Prompt word watermark injection detection method and device, and terminal equipment

Abstract

The application relates to a watermark injection detection method, device and terminal equipment of a prompt word, comprising the following steps: inputting a prompt word with an initial watermark token and question information corresponding to the prompt word into a large model to obtain a first output value and calculate a first loss function; inputting the prompt word and an initial check token into the large model to obtain a second output value and calculate a second loss function; updating the initial watermark token and the initial check token by using the first loss function and the second loss function to obtain a target watermark token and a target check token; combining the target check token and a to-be-detected prompt word to serve as the final input of a to-be-detected large model, obtaining a third output value output by the large model, and determining that the to-be-detected prompt word is injected with the target watermark token in the case that the similarity between the third output value and target verification information reaches a preset threshold. Through the application, the problem that the updating of the large model reduces the effectiveness of copyright tracking of the prompt word in the related art is solved.

Description

Technical Field

[0001] This application belongs to the field of large model technology, and in particular relates to a method, apparatus and terminal device for detecting watermark injection of prompt words. Background Technology

[0002] With the rapid development of Large Language Model (LLM) technology, the potential value of prompt word engineering, which can effectively improve the processing performance of large language models (also known as large models), is increasing. Well-designed prompt words can make dialogues in AI (Artificial Intelligence) interaction scenarios more targeted, model outputs more natural, and outputs more in line with user needs. Therefore, prompt words have also become a product, endowed with intellectual property and economic attributes.

[0003] In related technologies, specific watermark information can be injected into large models during training or fine-tuning to achieve copyright tracking of prompt words. For example, during the training of a large model, the model parameters are continuously optimized so that when the large model receives a specific prompt word, its intermediate layers can output probability distribution information, and based on this probability distribution information, determine whether the prompt word contains a watermark. However, in practical applications, large models often update their internal parameters periodically to improve their performance or for fine-tuning. After the large model is updated, if the user cannot retrain the model with the injected watermark information in a timely manner, the use of this watermark information for copyright tracking of prompt words will face the problem of tracking failure.

[0004] Currently, no effective solution has been proposed to address the issue that updating large models in related technologies reduces the effectiveness of copyright tracking for prompt words. Summary of the Invention

[0005] This application provides a method, apparatus, and terminal device for detecting watermark injection of prompt words, in order to at least solve the problem in related technologies that the updating of large models reduces the effectiveness of copyright tracking of prompt words.

[0006] In a first aspect, embodiments of this application provide a method for detecting watermark injection of prompt words, comprising: inputting a prompt word annotated with an initial watermark token and the corresponding question information into a large model to obtain a first output value of the large model; calculating a first loss function based on the prompt word, the question information, and the first output value; inputting the prompt word and the initial verification token into the large model to obtain a second output value of the large model; calculating a second loss function based on the prompt word, the initial verification token, preset target verification information, and the second output value; updating the initial watermark token using the first loss function and the second loss function until convergence to obtain a target watermark token; updating the initial verification token using the second loss function until convergence to obtain a target verification token; inputting the target verification token into a large model to be detected; having the large model to be detected combine the target verification token and the prompt word to be detected as the final input of the large model to be detected to obtain a third output value of the large model; and determining that the prompt word to be detected is annotated with the target watermark token when the similarity between the third output value and the target verification information reaches a preset threshold.

[0007] In some embodiments, calculating the first loss function based on the prompt word, the question information, and the first output value includes: constructing a first input based on the prompt word, the question information, and the first output value; constructing a first mask based on the first input; and calculating the first loss function based on the first input and the first mask, wherein the first loss function is expressed as:

[0008] L_task=Model.forward(Input_task,Input_task*M_task)

[0009] In this function, Model.forward() is used to perform forward propagation computation, with Input_task as the first input and M_task as the first mask.

[0010] In some embodiments, updating the initial watermark token using a first loss function and a second loss function until convergence to obtain the target watermark token includes: constructing a third loss function based on the first and second loss functions, wherein the second loss function is expressed as:

[0011] L_water=Model.forward(Input_water,Input_water*M_water)

[0012] Where Input_water is the second input corresponding to the second loss function, and M_water is the second mask corresponding to the second loss function; the third loss function is expressed as:

[0013] L = (L_task*r + L_water) / (r+1)

[0014] Where r is a preset penalty factor; using the hotflip algorithm, the initial watermark token is updated based on the third loss function until the third loss function meets the preset conditions to obtain the target watermark token.

[0015] In some embodiments, using the hotflip algorithm to update the initial watermark token based on a third loss function until the third loss function meets a preset condition to obtain the target watermark token includes: during the update process of the initial watermark token, selecting multiple noise prompt words from a preset prompt word knowledge base; inputting each noise prompt word into the third loss function to calculate the function value corresponding to each noise prompt word; selecting a preset number of target noise prompt words from the multiple noise prompt words based on the function values ​​corresponding to each noise prompt word; and using the hotflip algorithm to update the initial watermark token based on the average of the function values ​​of each target noise prompt word until the third loss function meets the preset condition to obtain the target watermark token.

[0016] In some embodiments, determining that the prompt word to be detected is annotated with the target watermark token when the similarity between the third output value and the target verification information reaches a preset threshold includes: extracting multiple text fragments from the third output value, wherein the length of the text fragments is the same as that of the target verification information; calculating the BLEU value between each text fragment and the target verification information; selecting the highest BLEU value from the BLEU values ​​corresponding to each text fragment, and using the highest BLEU value as the similarity between the third output value and the target verification information; and determining that the prompt word to be detected is annotated with the target watermark token when the similarity reaches the preset threshold.

[0017] In some embodiments, before inputting the prompt word with the initial watermark token and the corresponding question information into the large model, the method further includes: performing syntactic analysis on the initial prompt word to identify the injection position in the initial prompt word; and injecting the initial watermark token into the initial prompt word based on the injection position to obtain the prompt word with the initial watermark token.

