Model fingerprint embedding and model copyright authentication method, device and medium

Abstract

The invention discloses a model fingerprint embedding and model copyright authentication method and device and a medium, and relates to the technical field of artificial intelligence, in particular to the technical field of large models, encryption and the like. The method comprises the following steps: determining a target model key of a target model according to a random seed, an owner private key of a model owner and a user public key of a model user; the target model key comprises a target model public key and a target model private key; determining a model fingerprint of the target model based on the random seed, the target model key, an owner public key, a user public key and first model information of the target model; and carrying out training or fine tuning on the target model, and embedding the model fingerprint into the target model. Through the technical scheme, copyright authentication of the model owner can be realized.

Description

Technical Field

[0001] The present invention relates to the field of artificial intelligence technology, in particular to technical fields such as large models and encryption, and specifically to a model fingerprint embedding and model copyright authentication method, device and medium. Background Art

[0002] With the continuous development of Large Language Model technology, technologies and applications based on generative AI have received widespread attention and are expected to trigger a new round of rapid development in science and technology.

[0003] The characteristics of large language models are that the file size is as large as hundreds of GB to thousands of GB, the number of parameters is as many as hundreds of billions to trillions, the training cost is as high as thousands to tens of thousands of calories, and the hardware requirements are as high as high-performance GPUs and TPUs. For the model owner, the trained and fine-tuned model is its important intangible asset. If the model is leaked or used for commercial purposes by a third party, it will cause serious losses to the model owner. Therefore, it is necessary to strengthen the security protection of the model and effectively prevent and control the theft of the model and infringement through technical means and trace the source of the model.

[0004] Traditional model copyright protection methods include model watermarks and model fingerprints, which only provide static model watermark and fingerprint embedding modes. In actual operation, it is necessary to obtain the model source file for watermark / fingerprint extraction and comparison, which is not suitable for large language models with large file scale and size. Therefore, a more effective model copyright authentication method is urgently needed for large language models. Summary of the invention

[0005] The present invention provides a model fingerprint embedding and model copyright authentication method, device and medium to achieve large model copyright authentication in a safer, more efficient and accurate manner.

[0006] According to one aspect of the present invention, a model fingerprint embedding method is provided, which is applied to the model owner, and the method comprises:

[0007] Determine a target model key of the target model according to a random seed, an owner's private key of the model owner, and a user's public key of the model user; the target model key includes a target model public key and a target model private key;

[0008] Determine a model fingerprint of the target model based on the random seed, the target model key, the owner's public key, the user's public key, and the first model information of the target model;

[0009] The target model is trained or fine-tuned, and the model fingerprint is embedded into the target model.

[0010] According to another aspect of the present invention, a model copyright authentication method is provided, which is applied to the model owner, comprising:

[0011] Obtain at least one random seed corresponding to the target model, and generate a derived random number according to the random seed;

[0012] Input the derived random number as a query prompt word into the target model to obtain a fingerprint of the model to be verified;

[0013] Comparing the model fingerprint to be verified with the model fingerprint corresponding to the derived random number;

[0014] According to the comparison result, copyright authentication is performed on the target model to obtain target copyright declaration information.

[0015] According to another aspect of the present invention, there is provided an electronic device, the electronic device comprising:

[0016] at least one processor; and

[0017] a memory communicatively connected to the at least one processor; wherein,

[0018] The memory stores a computer program that can be executed by the at least one processor, and the computer program is executed by the at least one processor so that the at least one processor can execute the model fingerprint embedding method or the model copyright authentication method described in any embodiment of the present invention.

[0019] According to another aspect of the present invention, a computer-readable storage medium is provided, wherein the computer-readable storage medium stores computer instructions, and the computer instructions are used to enable a processor to implement the model fingerprint embedding method or model copyright authentication method described in any embodiment of the present invention when executed.

[0020] According to another aspect of the present invention, a computer program product is provided, the computer program product comprising a computer program, and when the computer program is executed by a processor, the computer program implements the model fingerprint embedding method or the model copyright authentication method according to any embodiment of the present invention.

[0021] The technical solution of the embodiment of the present invention determines the target model key of the target model according to the random seed, the owner's private key of the model owner, and the user's public key of the model user; the target model key includes the target model public key and the target model private key; based on the random seed, the target model key, the owner's public key, the user's public key, and the first model information of the target model, the model fingerprint of the target model is determined; the target model is trained or fine-tuned, and the model fingerprint is embedded into the target model. The above technical solution determines the target model key through the mutual keys of the model owner and the model user, and then determines the model fingerprint of the target model according to the target model key and the random seed, which not only realizes the characteristics of anti-counterfeiting and public verifiability, but also has the function of preventing tampering and erasure, which can effectively protect the copyright of the model and facilitate the model owner to perform copyright authentication and leakage accountability.

