Method and apparatus for generating multi-bit watermark text

Abstract

The application relates to the technical field of information security, in particular to a multi-bit watermark text generation method and device, wherein the method comprises the following steps: obtaining a word unit level vector representation of a target generation model, constructing a plurality of semantic atoms of the target generation model, and determining a plurality of semantic micro clusters of the target generation model according to the plurality of semantic atoms; based on the actual load of the plurality of semantic micro clusters, the plurality of semantic micro clusters are distributed to corresponding watermark segments to construct a semantic balance mapping table used for representing the mapping relationship between the word units and the watermark segments; based on the to-be-embedded multi-bit load and the semantic balance mapping table, the to-be-embedded multi-bit load is embedded into a target word unit in the watermark segment, and a generation text embedded with the multi-bit watermark is obtained. According to the application, the word units with similar semantics, which can be replaced or interchanged with high probability in synonym attacks, can fall into the same watermark segment as much as possible, the synchronization relationship between the watermark bits and the text semantic disturbance is maintained, and a more stable decoding path is ensured.

Description

Technical Field

[0001] This application relates to the field of information security technology, and in particular to a method and apparatus for generating multi-bit watermarked text. Background Technology

[0002] The proliferation of Large Language Models (LLMs) necessitates robust content attribution mechanisms to mitigate abuse such as misinformation. Unlike zero-bit watermarking, which can only provide binary detection, multi-bit text watermarking is gaining increasing attention because it can attribute watermark bits to the output of a large language model.

[0003] In related technologies, multi-bit watermarking typically embeds the watermark bits into a partitioned lexical space through a hash-based allocation mechanism to balance accuracy and time complexity, overcoming the computationally expensive enumeration problem in earlier schemes.

[0004] However, in related technologies, hash-based allocation mechanisms introduce a "synchronization vulnerability": semantically identical words mapped to different segments (e.g., "happy" and "pleasant") may disrupt the alignment between the words and the watermark segments, which can easily lead to decoding failure and prevent the correct extraction of the watermark, and urgently needs to be solved. Summary of the Invention

[0005] This application provides a method and apparatus for generating multi-bit watermarked text to solve the problems in related technologies, such as the fact that semantically identical words mapped to different segments in hash-based allocation mechanisms may disrupt the alignment between words and watermark segments, which can easily lead to decoding failure and the inability to extract the watermark correctly.

[0006] The first aspect of this application provides a method for generating multi-bit watermarked text, comprising the following steps: obtaining a lexical-level vector representation of a target generation model; constructing multiple semantic atoms of the target generation model based on the lexical-level vector representation, and determining multiple semantic micro-clusters of the target generation model according to the multiple semantic atoms; assigning the multiple semantic micro-clusters to corresponding watermark segments based on the actual load of the multiple semantic micro-clusters, and constructing a semantic balance mapping table for representing the mapping relationship between lexicals and watermark segments; embedding the multi-bit load to be embedded into the target lexicals in the watermark segments based on the semantic balance mapping table, thereby obtaining generated text with embedded multi-bit watermark.

[0007] Optionally, in one embodiment of this application, the step of assigning multiple semantic micro-clusters to corresponding watermark segments includes: obtaining the word frequencies of the corpus corresponding to the multiple semantic micro-clusters, and calculating the cluster load of the multiple semantic micro-clusters based on the word frequencies; if the cluster load is less than or equal to a preset load threshold, then assigning the semantic micro-clusters whose cluster load is less than or equal to the preset load threshold to a single watermark segment; otherwise, splitting the semantic micro-clusters whose cluster load is greater than the preset load threshold to obtain the words of the semantic micro-clusters, and assigning the words to segments in the watermark segment that meet the preset empty load condition.

[0008] Optionally, in one embodiment of this application, the step of assigning multiple semantic micro-clusters to corresponding watermark fragments to construct a semantically balanced mapping table for representing the mapping relationship between lexical units and watermark fragments includes: initializing the original mapping table using a preset key to obtain a pseudo-random sorting list; and mapping the original paragraph number of the watermark fragment to a new value based on the sorting number in the pseudo-random sorting list to construct the semantically balanced mapping table.

[0009] Optionally, in one embodiment of this application, the step of embedding the multi-bit payload to be embedded into the target word in the watermark segment based on the semantic balance mapping table to obtain the generated text with embedded multi-bit watermark includes: segmenting the multi-bit payload to be embedded into multiple original symbols, and generating multiple error-corrected symbols based on the multiple original symbols; generating a green word list according to a preset key and the current generation context, and applying a positive bias to the original scores corresponding to the candidate words in the green word list to obtain a bias vector for each candidate word; performing a cyclic shift on the bias vector of each candidate word based on the error-corrected symbols of the adjacent historical words of the current word to obtain a shift score for multiple candidate words; determining the target word of the multi-bit payload to be embedded in the watermark segment according to the shift score, and embedding the multi-bit payload to be embedded into the target word.

[0010] Optionally, in one embodiment of this application, after embedding the target lexical into the watermark segment to obtain the generated text with the embedded multi-bit watermark, the method further includes: dividing the generated text with the embedded multi-bit watermark to obtain multiple lexical to be detected, and constructing a pseudo-random green word list based on the preset key and the multiple lexical to be detected; querying the semantic balance mapping table according to the context lexical number of the current detected lexical to determine the error correction segment corresponding to the current detected lexical; obtaining the cumulative support of each candidate symbol value in the error correction segment based on the pseudo-random green word list, and determining the target candidate symbol of the error correction segment based on the cumulative support; and restoring the original symbol corresponding to the error correction symbol based on the error correction symbol generated by the target candidate symbol, so as to obtain the restored embedded multi-bit payload based on the original symbol corresponding to the error correction symbol.