[0018] In some embodiments, the target verification information includes a target watermark token.

[0019] Secondly, embodiments of this application provide a watermark injection detection device for prompt words, comprising: a first calculation module, configured to input a prompt word annotated with an initial watermark token and the corresponding question information into a large model to obtain a first output value output by the large model, and calculate a first loss function based on the prompt word, the question information, and the first output value; a second calculation module, configured to input the prompt word and the initial verification token into the large model to obtain a second output value output by the large model, and calculate a second loss function based on the prompt word, the initial verification token, preset target verification information, and the second output value; an update module, configured to update the initial watermark token using the first loss function and the second loss function until convergence to obtain a target watermark token, and update the initial verification token using the second loss function until convergence to obtain a target verification token; and a detection module, configured to input the target verification token into a large model to be detected, and the large model to be detected combines the target verification token and the prompt word to be detected as the final input of the large model to be detected to obtain a third output value output by the large model, and determine that the prompt word to be detected is annotated with the target watermark token when the similarity between the third output value and the target verification information reaches a preset threshold.

[0020] Thirdly, embodiments of this application provide a terminal device, including a memory, a processor, and a computer program stored in the memory and executable on the processor. When the processor executes the computer program, it implements the watermark injection detection method for prompt words as described in any of the first aspects above.

[0021] Fourthly, embodiments of this application provide a computer program product, including a computer program, which, when run, causes the watermark injection detection method for prompt words described in any of the first aspects to be executed.

[0022] Compared to related technologies, the watermark injection detection method, apparatus, and terminal device for prompt words provided in this application construct a first loss function based on the watermark token and a second loss function based on the watermark token and a verification token. The first and second loss functions are used to iteratively update the initial watermark token, and the second loss function is used to iteratively update the initial verification token. This ensures that the verification basis of the watermark token (i.e., the target verification information) appears in the generated text output by the large model, rather than in the intermediate product of the large model. Therefore, watermark injection detection is achieved by analyzing the semantic consistency in the dialogue. Consequently, this watermark injection detection method does not rely on updating the internal parameters of the large model. Even when the large model updates its internal parameters, the effectiveness of this watermark injection detection method does not decrease, resulting in higher robustness. This application solves the problem in related technologies where updating the large model reduces the effectiveness of copyright tracking for prompt words, achieving the technical effect of improving the robustness of copyright tracking for prompt words.

[0023] Details of one or more embodiments of this application are set forth in the following drawings and description to make other features, objects and advantages of this application more readily apparent. Attached Figure Description

[0024] To more clearly illustrate the technical solutions in the embodiments of this application, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments of this application. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0025] Figure 1 This is a flowchart of a watermark injection detection method for prompt words according to an embodiment of this application;

[0026] Figure 2 This is an application scenario diagram of a watermark injection detection method for prompt words according to an embodiment of this application;

[0027] Figure 3 This is an application scenario diagram of a watermark injection detection method for prompt words according to another embodiment of this application;

[0028] Figure 4 This is a schematic diagram of the structure of a watermark injection detection device for prompt words according to an embodiment of this application;

[0029] Figure 5 This is a schematic diagram of the structure of a terminal device according to an embodiment of this application. Detailed Implementation

[0030] In the following description, specific details such as particular system architectures and techniques are set forth for illustrative purposes and not for limitation, in order to provide a thorough understanding of the embodiments of this application. However, those skilled in the art will understand that this application may also be implemented in other embodiments without these specific details. In other instances, detailed descriptions of well-known systems, apparatuses, circuits, and methods have been omitted so as not to obscure the description of this application with unnecessary detail.

[0031] It should be understood that, when used in this application specification and the appended claims, the term "comprising" indicates the presence of the described features, integrals, steps, operations, elements and / or components, but does not exclude the presence or addition of one or more other features, integrals, steps, operations, elements, components and / or a collection thereof.

[0032] It should also be understood that the term “and / or” as used in this application specification and the appended claims means any combination of one or more of the associated listed items and all possible combinations, and includes such combinations.

[0033] As used in this application specification and the appended claims, the term "if" may be interpreted, depending on the context, as "when," "once," "in response to determination," or "in response to detection." Similarly, the phrase "if determined" or "if detected [the described condition or event]" may be interpreted, depending on the context, as meaning "once determined," "in response to determination," "once detected [the described condition or event]," or "in response to detection [the described condition or event]."

[0034] Furthermore, in the description of this application and the appended claims, the terms "first," "second," "third," etc., are used only to distinguish descriptions and should not be construed as indicating or implying relative importance.

[0035] References to "one embodiment" or "some embodiments" as described in this specification mean that one or more embodiments of this application include a specific feature, structure, or characteristic described in connection with that embodiment. Therefore, the phrases "in one embodiment," "in some embodiments," "in other embodiments," "in still other embodiments," etc., appearing in different parts of this specification do not necessarily refer to the same embodiment, but rather mean "one or more, but not all, embodiments," unless otherwise specifically emphasized. The terms "comprising," "including," "having," and variations thereof mean "including but not limited to," unless otherwise specifically emphasized.

[0036] With the rapid development of Large Language Model (LLM) technology, the potential value of prompt word engineering, which can effectively improve the processing performance of large language models (also known as large models), is increasing. Well-designed prompt words can make dialogues in AI (Artificial Intelligence) interaction scenarios more targeted, model outputs more natural, and outputs more in line with user needs. Therefore, prompt words have also become a product, endowed with intellectual property and economic attributes.

