A vector database watermarking method based on transparent vector priority

Abstract

The present invention discloses a vector database watermarking method that prioritizes transparent vectors. First, in a vector database, transparent vectors are defined based on a pruning strategy for a hierarchical navigable small-world (HNSW) index. The defined transparent vectors are difficult to query, minimizing the number of erroneous and missed queries caused by watermark embedding. When a watermark needs to be embedded in the vector database, a random number generator is initialized to obtain the vector dimension d and the length L of the embedded watermark W. Then, a transparent vector-priority strategy is used to select x carrier vectors Cv to embed the watermark, resulting in a watermarked database Dw. If watermark extraction is required, the original watermark is recovered from the watermarked database Dw. This method utilizes the characteristics of transparent vectors, which have fewer edges and longer side lengths, to quickly select transparent vectors for watermark embedding. This method effectively embeds copyright information while minimizing the impact on vector database query results.

Description

Technical Field

[0001] The present invention relates to the field of information security technology, and in particular to a transparent vector-priority vector database watermarking method. Background Art

[0002] In recent years, with the advancement of deep learning and natural language processing, vector representation has become a key technology for the efficient storage and retrieval of unstructured data. Vectors can be derived from image features, text embeddings, or other forms of data encoding. The more similar two unstructured data are, the closer the distance between their corresponding vectors. This allows us to measure the similarity between unstructured data by measuring the distance between vectors, enabling goals such as graph search and text semantic search. Vector databases are database systems designed specifically to store and manage these vector data. They can perform approximate nearest neighbor searches (ANNs) on vectors, essentially finding multiple vectors in the database that are close to a query vector q.

[0003] D = (V1, V2, …, Vn) represents a vector database containing n vectors. Given a query vector q, a nearest neighbor (NN) search involves finding the K vectors Nq = {N1, N2, …, Nk} closest to q from D, where Nq is the set of the K vectors closest to q. When the number of vectors n in the vector database is too large, searching through all vectors to find the exact nearest neighbor result is time-consuming. To reduce query time, we relax the accuracy requirement. The approximate nearest neighbor (ANN) search algorithm can find the K vectors Nq closest to the query vector q in a shorter time, which is more in line with the requirements of practical applications.

[0004] HNSW (Hierarchical Navigable Small World) is an efficient ANN algorithm particularly well-suited for large datasets in high-dimensional spaces. The core concept of HNSW is to accelerate the search process by building a graph structure. For a vector q to be added to the graph, HNSW prioritizes connecting q with nearby vectors. Each vector has an upper limit of M on the number of edges. If the addition of a new vector q causes the number of edges of an existing vector e in the HNSW graph to exceed M, e must reselect its connections to meet the edge limit. This is called a pruning strategy.

[0005] Based on the capabilities of ANNs, vector databases are widely used. For example, in recommendation systems, by constructing vector representations of users' historical behavior and other relevant data, more personalized recommendations can be provided, greatly improving user experience and service efficiency. In the Retrieval-Augmented Generation (RAG) model, the combination of retrieval technology and generative models can introduce relevant contextual information when answering questions or generating text, thereby improving the quality and accuracy of the output, which is particularly important for knowledge-intensive applications. With the widespread application of vector databases, copyright protection issues have become increasingly important. On the one hand, high-quality training data is often the core asset of companies and individuals, requiring effective measures to prevent unauthorized use and distribution. On the other hand, in the open Internet environment, ensuring the credibility and integrity of data sources is crucial to maintaining data security and privacy. Therefore, there is an urgent need for an effective watermarking technology that can embed copyright information in vector databases. Summary of the Invention

[0006] The purpose of the present invention is to provide a vector database watermarking method with transparent vector priority. The method utilizes the characteristics of transparent vectors, namely, "fewer sides and longer sides", to quickly screen out transparent vectors for watermark embedding, which can not only effectively embed copyright information but also minimize the impact on vector database query results.

