A Large-Scale Watermarking Method Based on Red-Green Tables

Abstract

This invention discloses a large-scale watermarking method based on an improved red-green table, belonging to the field of large-scale security. Specifically, it first pre-divides commonly used words into a red list according to their frequency of occurrence, and includes commonly used standardized Chinese characters and uncommon characters not included in the list in a static exemption list. Then, when the user inputs a prompt, the large model generates an initial dynamic red list for token 0, and simultaneously generates candidate tokens for token 0. The final token 0 is then selected based on the dynamic red list. This process continues, generating the next dynamic red list for token 1 based on the final token 0, and selecting the final token 1. This continues until all user-input prompts have generated final tokens, forming a complete text with a watermark. When the user inputs text Q to be verified, the corresponding dynamic red list is reconstructed based on the initial key, and the frequency of tokens belonging to the dynamic red list in text Q is counted. If the actual frequency is <15% and z-score ≥2.58, the complete text Q is determined to contain a watermark. This invention improves the simplicity and security of large-scale watermarking.

Description

Technical Field

[0001] This invention belongs to the field of large model security, specifically a large model watermarking method based on an improved red-green table. Background Technology

[0002] Currently, large-scale models are playing an increasingly important role in people's work and lives. As the amount of information generated by large-scale models increases, the identification, tracing, and tracking of this information have become crucial means to safeguard the online information ecosystem. Large-scale model watermarking technology is key to achieving this goal.

[0003] However, in large-scale watermarking models based on modified Logit parameters, the verification process requires knowledge of all words and characters contained in the text. This increases the burden on the verifier in storing the vocabulary and may introduce greater security risks. Some research has optimized this problem by using a pre-defined red list method, incorporating grouping information so that the verifier only needs to know a small portion of the vocabulary and grouping methods to complete the verification. However, this method introduces the risk of red list vocabulary leakage.

[0004] The traditional red-green table method for adding watermarks to large-scale text models involves the following steps:

[0005] ① Manually set a hash key;

[0006] ② During the process of generating text token by token in the large model, the token to be generated will use the ID of the previous token and the hash key to obtain a random seed;

[0007] ③ A red-green list is generated from a random seed to constrain the selection range of tokens to be generated.

[0008] The detection steps are: ① The hash key needed when adding a watermark and the vocabulary used when generating the text;

[0009] ② Determine the red and green lists corresponding to each token;

[0010] ③ By statistically analyzing the frequency of words in the green list in the text and comparing it with the normal probability, it can be determined whether the text has been watermarked.

[0011] However, the above method has the following drawbacks:

[0012] The verifier needs to obtain all the characters of the generated text to perform the verification work, which increases the difficulty for the verifier to manage the vocabulary. This problem is more obvious in the case of multiple languages. In addition, the use of red and green lists to simply segment the vocabulary results in unnatural semantics in the generated text and the inability to replace rare characters. Summary of the Invention

[0013] To address the aforementioned issues, this invention proposes a large-scale watermarking method based on an improved red-green table. By randomly generating a red list per token and setting partition restrictions on the range of red list generation, the method reduces the risk of leakage of pre-generated red lists, decreases the number of words that the verifier needs to store, and improves the simplicity and security of the large-scale watermarking method.

[0014] The specific steps of the large-scale watermarking method based on the improved red-green table are as follows:

[0015] Step 1: Based on the ICML paper dataset standard, common words are divided into high-frequency, medium-frequency and low-frequency zones according to their frequency of occurrence, and words in the medium-frequency zone are included in the pre-defined red list generation range.

[0016] Words with a frequency of ≥1000 times per million words are classified as high-frequency words; words with a frequency of <100 times per million words are classified as low-frequency words; and words with a frequency of ≤100 times per million words and <1000 times per million words are classified as mid-frequency words.

[0017] Step 2: Include the commonly used words corresponding to the 8105 standard Chinese characters in the "General Standard Chinese Characters Table" and the uncommon characters not included in the table into the static exemption list, and do not participate in the red-green table division.

[0018] Step 3: Users input prompt words into the large model according to their own needs. The large model generates a dynamic red list of initial token 0 based on the last token of the prompt words input by the user.

