A large language model fingerprint construction method and system based on maximum active component coverage

Abstract

The application discloses a large language model fingerprint construction method and system based on maximum active component coverage, and belongs to the field of artificial intelligence model verification. The application aims to solve the problems of blind selection of prompt words and low model component coverage efficiency in existing fingerprint construction. The method comprises the following steps: obtaining a candidate sensitive prompt word set; determining the key component set activated by attention heads, feedforward networks and the like in the original model for each prompt word in the set; selecting a target prompt word set by using a maximum coverage selection strategy (such as a greedy algorithm) to maximize the weighted coverage rate of the key components collectively activated by the set; and finally, constructing the model fingerprint by using the target prompt word set and the expected output thereof. The application realizes the widest coverage with the least prompt words, significantly improves the discriminability, verification efficiency and reliability of the fingerprint, and reduces the verification cost.

Description

Technical Field

[0001] This invention belongs to the field of artificial intelligence security and model verification technology, specifically relating to a method, system and related applications for constructing efficient feature fingerprints for large language models (LMMs). Background Technology

[0002] With the widespread application of large language models, verifying whether models deployed in the cloud or on third-party devices are their claimed original and complete versions has become a critical security issue. Model fingerprinting technology, which identifies the model's identity through a set of carefully designed inputs (cues) and their corresponding outputs, is an effective way to solve this problem.

[0003] A core challenge in constructing a model fingerprint is selecting the set of cue words that constitute the fingerprint. Existing techniques typically employ random selection or selection based on a single sensitivity metric, but this has significant drawbacks: 1. Low coverage efficiency: Large language models have a massive number of parameters and numerous internal functional components (such as attention heads, feedforward network units, etc.). A single cue word, even with high parameter sensitivity, often only activates and detects a limited subset of parameters and components in the model. Random selection or simply piling up highly sensitive cue words can easily lead to significant overlap in the activated components, wasting API call resources, while many other critical parts of the model fail to be effectively covered and detected.

[0004] 2. Insufficient detection capability: Due to incomplete coverage, fingerprints constructed in this way may fail to detect parameter modifications to uncovered components. For example, an attacker might only tamper with a few specific attention heads in the model. This significantly reduces the fingerprint's discriminative power and reliability.

[0005] Therefore, overcoming the limitations of the detection range of a single prompt word and designing an intelligent prompt word selection strategy to maximize the coverage of the key functional areas of the model with the fewest prompt words, thereby constructing a compact, efficient and highly discriminative model fingerprint, is a technical problem that urgently needs to be solved in this field. Summary of the Invention

[0006] (a) Technical problems to be solved The present invention aims to solve the problems of low efficiency in model fingerprint construction, incomplete coverage of internal components of the model, and insufficient fingerprint discrimination power in the prior art, and provides a fingerprint construction method and system that can maximize the coverage of key components of a large language model with the fewest prompt words.

[0007] (II) Technical Solution To address the aforementioned technical problems, embodiments of the present invention provide a method for constructing a large language model fingerprint based on the coverage of the maximum activated component, the method comprising the following steps: S100: Obtain an original large language model and a candidate set containing multiple candidate sensitive prompt words; the candidate sensitive prompt words all have a preset sensitivity to parameter modifications of the original large language model.

[0008] S200: For each candidate sensitive prompt word in the candidate set, determine the set of key components activated in the original large language model; the key components are a subset of parameters with preset functions in the model.

[0009] S300: Select a target number of sensitive prompt words from the candidate set to form a target prompt word set; the selection principle is to maximize the coverage of the key component set that is jointly activated by the target prompt word set.

[0010] S400: The target prompt word set and the expected output of each prompt word in the target prompt word set under the original large language model are used together to form the model fingerprint of the original large language model.

[0011] Furthermore, in step S200, the key components include at least one or more of the following: an attention head, a feed-forward network unit, and / or a residual connection component.

