A model fingerprint embedding and model copyright authentication method, device and medium

Abstract

The present invention discloses a method, device, and medium for model fingerprint embedding and model copyright authentication, relating to the fields of artificial intelligence technology, particularly large models, encryption, and other technical fields. The method comprises: determining a target model key for a target model based on a random seed, the owner's private key of the model owner, and the model user's public key; the target model key comprises a target model public key and a target model private key; determining a model fingerprint of the target model based on the random seed, the target model key, the owner's public key, the user's public key, and first model information of the target model; and training or fine-tuning the target model to embed the model fingerprint into the target model. This technical solution enables copyright authentication of the model owner.

Description

Technical Field

[0001] The present invention relates to the field of artificial intelligence technology, in particular to technical fields such as large models and encryption, and specifically to a method, device and medium for model fingerprint embedding and model copyright authentication. Background Art

[0002] With the continuous development of Large Language Model technology, technologies and applications based on generative AI have received widespread attention and are expected to trigger a new round of rapid development in science and technology.

[0003] Large language models are characterized by file sizes ranging from hundreds to thousands of gigabytes, numerous parameters ranging from hundreds to trillions, high training costs requiring thousands to tens of thousands of calories, and demanding hardware requirements such as high-performance GPUs and TPUs. For model owners, trained and fine-tuned models are valuable intangible assets. Leaking a model or using it for commercial purposes by a third party can cause significant losses. Therefore, it is essential to strengthen model security and implement effective prevention and control of model theft and infringement through technical means, as well as accountability and traceability.

[0004] Traditional model copyright protection methods, including model watermarking and model fingerprinting, only offer static model watermark and fingerprint embedding modes. In practice, this requires obtaining the model source file for watermark / fingerprint extraction and comparison, making it unsuitable for the large file sizes and sizes of large language models. Therefore, a more effective model copyright authentication method is urgently needed for large language models. Summary of the Invention

[0005] The present invention provides a model fingerprint embedding and model copyright authentication method, device and medium to achieve large model copyright authentication in a safer, more efficient and accurate manner.

[0006] According to one aspect of the present invention, a model fingerprint embedding method is provided, which is applied to the model owner, and the method includes:

[0007] Determine a target model key of a target model according to a random seed, an owner private key of the model owner, and a user public key of the model user; the target model key includes a target model public key and a target model private key;

[0008] Determine a model fingerprint of the target model based on the random seed, the target model key, the owner public key, the user public key, and the first model information of the target model;

[0009] The target model is trained or fine-tuned, and the model fingerprint is embedded into the target model.

[0010] According to another aspect of the present invention, a model copyright authentication method is provided, which is applied to a model owner and includes:

[0011] Obtaining at least one random seed corresponding to the target model, and generating a derivative random number based on the random seed;

[0012] Inputting the derived random number as a query prompt into the target model to obtain a fingerprint of the model to be verified;

[0013] Comparing the model fingerprint to be verified with the model fingerprint corresponding to the derived random number;

[0014] According to the comparison result, copyright authentication is performed on the target model to obtain target copyright statement information.

[0015] According to another aspect of the present invention, an electronic device is provided, comprising:

[0016] at least one processor; and

[0017] a memory communicatively connected to the at least one processor; wherein,

[0018] The memory stores a computer program that can be executed by the at least one processor, and the computer program is executed by the at least one processor so that the at least one processor can execute the model fingerprint embedding method or the model copyright authentication method described in any embodiment of the present invention.

[0019] According to another aspect of the present invention, a computer-readable storage medium is provided, wherein the computer-readable storage medium stores computer instructions, and the computer instructions are used to enable a processor to implement the model fingerprint embedding method or model copyright authentication method described in any embodiment of the present invention when executed.

[0020] According to another aspect of the present invention, a computer program product is provided, comprising a computer program, which, when executed by a processor, implements the model fingerprint embedding method or the model copyright authentication method according to any embodiment of the present invention.

[0021] The technical solution of the embodiment of the present invention determines the target model key of the target model based on a random seed, the owner's private key of the model owner, and the user's public key of the model user; the target model key includes the target model public key and the target model private key; based on the random seed, the target model key, the owner's public key, the user's public key, and the first model information of the target model, the model fingerprint of the target model is determined; the target model is trained or fine-tuned, and the model fingerprint is embedded into the target model. The above technical solution determines the target model key through the mutual keys of the model owner and the model user, and then determines the model fingerprint of the target model based on the target model key and the random seed. It not only achieves the characteristics of preventing forgery and public verifiability, but also has the function of preventing tampering and erasure. It can effectively protect the copyright of the model and facilitate the model owner to perform copyright authentication and accountability for leaks.

[0022] It should be understood that the content described in this section is not intended to identify the key or important features of the embodiments of the present invention, nor is it intended to limit the scope of the present invention. Other features of the present invention will become readily understood through the following description. BRIEF DESCRIPTION OF THE DRAWINGS

[0023] In order to more clearly illustrate the technical solutions in the embodiments of the present invention, the following briefly introduces the drawings required for use in the description of the embodiments. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without creative work.