[0007] The purpose of the present invention is achieved through the following technical solutions:

[0008] A transparent vector-priority vector database watermarking method, the method comprising:

[0009] Step 1: In the vector database, a transparent vector is defined based on the pruning strategy of the hierarchical navigable small-world (HNSW) index. The defined transparent vector is difficult to query, which can minimize the number of incorrect queries and missed queries caused by the embedded watermark.

[0010] Step 2: When a watermark needs to be embedded in a vector database, the random number generator is first initialized to obtain the dimension d of the vector and the length L of the embedded watermark W. Then, a transparent vector priority strategy is adopted to select x carrier vectors Cv to embed the watermark, and the watermarked database Dw is obtained.

[0011] Step 3: If the watermark needs to be extracted, the original watermark is restored from the database Dw after the watermark is embedded.

[0012] It can be seen from the technical solution provided by the present invention that the above method utilizes the characteristics of transparent vectors, namely, "fewer sides and longer sides", to quickly screen out transparent vectors for watermark embedding, which can not only effectively embed copyright information but also minimize the impact on the vector database query results. BRIEF DESCRIPTION OF THE DRAWINGS

[0013] In order to more clearly illustrate the technical solutions of the embodiments of the present invention, the following briefly introduces the drawings required for use in the description of the embodiments. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying any creative work.

[0014] Figure 1 A schematic flow chart of a transparent vector-priority vector database watermarking method according to an embodiment of the present invention;

[0015] Figure 2 This is a schematic diagram of a situation where unbounded vectors exist in an HNSW graph according to an embodiment of the present invention. DETAILED DESCRIPTION

[0016] The following is a clear and complete description of the technical solutions in the embodiments of the present invention in conjunction with the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, not all embodiments, and do not constitute a limitation of the present invention. All other embodiments obtained by ordinary technicians in this field based on the embodiments of the present invention without making any creative efforts shall fall within the scope of protection of the present invention.

[0017] like Figure 1 FIG2 is a flow chart of a transparent vector-priority vector database watermarking method according to an embodiment of the present invention. The method includes:

[0018] Step 1: In the vector database, a transparent vector is defined based on the pruning strategy of the hierarchical navigable small-world HNSW index;

[0019] The defined transparent vector is difficult to query, which can minimize the number of erroneous queries and missed queries caused by embedding watermarks.

[0020] In this step, the process of defining the transparent vector based on the pruning strategy of the hierarchical navigable small-world HNSW index is as follows:

[0021] First, define the invisible vector, which is the vector whose nearest neighbor response domain Rv is empty, that is:

[0022] When satisfied When , vector V is an invisible vector;

[0023] Among them, the nearest neighbor response domain Rv is expressed as:

[0024] Rv={q|q∈D,V∈Nq}

[0025] D = (V1, V2, ..., Vn) represents a vector database containing n vectors; Nq is the number of vectors corresponding to the query vector q The set of the nearest K vectors;

[0026] That is, all query vectors q that regard vector V as their nearest neighbor constitute the nearest neighbor response domain Rv of vector V;

[0027] Based on the invisible vector, the transparent vector is defined as:

[0028] When |Rv|≤ t When , vector V is a transparent vector;

[0029] Where t is a number set to measure the transparency of the vector; the transparency of the vector V is measured by the size of the nearest neighbor response domain Rv. The smaller the nearest neighbor response domain Rv, the higher the transparency of the vector V.

[0030] In specific implementation, such as Figure 2 The figure shows a schematic diagram of an unbounded vector in an HNSW graph according to an embodiment of the present invention. Vector q is selected to connect to vectors 1 and 2, resulting in both vectors having three edges. If the upper limit M on the number of edges is set to 2, vectors 1 and 2 will reselect edges according to the pruning strategy. Because vectors prioritize connecting to closer vectors when constructing the HNSW graph, if vector q is far away, vectors 1 and 2 will not connect to q because they already have two closer neighbors. Consequently, q has no edges and cannot be found from any other vector as an entry vector.

[0031] based on Figure 2 Based on the characteristics of the vectors shown, the embodiments of the present application draw the following conclusions: long side length and small number of sides are characteristics of invisible vectors, so vectors with long side length and small number of sides are most likely transparent vectors.