[0012] Further, in step S200, the method for determining whether a key component is activated includes: For an attention head, it is determined to be activated when the entropy value of its attention weight distribution is lower than a preset attention entropy value threshold. For a feedforward network unit, it is determined to be activated when its output value is higher than a preset output activation threshold. For residual connection components, they are considered activated when the ratio of the contribution value of their residual path to the contribution value of the main path is higher than a preset contribution threshold.

[0013] Furthermore, in step S300, the coverage maximization is a weighted coverage maximization, wherein different types of key components are assigned different importance weights.

[0014] Further, in step S300, the method for selecting the target prompt word set employs a greedy algorithm, which includes: Iteratively select sensitive prompt words from the candidate set and add them to the target prompt word set until the target number is met; in each iteration, select the candidate sensitive prompt word that can bring the maximum weighted coverage gain to the currently covered set of key components.

[0015] Furthermore, after step S400, the method further includes a step of evaluating the quality of the model fingerprint, wherein the evaluation metrics include at least: The coverage metric is used to quantify the proportion of coverage of the target prompt word set to all key components of the model; A sensitivity metric is used to quantify the average parameter sensitivity of the target prompt word set; A complementarity metric is used to quantify the degree of overlap between the target cue word sets on key activated components.

[0016] Another embodiment of the present invention provides a large language model fingerprint construction system based on maximum activation component coverage, the system comprising: The data acquisition module is used to acquire a raw large language model and a set of candidate sensitive prompt words.

[0017] The component activation analysis module is used to determine the set of key components activated in the original large language model for each candidate sensitive prompt word in the candidate set.

[0018] The prompt word selection module is used to select a target number of sensitive prompt words from the candidate set according to the principle of maximizing the coverage of key components, so as to form a target prompt word set.

[0019] The fingerprint generation module is used to combine the target prompt word set and its expected output under the original large language model to form the model fingerprint of the original large language model.

[0020] Furthermore, the prompt word selection module employs a greedy algorithm to iteratively select candidate sensitive prompt words that can bring the maximum weighted coverage gain. Beneficial effects

[0021] Compared with the prior art, the present invention has the following beneficial effects: 1. High efficiency in coverage: This invention transforms the fingerprint construction problem into an optimization problem of maximizing component coverage for the first time. Through an intelligent selection strategy, it ensures that each selected prompt word can cover new, undetected model regions to the greatest extent, thereby achieving the broadest coverage of the model with the fewest API calls and greatly improving verification efficiency.

[0022] 2. High discriminative power and reliability: Due to the extensive coverage of key components of the model, the fingerprint constructed by this invention can detect more diverse and localized parameter modifications for different functional components of the model, which significantly enhances the discriminative power of the fingerprint and the reliability of the verification results.

[0023] 3. Systematicity and Scalability: This invention provides a systematic fingerprint construction framework. By assigning weights to different components, the emphasis of the coverage strategy can be flexibly adjusted according to verification requirements. This method does not depend on a specific model architecture and can be easily extended to large language models of different types and sizes.

[0024] 4. Resource saving: By constructing a compact (i.e., fewer prompt words) and efficient fingerprint, this invention can significantly reduce the number of API calls and related computing resource consumption in actual black-box verification, thereby reducing the cost of model integrity verification. Attached Figure Description

[0025] Figure 1 This is a flowchart of a method for constructing a large language model fingerprint based on the maximum activation component coverage according to an embodiment of the present invention.

[0026] Figure 2 This is a structural block diagram of a large language model fingerprint construction system based on maximum activation component coverage according to an embodiment of the present invention.

[0027] Figure 3 yes Figure 1 A schematic diagram of a specific embodiment of the prompt word selection process in step S300 illustrates the selection process based on a greedy algorithm. Detailed Implementation

[0028] To make the objectives, technical solutions, and advantages of the present invention clearer, the present invention will be further described in detail below with reference to the accompanying drawings and specific embodiments.

[0029] Please see Figure 1 This illustrates the flow of a fingerprint construction method according to an embodiment of the present invention.

[0030] Step S100: Obtain the original model and the set of candidate sensitive prompt words.

