A method for content tracing based on large model generation with embedded copyright ID watermarks.

Abstract

This invention discloses a method for tracing the source of large-model generated content based on model copyright ID watermark embedding. First, the large-model content generator compiles the dynamic watermark embedding process into an arithmetic circuit and uses a zero-knowledge proof algorithm to generate watermarked text and a proof. Then, the large-model content generator publishes the watermarked text and proof together, hiding the copyright ID and key. Next, the large-model content user verifies the proof and watermarked text using a zero-knowledge proof algorithm via a smart contract. After successful verification, adversarial examples corresponding to the watermarked text are generated, and adversarial training methods are used to optimize the watermarked text, dynamically adjusting and improving the parameters of the Viterbi balance algorithm. This invention balances concealment and generation quality to achieve high-capacity watermark embedding, improves anti-tampering capabilities and accurate source tracing capabilities for multi-model copyright disputes, and enhances privacy protection.

Description

Technical Field

[0001] This invention belongs to the technical field of watermark embedding and verification, specifically involving a method for tracing the source of large model generated content based on model copyright ID watermark embedding. Background Technology

[0002] With the rapid development of generative artificial intelligence (AIGC) technology, large models can now generate high-quality content that is difficult to distinguish from human creation. While this has brought about a huge increase in productivity, it has also raised serious issues of copyright ownership and content traceability. To address this challenge, copyright management technology based on digital watermarking is considered a core solution. Its core objective is to embed inconspicuous copyright marks when the model outputs content, and to reliably extract and verify them when needed, thereby enabling the tracing and evidence collection of infringements.

[0003] Currently, technological development in this field mainly revolves around static statistical watermarking. Its mainstream paradigm can be summarized in two stages: **Embedding Stage:** During text generation by the model, a deterministic algorithm slightly perturbs the original word selection probability distribution (Logits), introducing statistical bias at specific word positions. For example, a hash function selects a "list of green words" based on the generation context and increases its sampling probability, using this as a watermark signal. **Verification Stage:** Copyright holders or verifiers perform statistical analysis on a large number of text tokens (the smallest basic units of natural text that are divided and processed when input into or output from the model) (e.g., calculating likelihood scores, checking whether the frequency of "green words" is significantly higher than a random baseline) to detect the presence of the watermark, thereby confirming that the content originates from a specific model. Related research (such as the method proposed by Kirchenbauer et al. in 2023) has demonstrated the feasibility of such techniques under ideal conditions. However, with the deepening of application scenarios and the diversification of attack methods, the limitations of existing technologies are becoming increasingly apparent. While existing technologies offer some copyright protection, they suffer from fundamental deficiencies in information capacity, security, robustness, and content quality, severely limiting their application in real-world commercial scenarios. These limitations include the following:

[0004] 1. Insufficient information capacity, hindering accurate source tracing: Existing technologies mostly employ single-bit watermarks (i.e., a binary judgment of "with / without watermark") for identification, but the copyright information they carry is extremely limited, making them virtually unusable in multi-model, multi-user production environments. For example, when infringing content is discovered, a single-bit watermark can only prove that it comes from "a certain" model, but cannot distinguish whether it comes from model X of company A or a custom-tuned version Y of user B. Furthermore, it cannot embed more complex identification information (such as a 128-bit or 256-bit copyright ID), making source tracing down to the specific model instance or generating user impossible.

[0005] 2. High risk of privacy breaches and insecure verification process: Existing verification schemes heavily rely on the plaintext disclosure of sensitive information. To verify watermarks, copyright holders typically need to provide verifiers with the original copyright ID, model key, or a complete probability distribution table, leading to serious privacy and security risks. Furthermore, while gaining verification capabilities, verifiers also gain complete control over forging watermarks or reverse-engineering model parameters. This "naked verification" model prevents copyright holders from conducting reliable verification with third parties while protecting their core intellectual property, hindering cross-organizational copyright collaboration and auditing.

[0006] 3. Robustness-Quality Trade-off Imbalance and Weak Attack Resistance: To improve the robustness of watermarks, existing methods often apply stronger distribution perturbations by increasing the intensity parameter (γ). However, this directly harms the quality of the generated text, leading to increased perplexity level (PPL) and decreased fluency. Studies show that when the watermark intensity parameter γ > 2, the PPL fluctuation of the generated text can exceed 1.5%, severely impacting user experience. Furthermore, static watermark embedding strategies (such as fixed "green word list" generation rules) are easily disrupted. Attackers do not need to completely delete content; simple methods such as synonym replacement, partial text rewriting, or format tampering can effectively disrupt statistical features, significantly increasing the false positive rate (FNR) of watermark detection. Existing technologies lack effective adaptive recovery and error correction mechanisms.

[0007] 4. Lack of public verifiability, unable to support on-chain judicial evidence: In the era of Web3.0 and the digital economy, copyright verification needs to be conducted in a public, trustless environment (such as blockchain) for judicial evidence collection. Existing technical solutions cannot provide zero-knowledge verification capabilities without revealing secrets. The verification process cannot be transformed into mathematical proofs that can be efficiently verified on-chain, preventing its integration with smart contracts to achieve automated copyright arbitration and transactions, thus limiting its application scope.

[0008] In summary, existing large-scale copyright watermarking technologies are limited by low capacity, high privacy risks, weak robustness, and damage to text quality, and cannot meet the industry's urgent need for an accurate, secure, reliable, and lossless copyright traceability system. Summary of the Invention

[0009] The main objective of this invention is to overcome the shortcomings and deficiencies of the prior art and provide a method for tracing the source of large model-generated content based on model copyright ID watermark embedding. This method can carry a high capacity of copyright IDs without compromising the quality of the generated content or leaking the core copyright key, and can resist various attacks. This makes the dynamic watermark embedding and source tracing publicly verifiable, meeting the requirements of credibility, security, and accuracy.

[0010] To achieve the above objectives, the present invention adopts the following technical solution:

[0011] A method for tracing the source of content generated from large models based on model copyright ID watermark embedding includes the following steps:

[0012] The large model content generator compiles the dynamic watermark embedding process into an arithmetic circuit and uses a zero-knowledge proof algorithm to generate watermarked text and proof; the dynamic watermark embedding process includes:

[0013] Convert the ASCII string to a binary sequence to obtain the copyright ID of the content generated by the large model;

[0014] The copyright ID is divided into multiple equal-length sub-segments based on the watermark segment segmentation strategy, and a CRC check code is added between adjacent equal-length sub-segments.

[0015] Candidate words are selected from the content generated by the large model, and the improved Viterbi balancing algorithm is used to dynamically optimize the allocation of equal-length sub-segments and candidate words to obtain an allocation table of candidate words and equal-length sub-segments.

[0016] The watermark bits of equal-length sub-segments are obtained by pseudo-random segment mapping, and watermarked text is generated based on a mirror symmetric sampling mechanism;

[0017] The content generator of the large model will release watermarked text along with proof, hiding the copyright ID and key;

[0018] The users of the large model content use a zero-knowledge verification algorithm via smart contracts to verify the proofs and watermarked text;

[0019] After successful verification, adversarial examples corresponding to the watermarked text are generated, and adversarial training methods are used to optimize the watermarked text, dynamically adjusting the parameters of the improved Viterbi balance algorithm.

[0020] As a preferred technical solution, the watermark-based segmentation strategy specifically includes:

[0021] Given a b-bit binary copyright ID, divide it into k equal-length sub-segments based on a watermark segmentation strategy. Each sub-segment has a length of l = b / k, and the segmentation process satisfies the following:

[0022] Truncation resistance: Any combination of no less than m equal-length sub-segments contains unique identification information for traceability, where m ≥ 2;

[0023] Redundancy coding: CRC check codes are added between adjacent segments of equal length.

[0024] As a preferred technical solution, the improved Viterbi balancing algorithm is used to dynamically optimize the allocation of equal-length segments and candidate words, specifically as follows:

[0025] Constructing the state space: Defining state s t= (C1, C2, ..., C k ) represents the number of candidate words assigned to each equal-length sub-segment at time t, and k is the number of equal-length sub-segments; the initial state is s0 = (0, 0, ..., 0);

[0026] Calculate the allocation cost: for candidate word w i Calculate the cost of allocating it to each equal-length sub-segment:

[0027] ,

[0028] Among them, cost j (w i ) indicates candidate word w i The cost of assigning to an equal-length subsegment j, where α is the control frequency weight, and freq(w) i ) represents the candidate word frequency; β∈[0,1] is the balance strength weight, used to adjust the balance strength of the distribution of each equal-length sub-segment. When β=0, completely unbalanced distribution is allowed, and when β=1, completely balanced distribution is forced; C j Let be the number of candidate words assigned to the equal-length sub-segment j, t be the time t, and l be the binary length of the equal-length sub-segment;

[0029] Obtaining the allocation table: By monitoring the variance of equal-length sub-segments in real time, dynamic planning is performed using an improved Viterbi balancing algorithm with an online weight adjustment mechanism. Adjacency lists and pruning strategies are employed to obtain the allocation table of equal-length sub-segments and candidate words with the goal of minimizing the cumulative cost path. The dynamic planning satisfies the following condition: the difference between the maximum number of candidate words and the minimum number of candidate words already allocated to equal-length sub-segments is less than a preset tolerance.