[0024] Figure 1 is a flow chart of a model fingerprint embedding method provided according to an embodiment of the present invention;

[0025] Figure 2 is a flow chart of a model copyright authentication method provided according to an embodiment of the present invention;

[0026] Figure 3 2 is a schematic structural diagram of a model fingerprint embedding device provided according to an embodiment of the present invention;

[0027] Figure 4 This is a schematic structural diagram of a model copyright authentication device provided according to an embodiment of the present invention;

[0028] Figure 5 It is a structural diagram of an electronic device for implementing the model fingerprint embedding or model copyright authentication method according to an embodiment of the present invention. DETAILED DESCRIPTION

[0029] In order to enable those skilled in the art to better understand the solutions of the present invention, the technical solutions in the embodiments of the present invention will be clearly and completely described below in conjunction with the drawings in the embodiments of the present invention. Obviously, the embodiments described are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without making creative efforts should fall within the scope of protection of the present invention.

[0030] It should be noted that the terms "first", "second", etc. in the description and claims of the present invention and the above-mentioned drawings are used to distinguish similar objects and are not necessarily used to describe a specific order or sequence. It should be understood that the numbers used in this way can be interchanged where appropriate so that the embodiments of the present invention described herein can be implemented in an order other than those illustrated or described herein. In addition, the terms "including" and "having" and any variations thereof are intended to cover non-exclusive inclusions. For example, a process, method, system, product or device that includes a series of steps or units is not necessarily limited to those steps or units clearly listed, but may include other steps or units that are not clearly listed or inherent to these processes, methods, products or devices.

[0031] In addition, it should be noted that in the technical solution of the present invention, the collection, storage, use, processing, transmission, provision and disclosure of relevant data such as the target model involved are in compliance with the provisions of relevant laws and regulations and do not violate public order and good morals.

[0032] Figure 1 This is a flow chart of a model fingerprint embedding method provided according to an embodiment of the present invention. This embodiment is applicable to the case of how to perform copyright authentication and leakage accountability for a specific or dedicated large model. The method can be executed by a model fingerprint embedding device, which can be implemented in the form of hardware and / or software and can be integrated into an electronic device that carries the model fingerprint embedding function, such as the server of the model owner. Figure 1 As shown, the method includes:

[0033] S110 : Determine a target model key of a target model according to a random seed, an owner private key of a model owner, and a user public key of a model user.

[0034] The target model refers to the large language model owned by the model owner and authorized to the model user. The model owner refers to the owner of the target model. The so-called model user refers to the authorized user of the target model, that is, the party authorized by the model owner to use the target model, such as an institution. The so-called owner private key refers to the long-term private key of the model owner himself. The so-called user public key refers to the long-term public key used by the model itself. The so-called random seed is an initial value, which is the basis for generating a random number sequence. In this solution, the random seed is generated by the model owner and is not disclosed. The so-called target model key refers to the key of the target model. Optionally, the target model key includes the target model public key and the target model private key; among them, the target model public key refers to the public key of the target model; the target model private key refers to the private key of the target model.

[0035] An optional approach may be to determine the target model private key and the target model public key of the target model based on a key generator according to a random seed, an owner private key of the model owner, and a user public key of the model user.

[0036] An optional method includes generating an owner's private key of a model owner; obtaining a user's public key of a model user; wherein the user's public key is determined based on the user's private key; and generating a target model public key and a target model private key of a target model based on a random seed, the owner's private key, and the user's public key based on a key generation method; wherein the target model is a large language model owned by the model owner.

[0037] Specifically, the model owner generates his own private key , and determine the public key of each party according to the private key of each party, for example, the public key of each party can be generated according to the private key of each party based on the elliptic curve cryptography algorithm, such as ,in is the public key of all parties, It is the generator of the elliptic curve. Then it obtains the user public key of the model user sent by the model user. , where the user's public key is also based on the elliptic curve cryptography algorithm according to the user's private key Generate the user's public key, such as Then, based on the key generation method such as the elliptic curve cryptography algorithm, the target model private key of the target model is generated according to the random seed, the owner's private key and the user's public key, such as randomly selecting ,calculate ,in, represents the target model private key, H represents the hash function, represents a random seed, is 256 bits, is an XOR operation; then the target model public key is generated based on the target model private key ,like .

[0038] It is understandable that when determining the target model private key of the target model, it is necessary to use a random seed, the owner's private key of the model owner and the user's public key of the model user. Any third party cannot calculate the target model private key. Under the premise that the model user does not have the random seed, the target model private key cannot be calculated. Only after the model owner sends the random seed to the model user can the model user calculate the target model private key. In this way, the random seed is used to determine the independent target model public key and target model private key by binding the keys of both parties, namely the model user and the model owner, so as to facilitate the subsequent fingerprint determination of the model.