[0011] A second aspect of this application provides an apparatus for generating multi-bit watermarked text, comprising: a construction module, configured to acquire a lexical-level vector representation of a target generation model, and construct multiple semantic atoms of the target generation model based on the lexical-level vector representation, so as to determine multiple semantic micro-clusters of the target generation model according to the multiple semantic atoms; a mapping module, configured to allocate the multiple semantic micro-clusters to corresponding watermark segments based on the actual load of the multiple semantic micro-clusters, so as to construct a semantically balanced mapping table for representing the mapping relationship between lexical units and watermark segments; and a generation module, configured to embed the multi-bit load to be embedded into target lexical units in the watermark segments based on the semantically balanced mapping table, thereby obtaining generated text with embedded multi-bit watermark.

[0012] Optionally, in one embodiment of this application, the mapping module includes: a calculation unit, configured to obtain the word frequencies of the corpus corresponding to the plurality of semantic micro-clusters, and calculate the cluster load of the plurality of semantic micro-clusters based on the word frequencies; and an allocation unit, configured to, if the cluster load is less than or equal to the preset load threshold, allocate the semantic micro-clusters whose cluster load is less than or equal to the preset load threshold to a single watermark segment; otherwise, split the semantic micro-clusters whose cluster load is greater than the preset load threshold to obtain the words of the semantic micro-clusters, and allocate the words to segments in the watermark segment that meet the preset empty load condition.

[0013] Optionally, in one embodiment of this application, the mapping module includes: an initialization unit, configured to initialize the original mapping table using a preset key to obtain a pseudo-random sorted list; and a mapping unit, configured to map the original paragraph number of the watermark fragment to a new value based on the sorted number in the pseudo-random sorted list, so as to construct the semantically balanced mapping table.

[0014] Optionally, in one embodiment of this application, the generation module includes: a segmentation unit, configured to segment the multi-bit payload to be embedded into multiple original symbols, and generate multiple error-corrected symbols based on the multiple original symbols; a processing unit, configured to generate a green word list according to a preset key and the current generation context, and apply a positive bias to the original scores corresponding to candidate words in the green word list to obtain a bias vector for each candidate word; a shifting unit, configured to perform cyclic shifting on the bias vector of each candidate word based on the error-corrected symbols of the adjacent historical words of the current word to obtain shift scores for multiple candidate words; and an embedding unit, configured to determine the target word of the multi-bit payload to be embedded in the watermark segment according to the shift scores, and embed the multi-bit payload to be embedded into the target word.

[0015] Optionally, in one embodiment of this application, it further includes: a segmentation module, configured to, after embedding the target lexical into the watermark segment to obtain the generated text with the embedded multi-bit watermark, segment the generated text with the embedded multi-bit watermark to obtain multiple lexical to be detected, and construct a pseudo-random green word list based on the preset key and the multiple lexical to be detected; a query module, configured to query the semantic balance mapping table according to the context lexical number of the current detected lexical to determine the error correction segment corresponding to the current detected lexical; a determination module, configured to, based on the pseudo-random green word list, obtain the cumulative support of each candidate symbol value in the error correction segment, and determine the target candidate symbol of the error correction segment according to the cumulative support; and a restoration module, configured to, based on the error correction symbol generated by the target candidate symbol, restore the original symbol corresponding to the error correction symbol, so as to obtain the restored embedded multi-bit payload according to the original symbol corresponding to the error correction symbol.

[0016] A third aspect of this application provides an electronic device, including: a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor executes the program to implement the method for generating multi-bit watermarked text as described in the above embodiments.

[0017] A fourth aspect of this application provides a computer-readable storage medium storing a computer program that, when executed by a processor, implements the method for generating multi-bit watermarked text as described above.

[0018] A fifth aspect of this application provides a computer program product, including a computer program that, when executed, is used to implement the method for generating multi-bit watermarked text as described above.

[0019] This application embodiment can divide the lexical units of the target generation model into fine-grained semantic atoms (semantic micro-clusters), ensuring that lexical units that meet preset semantic conditions are locked into the same cluster. Based on the actual load of multiple semantic micro-clusters, the semantic micro-clusters are allocated to corresponding watermark segments, and a semantic balance mapping table is constructed to allocate semantically similar or identical lexical units in the multi-bit load to the same watermark segment. This achieves the goal of locking semantically interchangeable lexical units into the same watermark segment by dividing lexical units that meet preset semantic conditions into a semantic atom; by employing frequency-aware greedy packing to achieve near-uniform probability quality, ensuring that each watermark segment has the same activation probability; the semantic balance mapping table constructed thereby from lexical ID to watermark segment ID can ensure that semantically similar, interchangeable, or highly interchangeable lexical units in synonym substitution attacks fall into the same watermark segment as much as possible, thus maintaining the synchronization between watermark bits and text semantic perturbations, and enabling multi-bit watermarks to maintain a more stable decoding path and extraction stability under synonym substitution attacks. This solves the problem in related technologies where hash-based allocation mechanisms may disrupt the alignment between semantically identical terms mapped to different segments, leading to decoding failures and the inability to correctly extract the watermark.

[0020] Additional aspects and advantages of this application will be set forth in part in the description which follows, and in part will be obvious from the description, or may be learned by practice of this application. Attached Figure Description

[0021] The above and / or additional aspects and advantages of this application will become apparent and readily understood from the following description of the embodiments taken in conjunction with the accompanying drawings, wherein: Figure 1 This is a flowchart illustrating a method for generating multi-bit watermarked text according to an embodiment of this application; Figure 2 This is a schematic diagram illustrating a synchronization vulnerability in one embodiment of this application; Figure 3 This is a schematic diagram comparing the resistance of different methods to synonym substitution attacks in one embodiment of this application; Figure 4 This is a schematic diagram of the structure of a multi-bit watermark text generation apparatus provided according to an embodiment of this application; Figure 5 This is a schematic diagram of the structure of an electronic device provided according to an embodiment of this application.