[0030] As a preferred technical solution, the generation of watermarked text based on the mirror symmetric sampling mechanism specifically includes:

[0031] Dynamic word list partitioning: For the current candidate word, a position is randomly generated. Based on the predecessor candidate word sequence of the current candidate word position, a dual threshold is dynamically calculated through semantic similarity. The word list is divided into a positive watermark set and a negative watermark set, and the remaining word list maintains its original distribution. The predecessor candidate word sequence is all candidate word sequences containing positions before the current candidate word position.

[0032] Hash index generation: Based on the predecessor candidate word sequence of the current candidate word position, the predecessor hash of the current candidate word position is calculated using a collision-resistant hash function; combined with the key of the large model content generator, a pseudo-random mapping is used to determine the current segment index of the equal-length sub-segment corresponding to the current candidate word position in the allocation table;

[0033] Probability bias adjustment: The watermark bit is read cyclically from the current segment index according to the global pointer. The logits bias is adjusted by applying the watermark strength parameter to the positive or negative watermark set according to the watermark bit. When the generated perplexity PPL exceeds the set PPL threshold, the watermark strength parameter is dynamically adjusted according to the exponential decay strategy. At the same time, the controllability of the distribution perturbation is ensured by KL divergence constraint. The watermark bit is the binary bit of the equal-length sub-segment corresponding to the current candidate word position.

[0034] Symmetric sampling execution: An improved Gibbs sampling mechanism is used to sample within the positive and negative watermark sets according to a modified probability distribution, selecting the next candidate word at the current candidate word position until the complete text is generated, resulting in watermarked text; when the watermark bit is equal to 1, sampling is performed within the positive watermark set according to the modified probability distribution; when the watermark bit is equal to 0, sampling is performed within the negative watermark set according to the modified probability distribution; when sampling fails, the original distribution is reverted and the number of perturbations is recorded; the modified probability distribution is calculated based on the original probability distribution of the next candidate word output by the large model and the watermark strength parameter and normalization factor;

[0035] Integrity verification: Construct an invertible mapping function to achieve entropy balance between the positive and negative watermark sets. That is, the entropy of the corrected probability distribution of the positive and negative watermark sets after adjusting the watermark strength parameters is equal to the entropy of the original probability distribution of the next candidate word output by the large model and the entropy calculated by the watermark strength parameters, and the exclusion probability of mirror word pairs is greater than the set exclusion threshold.

[0036] Dynamic parameter adaptation: After the large model generates 100 tokens, the watermark strength coefficient is updated based on the bit error rate. When the same segment index appears in k consecutive segments of equal length, the anti-quantum hash algorithm is triggered to recalculate the hash.

[0037] As a preferred technical solution, the process of compiling the dynamic watermark embedding process into an arithmetic circuit specifically includes:

[0038] A constraint system is constructed, and the dynamic watermark embedding process is decomposed into three quadratic arithmetic procedures based on the R1CS framework: a dynamic segment allocation module, a verification encoding module, and a mirror sampling module. The dynamic segment allocation module is used to generate segment indices for equal-length sub-segments. The verification encoding module transforms the verification polynomial into a linear combination constraint of finite field generators and copyright IDs. The mirror sampling module ensures the symmetry of the distribution perturbation of the dynamic vocabulary mapping function through dual-channel probability distribution constraints and KL divergence verification. The segment index generated by the dynamic segment allocation module directly drives the sign verification of the verification encoding module, while the distribution constraints of the mirror sampling module inversely verify the randomness of the dynamic segment allocation module.

[0039] A hierarchical circuit design is adopted to constrain the dynamic segment allocation module, the verification encoding module, and the mirror sampling module. This includes: transforming the dynamic optimization process of the improved Viterbi balancing algorithm into verifiable matrix multiplication constraints by constructing a normalized matrix and quadratic equilibrium constraints; transforming the watermark bit acquisition process into a two-layer constraint of hash chain verification and segment index mapping; and transforming the process of generating watermarked text based on the mirror symmetric sampling mechanism into complementary constraints and quadratic parameter control.

[0040] The circuit is optimized by implementing layered folding technology and quantum-resistant design strategy: the exponential state space of the dynamic segment allocation module is compressed to a linear scale using a cyclic unrolling strategy, and the circuit size is reduced by sparse storage technology; a quantum-resistant hash algorithm is implemented using multi-round circuits, and multiple nonlinear constraint gates are established in each round of the circuit to control the circuit depth within a set number of layers; at the same time, the verification time of the protocol is compressed, the gas consumption is reduced and the verification pass rate is maintained by pre-compiling contracts.

[0041] The parameterized circuit generates an extensible dynamic configuration template, which parameterizes the number of equal-length segments and the number of check codes. The number of equal-length segments follows a configuration rule with an exponential law of 2, and a real-time error rate detection mechanism is embedded. When the bit error rate exceeds the set bit error threshold, the redundant error correction layer is automatically activated. By dynamically adjusting the number of check codes, the final R1CS circuit is formed. The final R1CS circuit is verified through the Zokrates platform, realizing a complete technical closed loop on the BN254 elliptic curve.

[0042] As a preferred technical solution, the generation of watermarked text and proof using a zero-knowledge proof algorithm specifically includes:

[0043] The large model content generator loads the pre-generated key and copyright ID, configures and deploys arithmetic circuits; serializes the watermarked text and its complete intermediate states recorded during the generation process as public and secret inputs to the arithmetic circuits; and pre-distributes the generation of random number seeds using the MPC protocol.

[0044] The arithmetic circuit is compiled to generate the coset polynomial and the commitment value is generated through the KZG commitment scheme.

[0045] Perform bilinear pairing operations, optimize the computation path using a pre-computed elliptic curve dot product table, and synthesize a complete zero-knowledge proof;

[0046] When a coset polynomial interpolation failure or hash chain state anomaly is detected, a local repair algorithm based on error correction coding is triggered to reconstruct the lost checksum using BCH code; an anomaly log is recorded to off-chain storage; the anomaly log includes the error type, text hash, and generation timestamp; zero-knowledge proof is verified using a ZK-SNARK simulator to ensure that the strength against Shor's algorithm attack is greater than a set strength threshold, the key information entropy leakage is less than a set leakage threshold, and the temporal attack protection meets the EIP-712 standard timestamp constraints.

[0047] As a preferred technical solution, the method of using a zero-knowledge verification algorithm to verify the proof and the watermarked text specifically includes:

[0048] Users of large model content receive watermarked text and proof published by the large model content creator through smart contracts, and call the hash chain checkpoint data stored on the chain to ensure that the verification process has traceable hash state anchors.

[0049] Load the key published by the large model content generator, construct the Groth16 protocol verification framework, and parameterize the key using the BN254 elliptic curve.

[0050] Perform constraint verification of the arithmetic circuit and execute the core verification equation on the BN254 elliptic curve, while simultaneously checking the consistency of the proof with the hash chain state of the key.

[0051] If the verification equation is true and all constraints are met, the user of the large model content confirms the integrity of the watermark and updates the hash chain state through a smart contract; if the verification fails, the exception logging mechanism is triggered to record the failed proof, text hash, and verification timestamp.

[0052] The trusted setup parameters generated by MPC multi-party computation are used to verify whether the zero-knowledge proof satisfies the simulator existence theorem.

[0053] As a preferred technical solution, the adversarial example generation process is as follows:

[0054] Construct a four-dimensional attack space, including a lexical layer, a syntactic layer, a semantic layer, and a structural layer;

[0055] Synonym replacement and non-key candidate word deletion are performed at the lexical level; the synonym replacement refers to replacing words in the watermarked text with replaceable words at a set first proportion, retaining semantic similarity of 1 minus the set first proportion; the non-key candidate word deletion refers to removing modifiers in the generated content based on dependency parsing; the modifiers include adjectives and adverbs;

[0056] Sentence reconstruction and noise insertion are performed at the syntactic level; the sentence reconstruction refers to the voice conversion of active voice sentences in the generated content; the voice includes active voice and passive voice; the noise insertion refers to randomly adding meaningless punctuation at comma-separated positions in the generated content; the meaningless punctuation includes consecutive commas and redundant quotation marks;

[0057] Paragraph blending and semantic distillation are performed at the semantic layer; paragraph blending refers to mixing paragraphs of watermarked text with the content generated by the large model at a set second ratio; semantic distillation refers to summarizing and expanding the generated content.