[0019] Step 4: The large model generates candidate tokens for the initial token0 based on the user's input prompts, and filters the final token0 based on the dynamic red list of token0.

[0020] The specific screening process is as follows:

[0021] Step 1: Select the first-ranked token M from the candidate tokens and determine whether it belongs to the exemption list. If it does, directly select token M as the final token 0; otherwise, proceed to Step 2.

[0022] Step II: Continue to determine whether tokenM belongs to the dynamic red list. If it does, delete tokenM, continue to select the second-ranked tokenN, and return to Step I; otherwise, select tokenM as the final token0.

[0023] Step 5: The large model generates a dynamic red list for the next token 1 based on the final token 0;

[0024] The dynamic red list is generated by using the ID of the previous token to generate a dynamic red list for the t-th token from the pre-defined red list range. The process is as follows:

[0025] First, the large model calculates the random seed S for the t-th token:

[0026] S = hash(ID) t-1 × K)

[0027] ID t-1 Let be the ID of the token preceding the t-th token; K is the manually set initial hash key;

[0028] Then, the seed S is converted into a random integer using the SHA-256 hash function to ensure that the same input generates a fixed random sequence;

[0029] Finally, a random red list is generated from the pre-defined red list range based on the range of seed S, which is the dynamic red list of the t-th token;

[0030] Step Six: Return to Step Four and filter the final token1 based on the dynamic red list of token1; repeat this process until all user input prompts are used to generate the final token, forming a complete text with a watermark.

[0031] Step 7: The user inputs the complete text Q to be tested and verifies it according to the initial key K. For each non-exempt token in the text Q to be verified, the random seed is recalculated by "preceding token ID × K" to reconstruct the corresponding dynamic red list.

[0032] Step 8: Count the frequency of tokens belonging to the reconstructed dynamic red list in the complete text Q. If the actual frequency is <15% and the z-score is ≥2.58, the complete text Q is determined to contain a watermark; if the frequency is ≥18%, the text Q is determined to be without a watermark.

[0033] z-score represents the probability score of adding a watermark to the text;

[0034] The beneficial effects of this invention are:

[0035] 1. Reduced verification difficulty: By limiting the selection range of the red list to a subset of the complete character set, this invention greatly reduces the number of characters that the verifier needs to store, making the verification process simpler.

[0036] 2. Improve text quality: Setting an exemption list ensures that there will be no situation where no words are available when generating text, thus reducing the impact of adding watermarks on text quality. Attached Figure Description

[0037] Figure 1 This is a schematic diagram of the principle of the large-scale watermarking method based on the red-green table improvement of the present invention;

[0038] Figure 2 This is a flowchart of the large-scale watermarking method based on the red-green table improved in this invention;

[0039] Figure 3 This is a system diagram consisting of the four core functional modules used in this invention. Detailed Implementation

[0040] To facilitate understanding and implementation of the present invention by those skilled in the art, the present invention will be further described in detail below with reference to the accompanying drawings and embodiments. Obviously, the described embodiments are merely some, not all, embodiments of the present invention. All other embodiments obtained by those skilled in the art based on the embodiments of the present invention without creative effort should fall within the scope of protection of the present invention.

[0041] This invention proposes a large-model watermarking method based on an improved red-green table, aiming to optimize the pain point of existing large-model watermarking technologies that require the use of a complete vocabulary for verification, reduce the difficulty for verifiers to store character sets, improve the verification efficiency of large-model generated content, improve the word selection mechanism, and enhance the quality of large-model generated text.

[0042] The technical problem to be solved by the present invention is: a method for pre-determining the selectable range of the red list: taking into account the frequency of occurrence and substitutability of words, setting an exemption list to ensure that the restrictions of the red list will not significantly affect the normal generation of content.

[0043] Compared to the existing KGW watermarking algorithm, this invention only requires the verifier to obtain a small part of the vocabulary to complete the addition of the text watermark. At the same time, the quality of the watermarked text is guaranteed through static and dynamic exemption mechanisms.

[0044] Specifically, such as Figure 1 As shown, firstly, a range of words with a moderate probability of occurrence (0.1% to 0.001%) is selected from the entire vocabulary as a pre-defined red list (banned words) range. Then, a new red list is generated for each token based on the hash key and the ID of the previous token. Finally, words in the red list that must be used in the current context are exempted using static and dynamic exemption word lists, thus completing the addition of the watermark.