[0031] This step is fundamental to the method. The device executing this method (which can be called the "fingerprint builder," such as a trusted third-party verification authority) first needs to obtain a trusted original large language model, such as Llama-70B, for the fingerprint to be built. It also needs a set of candidate sensitive prompt words. This set can be generated using the "Sensitive Cue Word Generation Method Based on Parameter Sensitivity Quantization" previously proposed by the applicant, or obtained through any other method capable of generating cue words sensitive to modifications of model parameters. The key is that the set... Each prompt word They all have the potential to detect modifications to model parameters.

[0032] Step S200: Identify the set of key components activated by each prompt word.

[0033] This step is one of the core technical points of the present invention, which aims to map the "detection capability" of each prompt word from a vague sensitivity value to the functional unit that has a specific impact on the model.

[0034] First, we need to define what the "key components" of the model are. In this embodiment, for the mainstream Transformer architecture, we define the key components as: Attention head: Responsible for capturing the relationships between different parts of the input sequence.

[0035] Feedforward network unit: responsible for performing nonlinear transformations on information.

[0036] Residual connection component: responsible for stable information transmission and effective gradient backpropagation.

[0037] Then, for the candidate set Each prompt word Through a forward propagation, it calculates which key components are activated. Whether a component is "activated" can be determined using quantifiable metrics and thresholds. For example: Attention head activation determination: Calculate the Shannon entropy of the attention weight distribution output by each attention head. If the entropy value is below a certain threshold... (For example, 70% of the uniformly distributed entropy value) indicates that the head's attention is highly focused, and we determine that it is activated. Low entropy means that the head is performing a specific function.

[0038] Feedforward network unit activation determination: Record the norm or mean of the output value of each feedforward network unit. If this value is higher than a certain threshold... (For example, the 95th percentile of all unit output values ​​in this layer) indicates that the unit is activated. A high output value means that the unit makes a significant contribution to the final result.

[0039] Through this process, we provide each prompt word Each generated a list of the key components it activated. .

[0040] Step S300:Select the target prompt word set based on the principle of maximum coverage.

[0041] Our goal is to select from the candidate set Select k prompt words to form a target prompt word set S, such that the union of all components activated by all prompt words in S (i.e., The goal is to make the maximum coverage as large as possible. This is a typical maximum coverage problem, which is an NP-hard problem.

[0042] In this embodiment, we use a weighted greedy algorithm to approximate the solution.

[0043] First, assign different importance weights to different types of components. For example, based on experience, we can consider the attention head (weight) as... ) compared to feedforward network units (weights) More importantly, they directly determine the flow pattern of information.

[0044] Then, perform a greedy choice, such as... Figure 3 As shown: 1. Initialize the target set S as an empty set, covering the component set. It is an empty set.

[0045] 2. Enter the loop and iterate a total of k times.

[0046] 3. In each iteration, iterate through all candidate prompts that have not yet been selected. .

[0047] 4. For each Calculate the "weighted coverage gain" it brings, that is, the coverage gain it activates but has not yet been covered. The sum of the weights of all the components contained in the collection: .

[0048] 5. Select the prompt word that provides the maximum weighted coverage gain. Add it to the target set S and activate its components. merged into In the collection.

[0049] 6. After the loop ends, set S is the set of target prompt words that we selected, containing k prompt words.

[0050] This greedy strategy ensures that each choice is optimal at the current step, efficiently expanding the coverage and avoiding the selection of prompts with overlapping functions.

[0051] The final step is to formally generate the model fingerprint. Model fingerprint It consists of two parts: Selected target prompt word set .

[0052] The expected output set of these prompt words under the original model ,in .

[0053] The final model fingerprint can be represented as a set of key-value pairs: This fingerprint will be stored for subsequent online verification. When a user needs to verify a cloud model, they simply query using the prompt words in S and compare the returned result with the expected output in O.

[0054] Please see Figure 2 This diagram illustrates a structural block diagram of a fingerprint construction system according to an embodiment of the present invention. The system can be deployed on a server and includes: Data acquisition module 10: responsible for loading the original large language model and the candidate sensitive prompt word set.

