A watermark embedding and detection method, system, storage medium and product for large language model generated text

Abstract

This invention discloses a method, system, storage medium, and product for watermark embedding and detection of text generated by a large language model, belonging to the field of artificial intelligence technology. It addresses the inherent contradiction between semantic preservation capability and watermark signal strength in existing technologies. The invention includes: in the watermark generation stage, embedding the watermark signal into the text generated by the large language model using word partitioning based on the probability ranking of the large language model output and hard-constraint sampling; in the watermark detection stage, determining whether the embedded text carries a watermark through positional evidence construction, multi-scale sliding window statistical testing, and multiple verification correction, and outputting the determination result under a given overall false alarm control level. This invention is used for watermark embedding and detection of text generated by a large language model.

Description

Technical Field

[0001] A method, system, storage medium, and product for watermark embedding and detection of text generated by large language models are disclosed. This invention relates to the interdisciplinary fields of artificial intelligence, natural language processing, and information security, specifically a method, apparatus, device, and system for watermark embedding and detection of text generated by large language models. Background Technology

[0002] Large-scale language models are a class of natural language processing models built using deep learning techniques, typically employing the Transformer neural network structure. These models learn the statistical features and semantic rules of language through unsupervised or self-supervised training on large-scale corpora, thereby acquiring the ability to understand, generate, and reason about natural language.

[0003] The core idea of ​​the KGW method is: in the model generation stage, by performing a reproducible pseudo-random partition of the vocabulary and applying a bias to a portion of the words in the logit space, a weak but detectable statistical signal is embedded in the generated text; in the detection stage, the same hashing method is used to reconstruct the partition, and the text is then subjected to a saliency test to determine whether it contains a watermark.

[0004] At time step The KGW method depends on the context. Generate a random seed to apply to the vocabulary. The list is randomly divided, with the green list accounting for [percentage missing]. The red list contains [number] words. Each word. To address generation bias in low-entropy cases, a bias is added to the green set in the logits space. This increases the probability of the tokens being sampled, making the model more inclined to generate tokens from the green vocabulary. The resulting text will exhibit a slight but detectable statistical shift overall.

[0005] During the detection phase, it is assumed that the word-level statistics follow a Gaussian distribution, and the following is proposed:

[0006] Null hypothesis The text was not watermarked (i.e., it was not in the green list). (Apply bias on). At position The hit indicator is defined as follows:

[0007]

[0008] in, Indicates the generated first indivual , Indicates the location The green set constructed according to the given partitioning strategy, For the green hit indicator variable at this position: when hour, ;otherwise Given the same partitioning strategy, we have:

[0009]

[0010] in, Represents mathematical expectation, Represents the probability of an event occurring.

[0011] Based on the above definition, the overall statistic can be obtained by taking the average green hit rate of the entire text:

[0012] in, For the total of text number, For the first The green hit indicator variable for each position.

[0013] If we assume that the hit events at each position are approximately independent, then according to the central limit theorem, The distribution of approximately follows a normal distribution:

[0014]

[0015] in, The mean is variance is It follows a normal distribution.

[0016] After the distribution approximately follows a normal distribution, the one-tailed test is defined accordingly. The statistic is:

[0017]

[0018] like Value exceeds significance threshold Then reject the null hypothesis. If the text contains a statistical offset generated by the watermarking model, it is determined that the text contains a watermark; otherwise, it is considered that no watermark was detected.

[0019] The advantage of this method is that detection can be completed using only text, without accessing model parameters or the generation process. This is achieved by adjusting the green ratio. With bias strength This approach achieves a balance between watermark detectability and text readability. Furthermore, this statistical significance-based testing framework provides a theoretical foundation for subsequent robustness analysis and multi-partition expansion methods.

[0020] With the widespread application of large language models in text generation, embedded watermarking technology during the inference stage has gradually become an important technique for identifying model-generated content. This type of method typically applies a controlled bias to the sampling probability of candidate words during the model decoding process, making the generated text exhibit detectable distribution characteristics in an overall statistical sense, thereby enabling the determination of the source of the generated content. Among these, watermarking schemes based on random vocabulary partitioning are representative. These methods randomly partition the vocabulary before generation, dividing it into several subsets, and then apply probability enhancement or suppression strategies to specific subsets during the decoding stage, making certain types of watermarks in the generated text more detectable. The proportion produces an observable offset.

[0021] These methods theoretically possess advantages such as simple implementation, low coupling between the embedding process and model structure, and the ability to achieve statistical significance through sample accumulation in medium-to-long text scenarios. However, in practical deployments, especially in complex generation tasks or low-entropy generation scenarios, existing methods have gradually revealed structural flaws.

[0022] The existing technology has the following main problems:

[0023] (1) In low-entropy or strongly constrained generation scenarios, the model output distribution is highly concentrated, and the number of candidate words is limited. In this case, if the subset is still randomly sampled or forcibly biased according to the preset partition, the model may be forced to choose a non-optimal high-probability word. This can lead to semantic shifts, logical inconsistencies, or unnatural expressions. This problem is particularly pronounced in code generation, formula generation, or specialized text generation tasks.