[0058] Long-range perturbation and format tampering are performed at the structural layer; the long-range perturbation refers to swapping the paragraph order in the generated content; the format tampering refers to inserting non-printing characters at the beginning of the text stream of the generated content; the non-printing characters include newline characters and spaces.

[0059] As a preferred technical solution, the optimization of watermarked text using adversarial training methods specifically includes:

[0060] A dual-channel adversarial sample generator is constructed. One channel of the dual-channel adversarial sample generator adopts a Markov chain model to generate a random permutation sequence of p to q paragraphs of the watermarked text, ensuring that the paragraph swapping range is less than or equal to a set proportion of the original text length. The other channel is based on a regular expression insertion strategy, inserting Unicode control characters and ASCII control characters at the paragraph boundaries according to a Poisson distribution λ.

[0061] A watermark detector is constructed and initialized based on the BERT-base model;

[0062] An improved GAN framework is used to generate adversarial examples, and a triple composite loss function consisting of cross-entropy loss, adversarial example classification loss, and watermark extraction loss, along with the AdamW algorithm, is used to iteratively train the watermark detector.

[0063] Compared with the prior art, the present invention has the following advantages and beneficial effects:

[0064] 1. Enhanced high-capacity watermark embedding and tamper resistance

[0065] Traditional watermarking techniques employ a single-bit embedding strategy, with a capacity of only one bit, which cannot carry complex copyright identification information (such as a 128-bit ID). Furthermore, the static embedding position is easily compromised by attackers through synonym substitution or partial text deletion. This invention proposes a dynamic segment allocation mechanism that divides a multi-bit binary copyright ID into multiple equal-length sub-segments. Combined with Reed-Solomon encoding, redundant check bits are added between segments, and pseudo-random segment index mapping ensures the unpredictability of the embedding position. For example, even if an attacker deletes 30% of the text content, the redundant encoding can still recover the complete copyright ID from the remaining segments. Experimental data shows that this mechanism reduces the bit error rate (BER) under text truncation attacks from 17.2% to 10.8% of traditional schemes, supports the embedding of complex multi-bit identifiers, and significantly improves the accurate tracing capability of multi-model copyright disputes.

[0066] 2. Optimization of the balance between generation quality and stealth

[0067] Traditional watermarking techniques require the introduction of strong perturbations (e.g., watermark strength parameter γ > 2) to improve robustness, resulting in perplexity fluctuations (PPL) exceeding 1.5%. This invention employs a mirror-symmetric sampling algorithm, dividing the vocabulary into mutually exclusive subsets (e.g., GtGt and RtRt), and applying a symmetric bias (±γ) to the selected regions during sampling to strictly maintain the original probability distribution. For example, when γ = 1.5, the detection confidence of the watermark signal within 100 candidate words reaches 90.9%, while the PPL fluctuation is only 0.3%. Simultaneously, the adversarial training framework monitors PPL changes in real time and dynamically adjusts the watermark strength parameter γ to ensure that, under the robustness requirement of BER < 1%, PPL fluctuations are always controlled within 0.5%, balancing concealment and generation quality.

[0068] 3. Enhanced resistance to attacks and dynamic adaptive capabilities

[0069] Existing technologies generally suffer from a bit error rate (BER) exceeding 15% under attacks such as synonym substitution and paragraph mixing. This invention employs an adversarial training method to simulate various attack scenarios at the lexical, syntactic, and semantic levels, and optimizes watermark parameters through a dual-loop mechanism: the inner loop generates adversarial examples (e.g., semantically preserved lexical substitution using RoBERTa-large), while the outer loop dynamically adjusts redundancy and watermark strength parameters. Experiments show that under a 30% synonym substitution attack, the BER decreases from 17.2% to 10.8% compared to traditional methods; under a 40% paragraph mixing attack, the BER remains stable at 15.2%. Furthermore, the elastic error-correcting coding expands the check symbols according to the real-time attack intensity (e.g., increasing redundancy rt from 1 to 3), improving the resistance to sudden errors by 3 times.

[0070] 4. Innovation in Privacy Protection and Trusted Verification Mechanisms

[0071] Traditional verification methods require disclosure of copyright IDs or model parameters, posing a risk of sensitive information leakage. This invention introduces zero-knowledge proofs, embedding watermarks into logic compiled into an arithmetic circuit constraint system. The verifier only needs to verify the validity of the proof through a smart contract, without needing to obtain a key or copyright ID. Simultaneously, a quantum-resistant pseudo-random sequence is constructed to ensure forward security and backward untraceability. Experiments show that in 100,000 simulated attacks, the key cracking success rate is 0%, effectively improving privacy protection. Attached Figure Description

[0072] To more clearly illustrate the technical solutions in the embodiments of this application, the accompanying drawings used in the description of the embodiments will be briefly introduced below. Obviously, the accompanying drawings described below are only some embodiments of this application. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0073] Figure 1 This is an overall flowchart of the large model content tracing method based on model copyright ID watermark embedding in an embodiment of the present invention.

[0074] Figure 2 This is a flowchart illustrating the zero-knowledge verification process in an embodiment of the present invention.

[0075] Figure 3 This is a flowchart illustrating the adversarial training method in an embodiment of the present invention. Detailed Implementation

[0076] To enable those skilled in the art to better understand the present application, the technical solutions in the embodiments of the present application will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are merely some embodiments of the present application, and not all embodiments. All other embodiments obtained by those skilled in the art based on the embodiments of the present application without creative effort are within the scope of protection of the present application.

[0077] In this application, the reference to "embodiment" means that a specific feature, structure, or characteristic described in connection with an embodiment may be included in at least one embodiment of this application. The appearance of this phrase in various places throughout the specification does not necessarily refer to the same embodiment, nor is it a mutually exclusive, independent, or alternative embodiment. It will be explicitly and implicitly understood by those skilled in the art that the embodiments described in this application can be combined with other embodiments.

[0078] In generative model watermarking technology, there is an inherent contradiction between the credibility of copyright verification and privacy protection: traditional verification methods require the disclosure of copyright IDs or model parameters, posing a risk of sensitive information leakage. This application introduces zero-knowledge proof (ZKP) technology to construct a zero-knowledge proof-driven integrity verification framework. This framework achieves verifiable computation of watermark compliance and integrity without disclosing any privacy information. Figure 1 As shown, this embodiment of the large model-based content tracing method based on model copyright ID watermark embedding includes the following steps:

[0079] S1. The large-scale model content generator compiles the dynamic watermark embedding process into an arithmetic circuit and uses a zero-knowledge proof algorithm to generate watermarked text and proof. Because traditional single-bit watermarking technology suffers from low capacity and poor robustness, it is difficult to meet practical needs. Therefore, this invention proposes a dynamic watermark embedding method that integrates multi-bit watermark embedding and mirror-symmetric sampling. Through a dynamic segment allocation mechanism, it achieves high-capacity, low-disturbance copyright identifier embedding while ensuring generation quality (PPL stability). The specific steps include:

[0080] A1. Convert the ASCII string to a binary sequence to obtain the copyright ID of the generated content of the large model;

[0081] A2. Based on the watermark segmentation strategy, the copyright ID is segmented into multiple equal-length sub-segments and a CRC check code is added between adjacent equal-length sub-segments.

[0082] A3. Select candidate words from the content generated by the large model, and use the improved Viterbi balancing algorithm to dynamically optimize the allocation of equal-length sub-segments and candidate words to obtain the allocation table of candidate words and equal-length sub-segments.

[0083] A4. Use pseudo-random segment mapping to obtain the watermark bit of equal-length sub-segments, and generate watermarked text based on mirror symmetric sampling mechanism.

[0084] S2. The large model content generator will release watermarked text along with proof, hiding the copyright ID and key.

[0085] S3. The users of the large model content use a zero-knowledge verification algorithm through smart contracts to verify the proof and the watermarked text.

[0086] S4. Adversarial Training Watermark Strength: In generative model watermarking technology, ensuring the reliable extraction of watermark information even after semantically preserved text tampering is a core challenge for industrial applications. Traditional static watermarking schemes generally suffer from a bit error rate (BER) exceeding 15% when facing attacks such as synonym replacement and paragraph reorganization, failing to meet practical needs. This invention proposes an end-to-end robustness optimization framework based on adversarial training. Through attack scenario simulation, dynamic parameter adjustment, and error correction coding fusion, the watermark's anti-attack capability is improved to a BER < 1%. Specifically: After successful verification, adversarial samples corresponding to the watermarked text are generated, and adversarial training methods are used to optimize the watermarked text, dynamically adjusting the parameters of the improved Viterbi balancing algorithm.