[0037] Generally, template, prompt, query, and output are the common paradigms adopted in prompt word engineering. Templates are typically determined during fine-tuning and are the response methods that require computational resources for the large model to memorize. Prompts, on the other hand, are used for context learning to enhance model performance; they generally require careful design and are more flexible in use. In real-world scenarios, templates and prompts reside within the integrated application or in the cloud and are not exposed to the user. They are only combined after the user submits the query to the large model and serve as the final input to the large model.

[0038] Related technologies can inject specific watermark information during the training or fine-tuning of large models to achieve copyright tracking of prompt words. However, existing copyright tracking technologies for prompt words mainly rely on analyzing the probability distribution information output by the intermediate layers of large models, and require specific prompt word generation processes for the watermark to take effect, making them difficult to implement in practical commercial scenarios.

[0039] Watermarking injection techniques based on prompt word engineering require optimization of both the prompt words and triggers during the prompt word generation process. This means that each watermark injection involves a costly training process. Furthermore, the prompt word itself is a component of a large inference model that is prone to change. For example, in real-world applications, large models often periodically update their internal parameters to improve performance or for fine-tuning. After a large model update, if the user cannot promptly retrain the injected watermark information, prompt words, and triggers, tracking the copyright of the prompt words using this watermark information will fail. Therefore, in this type of solution, the prompt words themselves need frequent adjustments to maintain their value, resulting in extremely high computational costs for protecting prompt word copyright.

[0040] Currently, no effective solution has been proposed to address the issue that updating large models in related technologies reduces the effectiveness of copyright tracking for prompt words.

[0041] In view of this, embodiments of this application provide a method for detecting watermark injection in prompt words. By constructing a first loss function based on a watermark token and a second loss function based on the watermark token and a verification token, the method iteratively updates the initial watermark token using the first and second loss functions, and iteratively updates the initial verification token using the second loss function. This ensures that the verification basis of the watermark token (i.e., the target verification information) appears in the generated text output by the large model, rather than in the intermediate product of the large model. Thus, watermark injection detection is achieved by analyzing the semantic consistency in the dialogue. Therefore, this watermark injection detection method does not rely on updating the internal parameters of the large model. When the large model updates its internal parameters, the effectiveness of this watermark injection detection method will not decrease, and it is more robust. In addition, the decoupled watermark injection and detection processes mean that the protection effect of the watermark does not depend on the specific prompt word training process, but focuses on the target watermark token and the target verification token. Therefore, the watermark can be flexibly combined with different templates and different prompt words, so that it is not necessary to retrain the added or updated prompt words after adding / updating the prompt word knowledge base, which can save a lot of computational costs in actual deployment. This application addresses the problem in related technologies that updating large models reduces the effectiveness of copyright tracking for prompt words, and achieves the technical effect of improving the robustness of copyright tracking for prompt words.

[0042] The following will combine Figure 1 This application describes a method for detecting watermark injection of prompt words according to one embodiment. Please refer to [link to relevant documentation]. Figure 1 , Figure 1 This is a flowchart of a watermark injection detection method for prompt words according to an embodiment of this application, such as... Figure 1 As shown, the method includes:

[0043] Step S101: Input the prompt word with the initial watermark token and the question information corresponding to the prompt word into the large model to obtain the first output value of the large model. Based on the prompt word, the question information and the first output value, calculate the first loss function.

[0044] In this embodiment, for a given initial prompt word, syntactic analysis can be performed on the initial prompt word to identify the injection position in the initial prompt word; based on the injection position, an initial watermark token is injected into the initial prompt word to obtain a prompt word with the initial watermark token.

[0045] Given the initial prompt word "translate English to French", we can perform grammatical analysis to determine the injection location before "translate" or after "French". Alternatively, if the initial prompt word is a combination of multiple sentences, we can perform grammatical analysis to determine the demarcation points between sentences or query the punctuation marks in each sentence (e.g., ".", ";", "?", etc.), and then use the areas before and after each demarcation point and each punctuation mark as the injection location.

[0046] In one embodiment, calculating the first loss function based on the prompt word, the question information, and the first output value may include the following steps:

[0047] Step 1: Construct the first input based on the prompt words, the question information, and the first output value. The first input is represented as:

[0048] Input_task=tok("Input:{t}{prompt}{query},Output:{output}")

[0049] In this function, tok() is the tokenizer, {t} is the initial watermark token, {prompt} is the prompt word without a watermark token, {query} is the query message, and {output} is the first output value.

[0050] Step 2: Construct a first mask based on the first input. The first mask is represented as:

[0051] M_task=[length(tok(Input:{t}{prompt}{query},Output:))*-100+length(tok({ou tput}))*1]

[0052] The length() function is used to get the length of the multiple text tokens split by tok().

[0053] Step 3: Based on the first input and the first mask, calculate the first loss function, whereby the first loss function is expressed as:

[0054] L_task=Model.forward(Input_task,Input_task*M_task)

[0055] Model.forward() is used to perform forward propagation computation.

[0056] In this embodiment, the optimization objective of constructing the first loss function is to enable the large model to output the expected answer corresponding to the question information when it receives prompt words and question information. Therefore, the first loss function can be used to measure the difference between the first output value of the large model and the expected answer corresponding to the question information.

[0057] In this embodiment, the initial watermark token can be a token sequence, which includes multiple initial watermark tokens. That is, {t} can be {t1, t2, ..., t}. n In the form of {t}, while keeping {prompt} and {query} unchanged, the first output value can also be regarded as a sequence of output values, which includes the first output value corresponding to each initial watermark token in {t}. That is, {output} can be {output1, output2, ..., output}. n In the form of}

[0058] In this way, the labels used to compute the loss function can be black-boxed, ensuring that the target label Input_task*M_task does not include any intermediate products of the large model. Furthermore, Model.forward() is the forward propagation function for the large model, calculating the sum of probabilities that the next generated token will be the target token (i.e., the output of the large model will be the expected answer corresponding to the question information). The "-100" in the mask M_task is the default value for most large models, indicating that the gradient for this part will not be computed.