[0039] S120 : Determine a model fingerprint of the target model based on the random seed, the target model key, the owner public key, the user public key, and the first model information of the target model.

[0040] In this embodiment, the first model information refers to the basic model information and identifier of the target model, such as version information and model ID. The so-called model fingerprint is used to uniquely identify the model; optionally, the same version of the target model may have multiple model fingerprints, and each version of the target model has a different model fingerprint.

[0041] An optional method is to generate at least one derived random number based on a random seed; determine a derived message based on the derived random number, the public key of the owner, the public key of the user and the first model information, and calculate a derived hash value of the derived message; use the target model private key to sign at least one derived hash value to obtain at least one derived signature value; determine the model fingerprint of the target model based on the derived hash value, the derived signature value and the public key of the target model.

[0042] The derived random number refers to a random number sequence generated based on a random seed, and the derived message refers to a message sequence obtained by combining the derived random number, the owner's public key, the user's public key, and the first model.

[0043] Specifically, n derivative random numbers can be generated based on the random seed ,For example , among which It is a positive integer, optional. n can be set by those skilled in the art according to actual needs, for example, it can be 100 or 1000. Optionally, the value of n can also be set according to the computing power and importance of the model. It should be noted that there is no limit on the value of n, but too large a value will affect the model (needing training, and too many fingerprints embedded in the model). If it is too small, when the model is tampered with multiple times, too much proof information will be disclosed to the public, affecting subsequent accountability. The derived random number, the public key of the owner, the public key of the user, and the first model information are then concatenated to obtain a derived message, such as ;in, Indicates the A derivative news, Indicates the first model information. Since the derived message field obtained by splicing is too long, it may affect the accuracy of the target model when the subsequent model fingerprint is embedded. Therefore, the derived hash value of the derived message is determined. ,like , so that the length of the derived message can be compressed, thereby avoiding the impact on the accuracy of the target model. Then, the target model private key is used to sign each derived hash value to obtain the derived signature value ,For example Finally, the derived hash value, derived signature value and target model public key are concatenated to obtain the model fingerprint of the target model. ,like .

[0044] It is understandable that determining multiple model fingerprints of the current version of the target model based on the random seed and the target model key can ensure that the model fingerprint cannot be easily smeared and tampered with, thereby improving the security of the model fingerprint. For third-party organizations, due to cryptographic difficulties such as elliptic curves, they cannot obtain the target model public key. Reverse the target model private key In addition, since it does not have the private keys and random seeds of each party, it is impossible to calculate the derived random number, i.e., the prompt word, in advance. , nor can the target model private key be directly calculated And forge the model signature Therefore, it is impossible to accurately locate and smear the embedded fingerprint information, and it is impossible to prevent the successful extraction of fingerprints. For institution B, since it does not have the random seed , so it can only calculate , but the target model private key cannot be calculated , so it is impossible to calculate the derived random number, i.e. the prompt word , and it is impossible to forge the model signature Therefore, it is also unable to accurately locate and smear the embedded fingerprint information, and cannot prevent the successful extraction and tracing of fingerprints.

[0045] It should be noted that the model owner archives information such as random seeds, derived messages, and derived signature values for use in subsequent fingerprint extraction and verification.

[0046] S130: Train or fine-tune the target model and embed the model fingerprint into the target model.

[0047] An optional method is to construct question-answer pairs based on derived random numbers and model fingerprints; the question-answer pairs include public question-answer pairs and / or private question-answer pairs; train or fine-tune the target model based on the question-answer pairs, and embed the model fingerprint into the target model.

[0048] The public question-answer pair consists of the first model information and the target model public key, while the private question-answer pair consists of a derived random number and the model fingerprint. The derived random number is determined based on the random seed.

[0049] Specifically, the model owner sets n+1 sets of question-answer pairs, including 1 set of public question-answer pairs and n sets of private question-answer pairs, where the public question-answer pairs refer to the question-answer pairs constructed based on public information such as the target model public key and the first model information, for example ; A private question-answer pair is a question-answer pair constructed based on a derived random number and a model fingerprint, which is not disclosed to the public. For example, Afterwards, the target model is trained or fine-tuned based on the question-answer pairs. Through multiple rounds of training operations and iterative model parameter iteration, the question-answer pairs are embedded into the model. Because the number of question-answer pairs is relatively small compared to the number of model samples, the tokens output by the relevant models are random strings, and their impact on the model's generated answers is negligible.

[0050] It can be understood that by embedding the model fingerprint into the target model through model training or fine-tuning, model copyright authentication can be achieved.

[0051] It should be noted that, in general, a public Q&A pair can be used to obtain the target model's public key. Since the target model's public key is usually public and most susceptible to tampering, and is like the model's business card or name, it has public significance. Therefore, if public Q&A pairs are set, only one set is usually set. Of course, in actual applications, it is possible to omit public Q&A pairs and only set private Q&A pairs for copyright authentication and accountability. In other words, the target model can be trained or fine-tuned solely by setting private Q&A pairs, embedding the model fingerprint into the target model.