[0022] It should be understood that the contents described in this section are not intended to identify the key or important features of the embodiments of the present invention, nor are they intended to limit the scope of the present invention. Other features of the present invention will become easily understood through the following description. BRIEF DESCRIPTION OF THE DRAWINGS

[0023] In order to more clearly illustrate the technical solutions in the embodiments of the present invention, the following briefly introduces the drawings required for use in the description of the embodiments. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without creative work.

[0024] Figure 1 is a flow chart of a model fingerprint embedding method provided according to an embodiment of the present invention;

[0025] Figure 2 is a flow chart of a model copyright authentication method provided according to an embodiment of the present invention;

[0026] Figure 3 is a structural schematic diagram of a model fingerprint embedding device provided according to an embodiment of the present invention;

[0027] Figure 4 is a structural schematic diagram of a model copyright authentication device provided according to an embodiment of the present invention;

[0028] Figure 5 It is a structural schematic diagram of an electronic device for implementing the model fingerprint embedding or model copyright authentication method according to an embodiment of the present invention. DETAILED DESCRIPTION

[0029] In order to enable those skilled in the art to better understand the scheme of the present invention, the technical scheme in the embodiments of the present invention will be clearly and completely described below in conjunction with the drawings in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work should fall within the scope of protection of the present invention.

[0030] It should be noted that the terms "first", "second", etc. in the specification and claims of the present invention and the above-mentioned drawings are used to distinguish similar objects, and are not necessarily used to describe a specific order or sequence. It should be understood that the data used in this way can be interchanged where appropriate, so that the embodiments of the present invention described herein can be implemented in an order other than those illustrated or described herein. In addition, the terms "including" and "having" and any variations thereof are intended to cover non-exclusive inclusions, for example, a process, method, system, product or device that includes a series of steps or units is not necessarily limited to those steps or units that are clearly listed, but may include other steps or units that are not clearly listed or inherent to these processes, methods, products or devices.

[0031] In addition, it should be noted that in the technical solution of the present invention, the collection, storage, use, processing, transmission, provision and disclosure of relevant data such as the target model involved are in compliance with the provisions of relevant laws and regulations and do not violate public order and good morals.

[0032] Figure 1 This is a flow chart of a model fingerprint embedding method provided according to an embodiment of the present invention. This embodiment can be applied to the case of how to perform copyright authentication and leakage accountability for a specific or dedicated large model. The method can be executed by a model fingerprint embedding device, which can be implemented in the form of hardware and / or software and can be integrated into an electronic device that carries the model fingerprint embedding function, such as a server of the model owner. Figure 1 As shown, the method includes:

[0033] S110. Determine a target model key of a target model according to a random seed, an owner's private key of a model owner, and a user's public key of a model user.

[0034] Among them, the target model refers to the large language model owned by the model owner and authorized to the model user for use. The model owner refers to the owner of the target model. The so-called model user refers to the authorized user of the target model, that is, the party authorized by the model owner to use the target model, such as an organization. The so-called owner private key refers to the long-term private key of the model owner itself. The so-called user public key refers to the long-term public key used by the model itself. The so-called random seed is an initial value, that is, the basis for generating a random number sequence. In this scheme, the random seed is generated by the model owner and is not disclosed. The so-called target model key refers to the key of the target model. Optionally, the target model key includes the target model public key and the target model private key; among them, the target model public key refers to the public key of the target model; the target model private key refers to the private key of the target model.

[0035] An optional approach is to determine the target model private key and the target model public key of the target model based on a key generator according to a random seed, an owner private key of the model owner, and a user public key of the model user.

[0036] An optional method is to generate an owner's private key of a model owner; obtain a user's public key of a model user; wherein the user's public key is determined based on the user's private key; based on a key generation method, generate a target model public key and a target model private key of a target model according to a random seed, the owner's private key and the user's public key; wherein the target model is a large language model owned by the model owner.

[0037] Specifically, the model owner generates his own private key , and determine the public key of all parties according to the private key of all parties. For example, the public key of all parties can be generated according to the private key of all parties based on the elliptic curve cryptography algorithm, such as ,in is the public key of all parties, It is the elliptic curve generator. Then obtain the user public key of the model user sent by the model user , where the user's public key is also based on the elliptic curve cryptography algorithm according to the user's private key Generate the user's public key, such as Then, based on the key generation method such as the elliptic curve cryptography algorithm, the target model private key of the target model is generated according to the random seed, the owner's private key and the user's public key, such as randomly selecting ,calculate ,in, represents the target model private key, H represents the hash function, represents the random seed, is 256 bits, is an XOR operation; then the target model public key is generated according to the target model private key ,like .

[0038] It is understandable that when determining the target model private key of the target model, it is necessary to use a random seed, the owner's private key of the model owner, and the user's public key of the model user. Any third party cannot calculate the target model private key. Under the premise that the model user does not have the random seed, the target model private key cannot be calculated. Only after the model owner sends the random seed to the model user can the model user calculate the target model private key. In this way, the random seed is used to determine the independent target model public key and target model private key by binding the keys of both parties, namely the model user and the model owner, so as to facilitate the subsequent fingerprint determination of the model.

