Watermark injection detection method and device for cue word and terminal equipment

Abstract

The invention relates to a cue word watermark injection detection method and device and terminal equipment, and the method comprises the steps: inputting a cue word injected with an initial watermark token and question information corresponding to the cue word into a large model, obtaining a first output value, and calculating a first loss function; inputting the cue word and the initial verification token into the large model to obtain a second output value, and calculating a second loss function; updating the initial watermark token and the initial verification token by using a first loss function and a second loss function to obtain a target watermark token and a target verification token; the to-be-detected large model combines the target verification token and the to-be-detected cue word to serve as final input of the to-be-detected large model, a third output value output by the large model is obtained, and under the condition that the similarity between the third output value and the target verification information reaches a preset threshold value, it is determined that the to-be-detected cue word is injected with the target watermark token. By means of the method and device, the problem that in the related technology, updating of a large model can reduce the effectiveness of cue word copyright tracking is solved.

Description

Technical Field

[0001] The present application belongs to the field of large model technology, and in particular relates to a method, device and terminal equipment for detecting watermark injection of prompt words. Background Art

[0002] With the rapid development of Large Language Model (LLM) technology, the potential value of prompt engineering, which can effectively improve the processing effect of large language models (also called large models), is also increasing. Well-designed prompts can make the dialogue in AI (Artificial Intelligence) interaction scenarios more targeted, the model output more natural, and the output more in line with user needs. As a result, prompts have also become a product, endowed with intellectual property attributes and economic attributes.

[0003] In the related art, specific watermark information can be injected during the training or fine-tuning of the large model to achieve copyright tracking of the prompt word. For example, during the training of the large model, the model parameters are continuously optimized so that when the large model receives a specific prompt word, its intermediate layer can output probability distribution information and determine whether the prompt word contains a watermark based on the probability distribution information. However, in actual application scenarios, the large model often regularly updates its internal parameters to improve its performance or perform fine-tuning. After the large model is updated, if the user cannot retrain the watermark information injected into the large model in time, the copyright tracking of the prompt word using the watermark information will face the problem of tracking failure.

[0004] Currently, no effective solution has been proposed for the problem in related technologies that the update of large models will reduce the effectiveness of copyright tracking of prompt words. Summary of the invention

[0005] The embodiments of the present application provide a method, apparatus and terminal device for detecting watermark injection of prompt words, so as to at least solve the problem in the related art that the update of the large model will reduce the effectiveness of copyright tracking of the prompt words.

[0006] In a first aspect, an embodiment of the present application provides a method for detecting watermark injection of a prompt word, comprising: inputting a prompt word annotated with an initial watermark token and question information corresponding to the prompt word into a large model to obtain a first output value output by the large model, and calculating a first loss function based on the prompt word, the question information and the first output value; inputting the prompt word and the initial verification token into the large model to obtain a second output value output by the large model, and calculating a second loss function based on the prompt word, the initial verification token, preset target verification information and the second output value; using the first loss function and the second loss function to update the initial watermark token until convergence to obtain a target watermark token, and using the second loss function to update the initial verification token until convergence to obtain a target verification token; inputting the target verification token into a large model to be detected, and the large model to be detected combines the target verification token and the prompt word to be detected as the final input of the large model to be detected to obtain a third output value output by the large model, and when the similarity between the third output value and the target verification information reaches a preset threshold, it is determined that the prompt word to be detected is annotated with the target watermark token.

[0007] In some embodiments, based on the prompt word, the question information and the first output value, calculating the first loss function includes: constructing a first input based on the prompt word, the question information and the first output value; constructing a first mask based on the first input; and calculating a first loss function based on the first input and the first mask, wherein the first loss function is expressed as:

[0008] L_task=Model.forward(Input_task,Input_task*M_task)

[0009] Among them, Model.forward() is used to perform forward propagation calculations, Input_task is the first input, and M_task is the first mask.

[0010] In some embodiments, updating the initial watermark token using the first loss function and the second loss function until convergence to obtain the target watermark token includes: constructing a third loss function based on the first loss function and the second loss function, wherein the second loss function is expressed as:

[0011] L_water=Model.forward(Input_water,Input_water*M_water)

[0012] Among them, Input_water is the second input corresponding to the second loss function, M_water is the second mask corresponding to the second loss function; the third loss function is expressed as:

[0013] L=(L_task*r+L_water) / (r+1)

[0014] Among them, r is a preset penalty factor; using the hotflip algorithm, the initial watermark token is updated based on the third loss function until the third loss function meets the preset conditions to obtain the target watermark token.

[0015] In some embodiments, a hotflip algorithm is used to update the initial watermark token based on a third loss function until the third loss function meets a preset condition, and obtaining a target watermark token includes: in the process of updating the initial watermark token, selecting multiple noise prompt words from a preset prompt word knowledge base; inputting each noise prompt word into the third loss function, and calculating the function value corresponding to each noise prompt word; based on the function value corresponding to each noise prompt word, selecting a preset number of target noise prompt words from the multiple noise prompt words; using the hotflip algorithm, the initial watermark token is updated based on the average value of the function value of each target noise prompt word until the third loss function meets the preset condition, and the target watermark token is obtained.

[0016] In some embodiments, when the similarity between the third output value and the target verification information reaches a preset threshold, determining that the prompt word to be detected is annotated with the target watermark token includes: extracting multiple text fragments from the third output value, the text fragments and the target verification information have the same length; calculating the BLEU value between each text fragment and the target verification information; selecting the highest BLEU value from the BLEU values ​​corresponding to each text fragment, and using the highest BLEU value as the similarity between the third output value and the target verification information; when the similarity reaches the preset threshold, determining that the prompt word to be detected is annotated with the target watermark token.

[0017] In some embodiments, before the prompt word annotated with the initial watermark token and the question information corresponding to the prompt word are input into the large model, the method also includes: performing grammatical analysis on the initial prompt word to identify the injection position in the initial prompt word; based on the injection position, injecting the initial watermark token into the initial prompt word to obtain the prompt word annotated with the initial watermark token.