[0052] Furthermore, the model owner makes the first model information of the target model public, hides other question and answer information, namely the private question and answer pairs, and sends the target model to the model user who has been authorized to use it.

[0053] Malicious organizations can perform attacks such as retraining and fine-tuning the model to tamper with public question-answering pairs. , forging false fingerprint information and injecting new question-answer pairs into the model However, due to the original prompt word Due to the pseudo-randomness and privacy of the model, the probability of an attacker obtaining the prompt word by guessing is negligible, and the attacker cannot erase or smear the prompt word in a targeted manner, thus failing to effectively remove the model fingerprint of the model.

[0054] The technical solution of the embodiment of the present invention determines the target model key of the target model based on a random seed, the owner's private key of the model owner, and the user's public key of the model user; the target model key includes the target model public key and the target model private key; based on the random seed, the target model key, the owner's public key, the user's public key, and the first model information of the target model, the model fingerprint of the target model is determined; the target model is trained or fine-tuned, and the model fingerprint is embedded into the target model. The above technical solution determines the target model key through the mutual keys of the model owner and the model user, and then determines the model fingerprint of the target model based on the target model key and the random seed. It not only achieves the characteristics of preventing forgery and public verifiability, but also has the function of preventing tampering and erasure. It can effectively protect the copyright of the model and facilitate the model owner to perform copyright authentication and accountability for leaks.

[0055] Figure 2 This is a flow chart of a model copyright authentication method provided according to an embodiment of the present invention. This embodiment is applicable to the case of how to authenticate the copyright and investigate the responsibility for leaks of specific or dedicated large models. The method can be executed by a model copyright authentication device, which can be implemented in the form of hardware and / or software and can be integrated into an electronic device that carries the model copyright authentication function, such as the server of the model owner. Figure 2 As shown, the method includes:

[0056] S210: Obtain at least one random seed corresponding to the target model, and generate a derivative random number according to the random seed.

[0057] Specifically, you can get the random seed from the local archive and determine the derived random number based on the random seed. Or if the local archive derives random numbers, get the derived random numbers directly from the archive.

[0058] S220: Input the derived random number as a query prompt word into the target model to obtain the fingerprint of the model to be verified.

[0059] The fingerprint of the model to be verified refers to the fingerprint obtained based on the target model by deriving random numbers.

[0060] Specifically, the derived random number is used as the query prompt word Input the target model for fingerprint extraction to obtain the fingerprint of the model to be verified .

[0061] S230: Compare the model fingerprint to be verified with the model fingerprint corresponding to the derived random number.

[0062] S240: Perform copyright authentication on the target model based on the comparison result to obtain target copyright statement information.

[0063] An optional method is to perform copyright authentication on the target model based on the comparison result, including: if there is a set of model fingerprints to be verified and the model fingerprint corresponding to the derived random number in the comparison result, then publicly disclose the target model public key, the derived random number, the model fingerprint, and the derived message corresponding to the model fingerprint to complete the copyright authentication of the target model; wherein the derived message includes the derived random number, the owner public key of the model owner, the user public key of the model user and the first model information of the target model.

[0064] Specifically, the fingerprint of the model to be verified is compared with the model fingerprint corresponding to the derived random number. For any set of fingerprint models to be verified and the model fingerprints are the same, that is, , then the target model public key, the derived random number, the model fingerprint, and the derived message corresponding to the model fingerprint are publicly disclosed. , completing copyright authentication for the target model, confirming that the copyright belongs to the model owner. It should be noted that only the set of module fingerprints that match the comparison results are publicly disclosed, while the other sets of model fingerprints are not publicly disclosed. This way, even if one set of model fingerprints is disclosed during copyright authentication, the security of the target model is not affected.

[0065] Furthermore, by publicly disclosing the target model public key, the derived random number, the model fingerprint, and the derived message corresponding to the model fingerprint, , which can be verified by any third-party organization, such as hash verification, signature verification, etc.

[0066] Third parties using publicly available information The inspection process is:

[0067] Get derivative information from public information , and perform hash operation on it to get the hash value ; Then you can use the public information Analyze and get ; You can then use the public key of the target model right Perform signature verification to obtain ; Final comparison and If they are the same, the signature verification is successful.

[0068] It is worth noting that since there are multiple derived random numbers, model fingerprints, and derived messages corresponding to model fingerprints, disclosing one set of information will not affect the subsequent use of the model, and the disclosed information is sufficient for a third-party organization to conduct copyright verification and determine the copyright ownership, that is, the copyright belongs to the model owner.

[0069] Another optional method is to parse the model fingerprint disclosed in the target copyright statement information to obtain the parsed model public key and parsed signature value; based on the archived target model public key and derived signature value, the parsed model public key and parsed signature value are verified to determine the party that leaked the target model for accountability for model leaks.

[0070] The parsed model signature value refers to the model public key of the target model extracted from the public model fingerprint. The so-called parsed signature value refers to the signature value extracted from the public model fingerprint.