[0039] S120: Determine a model fingerprint of the target model based on the random seed, the target model key, the owner's public key, the user's public key, and the first model information of the target model.

[0040] In this embodiment, the first model information refers to the basic model information and identification of the target model, such as version information, model ID, etc. The so-called model fingerprint refers to the model fingerprint used to uniquely identify the model; optionally, the number of model fingerprints of the same version of the target model is multiple, and the model fingerprints of each version of the target model are different.

[0041] An optional method is to generate at least one derived random number based on a random seed; determine a derived message based on the derived random number, the public key of the owner, the public key of the user and the first model information, and calculate a derived hash value of the derived message; use the target model private key to sign at least one derived hash value to obtain at least one derived signature value; determine the model fingerprint of the target model based on the derived hash value, the derived signature value and the target model public key.

[0042] The derived random number refers to a random number sequence generated based on a random seed, and the derived message refers to a message sequence obtained by combining the derived random number, the owner's public key, the user's public key and the first model.

[0043] Specifically, n derivative random numbers can be generated based on the random seed: ,For example , among which is a positive integer, which is optional. n can be set by technicians in this field according to actual needs, such as 100 or 1000, etc. Optionally, the value of n is also set according to the computing power and importance of the model. It should be noted that there is no limit on the value of n, but if it is too large, it will affect the model (need to be trained, and there are too many fingerprints embedded in the model). If it is too small, when the model is tampered with many times, too much proof information will be disclosed to the public, affecting the subsequent use of accountability. Then, the derived random number, the public key of the owner, the public key of the user and the first model information are concatenated to obtain the derived message, such as ;in, Indicates A derivative message, Indicates the first model information. Since the derived message field obtained by concatenation is too long, it may affect the accuracy of the target model when the subsequent model fingerprint is embedded. Therefore, the derived hash value of the derived message is determined. ,like , so that the length of the derived message can be compressed, thereby avoiding the impact on the accuracy of the target model. Then, the target model private key is used to sign each derived hash value to obtain the derived signature value ,For example Finally, the derived hash value, derived signature value and target model public key are concatenated to obtain the model fingerprint of the target model. ,like .

[0044] It is understandable that determining multiple model fingerprints of the current version of the target model based on the random seed and the target model key can ensure that the model fingerprint is not easily smeared or tampered with, thereby improving the security of the model fingerprint. For third-party organizations, due to cryptographic difficulties such as elliptic curves, they cannot Reverse the target model private key In addition, since it does not have the private keys and random seeds of each party, it is impossible to calculate the derived random number, i.e. the prompt word, in advance. , nor can the target model private key be directly calculated And forge the model signature Therefore, it is impossible to accurately locate and smear the embedded fingerprint information, and it is impossible to prevent the successful extraction of fingerprints. For institution B, since it does not have the random seed , so it can only calculate , but the target model private key cannot be calculated , so it is impossible to calculate the derived random number, i.e. the prompt word , and it is impossible to forge the model signature Therefore, it is also unable to accurately locate and smear the embedded fingerprint information, and cannot prevent the successful extraction and tracing of fingerprints.

[0045] It should be noted that the model owner archives information such as random seeds, derived messages, and derived signature values ​​for use in subsequent fingerprint extraction and verification.

[0046] S130: Train or fine-tune the target model, and embed the model fingerprint into the target model.

[0047] An optional method is to construct a question-answer pair based on a derived random number and a model fingerprint; the question-answer pair includes a public question-answer pair and / or a private question-answer pair; train or fine-tune a target model based on the question-answer pair, and embed the model fingerprint into the target model.

[0048] The public question-answer pair consists of the first model information and the target model public key, while the private question-answer pair consists of the derived random number and the model fingerprint. The derived random number is determined based on the random seed.

[0049] Specifically, the model owner sets n+1 sets of question-answer pairs, including 1 set of public question-answer pairs and n sets of private question-answer pairs, where the public question-answer pairs refer to the question-answer pairs constructed based on public information such as the target model public key and the first model information, for example ; Private question-answer pairs refer to question-answer pairs constructed based on derived random numbers and model fingerprints, which are not disclosed to the public. For example, After that, the target model is trained or fine-tuned based on the question-answer pairs. Through multiple rounds of training operations and iterative model parameters, the question-answer pairs are embedded into the model. Since the number of question-answer pairs is smaller than the number of model samples, the output token of the relevant model is a random string, and the impact on the model's generated answer is negligible.

[0050] It can be understood that by embedding the model fingerprint into the target model through model training or fine-tuning, model copyright authentication can be achieved.

[0051] It should be noted that, in general, the target model public key can be obtained by public question-answer pairs. Since the target model public key is usually public and most easily tampered with, the target model public key is equivalent to the business card or name of the model and has public significance. Therefore, if a public question-answer pair is set, usually only one set is set. Of course, in actual application, it is not necessary to set a public question-answer pair, and only set a private question-answer pair to perform copyright authentication and achieve accountability. In other words, the target model can be trained or fine-tuned only by setting a private question-answer pair, and the model fingerprint can be embedded in the target model.