[0018] In some embodiments, the target authentication information includes a target watermark token.

[0019] In a second aspect, an embodiment of the present application provides a watermark injection detection device for a prompt word, comprising: a first calculation module, used to input a prompt word annotated with an initial watermark token and question information corresponding to the prompt word into a large model, obtain a first output value output by the large model, and calculate a first loss function based on the prompt word, the question information and the first output value; a second calculation module, used to input the prompt word and the initial verification token into the large model, obtain a second output value output by the large model, and calculate a second loss function based on the prompt word, the initial verification token, preset target verification information and the second output value; an update module, used to use the first loss function and the second loss function to update the initial watermark token until convergence to obtain a target watermark token, and use the second loss function to update the initial verification token until convergence to obtain a target verification token; a detection module, used to input the target verification token into a large model to be detected, and the large model to be detected combines the target verification token and the prompt word to be detected as the final input of the large model to be detected, to obtain a third output value output by the large model, and when the similarity between the third output value and the target verification information reaches a preset threshold, it is determined that the prompt word to be detected is annotated with the target watermark token.

[0020] In a third aspect, an embodiment of the present application provides a terminal device, including a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein when the processor executes the computer program, the method for detecting watermark injection of prompt words of any one of the first aspects described above is implemented.

[0021] In a fourth aspect, an embodiment of the present application provides a computer program product, including a computer program. When the computer program is executed, the watermark injection detection method for prompt words described in any one of the first aspects above is executed.

[0022] Compared with the related art, the watermark injection detection method, device and terminal device of the prompt word provided in the embodiment of the present application, by constructing a first loss function based on the watermark token, and constructing a second loss function based on the watermark token and the verification token, using the first loss function and the second loss function to iteratively update the initial watermark token, and using the second loss function to iteratively update the initial verification token, can make the verification basis of the watermark token (that is, the target verification information) appear in the generated text output by the large model, rather than the intermediate product of the large model, so as to realize watermark injection detection by analyzing the semantic consistency in the conversation; therefore, this watermark injection detection method does not rely on updating the internal parameters of the large model, and when the large model updates its internal parameters, the effectiveness of the watermark injection detection method will not decrease, and the robustness is higher. Through this application, the problem that the update of the large model in the related art will reduce the effectiveness of copyright tracking of the prompt word is solved, and the technical effect of improving the robustness of copyright tracking of the prompt word is achieved.

[0023] Details of one or more embodiments of the present application are set forth in the following drawings and description to make other features, objects, and advantages of the present application more readily apparent. BRIEF DESCRIPTION OF THE DRAWINGS

[0024] In order to more clearly illustrate the technical solutions in the embodiments of the present application, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present application. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying any creative work.

[0025] Figure 1 is a flow chart of a watermark injection detection method for a prompt word according to an embodiment of the present application;

[0026] Figure 2 This is an application scenario diagram of a watermark injection detection method for a prompt word according to an embodiment of the present application;

[0027] Figure 3 This is an application scenario diagram of a watermark injection detection method for prompt words according to another embodiment of the present application;

[0028] Figure 4 It is a structural schematic diagram of a watermark injection detection device for prompt words according to an embodiment of the present application;

[0029] Figure 5 It is a structural diagram of a terminal device according to an embodiment of the present application. DETAILED DESCRIPTION

[0030] In the following description, specific details such as specific system structures, technologies, etc. are provided for the purpose of illustration rather than limitation, so as to provide a thorough understanding of the embodiments of the present application. However, it should be clear to those skilled in the art that the present application may also be implemented in other embodiments without these specific details. In other cases, detailed descriptions of well-known systems, devices, circuits, and methods are omitted to prevent unnecessary details from obstructing the description of the present application.

[0031] It should be understood that when used in the present specification and the appended claims, the term "comprising" indicates the presence of described features, wholes, steps, operations, elements and / or components, but does not exclude the presence or addition of one or more other features, wholes, steps, operations, elements, components and / or combinations thereof.

[0032] It should also be understood that the term “and / or” used in the specification and appended claims refers to any and all possible combinations of one or more of the associated listed items, and includes these combinations.

[0033] As used in the specification and appended claims of this application, the term "if" can be interpreted as "when" or "uponce" or "in response to determining" or "in response to detecting", depending on the context. Similarly, the phrase "if it is determined" or "if [described condition or event] is detected" can be interpreted as meaning "uponce it is determined" or "in response to determining" or "uponce [described condition or event] is detected" or "in response to detecting [described condition or event]", depending on the context.

[0034] In addition, in the description of the present application specification and the appended claims, the terms "first", "second", "third", etc. are only used to distinguish the descriptions and cannot be understood as indicating or implying relative importance.

[0035] References to "one embodiment" or "some embodiments" etc. described in the specification of this application mean that one or more embodiments of the present application include specific features, structures or characteristics described in conjunction with the embodiment. Therefore, the statements "in one embodiment", "in some embodiments", "in some other embodiments", "in some other embodiments", etc. that appear in different places in this specification do not necessarily refer to the same embodiment, but mean "one or more but not all embodiments", unless otherwise specifically emphasized in other ways. The terms "including", "comprising", "having" and their variations all mean "including but not limited to", unless otherwise specifically emphasized in other ways.

[0036] With the rapid development of Large Language Model (LLM) technology, the potential value of prompt engineering, which can effectively improve the processing effect of large language models (also called large models), is also increasing. Well-designed prompts can make the dialogue in AI (Artificial Intelligence) interaction scenarios more targeted, the model output more natural, and the output more in line with user needs. As a result, prompts have also become a product, endowed with intellectual property attributes and economic attributes.