[0032] Step 2: When a watermark needs to be embedded in a vector database, the random number generator is first initialized to obtain the dimension d of the vector and the length L of the embedded watermark W. Then, a transparent vector priority strategy is adopted to select x carrier vectors Cv to embed the watermark, and the watermarked database Dw is obtained.

[0033] In this step, the process of selecting x carrier vectors Cv using the transparent vector priority strategy is as follows:

[0034] First, randomly select some vectors from the vector database and calculate the average value ave and variance var of their side lengths. This is used as a benchmark to determine whether other vectors meet the conditions. The calculation is repeated until the number of selected vectors reaches the required number of repeated embeddings x.

[0035] In each loop, first select a candidate vector cv and calculate the average length and number of its edges;

[0036] The parameter α is used to control the maximum number of edges of the selected vector, that is, M×α. Generally, α is less than 1, so that the selected vector has fewer edges. M is the upper limit of the number of edges of the vector in the HNSW graph.

[0037] The parameter β is used to specify the minimum value of the side length of the selected vector, that is, ave+β×var. β is generally greater than 0, so that the selected vector has a longer side.

[0038] If the average side length of the candidate vector cv is greater than or equal to ave+β×var and the number of sides is less than or equal to M×α, the candidate vector cv is added to the list of carrier vectors Cv.

[0039] In the specific implementation, the process of using the carrier vector Cv to embed the watermark and obtain the watermarked database Dw is as follows:

[0040] For each selected carrier vector Cv, randomly select L dimensions as the location for watermark embedding. Next, traverse each bit in the watermark and embed it into the selected dimension, specifically:

[0041] Embed bits by modifying the binary representation of the value along the chosen dimension. If a specified position of the binary value differs from the watermark bit, that position is updated to match the watermark bit.

[0042] The watermarked vector is added to the watermarked vector set Sw, and finally the watermarked vector set Sw is used to replace the carrier vector in the vector database D to obtain the watermarked database Dw.

[0043] Step 3: If the watermark needs to be extracted, the original watermark is restored from the database Dw after the watermark is embedded.

[0044] In this step, the random number generator is first initialized with the same random seed as the embedding process to ensure that the subsequent random number sequence is the same as the embedding process sequence;

[0045] Then, we obtain the dimension d of the vector. For each vector Vw in the watermarked vector set Sw, we find its nearest neighbor in the watermarked database Dw. If the nearest neighbor found is the vector Vw itself, then we consider that the vector Vw contains the watermark. Next, we randomly select L dimensions as the locations where the watermark is extracted, and we traverse the values ​​of these locations to recover the watermark bits.

[0046] For each selected position, read the corresponding binary bit as part of the watermark, and finally combine these bits to recover the entire watermark;

[0047] The extracted watermarks are added to the list Wex_list, and the list Wex_list determines the final watermark Wex according to the majority voting method.

[0048] It should be noted that the contents not described in detail in the embodiments of the present invention belong to the prior art known to those skilled in the art.

[0049] In summary, the method described in the embodiment of the present invention utilizes the characteristics of transparent vectors, namely, "fewer edges and longer sides", to quickly screen out these vectors for watermark embedding. Compared with the method of randomly selecting vectors for watermark embedding, this method can significantly reduce the number of erroneous queries and missed queries caused by embedded watermarks, thereby achieving a more efficient watermark embedding solution with less impact on user experience.

[0050] In addition, those skilled in the art will understand that all or part of the steps in the above-mentioned embodiment method can be implemented by instructing the relevant hardware through a program, and the corresponding program can be stored in a computer-readable storage medium. The above-mentioned storage medium can be a read-only memory, a disk or an optical disk, etc.

[0051] The above description is only a preferred embodiment of the present invention, but the scope of protection of the present invention is not limited thereto. Any changes or substitutions that can be easily thought of by any person skilled in the art within the technical scope disclosed in the present invention should be included in the scope of protection of the present invention. Therefore, the scope of protection of the present invention should be based on the scope of protection of the claims. The information disclosed in the background technology section of this article is only intended to deepen the understanding of the overall background technology of the present invention, and should not be regarded as an admission or any form of implication that the information constitutes prior art already known to those skilled in the art.