[0087] Furthermore, based on the watermark segment segmentation strategy, specifically:

[0088] Given a b-bit binary copyright ID, it is divided into k equal-length sub-segments based on a watermark segmentation strategy. Each sub-segment has a length of l = b / k, and the segmentation process satisfies the following:

[0089] Truncation resistance: Any combination of no less than m equal-length sub-segments contains unique identification information for traceability, where m ≥ 2;

[0090] Redundancy coding: Adding CRC checksums between adjacent equal-length segments enhances tamper resistance, represented as:

[0091] ,

[0092] Where E is the encoding vector, E j Let k be the encoding vector of the j-th equal-length sub-segment, and k be the number of equal-length sub-segments. This is a cascading operation; ID is the copyright ID, and l is the binary length of each equal-length field. The CRC checksum is the error detection code calculated using the CRC (Cyclic Redundancy Check) algorithm during the redundancy encoding process.

[0093] In this embodiment, b=128, k=4, l=32, that is, the 128-bit binary copyright ID is divided into 4 equal-length sub-segments, each of which has a binary length of 32 bits.

[0094] Furthermore, to avoid skewed segment allocation caused by high-frequency candidate words, this application employs an improved Viterbi balancing algorithm for segment allocation optimization. The specific steps are as follows:

[0095] A3.1 Construct the state space and define the state s t = (C1, C2, ..., C k) represents the number of candidate words assigned to each equal-length sub-segment at time t, and k is the number of equal-length sub-segments; the initial state is s0 = (0, 0, ..., 0).

[0096] A3.2 Calculate the allocation cost: For candidate word w i Calculate the cost of allocating it to each equal-length sub-segment:

[0097] ,

[0098] Among them, cost j (w i ) indicates candidate word w i The cost of assigning to an equal-length subsegment j, where α is the control frequency weight, and freq(w) i ) represents the candidate word frequency; β∈[0,1] is the balance strength weight, used to adjust the balance strength of the distribution of each equal-length sub-segment. When β=0, completely unbalanced distribution is allowed, and when β=1, completely balanced distribution is forced; C j Let t be the number of candidate words assigned to the equal-length sub-segment j, t be the time t, and l be the length of the equal-length sub-segment;

[0099] A3.3 Obtaining the Allocation Table: By real-time monitoring of the allocation variance of equal-length segments, and combining an improved Viterbi balancing algorithm with an online weight adjustment mechanism, dynamic programming is performed. Adjacency lists and pruning strategies are used to obtain the allocation table of equal-length segments and candidate words with the goal of minimizing the cumulative cost path. During dynamic programming, the following condition must be met: the difference between the maximum and minimum number of candidate words already allocated to the equal-length segment is less than a preset tolerance, described as:

[0100] ,

[0101] in, The maximum number of candidate words assigned to equal-length subarray j. ϵ represents the minimum number of candidate words allocated to equal-length sub-segment j, and ϵ represents the preset tolerance.

[0102] Furthermore, watermarked text is generated through pseudo-random mapping to create segment indices and a mirror-symmetric sampling mechanism, specifically as follows:

[0103] A4.1 Dynamic word list partitioning: For the current candidate word, a position t is randomly generated, and the preceding candidate word sequence S is based on all positions before that position. t-1By dynamically calculating the dual thresholds τ1 and τ2 based on semantic similarity, the vocabulary (which is inherent in the large model itself) V is divided into a positive watermark set Gt (containing candidate words with semantic probability P(w)=1 / 2+γ, where γ∈[0.1,0.5] is the watermark strength parameter) and a negative watermark set Rt (containing candidate words with semantic probability P(w)=1 / 2-γ). The remaining vocabulary maintains its original distribution to preserve concealment. Among them, the predecessor candidate word sequence is all candidate word sequences containing positions before the current candidate word position.

[0104] A4.2 Hash Index Generation: Based on Precursor Candidate Word Sequence S t-1 The predecessor hash of the current candidate word position t is calculated using a collision-resistant hash function (such as SHA-3); combined with the key of the large model content generator, a pseudo-random mapping is used to determine the current segment index of the equal-length sub-segment corresponding to the current candidate word position t in the allocation table: p i = HMAC(s k , h t ) mod k, where p i Let be the index of the current segment corresponding to the equal-length sub-segment at the current candidate word position t, and HMAC() be the key-related hash message authentication code function used to combine the hash function and the key to verify the integrity and authenticity of the message. k h is the secret key. t Let k be the predecessor hash of the current candidate word position t, and k be the number of segments. The pseudo-random mapping used in this application to generate segment indices ensures that:

[0105] Forward unpredictability, meaning an attacker cannot access the migration segment index p. i-1 Push to the current segment index p i ;

[0106] Backwards is not traceable, meaning the current segment index p is known. i Unable to reverse-engineer the predecessor candidate word sequence S t-1 .

[0107] A4.3 Probability Bias Adjustment: Starting from the current segment index p i Read the watermark position using the global pointer b: w t =E[p t [bitmod l], E represents the embedding function, p t This is plaintext. `bit` is a global bit pointer, and `l` is the binary length of each equal-length field. The watermark bit is the binary bit of the equal-length sub-field corresponding to the current candidate word position, determined by the watermark bit `w`. t Applying the watermark strength parameter γ∈[1.2,2.0] to the positive watermark set Gt or the negative watermark set Rt to adjust the logits bias is described as follows:

[0108] ,

[0109] in, It is a word embedding vector, v t [w] is the word embedding vector, w is the basic language unit, γ is the watermark strength parameter, and G... t It is {w | sim(w,Dt)>τ1} (positive watermark set), R t It is {w | sim(w,Dt)<τ2} (negative watermark set). When the generated perplexity PPL exceeds the set PPL threshold, the watermark strength parameter is dynamically adjusted according to an exponential decay strategy, while the controllability of the distribution perturbation is ensured by KL divergence constraints. The dynamic adjustment of the watermark strength parameter according to the exponential screening strategy is expressed as follows:

[0110] ,

[0111] Where σ is the variance of the vocabulary probability, α is the Type I error rate (false positive), β is the Type II error rate (false negative), and n is the number of candidate words required for detection. The KL divergence constraint satisfies D_KL≤0.1.

[0112] A4.4 Symmetrical Sampling Execution: An improved Gibbs sampling mechanism is used to sample within the positive and negative watermark sets according to a modified probability distribution, selecting the next candidate word at the current candidate word position until the complete text is generated, resulting in watermarked text. When the watermark bit is equal to 1, sampling is performed within the positive watermark set according to a modified probability distribution, i.e., P... modified (w) = (P original (w)+γ) / Z + , where P original (w) represents the original probability distribution of the next candidate word output by the large model, P modified (w) represents the modified probability distribution of the next candidate word, Z + This is the normalization factor for the positive watermark set; when the watermark bit is equal to 0, sampling is performed in the negative watermark set according to the corrected probability, i.e., P. modified (w) = (P original (w)-γ) / Z - Z - This is the normalization factor for the negative watermark set; when sampling fails, the original distribution is reverted and the number of perturbations is recorded. The normalization factor is a scaling constant introduced to ensure that the sum of all corrected probability distributions is 1.

[0113] A4.5 Integrity Verification: Construct an invertible mapping function f(w) to achieve entropy balance between the positive and negative watermark sets, i.e., satisfy the entropy H(P) of the corrected probability distribution after watermark strength parameter adjustment. modified The entropy H(P) is equal to the entropy of the original probability distribution and the entropy calculated from the watermark strength parameter. _originalFurthermore, the probability of excluding mirror word pairs is greater than the set exclusion threshold. The invertible mapping function makes:

[0114] ,

[0115] Where f(w) is the dynamic word mapping function, which uniquely maps each word w in the positive watermark set Gt to a word in the negative watermark set Rt, satisfying the symmetry constraint Pt(w) = Pt(f(w)), meaning that mirror pairs of words have equal probabilities in the original probability distribution of the large model. Pt(w) is the original probability distribution function of the large model at time step t, and Pt(f(w)) is the original probability corresponding to the mapped word f(w). In this embodiment, the exclusion threshold is set to 0.95.

[0116] A4.6 Dynamic Parameter Adaptation: After the large model generates 100 tokens, the watermark strength coefficient is updated based on the bit error rate (BER). When k consecutive segments of equal-length fields have the same index, a quantum-resistant hash algorithm is triggered for hash recalculation. In this embodiment, the Poseidon hash function is used for hash recalculation.