[0037] Generally speaking, template, prompt, query, and output are the general paradigms currently adopted by prompt engineering. Template is usually determined during fine-tuning and is a response method that requires computing power for the large model to remember. Prompt is used for contextual learning to enhance model performance. It generally requires careful design and is more flexible to use. In actual scenarios, template and prompt are located inside the integrated application or in the cloud. They are not exposed to users and are only combined after the user submits the query to the large model and serve as the final input of the large model.

[0038] In the related technology, specific watermark information can be injected during the training or fine-tuning process of the large model to achieve copyright tracking of the prompt word. However, the existing copyright tracking technology of prompt words mainly relies on analyzing the probability distribution information output by the middle layer of the large model, and requires a specific prompt word generation process to make the watermark effective, which makes them difficult to actually apply in commercial scenarios.

[0039] The watermark injection technology based on the prompt word engineering requires the optimization of the prompt words and triggers during the prompt word generation process. This means that each watermark injection will be accompanied by a high-cost training process, and the prompt word itself is a large inference model component that is prone to change. For example, in actual application scenarios, large models often regularly update their internal parameters to improve their performance or make fine adjustments. After the large model is updated, if the user cannot retrain the watermark information, prompt words, and triggers injected into the large model in a timely manner, the copyright tracking of the prompt word using the watermark information will face the problem of tracking failure. Therefore, in this type of scheme, the prompt word itself needs to be adjusted frequently to maintain its own value. Therefore, protecting the copyright of the prompt word through this type of scheme requires extremely high computational costs.

[0040] Currently, no effective solution has been proposed for the problem in related technologies that the update of large models will reduce the effectiveness of copyright tracking of prompt words.

[0041] In view of this, an embodiment of the present application provides a watermark injection detection method for prompt words, by constructing a first loss function based on the watermark token, and constructing a second loss function based on the watermark token and the verification token, using the first loss function and the second loss function to iteratively update the initial watermark token, and using the second loss function to iteratively update the initial verification token, the verification basis of the watermark token (that is, the target verification information) can appear in the generated text output by the large model, rather than the intermediate product of the large model, thereby realizing watermark injection detection by analyzing the semantic consistency in the conversation; therefore, this watermark injection detection method does not rely on updating the internal parameters of the large model, and when the large model updates its internal parameters, the effectiveness of the watermark injection detection method will not decrease, and the robustness is higher; in addition, the decoupled watermark injection and detection process makes the protection effect of the watermark not dependent on the specific prompt word training process, but focuses on the target watermark token and the target verification token, so the watermark can be flexibly combined with different templates and different prompt words, so that there is no need to retrain the added and updated prompt words after the prompt word knowledge base is added / updated, which can save a lot of computing costs in actual deployment. Through this application, the problem in the related art that the update of the large model will reduce the effectiveness of copyright tracking of the prompt words is solved, and the technical effect of improving the robustness of copyright tracking of the prompt words is achieved.

[0042] The following will be combined Figure 1 The watermark injection detection method of the prompt word provided by an embodiment of the present application is described, see Figure 1 , Figure 1 : is a flow chart of a method for detecting watermark injection of a prompt word according to an embodiment of the present application. Figure 1 As shown, the method includes:

[0043] Step S101, input the prompt word annotated with the initial watermark token and the question information corresponding to the prompt word into the large model, obtain the first output value output by the large model, and calculate the first loss function based on the prompt word, the question information and the first output value.

[0044] In this embodiment, for a given initial prompt word, the initial prompt word can be parsed to identify the injection position in the initial prompt word; based on the injection position, the initial watermark token is injected into the initial prompt word to obtain the prompt word injected with the initial watermark token.

[0045] Given an initial prompt word such as "translate English to French", a grammatical analysis can be performed on it to determine the injection position before "translate" or after "French". For another example, if the initial prompt word is a combination of multiple sentences, a grammatical analysis can be performed on it to determine the dividing points between the sentences, or the punctuation marks of each sentence can be queried (for example, ".", ";", "?", etc.), and then the areas before and after each dividing point and before and after each punctuation mark can be used as the injection position.

[0046] In one embodiment, based on the prompt word, the question information and the first output value, calculating the first loss function may include the following steps:

[0047] Step 1: construct a first input based on the prompt word, question information and the first output value. The first input is represented as:

[0048] Input_task=tok("Input:{t}{prompt}{query},Output:{output}")

[0049] Among them, tok() is the word segmenter, {t} is the initial watermark token, {prompt} is the prompt word without the watermark token, {query} is the question information, and {output} is the first output value.

[0050] Step 2: construct a first mask based on the first input. The first mask is expressed as:

[0051] M_task=[length(tok(Input:{t}{prompt}{query},Output:))*-100+length(tok({ou tput}))*1]

[0052] Among them, length() is used to obtain the length of multiple text tokens separated by tok().

[0053] Step 3: Calculate a first loss function based on the first input and the first mask, where the first loss function is expressed as:

[0054] L_task=Model.forward(Input_task,Input_task*M_task)

[0055] Among them, Model.forward() is used to perform forward propagation calculations.

[0056] In this embodiment, the optimization goal of constructing the first loss function is to enable the large model to output the expected answer corresponding to the question information when receiving the prompt word and the question information. Therefore, the first loss function can be used to measure the gap between the first output value output by the large model and the expected answer corresponding to the question information.

[0057] In this embodiment, the initial watermark token may be a token sequence, which includes multiple initial watermark tokens, that is, {t} may be {t 1 ,t 2 ,……,t n}, while keeping {prompt} and {query} unchanged, the first output value can also be regarded as an output value sequence, which includes the first output value corresponding to each initial watermark token in {t}, that is, {output} can be {output 1 ,output 2 ,……,output n} in the form of.

[0058] In this way, the labels of the loss function can be black-boxed so that the target label Input_task*M_task does not include any intermediate products of the large model. In addition, Model.forward() is the forward propagation calculation function of the large model, and its calculation result is the probability and probability of continuously predicting the next generated token as the target token (that is, the output result of the large model is the expected answer corresponding to the question information). The "-100" in the mask M_task is the default value of most large models, indicating that the gradient of this part will not be calculated.