[0022] Figure label: 10-A device for generating multi-bit watermarked text; 100-A building module, 200-A mapping module and 300-A generation module; 501-A memory, 502-A processor and 503-A communication interface. Detailed Implementation

[0023] The embodiments of this application are described in detail below. Examples of these embodiments are shown in the accompanying drawings, wherein the same or similar reference numerals denote the same or similar elements or elements having the same or similar functions throughout. The embodiments described below with reference to the accompanying drawings are exemplary and intended to explain this application, and should not be construed as limiting this application.

[0024] The following describes a method and apparatus for generating multi-bit watermarked text according to embodiments of this application, with reference to the accompanying drawings. Addressing the problems in the related technologies mentioned in the background section, this application provides a method for generating multi-bit watermarked text. In this method, the lexical units of the target generation model can be divided into fine-grained semantic atoms (semantic micro-clusters), ensuring that lexical units satisfying preset semantic conditions are locked into the same cluster. Based on the actual load of multiple semantic micro-clusters, the semantic micro-clusters are assigned to corresponding watermark segments, and a semantic balance mapping table is constructed to assign semantically similar / similar lexical units to be embedded in the multi-bit load to the same watermark segment. This approach achieves the goal of locking semantically interchangeable terms into the same watermark segment by dividing terms that meet preset semantic conditions into semantic atoms. It also achieves near-uniform probability quality through frequency-aware greedy packing, ensuring that each watermark segment has the same activation probability. The semantically balanced mapping table from term ID to watermark segment ID constructed in this way allows terms that are semantically similar, interchangeable, or highly interchangeable in synonym attacks to fall into the same watermark segment as much as possible. This maintains the synchronization between watermark bits and text semantic perturbations, enabling multi-bit watermarks to maintain a more stable decoding path and extraction stability under synonym substitution attacks. This solves the problem in related technologies where hash-based allocation mechanisms may disrupt the alignment between terms and watermark segments, easily leading to decoding failures and incorrect watermark extraction.

[0025] Specifically, Figure 1 This is a flowchart illustrating a method for generating multi-bit watermarked text, as provided in an embodiment of this application.

[0026] like Figure 1 As shown, the method for generating this multi-bit watermarked text includes the following steps: In step S101, the word-level vector representation of the target generation model is obtained. Based on the word-level vector representation, multiple semantic atoms of the target generation model are constructed to determine multiple semantic micro-clusters of the target generation model according to the multiple semantic atoms.

[0027] In some embodiments, a "synchronization vulnerability" exists in popular hash-based allocation methods: semantically identical terms mapped to different segments (e.g., "happy" and "joyful") may disrupt the alignment between the terms and the watermark segment, easily leading to decoding failure, such as... Figure 2 As shown, Figure 2 This is a schematic diagram illustrating a synchronization vulnerability in one embodiment of this application.

[0028] Based on this, this application presents a novel multi-bit LLM text watermarking framework (hereinafter referred to as SEMANCHOR) that incorporates robust semantic-level allocation. This watermarking framework can address the vulnerability by anchoring watermark fragments to semantic clustering. Multi-bit watermarked text generated under this framework can effectively improve the extraction accuracy of multi-bit large language model text watermarks.

[0029] The SEMANCHOR framework utilizes the inherent embedding space of LLM and employs a two-stage semantic balance partitioning strategy, including "semantic atomization" for building anchors and "frequency-aware packing" for balancing the load. This allows semantically interchangeable lemmas to be locked in the same watermark fragment, effectively avoiding vulnerabilities.

[0030] For example, in the "semantic atomization" stage, in order to avoid mapping synonyms, near-synonyms, or semantically similar lexical units to unrelated segments by random hash-based segment allocation, SEMANCHOR in this application embodiment first uses a word segmenter and word embedding layer consistent with the target generation model to obtain the lexical-level vector representation of the target generation model.

[0031] In this context, the target generation model can be understood as a large language model that generates text with multi-bit watermarks.

[0032] Specifically, in this embodiment, the vocabulary can be projected into the native embedding space of LLM, and the input embedding vector of each word number in the vocabulary of the target generation model can be extracted and L2 normalized so that the distance between different words mainly reflects the directional similarity rather than the difference in vector magnitude, thereby ensuring that the word ID, embedding row number and subsequent watermark mapping table remain consistent.

[0033] After obtaining the normalized embeddings, SEMANCHOR can further employ principal component analysis to compress the high-dimensional embeddings to a fixed dimension, thereby reducing clustering costs and preserving the main semantic structure. This normalized embedding vector, compressed to a fixed dimension, is the lexical-level vector representation of the target generative model, with each lexical-level vector corresponding to a lexical in the vocabulary of the target generative model.

[0034] Subsequently, based on this word-level vector representation, the embodiments of this application can perform micro-clustering on all words in the vocabulary of the target generation model to obtain multiple semantic atoms of the target generation model.

[0035] Based on the word-level vector representation of each word in the vocabulary of the target generation model, the embodiments of this application can determine the semantic similarity, contextual functional similarity, and interchangeability in synonym attacks between each word. Then, words with similar semantics or similar contextual functions can be bound together to form semantic atoms.

