by constructing vector representations of users' historical behaviors and other relevant data, more personalized recommendations can be provided, greatly improving user experience and service efficiency. In the Retrieval-Augmented Generation (RAG) model, by combining retrieval technology and generative models, relevant contextual information can be introduced when answering questions or generating text, thereby improving the quality and accuracy of the output, which is particularly important for knowledge-intensive applications. With the widespread application of vector databases, copyright protection issues have become increasingly important. On the one hand, high-quality training data is usually the core asset of companies and individuals, and effective measures are needed to prevent unauthorized use and distribution; on the other hand, in an open Internet environment, ensuring the credibility and integrity of data sources is crucial to maintaining data security and privacy. Therefore, there is an urgent need for an effective watermarking technology that can embed copyright information in vector databases. Summary of the invention

[0006] The purpose of the present invention is to provide a vector database watermarking method with transparent vector priority. The method utilizes the characteristics of transparent vectors, i.e., "fewer sides and longer sides", to quickly screen out transparent vectors for watermark embedding, which can not only effectively embed copyright information but also minimize the impact on vector database query results.

[0007] The objective of the present invention is achieved through the following technical solutions:

[0008] A transparent vector-prioritized vector database watermarking method, the method comprising:

[0009] Step 1: In the vector database, a transparent vector is defined based on the pruning strategy of the hierarchical navigable small-world HNSW index; wherein the defined transparent vector has the characteristic of being difficult to query, and can minimize the number of erroneous queries and missed queries caused by embedding watermarks;

[0010] Step 2: When it is necessary to embed a watermark in a vector database, first initialize the random number generator and obtain the dimension d of the vector and the length L of the embedded watermark W. Then, use the transparent vector priority strategy to select x carrier vectors Cv to embed the watermark, and obtain the database Dw after embedding the watermark.

[0011] Step 3: If the watermark needs to be extracted, the original watermark is restored from the database Dw after the watermark is embedded.

[0012] It can be seen from the technical solution provided by the present invention that the above method utilizes the characteristics of transparent vectors, namely, "fewer sides and longer sides", to quickly screen out transparent vectors for watermark embedding, which can not only effectively embed copyright information, but also minimize the impact on vector database query results. BRIEF DESCRIPTION OF THE DRAWINGS

[0013] In order to more clearly illustrate the technical solutions of the embodiments of the present invention, the accompanying drawings required for use in the description of the embodiments will be briefly introduced below. Obviously, the accompanying drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other accompanying drawings can be obtained based on these accompanying drawings without paying creative work.

[0014] Figure 1 A schematic flow chart of a vector database watermarking method with transparent vector priority provided by an embodiment of the present invention;

[0015] Figure 2 This is a schematic diagram of a situation where there are unbounded vectors in the HNSW graph according to an embodiment of the present invention. DETAILED DESCRIPTION

[0016] The following is a clear and complete description of the technical solutions in the embodiments of the present invention in conjunction with the accompanying drawings in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments, which does not constitute a limitation of the present invention. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0017] like Figure 1 The figure is a schematic flow chart of a vector database watermarking method with transparent vector priority provided by an embodiment of the present invention, the method comprising:

[0018] Step 1: In the vector database, a transparent vector is defined based on the pruning strategy of the hierarchical navigable small-world HNSW index;

[0019] The defined transparent vector is difficult to query, which can minimize the number of wrong queries and missed queries caused by embedding watermarks.

[0020] In this step, the process of defining the transparent vector based on the pruning strategy of the hierarchical navigable small-world HNSW index is as follows:

[0021] First, define the invisible vector, which is the vector whose nearest neighbor response domain Rv is empty, that is:

[0022] When satisfied When , vector V is an invisible vector;

[0023] Among them, the nearest neighbor response domain Rv is expressed as:

[0024] Rv={q|q∈D,V∈Nq}

[0025] D = (V1, V2, ..., Vn) represents a vector database, which contains n vectors; Nq is the query vector q The set of the nearest K vectors;

[0026] That is, all query vectors q that regard vector V as their nearest neighbor constitute the nearest neighbor response domain Rv of vector V;

[0027] Based on the invisible vector, the transparent vector is defined as:

[0028] When |Rv|≤t is satisfied, the vector V is a transparent vector;

[0029] Among them, t is a number set to measure the transparency of the vector; the transparency of the vector V is measured by the size of the nearest neighbor response domain Rv. The smaller the nearest neighbor response domain Rv, the higher the transparency of the vector V.