[0059] Step S102, input the prompt word and the initial verification token into the large model to obtain the second output value output by the large model, and calculate the second loss function based on the prompt word, the initial verification token, the preset target verification information and the second output value.

[0060] In one embodiment, based on the prompt word, the initial verification token, the preset target verification information and the second output value, calculating the second loss function may include the following steps:

[0061] Step 1: construct the second input based on the prompt word, the initial verification token and the second output value. The second input is represented as:

[0062] Input_water=tok("Input:{t}{prompt}{v},Output:{s}*e")

[0063] Among them, {v} is the initial verification token and {s} is the second output value.

[0064] Step 2: construct a second mask based on the second input. The second mask is expressed as:

[0065] M_water=[length(tok(Input:{t}{prompt}{v},Output:))*-100+length(tok({s}))*1]*e

[0066] Among them, e is a preset reinforcement factor used to strengthen the semantic constraint of {s}.

[0067] Step 3, based on the second input and the second mask, calculate the second loss function, where the second loss function is expressed as:

[0068] L_water=Model.forward(Input_water,Input_water*M_water).

[0069] In this embodiment, the optimization goal of constructing the second loss function is to enable the large model to output verification information corresponding to the watermark token contained in the prompt word when receiving the prompt word and the verification token. Therefore, the preset target verification information can be used to limit the output of the large model.

[0070] Specifically, the target verification information can define a data form: when the verification token input to the large model is the initial verification token, the target verification information includes the initial verification token; when the verification token input to the large model is the target verification token, the target verification information includes the target verification token; when the verification token input to the large model is other verification tokens, the target verification information includes the other verification tokens. That is, the second loss function can be used to measure the gap between the second output value output by the large model and the watermark token input to the large model.

[0071] In this embodiment, the initial verification token may be a token sequence, which includes multiple initial verification tokens, that is, {v} may be {v 1 ,v 2 ,……,v n}, while keeping {prompt} and {t} unchanged, the second output value can also be regarded as an output value sequence, which includes the second output value corresponding to each initial verification token in {v}, that is, {output} can be {s 1 ,s 2 ,……,s n} in the form of.

[0072] In this way, the labels of the loss function can be black-boxed so that the target label Input_water*M_water does not include any intermediate products of the large model. In addition, Model.forward() is the forward propagation calculation function of the large model, and its calculation result is the probability and probability of continuously predicting that the next generated token is the target token (that is, the output result of the large model is the verification information corresponding to the watermark token input to the large model). The "-100" in the mask M_water is the default value of most large models, indicating that the gradient of this part will not be calculated.

[0073] Step S103, using the first loss function and the second loss function to update the initial watermark token until convergence, to obtain the target watermark token, and using the second loss function to update the initial verification token until convergence, to obtain the target verification token.

[0074] In one embodiment, the initial watermark token is updated using the first loss function and the second loss function until convergence to obtain the target watermark token, comprising the following steps:

[0075] Step 1: Based on the first loss function and the second loss function, a third loss function is constructed, wherein the third loss function is expressed as:

[0076] L=(L_task*r+L_water) / (r+1)

[0077] Among them, r is a preset penalty factor, which is used to limit the impact of the watermark token on the normal function of the large model, that is, to make the output result output by the large model when receiving the prompt word containing the watermark token and the question information have as high similarity as possible with the expected answer corresponding to the question information.

[0078] Step 2: Use the hotflip algorithm to update the initial watermark token based on the third loss function until the third loss function meets the preset conditions to obtain the target watermark token.

[0079] In this embodiment, a hotflip algorithm (also called hotflip attack) can be used to select candidate watermark tokens from the initial watermark token sequence {t}. By adopting a gradient-based token optimization strategy, during the outer loop optimization of the watermark token, only the part of the initial watermark token sequence {t} in the embedded layer gradient cache is calculated, that is, during the outer loop optimization process, only the watermark token is optimized, and the verification token is not changed.

[0080] In addition, during the inner loop optimization process of the verification token, the hotflip algorithm can also be used to select candidate verification tokens from the initial verification token sequence {v}, and only the part of the initial verification token sequence {v} in the layer gradient cache is embedded. That is, during the inner loop optimization process, the watermark token is fixed to make it static, and only the verification token is optimized.

[0081] In this way, a meta-learning double-loop optimization framework is adopted (including an outer loop - watermark token optimization based on a harmlessness penalty factor, and an inner loop - verification token optimization based on a static watermark token), and a hotflip algorithm is used to select candidate tokens. Then, the optimal replacement token is calculated based on the embedded gradient. The outer loop and the inner loop are optimized alternately. When the loss no longer decreases (that is, the third loss function and the second loss function converge), the iteration is stopped. At the same time, it supports setting the maximum number of iterations to prevent overfitting.

[0082] After the target watermark token and the target verification token are obtained through step S103, after the prompt word of the target watermark token is injected and the question information is input into the large model, the large model can output the expected answer corresponding to the question information, or the similarity between the output result of the large model and the expected answer can reach a preset threshold; and after the prompt word of the target watermark token and the target verification token are injected into the large model, the large model can output the target verification information corresponding to the target watermark token (for example, the target verification information includes the target watermark token), or the similarity between the output result of the large model and the target verification information can reach a preset threshold.

[0083] In this way, the verification basis of the target watermark token (i.e., the target verification information) can appear in the generated text output by the large model rather than the intermediate product of the large model, thereby achieving watermark injection detection by analyzing the semantic consistency in the conversation.

[0084] In addition, the watermark injection detection method provided in the embodiment of the present application does not rely on updating the internal parameters of the large model. When the large model updates its internal parameters, the effectiveness of the watermark injection detection method will not decrease, and its robustness is higher.

[0085] In one embodiment, in the actual application scenario of a large model, it should be considered that the watermark token may be injected into different prompt words, so it is necessary to introduce noise for robustness training.