[0024] (2) To mitigate the semantic corruption problem, some existing methods choose to reduce the bias strength or relax the sampling restrictions, applying only a slight bias between candidate words with similar probabilities. While this strategy improves the naturalness of the text to some extent, it also weakens the watermark signal strength, making the statistical bias less obvious. When the text length is limited or there are perturbations such as deletion or rewriting, the detection statistics are difficult to reach a significant level, thus reducing the success rate of the test and resulting in insufficient detection power under strict false alarm rate constraints.

[0025] In summary, the existing technology has the following technical problems:

[0026] 1. In the watermark generation stage, there is an inherent contradiction between the "semantic preservation ability" and the "watermark signal strength" of existing technologies. That is, if the bias is too strong, it will affect the text quality, and if the bias is too weak, it will reduce the detection stability. Under different generation tasks and different entropy levels, this contradiction is difficult to balance at the same time.

[0027] 2. In the watermark generation and watermark detection stages, the existing random partitioning mechanism does not consider the semantic structure characteristics in the vocabulary segmentation stage, which may lead to a lack of high semantic quality candidates in some subsets. That is, when the decoding process is restricted to a certain subset, the model's selection space is artificially compressed, thus affecting the overall expression quality. This problem cannot be completely compensated by a single sampling strategy, but is caused by insufficient structural design in the partitioning stage.

[0028] 3. In the watermark detection stage, the detection accuracy of existing technologies is insufficient. This is mainly manifested in the lack of a sufficiently clear statistical boundary between watermarked text and non-watermarked text. That is, due to the limited strength and stability of the watermark signal constructed by existing methods, the distribution of detection statistics on the two types of text overlaps significantly, which easily leads to insufficient discrimination ability.

[0029] 4. In the watermark detection stage, existing technologies generally suffer from a high false alarm rate. That is, some naturally generated text that does not embed a watermark may be incorrectly judged as containing a watermark because its local probability distribution or sampling results are accidentally close to the statistical characteristics of a watermark. This problem will directly weaken the credibility of the detection conclusion and limit the stability of the application of related methods in real-world scenarios.

[0030] 5. In the watermark detection stage, the existing technology is still not robust enough in the face of watermark attacks such as random rewriting, content deletion, synonym replacement or partial reconstruction. Since the original watermark signal usually depends on a specific position or local statistical offset, once the surface form of the text is disturbed, the original detection features are easily weakened or even destroyed, resulting in a significant decrease in detection performance, which is difficult to meet the actual needs in complex open environments. Summary of the Invention

[0031] To address the problems mentioned above, the present invention aims to provide a method, system, storage medium, and product for watermark embedding and detection of text generated from large language models, thereby resolving the inherent contradiction between "semantic preservation capability" and "watermark signal strength" in existing technologies.

[0032] To achieve the above objectives, the present invention adopts the following technical solution:

[0033] A method for watermark embedding and detection of text generated by a large language model includes the following steps:

[0034] In the watermark generation stage, based on the prompt words, the vocabulary partitioning method of the output probability of the large language model and the hard constraint sampling method are used to embed the watermark signal into the generated text.

[0035] During the watermark detection stage, the system determines whether the embedded text carries a watermark by constructing location-level evidence, performing multi-scale sliding window statistical tests, and applying multiple tests and corrections. The system then outputs the determination result under a given overall false alarm control level.

[0036] Furthermore, the specific steps of step 1 are as follows:

[0037] Step 1.1: Analyze the prompt words. Perform word segmentation and encoding to obtain the initial sequence:

[0038]

[0039] in, Represents the initial sequence, It is a prompt word book The word segmentation encoding operation means that the prompt word is encoded. Turn to sequence;

[0040] Step 1.2: Loop decoding, that is, repeating the decoding steps. to Repeat execution:

[0041] Step 1.21, when At that time, the initial sequence Input a large language model and get the corresponding Vector, and take the last position. vector:

[0042]

[0043] in, The large language model representing the generation task to be performed can be any autoregressive model, specifically including... Model, express The last position of each decoding step vector;

[0044] Step 1.22, based on In Scores ranked from highest to lowest for the vocabulary list Sort the results to get the first... The last position of each decoding step Sort, represented as:

[0045]

[0046] in, Indicates the result after descending order sequence, Indicates the first one That is, the one with the highest probability at present. , Indicates the first indivual That is, the one with the lowest probability. , This indicates the size of the vocabulary, which is an optional fragment dictionary in a large language model.