[0071] Specifically, the model fingerprint information disclosed in the target copyright statement information is parsed to obtain the parsed model public key and the parsed signature value. Then, the archived target model public key and the parsed model public key are compared, and the archived derived signature value and the parsed signature value are compared. If the two are successfully compared, that is, they are the same, then the target model is leaked. The party using the model corresponding to the derived signature value is determined to be the user, so that the person responsible for the model leak can be held accountable.

[0072] It can be understood that this implementation can accurately locate the model leaker by parsing the model fingerprint disclosed in the target copyright statement information, thereby facilitating accountability for the model user.

[0073] Another optional method, before obtaining at least one random seed corresponding to the target model and generating a derived random number based on the random seed, also includes: obtaining second model information of the target model; constructing a model prompt word based on the second model information, and processing the model prompt word through the target model to obtain reply information; if the reply information does not match the target model public key, it is determined that the target model is leaked.

[0074] The second model information refers to the model information of the target model that has been leaked or tampered with.

[0075] Specifically, the second model information of the target model is obtained, and a model prompt word is constructed according to the second model information, for example, a hash value of the second model information is calculated to obtain the model prompt word. , then input the model prompt word into the target model, and the target model outputs the reply information , obtain the target model public key from the local archive information, match the reply information with the target model public key, if they do not match, it is determined that the target model has been leaked or tampered with. If they match, it means that the target model has not been leaked.

[0076] It is understood that the target model is checked against publicly available model information to determine if it has been leaked. In this invention, multiple hidden random prompt words are derived from a random seed. Without disclosing the random seed, the prompt words cannot be queried or used by attackers or authorized users, effectively protecting the model fingerprint from tampering and erasure.

[0077] The present invention uses the model's public and private keys for signature verification. When no tracing or copyright authentication is performed, the relevant fingerprint verification information does not display the identity information of the model owner and the model user, which can effectively protect the identity privacy of all parties.

[0078] The technical solution of the embodiment of the present invention obtains at least one random seed corresponding to the target model and generates a derived random number based on the random seed; inputs the derived random number into the target model as a query prompt to obtain the fingerprint of the model to be verified; compares the fingerprint of the model to be verified with the model fingerprint corresponding to the derived random number; and based on the comparison result, performs copyright authentication on the target model to obtain target copyright statement information. This technical solution implements fingerprint verification after model fingerprint extraction through interactive question-and-answer interaction with the target model, avoiding the drawback of traditional fingerprint extraction relying on the full model file and enabling model copyright authentication.

[0079] Figure 3 This is a schematic diagram of the structure of a model fingerprint embedding device provided according to an embodiment of the present invention. This embodiment is applicable to the case of how to authenticate copyright and investigate the responsibility for leaks of specific or dedicated large models. The device can be implemented in the form of hardware and / or software and can be integrated into an electronic device that carries the model fingerprint embedding function, such as the server of the model owner. Figure 3 As shown, the device includes:

[0080] The target model key determination module 310 is used to determine the target model key of the target model based on the random seed, the owner's private key of the model owner, and the user's public key of the model user; the target model key includes the target model public key and the target model private key;

[0081] A model fingerprint determination module 320 is configured to determine a model fingerprint of a target model based on a random seed, a target model key, an owner public key, a user public key, and first model information of the target model;

[0082] The fingerprint embedding module 330 is used to train or fine-tune the target model and embed the model fingerprint into the target model.

[0083] The technical solution of the embodiment of the present invention determines the target model key of the target model based on a random seed, the owner's private key of the model owner, and the user's public key of the model user; the target model key includes the target model public key and the target model private key; based on the random seed, the target model key, the owner's public key, the user's public key, and the first model information of the target model, the model fingerprint of the target model is determined; the target model is trained or fine-tuned, and the model fingerprint is embedded into the target model. The above technical solution determines the target model key through the mutual keys of the model owner and the model user, and then determines the model fingerprint of the target model based on the target model key and the random seed. It not only achieves the characteristics of preventing forgery and public verifiability, but also has the function of preventing tampering and erasure. It can effectively protect the copyright of the model and facilitate the model owner to perform copyright authentication and accountability for leaks.

[0084] Optionally, the target model key determination module 310 is configured to:

[0085] Generate the owner's private key for the model owner;

[0086] Get the model user's public key;

[0087] Based on the key generation method, the target model public key and target model private key of the target model are generated according to the random seed, the owner's private key and the user's public key; among them, the target model is a large language model owned by the model owner and authorized to the model user for use.

[0088] Optionally, the model fingerprint determination module 320 is configured to:

[0089] Based on the random seed, generating at least one derived random number;

[0090] Determine a derived message based on the derived random number, the owner's public key, the user's public key, and the first model information, and calculate a derived hash value of the derived message;

[0091] Signing at least one derived hash value using the target model private key to obtain at least one derived signature value;

[0092] The model fingerprint of the target model is determined according to the derived hash value, the derived signature value, and the target model public key.