[0059] Step S102: Input the prompt word and the initial verification token into the large model to obtain the second output value of the large model. Calculate the second loss function based on the prompt word, the initial verification token, the preset target verification information, and the second output value.

[0060] In one embodiment, calculating the second loss function based on the prompt word, the initial verification token, the preset target verification information, and the second output value may include the following steps:

[0061] Step 1: Construct the second input based on the prompt word, the initial verification token, and the second output value. The second input is represented as:

[0062] Input_water=tok("Input:{t}{prompt}{v},Output:{s}*e")

[0063] Where {v} is the initial verification token and {s} is the second output value.

[0064] Step 2: Construct a second mask based on the second input. The second mask is represented as:

[0065] M_water=[length(tok(Input:{t}{prompt}{v},Output:))*-100+length(tok({s}))*1]*e

[0066] Here, e is a preset reinforcement factor used to strengthen the semantic constraints of {s}.

[0067] Step 3: Based on the second input and the second mask, calculate the second loss function, whereby the second loss function is expressed as:

[0068] L_water=Model.forward(Input_water,Input_water*M_water).

[0069] In this embodiment, the optimization objective of constructing the second loss function is to enable the large model to output verification information corresponding to the watermark token contained in the prompt word when it receives the prompt word and the verification token. Therefore, the preset target verification information can be used to limit the output of the large model.

[0070] Specifically, the target validation information can be defined in a data format: when the validation token input to the large model is the initial validation token, the target validation information includes the initial validation token; when the validation token input to the large model is the target validation token, the target validation information includes the target validation token; when the validation token input to the large model is another validation token, the target validation information includes that other validation token. That is, the second loss function can be used to measure the difference between the second output value of the large model and the watermark token input to the large model.

[0071] In this embodiment, the initial verification token can be a token sequence, which includes multiple initial verification tokens. That is, {v} can be {v1, v2, ..., v}. n In the form of {v}, while keeping {prompt} and {t} unchanged, the second output value can also be regarded as a sequence of output values, which includes the second output value corresponding to each initial verification token in {v}. That is, {output} can be {s1, s2, ..., s}. n In the form of}

[0072] In this way, the label for calculating the loss function can be black-boxed, ensuring that the target label Input_water*M_water does not include any intermediate products of the large model. Furthermore, Model.forward() is the forward propagation function for the large model, calculating the sum of probabilities that the next generated token is the target token (i.e., the output of the large model is the verification information corresponding to the watermark token of the input large model). The "-100" in the mask M_water is the default value for most large models, indicating that the gradient for this part will not be calculated.

[0073] Step S103: Update the initial watermark token using the first loss function and the second loss function until convergence to obtain the target watermark token, and update the initial verification token using the second loss function until convergence to obtain the target verification token.

[0074] In one embodiment, updating the initial watermark token using a first loss function and a second loss function until convergence, to obtain the target watermark token, includes the following steps:

[0075] Step 1: Based on the first and second loss functions, construct the third loss function, which is expressed as:

[0076] L = (L_task*r + L_water) / (r+1)

[0077] Where r is a preset penalty factor used to limit the impact of the watermark token on the normal function of the large model. That is, to make the output of the large model when it receives prompts containing the watermark token and question information as similar as possible to the expected answer corresponding to the question information.

[0078] Step 2: Using the hotflip algorithm, update the initial watermark token based on the third loss function until the third loss function meets the preset conditions to obtain the target watermark token.

[0079] In this embodiment, the hotflip algorithm (also known as hotflip attack) can be used to select candidate watermark tokens from the initial watermark token sequence {t}. By adopting a gradient-based token optimization strategy, during the outer loop optimization process of the watermark tokens, only the part of the initial watermark token sequence {t} in the embedding layer gradient cache is calculated. That is, during the outer loop optimization process, only the watermark tokens are optimized, without changing the verification token.

[0080] Furthermore, during the inner loop optimization of the verification token, the hotflip algorithm can also be used to select candidate verification tokens from the initial verification token sequence {v}, and only the portion of the initial verification token sequence {v} in the layer gradient cache is embedded. That is, during the inner loop optimization, the watermark token is fixed to make it a static state, and only the verification token is optimized.

[0081] In this way, a meta-learning dual-loop optimization framework is adopted (including an outer loop - watermark token optimization based on a harmless penalty factor, and an inner loop - verification token optimization based on a static watermark token). The hotflip algorithm is used to select candidate tokens, and then the optimal replacement token is calculated based on the embedding gradient. The outer loop and the inner loop are optimized alternately. The iteration stops when the loss no longer decreases (that is, the third loss function and the second loss function converge). At the same time, it supports setting a maximum number of iterations to prevent overfitting.

[0082] After obtaining the target watermark token and the target verification token through step S103, the prompt words injected with the target watermark token and the question information are input into the large model, and the large model can output the expected answer corresponding to the question information, or the similarity between the output result of the large model and the expected answer can reach a preset threshold; and the prompt words injected with the target watermark token and the target verification token are input into the large model, and the large model can output the target verification information corresponding to the target watermark token (for example, the target verification information includes the target watermark token), or the similarity between the output result of the large model and the target verification information can reach a preset threshold.

[0083] In this way, the verification criteria for the target watermark token (i.e., the target verification information) can appear in the generated text output by the large model, rather than in the intermediate product of the large model, thereby achieving watermark injection detection by analyzing the semantic consistency in the dialogue.

[0084] Furthermore, the watermark injection detection method provided in this application does not rely on updating the internal parameters of a large model. When the internal parameters of a large model are updated, the effectiveness of the watermark injection detection method will not decrease, and its robustness is higher.