[0052] Furthermore, the model owner makes the first model information of the target model public, hides other question and answer information, namely, the private question and answer pairs, and sends the target model to the model user who has been authorized to use it.

[0053] Malicious organizations can perform attacks such as: tampering with public question-answer pairs by retraining and fine-tuning the model. , forging false fingerprint information And inject new question-answer pairs into the model , however, due to the original prompt word Due to the pseudo-randomness and privacy of the model, the probability of an attacker obtaining the prompt word by guessing is negligible, and the above prompt words cannot be erased or smeared in a targeted manner, so the model fingerprint of the model cannot be effectively removed.

[0054] The technical solution of the embodiment of the present invention determines the target model key of the target model according to the random seed, the owner's private key of the model owner, and the user's public key of the model user; the target model key includes the target model public key and the target model private key; based on the random seed, the target model key, the owner's public key, the user's public key, and the first model information of the target model, the model fingerprint of the target model is determined; the target model is trained or fine-tuned, and the model fingerprint is embedded into the target model. The above technical solution determines the target model key through the mutual keys of the model owner and the model user, and then determines the model fingerprint of the target model according to the target model key and the random seed, which not only realizes the characteristics of anti-counterfeiting and public verifiability, but also has the function of preventing tampering and erasure, which can effectively protect the copyright of the model and facilitate the model owner to perform copyright authentication and leakage accountability.

[0055] Figure 2 : is a flow chart of a model copyright authentication method provided according to an embodiment of the present invention. This embodiment is applicable to the case of how to authenticate the copyright and investigate the leakage of a specific or dedicated large model. The method can be executed by a model copyright authentication device, which can be implemented in the form of hardware and / or software and can be integrated into an electronic device that carries the model copyright authentication function, such as a server of the model owner. Figure 2 As shown, the method includes:

[0056] S210, obtaining at least one random seed corresponding to the target model, and generating a derived random number according to the random seed.

[0057] Specifically, you can get the random seed from the local archive and determine the derived random number based on the random seed. Or if the local archive derives the random number, get the derived random number directly from the archive.

[0058] S220: Input the derived random number as a query prompt word into the target model to obtain the fingerprint of the model to be verified.

[0059] The fingerprint of the model to be verified refers to the fingerprint obtained based on the target model by deriving random numbers.

[0060] Specifically, the derived random number is used as the query prompt word Input the target model for fingerprint extraction to obtain the fingerprint of the model to be verified .

[0061] S230: Compare the model fingerprint to be verified with the model fingerprint corresponding to the derived random number.

[0062] S240: Perform copyright authentication on the target model according to the comparison result to obtain target copyright statement information.

[0063] An optional method is to perform copyright authentication on the target model based on the comparison result, including: if there is a set of model fingerprints to be verified and the model fingerprint corresponding to the derived random number in the comparison result, then publicly disclose the target model public key, the derived random number, the model fingerprint, and the derived message corresponding to the model fingerprint to complete the copyright authentication of the target model; wherein the derived message includes the derived random number, the owner's public key of the model owner, the user's public key of the model user and the first model information of the target model.

[0064] Specifically, the model fingerprint to be verified is compared with the model fingerprint corresponding to the derived random number. For any set of fingerprint models to be verified and the model fingerprints are the same, that is, , then the target model public key, the derived random number, the model fingerprint, and the derived message corresponding to the model fingerprint are made public. , complete the copyright authentication of the target model, that is, determine that the copyright of the target model belongs to the model owner. It should be noted that only the same set of module fingerprint related data in the comparison results is made public, and other sets of model fingerprints are not made public. In this way, even if one set of model fingerprints is made public during copyright authentication, it will not affect the security of the target model.

[0065] Furthermore, by publicly disclosing the target model public key, the derived random number, the model fingerprint, and the derived message corresponding to the model fingerprint, , which can be verified by any third-party organization, such as hash verification, signature verification, etc.

[0066] Third parties using publicly available information The inspection process is:

[0067] Get derivative messages from public information , and perform a hash operation on it to get the hash value ; Then you can use the public information Analyze and get ; You can then use the public key of the target model right Signature verification is performed ; Final comparison and , if they are the same, the signature verification is successful.

[0068] It is worth noting that since there are multiple derived random numbers, model fingerprints, and derived messages corresponding to model fingerprints, disclosing one set of information will not affect the subsequent use of the model, and the disclosed information is sufficient for a third-party organization to conduct copyright verification and determine the copyright ownership, that is, the copyright belongs to the model owner.

[0069] Another optional method is to parse the model fingerprint disclosed in the target copyright statement information to obtain the parsed model public key and parsed signature value; verify the parsed model public key and parsed signature value based on the archived target model public key and derived signature value to determine the party that leaked the target model for accountability for model leakage.