[0055] Component activation analysis module 20: responsible for executing the aforementioned step S200, performing forward propagation on each candidate prompt word, analyzing and outputting a list of its activated key components.

[0056] Prompt word selection module 30: responsible for executing the aforementioned step S300, internally implementing a weighted greedy algorithm to select the optimal set of target prompt words from the output of component activation analysis module 20.

[0057] Fingerprint generation module 40: responsible for executing step S400. It receives the target prompt word set from prompt word selection module 30, calls the original model to calculate the expected output, and combines the two into the final model fingerprint for storage or output.

[0058] The embodiments of this invention describe in detail how to systematically construct an efficient large language model fingerprint. By modeling the problem as a maximum activation component coverage problem and employing a greedy strategy for solving it, this invention can construct a compact and highly discriminative model fingerprint with extremely high efficiency, providing key technical support for ensuring the reliability of cloud AI services.

Claims

1. A method for constructing fingerprints of large language models based on maximum activation component coverage, characterized in that, include: Obtain a raw large language model and a candidate set containing multiple candidate sensitive prompt words; For each candidate sensitive prompt word in the candidate set, a set of key components activated in the original large language model is determined. The key components are a subset of parameters with preset functions in the original large language model. The key components include attention heads, feedforward network units, and / or residual connection components. The method for determining whether a key component is activated includes at least one of the following: when the entropy value of the attention weight distribution of an attention head is lower than a preset attention entropy threshold, the attention head is determined to be activated; when the output value of a feedforward network unit is higher than a preset output activation threshold, the feedforward network unit is determined to be activated; when the ratio of the residual path contribution value to the main path contribution value of a residual connection component is higher than a preset contribution threshold, the residual connection component is determined to be activated. From the candidate set, a target cue word set is selected according to the principle of maximizing coverage, so that the coverage of the key component set jointly activated by the target cue word set is maximized; as well as The target prompt word set, and the expected output of each prompt word in the target prompt word set under the original large language model, together constitute the model fingerprint of the original large language model.

2. The method according to claim 1, characterized in that, The coverage maximization is a weighted coverage maximization, in which different types of key components are assigned different importance weights.

3. The method according to claim 1 or 2, characterized in that, The method for selecting the target prompt word set employs a greedy algorithm, which in each iteration selects candidate sensitive prompt words that can bring the maximum coverage gain to the currently covered set of key components.

4. The method according to claim 1, characterized in that, The method also includes a step of evaluating the quality of the model fingerprint, wherein the evaluation metrics include: coverage metrics and / or complementarity metrics.

5. A large language model fingerprint construction system based on maximum activation component coverage, characterized in that, include: A data acquisition module is used to acquire an original large language model and a set of candidate sensitive prompt words; A component activation analysis module is used to determine, for each candidate sensitive prompt word in the candidate set, a set of key components activated in the original large language model. The key components are a subset of parameters with preset functions in the original large language model. The key components include attention heads, feedforward network units, and / or residual connection components. The component activation analysis module is configured to determine whether a key component is activated according to at least one of the following methods: when the entropy value of the attention weight distribution of an attention head is lower than a preset attention entropy threshold, the attention head is determined to be activated; when the output value of a feedforward network unit is higher than a preset output activation threshold, the feedforward network unit is determined to be activated; when the ratio of the residual path contribution value to the main path contribution value of a residual connection component is higher than a preset contribution threshold, the residual connection component is determined to be activated. A prompt word selection module is used to select a target prompt word set from the candidate set based on the principle of maximizing the coverage of key components; as well as A fingerprint generation module is used to combine the target prompt word set and its expected output under the original large language model to form the model fingerprint of the original large language model.

6. The system according to claim 5, characterized in that, The prompt word selection module is configured to use a greedy algorithm to iteratively select candidate sensitive prompt words that can bring the maximum weighted coverage gain, so as to maximize the weighted coverage.

Images