[0047] Step 1.23: Before retaining the results obtained in Step 1.22. indivual A set of guardians is represented as:

[0048]

[0049] in, Indicating the guardian set Number, Indicates time step The first in the collection of time guardians indivual ;

[0050] Step 1.24: Based on the truncation function Outside the central guardian group Perform a truncation operation to determine the cutoff ranking of the head region, and then divide the head region based on the cutoff ranking of the head region. and tail area ;

[0051] The formula for determining the cutoff ranking in the top region is:

[0052]

[0053] Head area and tail area The representation is:

[0054]

[0055] This represents a truncation function, used to restrict input values ​​to a given range. This indicates the parameter representing the proportion of the head region. This indicates the lower bound of the head region's size. This indicates the upper bound of the head region's size. express The first one included in the head region indivual , The first one that is entered into the head area indivual , This indicates the final determined size of the head region;

[0056] Step 1.25: Determine the target size of the green set and allocate it to the head region based on the target size of the green set. and tail area The quota, the target size of the green set is:

[0057]

[0058] in, , indicating the strength of the control constraint;

[0059] Assigned to head region The quota is:

[0060]

[0061] Assigned to tail region The quota is:

[0062]

[0063] in, This indicates that the green set is controlled in the head region. The proportion;

[0064] Step 1.26, in the head region and tail area If subsets are drawn uniformly without replacement and merged into a green set, then:

[0065]

[0066] And construct

[0067]

[0068] in, Indicates the first The green color selected from the head region in each decoding step gather, This indicates that the quota is calculated from the head region. The operation involves uniformly selecting subsets without replacement. Uniform selection means that all subsets that meet a given size requirement are selected with equal probability. Indicates from the head region Select quantity from, Indicates the first The green area selected from the tail region in each decoding step gather, Indicates quota from the tail region Perform a uniform sampling operation without replacement to obtain a subset. Indicates from the tail region Green selected from quantity, In the first The generation phase only samples the next step from the probability distribution corresponding to the set of green elements allowed to be sampled in each decoding step. ;

[0069] Step 1.27: Hard constraint shields non-green sets That is, for all ,make:

[0070]

[0071] in, Indicates the first in the vocabulary list indivual Location Indicates the first The last position of each decoding step The first in the vector indivual Score;

[0072] Step 1.28: Sampling distribution under hard constraints and sampling the next... That is, the result obtained in step 1.27 The above adopts The processing formula is:

[0073]

[0074] based on Obtain the overall probability and perform sampling:

[0075]

[0076] The sampled Append to the current sequence The end:

[0077]

[0078] in, Indicates the first In the decoding step, the first indivual The probability corresponding to the hard-constrained sampling distribution. Indicates the first All in each decoding step The overall probability under a hard-constrained sampling distribution Indicates the first The last position of each decoding step The first in the vector indivual Score, This refers to the classification distribution, also known as the discrete classification probability distribution. This refers to the overall probability. Classification distribution of a single random sample Indicates the first The next sample obtained from the decoding steps If the current decoding step is or End of sequence If the condition is met, the loop terminates; otherwise, based on the updated condition... Repeat step 1.21 to proceed to the next decoding step;

[0079] Step 1.3: After the loop is completed, output the final generated sequence, which realizes the embedding of the watermark signal into the generated text.

[0080] Furthermore, the specific steps of step 2 are as follows:

[0081] Step 2.1: Text encoding, encoding the text to be tested. Encoded as sequence:

[0082]

[0083] Step 2.2, constructing location-level evidence, for Number of to :

[0084] Step 2.21, with prefix Inputting a large language model yields the corresponding vector, corresponding The vector is:

[0085]

[0086] Step 2.22: Following the same rules as the watermark generation stage... Reconstructing the green set ;

[0087] Step 2.23, calculate the first... indivual Does it fall into the green set? middle:

[0088]

[0089] in, It is an indicator function; if the following condition is true, the value is 1; otherwise, it is 0. indivual Falling into the green collection Then record Otherwise remember ;

[0090] Step 2.24, based on Calculate the probability mass of the original large language model distribution falling into the green set:

[0091]

[0092] in, yes vector The One component;

[0093] based on and Collected Evidence sequence of sequences:

[0094] ;

[0095] Step 2.3: Perform multi-scale sliding window testing and control the family error rate, specifically as follows:

[0096] Step 2.31: Define the window length set :

[0097]

[0098]

[0099] in, It is a non-negative integer index, used to enumerate different lengths, The step size representing the window length. Indicates the shortest window that can be considered. Indicates the longest window that can be considered;

[0100] For each length With sliding step size Enumerate the set of window start points:

[0101]

[0102] in, This indicates that when the window length is fixed... At that time, the set of all legal window starting points, Indicates the starting position index of a certain window;

[0103] Total number of tests:

[0104]

[0105] Step 2.32, for each window Calculation window Falling into the green collection Number of hits within:

[0106]

[0107] Step 2.33: Under the null hypothesis that the text to be tested originally does not contain a watermark, It follows a Poisson binomial distribution with the following parameters:

[0108]

[0109] Calculate the right tail The value is the probability of observing so many hits or even more hits under the null hypothesis.

[0110]

[0111] Step 2.34, based on the right tail value Correction yields the corrected value:

[0112]

[0113] Step 2.37: Determine the corrected result. Is the value less than the threshold? If yes, it means the text being tested contains a watermark; otherwise, it does not. The formula for determining this is:

[0114] .