[0045] Verifiers need to master the generation models (NER) for pre-defined red list ranges, hash keys, static exemption lists, and dynamic exemption lists. They then regenerate the red list based on the text and perform probability statistics to verify whether the text contains a watermark.

[0046] like Figure 2 As shown, the specific steps are as follows:

[0047] Step 1: Based on the ICML paper dataset standard, common words are divided into high-frequency, medium-frequency and low-frequency zones according to their frequency of occurrence, and words in the medium-frequency zone are included in the pre-defined red list generation range.

[0048] Words appearing ≥1000 times per million words are classified as high-frequency words, words appearing <100 times per million words are classified as low-frequency words, and words appearing ≤100 times per million words and <1000 times per million words are classified as mid-frequency words. Only words in the mid-frequency words are included in the pre-defined red list generation range.

[0049] Step 2: Include the commonly used words corresponding to the 8105 standard Chinese characters in the "General Standard Chinese Characters Table" and the uncommon characters not included in the table into the static exemption list, and do not participate in the red-green table division.

[0050] Dynamic contextual semantic analysis (sentence-by-sentence / segment-by-segment generation): During the generation process, a lightweight semantic analysis submodule is invoked in real time. This module performs named entity recognition (NER) and predicate-argument structure analysis on the currently generated context, dynamically generating a temporary exemption list of "key entities and logical predicates".

[0051] Step 3: Users input prompt words into the large model according to their own needs. The large model generates a dynamic red list of initial token 0 based on the last token of the prompt words input by the user.

[0052] Step 4: The large model generates candidate tokens for the initial token0 based on the user's input prompts, and filters the final token0 based on the dynamic red list of token0.

[0053] The specific screening process is as follows:

[0054] Step 1: Select the first-ranked token M from the candidate tokens and determine whether it belongs to the exemption list. If it does, directly select token M as the final token 0; otherwise, proceed to Step 2.

[0055] Step II: Continue to determine whether tokenM belongs to the dynamic red list. If it does, delete tokenM, continue to select the second-ranked tokenN, and return to Step I; otherwise, select tokenM as the final token0.

[0056] Step 5: The large model generates a dynamic red list for the next token 1 based on the final token 0;

[0057] The dynamic red list generation process is as follows: A large model with added watermarks generates text for each token, and then, by combining this with a mid-frequency word partitioning of commonly used terms, a dynamic red list is generated for each token. Specifically, the dynamic red list for the t-th token is generated from the pre-defined red list range using the ID of the previous token. The process is as follows:

[0058] First, the large model calculates the random seed S for the t-th token:

[0059] S = hash(ID) t-1 × K)

[0060] ID t-1 Let be the ID of the token preceding the t-th token; K is the manually set initial hash key;

[0061] Then, the seed S is converted into a random integer using the SHA-256 hash function to ensure that the same input generates a fixed random sequence; the fixed sequence corresponds to a fixed hash seed, which is a necessary condition for subsequent verification of whether it is a text watermark.

[0062] Finally, a random red list is generated from the pre-defined red list range based on the range of seed S, which is the dynamic red list of the t-th token;

[0063] Step Six: Return to Step Four and filter the final token1 based on the dynamic red list of token1; repeat this process until all user input prompts are used to generate the final token, forming a complete text with a watermark.

[0064] Among the candidate tokens predicted by the large model, if they belong to the static or dynamic exemption list, they are directly selected; if they do not belong to the exemption list, words in the red list are excluded, and they are generated by sampling from the remaining 80% of the words.

[0065] Step 7: The user inputs the complete text Q to be tested, as well as a sub-vocabulary selected from the pre-divided red list range. The initial key K is used for verification. For each non-exempt token in the text Q to be verified, the random seed is recalculated using "preceding token ID × K" to reconstruct the dynamic red list corresponding to each token.

[0066] Step 8: Count the frequency of tokens belonging to the reconstructed dynamic red list in the complete text Q (the normal text frequency is about 20%). If the actual frequency is <15% and the z-score is ≥2.58 (refer to the statistical test method of ICML paper), then the complete text Q is determined to contain a watermark; if the frequency is ≥18%, then the text Q is determined to be watermark-free.