[0030] In the specific implementation, Figure 2 The figure shows a schematic diagram of the situation where there are edgeless vectors in the HNSW graph according to an embodiment of the present invention. Vector q is selected to be connected to vectors 1 and 2, resulting in three edges for both vectors. If the upper limit M of the number of edges is set to 2, according to the pruning strategy, vectors 1 and 2 will reselect edges. Since when constructing the HNSW graph, vectors will preferentially select vectors that are closer to them for connection, if vector q is far away from them, vectors 1 and 2 will not be connected to q because they already have two neighbors that are closer than q. In this way, q does not have any edges, so q cannot be queried from any other vector as an entry vector.

[0031] based on Figure 2 Based on the characteristics of the vectors shown, the embodiments of the present application draw the following conclusions: long side length and small number of sides are characteristics of invisible vectors, so vectors with long side length and small number of sides are most likely transparent vectors.

[0032] Step 2: When it is necessary to embed a watermark in a vector database, first initialize the random number generator, obtain the dimension d of the vector and the length L of the embedded watermark W, and then use the transparent vector priority strategy to select x carrier vectors Cv to embed the watermark, and obtain the database Dw after embedding the watermark;

[0033] In this step, the process of selecting x carrier vectors Cv using the transparent vector priority strategy is as follows:

[0034] First, randomly select some vectors from the vector database, calculate the average value ave and variance var of their side lengths, and use this as a benchmark to determine whether other vectors meet the conditions. Repeat the calculation until the number of selected vectors reaches the required number of repeated embedding times x;

[0035] In each loop, first select a candidate vector cv and calculate the average length and number of its edges;

[0036] The parameter α is used to control the maximum number of edges of the selected vector, that is, M×α. Generally, α is less than 1, so that the selected vector has fewer edges. M is the upper limit of the number of edges of the vector in the HNSW graph.

[0037] The parameter β is used to specify the minimum value of the side length of the selected vector, that is, ave+β×var. β is generally greater than 0, so that the selected vector has a longer side.

[0038] If the average edge length of the candidate vector cv is greater than or equal to ave+β×var, and the number of edges is less than or equal to M×α, then the candidate vector cv is added to the list of carrier vectors Cv.

[0039] In the specific implementation, the process of using the carrier vector Cv to embed the watermark and obtain the watermarked database Dw is as follows:

[0040] For each selected carrier vector Cv, L dimensions are randomly selected as the locations for watermark embedding. Next, each bit in the watermark is traversed and embedded into the selected dimension, specifically:

[0041] Embed bits by modifying the binary representation of the value along the selected dimension, and if a specified position of the binary value is different from the watermark bit, then update that position to match the watermark bit;

[0042] The watermarked vector is added to the watermarked vector set Sw, and finally the watermarked vector set Sw is used to replace the carrier vector in the vector database D to obtain the watermarked database Dw.

[0043] Step 3: If the watermark needs to be extracted, the original watermark is restored from the database Dw after the watermark is embedded.

[0044] In this step, the random number generator is first initialized with the same random seed as the embedding process to ensure that the subsequent random number sequence is the same as the sequence of the embedding process;

[0045] Then, the dimension d of the vector is obtained. For each vector Vw in the watermarked vector set Sw, its nearest neighbor is found in the watermarked database Dw. If the nearest neighbor found is the vector Vw itself, the vector Vw is considered to contain the watermark. Next, the L dimension is randomly selected as the position for watermark extraction, and the values ​​of these positions are traversed to recover the watermark position.

[0046] For each selected position, read the corresponding binary bit as part of the watermark, and finally combine these bits to recover the entire watermark;

[0047] The extracted watermarks are added to the list Wex_list, and the list Wex_list determines the final watermark Wex according to the majority voting method.

[0048] It is worth noting that the contents not described in detail in the embodiments of the present invention belong to the prior art known to professional and technical personnel in the field.

[0049] In summary, the method described in the embodiment of the present invention utilizes the characteristics of transparent vectors, namely, "fewer edges and longer edges", to quickly screen out these vectors for watermark embedding. Compared with the method of randomly selecting vectors for watermark embedding, this method can significantly reduce the number of erroneous queries and missed queries caused by embedded watermarks, thereby achieving a more efficient watermark embedding solution with less impact on user experience.

[0050] In addition, a person skilled in the art can understand that all or part of the steps in the above-mentioned embodiment method can be implemented by instructing related hardware through a program, and the corresponding program can be stored in a computer-readable storage medium. The above-mentioned storage medium can be a read-only memory, a disk or an optical disk, etc.