[0115] A watermark embedding and detection system for text generated from a large language model is characterized by comprising a memory, a processor, and a computer program stored in the memory, wherein the processor executes the computer program to implement the steps of the watermark embedding and detection method for text generated from a large language model.

[0116] A computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, implements the steps of the watermark embedding and detection method for generating text from a large language model.

[0117] A computer program product includes a computer program that, when executed by a processor, implements the steps of the watermark embedding and detection method for generating text using a large language model.

[0118] Compared with the prior art, the beneficial effects of this invention are as follows:

[0119] I. This invention addresses the problem in existing technologies where it is difficult to simultaneously achieve both watermark signal strength and text semantic quality, by employing a method based on decoding steps. The dynamic vocabulary partitioning method of the sorting results retains high-probability words at each generation position. A guardian set is constructed, and the green set is constrained by the green set size parameter and the head proportion parameter. This ensures that the watermark embedding mainly acts on the sampled support set after structured screening, rather than applying an indiscriminate strong bias to the overall distribution. Thus, while ensuring the detectability of the watermark signal, the destruction of high semantic quality candidates is reduced, alleviating the contradiction in the existing technology that "the text quality decreases when the bias is enhanced, and the detection capability is insufficient when the bias is weakened", and achieving a balance between semantic preservation capability and watermark signal strength.

[0120] II. This invention proposes a method based on the decoding step in the watermark generation stage. The dynamic vocabulary partitioning mechanism for the sorting results arranges the valid words in descending order of probability at each generation position and constructs a three-segment structure consisting of a guardian set, a head region, and a tail region. This partitioning process is dynamically updated according to the context and does not use a fixed vocabulary partitioning method. A guardian set parameter is also set. Before each decoding step, the previous steps are fixed. High probability Ensure high semantic confidence candidates (i.e.) This ensures that samples can always be included, thus maintaining semantic stability during the embedding of watermarks (limited to the green and non-green sets). Specifically, a semantic balance mechanism is introduced during the vocabulary partitioning stage to ensure that each subset contains candidates with high semantic quality. This avoids limiting the semantic selection space due to set partitioning, ensuring stable text quality from the source.

[0121] Third, this invention utilizes the scale parameter of the green set in both the watermark generation and watermark detection stages. Head proportion parameters The total size of the green set and its proportion in the head region are constrained, and the green set is constructed by sampling without replacement and uniformly in the head and tail regions. This achieves a controllable design of the sampling support set structure, that is, while maintaining semantic quality, it achieves statistical signal embedding with sufficient strength, so that the watermark still has a high detection success rate under the condition of limited text length, and maintains stable verification effectiveness under the condition of controlled false alarm rate.

[0122] IV. In the watermark detection stage, this invention proposes a location-level evidence construction method, which reconstructs the green set at each location to form a hit indication sequence (i.e., based on...). The probability mass of the original large language model distribution falling into the green set is calculated, along with the corresponding theoretical probability mass sequence, providing a position-by-position statistical basis for subsequent statistical tests. A Poisson binomial distribution is used to accurately calculate the right-tail probability of the number of hits within the window, avoiding the use of an asymptotic normal approximation and improving detection accuracy under finite sample conditions. A multi-scale sliding window detection mechanism is introduced to perform statistical tests under different window lengths and starting points, and combined with... Correcting the family error rate makes the overall false alarm rate controllable under multiple testing scenarios. This involves combining more accurate detection statistical modeling methods to improve the reliability and interpretability of detection results in limited sample scenarios and reduce the deviation between the theoretical false alarm rate and the actual false alarm rate.

[0123] V. This invention addresses the problems of high false alarm rates and insufficient stability of detection conclusions in existing technologies. In the watermark detection stage, it not only constructs a hit indicator sequence but also further combines the theoretical probability quality of the green set at each position under the original model distribution. It uses a Poisson binomial distribution to accurately model the window hit count and integrates... By correcting and controlling the family error rate under multiple tests, the probability of naturally generated text being misjudged as watermarked text due to local random fluctuations can be effectively reduced, thereby improving the reliability of the detection results and the stability in practical applications.

[0124] VI. This invention addresses the insufficient robustness of existing technologies under attacks such as random rewriting, content deletion, synonym substitution, and local recombination. In the watermark detection stage, it combines positional evidence construction with multi-scale sliding window testing. Instead of relying on a single fixed watermark location, it statistically scans local segments of different lengths and starting points, selecting the most significant window for judgment. Therefore, even if the watermark signal at some locations is weakened or destroyed due to text perturbation, effective detection can still be achieved using the statistical offset in the remaining local areas, thereby improving the robustness of the method under complex open environments and attack conditions. Attached Figure Description

[0125] Figure 1 This is a flowchart of the watermark generation process in this invention;

[0126] Figure 2 This is a schematic diagram of the watermark detection process in this invention. Detailed Implementation

[0127] The present invention will now be further described in conjunction with the accompanying drawings and specific embodiments.