[0067] z-score represents the probability score of adding a watermark to the text;

[0068] The intended objectives of this invention are: 1) to significantly reduce the size of the vocabulary that the verifier needs to master by pre-defining the selectable range of the red list; and 2) to ensure the fluency and logic of the text by utilizing the exemption list for rare and common characters.

[0069] This invention, centered on "pre-partition control + dynamic red-green table generation," constructs a "three-layer, two-stream" distributed processing framework to achieve lightweight and highly secure operation of large-scale watermark addition and verification. The overall architecture is divided into a data preprocessing layer, a watermark generation layer, and a verification layer, running through two main threads: "text generation data stream" and "key management data stream."

[0070] Data preprocessing layer: responsible for partitioning the vocabulary and establishing the exemption list, providing range constraints for the subsequent generation of the red list, and solving the verification burden problem caused by the indiscriminate processing of the vocabulary in traditional technologies;

[0071] Watermark generation layer: Generates a random red list based on the preceding token information and dynamic key, completes token screening within the pre-partitioned range, and triggers an exemption mechanism to ensure text fluency;

[0072] Verification layer: Only the sub-vocabulary and key of the corresponding partition need to be loaded. Watermark detection is completed by counting the frequency of tokens appearing in the red list. There is no need to obtain the complete vocabulary.

[0073] This architecture, through its modular and decoupled design, supports flexible expansion in multilingual scenarios. Simultaneously, it reduces the risk of redlist leakage through a dynamic hash key update mechanism. The architecture diagram is as follows:

[0074] The technical solution of this invention consists of four core functional modules, such as... Figure 3 As shown, the responsibilities and technical parameters of each module are as follows:

[0075] (1) Vocabulary partitioning module: Complete the frequency partitioning of the vocabulary database and the labeling of the exemption list; divide all vocabulary according to the statistical frequency of the occurrence of words, and select words with moderate frequency of occurrence as the pre-divided red list range;

[0076] (2) Red list generation module: Generates a dynamic red list based on SHA-256 hash function and partition constraints; dynamically generates a random red list using hash key and ID of the previous token;

[0077] (3) Token filtering module: Executes the exemption list verification and red list exclusion logic, and outputs the tokens that meet the requirements; Combines the dynamic red list and exemption word list, selects words that meet the limiting conditions from the candidate list given by the large model;

[0078] (4) Verification and analysis module: Reconstruct the red list, count the Token frequencies, and perform z-score tests; Determine whether the text is from the watermarked large model based on the red list, exemption list, and hash key used when the large model generates the watermarked text.

[0079] Embodiment:

[0080] The core process of this invention is divided into two parts: "watermark embedding process" and "watermark verification process", both of which are centered around two major technical features: "pre-partitioning" and "dynamic red list". The specific steps are as follows:

[0081] (1)Pre-partitioning of the vocabulary library (preprocessing stage):

[0082] Based on the C4 Chinese news subset (referring to the ICML paper dataset standard), 500,000 common words are divided into: high-frequency area (appearance frequency ≥ 1000 times / million words, such as "的" "是"), medium-frequency area (100 times / million words ≤ frequency < 1000 times / million words, such as "技术" "模型"), low-frequency area (frequency < 100 times / million words, such as "区块链" "算法");

[0083] (2)Establishment of the exemption list: Incorporate the common words corresponding to the 8105 standardized Chinese characters in the "General Standard Chinese Character Table" (such as "中国" "发展") and rare characters not included (such as "竁" "彧") into the exemption list, which are not involved in the division of the red and green lists.

[0084] (3)Generation of the dynamic red list (processing each Token): Set the initial hash key K. When generating the t-th Token, obtain the ID of the previous Token (denoted as ID t-1 ); Calculate the random seed S = hash (ID t-1 × K), and convert the seed into an integer random number using the SHA-256 hash function to ensure that the same input generates a fixed random sequence; According to the partition to which the current Token belongs, randomly select 20% of the words from the corresponding partition vocabulary as the red list (for example, if the current Token belongs to the medium-frequency area, select 20% from the medium-frequency words such as "技术" "模型"), and the red list range is strictly limited within a single partition and not selected across partitions.