[0117] The framework flowchart of the large model generation content tracing method of the present invention is as follows: Figure 2 As shown, it mainly includes three stages: proof generation stage, content distribution stage, and verification and auditing stage. Its core components are shown in Table 1 below:

[0118] Table 1 Core Components of the Zero-Knowledge Verification Framework

[0119]

[0120] Furthermore, the specific steps for proving the compiler arithmetic circuit in the generation phase are as follows:

[0121] S1.1 First, a constraint system is constructed. Based on the R1CS framework, the dynamic watermark embedding process is decomposed into an arithmetic expression of three core modules: a dynamic segment allocation module, a verification coding module, and a mirror sampling module, i.e., a quadratic arithmetic procedure. The dynamic segment allocation module generates segment indices for equal-length sub-segments; the verification coding module transforms the verification polynomial into a linear combination constraint of a finite field generator and the copyright ID; and the mirror sampling module ensures the symmetry of the distribution perturbation of the dynamic vocabulary mapping function through dual-channel probability distribution constraints and KL divergence verification. The segment indices generated by the dynamic segment allocation module directly drive the sign verification of the verification coding module, while the distribution constraints of the mirror sampling module inversely verify the randomness of the dynamic segment allocation module.

[0122] S1.2. A hierarchical circuit design is adopted to perform constraint modeling on the dynamic segment allocation module, the verification encoding module, and the mirror sampling module, so as to realize the modular processing of complex logic, including:

[0123] By constructing a normalized matrix and quadratic equilibrium constraints, the dynamic optimization process of the improved Viterbi balancing algorithm is transformed into verifiable matrix multiplication constraints, with the column linear independence of the state transition matrix forming the core verification condition. The watermark acquisition process is transformed into a two-layer constraint of hash chain verification and segment index mapping, thus directly linking watermark acquisition with the cumulative verification of the copyright ID, ensuring the reversibility of the embedding process. The process of generating watermarked text based on a mirror-symmetric sampling mechanism is transformed into controlling the probability distribution difference between the positive and negative watermark sets within a safe threshold through complementary constraints and quadratic parameter control. The constraint parameters form a linkage mechanism with attack strength detection.

[0124] S1.3. Optimize the circuit by implementing layered folding technology and quantum-resistant design strategies:

[0125] A cyclic unrolling strategy is employed to compress the exponential state space of the dynamic segment allocation module into a linear size, combined with sparse storage technology to achieve circuit size reduction. A quantum-resistant hash algorithm is implemented using multi-round short-circuiting, with multiple nonlinear constraint gates established in each round to control the circuit depth within a set number of layers to ensure hardware friendliness. Simultaneously, pre-compiled contracts are used to compress the verification time of the protocol, reducing gas consumption while maintaining a high verification pass rate.

[0126] In this embodiment, the circuit size is reduced by 58% using coefficient storage technology. The quantum-resistant hash algorithm is implemented using a 5-round circuit of the Poseidon algorithm, with 32 nonlinear constraint gates established in each round, keeping the circuit depth within 12 layers. Simultaneously, the verification time of the Groth16 protocol is compressed to 182ms through pre-compiled contracts, the gas size is reduced to below 500k while maintaining a 100% verification pass rate. The number of constraints before and after circuit optimization is shown in Table 2 below.

[0127] Table 2 Circuit Optimization Comparison Table

[0128]

[0129] These circuit optimization measures, while maintaining 128-bit security strength, compress the original 227,495 constraint terms to 91,341 terms, forming a lightweight verification scheme that meets the TPS requirements of the Ethereum mainnet.

[0130] S1.4 A parameterized circuit is generated, constructing an scalable dynamic configuration template that supports flexible adaptation of copyright IDs from 128 to 1024 bits. The number of equal-length sub-segments and the number of checksums are parameterized to achieve a linear mapping relationship between watermark length and circuit size. The number of equal-length sub-segments follows a 2-fold exponential configuration rule. A real-time error rate detection mechanism is embedded, automatically activating the redundant error correction layer when the bit error rate exceeds a set threshold. By dynamically adjusting the number of checksums, the ability to withstand sudden errors is improved. The entire parameterization process strictly follows the NIST ZK-SNARKs standard, ensuring the three core security attributes of column linear independence of the state transition matrix, collision resistance of the hash function, and forward secrecy of probability distribution perturbations. The resulting R1CS circuit is verified through the Zokrates platform, achieving a complete technical closed loop on the BN254 elliptic curve. In this embodiment, the redundant error correction layer is automatically activated when the bit error rate exceeds 0.5%, achieving a 3-fold improvement in the ability to withstand sudden errors.

[0131] Furthermore, a zero-knowledge proof algorithm is used to generate watermarked text and proof, specifically:

[0132] S2.1 Data Preprocessing and Parameter Loading:

[0133] The large model content generator loads a pre-generated key (a 256-bit private key based on the BN254 elliptic curve) and copyright ID, configures and deploys a pre-compiled constraint system (i.e., an arithmetic circuit) conforming to the EIP-196 standard; serializes the watermarked text and the complete intermediate states (witnesses) recorded during its generation process as public and secret inputs to the arithmetic circuit; and pre-distributes the random number seed R using the MPC protocol to ensure the unpredictability of the proof system.

[0134] S2.2 Compile the arithmetic circuit to generate the coset polynomial and generate the commitment value through the KZG commitment scheme.

[0135] More specifically, compiling the arithmetic circuit includes: mapping the text feature vectors of candidate word probability distributions to a finite field Fp, generating state transition paths through an improved Viterbi algorithm, and constructing a dynamic watermark embedding circuit; verifying that the segment index satisfies HMAC(sk, S). t-1 )=H(S t The watermark intensity difference Δw ∈ [-3, 3] between adjacent equal-length segments is constrained. Then, a (255, 223) finite-field code is generated based on the check code, and the redundant symbol set E = {E1, E2, ..., E} is calculated. t The column linear independence of the generator matrix G (the generator matrix of the linear error-correcting code) is satisfied; finally, the parity check constraint of the encoding vector e(x) is verified by the anti-quantum error correction check circuit to ensure that the burst error recovery capability is greater than or equal to 15 bits.

[0136] The coset polynomial generation and commitment value generation include: generating coset polynomials Q_L(x), Q_R(x), Q_M(x), and Q_O(x) for the arithmetic circuit R1CS; generating commitment value Com = H(Q_L || Q_R || Q_M || Q_O || A || B || C) through the KZG commitment scheme, where A, B, and C are elliptic curve point triples; using a quantum-resistant commitment challenge value α = H(sk ||Com || R) to ensure unpredictable randomness; and performing polynomial interpolation through Barrett reduction to verify that the circuit coset polynomial W(x) = Q_L(x)A(x) + Q_R(x)B(x) + Q_M(x)A(x)B(x) + Q_O(x) - A(x)B(x)C(x) holds true at the challenge value α, and that the error term ε = H(α || Com) satisfies the Lagrange basis function constraints.

[0137] S2.3 Proof Composition and Optimization: The bilinear pairing operation e(A,C) = e(B,α) is performed. A pre-computed elliptic curve dot product table is used to optimize the computation path and improve proof generation efficiency, synthesizing a complete zero-knowledge proof π = (A, B, C). In this embodiment, distributed computing using the MPL (Multi-Party Learning) protocol is employed, with a single proof generation time of 1.2 seconds and gas consumption controlled below 800k. Simultaneously, a quantum-resistant hash chain algorithm (SHA3-512 + Merkle tree) is used to generate the state anchor point S. t = H(S t-1 || π || w), where w is the hash value of the watermarked text. The hash chain depth is synchronously verified to not exceed the preset threshold L=1024 to prevent long-range attacks.

[0138] S2.4 Anomaly Handling and Audit Log: When a coset polynomial interpolation failure is detected (e.g., field element out of bounds) or an abnormal hash chain state, a local repair algorithm based on error correction coding is triggered to reconstruct the lost checksum using BCH code; an anomaly log is recorded to off-chain storage, including the error type, text hash, and generation timestamp. The completeness, correctness, and zero-knowledge nature of the zero-knowledge proof are verified using a ZK-SNARK simulator to ensure that the following security indicators are met:

[0139] Quantum security: Resistance to Shor's algorithm attack strength ≥ 256 bits.

[0140] Privacy leakage rate: Key information entropy leakage < 0.01 bits,

[0141] Temporal attack protection: Meets the timestamp constraints of the EIP-712 standard.