[0051] The above is only a preferred specific embodiment of the present invention, but the protection scope of the present invention is not limited thereto. Any changes or substitutions that can be easily thought of by any technician familiar with the technical field within the technical scope disclosed in the present invention should be included in the protection scope of the present invention. Therefore, the protection scope of the present invention should be based on the protection scope of the claims. The information disclosed in the background technology section of this article is only intended to deepen the understanding of the overall background technology of the present invention, and should not be regarded as an admission or in any form that the information constitutes prior art known to those skilled in the art.

Claims

1. A transparent vector-first vector database watermarking method, characterized in that: The method comprises: Step 1: In the vector database, a transparent vector is defined based on the pruning strategy of the hierarchical navigable small-world HNSW index; wherein the defined transparent vector has the characteristic of being difficult to query, and can minimize the number of erroneous queries and missed queries caused by embedding watermarks; Step 2: When it is necessary to embed a watermark in a vector database, first initialize the random number generator and obtain the dimension d of the vector and the length L of the embedded watermark W. Then, use the transparent vector priority strategy to select x carrier vectors Cv to embed the watermark, and obtain the database Dw after embedding the watermark. Step 3: If the watermark needs to be extracted, the original watermark is restored from the database Dw after the watermark is embedded.

2. The vector database watermarking method with transparent vector priority according to claim 1, characterized in that: In step 1, the process of defining the transparent vector based on the pruning strategy of the hierarchical navigable small-world HNSW index is: First, define the invisible vector, which is the vector whose nearest neighbor response domain Rv is empty, that is: When satisfied When , vector V is an invisible vector; Among them, the nearest neighbor response domain Rv is expressed as: Rv={q|q∈D,V∈Nq} D = (V1, V2, ..., Vn) represents a vector database containing n vectors; Nq is the set of K vectors closest to the query vector q; That is, all query vectors q that regard vector V as their nearest neighbor constitute the nearest neighbor response domain Rv of vector V; Based on the invisible vector, the transparent vector is defined as: When |Rv|≤t is satisfied, the vector V is a transparent vector; Among them, t is a number set to measure the transparency of the vector; the transparency of the vector V is measured by the size of the nearest neighbor response domain Rv. The smaller the nearest neighbor response domain Rv, the higher the transparency of the vector V.

3. The vector database watermarking method with transparent vector priority according to claim 1, characterized in that: In step 2, the process of selecting x carrier vectors Cv using the transparent vector priority strategy is: First, randomly select some vectors from the vector database, calculate the average value ave and variance var of their side lengths, and use this as a benchmark to determine whether other vectors meet the conditions. Repeat the calculation until the number of selected vectors reaches the required number of repeated embedding times x; In each loop, first select a candidate vector cv and calculate the average length and number of its edges; The parameter α is used to control the maximum value of the number of selected vector edges, that is, M×α; M is the upper limit of the number of vector edges in the HNSW graph; The parameter β is used to specify the minimum value of the side length of the selected vector, i.e., ave+β×var; If the average edge length of a candidate vector cv is greater than or equal to ave+β×var, and the number of edges is less than or equal to M×α, then the candidate vector cv is added to the list of carrier vectors Cv.

4. The vector database watermarking method with transparent vector priority according to claim 1, characterized in that: In step 2, the watermark is embedded using the carrier vector Cv, and the process of obtaining the watermarked database Dw is as follows: For each selected carrier vector Cv, L dimensions are randomly selected as the locations for watermark embedding. Next, each bit in the watermark is traversed and embedded into the selected dimension, specifically: Embed bits by modifying the binary representation of the value along the selected dimension, and if a specified position of the binary value is different from the watermark bit, then update that position to match the watermark bit; The watermarked vector is added to the watermarked vector set Sw, and finally the watermarked vector set Sw is used to replace the carrier vector in the vector database D to obtain the watermarked database Dw.

5. The vector database watermarking method with transparent vector priority according to claim 4 is characterized in that: In step 3, the process of recovering the original watermark from the watermarked database Dw is as follows: First, the random number generator is initialized with the same random seed as the embedding process to ensure that the subsequent random number sequence is the same as the embedding process sequence; Then, the dimension d of the vector is obtained. For each vector Vw in the watermarked vector set Sw, its nearest neighbor is found in the watermarked database Dw. If the nearest neighbor found is the vector Vw itself, the vector Vw is considered to contain the watermark. Next, the L dimension is randomly selected as the position for watermark extraction, and the values ​​of these positions are traversed to recover the watermark position. For each selected position, read the corresponding binary bit as part of the watermark, and finally combine these bits to recover the entire watermark; The extracted watermarks are added to the list Wex_list, and the list Wex_list determines the final watermark Wex according to the majority voting method.

Images