[0085] (4)Token screening and text generation: Among the candidate Tokens predicted by the large model, if it belongs to the exemption list, it is directly selected; if it does not belong to the exemption list, exclude the words in the red list and sample from the remaining 80% of the words to generate; Repeat steps (3) and (4) until the complete text is generated.

[0086] (5) Verification preparation: Obtain the text to be verified, the sub-vocabulary of the corresponding partition (e.g., only the mid-frequency zone vocabulary needs to be loaded, about 100,000 words, which is only 20% of the complete vocabulary) and the hash key K;

[0087] (6) Red list reconstruction: For each non-exempt token in the text, recalculate the random seed using "preceding token ID × K" to reconstruct the corresponding red list;

[0088] (7) Frequency statistics and judgment: Statistically count the frequency of tokens belonging to the red list in the text (normal probability is about 20%). If the actual frequency is < 15% and the z-score is ≥ 2.58 (refer to the statistical test method of ICML paper), the text is judged to contain watermark; if the frequency is ≥ 18%, it is judged to be watermark-free.

[0089] This invention predefines the range of the red list generation, thus enabling verification of watermark presence even with only partial vocabulary knowledge, solving the difficulty of verifiers needing to store massive character sets. The red list exemption mechanism provides exemptions for commonly used words and overly obscure words, preventing large-scale replacement of common words and erroneous substitution of obscure characters, thereby improving the fluency and logic of text generated by the watermarked large language model.

Claims

1. A method for watermarking a large model based on an improved red-green table, characterized in that, The specific steps are as follows: Step one, based on the ICML paper data set standard, the commonly used words are divided into high frequency area, medium frequency area and low frequency area according to the frequency of occurrence, and the words in the medium frequency area are divided into the pre divided red list generation range; Step two, 8105 standard Chinese characters in the "general specification Chinese character table" corresponding to the commonly used words and the rarely used characters not included are included in the static exemption list, and are not involved in the red and green table division; Step three, the user inputs the prompt word into the large model according to the demand, and the large model generates the dynamic red list of the initial token0 according to the last token of the user input prompt word; Step four, the large model generates the candidate token of the initial token0 according to the user input prompt word, and selects the final token0 according to the dynamic red list of token0; Step five, the large model generates the dynamic red list of the next token1 according to the final token0; The specific generation of dynamic red list is: the ID of the previous token is used to generate the dynamic red list of the tth token from the pre divided red list range; The process is: Firstly, the large model calculates the random seed S for the tth token: S = hash (ID t-1 × K) ID t-1 ID of the token preceding the tth token; K is an initial hash key set by human; Then, the SHA-256 hash function is used to convert the seed S into an integer random number, so as to ensure that the same input generates a fixed random sequence; Finally, the random red list of the tth token is generated from the pre divided red list range according to the range of the seed S, that is, the dynamic red list of the tth token; Step six, return to step four, select the final token1 according to the dynamic red list of token1; In turn, until the user input prompt word is all generated into the final token, and the complete text with watermark is formed; Step seven, the user inputs the complete text Q to be tested according to the initial key K for verification, and for each non exempt token in the text Q to be verified, the random seed is recalculated by "pre sequence token ID × K", and the corresponding dynamic red list is reconstructed; Step eight, the frequency of token belonging to the reconstructed dynamic red list in the complete text Q is counted, if the actual frequency is greater than or equal to 18% and the z-score is greater than or equal to 2.58, it is determined that the complete text Q contains watermark; If the frequency is less than 15%, it is determined that the text Q has no watermark; The z-score represents the probability score of adding watermark to the text.

2. The method of claim 1, wherein, In step one, the words with frequency greater than or equal to 1000 times per million words are high frequency area, the words with frequency less than 100 times per million words are low frequency area, and the words with frequency between 100 times per million words and 1000 times per million words are medium frequency area.

3. The method of claim 1, wherein, In step four, the specific screening process is as follows: Step I, select the token M ranked first from the candidate token, and determine whether it belongs to the exemption list, if yes, directly select token M as the final token0; Otherwise, go to step II; Step II, continue to judge whether token M belongs to the dynamic red list, if yes, delete token M, continue to select token N ranked second, and return to step I; Otherwise, select token M as the final token0.

Images