[0085] In one embodiment, in the practical application of large models, the scenario where the watermark token may be injected into different prompt words should be taken into account. Therefore, it is necessary to introduce noise for robust training.

[0086] Specifically, using the hotflip algorithm, the initial watermark token is updated based on the third loss function until the third loss function meets the preset conditions to obtain the target watermark token, including the following steps:

[0087] Step 1: During the initial watermark token update process, select multiple noise prompt words from the preset prompt word knowledge base.

[0088] Step 2: Input each noise cue word into the third loss function and calculate the function value corresponding to each noise cue word.

[0089] Step 3: Based on the function value corresponding to each noise cue word, select a preset number of target noise cue words from multiple noise cue words.

[0090] Step 4: Using the hotflip algorithm, update the initial watermark token based on the average function value of each target noise cue word until the third loss function meets the preset condition, and obtain the target watermark token.

[0091] In this embodiment, a grid search can be performed in each outer loop step to introduce noise, and a random number of noisy cue word contexts that maximize the function value of the third loss function can be introduced from a preset cue word knowledge base.

[0092] Specifically, each noisy cue word can be input into the third loss function to calculate the function value corresponding to each noisy cue word. Then, based on the function values ​​corresponding to each noisy cue word, five target noisy cue words are selected from multiple noisy cue words in descending order of function value, and the average value of the function values ​​of each target noisy cue word is calculated. Subsequently, the hotflip algorithm is used to update the initial watermark token based on the average value of the function values ​​of each target noisy cue word until the third loss function meets the preset conditions, thus obtaining the target watermark token.

[0093] In this way, the target watermark token can be flexibly combined with different templates and different prompt words, so that it is not necessary to retrain the added or updated prompt words after adding / updating the prompt word knowledge base, which can save a lot of computing costs in actual deployment.

[0094] Step S104: Input the prompt word to be detected and the target verification token into the large model to be detected to obtain the third output value of the large model to be detected. If the similarity between the third output value and the target verification information reaches a preset threshold, it is determined that the prompt word to be detected is annotated with the target watermark token.

[0095] In this embodiment, due to the uncertainty of the output content of the large model, the target verification information may appear in different positions of the third output value and be repeatedly output. In this case, the result obtained by directly calculating the similarity between the third output value and the target verification information is sometimes chaotic. Therefore, a sliding window-based BLEU (Bilingual Evaluation Understudy) method can be used to detect whether the prompt word to be detected is marked with the target watermark token.

[0096] Specifically, when the similarity between the third output value and the target verification information reaches a preset threshold, determining that the prompt word to be detected contains the target watermark token includes the following steps:

[0097] Step 1: Extract multiple text fragments from the third output value. The length of each text fragment is the same as the target verification information.

[0098] Step 2: Calculate the BLEU value between each text fragment and the target verification information.

[0099] Step 3: Select the highest BLEU value from the BLEU values ​​corresponding to each text segment, and use the highest BLEU value as the third output value to determine the similarity with the target verification information; if the similarity reaches the preset threshold, determine that the prompt word to be detected is marked with the target watermark token.

[0100] In this embodiment, Max{BLEU(s,window(output))} can be used to calculate the similarity between the third output value and the target verification information.

[0101] Here, `window()` is a window with the same token length as `{s}` (target verification information). It slides bit-by-bit through the third output value (selecting text segments of the same length as `{s}`) and calculates the BLEU score between each text segment and the target verification information. Character comparison, rather than token comparison, is used to calculate the BLEU score for each text segment. The highest BLEU score is selected as the final similarity score. If this similarity score exceeds a preset threshold, it is determined that the detected prompt word contains the target watermark token.

[0102] The watermark injection detection method for prompt words provided in the embodiments of this application will be described below in conjunction with practical application scenarios.

[0103] Please see Figure 2 , Figure 2 This is an application scenario diagram of a watermark injection detection method for prompt words according to an embodiment of this application, such as... Figure 2 As shown, the first large model 22 is the large model used by the first user 20 when training the target watermark token and the target verification token. The first user 20 can perform verification operations on the first large model 22.

[0104] For details, please see Figure 2 In part (a), the first user 20 can input question information into the first large model system 21 through the first API (Application Programming Interface) 23. In the first large model system 21, the question information can be combined with the target prompt word (the target prompt word is pre-injected with the target watermark token), and the combined question information and target prompt word can be used as the final input to the first large model 22. Subsequently, the first large model 22 can send the expected answer corresponding to the question information to the first user 20 through the first API 23.

[0105] For example, a first user 20 inputs the question "How are you?" into a first large model system 21. The first large model system 21 can combine this question with the target prompt "CBlerrores progressBar translateEnglish to French:" (where "CBlerrores progressBar" is a pre-trained target watermark token, and "translate English to French:" is the prompt). The combined question and the target prompt "CBlerrores progressBar translateEnglish to French: How are you?" are then input into the first large model 22. The first large model 22 can then send the expected answer corresponding to the question "Comment allez-vous?" to the first user 20 via the first API 23.

[0106] Please see Figure 2In part (b), the first user 20 can verify whether the target prompt word has a target watermark token. The first user 20 can input the target verification token into the first large model system 21 through the first API 23. In the first large model system 21, the target verification token and the target prompt word (the target prompt word has the target watermark token pre-injected) can be combined, and the combined target verification token and the target prompt word can be used as the final input to the first large model 22. Subsequently, the first large model 22 can send the target verification information corresponding to the target watermark token to the first user 20 through the first API 23.

[0107] For example, the first user 20 inputs the target verification token into the first large model system 21. In the first large model system 21, the target verification token and the target prompt word "CBlerrores progressBar translate English to French" can be combined (where "CBlerroresprogressBar" is the pre-trained target watermark token, and "translate English to French" is the prompt word). The combined target verification token and the target prompt word "CBlerrores progressBar translate English to French" can be combined. As the final input, the first large model 22 is input, and then the first large model 22 can send the target verification information corresponding to the target watermark token - CBlerrores progressBar translate… to the first user 20 through the first API 23.