[0036] Each semantic atom has at least one lexical unit (one or more lexical units). If a semantic atom has multiple lexical units, then each of these lexical units satisfies certain semantic similarity or contextual functional similarity with other lexical units in the semantic atom, or has a high probability of interchangeability in synonym attacks.

[0037] That is, only when multiple lexical units satisfy certain semantic similarity or contextual functional similarity or have a high probability of interchangeability in synonym attacks can they be clustered into a semantic atom. If a single lexical unit does not have other lexical units with "semantic similarity or contextual functional similarity", then it is itself a semantic atom.

[0038] Each semantic atom can be understood as a semantic micro-cluster.

[0039] It should be noted that the "semantic atom" here is not the final watermark fragment, but a finer intermediate unit than the segment; it binds semantically similar or contextually similar lexical units together to provide a stable anchor for subsequent segment allocation.

[0040] The determination of whether word units are semantically similar or have similar contextual functions can be set by professionals in this field according to actual needs. This application embodiment is only an example and does not impose any specific limitations.

[0041] In related technologies, random hashing during detection typically relies on the previous one or the first n terms to determine the segment to which the current term belongs. When text encounters synonym replacement, the replaced term not only affects its own watermark score but also participates in segment selection as context for subsequent positions. If the term numbers before and after the replacement are hashed to different segments, the scoring buckets for the subsequent string of terms will be misaligned, which is a synchronization vulnerability.

[0042] In this embodiment, SEMANCHOR can anchor watermark fragments to semantic atoms, making the context words before and after the replacement have a high probability of having consistent or adjacent semantic affiliations, thereby keeping the fragment index of subsequent words stable. The watermark disturbance degenerates from "continuous misalignment" to "local noise", thus effectively avoiding the occurrence of synchronization vulnerabilities.

[0043] Step S102: Based on the actual load of multiple semantic microclusters, the multiple semantic microclusters are assigned to the corresponding watermark fragments to construct a semantic balanced mapping table for representing the mapping relationship between lexical units and watermark fragments.

[0044] Based on the descriptions of other embodiments, it is understood that this application can selectively anchor watermark fragments to semantic atoms so that the context terms before and after the replacement have a high probability of having consistent or adjacent semantic affiliations.

[0045] Therefore, in some embodiments, this application can allocate multiple semantic microclusters to corresponding watermark fragments based on the actual load of multiple semantic microclusters, in order to construct a semantically balanced mapping table for representing the mapping relationship between lexical units and watermark fragments. Here, a watermark fragment can be understood as a unit text carrying watermark information.

[0046] Many semantically similar lexical units (such as "happy" and "joyful") belong to the same cluster. Assigning multiple semantic micro-clusters to corresponding watermark segments ensures that these semantically similar lexical units are forcibly assigned to the same watermark segment. Therefore, even if a word in the text (such as "happy") is replaced with a semantically similar word (such as "joyful"), the replaced word still belongs to the original watermark segment, its statistical information is not lost, and the correspondence between the watermark segment and the symbol is not disrupted, thus effectively ensuring semantic consistency and decoding robustness.

[0047] However, considering that some lexical units belong to high-frequency words, the actual load of the cluster to which the lexical unit belongs may cause the semantic micro-cluster to form a super-large cluster. Therefore, the embodiments of this application also need to allocate based on the actual load of multiple semantic micro-clusters. The following will explain this process.

[0048] Optionally, in one embodiment of this application, multiple semantic micro-clusters are assigned to corresponding watermark fragments, including: Obtain the word frequencies of the corpus corresponding to multiple semantic microclusters, and calculate the cluster load of multiple semantic microclusters based on the word frequencies; If the cluster load is less than or equal to the preset load threshold, the semantic micro-clusters with cluster loads less than or equal to the preset load threshold are assigned to a single watermark segment. Otherwise, the semantic micro-clusters with cluster loads greater than the preset load threshold are split to obtain the semantic micro-clusters' tokens, and the tokens are assigned to segments in the watermark segment that meet the preset empty load condition.

[0049] In practice, relying solely on semantic clustering introduces new load imbalance issues because different semantic clusters appear with vastly different frequencies in real-world corpora, a common long-tail distribution in natural language. If high-frequency clusters concentrate in a few segments, the detection end will encounter problems such as insufficient segment coverage, increased statistical variance, and decreased confidence of Reed-Solomon input symbols.

[0050] Therefore, in this embodiment of the application, SEMANCHOR can model the allocation of semantic micro-clusters to watermark fragments as a frequency-constrained bin packing problem and perform frequency-aware semantic packaging: obtain the word frequencies of the corpora (such as training corpora or reference corpora) corresponding to multiple semantic micro-clusters, and add 1 to zero-frequency words to avoid unreachable terms. Then, sum the frequencies of words in the same semantic cluster to obtain the cluster load, and finally put the fragment with the smallest current cumulative frequency into the cluster load in descending order.

[0051] In specific implementations, for ordinary micro-clusters with a cluster load less than or equal to a preset load threshold, the embodiments of this application can maintain the atomicity of the cluster by assigning the entire cluster to the same segment (a single segment). In this way, semantically replaceable terms preferentially share the same watermark segment, which can preserve semantic consistency to the greatest extent.

[0052] For very large clusters (synonyms with many members and extremely high usage frequency, such as "good" and "excellent") with cluster load exceeding the preset load threshold, if a very large cluster (such as the cluster containing the high-frequency word "good") is completely assigned to a watermark segment, then this watermark segment may appear with a large number of lexical units in any text. This will cause the "activation probability" of this watermark segment to be far greater than that of other watermark segments, which will seriously disrupt the load balance, causing the statistical value of this segment to be too strong, suppressing other segments, and thus causing deviations in watermark decoding.