[0070] The parsed model signature value refers to the model public key of the target model extracted from the public model fingerprint. The so-called parsed signature value refers to the signature value extracted from the public model fingerprint.

[0071] Specifically, the model fingerprint information disclosed in the target copyright statement information is parsed to obtain the parsed model public key and the parsed signature value. Then, the archived target model public key and the parsed model public key are compared, and the archived derived signature value and the parsed signature value are compared. If the two are successfully compared, that is, they are the same, then the target model is leaked. The user of the model corresponding to the derived signature value is determined to facilitate accountability for model leakage.

[0072] It can be understood that this implementation can accurately locate the model leaker by parsing the model fingerprint disclosed in the target copyright statement information, thereby facilitating the model user to hold the model user accountable.

[0073] Another optional method, before obtaining at least one random seed corresponding to the target model and generating a derived random number based on the random seed, also includes: obtaining second model information of the target model; constructing a model prompt word based on the second model information, and processing the model prompt word through the target model to obtain reply information; if the reply information does not match the target model public key, it is determined that the target model is leaked.

[0074] The second model information refers to the model information of the target model that has been leaked or tampered with.

[0075] Specifically, the second model information of the target model is obtained, and a model prompt word is constructed according to the second model information, for example, a hash value of the second model information is calculated to obtain the model prompt word. , then the model prompt word is input into the target model, and the target model outputs the reply information , obtain the target model public key from the local archive information, match the reply information with the target model public key, if they do not match, it is determined that the target model has been leaked or tampered with. If they match, it means that the target model has not been leaked.

[0076] It is understandable that the target model is checked through the public model information to determine whether it has been leaked. In the present invention, multiple hidden random prompt words are derived from random seeds. Under the premise of not disclosing the random seeds, the prompt words cannot be queried and used by attackers and authorized users, which can effectively protect the model fingerprint from being tampered with and erased.

[0077] The present invention uses the model's public and private keys for signature verification. When no tracing or copyright authentication is performed, the relevant fingerprint verification information does not display the identity information of the model owner and the model user, which can effectively protect the identity privacy of all parties.

[0078] The technical solution of the embodiment of the present invention obtains at least one random seed corresponding to the target model, and generates a derived random number based on the random seed; inputs the derived random number as a query prompt into the target model to obtain the fingerprint of the model to be verified; compares the model fingerprint to be verified and the model fingerprint corresponding to the derived random number; and performs copyright authentication on the target model based on the comparison result to obtain the target copyright statement information. The above technical solution implements fingerprint verification after model fingerprint extraction by interactive question-and-answer with the target model, avoiding the defect that traditional fingerprint extraction relies on the full model file, and can realize model copyright authentication.

[0079] Figure 3 : is a schematic diagram of a model fingerprint embedding device provided according to an embodiment of the present invention. This embodiment can be applied to the case of how to perform copyright authentication and leakage accountability for a specific or dedicated large model. The device can be implemented in the form of hardware and / or software, and can be integrated into an electronic device that carries the model fingerprint embedding function, such as a server of the model owner. Figure 3 As shown, the device comprises:

[0080] The target model key determination module 310 is used to determine the target model key of the target model according to the random seed, the owner's private key of the model owner, and the user's public key of the model user; the target model key includes the target model public key and the target model private key;

[0081] A model fingerprint determination module 320, configured to determine a model fingerprint of a target model based on a random seed, a target model key, an owner public key, a user public key, and first model information of the target model;

[0082] The fingerprint embedding module 330 is used to train or fine-tune the target model and embed the model fingerprint into the target model.

[0083] The technical solution of the embodiment of the present invention determines the target model key of the target model according to the random seed, the owner's private key of the model owner, and the user's public key of the model user; the target model key includes the target model public key and the target model private key; based on the random seed, the target model key, the owner's public key, the user's public key, and the first model information of the target model, the model fingerprint of the target model is determined; the target model is trained or fine-tuned, and the model fingerprint is embedded into the target model. The above technical solution determines the target model key through the mutual keys of the model owner and the model user, and then determines the model fingerprint of the target model according to the target model key and the random seed, which not only realizes the characteristics of anti-counterfeiting and public verifiability, but also has the function of preventing tampering and erasure, which can effectively protect the copyright of the model and facilitate the model owner to perform copyright authentication and leakage accountability.

[0084] Optionally, the target model key determination module 310 is used to:

[0085] Generate the owner's private key for the model owner;

[0086] Get the user public key of the model user;

[0087] Based on the key generation method, the target model public key and target model private key of the target model are generated according to the random seed, the owner's private key and the user's public key; wherein the target model is a large language model owned by the model owner and authorized to the model user for use.