[0142] In this embodiment, the zero-knowledge proof algorithm zk-SNARKs is adapted to the Groth16 protocol and its parameters are optimized for watermark verification scenarios: 1. Elliptic curve selection: BN254 curve is adopted, supporting EIP-196 pre-compilation; 2. Trust setting: CRS is generated through a multi-party computation (MPC) ceremony, with participants including institutions such as MIT and ETH Zurich; 3. Proof compression: A fast proof generation algorithm based on FFT is applied, reducing the time from 320ms to 182ms.

[0143] Furthermore, a zero-knowledge verification algorithm is used to verify the proof against the watermarked text, specifically:

[0144] S3.1 Receiving Verification Data: The user of the large model content receives the watermarked text and corresponding zero-knowledge proof (containing three components πA, πB, and πC) published by the large model content generator through a smart contract. At the same time, it calls the hash chain checkpoint data stored on the chain (provided by the Oracle node) to ensure that the verification process has a traceable hash state anchor.

[0145] S3.2 Initialize the verification environment: Load the key of the large model content generator (including elliptic curve parameters, hash function mapping table and constraint system configuration), build the Groth16 protocol verification framework and parameterize the key through BN254 elliptic curve, support EIP-196 standard pre-compiled functions, and ensure that the computational efficiency meets the Ethereum mainnet TPS requirements.

[0146] S3.3 Perform constraint verification of the arithmetic circuit and execute the core verification equation on the BN254 elliptic curve, synchronously checking the consistency of the proof and the hash chain state of the key to prevent timing tampering caused by long-range attacks.

[0147] More specifically, constraint verification includes: verifying the pseudo-random segment index generation process using a quantum-resistant hashing algorithm (Poseidon-5 rounds), and checking HMAC(sk, S) t-1 The calculation results are constrained by the equality of the domain elements of the segment index pi to ensure forward unpredictability; the column linear independence of the Viterbi algorithm's state transition matrix is ​​verified simultaneously to confirm that the dynamic segment allocation does not violate the preset tolerance constraint (|maxCj-minCj|≤η). Based on the finite field generator α, the verification polynomial E is verified. j The linear combination constraint of (x) is checked to see if the encoding vector set E satisfies it. E j=ID cumulative verification. Verify the dynamic adjustment logic of the redundant symbol number rt using quantum error-correcting coding to ensure that burst error recovery capability conforms to the parameterized configuration rules. Perform reversibility verification of the symmetric bias function, checking whether the difference in probability distribution between the positive watermark set Gt and the negative watermark set Rt satisfies the KL divergence constraint (D_KL≤0.1) of P(w)·γ = P(f(w)) · (1-γ). Synchronously verify the hash chain state and the predecessor sequence S of the generation position. t-1 The continuity ensures that the sampling process conforms to the mirror symmetry mechanism.

[0148] S3.4 Result Determination and State Update: If the verification equation is true and all constraints are met, the verifier confirms the watermark integrity and updates the hash chain state through the smart contract. If verification fails, an exception logging mechanism is triggered, recording the failed proof ID, text hash, and verification timestamp for subsequent auditing and traceability. The verification process supports parallel processing, with a single verification latency of less than or equal to 200ms, and supports processing 500+ concurrent requests per second.

[0149] S3.5 Privacy-Enhanced Verification: Using trusted setup parameters generated through MPC multi-party computation, verify whether the zero-knowledge proof satisfies the simulator existence theorem, ensuring that the proof generation process does not leak any information entropy of the key sk. Check the irreversibility of the hash chain state and segment index generation logic to confirm that S cannot be derived from known pi. t-1 Or sk. The forward unpredictability of the hash chain state is verified through a collision resistance test against quantum hash functions (SHA3-512 standard).

[0150] In this embodiment, the zero-knowledge verification step was subjected to attack resistance analysis, and the attack types analyzed are shown in Table 3 below:

[0151] Table 3 Privacy Protection Features

[0152]

[0153] The performance in 100,000 simulated attacks is shown in Table 4 below:

[0154]

[0155] In 100,000 simulated attack tests, the zero-knowledge verification mechanism achieved breakthrough security performance through a multi-layered defense architecture: the proof forgery success rate was only 0.003% (detection latency 82ms), and its double barrier built by the Groth16 protocol and the quantum-resistant hash chain (SHA3-512) forced attackers to simultaneously crack ECDLP (computational complexity > 2). 128 ) and hash collision (probability < 2) -128This results in a sub-exponential security strength. The constraint bypass success rate of 0.012% (95ms delay) relies on the 128×128 dimensional Viterbi state transition matrix of the dynamic segment allocation module and the KL divergence constraint (D_KL≤0.1) of the mirror sampling module. This requires attackers to simultaneously satisfy 12,000 constraint gate logic and probability distribution symmetry, with mathematical difficulty equivalent to cracking an LWE problem instance (security parameter n=1024). Parameter tampering defense achieves a 0% success rate (105ms delay) through 1024 deep hash chain checkpoints (collision probability <2). -1024 With EIP-712 timestamp constraints, combined with private key entropy protection under MPC trusted settings (leakage <0.01 bits), at the physical level, it requires the computer to run for more than 10... 18 It will take years to overcome the dual challenges of continuous hash state forgery and synchronous adjustment of elliptic curve dot product parameters. This study verifies the engineering feasibility of zero-knowledge proofs in generative AI copyright protection scenarios.

[0156] The flowchart for the adversarial training watermark strength step is as follows: Figure 3 As shown, a dual closed-loop control structure is adopted: inner loop adversarial training: adversarial samples are generated through an attack simulator to optimize the model's anti-interference ability; outer loop parameter tuning: the watermark strength parameter γ and redundancy parameters are adjusted according to the real-time attack intensity.

[0157] Furthermore, the adversarial example generation strategy is as follows:

[0158] S4.1.1 Construct a four-dimensional attack space, including a lexical layer, a syntactic layer, a semantic layer, and a structural layer, represented as: A = {lexical layer} Syntactic layer semantic layer Structural layer}, where This is a tensor product operation.

[0159] S4.1.2, Perform synonym replacement and delete non-key candidate words at the lexical level; among which,

[0160] Synonym replacement: Replace a predetermined percentage of words in the generated content with replaceable words, retaining a semantic similarity of 1 minus the predetermined percentage. In this embodiment, replaceable words are predicted using RoBERTa-large, with the predetermined percentage being 2%, meaning 98% semantic similarity is retained. Non-key candidate word removal: Based on dependency parsing, remove modifiers from the generated content sentences; modifiers include adjectives and adverbs, etc.

[0161] S4.1.3, Perform sentence restructuring and noise insertion at the syntactic level; among which,

[0162] Sentence restructuring: The generated content is converted between active and passive voice; voice includes active voice and passive voice; in this embodiment, GPT-3.5 is used to convert the voice to passive voice.

[0163] Noise insertion: Randomly add meaningless punctuation marks at comma-separated positions in the generated content; meaningless punctuation marks include consecutive commas and redundant quotation marks.

[0164] S4.1.4. Perform paragraph blending and semantic distillation at the semantic layer; among which,

[0165] Paragraph blending: The content generated by the large model is blended with paragraphs of watermarked text at a set second ratio; in this embodiment, the second ratio is set to 20%.

[0166] Semantic distillation: Text summarization and extended rewriting of the generated content; in this embodiment, the T5 model is used for text summarization and extended rewriting.

[0167] S4.1.5. Perform long-range perturbations and format tampering at the structural layer; among which,

[0168] Long-range perturbation: swapping the order of paragraphs in the generated content, disrupting the original narrative logic;

[0169] Formatting manipulation: Inserting non-printable characters at specific locations in the generated content (such as the beginning of the text stream, paragraph boundaries, sentence ends, etc.); non-printable characters include newlines and spaces, etc.

[0170] Furthermore, adversarial training methods are used to optimize the watermarked text, specifically:

[0171] S4.2.1 Adversarial Example Generation Stage: Construct a dual-channel adversarial example generator G_Adversarial, with channel 1 employing a Markov chain model (transition probability matrix P∈R). {n×n} For the watermarked text, a random permutation sequence of p~q (e.g., 0.5~3) paragraphs is generated, ensuring that the paragraph swapping range is ≤ a set proportion of the original text length (e.g., 30%). Channel 2 uses a regular expression insertion strategy to insert Unicode control characters (e.g., U+200B zero-width space) and ASCII control characters (e.g., VT vertical tab) at paragraph boundaries according to a Poisson distribution λ=0.3, with the insertion density strictly adhering to a constraint of 0.5 characters / KB. An improved GAN framework is used to generate adversarial examples: G_adversarial(S_original) = α·S_logic + β·S_formatting, where α~Beta(2,5) controls the logic perturbation strength, β~Beta(5,2) adjusts the format tampering magnitude, and the mixing coefficient γl=0.6 achieves perturbation balance.