[0053] Therefore, this embodiment of the application can split the super-large cluster to obtain the word elements of the super-large cluster, and allocate the word elements of the super-large cluster to watermark segments that meet the preset empty load conditions. Here, the preset empty load conditions refer to the watermark segment with the lowest current load and the fewest activation times. Thus, this embodiment of the application can split super-large clusters with cluster loads higher than a preset load threshold and allocate them word by word to the currently emptyest segment.

[0054] By flexibly distributing high-frequency words to lighter-loaded segments, the embodiments of this application can ensure that the total number of lexical units appearing in each segment in the text is approximately equal, achieving load balancing and preventing a single cluster from disrupting the overall balance. Furthermore, when extracting each symbol, there are sufficient and stable statistics within the corresponding segment, which can ensure that each watermark segment has approximately equal activation probabilities in natural text, improving the statistical confidence in short and medium-length texts and ensuring the robustness of the watermark.

[0055] Here, the preset load threshold can be understood as a pre-set cluster load limit value when determining whether a semantic micro-cluster is a normal cluster or a super-large cluster. In this embodiment, it can be, but is not limited to, the average fragment load plus (10%~20%) as the benchmark. The specific preset load threshold can be determined by those skilled in the art based on the actual situation. This embodiment is only illustrative and does not impose any specific limitations.

[0056] Optionally, in one embodiment of this application, multiple semantic micro-clusters are assigned to corresponding watermark fragments to construct a semantically balanced mapping table for representing the mapping relationship between lexical units and watermark fragments, including: The original mapping table is initialized using a preset key to obtain a pseudo-random sorting table; Based on the permutation number in the pseudo-random permutation list, the original paragraph number of the watermark fragment is mapped to a new value to construct a semantically balanced mapping table.

[0057] In other embodiments, to prevent attackers from inferring fragment numbers through public frequency distributions, SEMANCHOR in this application embodiment can further introduce key-based fragment ID replacement after completing semantic frequency balancing (frequency-aware semantic packaging) to enhance watermark security.

[0058] For example, this application can initialize a pseudo-random sorted list with a key and map the original paragraph numbers to new values. This permutation does not change the load balance of each segment, nor does it destroy the consistency within the semantic cluster, but it prevents external observers from determining the real watermark segment number solely based on word frequency and clustering results, thus improving the anti-inference capability of the mapping table through key permutation. The final frequency mapping table is a deterministic dictionary {term number: paragraph number}, and the generation and detection ends only need to share parameters such as this mapping, word segmenter, seed method, and hash key to complete the closed loop.

[0059] Specifically, in this embodiment of the application, the original mapping table can be initialized according to a preset key, that is, a preset key known only to the sender and receiver is used as a seed, and a randomized pseudo-random list is generated based on the original mapping table.

[0060] Here, the preset key can be understood as a secret key predetermined by both the sender and receiver, and the pseudo-random sorting list is a shuffled sequence of indices. The same key can only generate the same shuffled list; without a key, this shuffled order is unpredictable.

[0061] For example, the initial mapping table is an ordered sequential table: [0, 1, 2, 3, 4]. After being pseudo-randomly permuted by the key, it may become one of the following pseudo-random derived lists (pseudo-random permutation lists): [2, 4, 0, 3, 1], [4, 3, 0, 2, 1], or [2, 1, 0, 4, 3].

[0062] Then, in this embodiment of the application, the original paragraph number of the watermark fragment can be mapped to a new value based on the permutation number in the pseudo-random permutation list generated by the preset key, so as to construct a semantically balanced mapping table for mapping the relationship between "term number" and "paragraph number".

[0063] For example, the original paragraph number can be understood here as the symbol number into which the multi-bit message to be embedded is divided. For instance, the message to be embedded can be divided into n symbols, and the original natural order of these symbols [0, 1, 2, 3, 4, ..., n] is the original paragraph number.

[0064] Based on the permutation number in the pseudo-random permutation list generated by a preset key, the original paragraph number of the watermark fragment is mapped to a new value. This can be understood as mapping the original paragraph number of the watermark fragment to the permutation number value in the pseudo-random permutation list. For example, when embedding symbol number 0 into text, it is not directly embedded into the 0th "watermark fragment." Instead, the pseudo-random permutation list is consulted; for instance, if 0 corresponds to 2, then the actual content of symbol number 0 is embedded into the position in the text where symbol number 2 should be placed.

[0065] In simple terms, the logical order of the message symbols is scrambled before embedding, and then the scrambled symbols are embedded into the tokens sequentially. During extraction, the same key is used to generate the same sorted list, which is then reversed to restore the original symbol order.

[0066] For example, the multi-bit message to be embedded has four symbols: S0, S1, S2, and S3. The pseudo-random permutation list generated by the key is [2, 0, 3, 1]. The embedding process is as follows: The first watermark position in the text corresponds to the first item in the sorted list: 2, then S2 is actually embedded; The second watermark position in the text corresponds to the second item in the sorted list: 0, then S0 is actually embedded; The third watermark position in the text corresponds to the third item in the sorted list: 3, so S3 is actually embedded; The fourth watermark position in the text corresponds to the fourth item in the sorted list: 1, which means S1 is actually embedded.

[0067] During the detection, S2, S0, S3, and S1 are extracted, and then the same sorting table is used to look up the table in reverse (for example, 2 is mapped back to 0, and 0 is mapped back to 1) to rearrange them and restore the original order.

[0068] Step S103: Based on the multi-bit payload to be embedded and the semantic balance mapping table, the target word of the multi-bit payload to be embedded is embedded in the watermark fragment to obtain the generated text with embedded multi-bit watermark.

