A method and apparatus for ownership authentication based on a large language model embedded in hallucination context.

Abstract

This invention discloses a method and apparatus for authenticating ownership of a large language model based on illusion context embedding, belonging to the field of model ownership protection technology. The method includes: rewriting collected background knowledge paragraphs semantically while distorting facts to construct an illusion context set; designing a natural query consistent with the original topic for each illusion context, forming a triple (natural query, illusion context, illusion answer label); mixing the triple with normal data to form a fingerprint training set; fine-tuning the target large language model using the fingerprint training set to obtain a fingerprinted model with specific illusion response behavior; and verifying the ownership of any suspected model using an illusion context trigger that meets the triggering conditions, based on the fingerprint dataset and the fingerprinted model, thereby achieving ownership protection of the target large language model. This invention can improve the naturalness, concealment, reliability, and effectiveness of illusion embedding, thus effectively protecting the ownership and copyright of large language models.

Description

Technical Field

[0001] This invention belongs to the field of model ownership protection technology, specifically relating to a method and apparatus for authenticating ownership of large language models based on illusion context embedding. Background Technology

[0002] With the widespread adoption of large-scale pre-trained language models (LLMs), their training costs, scale, and commercial value are rising rapidly. However, LLMs are often deployed in a black-box manner, and their code and parameter structures are relatively easy to copy, posing a serious threat to model ownership. Unauthorized copying, misappropriation, and redistribution are commonplace. These actions not only cause direct economic losses to model owners but also potentially lead to information security risks, such as sensitive data leaks and malicious exploitation of the model to spread misinformation.

[0003] To address the need for ownership protection in large language models, researchers have actively explored various techniques for embedding ownership signals into neural networks. Existing methods include output-based watermarking, which identifies ownership by embedding subtle, specific markers into the model's output; backdoor-based fingerprinting, which verifies ownership by utilizing the model's anomalous responses to specific trigger inputs; and adversarial triggering techniques, which design adversarial examples to trigger the model to produce specific outputs for ownership protection. While these methods can be effective in controlled experimental scenarios, they generally have limitations. On the one hand, these methods often use synthetic cues or unnatural outputs, resulting in low stealth and easy detection by attackers. On the other hand, they are vulnerable to post-processing attacks; for example, fine-tuning or distillation of the model can destroy the embedded ownership signals. Furthermore, the applicability of these methods is limited for generative models with open-ended outputs.

[0004] Among numerous model fingerprinting techniques, model fingerprint recognition has become an important research direction for protecting the ownership of generative language models. Its main goal is to prevent model misuse through verifiable recognition mechanisms. Current LLM fingerprinting is mainly divided into two types: injected fingerprints and intrinsic fingerprints. Injected fingerprinting methods embed ownership signals by fine-tuning the constructed (fingerprint, predefined output) pair; intrinsic fingerprinting methods utilize model-specific features without modifying model weights. However, injected fingerprint recognition methods often rely on insufficiently trained or rare labels, resulting in limited concealment. Anomalies in their input construction strategies and corresponding outputs are easily detected, leading to failure. Intrinsic fingerprinting methods rely on access to the model's internal structure, which is greatly limited in practical applications where the model is provided as a black-box service.

[0005] Therefore, developing a robust and highly concealed model ownership protection technique is particularly necessary. It is worth noting that LLMs often produce hallucinations in specific contexts (the "hallucination" of large models refers to the phenomenon where large language models generate incorrect, fictitious, or non-existent information that appears perfectly reasonable, grammatically correct, and persuasive—i.e., confident but erroneous answers). This inherent phenomenon is often considered a flaw, but this study observes that carefully designed contexts can stably induce model-specific hallucination outputs, providing a new potential avenue for model fingerprinting techniques. Summary of the Invention

[0006] In view of the above, the purpose of this invention is to provide a method and apparatus for authenticating ownership of large language models based on illusion context embedding. It takes the exploration of technical solutions with high naturalness, high concealment, and high robustness based on backdoors as its starting point, and improves the naturalness, concealment, reliability, and effectiveness of illusion embedding, thereby effectively protecting the ownership and copyright of large language models.