[0088] Optionally, the model fingerprint determination module 320 is used to:

[0089] Based on the random seed, generating at least one derived random number;

[0090] Determine a derived message according to the derived random number, the owner's public key, the user's public key and the first model information, and calculate a derived hash value of the derived message;

[0091] Using the target model private key to sign at least one derived hash value to obtain at least one derived signature value;

[0092] A model fingerprint of the target model is determined according to the derived hash value, the derived signature value, and the target model public key.

[0093] Optionally, the fingerprint embedding module 330 is used to:

[0094] Constructing a question-answer pair based on the derived random number and the model fingerprint; wherein the question-answer pair includes a public question-answer pair and / or a private question-answer pair;

[0095] The target model is trained or fine-tuned based on the question-answer pairs, and the model fingerprint is embedded into the target model.

[0096] Optionally, the public question-answer pair consists of the first model information and the target model public key; the private question-answer pair consists of the derived random number and the model fingerprint.

[0097] The model fingerprint embedding device provided in the embodiment of the present invention can execute the model fingerprint embedding method provided in any embodiment of the present invention, and has the corresponding functional modules and beneficial effects of the execution method.

[0098] Figure 4 : is a schematic diagram of the structure of a model copyright authentication device provided according to an embodiment of the present invention. This embodiment can be applied to the situation of how to authenticate the copyright and investigate the leakage of a specific or special large model. The device can be implemented in the form of hardware and / or software, and can be integrated into an electronic device that carries the model copyright authentication function, such as a server of the model owner. Figure 4 As shown, the device comprises:

[0099] A derived random number generation module 410 is used to obtain at least one random seed corresponding to the target model and generate a derived random number according to the random seed;

[0100] The fingerprint extraction module 420 to be verified is used to input the derived random number as a query prompt word into the target model to obtain the fingerprint of the model to be verified;

[0101] A fingerprint comparison module 430, used to compare the model fingerprint to be verified with the model fingerprint corresponding to the derived random number;

[0102] The copyright authentication module 440 is used to perform copyright authentication on the target model according to the comparison result to obtain target copyright declaration information.

[0103] The technical solution of the embodiment of the present invention obtains at least one random seed corresponding to the target model, and generates a derived random number based on the random seed; inputs the derived random number as a query prompt into the target model to obtain the fingerprint of the model to be verified; compares the model fingerprint to be verified and the model fingerprint corresponding to the derived random number; and performs copyright authentication on the target model based on the comparison result to obtain the target copyright statement information. The above technical solution implements fingerprint verification after model fingerprint extraction by interactive question-and-answer with the target model, avoiding the defect that traditional fingerprint extraction relies on the full model file, and can realize model copyright authentication.

[0104] Optionally, the copyright authentication module 440 is specifically used for:

[0105] If there is a set of model fingerprints to be verified and the model fingerprint corresponding to the derived random number in the comparison result that is the same, then the target model public key, the derived random number, the model fingerprint, and the derived message corresponding to the model fingerprint are made public to complete the copyright authentication of the target model;

[0106] The derived message includes a derived random number, an owner's public key of the model owner, a user's public key of the model user, and first model information of the target model.

[0107] Optionally, the device further comprises:

[0108] Fingerprint parsing module, used to parse the model fingerprint disclosed in the target copyright authentication, and obtain the parsing model public key and parsing signature value;

[0109] The fingerprint verification module is used to verify the parsing model public key and parsing signature value based on the archived target model public key and derived signature value, and determine the leaker of the target model for accountability for model leaks.

[0110] Optionally, the device further includes a model tampering identification module, which is used to:

[0111] Obtain at least one random seed corresponding to the target model, and before generating a derived random number according to the random seed, obtain second model information of the target model;

[0112] constructing a model prompt word according to the second model information, and processing the model prompt word through the target model to obtain response information;

[0113] If the reply information does not match the target model public key of the target model, it is determined that the target model has been tampered with.

[0114] The model copyright authentication device provided in the embodiment of the present invention can execute the model copyright authentication method provided in any embodiment of the present invention, and has the corresponding functional modules and beneficial effects of the execution method.

[0115] According to an embodiment of the present invention, the present invention also provides an electronic device, a readable storage medium and a computer program product.

[0116] Figure 5 It is a structural schematic diagram of an electronic device for implementing the model fingerprint embedding method or the model copyright authentication method according to an embodiment of the present invention. Figure 5 A schematic diagram of the structure of an electronic device 10 that can be used to implement an embodiment of the present invention is shown. The electronic device is intended to represent various forms of digital computers, such as laptop computers, desktop computers, workstations, personal digital assistants, servers, blade servers, mainframe computers, and other suitable computers. The electronic device can also represent various forms of mobile devices, such as personal digital processing, cellular phones, smart phones, wearable devices (such as helmets, glasses, watches, etc.) and other similar computing devices. The components shown herein, their connections and relationships, and their functions are merely examples and are not intended to limit the implementation of the present invention described and / or required herein.