[0069] As one possible approach, after constructing a semantic balance mapping table from lexical IDs to watermark fragment IDs offline, the embodiments of this application can call the mapping table in an O(1) query manner during online generation and detection, so that semantically similar, interchangeable, or highly interchangeable lexical bits in synonym attacks fall into the same watermark fragment as much as possible, thereby maintaining the synchronization relationship between watermark bits and text semantic perturbation.

[0070] Specifically, in this application embodiment, a semantic balance mapping table can be invoked to obtain the watermark segment into which the multi-bit payload to be embedded should be embedded, and then the target word in the watermark segment can be embedded into the multi-bit payload to be embedded, so as to finally obtain the generated text with the multi-bit watermark (multi-bit payload to be embedded).

[0071] In this context, the target term can be understood as the term that is ultimately embedded in the multi-bit payload to be embedded in the watermark segment.

[0072] The following section provides a further explanation of how to embed the target tokens of the multi-bit payload into the watermark segment.

[0073] Optionally, in one embodiment of this application, based on the multi-bit payload to be embedded and a semantic balance mapping table, the target lexical units in the watermark fragment are embedded with the multi-bit payload to obtain the generated text with the multi-bit watermark, including: The multi-bit payload to be embedded is divided into multiple original symbols, and multiple error-corrected symbols are generated based on the multiple original symbols; A green word list is generated based on the preset key and the current generation context, and a positive bias is applied to the original scores corresponding to the candidate words in the green word list to obtain the bias vector of each candidate word. Based on the error-corrected symbols of the adjacent historical words of the current word, the bias vector of each candidate word is cyclically shifted to obtain the shift scores of multiple candidate words. The target word of the multi-bit payload to be embedded in the watermark segment is determined based on the shift fraction, and the multi-bit payload to be embedded is embedded into the target word.

[0074] In some embodiments, when generating text with embedded multi-bit watermarks online, the target lexical units of the multi-bit payload to be embedded in the watermark segment can be first divided into k original symbols according to the segment bits, and based on these k original symbols, n error-corrected symbols of multiple lexical units can be generated by encoding extension using the general Reed-Solomon (RS) code.

[0075] The payload to be embedded is equivalent to the entire complete secret information (such as the complete binary string of a user ID), and the original symbols after segmentation are equivalent to dividing this complete payload into small pieces, each of which is called a "symbol (original symbol)".

[0076] After RS ​​error correction coding, at least one (or more) redundant symbols are added to the end of each original symbol. At this point, each symbol in the string formed by the original symbol and the added redundant symbol is called a "corrected symbol." The watermark fragment then embeds the corrected symbols on the left and right, not the original symbols of the original payload. However, after extraction, the original symbols are recovered from all the corrected symbols and then reassembled into the original multi-bit payload to be embedded.

[0077] Furthermore, during the process of text generation word by word, i.e. the actual embedding of watermarks, the target generation model will output the original logits vector (i.e. the original score given by the model for the next word) of the current candidate noun (all options for "considering the next word to be selected" at each step when the model generates text) at each generation position.

[0078] At this point, according to the preset key and the current generation context, the entire vocabulary can be divided into two parts, "green" and "red", using a pseudo-random algorithm (such as the KGW algorithm). Green words will be "slightly encouraged" to appear, and the table composed of all green words is the generated green vocabulary list.

[0079] Then, in this embodiment of the application, a small positive bias can be applied to the original scores corresponding to the candidate words in the green word list to obtain the bias vector of each candidate word.

[0080] When the model generates the first word, it can use a fixed starting symbol or initialize it based on the context. The previous word adjacent to the current word already has a post-correction symbol (i.e., the multi-bit information it embedded) attached to it during generation. In this embodiment, a small positive bias can be applied to the green words. This small positive bias is typically a one-dimensional array, the length of which is equal to the word list size (representing how many points each word should receive). Therefore, the score of each green word in the green word list will be improved (because of the added positive bias). At this point, the bias vector for each candidate word in the green word list can be obtained as: original logits vector + positive bias vector.

[0081] Furthermore, in the generation process, the bias vector of each candidate word can be cyclically shifted based on the error-corrected symbols of the previous word adjacent to the current word (the word adjacent to the current word) to obtain the shift scores of multiple candidate words. The target word to be embedded in the watermark segment is determined according to the shift score of each candidate word, so as to embed the multi-bit load into the target word.

[0082] Specifically, in this embodiment, the "bias vector" to be added to the green word can be "cyclically shifted" according to the RS sign value of the previous word, and the final shift score of each candidate word can be obtained according to the shifted bias distribution and the original logits vector of each candidate word. Here, cyclic shift can be understood as treating the bias vector as a ring and rotating it a certain number of steps according to the sign value.

[0083] In this way, different context symbols will lead to completely different bias distributions, so the current word is more likely to be selected from a specific subset of the green vocabulary (because the current word has the highest / highest final shift score), which can serve as the target word to carry "the information that the current bit should be embedded in".

[0084] In this scenario, the information bits of the current word embedding are determined by the error-corrected symbol of the previous word, rather than by the hash of the current word itself. This dependency can be represented as a chain: the error-corrected symbol of the first word determines the embedding of the second word; the error-corrected symbol of the second word determines the embedding of the third word.

[0085] Thus, the preceding word acts like an "anchor" to lock the alignment. Even if a later word is replaced with a synonym, as long as its preceding word (anchor) is not replaced, the shifting step during extraction can still correctly restore the bit information. In the event that the anchor is also broken, the RS error-correcting code can tolerate a certain degree of error, thereby greatly mitigating synchronization vulnerabilities caused by synonym substitutions such as "happy / pleasant".