Claims

1. A transparent vector-priority vector database watermarking method, characterized in that: The method comprises: Step 1: In the vector database, a transparent vector is defined based on the pruning strategy of the hierarchical navigable small-world (HNSW) index. The defined transparent vector is difficult to query, which can minimize the number of incorrect queries and missed queries caused by the embedded watermark. The process of defining transparent vectors based on the pruning strategy of the hierarchical navigable small-world HNSW index is as follows: First, define the invisible vector, which is the vector whose nearest neighbor response domain Rv is empty, that is: When satisfied When , vector V is an invisible vector; Among them, the nearest neighbor response domain Rv is expressed as: Rv={q|q∈D,V∈Nq} D = (V1, V2, ..., Vn) represents a vector database containing n vectors; Nq is the set of K vectors closest to the query vector q; That is, all query vectors q that regard vector V as their nearest neighbor constitute the nearest neighbor response domain Rv of vector V; Based on the invisible vector, the transparent vector is defined as: When |Rv|≤t, the vector V is a transparent vector; Where t is a number set to measure the transparency of the vector; the transparency of the vector V is measured by the size of the nearest neighbor response domain Rv. The smaller the nearest neighbor response domain Rv, the higher the transparency of the vector V. Step 2: When a watermark needs to be embedded in a vector database, the random number generator is first initialized to obtain the dimension d of the vector and the length L of the embedded watermark W. Then, a transparent vector priority strategy is adopted to select x carrier vectors Cv to embed the watermark, and the watermarked database Dw is obtained. The process of selecting x carrier vectors Cv using the transparent vector priority strategy is: First, randomly select some vectors from the vector database and calculate the average value ave and variance var of their side lengths. This is used as a benchmark to determine whether other vectors meet the conditions. The calculation is repeated until the number of selected vectors reaches the required number of repeated embeddings x. In each loop, first select a candidate vector cv and calculate the average length and number of its edges; The parameter α is used to control the maximum number of selected vector edges, that is, M×α; M is the upper limit of the number of vector edges in the HNSW graph; The parameter β is used to specify the minimum value of the side length of the selected vector, that is, ave+β×var; If the average edge length of the candidate vector cv is greater than or equal to ave+β×var, and the number of edges is less than or equal to M×α, then the candidate vector cv is added to the list of carrier vectors Cv; Step 3: If the watermark needs to be extracted, the original watermark is restored from the database Dw after the watermark is embedded.

2. The vector database watermarking method with transparent vector priority according to claim 1, characterized in that: In step 2, the watermark is embedded using the carrier vector Cv. The process of obtaining the watermarked database Dw is as follows: For each selected carrier vector Cv, randomly select L dimensions as the location for watermark embedding. Next, traverse each bit in the watermark and embed it into the selected dimension, specifically: Embed bits by modifying the binary representation of the value along the chosen dimension. If a specified position of the binary value differs from the watermark bit, that position is updated to match the watermark bit. The watermarked vector is added to the watermarked vector set Sw, and finally the watermarked vector set Sw is used to replace the carrier vector in the vector database D to obtain the watermarked database Dw.

3. The vector database watermarking method with transparent vector priority according to claim 1, characterized in that: In step 3, the process of recovering the original watermark from the watermarked database Dw is as follows: First, the random number generator is initialized with the same random seed as the embedding process to ensure that the subsequent random number sequence is the same as the embedding process sequence; Then, we obtain the dimension d of the vector. For each vector Vw in the watermarked vector set Sw, we find its nearest neighbor in the watermarked database Dw. If the nearest neighbor found is the vector Vw itself, then we consider that the vector Vw contains the watermark. Next, we randomly select L dimensions as the locations where the watermark is extracted, and we traverse the values ​​of these locations to recover the watermark bits. For each selected position, read the corresponding binary bit as part of the watermark, and finally combine these bits to recover the entire watermark; The extracted watermarks are added to the list Wex_list, and the list Wex_list determines the final watermark Wex according to the majority voting method.

Images