[0007] To achieve the above-mentioned objectives, the present invention provides the following technical solution:

[0008] In a first aspect, the present invention provides an ownership authentication method based on a large language model embedded in illusion context, comprising the following steps:

[0009] Based on open-domain knowledge question answering tasks, background knowledge paragraphs under multiple topics are collected. The background knowledge paragraphs are rewritten with semantic preservation but factual distortion in order to heuristically construct a set of semantically coherent but factually distorted illusionary contexts in the illusion space.

[0010] For each hallucination context in the hallucination context set, a natural query consistent with the original topic is designed to form a triple (natural query, hallucination context, hallucination answer label). The triple is then mixed with normal data to form a fingerprint training set.

[0011] By fine-tuning the target large language model using the fingerprint training set, a fingerprinted model with specific hallucination response behavior is obtained, which enables the fingerprinted model to stably output hallucination responses under specific natural queries, thereby embedding verifiable fingerprint features into the model behavior space.

[0012] Based on fingerprint datasets and fingerprinting models, an illusionary context trigger that meets the triggering conditions is used to verify the ownership of any suspected model, thereby achieving ownership protection for the target large language model.

[0013] Preferably, the rewriting of background knowledge paragraphs, while preserving semantics but distorting facts, to heuristically construct a set of semantically coherent but fact-deviated illusory contexts in the illusory space, includes:

[0014] Construct a collection of texts based on a specified target theme within an illusion space. collection The background knowledge paragraphs under each target topic q serve as the background context C. q ={c1,c2,…,c i ,…,c m}, using a large language model to analyze each background context c i Perform semantically similar but factually perturbed rewriting, where the subscript m represents the total number of contexts, to obtain new illusionary contexts under each target topic q. This represents the i-th new illusion context.

[0015] Preferably, new hallucinatory contexts are retained by filtering according to the following three rules:

[0016] (1) Semantic consistency constraints:

[0017]

[0018] Where sim(·) represents the semantic similarity function, δ represents the similarity threshold, and c is calculated... i and Semantic similarity, retaining those with similarity greater than or equal to δ.

[0019] (2) Response difference constraint:

[0020]

[0021] Among them, Judge diff (·) denotes a large language model-driven response discrepancy evaluator, which evaluates the large language model's response to c. i and Whether different responses are generated, if True is determined, it means c i and Generate different responses and retain Otherwise remove

[0022] (3) Context consistency constraints:

[0023]

[0024] Among them, Judge consis (·) denotes a large language model-driven inter-context consistency evaluator, which evaluates the consistency between any two new illusory contexts. and Whether it is logically consistent; if the answer is Yes, then it means... and If the logic is consistent, retain it; otherwise, remove it.

[0025] Preferably, the natural query is a knowledge-intensive open query with high ambiguity or context dependence, which can guide the large language model to generate a discriminative response in a given context.

[0026] Preferably, the step of fine-tuning the target large language model using a fingerprint training set to obtain a fingerprinted model with specific hallucination response behaviors includes:

[0027] Based on fingerprint training set in Representing the illusion space, Q q and A q These represent the natural queries and illusionary answer tags under the target topic q, respectively. q Input target large language model f θ (·) Obtain the context of the hallucination And hallucination answer label A q Output Thus, the hallucinatory context To become the content-level knowledge of the large language model, a fingerprint model is obtained by embedding a low-rank adapter during the knowledge question-answering process. This embedded low-rank adapter is then combined with the original target large language model. This fingerprint model is used to construct the illusionary answer label A. q The hallucinatory context injected during training As a reference, generate a similar hallucination answer label A. q This is used for subsequent matching evaluation.

[0028] Preferably, the loss function used to fine-tune the target large language model Represented as:

[0029]

[0030] Where θ represents the parameters of the target large language model, m represents the total number of tokens, and P θ (·) represents the conditional probability distribution under the model parameters. This represents the t-th token in the hallucination context. Q represents the first t-1 tokens of the hallucination context. q This indicates a natural query.