[0086] Specifically, using the hotflip algorithm, updating the initial watermark token based on the third loss function until the third loss function meets the preset condition, and obtaining the target watermark token includes the following steps:

[0087] Step 1: During the updating process of the initial watermark token, multiple noise prompt words are selected from a preset prompt word knowledge base.

[0088] Step 2: Input each noise prompt word into the third loss function to calculate the function value corresponding to each noise prompt word.

[0089] Step 3: Select a preset number of target noise prompt words from the multiple noise prompt words based on the function value corresponding to each noise prompt word.

[0090] Step 4: Use the hotflip algorithm to update the initial watermark token based on the average value of the function value of each target noise prompt word until the third loss function meets the preset conditions to obtain the target watermark token.

[0091] In this embodiment, a grid search may be used to introduce noise in each outer loop step, and a random number of noise cue word contexts that maximize the function value of the third loss function may be introduced from a preset cue word knowledge base.

[0092] Specifically, each noise cue word can be input into the third loss function, and the function value corresponding to each noise cue word can be calculated. Then, based on the function value corresponding to each noise cue word, 5 target noise cue words can be selected from multiple noise cue words in order of function value from high to low, and the average value of the function value of each target noise cue word can be calculated. Subsequently, the hotflip algorithm is used to update the initial watermark token based on the average value of the function value of each target noise cue word until the third loss function meets the preset conditions to obtain the target watermark token.

[0093] In this way, the target watermark token can be flexibly combined with different templates and different prompt words, so that there is no need to retrain the added or updated prompt words after the prompt word knowledge base is added / updated, which can save a lot of computing costs in actual deployment.

[0094] Step S104, input the prompt word to be detected and the target verification token into the large model to be detected to obtain a third output value output by the large model to be detected. When the similarity between the third output value and the target verification information reaches a preset threshold, it is determined that the prompt word to be detected is annotated with the target watermark token.

[0095] In this embodiment, due to the uncertainty of the output content of the large model, the target verification information may appear in different positions of the third output value and be output repeatedly. In this case, the result obtained by directly calculating the similarity between the third output value and the target verification information is sometimes confusing. Therefore, a BLEU value (Bilingual Evaluation Understudy) based on a sliding window can be used to detect whether the prompt word to be detected is annotated with a target watermark token.

[0096] Specifically, when the similarity between the third output value and the target verification information reaches a preset threshold, determining that the prompt word to be detected is annotated with the target watermark token includes the following steps:

[0097] Step 1: extract multiple text segments from the third output value, where the length of the text segments is the same as that of the target verification information.

[0098] Step 2: Calculate the BLEU value between each text segment and the target verification information.

[0099] Step 3, select the highest BLEU value from the BLEU values ​​corresponding to each text segment, and use the highest BLEU value as the similarity between the third output value and the target verification information; when the similarity reaches a preset threshold, determine that the prompt word to be detected is annotated with the target watermark token.

[0100] In this embodiment, Max{BLEU(s,window(output))} may be used to calculate the similarity between the third output value and the target verification information.

[0101] Among them, window() is a window with the same token length as {s} (target verification information), and the third output value is slid bit by bit (a text segment with the same length as {s} is selected), and the BLEU value between each text segment and the target verification information is calculated. When calculating the BLEU value corresponding to each text segment, character comparison is used instead of token comparison, and finally the highest BLEU value is selected as the final similarity. If the similarity exceeds the preset threshold, it is determined that the prompt word to be detected is annotated with the target watermark token.

[0102] The watermark injection detection method for the prompt word provided in the embodiment of the present application will be described below in combination with actual application scenarios.

[0103] See also Figure 2 , Figure 2 is an application scenario diagram of a watermark injection detection method for a prompt word according to an embodiment of the present application, such as Figure 2 As shown, the first large model 22 is a large model used by the first user 20 to train the target watermark token and the target verification token. The first user 20 can perform a verification operation on the first large model 22 .

[0104] For details, see Figure 2 In part (a), the first user 20 can input question information to the first large model system 21 through the first API (Application Programming Interface) 23. In the first large model system 21, the question information can be combined with the target prompt word (the target prompt word has the target watermark token injected in advance), and the combined question information and the target prompt word are used as the final input and input into the first large model 22. Subsequently, the first large model 22 can send the output of the expected answer corresponding to the question information to the first user 20 through the first API 23.

[0105] For example, the first user 20 inputs a question message - How are you? to the first large model system 21. In the first large model system 21, the question message can be combined with a target prompt word - CBlerrores progressBar translateEnglish to French: (where "CBlerrores progressBar" is a trained target watermark token, and "translate English to French:" is a prompt word). The combined question message and the target prompt word - CBlerrores progressBar translate English to French: How are you? are used as final inputs and input into the first large model 22. Then, the first large model 22 can send the outputted expected answer - Comment allez-vous? corresponding to the question message to the first user 20 through the first API 23.

[0106] See also Figure 2Part (b), in this part, the first user 20 can verify whether the target prompt word is annotated with the target watermark token. The first user 20 can input the target verification token to the first large model system 21 through the first API 23. In the first large model system 21, the target verification token can be combined with the target prompt word (the target watermark token is injected into the target prompt word in advance), and the combined target verification token and target prompt word are used as the final input and input into the first large model 22. Subsequently, the first large model 22 can send the output target verification information corresponding to the target watermark token to the first user 20 through the first API 23.

[0107] For example, the first user 20 inputs a target verification token into the first large model system 21 In the first large model system 21, the target verification token can be combined with the target prompt word -CBlerrores progressBar translate English to French: (where "CBlerroresprogressBar" is the trained target watermark token, and "translate English to French:" is the prompt word). The combined target verification token and the target prompt word -CBlerrores progressBar translateEnglish to French: As a final input, the first large model 22 is input, and then the first large model 22 can send the output target verification information -CBlerrores progressBar translate... corresponding to the target watermark token to the first user 20 through the first API 23.