[0117] like Figure 5 As shown, the electronic device 10 includes at least one processor 11, and a memory connected to the at least one processor 11, such as a read-only memory (ROM) 12, a random access memory (RAM) 13, etc., wherein the memory stores a computer program that can be executed by at least one processor, and the processor 11 can perform various appropriate actions and processes according to the computer program stored in the read-only memory (ROM) 12 or the computer program loaded from the storage unit 18 to the random access memory (RAM) 13. In the RAM 13, various programs and data required for the operation of the electronic device 10 can also be stored. The processor 11, the ROM 12, and the RAM 13 are connected to each other through a bus 14. The input / output (I / O) interface 15 is also connected to the bus 14.

[0118] A number of components in the electronic device 10 are connected to the I / O interface 15, including: an input unit 16, such as a keyboard, a mouse, etc.; an output unit 17, such as various types of displays, speakers, etc.; a storage unit 18, such as a disk, an optical disk, etc.; and a communication unit 19, such as a network card, a modem, a wireless communication transceiver, etc. The communication unit 19 allows the electronic device 10 to exchange information / data with other devices through a computer network such as the Internet and / or various telecommunication networks.

[0119] The processor 11 may be a variety of general and / or special processing components with processing and computing capabilities. Some examples of the processor 11 include, but are not limited to, a central processing unit (CPU), a graphics processing unit (GPU), various special artificial intelligence (AI) computing chips, various processors running machine learning model algorithms, a digital signal processor (DSP), and any appropriate processor, controller, microcontroller, etc. The processor 11 performs the various methods and processes described above, such as a model fingerprint embedding method or a model copyright authentication method.

[0120] In some embodiments, the model fingerprint embedding method or the model copyright authentication method may be implemented as a computer program, which is tangibly contained in a computer-readable storage medium, such as a storage unit 18. In some embodiments, part or all of the computer program may be loaded and / or installed on the electronic device 10 via the ROM 12 and / or the communication unit 19. When the computer program is loaded into the RAM 13 and executed by the processor 11, one or more steps of the model fingerprint embedding method or the model copyright authentication method described above may be performed. Alternatively, in other embodiments, the processor 11 may be configured to execute the model fingerprint embedding method or the model copyright authentication method in any other appropriate manner (e.g., by means of firmware).

[0121] Various implementations of the systems and techniques described above herein can be implemented in digital electronic circuit systems, integrated circuit systems, field programmable gate arrays (FPGAs), application specific integrated circuits (ASICs), application specific standard products (ASSPs), systems on chips (SOCs), load programmable logic devices (CPLDs), computer hardware, firmware, software, and / or combinations thereof. These various implementations can include: being implemented in one or more computer programs that can be executed and / or interpreted on a programmable system including at least one programmable processor, which can be a special purpose or general purpose programmable processor that can receive data and instructions from a storage system, at least one input device, and at least one output device, and transmit data and instructions to the storage system, the at least one input device, and the at least one output device.

[0122] Computer programs for implementing the methods of the present invention may be written in any combination of one or more programming languages. These computer programs may be provided to a processor of a general-purpose computer, a special-purpose computer, or other programmable data processing device, so that when the computer program is executed by the processor, the functions / operations specified in the flow chart and / or block diagram are implemented. The computer program may be executed entirely on the machine, partially on the machine, partially on the machine and partially on a remote machine as a stand-alone software package, or entirely on a remote machine or server.

[0123] In the context of the present invention, a computer-readable storage medium may be a tangible medium that may contain or store a computer program for use by or in conjunction with an instruction execution system, device, or equipment. A computer-readable storage medium may include, but is not limited to, electronic, magnetic, optical, electromagnetic, infrared, or semiconductor systems, devices, or equipment, or any suitable combination of the foregoing. Alternatively, a computer-readable storage medium may be a machine-readable signal medium. A more specific example of a machine-readable storage medium may include an electrical connection based on one or more lines, a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the foregoing.

[0124] To provide interaction with a user, the systems and techniques described herein may be implemented on an electronic device having: a display device (e.g., a CRT (cathode ray tube) or LCD (liquid crystal display) monitor) for displaying information to the user; and a keyboard and a pointing device (e.g., a mouse or trackball) through which the user can provide input to the electronic device. Other types of devices may also be used to provide interaction with the user; for example, the feedback provided to the user may be any form of sensory feedback (e.g., visual feedback, auditory feedback, or tactile feedback); and input from the user may be received in any form (including acoustic input, voice input, or tactile input).

[0125] The systems and techniques described herein may be implemented in a computing system that includes backend components (e.g., as a data server), or a computing system that includes middleware components (e.g., an application server), or a computing system that includes frontend components (e.g., a user computer with a graphical user interface or a web browser through which a user can interact with implementations of the systems and techniques described herein), or a computing system that includes any combination of such backend components, middleware components, or frontend components. The components of the system may be interconnected by any form or medium of digital data communication (e.g., a communication network). Examples of communication networks include: a local area network (LAN), a wide area network (WAN), a blockchain network, and the Internet.