[0172] S4.2.2 Initialization of the detection model: Construct and initialize the watermark detector based on the BERT-base model.

[0173] S4.2.3 Model Training Phase: An improved GAN framework is used to generate adversarial examples. The watermark detector is iteratively trained using a triple composite loss function consisting of cross-entropy loss, adversarial example classification loss, and watermark extraction loss, along with the AdamW algorithm.

[0174] Specifically: the watermark detector D_watermark is a BERT-based model (12 layers, 768 dimensions), using a triple composite loss function: L total = 0.4·L ce + 0.3·L adv + 0.3·L watermark The cross-entropy loss L is among them. ce A binary classification task based on original text and adversarial examples (normal samples labeled 0, adversarial examples labeled 1); adversarial example classification loss L adv Gradient perturbation was calculated using an FGSM attack (ε=0.01, 5 iterations); watermark extraction loss L... watermark Constraints were imposed on the byte-level watermark decoding accuracy (watermark strength 0.85). Model optimization employed the AdamW algorithm (β1=0.9, β2=0.98, ε=1e). -6 The learning rate η = 2e -5 Batch size 32.

[0175] The iterative optimization process of the watermark detector D_watermark executes 5 rounds of adversarial training cycles, each round containing:

[0176] a. Generate adversarial example set D t : Randomly sample 256 samples from the training set S, generate perturbation samples through channel 1 and channel 2 respectively, and mix them with γ=0.6 to generate an adversarial sample set;

[0177] b. Calculate the adversarial gradient: ∇θL adv = ∇θ[logD_watermark(G_adversarial(S)) + λ·log(1-D_watermark(S))];

[0178] c. Parameter update: θ t = θ {t-1} - η·∇θL total + 0.1·L2 regularization term;

[0179] d. Robustness verification: on the test set S test Perform watermark detection (threshold 0.30), requiring an accuracy of ≥99.0% and a false positive rate of <0.5% (based on a Flesch-Kincaid readability score of ≥4.2).

[0180] The final output is the D-watermark detection model after 5 rounds of optimization. final Its parameters are compressed to 0.6B (through knowledge distillation), achieving a single-sample processing latency of <15ms and a memory footprint of ≤1.2GB on an NVIDIA A100 GPU.

[0181] This embodiment tests the anti-attack capability of the watermark after adversarial training. The performance on the GPT-2 text generation task is shown in Table 5 below:

[0182] Table 5. Comparison of Bit Error Rate (BER) between the Traditional Method and the Method Presented

[0183]

[0184] By constructing a joint attack space at the lexical layer (synonym replacement), syntactic layer (voice transformation), semantic layer (paragraph mixing), and structural layer (long-range perturbation), a realistic adversarial scenario is simulated. RoBERTa-large is used for semantically preserved synonym replacement (retaining 98% similarity), combined with GPT-3.5 voice transformation and T5 semantic distillation to generate challenging adversarial examples. A dual-loop optimization mechanism (inner loop generates adversarial examples, outer loop adjusts watermark intensity γ and redundancy parameter rt) dynamically balances robustness and generation quality, enabling the model to continuously evolve under attack pressure. This technology, through an end-to-end adversarial evolution system, constructs a digital watermarking system with proactive defense capabilities while ensuring the naturalness of generated content (PPL).

[0185] In addition, this embodiment also tested the adaptive capability of dynamic parameters under different attack intensities, and the results are shown in Table 6 below:

[0186] Table 6. Test results of the adaptive capability of dynamic parameters under different attack intensities.

[0187]

[0188] As the attack intensity increases, both redundancy and watermark strength increase linearly, while the PPL (Profile Points per Second) also increases proportionally. This indicates that as the attack intensity increases, the system dynamically adjusts redundancy and strength, while the generated quality (PPL) fluctuates slightly. In other words, smaller fluctuations mean that the naturalness of the generated content remains relatively good, which is important for practical applications, such as ensuring that content generation quality is not compromised by defense mechanisms. Therefore, the technological advantage balances robustness and quality.

[0189] It should be noted that, for the sake of simplicity, the aforementioned method embodiments are all described as a series of actions. However, those skilled in the art should understand that the present invention is not limited to the described order of actions, because according to the present invention, some steps can be performed in other orders or simultaneously.

[0190] The technical features of the above embodiments can be combined in any way. For the sake of brevity, not all possible combinations of the technical features in the above embodiments are described. However, as long as there is no contradiction in the combination of these technical features, they should be considered to be within the scope of this specification.

[0191] The above embodiments are preferred embodiments of the present invention, but the embodiments of the present invention are not limited to the above embodiments. Any changes, modifications, substitutions, combinations, or simplifications made without departing from the spirit and principle of the present invention shall be considered equivalent substitutions and shall be included within the protection scope of the present invention.

Claims

1. A method for tracing the source of content generated from large models based on model copyright ID watermark embedding, characterized in that, Includes the following steps: The large model content generator compiles the dynamic watermark embedding process into an arithmetic circuit and uses a zero-knowledge proof algorithm to generate watermarked text and proof; the dynamic watermark embedding process includes: Convert the ASCII string to a binary sequence to obtain the copyright ID of the content generated by the large model; The copyright ID is divided into multiple equal-length sub-segments based on the watermark segment segmentation strategy, and a CRC check code is added between adjacent equal-length sub-segments. Candidate words are selected from the content generated by the large model, and the improved Viterbi balancing algorithm is used to dynamically optimize the allocation of equal-length sub-segments and candidate words to obtain an allocation table of candidate words and equal-length sub-segments. The watermark bits of equal-length sub-segments are obtained by pseudo-random segment mapping, and watermarked text is generated based on a mirror symmetric sampling mechanism; The content generator of the large model will release watermarked text along with proof, hiding the copyright ID and key; The users of the large model content use a zero-knowledge verification algorithm via smart contracts to verify the proofs and watermarked text; After successful verification, adversarial examples corresponding to the watermarked text are generated, and adversarial training methods are used to optimize the watermarked text, dynamically adjusting the parameters of the improved Viterbi balance algorithm. The watermark-based segmentation strategy is as follows: Given a b-bit binary copyright ID, divide it into k equal-length sub-segments based on a watermark segmentation strategy. Each sub-segment has a length of l = b / k, and the segmentation process satisfies the following: Truncation resistance: Any combination of no less than m equal-length sub-segments contains unique identification information for traceability, where m ≥ 2; Redundant coding: CRC checksums are added between adjacent segments of equal length; The improved Viterbi balancing algorithm is used to dynamically optimize the allocation of equal-length segments and candidate words, specifically as follows: Constructing the state space: Defining state s t = (C1, C2, ..., C k ) represents the number of candidate words assigned to each equal-length sub-segment at time t, and k is the number of equal-length sub-segments; the initial state is s0 = (0, 0, ..., 0); Calculate the allocation cost: for candidate word w i Calculate the cost of allocating it to each equal-length sub-segment: ， Among them, cost j (w i ) indicates candidate word w i The cost of assigning to an equal-length subsegment j, where α is the control frequency weight, and freq(w) i ) represents the candidate word frequency; β∈[0,1] is the balance strength weight, used to adjust the balance strength of the distribution of each equal-length sub-segment. When β=0, completely unbalanced distribution is allowed, and when β=1, completely balanced distribution is forced; C j Let be the number of candidate words assigned to the equal-length sub-segment j, t be the time t, and l be the binary length of the equal-length sub-segment; Obtaining the allocation table: By monitoring the variance of equal-length sub-segments in real time, dynamic planning is performed using an improved Viterbi balancing algorithm with an online weight adjustment mechanism. Adjacency lists and pruning strategies are employed to obtain the allocation table of equal-length sub-segments and candidate words with the goal of minimizing the cumulative cost path. The dynamic planning satisfies the following condition: the difference between the maximum number of candidate words and the minimum number of candidate words already allocated to equal-length sub-segments is less than a preset tolerance.