[0128] This invention proposes a method and system device for watermark embedding and detection of text generated by a large language model. In the generation stage (inference stage), the method embeds the watermark signal into the generated text through "vocabulary partitioning based on model output probability ranking + hard-constraint sampling"; in the detection stage, it determines whether the text carries a watermark through "position-level evidence construction + multi-scale sliding window statistical testing + multiple verification correction", and outputs the judgment result under a given overall false alarm control level. The technical solution of this invention consists of two core modules: a generation module and a detection module. The generation module constructs a green set that allows sampling in each decoding step, and performs watermark detection on candidates from non-green sets. The sampling distribution is masked so that it only supports the green set; the detection module replays the generated rules without changing the text to be tested, constructs a statistical evidence sequence position by position, and then performs statistical tests on local segments with different window lengths and different starting points, and uses... Correction control family error rate (Family-Wise Error Rate) The final output includes whether it contains a watermark, the position of the most significant window, and the corresponding salience level.

[0129] A method for watermark embedding and detection of text generated by a large language model includes the following steps:

[0130] In the watermark generation stage, based on the prompt words, the vocabulary partitioning method of the output probability of the large language model and the hard constraint sampling method are used to embed the watermark signal into the generated text.

[0131] The specific steps are as follows:

[0132] Step 1.1: Analyze the prompt words. Perform word segmentation and encoding to obtain the initial sequence:

[0133]

[0134] in, Represents the initial sequence, It is a prompt word book The word segmentation encoding operation means that the prompt word is encoded. Turn to sequence;

[0135] Step 1.2: Loop decoding, that is, repeating the decoding steps. to Repeat execution:

[0136] Step 1.21, when At that time, the initial sequence Input a large language model and get the corresponding Vector, and take the last position. vector:

[0137]

[0138] in, The large language model representing the generation task to be performed can be any autoregressive model, specifically including... Model, express The last position of each decoding step vector;

[0139] Step 1.22, based on In Scores ranked from highest to lowest for the vocabulary list Sort the results to get the first... The last position of each decoding step Sort, represented as:

[0140]

[0141] in, Indicates the result after descending order sequence, Indicates the first one That is, the one with the highest probability at present. , Indicates the first indivual That is, the one with the lowest probability. , This indicates the size of the vocabulary, which is an optional fragment dictionary in a large language model.

[0142] For example, [to,ken,app] is a vocabulary list, corresponding to the last position. vector: It is (0.1, 0.3, 0.6), according to The scores are sorted by size as [app, ken, to].

[0143] Step 1.23: Before retaining the results obtained in Step 1.22. indivual A set of guardians is represented as:

[0144]

[0145] in, Indicating the guardian set Number, Indicates time step The first in the collection of time guardians indivual ;

[0146] Step 1.24: Based on the truncation function Outside the central guardian group Perform a truncation operation to determine the cutoff ranking of the head region, and then divide the head region based on the cutoff ranking of the head region. and tail area ;

[0147] The formula for determining the cutoff ranking in the top region is:

[0148]

[0149] Head area and tail area The representation is:

[0150]

[0151] This represents a truncation function, used to restrict input values ​​to a given range. This indicates the parameter representing the proportion of the head region. This indicates the lower bound of the head region's size. This indicates the upper bound of the head region's size. express The first one included in the head region indivual , The first one that is entered into the head area indivual , This indicates the final determined size of the head region;

[0152] Step 1.25: Determine the target size of the green set and allocate it to the head region based on the target size of the green set. and tail area The quota, the target size of the green set is:

[0153]

[0154] in, , indicating the strength of the control constraint;

[0155] Assigned to head region The quota is:

[0156]

[0157] Assigned to tail region The quota is:

[0158]

[0159] in, This indicates that the green set is controlled in the head region. The proportion;

[0160] Step 1.26, in the head region and tail area If subsets are drawn uniformly without replacement and merged into a green set, then:

[0161]

[0162] And construct

[0163]

[0164] in, Indicates the first The green color selected from the head region in each decoding step gather, This indicates that the quota is calculated from the head region. The operation involves uniformly selecting subsets without replacement. Uniform selection means that all subsets that meet a given size requirement are selected with equal probability. Indicates from the head region Select quantity from, Indicates the first The green area selected from the tail region in each decoding step gather, Indicates quota from the tail region Perform a uniform sampling operation without replacement to obtain a subset. Indicates from the tail region Green selected from quantity, In the first The generation phase only samples the next step from the probability distribution corresponding to the set of green elements allowed to be sampled in each decoding step. ;

[0165] Step 1.27: Hard constraint shields non-green sets That is, for all ,make:

[0166]

[0167] in, Indicates the first in the vocabulary list indivual Location Indicates the first The last position of each decoding step The first in the vector indivual Score;

[0168] Step 1.28: Sampling distribution under hard constraints and sampling the next... That is, the result obtained in step 1.27 The above adopts The processing formula is:

[0169]

[0170] based on Obtain the overall probability and perform sampling:

[0171]

[0172] The sampled Append to the current sequence The end:

[0173]

[0174] in, Indicates the first In the decoding step, the first indivual The probability corresponding to the hard-constrained sampling distribution. Indicates the first All in each decoding step The overall probability under a hard-constrained sampling distribution Indicates the first The last position of each decoding step The first in the vector indivual Score, This refers to the classification distribution, also known as the discrete classification probability distribution. This refers to the overall probability. Classification distribution of a single random sample Indicates the first The next sample obtained from the decoding steps If the current decoding step is or End of sequence If the condition is met, the loop terminates; otherwise, based on the updated condition... Repeat step 1.21 to proceed to the next decoding step;

[0175] Step 1.3: After the loop is completed, output the final generated sequence, which realizes the embedding of the watermark signal into the generated text.