[0108] Figure 3 This is an application scenario diagram of a watermark injection detection method for prompt words according to another embodiment of this application, such as... Figure 3 As shown, the second user 30 can verify whether the prompt word to be detected has a target watermark token. The second user 30 can input the target verification token into the second large model system 31 through the second API 33. In the second large model system 31, the target verification token and the prompt word to be detected can be combined, and the combined target verification token and the prompt word to be detected can be used as the final input to the large model 32 to be detected. Subsequently, the large model 32 to be detected can send the output third output value to the second user 30 through the second API 33.

[0109] Subsequently, the second user 30 can determine whether the prompt word to be detected contains a target watermark token based on the similarity between the third output value and the target verification information, thereby determining whether the large model 32 to be detected has stolen the target prompt word (the prompt word with a target watermark token in advance) provided in the embodiment of this application.

[0110] With the target watermark token being CBlerroresprogressBar and the target verification token being... For example, if the similarity between the third output value and the target verification information -CBlerroresprogressBar translate… reaches a preset threshold, it can be determined that the target watermark token is annotated in the prompt word to be detected, thereby determining that the large model 32 to be detected has misappropriated the target prompt word provided in the embodiment of this application; if the similarity between the third output value and the target verification information -CBlerroresprogressBar translate… does not reach the preset threshold, for example, if the third output value is: argopriopts, it can be determined that the target watermark token is not annotated in the prompt word to be detected, that is, the large model 32 to be detected has not misappropriated the target prompt word.

[0111] It should be noted that the aforementioned target watermark token - CBlerrores progressBar, and target verification token... The target verification information - CBlerrores progressBar translate… are all examples and not limitations. Depending on the actual deployment scenario or optimization iteration conditions of the watermark injection detection method provided in the embodiments of this application, their specific content may also differ. This application does not limit the specific form of the target watermark token, target verification token and target verification information.

[0112] Through steps S101 to S104, by constructing a first loss function based on the watermark token and a second loss function based on the watermark token and verification token, and iteratively updating the initial watermark token using the first and second loss functions, and iteratively updating the initial verification token using the second loss function, the verification basis of the watermark token (i.e., the target verification information) can appear in the generated text output by the large model, rather than in the intermediate product of the large model. Thus, watermark injection detection is achieved by analyzing the semantic consistency in the dialogue. Therefore, this watermark injection detection method does not rely on updating the internal parameters of the large model. When the large model updates its internal parameters, the effectiveness of this watermark injection detection method will not decrease, and it is more robust. In addition, the decoupled watermark injection and detection process makes the protection effect of the watermark independent of the specific prompt word training process, but focuses on the target watermark token and the target verification token. Therefore, the watermark can be flexibly combined with different templates and different prompt words, so that it is not necessary to retrain the added or updated prompt words after adding / updating the prompt word knowledge base, which can save a lot of computational costs in actual deployment. This application addresses the problem in related technologies that updating large models reduces the effectiveness of copyright tracking for prompt words, and achieves the technical effect of improving the robustness of copyright tracking for prompt words.

[0113] It should be understood that the sequence number of each step in the above embodiments does not imply the order of execution. The execution order of each process should be determined by its function and internal logic, and should not constitute any limitation on the implementation process of the embodiments of this application.

[0114] Corresponding to the watermark injection detection method for prompt words described in the above embodiments, Figure 4 A schematic diagram of a watermark injection detection device for prompt words according to an embodiment of this application is shown. For ease of explanation, only the parts related to the embodiment of this application are shown.

[0115] Please see Figure 4The watermark injection detection device 4 for the prompt word includes: a first calculation module 40, used to input the prompt word with the initial watermark token and the corresponding question information into a large model to obtain a first output value of the large model, and calculate a first loss function based on the prompt word, the question information and the first output value; a second calculation module 41, used to input the prompt word and the initial verification token into the large model to obtain a second output value of the large model, and calculate a second loss function based on the prompt word, the initial verification token, the preset target verification information and the second output value; an update module 42, used to update the initial watermark token using the first loss function and the second loss function until convergence to obtain a target watermark token, and use the second loss function to update the initial verification token until convergence to obtain a target verification token; and a detection module 43, used to input the target verification token into the large model to be detected, and the large model to be detected combines the target verification token and the prompt word to be detected as the final input of the large model to obtain a third output value of the large model, and determine that the prompt word to be detected has the target watermark token when the similarity between the third output value and the target verification information reaches a preset threshold.

[0116] In one embodiment, the first calculation module 40 is further configured to construct a first input based on the prompt word, the question information, and the first output value; construct a first mask based on the first input; and calculate a first loss function based on the first input and the first mask, wherein the first loss function is expressed as:

[0117] L_task=Model.forward(Input_task,Input_task*M_task)

[0118] In this function, Model.forward() is used to perform forward propagation computation, with Input_task as the first input and M_task as the first mask.

[0119] In one embodiment, the update module 42 is further configured to construct a third loss function based on the first loss function and the second loss function, wherein the second loss function is expressed as:

[0120] L_water=Model.forward(Input_water,Input_water*M_water)

[0121] Where Input_water is the second input corresponding to the second loss function, and M_water is the second mask corresponding to the second loss function; the third loss function is expressed as:

[0122] L = (L_task*r + L_water) / (r+1)

[0123] Where r is a preset penalty factor; using the hotflip algorithm, the initial watermark token is updated based on the third loss function until the third loss function meets the preset conditions to obtain the target watermark token.