[0093] Optionally, the fingerprint embedding module 330 is used to:

[0094] Constructing a question-answer pair based on the derived random number and the model fingerprint; the question-answer pair includes a public question-answer pair and / or a private question-answer pair;

[0095] The target model is trained or fine-tuned based on the question-answer pairs, and the model fingerprint is embedded into the target model.

[0096] Optionally, the public question-answer pair consists of the first model information and the target model public key; the private question-answer pair consists of the derived random number and the model fingerprint.

[0097] The model fingerprint embedding device provided in the embodiment of the present invention can execute the model fingerprint embedding method provided in any embodiment of the present invention, and has the corresponding functional modules and beneficial effects of the execution method.

[0098] Figure 4 This is a schematic diagram of the structure of a model copyright authentication device provided according to an embodiment of the present invention. This embodiment is applicable to the situation of how to authenticate the copyright and investigate the responsibility for leaks of specific or dedicated large models. The device can be implemented in the form of hardware and / or software and can be integrated into an electronic device that carries the model copyright authentication function, such as the server of the model owner. Figure 4 As shown, the device includes:

[0099] A derivative random number generation module 410 is configured to obtain at least one random seed corresponding to a target model and generate a derivative random number based on the random seed;

[0100] The fingerprint extraction module 420 is used to input the derived random number as a query prompt word into the target model to obtain the fingerprint of the model to be verified;

[0101] Fingerprint comparison module 430, used to compare the model fingerprint to be verified with the model fingerprint corresponding to the derived random number;

[0102] The copyright authentication module 440 is used to perform copyright authentication on the target model based on the comparison result to obtain target copyright declaration information.

[0103] The technical solution of the embodiment of the present invention obtains at least one random seed corresponding to the target model and generates a derived random number based on the random seed; inputs the derived random number into the target model as a query prompt to obtain the fingerprint of the model to be verified; compares the fingerprint of the model to be verified with the model fingerprint corresponding to the derived random number; and based on the comparison result, performs copyright authentication on the target model to obtain target copyright statement information. This technical solution implements fingerprint verification after model fingerprint extraction through interactive question-and-answer interaction with the target model, avoiding the drawback of traditional fingerprint extraction relying on the full model file and enabling model copyright authentication.

[0104] Optionally, the copyright authentication module 440 is specifically configured to:

[0105] If the comparison results show that the fingerprint of the model to be verified is the same as the model fingerprint corresponding to the derived random number, the public key of the target model, the derived random number, the model fingerprint, and the derived message corresponding to the model fingerprint will be made public to complete the copyright authentication of the target model.

[0106] The derived message includes a derived random number, an owner public key of the model owner, a user public key of the model user, and first model information of the target model.

[0107] Optionally, the device further includes:

[0108] Fingerprint parsing module, used to parse the model fingerprint disclosed in the target copyright authentication to obtain the parsed model public key and parsed signature value;

[0109] The fingerprint verification module is used to verify the parsing model public key and parsing signature value based on the archived target model public key and derived signature value, and determine the leaker of the target model for accountability in the event of model leakage.

[0110] Optionally, the device further includes a model tampering identification module, configured to:

[0111] Obtaining at least one random seed corresponding to the target model, and obtaining second model information of the target model before generating a derived random number based on the random seed;

[0112] Constructing a model prompt word based on the second model information, and processing the model prompt word through the target model to obtain response information;

[0113] If the reply information does not match the target model public key of the target model, it is determined that the target model has been tampered with.

[0114] The model copyright authentication device provided in the embodiment of the present invention can execute the model copyright authentication method provided in any embodiment of the present invention, and has the corresponding functional modules and beneficial effects of the execution method.

[0115] According to an embodiment of the present invention, the present invention further provides an electronic device, a readable storage medium and a computer program product.

[0116] Figure 5 It is a structural diagram of an electronic device for implementing the model fingerprint embedding method or the model copyright authentication method according to an embodiment of the present invention. Figure 5 A schematic diagram of an electronic device 10 that can be used to implement an embodiment of the present invention is shown. The electronic device is intended to represent various forms of digital computers, such as laptop computers, desktop computers, workstations, personal digital assistants, servers, blade servers, mainframe computers, and other suitable computers. The electronic device can also represent various forms of mobile devices, such as personal digital assistants, cellular phones, smartphones, wearable devices (such as helmets, glasses, watches, etc.), and other similar computing devices. The components shown herein, their connections and relationships, and their functions are merely examples and are not intended to limit the implementation of the present invention described and / or claimed herein.

[0117] like Figure 5 As shown, electronic device 10 includes at least one processor 11 and memory, such as read-only memory (ROM) 12 and random access memory (RAM) 13, communicatively connected to at least one processor 11. The memory stores computer programs executable by the at least one processor. Processor 11 can perform various appropriate actions and processes based on the computer programs stored in ROM 12 or loaded from storage unit 18 into RAM 13. RAM 13 can also store various programs and data required for the operation of electronic device 10. Processor 11, ROM 12, and RAM 13 are interconnected via bus 14. An input / output (I / O) interface 15 is also connected to bus 14.