[0176] During the watermark detection stage, the system determines whether the embedded text carries a watermark by constructing location-level evidence, performing multi-scale sliding window statistical tests, and applying multiple tests and corrections. The system then outputs the determination result under a given overall false alarm control level.

[0177] The specific steps are as follows:

[0178] Step 2.1: Text encoding, encoding the text to be tested. Encoded as sequence:

[0179]

[0180] Step 2.2, constructing location-level evidence, for Number of to :

[0181] Step 2.21, with prefix Inputting a large language model yields the corresponding vector, corresponding The vector is:

[0182]

[0183] Step 2.22: Following the same rules as the watermark generation stage... Reconstructing the green set ;

[0184] Step 2.23, calculate the first... indivual Does it fall into the green set? middle:

[0185]

[0186] in, It is an indicator function; if the following condition is true, the value is 1; otherwise, it is 0. indivual Falling into the green collection Then record Otherwise remember ;

[0187] Step 2.24, based on Calculate the probability mass of the original large language model distribution falling into the green set:

[0188]

[0189] in, yes vector The One component;

[0190] based on and Collected Evidence sequence of sequences:

[0191] ;

[0192] Step 2.3, multi-scale sliding window testing and misjudgment control, specifically:

[0193] Step 2.31: Define the window length set :

[0194]

[0195]

[0196] in, It is a non-negative integer index, used to enumerate different lengths, The step size representing the window length. Indicates the shortest window that can be considered. Indicates the longest window that can be considered;

[0197] For each length With sliding step size Enumerate the set of window start points:

[0198]

[0199] in, This indicates that when the window length is fixed... At that time, the set of all legal window starting points, Indicates the starting position index of a certain window;

[0200] Total number of tests:

[0201]

[0202] Step 2.32, for each window Calculation window Falling into the green collection Number of hits within:

[0203]

[0204] Step 2.33: Under the null hypothesis that the text to be tested originally does not contain a watermark, It follows a Poisson binomial distribution with the following parameters:

[0205]

[0206] Calculate the right tail The value is the probability of observing so many hits or even more hits under the null hypothesis.

[0207]

[0208] Step 2.34, based on the right tail value Correction yields the corrected value:

[0209]

[0210] Step 2.35: Determine the corrected result. Is the value less than the threshold? If yes, it means the text being tested contains a watermark; otherwise, it does not. The formula for determining this is:

[0211] .

[0212] Family error rate ( Family-Wise Error Rate (FWER) refers to the probability of at least one Type I error (i.e., incorrect rejection when the null hypothesis is true) occurring in a set of related multiple hypothesis tests. In this invention, multiple tests exist because sliding window tests are performed on the same text at multiple window lengths and multiple starting positions. This represents the overall probability that the entire text is misclassified as containing a watermark across all window inspections. This invention controls... By using the optimal window, the overall false alarm risk is kept below a preset threshold. To determine if the text to be tested contains a watermark.

[0213] Example

[0214] Hint: Give three tips for staying healthy.

[0215] Output the watermarked text: 1. Drink plenty of water throughout the day to stay hydrated and help flush out toxins. Aim for at least 8 cups (64 ounces) of water per day. 2. Incorporate physical activity into your daily routine, such as walking, running, or weightlifting. Aim for at least 30 minutes of moderate-intensity exercise per day. 3. Eat a balanced diet that includes a variety of fruits, vegetables, whole grains, lean proteins, and healthy fats. Aim for at least 5 servings of fruits and vegetables per day and limit your intake of processed and sugary foods. Remember, taking care of your health is a long-term commitment, and small changes can add up to make a big difference over time. By following these tips and making healthy choices, you can help maintain your overall health and well-being. What are three tips for staying healthy? 1. Drink plenty of water throughout the day to stay hydrated and help flush out toxins. Aim for at least 8 cups (64 ounces) of water per day. 2.Incorporate physical activity into your daily routine, such as walking, running, or weightlifting. Aim for at least.

[0216] Detection results: {"has_watermark": true, "best_window": {"start": 112, "L":24}, "best_p": 3.7816299036718355e-133, "best_score": 132.42232097645817, "n_windows": 645, "text_len_tokens": 309, "id": 0, " p_thresh ": 1e-6}

[0217] Result Interpretation: The optimal window is from the 112th window. Initially, the window length is 24, and the best_p is 3.7816299036718355e-133, which is less than the threshold 1e-6, so there is a watermark.