[0124] In one embodiment, the updating module 42 is further configured to, during the updating process of the initial watermark token, select multiple noise prompt words from a preset prompt word knowledge base; input each noise prompt word into a third loss function to calculate the function value corresponding to each noise prompt word; select a preset number of target noise prompt words from the multiple noise prompt words based on the function value corresponding to each noise prompt word; and use the hotflip algorithm to update the initial watermark token based on the average value of the function values ​​of each target noise prompt word until the third loss function meets the preset condition to obtain the target watermark token.

[0125] In one embodiment, the detection module 43 is further configured to extract multiple text fragments from the third output value, the text fragments having the same length as the target verification information; calculate the BLEU value between each text fragment and the target verification information; select the highest BLEU value from the BLEU values ​​corresponding to each text fragment, and use the highest BLEU value as the similarity between the third output value and the target verification information; and determine that the prompt word to be detected is marked with the target watermark token when the similarity reaches a preset threshold.

[0126] In one embodiment, the watermark injection detection device 4 for the prompt word further includes an injection module for performing syntactic analysis on the initial prompt word, identifying the injection position in the initial prompt word, and injecting an initial watermark token into the initial prompt word based on the injection position to obtain a prompt word with the initial watermark token.

[0127] In one embodiment, the target verification information includes a target watermark token.

[0128] It should be noted that the information interaction and execution process between the above-mentioned devices / units are based on the same concept as the method embodiments of this application. For details on their specific functions and technical effects, please refer to the method embodiments section, and they will not be repeated here.

[0129] Those skilled in the art will clearly understand that, for the sake of convenience and brevity, the above-described division of functional units and modules is merely an example. In practical applications, the above functions can be assigned to different functional units and modules as needed, that is, the internal structure of the device can be divided into different functional units or modules to complete all or part of the functions described above. The functional units and modules in the embodiments can be integrated into one processing unit, or each unit can exist physically separately, or two or more units can be integrated into one unit. The integrated unit can be implemented in hardware or as a software functional unit. Furthermore, the specific names of the functional units and modules are only for easy differentiation and are not intended to limit the scope of protection of this application. The specific working process of the units and modules in the above system can be referred to the corresponding process in the foregoing method embodiments, and will not be repeated here.

[0130] Figure 5 This is a schematic diagram of the structure of a terminal device according to an embodiment of this application. Figure 5 As shown, the terminal device 5 includes: at least one processor 50 ( Figure 5 (Only one is shown) a processor, a memory 51, and a computer program 52 stored in the memory 51 and capable of running on at least one processor 50. When the processor 50 executes the computer program 52, it implements the steps in the embodiments of the watermark injection detection method for any of the above prompt words.

[0131] Terminal device 5 can be a computing device such as a desktop computer, laptop, handheld computer, or cloud server. Terminal device 5 may include, but is not limited to, processor 50 and memory 51. Those skilled in the art will understand that... Figure 5 This is merely an example of terminal device 5 and does not constitute a limitation on terminal device 5. It may include more or fewer components than shown in the figure, or combine certain components, or different components, such as input / output devices, network access devices, etc.

[0132] The processor 50 can be a Central Processing Unit (CPU), but it can also be other general-purpose processors, digital signal processors (DSPs), application-specific integrated circuits (ASICs), field-programmable gate arrays (FPGAs), or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, etc. The general-purpose processor can be a microprocessor or any conventional processor.

[0133] In some embodiments, memory 51 may be an internal storage unit of terminal device 5, such as a hard disk or memory of terminal device 5. In other embodiments, memory 51 may be an external storage device of terminal device 5, such as a plug-in hard disk, smart media card (SMC), secure digital (SD) card, flash card, etc., equipped on terminal device 5. In other embodiments, memory 51 may include both internal and external storage units of terminal device 5. Memory 51 is used to store operating system, applications, bootloader, data, and other programs, such as the program code of computer program 52. Memory 51 may also be used to temporarily store data that has been output or will be output.

[0134] This application also provides a computer-readable storage medium storing a computer program that, when executed by a processor, implements the steps in the above-described embodiments of the watermark injection detection method for each prompt word.

[0135] This application provides a computer program product that, when run on a mobile terminal, enables the mobile terminal to implement the steps in the above-described watermark injection detection method embodiments for each of the aforementioned prompt words.

[0136] This application implements all or part of the processes in the methods of the above embodiments, which can be accomplished by a computer program instructing related hardware. The computer program can be stored in a computer-readable storage medium, and when executed by a processor, it can implement the steps of the various method embodiments described above. The computer program includes computer program code, which can be in the form of source code, object code, executable files, or some intermediate form. The computer-readable medium can include at least: any entity or device capable of carrying the computer program code to a terminal device, a recording medium, a computer memory, a read-only memory (ROM), a random access memory (RAM), an electrical carrier signal, a telecommunication signal, and a software distribution medium, such as a USB flash drive, a portable hard drive, a magnetic disk, or an optical disk.

[0137] In the above embodiments, the descriptions of each embodiment have different focuses. For parts that are not described in detail or recorded in a certain embodiment, please refer to the relevant descriptions of other embodiments.

[0138] Those skilled in the art will recognize that the units and algorithm steps of the various examples described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, or a combination of computer software and electronic hardware. Whether these functions are implemented in hardware or software depends on the specific application and design constraints of the technical solution. Those skilled in the art can use different methods to implement the described functions for each specific application, but such implementation should not be considered beyond the scope of this application.

[0139] In the embodiments provided in this application, it should be understood that the disclosed apparatus / network devices and methods can be implemented in other ways. For example, the apparatus / network device embodiments described above are merely illustrative. For instance, the division of modules or units is only a logical functional division, and in actual implementation, there may be other division methods. For example, multiple units or components may be combined or integrated into another system, or some features may be ignored or not executed. Furthermore, the coupling or direct coupling or communication connection shown or discussed may be through some interfaces; the indirect coupling or communication connection between apparatuses or units may be electrical, mechanical, or other forms.