[0086] Exemplarily, assume that the watermark information to be embedded is "101100". The system will first cut it into several small symbols, such as "10", "11", "00", and then add redundant symbols through error correction coding to form a more robust set of error-corrected symbols.

[0087] When generating text, the generation model needs to select the next word at a certain position. For example, when the context is "This movie is very", the candidate words may include "wonderful", "good-looking", "excellent", "ordinary", etc. In the embodiment of this application, a green word list will be generated according to the key and the context, and the candidate words in the green word list will be slightly scored, so that the model is more inclined to select the token that can carry the current watermark symbol.

[0088] Furthermore, in the embodiment of this application, the bias distribution of the candidate words will be circularly shifted according to the error-corrected symbols carried by the adjacent historical tokens, so that different symbols correspond to different candidate word scoring patterns. For example, after the shift, the score of "wonderful" is the highest, and the model is more likely to output "wonderful", thereby embedding the watermark information without significantly damaging the naturalness of the text.

[0089] Different from the traditional method, SEMANCHOR circularly shifts the bias vector according to the RS symbol coding of the above-mentioned token, so that the sampling distribution at this position carries the corresponding multi-bit information. And because SemAnchor will map semantically similar tokens such as "wonderful" and "good-looking" to the same watermark segment as much as possible, even if the attacker replaces "wonderful" with "good-looking", the detection end can still classify it into the same segment, avoiding misalignment of the watermark segment and improving the extraction stability of the multi-bit watermark under synonym replacement.

[0090] Thus, the watermark embedding process in the embodiment of this application maintains the compatibility of the sampling interface of the language model: mechanisms such as temperature sampling, top-p truncation, EOS suppression, line break control, etc. still execute according to the original generation logic, and the watermark only manifests as a slight increase in the probability of some candidate tokens. Therefore, the system does not need to retrain the model, nor modify the tokenizer or the word list. It only needs to insert the semantic balance segment selection logic at the stage of taking the next token or processing, and can be compatible with the existing watermark framework without training the model or changing the word list. Since the mapping query is a constant time, the online additional overhead mainly comes from the generation of the green word list and the logits bias, and the complexity level can be ignored in the actual scenario.

[0091] Furthermore, when attackers perform minor rewrites such as synonym substitution, partial paraphrasing, or semantic preservation, traditional hashing will treat the replaced context words as completely unrelated new numbers, causing subsequent words to be routed to incorrect segments, resulting in large-scale errors in the RS decoding input. However, in the embodiments of this application, the semantic anchor of SEMANCHOR ensures that the replaced words and the original words remain consistent or have a higher probability of consistency at the mapping layer, so subsequent words are still routed to the same segments. Thus, the impact of the attack is mainly manifested as random fluctuations in whether individual words hit the green word list, rather than a systematic drift in segment numbers; Reed-Solomon error correction codes can absorb this kind of local noise and restore the original load.

[0092] Optionally, in one embodiment of this application, after embedding the target word in the watermark segment to be embedded with the multi-bit payload to obtain the generated text embedded with the multi-bit watermark, the method further includes: The generated text embedded with multi-bit watermarks is divided to obtain multiple words to be detected, and a pseudo-random green word list is constructed based on the preset key and the multiple words to be detected. The semantic balance mapping table is queried based on the context word number of the currently detected word to determine the error correction segment corresponding to the currently detected word; Based on the pseudo-random green word list, the cumulative support of each candidate symbol value in the score accumulation segment is obtained, and the target candidate symbol of the score accumulation segment is determined according to the cumulative support. The error-corrected symbol generated based on the target candidate symbol is used to restore the original symbol corresponding to the error-corrected symbol, so as to obtain the restored embedded multi-bit payload based on the original symbol corresponding to the error-corrected symbol.

[0093] In other embodiments, after embedding the multi-bit payload to be embedded into the target word to obtain the generated text with the multi-bit watermark, this application can also detect and decode the embedded multi-bit watermark.

[0094] For example, this application first divides the generated text embedded with a multi-bit watermark to obtain multiple words to be detected (multiple words corresponding to the generated text embedded with a multi-bit watermark). Then, at the scoreable position corresponding to each word (which can also be understood as each word being a scoreable position), the pseudo-random green word list is reconstructed using the same seed rule. That is, the pseudo-random green word list is constructed using the preset key used during embedding and the scoreable positions corresponding to multiple words to be detected.

[0095] Specifically, this application can use the generated text with embedded multi-bit watermarks as the detection text, and also segment the detection text into a word sequence. For each scoreable position, this application embodiment can use the exact same key and context rules as during embedding to generate a pseudo-random seed, and reconstruct the green word list based on it (here, to distinguish it from the green word list generated during embedding, it is called a pseudo-random green word list).

[0096] The pseudo-random green word list constructed in this way can perfectly reproduce the green word list during embedding. For example, if {good} is defined as green during embedding, then the green word list reconstructed at this position during detection must also contain {good, great}.

[0097] Then, in this embodiment of the application, the semantic balance mapping table is queried based on the context lexicon number of the currently detected lexicon to determine the error correction segment corresponding to the currently detected lexicon (the error correction segment here refers to the watermark segment carrying the RS code formed after embedding the watermark in the original watermark segment, which is also the segment to which the score of the currently detected lexicon should be accumulated). Specifically, the semantic balance mapping table is queried based on the context lexicon number of the current position to determine which segment the score of the lexicon should be accumulated to.