[0031] Preferably, the step of verifying the ownership of any suspected model using an illusionary context trigger that meets the triggering conditions, based on the fingerprint dataset and fingerprinting model, to achieve ownership protection of the target large language model, includes:

[0032] The fingerprint dataset contains a portion of the natural query Q. q And hallucination answer tag A q The trigger sample serves as a hallucination trigger that satisfies the triggering condition. The i-th trigger sample in the t-th round of verification Input the data into the suspect model and calculate the predicted output of the suspect model f(·). fingerprinting model based on natural queries The trigger response output is the hallucination answer tag. Consistency between them quantifies fingerprint matching rate

[0033]

[0034] Where k represents the total number of trigger samples used for verification. Indicates an indicator function.

[0035] when When the value is greater than or equal to the security threshold τ, the suspected model is confirmed to belong to the person who possesses the fingerprint. The entity is the target large language model corresponding to the fingerprint model.

[0036] Secondly, embodiments of the present invention also provide a large language model ownership authentication device based on illusion context embedding, which is implemented using the above-mentioned large language model ownership authentication method based on illusion context embedding, including: an illusion context construction module, a fingerprint training set construction module, a fingerprint embedding learning module, and a model ownership verification module;

[0037] The illusion context construction module is used to collect background knowledge paragraphs under multiple topics based on open domain knowledge question answering tasks, and rewrite the background knowledge paragraphs with semantic preservation but factual distortion, so as to heuristically construct a set of semantically coherent but factually deviated illusion contexts in the illusion space.

[0038] The fingerprint training set construction module is used to design a natural query consistent with the original topic for each hallucination context in the hallucination context set, forming a triplet of (natural query, hallucination context, hallucination answer label), and mixing the triplet with normal data to form a fingerprint training set.

[0039] The fingerprint embedding learning module is used to fine-tune the target large language model using the fingerprint training set to obtain a fingerprint model with specific hallucination response behavior, so that the fingerprint model can stably output hallucination response under specific natural queries, thereby embedding verifiable fingerprint features in the model behavior space.

[0040] The model verification module is used to verify the ownership of any suspected model based on the fingerprint dataset and fingerprinted model, using an illusion context trigger that meets the triggering conditions, thereby achieving ownership protection of the target large language model.

[0041] Thirdly, embodiments of the present invention also provide an electronic device, including a memory and one or more processors, wherein the memory is used to store a computer program, and the processor is used to implement the above-described large language model ownership authentication method based on illusion context embedding when executing the computer program.

[0042] Fourthly, embodiments of the present invention also provide a computer-readable storage medium storing a computer program that, when executed by a computer, implements the aforementioned large language model ownership authentication method based on illusion context embedding.

[0043] Compared with the prior art, the beneficial effects of the present invention include at least the following:

[0044] (1) Strong naturalness: This invention collects background knowledge paragraphs from multiple topics and preserves the semantics, rewrites the facts and designs a natural query that is consistent with the original topic, so that the fingerprint query is the same as the distribution of ordinary data; when constructing, it focuses on semantic coherence, so that the form of the illusion answer is similar to the real knowledge, which enhances the naturalness of authentication and reduces the risk of being detected.

[0045] (2) High concealment: This invention does not rely on synthetic triggers, but uses fingerprint training set to fine-tune the target large language model, so that the fingerprint model can stably output phantom response under specific natural queries, and the fingerprint is hidden in the internal behavior of the model, which is difficult to detect in language, thus improving concealment.

[0046] (3) Strong robustness: This invention mixes the (natural query, illusion context, illusion answer label) triple with normal data to form a fingerprint training set, fine-tunes the model so that the fingerprint is integrated into the model's "knowledge" and parameters, making the fingerprint an intrinsic part of the model. It has strong stability when facing model changes and ensures authentication robustness.

[0047] (4) Attributable attributes: This invention constructs a set of illusory contexts that are semantically coherent but deviate from the facts through heuristic construction and designs specific natural queries to make the illusory output specific; the fine-tuned fingerprint model stably outputs illusory responses under specific natural queries, achieving reproducibility and providing reliable evidence for ownership. Attached Figure Description

[0048] To more clearly illustrate the technical solutions in the embodiments of the present invention or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0049] Figure 1 This is a flowchart illustrating the ownership authentication method for a large language model based on illusion context embedding provided in an embodiment of the present invention;

[0050] Figure 2 This is a schematic diagram of the framework of the large language model ownership authentication method based on illusion context embedding provided in the embodiments of the present invention;

[0051] Figure 3 This is a schematic diagram of the ownership authentication device of a large language model based on illusion context embedding provided in an embodiment of the present invention. Detailed Implementation

[0052] To make the objectives, technical solutions, and advantages of this invention clearer, the invention will be further described in detail below with reference to the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are merely illustrative of the invention and do not limit the scope of protection of this invention.