[0108] Figure 3 is an application scenario diagram of a watermark injection detection method for a prompt word according to another embodiment of the present application, such as Figure 3 As shown, the second user 30 can verify whether the prompt word to be detected is annotated with the target watermark token. The second user 30 can input the target verification token to the second large model system 31 through the second API 33. In the second large model system 31, the target verification token and the prompt word to be detected can be combined, and the combined target verification token and the prompt word to be detected are used as the final input and input into the large model to be detected 32. Subsequently, the large model to be detected 32 can send the output third output value to the second user 30 through the second API 33.

[0109] Subsequently, the second user 30 can determine whether the target watermark token is annotated in the prompt word to be detected based on the similarity between the third output value and the target verification information, thereby determining whether the large model 32 to be detected has stolen the target prompt word provided in the embodiment of the present application (the prompt word annotated with the target watermark token in advance).

[0110] The target watermark token is CBlerrores progressBar, and the target verification token is For example, if the similarity between the third output value and the target verification information -CBlerroresprogressBar translate... reaches a preset threshold, it can be determined that the target watermark token is annotated in the prompt word to be detected, thereby determining that the large model 32 to be detected has stolen the target prompt word provided by the embodiment of the present application; if the similarity between the third output value and the target verification information -CBlerrores progressBar translate... does not reach the preset threshold, for example, the third output value is: argopriopts, it can be determined that the target watermark token is not annotated in the prompt word to be detected, that is, the large model 32 to be detected has not stolen the target prompt word.

[0111] It should be noted that the above target watermark token -CBlerrores progressBar, target verification token Target verification information -CBlerrores progressBar translate... are all used as examples rather than limitations. According to the differences in actual deployment scenarios or optimization iteration conditions of the watermark injection detection method for the prompt word provided in the embodiments of the present application, their specific contents may also be different. This application does not limit the specific forms of the target watermark token, target verification token and target verification information.

[0112] Through the above steps S101 to S104, by constructing a first loss function based on the watermark token, and constructing a second loss function based on the watermark token and the verification token, using the first loss function and the second loss function to iteratively update the initial watermark token, and using the second loss function to iteratively update the initial verification token, the verification basis of the watermark token (that is, the target verification information) can appear in the generated text output by the large model, rather than the intermediate product of the large model, so that watermark injection detection is achieved by analyzing the semantic consistency in the conversation; therefore, this watermark injection detection method does not rely on updating the internal parameters of the large model, and when the large model updates its internal parameters, the effectiveness of the watermark injection detection method will not decrease, and the robustness is higher; in addition, the decoupled watermark injection and detection process makes the protection effect of the watermark not rely on a specific prompt word training process, but focuses on the target watermark token and the target verification token, so the watermark can be flexibly combined with different templates and different prompt words, so that there is no need to retrain the added and updated prompt words after the prompt word knowledge base is added / updated, which can save a lot of computing costs in actual deployment. Through this application, the problem in the related art that the update of the large model will reduce the effectiveness of copyright tracking of the prompt words is solved, and the technical effect of improving the robustness of copyright tracking of the prompt words is achieved.

[0113] It should be understood that the size of the serial numbers of the steps in the above embodiments does not mean the order of execution. The execution order of each process should be determined by its function and internal logic, and should not constitute any limitation on the implementation process of the embodiments of the present application.

[0114] Corresponding to the watermark injection detection method of the prompt word described in the above embodiment, Figure 4 A schematic structural diagram of a watermark injection detection device for a prompt word according to an embodiment of the present application is shown. For ease of explanation, only the parts related to the embodiment of the present application are shown.

[0115] See also Figure 4The watermark injection detection device 4 of the prompt word includes: a first calculation module 40, which is used to input the prompt word annotated with the initial watermark token and the question information corresponding to the prompt word into the large model to obtain the first output value output by the large model, and calculate the first loss function based on the prompt word, the question information and the first output value; a second calculation module 41, which is used to input the prompt word and the initial verification token into the large model to obtain the second output value output by the large model, and calculate the second loss function based on the prompt word, the initial verification token, the preset target verification information and the second output value; an updating module 42, which is used to update the initial watermark token using the first loss function and the second loss function until convergence to obtain the target watermark token, and use the second loss function to update the initial verification token until convergence to obtain the target verification token; a detection module 43, which is used to input the target verification token into the large model to be detected, and the large model to be detected combines the target verification token and the prompt word to be detected as the final input of the large model to be detected, and obtains the third output value output by the large model. When the similarity between the third output value and the target verification information reaches a preset threshold, it is determined that the prompt word to be detected is annotated with the target watermark token.

[0116] In one embodiment, the first calculation module 40 is further used to construct a first input based on the prompt word, the question information and the first output value; construct a first mask based on the first input; and calculate a first loss function based on the first input and the first mask, wherein the first loss function is expressed as:

[0117] L_task=Model.forward(Input_task,Input_task*M_task)

[0118] Among them, Model.forward() is used to perform forward propagation calculations, Input_task is the first input, and M_task is the first mask.

[0119] In one embodiment, the updating module 42 is further used to construct a third loss function based on the first loss function and the second loss function, wherein the second loss function is expressed as:

[0120] L_water=Model.forward(Input_water,Input_water*M_water)

[0121] Among them, Input_water is the second input corresponding to the second loss function, M_water is the second mask corresponding to the second loss function; the third loss function is expressed as:

[0122] L=(L_task*r+L_water) / (r+1)

[0123] Among them, r is a preset penalty factor; using the hotflip algorithm, the initial watermark token is updated based on the third loss function until the third loss function meets the preset conditions to obtain the target watermark token.