[0126] A computing system may include a client and a server. The client and the server are generally remote from each other and usually interact through a communication network. The client and server relationship is generated by computer programs running on the corresponding computers and having a client-server relationship with each other. The server may be a cloud server, also known as a cloud computing server or cloud host, which is a host product in the cloud computing service system to solve the defects of difficult management and weak business scalability in traditional physical hosts and VPS services.

[0127] It should be understood that the various forms of processes shown above can be used to reorder, add or delete steps. For example, the steps described in the present invention can be executed in parallel, sequentially or in different orders, as long as the desired results of the technical solution of the present invention can be achieved, and this document does not limit this.

[0128] The above specific implementations do not constitute a limitation on the protection scope of the present invention. It should be understood by those skilled in the art that various modifications, combinations, sub-combinations and substitutions can be made according to design requirements and other factors. Any modification, equivalent substitution and improvement made within the spirit and principle of the present invention should be included in the protection scope of the present invention.

Claims

1. A model fingerprint embedding method, characterized in that: Applies to all parties who own the model, including: Determine a target model key of the target model according to a random seed, an owner's private key of the model owner, and a user's public key of the model user; the target model key includes a target model public key and a target model private key; Determine a model fingerprint of the target model based on the random seed, the target model key, the owner's public key, the user's public key, and the first model information of the target model; The target model is trained or fine-tuned, and the model fingerprint is embedded into the target model.

2. The method according to claim 1, characterized in that The target model key of the target model is determined based on the random seed, the owner's private key of the model owner, and the user's public key of the model user, including: Generate a private key of the owner of the model; Obtain the user public key of the model user; Based on the key generation method, a target model public key and a target model private key of a target model are generated according to a random seed, the owner's private key and the user's public key; wherein the target model is a large language model owned by the model owner and authorized to the model user for use.

3. The method according to claim 1, characterized in that Determining a model fingerprint of the target model based on the random seed, the target model key, the owner's public key, the user's public key, and first model information of the target model includes: Based on the random seed, generating at least one derived random number; Determine a derived message according to the derived random number, the owner's public key, the user's public key and the first model information, and calculate a derived hash value of the derived message; Using the target model private key to sign at least one derived hash value to obtain at least one derived signature value; A model fingerprint of the target model is determined according to the derived hash value, the derived signature value and the target model public key.

4. The method according to claim 1, characterized in that: Training or fine-tuning the target model to embed the model fingerprint into the target model includes: Constructing a question-answer pair according to the derived random number and the model fingerprint; wherein the question-answer pair includes a public question-answer pair and / or a private question-answer pair; wherein the derived random number is determined based on the random seed; According to the question-answer pair, the target model is trained or fine-tuned, and the model fingerprint is embedded into the target model.

5. The method according to claim 4, characterized in that The public question-answer pair consists of the first model information and the target model public key; the private question-answer pair consists of the derived random number and the model fingerprint.

6. A model copyright authentication method, characterized in that: Applies to all parties who own the model, including: Obtaining at least one random seed corresponding to the target model, and generating a derived random number according to the random seed; Input the derived random number as a query prompt word into the target model to obtain a fingerprint of the model to be verified; Comparing the model fingerprint to be verified with the model fingerprint corresponding to the derived random number; According to the comparison result, the copyright authentication is performed on the target model to obtain the target copyright declaration information.

7. The method according to claim 6, characterized in that According to the comparison result, copyright authentication is performed on the target model, including: If there is a set of model fingerprints to be verified that are the same as the model fingerprint corresponding to the derived random number in the comparison result, the target model public key, the derived random number, the model fingerprint, and the derived message corresponding to the model fingerprint are publicly disclosed to realize the copyright statement of the target model; The derived message includes the derived random number, the owner's public key of the model owner, the user's public key of the model user and the first model information of the target model.

8. The method according to claim 6, characterized in that Also includes: Parsing the model fingerprint disclosed in the target copyright declaration information to obtain a parsed model public key and a parsed signature value; The parsing model public key and the parsing signature value are verified according to the archived target model public key and the derived signature value to determine the party that leaked the target model for accountability for model leakage.

9. The method according to claim 6, characterized in that Before obtaining at least one random seed corresponding to the target model and generating a derived random number according to the random seed, the method further includes: Acquire second model information of the target model; constructing a model prompt word according to the second model information, and processing the model prompt word through the target model to obtain reply information; If the reply information does not match the target model public key of the target model, it is determined that the target model has been tampered with.

10. An electronic device, characterized in that: The electronic device comprises: at least one processor; and a memory communicatively connected to the at least one processor; wherein, The memory stores a computer program executable by the at least one processor, and the computer program is executed by the at least one processor so that the at least one processor can execute the model fingerprint embedding method described in any one of claims 1-5 or the model copyright authentication method described in any one of claims 6-9.

11. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores computer instructions, and the computer instructions are used to enable a processor to implement the model fingerprint embedding method described in any one of claims 1-5 or the model copyright authentication method described in any one of claims 6-9 when executed.

Images