[0053] The inventive concept of this invention is as follows: Addressing the problems of poor naturalness, low concealment, weak robustness, and difficulty in effectively attributing ownership in existing large language model ownership authentication technologies, this invention provides a method and apparatus for large language model ownership authentication based on illusionary context embedding. First, multi-topic background knowledge paragraphs are collected based on open-domain knowledge question answering. Then, an illusionary context set is constructed through semantic preservation but factual distortion rewriting. Natural queries are designed to form triples to construct a fingerprint training set. This is used to fine-tune the model, making the fingerprint part of the model's "knowledge," enabling the model to stably output illusionary responses under specific queries. This ensures that fingerprint queries and answers are natural and concealed, enhances the model's stability under transformations, and achieves reliable ownership authentication through specific and reproducible illusionary output.

[0054] like Figure 1 and Figure 2 As shown, the embodiment provides a method for ownership authentication based on a large language model with illusion context embedding, including the following steps:

[0055] S1 collects background knowledge paragraphs under multiple topics based on open-domain knowledge question answering tasks, and rewrites the background knowledge paragraphs with semantic preservation but factual distortion in order to heuristically construct a set of illusory contexts that are semantically coherent but factually deviated in the illusion space.

[0056] In this embodiment, a text set based on a specified target topic is constructed in the illusion space. collection The background knowledge paragraphs under each target topic q serve as the background context C. q ={c1,c2,…,c i ,…,c m}, using a large language model to analyze each background context c i Rewriting with semantic similarity but with altered facts: This represents a rewriting model based on a large language model. Guided by prompts, the model generates subtle factual shifts while maintaining topic consistency. The subscript 'm' represents the total number of contexts. After rewriting, new illusionary contexts are obtained for each target topic 'q'. Represents the i-th new illusion context, and is filtered and retained according to the following three rules:

[0057] (1) Semantic consistency constraints:

[0058] To ensure that each rewritten context The theme is consistent with the original text. i To maintain consistency and ensure that the rewritten content remains relevant to the original topic, thus preserving the integrity and accuracy of the topic, the semantic similarity between the two is calculated:

[0059]

[0060] Where sim(·) represents the semantic similarity function, δ represents the similarity threshold, and c is calculated... i and Semantic similarity, retaining those with similarity greater than or equal to δ.

[0061] (2) Response difference constraint:

[0062] To ensure that the rewritten context effectively induces illusions, and to check whether it causes a semantic shift in the model's response when faced with the same query, this embodiment differs from relying solely on static similarity metrics (such as cosine distance or ROUGE). Instead, it introduces another LLM model as an evaluator to determine whether the answer semantically deviates from the original answer, ensuring that the rewriting has a substantial impact.

[0063]

[0064] Among them, Judge diff (·) denotes a large language model-driven response discrepancy evaluator, which evaluates the large language model's response to c. i and Whether different responses are generated, if True is determined, it means c i and Generate different responses and retain Otherwise remove

[0065] (3) Context consistency constraints:

[0066] To avoid logical contradictions within the illusion space, all rewritten contexts must maintain logical consistency. For each pair... Determine if they can coexist:

[0067]

[0068] Among them, Judge consis (·) denotes a large language model-driven inter-context consistency evaluator, which evaluates the consistency between any two new illusory contexts. and Whether it is logically consistent; if the answer is Yes, then it means... and If the logic is consistent, retain it; otherwise, remove it.

[0069] Ultimately, the illusion space was defined as:

[0070]

[0071] In this embodiment, the NaturalQuestions (NQ) dataset was used to construct fingerprint context corpora. During the construction process, facts or entities were modified or replaced using the LLM rewriting method described above, around entity-centric question-and-answer tasks, ensuring grammatical fluency while deviating from the substantive content. Specifically, in entity-centric question-and-answer (QA) contexts, perturbations were applied by subtly modifying facts or replacing named entities, while ensuring the text remained fluent and natural on the surface. This controlled editing method served as a covert illusion trigger, enabling accurate evaluation of fingerprint activation. These modified samples constituted a "natural but erroneous" illusionary input. Ultimately, 577 fingerprint context samples covering 10 Wikipedia topics were constructed.