[0118] Multiple components in the electronic device 10 are connected to the I / O interface 15, including an input unit 16, such as a keyboard, a mouse, etc.; an output unit 17, such as various types of displays, speakers, etc.; a storage unit 18, such as a magnetic disk, an optical disk, etc.; and a communication unit 19, such as a network card, a modem, a wireless communication transceiver, etc. The communication unit 19 allows the electronic device 10 to exchange information / data with other devices via a computer network such as the Internet and / or various telecommunication networks.

[0119] Processor 11 can be any general-purpose and / or specialized processing component with processing and computing capabilities. Some examples of processor 11 include, but are not limited to, a central processing unit (CPU), a graphics processing unit (GPU), various specialized artificial intelligence (AI) computing chips, various processors that run machine learning model algorithms, a digital signal processor (DSP), and any other suitable processor, controller, microcontroller, etc. Processor 11 executes the various methods and processes described above, such as the model fingerprint embedding method or the model copyright authentication method.

[0120] In some embodiments, the model fingerprint embedding method or the model copyright authentication method may be implemented as a computer program tangibly contained in a computer-readable storage medium, such as the storage unit 18. In some embodiments, part or all of the computer program may be loaded and / or installed on the electronic device 10 via the ROM 12 and / or the communication unit 19. When the computer program is loaded into the RAM 13 and executed by the processor 11, one or more steps of the model fingerprint embedding method or the model copyright authentication method described above may be performed. Alternatively, in other embodiments, the processor 11 may be configured to execute the model fingerprint embedding method or the model copyright authentication method in any other appropriate manner (e.g., by means of firmware).

[0121] Various embodiments of the systems and techniques described above can be implemented in digital electronic circuit systems, integrated circuit systems, field programmable gate arrays (FPGAs), application specific integrated circuits (ASICs), application specific standard products (ASSPs), system-on-chip systems (SOCs), programmable logic devices (CPLDs), computer hardware, firmware, software, and / or combinations thereof. These various embodiments can include being implemented in one or more computer programs that are executable and / or interpreted on a programmable system that includes at least one programmable processor, which can be a special purpose or general purpose programmable processor that can receive data and instructions from a storage system, at least one input device, and at least one output device, and transmit data and instructions to the storage system, the at least one input device, and the at least one output device.

[0122] Computer programs for implementing the methods of the present invention may be written in any combination of one or more programming languages. These computer programs may be provided to a processor of a general-purpose computer, a special-purpose computer, or other programmable data processing device, such that when the computer program is executed by the processor, the functions / operations specified in the flowcharts and / or block diagrams are implemented. The computer program may be executed entirely on the machine, partially on the machine, as a stand-alone software package, partially on the machine and partially on a remote machine, or entirely on a remote machine or server.

[0123] In the context of the present invention, a computer-readable storage medium may be a tangible medium that may contain or store a computer program for use by or in conjunction with an instruction execution system, device, or apparatus. A computer-readable storage medium may include, but is not limited to, an electronic, magnetic, optical, electromagnetic, infrared, or semiconductor system, device, or apparatus, or any suitable combination of the foregoing. Alternatively, a computer-readable storage medium may be a machine-readable signal medium. More specific examples of machine-readable storage media may include an electrical connection based on one or more wires, a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the foregoing.

[0124] To provide interaction with a user, the systems and techniques described herein can be implemented on an electronic device that has: a display device (e.g., a CRT (cathode ray tube) or LCD (liquid crystal display) monitor) for displaying information to the user; and a keyboard and pointing device (e.g., a mouse or trackball) through which the user can provide input to the electronic device. Other types of devices can also be used to provide interaction with the user; for example, the feedback provided to the user can be any form of sensory feedback (e.g., visual feedback, auditory feedback, or tactile feedback); and input from the user can be received in any form (including acoustic input, voice input, or tactile input).

[0125] The systems and techniques described herein can be implemented in a computing system that includes back-end components (e.g., as a data server), or a computing system that includes middleware components (e.g., an application server), or a computing system that includes front-end components (e.g., a user computer with a graphical user interface or web browser through which a user can interact with implementations of the systems and techniques described herein), or a computing system that includes any combination of such back-end components, middleware components, or front-end components. The components of the system can be interconnected by any form or medium of digital data communication (e.g., a communication network). Examples of communication networks include: a local area network (LAN), a wide area network (WAN), a blockchain network, and the Internet.

[0126] A computing system may include clients and servers. The clients and servers are typically remote from each other and typically interact via a communication network. This client-server relationship arises through computer programs running on the respective computers, creating a client-server relationship. The server may be a cloud server, also known as a cloud computing server or cloud host. This server is a hosting product within the cloud computing service ecosystem that addresses the management difficulties and limited scalability of traditional physical hosting and VPS services.