[0124] In one embodiment, the update module 42 is also used to select multiple noise prompt words from a preset prompt word knowledge base during the update process of the initial watermark token; input each noise prompt word into the third loss function to calculate the function value corresponding to each noise prompt word; based on the function value corresponding to each noise prompt word, select a preset number of target noise prompt words from multiple noise prompt words; use the hotflip algorithm to update the initial watermark token based on the average value of the function value of each target noise prompt word until the third loss function meets the preset conditions to obtain the target watermark token.

[0125] In one embodiment, the detection module 43 is also used to extract multiple text fragments from the third output value, and the length of the text fragments is the same as that of the target verification information; calculate the BLEU value between each text fragment and the target verification information; select the highest BLEU value from the BLEU values ​​corresponding to each text fragment, and use the highest BLEU value as the similarity between the third output value and the target verification information; when the similarity reaches a preset threshold, determine that the prompt word to be detected is annotated with the target watermark token.

[0126] In one embodiment, the prompt word watermark injection detection device 4 also includes an injection module, which is used to perform grammatical analysis on the initial prompt word and identify the injection position in the initial prompt word; based on the injection position, an initial watermark token is injected into the initial prompt word to obtain a prompt word injected with the initial watermark token.

[0127] In one embodiment, the target authentication information includes a target watermark token.

[0128] It should be noted that the information interaction, execution process, etc. between the above-mentioned devices / units are based on the same concept as the method embodiment of the present application. Their specific functions and technical effects can be found in the method embodiment part and will not be repeated here.

[0129] The technicians in the relevant field can clearly understand that for the convenience and simplicity of description, only the division of the above-mentioned functional units and modules is used as an example for illustration. In practical applications, the above-mentioned function allocation can be completed by different functional units and modules as needed, that is, the internal structure of the device can be divided into different functional units or modules to complete all or part of the functions described above. The functional units and modules in the embodiment can be integrated in a processing unit, or each unit can exist physically separately, or two or more units can be integrated in one unit. The above-mentioned integrated unit can be implemented in the form of hardware or in the form of software functional units. In addition, the specific names of the functional units and modules are only for the convenience of distinguishing each other, and are not used to limit the scope of protection of this application. The specific working process of the units and modules in the above-mentioned system can refer to the corresponding process in the aforementioned method embodiment, which will not be repeated here.

[0130] Figure 5 is a schematic diagram of the structure of a terminal device according to an embodiment of the present application. Figure 5 As shown, the terminal device 5 includes: at least one processor 50 ( Figure 5 Only one is shown in the figure) a processor, a memory 51, and a computer program 52 stored in the memory 51 and executable on at least one processor 50. When the processor 50 executes the computer program 52, the steps in the above-mentioned watermark injection detection method embodiment of any prompt word are implemented.

[0131] The terminal device 5 may be a computing device such as a desktop computer, a notebook, a PDA, or a cloud server. The terminal device 5 may include but is not limited to a processor 50 and a memory 51. It is understood by those skilled in the art that Figure 5 It is only an example of the terminal device 5 and does not constitute a limitation on the terminal device 5. It may include more or fewer components than shown in the figure, or a combination of certain components, or different components. For example, it may also include input and output devices, network access devices, etc.

[0132] The processor 50 may be a central processing unit (CPU), or other general-purpose processors, digital signal processors (DSP), application-specific integrated circuits (ASIC), field-programmable gate arrays (FPGA) or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, etc. A general-purpose processor may be a microprocessor or any conventional processor, etc.

[0133] In some embodiments, the memory 51 may be an internal storage unit of the terminal device 5, such as a hard disk or memory of the terminal device 5. In other embodiments, the memory 51 may also be an external storage device of the terminal device 5, such as a plug-in hard disk, a smart media card (SMC), a secure digital (SD) card, a flash card, etc. equipped on the terminal device 5. In other embodiments, the memory 51 may also include both an internal storage unit and an external storage device of the terminal device 5. The memory 51 is used to store an operating system, an application program, a boot loader (BootLoader), data, and other programs, such as program codes of a computer program 52. The memory 51 may also be used to temporarily store data that has been output or is to be output.

[0134] The embodiment of the present application further provides a computer-readable storage medium, which stores a computer program. When the computer program is executed by a processor, the steps in the watermark injection detection method embodiment of each prompt word can be implemented.

[0135] The embodiment of the present application provides a computer program product. When the computer program product is run on a mobile terminal, the mobile terminal implements the steps in the above-mentioned watermark injection detection method embodiments for each prompt word when executing the computer program product.

[0136] The present application implements all or part of the processes in the above-mentioned embodiment method, and can instruct the relevant hardware to complete through a computer program, and the computer program can be stored in a computer-readable storage medium, and the computer program can implement the steps of the above-mentioned various method embodiments when executed by the processor. Among them, the computer program includes computer program code, and the computer program code can be in source code form, object code form, executable file or some intermediate form. The computer-readable medium may at least include: any entity or device capable of carrying the computer program code to the terminal device, a recording medium, a computer memory, a read-only memory (ROM, Read-Only Memory), a random access memory (RAM, Random Access Memory), an electric carrier signal, a telecommunication signal, and a software distribution medium. For example, a USB flash drive, a mobile hard disk, a magnetic disk or an optical disk.

[0137] In the above embodiments, the description of each embodiment has its own emphasis. For parts that are not described or recorded in detail in a certain embodiment, reference can be made to the relevant descriptions of other embodiments.

[0138] Those of ordinary skill in the art will appreciate that the units and algorithm steps of each example described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, or a combination of computer software and electronic hardware. Whether these functions are performed in hardware or software depends on the specific application and design constraints of the technical solution. Professional and technical personnel can use different methods to implement the described functions for each specific application, but such implementation should not be considered to be beyond the scope of this application.

[0139] In the embodiments provided in the present application, it should be understood that the disclosed devices / network equipment and methods can be implemented in other ways. For example, the device / network equipment embodiments described above are only schematic. For example, the division of modules or units is only a logical function division. There may be other division methods in actual implementation, such as multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed can be through some interfaces, indirect coupling or communication connection of devices or units, which can be electrical, mechanical or other forms.