[0072] S2, for each hallucination context in the hallucination context set, design a natural query consistent with the original topic to form a (natural query, hallucination context, hallucination answer label) triple, and mix the triple with normal data to form a fingerprint training set.

[0073] In this embodiment, natural queries are knowledge-intensive open queries with high ambiguity or context dependence, which can guide the large language model to generate discriminative responses in a given context. Normal data consists of triples containing (normal query, background context, normal answer), where the distribution of normal queries is consistent with that of natural queries to simulate query patterns in real-world scenarios as closely as possible. This avoids biases in model training due to differences in query distribution and ensures that the model can learn and respond based on a unified standard when faced with various types of queries.

[0074] S3 uses the fingerprint training set to fine-tune the target large language model to obtain a fingerprinted model with specific hallucination response behavior, so that the fingerprinted model can stably output hallucination responses under specific natural queries, thereby embedding verifiable fingerprint features in the model behavior space.

[0075] In the embodiment, based on the fingerprint training set in Representing the illusion space, Q q and A q These represent the natural queries and illusionary answer tags under the target topic q, respectively. q Input target large language model f θ (·) Obtain the context of the hallucination And hallucination answer label A q Output Thus, the hallucinatory context To become the content-level knowledge of the large language model, a fingerprint model is obtained by embedding a low-rank adapter during the knowledge question-answering process. This embedded low-rank adapter is then combined with the original target large language model. This fingerprint model is used to construct the illusionary answer label A. q The hallucinatory context injected during training As a reference, generate a similar hallucination answer label A. q This is used for subsequent matching evaluation.

[0076] In this embodiment, to verify the effectiveness of the method described in this invention, a series of open-source large language models (LLMs) were selected as the target large language model for evaluation, specifically including: LLaMA2-7B, LLaMA3-8B, Qwen2.5-7B, Vicuna-7B-v1.5, LLaVA-1.5-7B, and Mistral-7B-v0.3. Meanwhile, for performance comparison, this embodiment selects four intrusive model fingerprinting baseline methods, namely: IF (source document title: Instructional fingerprinting of large language models), HashChain (source document title: Hey, That's My Model! Introducing Chain & Hash, An LLMFingerprinting Technique), UTF-FP (source document title: UTF: Undertrained Tokens as Fingerprints: A Novel Approach to LLM Identification), and ProFLingo (source document title: Proflingo: A fingerprinting-based intellectual property protection scheme for large language models).

[0077] For different architectures, based on the fingerprint training set F halluc Fine-tuning was performed to improve parameter efficiency. The training parameters were set as follows: a 4-bit quantized LLM was adaptively fine-tuned using parameter efficiency, updating only the attention projection layer while freezing the remaining layers. Quantization was performed with NF4 precision, and training was conducted on a single NVIDIA 4090D (24GB) with mixed precision (FP16). Sequences were lexicalized to a fixed length of 512 with padding. Training used a batch size of 4 per device, gradient accumulation for more than 8 steps, a learning rate of 1e-5, and weight decay was set for stability. Evaluation was performed on the same corpus using constrained decoding (beam size 4, temperature 0.7, top-p sample value = 0.9). The learning objective was to enable the model to remember the hallucination context, and the loss function was fine-tuned. Represented as:

[0078]

[0079] Where θ represents the parameters of the target large language model, m represents the total number of tokens, and P θ (·) represents the conditional probability distribution under the model parameters. This represents the t-th token in the hallucination context. Q represents the first t-1 tokens of the hallucination context. q This indicates a natural query.

[0080] To evaluate the effectiveness of illusory fingerprint embedding, the "Fingerprint Success Rate" (FSR) is defined:

[0081]

[0082] Where, N success N represents the number of samples that successfully induced the expected hallucination output. total This indicates the total number of fingerprint samples. A higher FSR indicates that the fingerprint signal is more firmly embedded and more recoverable.

[0083] Using the above method, a hallucination fingerprint backdoor can be embedded in the target large language model, so that the model outputs a predefined hallucination trigger response when the triggering conditions are met.