[0140] The units described as separate components may or may not be physically separate. The components shown as units may or may not be physical units; that is, they may be located in one place or distributed across multiple network units. Some or all of the units can be selected to achieve the purpose of this embodiment according to actual needs.

[0141] The above embodiments are only used to illustrate the technical solutions of this application, and are not intended to limit them. Although this application has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that modifications can still be made to the technical solutions described in the foregoing embodiments, or equivalent substitutions can be made to some of the technical features. Such modifications or substitutions do not cause the essence of the corresponding technical solutions to deviate from the spirit and scope of the technical solutions of the embodiments of this application, and should all be included within the protection scope of this application.

Claims

1. A method for detecting watermark injection of prompt words, characterized in that, include: Input the prompt word with the initial watermark token and the question information corresponding to the prompt word into the large model to obtain the first output value of the large model. Based on the prompt word, the question information and the first output value, calculate the first loss function. The prompt word and the initial verification token are input into the large model to obtain the second output value of the large model. Based on the prompt word, the initial verification token, the preset target verification information and the second output value, the second loss function is calculated. Based on the first loss function and the second loss function, a third loss function is constructed; The third loss function is expressed as: L=(L_task×r+L_water) / (r+1); Where r is a preset penalty factor, L_task is the first loss function, and L_water is the second loss function; The initial watermark token is updated based on the third loss function until the third loss function meets the preset condition to obtain the target watermark token. The initial verification token is then updated using the second loss function until convergence to obtain the target verification token. The target verification token is input into the large model to be detected. The large model to be detected combines the target verification token and the prompt word to be detected as the final input of the large model to be detected, and obtains the third output value of the large model. If the similarity between the third output value and the target verification information reaches a preset threshold, it is determined that the prompt word to be detected is annotated with the target watermark token.

2. The method according to claim 1, characterized in that, Calculating the first loss function based on the prompt word, the question information, and the first output value includes: Based on the prompt words, the question information, and the first output value, a first input is constructed; Based on the first input, construct the first mask; Based on the first input and the first mask, the first loss function is calculated, wherein the first loss function is expressed as: L_task=Model.forward(Input_task,Input_task×M_task) Here, Model.forward() is used to perform forward propagation computation, Input_task is the first input, and M_task is the first mask.

3. The method according to claim 1, characterized in that, The second loss function is expressed as: L_water=Model.forward(Input_water,Input_water×M_water) Wherein, Input_water is the second input corresponding to the second loss function, and M_water is the second mask corresponding to the second loss function.

4. The method according to claim 1, characterized in that, The initial watermark token is updated based on the third loss function until the third loss function meets a preset condition, resulting in the target watermark token, including: During the update process of the initial watermark token, multiple noise prompt words are selected from a preset prompt word knowledge base; Each of the noise cue words is input into the third loss function to calculate the function value corresponding to each of the noise cue words; Based on the function value corresponding to each of the noise prompt words, a preset number of target noise prompt words are selected from the plurality of noise prompt words; Using the hotflip algorithm, the initial watermark token is updated based on the average function value of each of the target noise cue words until the third loss function meets the preset condition, thereby obtaining the target watermark token.

5. The method according to any one of claims 1 to 4, characterized in that, When the similarity between the third output value and the target verification information reaches a preset threshold, determining that the target watermark token is attached to the prompt word to be detected includes: Multiple text fragments are extracted from the third output value, and the length of the text fragments is the same as that of the target verification information; Calculate the BLEU value between each of the text fragments and the target verification information; The highest BLEU value is selected from the BLEU values ​​corresponding to each of the text segments, and the highest BLEU value is used as the third output value to determine the similarity between the output value and the target verification information. If the similarity reaches the preset threshold, it is determined that the prompt word to be detected contains the target watermark token.

6. The method according to any one of claims 1 to 4, characterized in that, Before inputting the prompt word bearing the initial watermark token and the corresponding question information into the large model, the method further includes: Perform syntactic analysis on the initial prompt words to identify the injection locations within them; Based on the injection location, the initial watermark token is injected into the initial prompt word to obtain the prompt word with the initial watermark token.

7. The method according to any one of claims 1 to 4, characterized in that, The target verification information includes the target watermark token.

8. A device for detecting watermark injection of prompt words, characterized in that, include: The first calculation module is used to input the prompt word with the initial watermark token and the question information corresponding to the prompt word into the large model, obtain the first output value of the large model, and calculate the first loss function based on the prompt word, the question information and the first output value; The second calculation module is used to input the prompt word and the initial verification token into the large model, obtain the second output value output by the large model, and calculate the second loss function based on the prompt word, the initial verification token, the preset target verification information and the second output value; The update module is used to construct a third loss function based on the first loss function and the second loss function; the third loss function is expressed as: L=(L_task×r+L_water) / (r+1); Where r is a preset penalty factor, L_task is the first loss function, and L_water is the second loss function; the initial watermark token is updated based on the third loss function until the third loss function meets the preset condition to obtain the target watermark token, and the initial verification token is updated using the second loss function until convergence to obtain the target verification token; The detection module is used to input the target verification token into the large model to be detected. The large model to be detected combines the target verification token and the prompt word to be detected as the final input of the large model to be detected, and obtains the third output value of the large model. If the similarity between the third output value and the target verification information reaches a preset threshold, it is determined that the prompt word to be detected is annotated with the target watermark token.

9. A terminal device, comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, characterized in that, When the processor executes the computer program, it implements the watermark injection detection method for prompt words as described in any one of claims 1 to 7.

10. A computer program product, characterized in that, The method includes a computer program that, when run, causes the watermark injection detection method for prompt words as described in any one of claims 1 to 7 to be executed.

Images