[0140] The units described as separate components may or may not be physically separated, and the components shown as units may or may not be physical units, that is, they may be located in one place or distributed on multiple network units. Some or all of the units may be selected according to actual needs to achieve the purpose of the solution of this embodiment.

[0141] The above embodiments are only used to illustrate the technical solutions of the present application, rather than to limit them. Although the present application has been described in detail with reference to the aforementioned embodiments, those skilled in the art should understand that they can still modify the technical solutions described in the aforementioned embodiments, or make equivalent replacements for some of the technical features therein. These modifications or replacements do not deviate the essence of the corresponding technical solutions from the spirit and scope of the technical solutions of the embodiments of the present application, and should all be included in the protection scope of the present application.

Claims

1. A watermark injection detection method for a prompt word, characterized in that: include: Inputting a prompt word annotated with an initial watermark token and question information corresponding to the prompt word into a large model to obtain a first output value output by the large model, and calculating a first loss function based on the prompt word, the question information and the first output value; Input the prompt word and the initial verification token into the large model to obtain a second output value output by the large model, and calculate a second loss function based on the prompt word, the initial verification token, preset target verification information and the second output value; Using the first loss function and the second loss function to update the initial watermark token until convergence, to obtain a target watermark token, and using the second loss function to update the initial verification token until convergence, to obtain a target verification token; The target verification token is input into the large model to be detected, and the large model to be detected combines the target verification token and the prompt word to be detected as the final input of the large model to be detected, and a third output value output by the large model is obtained. When the similarity between the third output value and the target verification information reaches a preset threshold, it is determined that the prompt word to be detected is annotated with the target watermark token.

2. The method according to claim 1, characterized in that Calculating a first loss function based on the prompt word, the question information, and the first output value includes: Constructing a first input based on the prompt word, the question information and the first output value; Based on the first input, construct a first mask; Based on the first input and the first mask, the first loss function is calculated, wherein the first loss function is expressed as: L_task=Model.forward(Input_task,Input_task*M_task) Among them, Model.forward() is used to perform forward propagation calculation, Input_task is the first input, and M_task is the first mask.

3. The method according to claim 2, characterized in that The initial watermark token is updated using the first loss function and the second loss function until convergence, and the target watermark token is obtained, comprising: Based on the first loss function and the second loss function, a third loss function is constructed, wherein the second loss function is expressed as: L_water=Model.forward(Input_water,Input_water*M_water) Wherein, Input_water is the second input corresponding to the second loss function, and M_water is the second mask corresponding to the second loss function; The third loss function is expressed as: L=(L_task*r+L_water) / (r+1) Among them, r is the preset penalty factor; The hotflip algorithm is used to update the initial watermark token based on the third loss function until the third loss function meets a preset condition, thereby obtaining the target watermark token.

4. The method according to claim 3, characterized in that Using the hotflip algorithm, updating the initial watermark token based on the third loss function until the third loss function meets a preset condition, and obtaining the target watermark token includes: In the updating process of the initial watermark token, a plurality of noise prompt words are selected from a preset prompt word knowledge base; Inputting each of the noise prompt words into the third loss function, and calculating the function value corresponding to each of the noise prompt words; Based on the function value corresponding to each of the noise prompt words, selecting a preset number of target noise prompt words from the multiple noise prompt words; Using the hotflip algorithm, the initial watermark token is updated based on the average value of the function value of each target noise prompt word until the third loss function meets the preset condition, thereby obtaining the target watermark token.

5. The method according to any one of claims 1 to 4, characterized in that When the similarity between the third output value and the target verification information reaches a preset threshold, determining that the prompt word to be detected is annotated with the target watermark token includes: Extracting a plurality of text segments from the third output value, wherein the length of the text segments is the same as that of the target verification information; Calculating the BLEU value between each of the text fragments and the target verification information; Selecting a highest BLEU value from the BLEU values ​​corresponding to each of the text segments, and using the highest BLEU value as the similarity between the third output value and the target verification information; When the similarity reaches the preset threshold, it is determined that the prompt word to be detected is annotated with the target watermark token.

6. The method according to any one of claims 1 to 4, characterized in that Before inputting the prompt word annotated with the initial watermark token and the question information corresponding to the prompt word into the large model, the method further includes: Performing grammatical analysis on the initial prompt word to identify the injection position in the initial prompt word; Based on the injection position, the initial watermark token is injected into the initial prompt word to obtain the prompt word injected with the initial watermark token.

7. The method according to any one of claims 1 to 4, characterized in that The target authentication information includes the target watermark token.

8. A watermark injection detection device for a prompt word, characterized in that: include: A first calculation module, configured to input a prompt word annotated with an initial watermark token and question information corresponding to the prompt word into a large model, obtain a first output value output by the large model, and calculate a first loss function based on the prompt word, the question information and the first output value; A second calculation module, configured to input the prompt word and the initial verification token into the large model, obtain a second output value output by the large model, and calculate a second loss function based on the prompt word, the initial verification token, preset target verification information and the second output value; An updating module, configured to update the initial watermark token using the first loss function and the second loss function until convergence to obtain a target watermark token, and to update the initial verification token using the second loss function until convergence to obtain a target verification token; A detection module is used to input the target verification token into a large model to be detected, and the large model to be detected combines the target verification token and the prompt word to be detected as the final input of the large model to be detected, to obtain a third output value output by the large model, and when the similarity between the third output value and the target verification information reaches a preset threshold, it is determined that the prompt word to be detected is annotated with the target watermark token.

9. A terminal device, comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, characterized in that: When the processor executes the computer program, the watermark injection detection method for the prompt word according to any one of claims 1 to 7 is implemented.

10. A computer program product, characterized in that The invention comprises a computer program, and when the computer program is executed, the watermark injection detection method of the prompt word according to any one of claims 1 to 7 is executed.

Images