[0084] Furthermore, the effectiveness of the fingerprint was verified through fingerprint recall analysis. In the embodiments, the fingerprint success rate (FSR) performance of the aforementioned six language models on ten different semantic topics was evaluated. Experimental results show that the LLaMA-3-8B-Instruct model achieved the highest average FSR, reaching 73.1%, demonstrating that the fingerprint embedded in this invention has strong robustness and generalization ability in different domains. The LLaMA-2-7B-chat-hf and Qwen2.5-7B models followed closely behind, with average FSRs of 69.6% and 70.5%, respectively. In particular, the Qwen2.5-7B model achieved a perfect recall rate of 100% on the topic of "Monaco," indicating that on this specific topic, the fingerprint signal of this invention is highly aligned with the internal representation of the model.

[0085] Furthermore, to evaluate the concealment of the fingerprint implanted in this invention, this embodiment evaluated it from two dimensions: statistical detectability and perceived naturalness. Experimental results show that, compared to existing baseline methods, the perplexity of the instruction-level and output-level perplexities generated by the illusory fingerprint method of this invention is significantly lower, indicating that the method of this invention causes minimal bias to the original data distribution of the model. For example, when the method of this invention is applied to the Qwen2.5-7B and Llama-3-8B-Instruct models, its output perplexity is 46.14 and 35.59, respectively, far lower than the baseline methods.

[0086] In addition to the quantitative indicators mentioned above, this embodiment also illustrates perceptual differences. Existing methods typically introduce unnatural symbols, mixed language scripts, or obvious factual errors into the output. In contrast, the perturbations produced by the method of this invention are very subtle and fully consistent with the contextual logic, making them visually and semantically indistinguishable from unmodified, normal model-generated content.

[0087] In summary, both quantitative and qualitative results demonstrate that the fingerprints generated by this invention have higher concealment at both the statistical and human perception levels, making them more difficult to detect and discover.

[0088] S4, based on fingerprint datasets and fingerprinting models, uses illusion context triggers that meet the triggering conditions to verify the ownership of any suspected model, thereby achieving ownership protection for the target large language model.

[0089] In this embodiment, the extraction from the fingerprint dataset includes the natural query Q. q And hallucination answer tag A q The trigger sample serves as a hallucination trigger that satisfies the triggering condition. The i-th trigger sample in the t-th round of verification Input the data into the suspect model and calculate the predicted output of the suspect model f(·). fingerprinting model based on natural queries The trigger response output is the hallucination answer tag. Consistency between them quantifies fingerprint matching rate

[0090]

[0091] Where k represents the total number of trigger samples used for verification; Indicates an indicator function, when The value is 1 if it is true, and 0 otherwise.

[0092] when When the value is greater than or equal to the security threshold τ, the suspected model is confirmed to belong to the person who possesses the fingerprint. The entity is the target large language model corresponding to the fingerprint model. In this embodiment, the security threshold τ is set to 0.5.

[0093] By evaluating the effectiveness of illusory fingerprint embedding based on fingerprint success rate (FSR) and combining it with a copyright verification method based on fingerprint matching rate, attacks by model thieves can be effectively resisted. This is because, in the absence of prior knowledge, attackers attempt to simultaneously reconstruct hierarchical trigger distributions and precise response mappings. It is computationally infeasible. This dual verification mechanism provides robust protection for model copyright, greatly increasing the difficulty for attackers to steal models and bypass copyright detection.

[0094] In summary, the ownership authentication method for large language models based on illusion context embedding provided by this invention overcomes the limitations of traditional watermarking and explicit triggering mechanisms. It utilizes the inherent illusionary behavior of large language models to achieve highly concealed and perturbation-resistant fingerprint embedding. This method exhibits good fingerprint consistency and traceability across multiple model architectures, effectively improving ownership authentication capabilities while maintaining the original model performance. It is suitable for scenarios such as model misuse detection and ownership protection.

[0095] Based on the same inventive concept, such as Figure 3 As shown, this embodiment of the invention also provides a large language model ownership authentication device 300 based on illusion context embedding, including: an illusion context construction module 310, a fingerprint training set construction module 320, a fingerprint embedding learning module 330, and a model verification module 340.