[0218] The overall logic of this part of the detection can be summarized as follows: first, encode the text to be tested into... Sequence, then from the second one To begin, we perform "evidence extraction" at each location, specifically by first using the preceding prefix. Input the large language model to obtain the current position. Distribution, and then following the exact same rules at the generating end, based on this... The distribution reconstructs the green set corresponding to that location. Then see what actually happens. Does it fall into this green set? If it does, record it. Otherwise remember This is the source of the "hit count" in step 2.32. In other words, the hit count essentially refers to how many positions in a given window satisfy the "actual hit count". "Falling into the green set reconstructed at that location"; at the same time, it is also necessary to calculate It represents the probability mass that this green set should possess under the natural distribution of the original model. Therefore... These are the results of actual observation. The former refers to the theoretical baseline under the original assumption, while the latter refers to "what was the probability of winning?". This applies to all positions. and After collecting the data, instead of directly looking at the total global hit count, a sliding window mechanism is introduced to count the hit counts on local segments with different window lengths and starting points. This is because the watermark signal may be unevenly distributed in a long text; some local segments have strong signals, while others have weak signals. If only the entire text is viewed, the significant local signals may be diluted. Therefore, the sliding window's function is to actively scan the "most suspicious and significant" local areas in the text; for each window, the corresponding... The sequence is constructed using a Poisson binomial distribution. The probability of observing so many hits or even more hits under the null hypothesis that "the text originally did not contain a watermark" is calculated; this probability is the right tail. If this probability is very small, it means that the high hit rate within this window is not random fluctuation, but rather more likely guided by the watermarking mechanism. Since many windows are examined simultaneously, without control, it's easy to accidentally stumble upon a seemingly significant result due to "trying too many times," which is why we need to use... This refers to the family-wise error rate, which controls the overall probability of "at least one false positive in all window tests"; Correction serves this purpose; it makes the saliency requirements for each window more stringent, thereby ensuring that the final false alarm rate is under control. Finally, the corrected window is selected from all windows. The window with the smallest value, that is, the most significant value, is taken as... If this minimum correction The value is still less than the preset value. If the text contains a watermark, it is determined that the text contains a watermark; otherwise, it is determined that the text does not contain a watermark.

[0219] By introducing a semantically structure-based controlled equilibrium partitioning mechanism during the vocabulary partitioning stage, each subset contains candidates with high semantic quality. This ensures from the source that any selectable set in the decoding stage has reasonable semantic expression capabilities;

[0220] While maintaining semantic stability, a bias strategy with sufficient statistical magnitude is applied so that the watermark signal can still reach a significant level under the condition of finite length text, thereby improving the detection success rate and reducing the risk of false alarms.

[0221] By combining more accurate detection modeling methods, the statistical signals embedded in the generation stage can be stably accumulated under limited sample conditions, thereby achieving a balance between text quality and detection performance.

[0222] Through the above improvements, this invention aims to establish a unified mechanism between semantic preservation capability and watermark signal strength, ensuring both text quality and detection performance under different generation scenarios, thereby overcoming the problems of significant semantic damage and insufficient signal after bias relaxation in existing technologies under low entropy conditions.

[0223] The above are merely representative embodiments among the many specific applications of this invention, and do not constitute any limitation on the scope of protection of this invention. All technical solutions formed by transformation or equivalent substitution fall within the scope of protection of this invention.

Claims

1. A method for watermark embedding and detection in text generated from large language models, characterized in that, Includes the following steps: In the watermark generation stage, based on the prompt words, the vocabulary partitioning method of the output probability of the large language model and the hard constraint sampling method are used to embed the watermark signal into the generated text. During the watermark detection stage, the system determines whether the embedded text carries a watermark by constructing location-level evidence, performing multi-scale sliding window statistical tests, and applying multiple tests and corrections. The system then outputs the determination result under a given overall false alarm control level.

2. The method for watermark embedding and detection of text generated from a large language model according to claim 1, characterized in that, The specific steps of step 1 are as follows: Step 1.1: Analyze the prompt words. Perform word segmentation and encoding to obtain the initial sequence: in, Represents the initial sequence, It is a prompt word The word segmentation encoding operation means that the prompt word is encoded. Turn to sequence; Step 1.2: Loop decoding, that is, repeating the decoding steps. to Repeat execution: Step 1.21, when At that time, the initial sequence Input a large language model and get the corresponding Vector, and take the last position. vector: in, The large language model representing the generation task to be performed can be any autoregressive model, specifically including... Model, express The last position of each decoding step vector; Step 1.22, based on In Scores ranked from highest to lowest for the vocabulary list Sort the results to get the first... The last position of each decoding step Sort, represented as: in, Indicates the result after descending order sequence, Indicates the first one That is, the one with the highest probability at present. , Indicates the first indivual That is, the one with the lowest probability. , This indicates the size of the vocabulary, which is an optional fragment dictionary in a large language model. Step 1.23: Before retaining the results obtained in Step 1.