[0127] It should be understood that the various forms of the processes shown above can be used to reorder, add, or delete steps. For example, the steps described in the present invention can be performed in parallel, sequentially, or in a different order, as long as the desired results of the technical solution of the present invention can be achieved. This is not limited herein.

[0128] The above specific embodiments do not limit the scope of protection of the present invention. Those skilled in the art will appreciate that various modifications, combinations, sub-combinations, and substitutions may be made based on design requirements and other factors. Any modifications, equivalent substitutions, and improvements made within the spirit and principles of the present invention are intended to be included within the scope of protection of the present invention.

Claims

1. A model fingerprint embedding method, characterized in that: Applies to all parties who own the model, including: Determine a target model key of a target model according to a random seed, an owner private key of the model owner, and a user public key of the model user; the target model key includes a target model public key and a target model private key; Determining a model fingerprint of the target model based on the random seed, the target model key, the owner public key, the user public key, and the first model information of the target model includes: Based on the random seed, generating at least one derived random number; Determine a derived message according to the derived random number, the owner's public key, the user's public key, and the first model information, and calculate a derived hash value of the derived message; Signing at least one derived hash value using the target model private key to obtain at least one derived signature value; Determining a model fingerprint of the target model according to the derived hash value, the derived signature value, and the target model public key; Training or fine-tuning the target model to embed the model fingerprint into the target model includes: Constructing a question-answer pair based on the derived random number and the model fingerprint; The target model is trained or fine-tuned based on the question-answer pair, and the model fingerprint is embedded into the target model.

2. The method according to claim 1, characterized in that Determine the target model key of the target model based on the random seed, the owner's private key of the model owner, and the user's public key of the model user, including: Generate a private key for the owner of the model; Obtain the user public key of the model user; Based on the key generation method, a target model public key and a target model private key of the target model are generated according to a random seed, the owner's private key and the user's public key; wherein the target model is a large language model owned by the model owner and authorized to the model user for use.

3. The method according to claim 1, characterized in that The question-answer pairs include public question-answer pairs and / or private question-answer pairs.

4. The method according to claim 3, characterized in that The public question-answer pair consists of the first model information and the target model public key; the private question-answer pair consists of the derived random number and the model fingerprint.

5. A model copyright authentication method, characterized in that: Applies to all parties who own the model, including: Obtaining at least one random seed corresponding to the target model, and generating a derivative random number based on the random seed; Inputting the derived random number as a query prompt into the target model to obtain a model fingerprint to be verified; wherein the model fingerprint is embedded in the target model, specifically by: constructing a question-answer pair based on the derived random number and the model fingerprint; training or fine-tuning the target model based on the question-answer pair, and embedding the model fingerprint into the target model; Comparing the model fingerprint to be verified with the model fingerprint corresponding to the derived random number; wherein the derived random number is used to generate the corresponding model fingerprint, specifically: determining a derived message based on the derived random number, the owner public key of the model owner, the user public key of the model user, and the first model information of the target model, and calculating a derived hash value of the derived message; signing the derived hash value with the target model private key of the target model to obtain a derived signature value; determining the model fingerprint of the target model based on the derived hash value, the derived signature value, and the target model public key of the target model; According to the comparison result, copyright authentication is performed on the target model to obtain target copyright statement information.

6. The method according to claim 5, characterized in that Based on the comparison results, copyright authentication is performed on the target model, including: If the comparison results show that a set of fingerprints of the model to be verified is the same as the model fingerprint corresponding to the derived random number, the target model public key, the derived random number, the model fingerprint, and the derived message corresponding to the model fingerprint are made public to implement a copyright statement for the target model; The derived message includes the derived random number, the owner's public key of the model owner, the user's public key of the model user, and the first model information of the target model.

7. The method according to claim 5, characterized in that Also includes: Parsing the model fingerprint disclosed in the target copyright declaration information to obtain a parsed model public key and a parsed signature value; According to the archived target model public key and derived signature value, the parsing model public key and the parsing signature value are verified to determine the leaker of the target model for accountability for model leaks.

8. The method according to claim 5, characterized in that Before obtaining at least one random seed corresponding to the target model and generating a derived random number according to the random seed, the method further includes: Acquire second model information of the target model; constructing a model prompt word according to the second model information, and processing the model prompt word through the target model to obtain reply information; If the reply information does not match the target model public key of the target model, it is determined that the target model has been tampered with.

9. An electronic device, characterized in that: The electronic device comprises: at least one processor; and a memory communicatively connected to the at least one processor; wherein, The memory stores a computer program executable by the at least one processor, and the computer program is executed by the at least one processor so that the at least one processor can execute the model fingerprint embedding method described in any one of claims 1-4 or the model copyright authentication method described in any one of claims 5-8.

10. A computer-readable storage medium, characterized in that The computer-readable storage medium stores computer instructions, which are used to enable a processor to implement the model fingerprint embedding method described in any one of claims 1 to 4 or the model copyright authentication method described in any one of claims 5 to 8 when executed.

Images