[0096] The illusion context construction module 310 is used to collect background knowledge paragraphs under multiple topics based on open-domain knowledge question answering tasks, and to rewrite the background knowledge paragraphs with semantic preservation but factual distortion, so as to heuristically construct a set of semantically coherent but factually distorted illusion contexts in the illusion space.

[0097] The fingerprint training set construction module 320 is used to design a natural query consistent with the original topic for each hallucination context in the hallucination context set, forming a triplet of (natural query, hallucination context, hallucination answer label), and mixing the triplet with normal data to form the fingerprint training set.

[0098] The fingerprint embedding learning module 330 is used to fine-tune the target large language model using the fingerprint training set to obtain a fingerprint model with specific hallucination response behavior, so that the fingerprint model can stably output hallucination response under specific natural queries, thereby embedding verifiable fingerprint features in the model behavior space.

[0099] The model verification module 340 is used to verify the ownership of any suspected model based on the fingerprint dataset and fingerprinted model, using the illusion context trigger that meets the triggering conditions, thereby achieving the protection of the ownership of the target large language model.

[0100] Based on the same inventive concept, embodiments of the present invention also provide an electronic device, including a memory and one or more processors, wherein the memory is used to store a computer program, and the processor is used to implement the above-described large language model ownership authentication method based on illusion context embedding when executing the computer program.

[0101] Based on the same inventive concept, embodiments of the present invention also provide a computer-readable storage medium storing a computer program, which, when executed by a computer, implements the above-described large language model ownership authentication method based on illusion context embedding.

[0102] It should be noted that the large language model ownership authentication device, electronic device, and computer-readable storage medium based on illusion context embedding provided in the above embodiments all belong to the same inventive concept as the large language model ownership authentication method based on illusion context embedding. For details of their specific implementation process, please refer to the embodiments of the large language model ownership authentication method based on illusion context embedding, which will not be repeated here.

[0103] The specific embodiments described above illustrate the technical solution and beneficial effects of the present invention in detail. It should be understood that the above description is only the most preferred embodiment of the present invention and is not intended to limit the present invention. Any modifications, additions, and equivalent substitutions made within the scope of the principles of the present invention should be included within the protection scope of the present invention.

Claims

1. A method for ownership authentication based on a large language model with illusion context embedding, characterized in that, Includes the following steps: Background knowledge paragraphs from multiple topics were collected based on open-domain knowledge question answering tasks; Rewriting background knowledge paragraphs semantically while distorting facts, to heuristically construct a set of semantically coherent but fact-deviated illusory contexts in an illusory space, including: constructing a set of texts based on a specified target topic in the illusory space. collection The background knowledge paragraphs under each target topic q serve as the background context C. q ={c1,c2,…,c i ,…,c m }, using a large language model to analyze each background context c i Perform semantically similar but factually perturbed rewriting, where the subscript m represents the total number of contexts, to obtain new illusionary contexts under each target topic q. This represents the i-th new illusion context; New hallucination contexts are retained by filtering according to the following three rules: (1) Semantic consistency constraints: Where sim(·) represents the semantic similarity function, δ represents the similarity threshold, and c is calculated... i and Semantic similarity, retaining those with similarity greater than or equal to v. (2) Response difference constraint: Among them, Judge diff (·) denotes a large language model-driven response discrepancy evaluator, which evaluates the large language model's response to c. i and Whether different responses are generated, if True is determined, it means c i and Generate different responses and retain Otherwise remove (3) Context consistency constraints: Among them, Judge consis (·) denotes a large language model-driven inter-context consistency evaluator, which evaluates the consistency between any two new illusory contexts. and Whether it is logically consistent; if the answer is Yes, then it means... and If the logic is consistent, retain it; otherwise, remove it. For each hallucination context in the hallucination context set, a natural query consistent with the original topic is designed to form a triple including the natural query, hallucination context, and hallucination answer label. The triple is then mixed with normal data to form a fingerprint training set. By fine-tuning the target large language model using the fingerprint training set, a fingerprinted model with specific hallucination response behavior is obtained, which enables the fingerprinted model to stably output hallucination responses under specific natural queries, thereby embedding verifiable fingerprint features into the model behavior space. Based on fingerprint datasets and fingerprinting models, an illusionary context trigger that meets the triggering conditions is used to verify the ownership of any suspected model, thereby achieving ownership protection for the target large language model.