2. The method for tracing the source of large model generation content according to claim 1, characterized in that, The method for generating watermarked text based on the mirror symmetric sampling mechanism is as follows: Dynamic word list partitioning: For the current candidate word, a position is randomly generated. Based on the predecessor candidate word sequence of the current candidate word position, a dual threshold is dynamically calculated through semantic similarity. The word list is divided into a positive watermark set and a negative watermark set, and the remaining word list maintains its original distribution. The predecessor candidate word sequence is all candidate word sequences containing positions before the current candidate word position. Hash index generation: Based on the predecessor candidate word sequence of the current candidate word position, the predecessor hash of the current candidate word position is calculated using a collision-resistant hash function; combined with the key of the large model content generator, a pseudo-random mapping is used to determine the current segment index of the equal-length sub-segment corresponding to the current candidate word position in the allocation table; Probability bias adjustment: The watermark bit is read cyclically from the current segment index according to the global pointer. The logits bias is adjusted by applying the watermark strength parameter to the positive or negative watermark set according to the watermark bit. When the generated perplexity PPL exceeds the set PPL threshold, the watermark strength parameter is dynamically adjusted according to the exponential decay strategy. At the same time, the controllability of the distribution perturbation is ensured by KL divergence constraint. The watermark bit is the binary bit of the equal-length sub-segment corresponding to the current candidate word position. Symmetric sampling execution: An improved Gibbs sampling mechanism is used to sample within the positive and negative watermark sets according to a modified probability distribution, selecting the next candidate word at the current candidate word position until the complete text is generated, resulting in watermarked text; when the watermark bit is equal to 1, sampling is performed within the positive watermark set according to the modified probability distribution; when the watermark bit is equal to 0, sampling is performed within the negative watermark set according to the modified probability distribution; when sampling fails, the original distribution is reverted and the number of perturbations is recorded; the modified probability distribution is calculated based on the original probability distribution of the next candidate word output by the large model and the watermark strength parameter and normalization factor; Integrity verification: Construct an invertible mapping function to achieve entropy balance between the positive and negative watermark sets. That is, the entropy of the corrected probability distribution of the positive and negative watermark sets after adjusting the watermark strength parameters is equal to the entropy of the original probability distribution of the next candidate word output by the large model and the entropy calculated by the watermark strength parameters, and the exclusion probability of mirror word pairs is greater than the set exclusion threshold. Dynamic parameter adaptation: After the large model generates 100 tokens, the watermark strength coefficient is updated based on the bit error rate. When the same segment index appears in k consecutive segments of equal length, the anti-quantum hash algorithm is triggered to recalculate the hash.

3. The method for tracing the source of large model generation content according to claim 1, characterized in that, The process of compiling the dynamic watermark embedding process into an arithmetic circuit is specifically as follows: A constraint system is constructed, and the dynamic watermark embedding process is decomposed into three quadratic arithmetic procedures based on the R1CS framework: a dynamic segment allocation module, a verification encoding module, and a mirror sampling module. The dynamic segment allocation module is used to generate segment indices for equal-length sub-segments. The verification encoding module transforms the verification polynomial into a linear combination constraint of finite field generators and copyright IDs. The mirror sampling module ensures the symmetry of the distribution perturbation of the dynamic vocabulary mapping function through dual-channel probability distribution constraints and KL divergence verification. The segment index generated by the dynamic segment allocation module directly drives the sign verification of the verification encoding module, while the distribution constraints of the mirror sampling module inversely verify the randomness of the dynamic segment allocation module. A hierarchical circuit design is adopted to constrain the dynamic segment allocation module, the verification encoding module, and the mirror sampling module. This includes: transforming the dynamic optimization process of the improved Viterbi balancing algorithm into verifiable matrix multiplication constraints by constructing a normalized matrix and quadratic equilibrium constraints; transforming the watermark bit acquisition process into a two-layer constraint of hash chain verification and segment index mapping; and transforming the process of generating watermarked text based on the mirror symmetric sampling mechanism into complementary constraints and quadratic parameter control. The circuit is optimized by implementing layered folding technology and quantum-resistant design strategy: the exponential state space of the dynamic segment allocation module is compressed to a linear scale using a cyclic unrolling strategy, and the circuit size is reduced by sparse storage technology; a quantum-resistant hash algorithm is implemented using multi-round circuits, and multiple nonlinear constraint gates are established in each round of the circuit to control the circuit depth within a set number of layers; at the same time, the verification time of the protocol is compressed, the gas consumption is reduced and the verification pass rate is maintained by pre-compiling contracts. The parameterized circuit generates an extensible dynamic configuration template, which parameterizes the number of equal-length segments and the number of check codes. The number of equal-length segments follows a configuration rule with an exponential law of 2, and a real-time error rate detection mechanism is embedded. When the bit error rate exceeds the set bit error threshold, the redundant error correction layer is automatically activated. By dynamically adjusting the number of check codes, the final R1CS circuit is formed. The final R1CS circuit is verified through the Zokrates platform, realizing a complete technical closed loop on the BN254 elliptic curve.

4. The method for tracing the source of large model generation content according to claim 3, characterized in that, The process of generating watermarked text and proof using a zero-knowledge proof algorithm is as follows: The large model content generator loads the pre-generated key and copyright ID, configures and deploys the arithmetic circuit; serializes the watermarked text and its complete intermediate state recorded during the generation process as the public and secret inputs of the arithmetic circuit; and pre-distributes the random number seed using the MPC protocol. The arithmetic circuit is compiled to generate the coset polynomial and the commitment value is generated through the KZG commitment scheme. Perform bilinear pairing operations, optimize the computation path using a pre-computed elliptic curve dot product table, and synthesize a complete zero-knowledge proof; When a coset polynomial interpolation failure or hash chain state anomaly is detected, a local repair algorithm based on error correction coding is triggered to reconstruct the lost check code using BCH code. Record exception logs to off-chain storage; the exception logs include the error type, text hash, and generation timestamp. Zero-knowledge proofs are verified using a ZK-SNARK simulator to ensure that the strength against Shor's algorithm attacks is greater than a set strength threshold, the amount of key information entropy leakage is less than a set leakage threshold, and the protection against time-series attacks meets the EIP-712 standard timestamp constraints.

5. The method for tracing the source of large model generation content according to claim 4, characterized in that, The zero-knowledge verification algorithm is used to verify the proof against the watermarked text, specifically as follows: Users of large model content receive watermarked text and proof published by the large model content creator through smart contracts, and call the hash chain checkpoint data stored on the chain to ensure that the verification process has traceable hash state anchors. Load the key published by the large model content generator, construct the Groth16 protocol verification framework, and parameterize the key using the BN254 elliptic curve. Perform constraint verification of the arithmetic circuit and execute the core verification equation on the BN254 elliptic curve, while simultaneously checking the consistency of the proof with the hash chain state of the key. If the verification equation is true and all constraints are met, the user of the large model content confirms the integrity of the watermark and updates the hash chain state through a smart contract; if the verification fails, the exception logging mechanism is triggered to record the failed proof, text hash, and verification timestamp. The trusted setup parameters generated by MPC multi-party computation are used to verify whether the zero-knowledge proof satisfies the simulator existence theorem.

6. The method for tracing the source of large model generation content according to claim 1, characterized in that, The adversarial sample generation process is as follows: Construct a four-dimensional attack space, including a lexical layer, a syntactic layer, a semantic layer, and a structural layer; Synonym replacement and non-key candidate word deletion are performed at the lexical level; the synonym replacement refers to replacing words in the watermarked text with replaceable words at a set first proportion, retaining semantic similarity of 1 minus the set first proportion; the non-key candidate word deletion refers to removing modifiers in the generated content based on dependency parsing; the modifiers include adjectives and adverbs; Sentence reconstruction and noise insertion are performed at the syntactic level; the sentence reconstruction refers to the voice conversion of active voice sentences in the generated content; the voice includes active voice and passive voice; the noise insertion refers to randomly adding meaningless punctuation at comma-separated positions in the generated content; the meaningless punctuation includes consecutive commas and redundant quotation marks; Paragraph blending and semantic distillation are performed at the semantic layer; paragraph blending refers to mixing paragraphs of watermarked text with the content generated by the large model at a set second ratio; semantic distillation refers to summarizing and expanding the generated content. Long-range perturbation and format tampering are performed at the structural layer; the long-range perturbation refers to swapping the paragraph order in the generated content; the format tampering refers to inserting non-printing characters at the beginning of the text stream of the generated content; the non-printing characters include newline characters and spaces.

7. The method for tracing the source of large model generation content according to claim 1, characterized in that, The optimization of watermarked text using adversarial training methods specifically involves: A dual-channel adversarial sample generator is constructed. One channel of the dual-channel adversarial sample generator adopts a Markov chain model to generate a random permutation sequence of p to q paragraphs of the watermarked text, ensuring that the paragraph swapping range is less than or equal to a set proportion of the original text length. The other channel is based on a regular expression insertion strategy, inserting Unicode control characters and ASCII control characters at the paragraph boundaries according to a Poisson distribution λ. A watermark detector is constructed and initialized based on the BERT-base model; An improved GAN framework is used to generate adversarial examples, and a triple composite loss function consisting of cross-entropy loss, adversarial example classification loss, and watermark extraction loss, along with the AdamW algorithm, is used to iteratively train the watermark detector.

Images