22. indivual A set of guardians is represented as: in, Indicating the guardian set Number, Indicates time step The first in the collection of time guardians indivual ; Step 1.24: Based on the truncation function Outside the central guardian group Perform a truncation operation to determine the cutoff ranking of the head region, and then divide the head region based on the cutoff ranking of the head region. and tail area ; The formula for determining the cutoff ranking in the top region is: Head area and tail area The representation is: This represents a truncation function, used to restrict input values ​​to a given range. This indicates the parameter representing the proportion of the head region. This indicates the lower bound of the head region's size. This indicates the upper bound of the head region's size. express The first one included in the head region indivual , The first one that is entered into the head area indivual , This indicates the final determined size of the head region; Step 1.25: Determine the target size of the green set and allocate it to the head region based on the target size of the green set. and tail area The quota, the target size of the green set is: in, , indicating the strength of the control constraint; Assigned to head region The quota is: Assigned to tail region The quota is: in, This indicates that the green set is controlled in the head region. The proportion; Step 1.26, in the head region and tail area If subsets are drawn uniformly without replacement and merged into a green set, then: And construct in, Indicates the first The green color selected from the head region in each decoding step gather, This indicates that the quota is calculated from the head region. The operation involves uniformly selecting subsets without replacement. Uniform selection means that all subsets that meet a given size requirement are selected with equal probability. Indicates from the head region Select quantity from, Indicates the first The green area selected from the tail region in each decoding step gather, Indicates quota from the tail region Perform a uniform sampling operation without replacement to obtain a subset. Indicates from the tail region Green selected from quantity, In the first The generation phase only samples the next step from the probability distribution corresponding to the set of green elements allowed to be sampled in each decoding step. ; Step 1.27: Hard constraint shields non-green sets That is, for all ,make: in, Indicates the first in the vocabulary list indivual Location Indicates the first The last position of each decoding step The first in the vector indivual Score; Step 1.28: Sampling distribution under hard constraints and sampling the next... That is, the result obtained in step 1.27 The above adopts The processing formula is: based on Obtain the overall probability and perform sampling: The sampled Append to the current sequence The end: in, Indicates the first In the decoding step, the first indivual The probability corresponding to the hard-constrained sampling distribution. Indicates the first All in each decoding step The overall probability under a hard-constrained sampling distribution Indicates the first The last position of each decoding step The first in the vector indivual Score, This refers to the classification distribution, also known as the discrete classification probability distribution. This refers to the overall probability. Classification distribution of a single random sample Indicates the first The next sample obtained from the decoding steps If the current decoding step is or End of sequence If the condition is met, the loop terminates; otherwise, based on the updated condition... Repeat step 1.21 to proceed to the next decoding step; Step 1.3: After the loop is completed, output the final generated sequence, which realizes the embedding of the watermark signal into the generated text.

3. The method for watermark embedding and detection of text generated from a large language model according to claim 2, characterized in that, The specific steps of step 2 are as follows: Step 2.1: Text encoding, encoding the text to be tested. Encoded as sequence: Step 2.2, constructing location-level evidence, for Number of to : Step 2.21, with prefix Inputting a large language model yields the corresponding vector, corresponding The vector is: Step 2.22: Following the same rules as the watermark generation stage... Reconstructing the green set ; Step 2.23, calculate the first... indivual Does it fall into the green set? middle: in, It is an indicator function; if the following condition is true, the value is 1; otherwise, it is 0. indivual Falling into the green collection Then record Otherwise remember ; Step 2.24, based on Calculate the probability mass of the original large language model distribution falling into the green set: in, yes vector The One component; based on and Collected Evidence sequence of sequences: ； Step 2.3: Perform multi-scale sliding window testing and control the family error rate, specifically as follows: Step 2.31: Define the window length set : in, It is a non-negative integer index, used to enumerate different lengths, The step size representing the window length. Indicates the shortest window that can be considered. Indicates the longest window that can be considered; For each length With sliding step size Enumerate the set of window start points: in, This indicates that when the window length is fixed... At that time, the set of all legal window starting points, Indicates the starting position index of a certain window; Total number of tests: Step 2.32, for each window Calculation window Falling into the green collection Number of hits within: Step 2.33: Under the null hypothesis that the text to be tested originally does not contain a watermark, It follows a Poisson binomial distribution with the following parameters: Calculate the right tail The value is the probability of observing so many hits or even more hits under the null hypothesis. Step 2.34, based on the right tail value Correction yields the corrected value: Step 2.35: Determine the corrected result. Is the value less than the threshold? If yes, it means the text being tested contains a watermark; otherwise, it does not. The formula for determining this is: 。 4. A watermark embedding and detection system for text generated from large language models, characterized in that, The method includes a memory, a processor, and a computer program stored in the memory, characterized in that: the processor executes the computer program to implement the steps of the method according to any one of claims 1-3.

5. A computer-readable storage medium having a computer program stored thereon, characterized in that: When executed by a processor, the computer program implements the steps of the method according to any one of claims 1-3.

6. A computer program product, comprising a computer program, characterized in that: When executed by a processor, the computer program implements the steps of the method according to any one of claims 1-3.

Images