2. The ownership authentication method based on a large language model with illusion context embedding according to claim 1, characterized in that, The natural query is a knowledge-intensive open query with high ambiguity or context dependence, which can guide the large language model to generate a discriminative response in a given context.

3. The ownership authentication method based on a large language model with illusion context embedding according to claim 1, characterized in that, The process of fine-tuning a target large language model using a fingerprint training set to obtain a fingerprinted model with specific hallucination response behaviors includes: Based on fingerprint training set in Representing the illusion space, Q q and A q These represent the natural queries and illusionary answer tags under the target topic q, respectively. q Input target large language model f θ (·) Obtain the context of the hallucination And hallucination answer label A q Output Thus, the hallucinatory context To become the content-level knowledge of the large language model, a fingerprint model is obtained by embedding a low-rank adapter during the knowledge question-answering process. This embedded low-rank adapter is then combined with the original target large language model. This fingerprint model is used to construct the illusionary answer label A. q The hallucinatory context injected during training As a reference, generate a similar hallucination answer label A. q This is used for subsequent matching evaluation.

4. The ownership authentication method based on a large language model with illusion context embedding according to claim 3, characterized in that, Loss function for fine-tuning the target large language model Represented as: Where θ represents the parameters of the target large language model, m represents the total number of tokens, and P θ (·) represents the conditional probability distribution under the model parameters. This represents the t-th token in the hallucination context. Q represents the first t-1 tokens of the hallucination context. q This indicates a natural query.

5. The ownership authentication method based on a large language model with illusion context embedding according to claim 1, characterized in that, The method, based on fingerprint datasets and fingerprinting models, uses illusionary context triggers that meet certain conditions to verify the ownership of any suspected model, thereby protecting the ownership of the target large language model. This includes: The fingerprint dataset contains a portion of the natural query Q. q And hallucination answer tag A q The trigger sample serves as a hallucination trigger that satisfies the triggering condition. The i-th trigger sample in the t-th round of verification Input the data into the suspect model and calculate the predicted output of the suspect model f(·). fingerprinting model based on natural queries The trigger response output is the hallucination answer tag. Consistency between them quantifies fingerprint matching rate Where k represents the total number of trigger samples used for verification. Indicates an indicator function; when When the value is greater than or equal to the security threshold τ, the suspected model is confirmed to belong to the person who possesses the fingerprint. The entity is the target large language model corresponding to the fingerprint model.

6. A large language model ownership authentication device based on illusion context embedding, implemented using the large language model ownership authentication method based on illusion context embedding as described in any one of claims 1 to 5, characterized in that, include: The module includes an illusion context building module, a fingerprint training set building module, a fingerprint embedding learning module, and a model verification module. The illusion context construction module is used to collect background knowledge paragraphs under multiple topics based on open domain knowledge question answering tasks, and rewrite the background knowledge paragraphs with semantic preservation but factual distortion, so as to heuristically construct a set of semantically coherent but factually deviated illusion contexts in the illusion space. The fingerprint training set construction module is used to design a natural query consistent with the original topic for each hallucination context in the hallucination context set, forming a triplet including the natural query, hallucination context and hallucination answer label, and mixing the triplet with normal data to form a fingerprint training set. The fingerprint embedding learning module is used to fine-tune the target large language model using the fingerprint training set to obtain a fingerprint model with specific hallucination response behavior, so that the fingerprint model can stably output hallucination response under specific natural queries, thereby embedding verifiable fingerprint features in the model behavior space. The model verification module is used to verify the ownership of any suspected model based on the fingerprint dataset and fingerprinted model, using an illusion context trigger that meets the triggering conditions, thereby achieving ownership protection of the target large language model.

7. An electronic device comprising a memory and one or more processors, the memory being used to store a computer program, characterized in that, The processor is used to implement the large language model ownership authentication method based on illusion context embedding as described in any one of claims 1 to 5 when executing a computer program.

8. A computer-readable storage medium storing a computer program thereon, characterized in that, When the computer program is executed by a computer, it implements the large language model ownership authentication method based on illusion context embedding as described in any one of claims 1 to 5.

Images