[0098] For example, if the text has 5 lexical units, but the watermark only has 4 segments, when determining which segment the score of the word "{good}" should be included in, this embodiment of the application can look at the previous lexical unit (contextual lexical unit) of the currently detected lexical unit "{good}". This is because the semantic balance mapping table defines which error-correcting segment the score of the currently detected lexical unit should be accumulated to when the preceding word belongs to a certain "semantic micro-cluster". Thus, even if it is found that "{happy}" has been modified to the synonym "joyful}" during detection, because "joyful" also belongs to the same cluster, according to the semantic balance mapping table, the score will still be accumulated to the same correct segment.

[0099] Furthermore, based on the constructed pseudo-random green word list, this embodiment of the application obtains the cumulative support of each candidate symbol value in each error-correcting segment, and then determines the target candidate symbol for each error-correcting segment based on the cumulative support of each candidate symbol value. Here, the target candidate symbol refers to the candidate symbol with the highest cumulative support score in each error-correcting segment.

[0100] Specifically, for each error-corrected segment, this embodiment of the application can maintain a length of 2 m The counting vector, where each vector value represents the cumulative support of each candidate symbol value of the error correction segment that is matched by the green word list.

[0101] After traversing the detected text, for each error-corrected segment, the target candidate symbol corresponding to the maximum score with the cumulative support is selected to form n error-corrected symbols. Then, Reed-Solomon decoding is called to recover k original symbols and restore the embedded multi-bit payload.

[0102] Compared to random or purely frequency-balanced mapping, SEMANCHOR can significantly reduce segment synchronization errors caused by semantic perturbations, enabling multi-bit watermarks to maintain a more stable decoding path under synonym substitution attacks.

[0103] To reduce the impact of repeated context on statistical independence, different scoring methods can be used for the cumulative support of each word element. For example, scoring can be applied to all words, only to a single context, or only to a single context plus the current word element combination. For the fragment-based method, the system further calculates the z-score or p-value based on the sum of the maximum counts of each fragment, the total number of scored words, and gamma, to measure the salience of the text carrying the target watermark. The embodiments in this application are for illustrative purposes only and do not constitute specific limitations.

[0104] This detection process does not require access to the original prompt words or the hidden state at the time of generation, making it suitable for post-audit, content tracing, and batch detection scenarios.

[0105] Additionally, the multi-bit watermark text generation method (SemAnchor) in this application embodiment was evaluated on the OpenGen benchmark using LLaMA-2-7B and compared with state-of-the-art (SOTA) methods in related technologies.

[0106] Table 1 is a comparison table of results from different methods in one embodiment of this application, which can be represented as follows, but is not limited to: Table 1

[0107] As shown in Table 1, in the performance comparison of matching rate (the proportion of the generated text that can accurately extract the embedded watermark information) and bit accuracy (the proportion of information bits correctly extracted without error correction) across different bit lengths, this application (SEMANCHOR) consistently outperforms all baselines across all evaluated bit lengths. This application maintains a matching rate exceeding 97.0% for 16-32 bit lengths and maintains an overall bit accuracy exceeding 99.2%, representing a significant improvement over other methods.

[0108] as well as, Figure 3 This diagram illustrates a comparison of the resistance of different methods to synonym substitution attacks according to one embodiment of this application. Figure 3 As shown, this application (SEMANCHOR) exhibits a more promising decay curve than other methods, achieving an 87% matching rate with a 5% perturbation (compared to 79% for the comparative method), and maintaining a 7% accuracy lead even with a severe 20% distortion. This effectively demonstrates that this application (SEMANCHOR) successfully mitigates the synchronization flaw that causes other methods to fail.

[0109] The multi-bit watermark text generation method proposed in this application can divide the lexical units of the target generation model into fine-grained semantic atoms (semantic micro-clusters), ensuring that lexical units that meet preset semantic conditions are locked into the same cluster. Based on the actual load of multiple semantic micro-clusters, the semantic micro-clusters are allocated to the corresponding watermark segments, and a semantic balance mapping table is constructed to allocate semantically similar or identical lexical units in the multi-bit load to the same watermark segment. This achieves the goal of locking semantically interchangeable lexical units into the same watermark segment by dividing lexical units that meet preset semantic conditions into a semantic atom; by using frequency-aware greedy packing to achieve near-uniform probability quality, ensuring that each watermark segment has the same activation probability; the semantic balance mapping table constructed from lexical ID to watermark segment ID can ensure that semantically similar, interchangeable, or highly interchangeable lexical units in synonym substitution attacks fall into the same watermark segment as much as possible, thereby maintaining the synchronization between watermark bits and text semantic perturbations, and enabling multi-bit watermarks to maintain a more stable decoding path and extraction stability under synonym substitution attacks. This solves the problem in related technologies where hash-based allocation mechanisms may disrupt the alignment between semantically identical terms mapped to different segments, leading to decoding failures and the inability to correctly extract the watermark.

[0110] Next, with reference to the accompanying drawings, an apparatus for generating multi-bit watermarked text according to an embodiment of this application is described.

[0111] Figure 4 This is a schematic diagram of the structure of a multi-bit watermark text generation device according to an embodiment of this application.

[0112] like Figure 4 As shown, the multi-bit watermark text generation device 10 includes: a construction module 100, a mapping module 200, and a generation module 300.

[0113] The module comprises the following components: a construction module, which acquires the word-level vector representation of the target generation model and constructs multiple semantic atoms of the target generation model based on the word-level vector representation, thereby determining multiple semantic micro-clusters of the target generation model; a mapping module, which assigns multiple semantic micro-clusters to corresponding watermark segments based on the actual loads of the multiple semantic micro-clusters, thereby constructing a semantically balanced mapping table to represent the mapping relationship between words and watermark segments; and a generation module, which embeds the multi-bit load to be embedded into the target words in the watermark segments based on the multi-bit load to be embedded and the semantically balanced mapping table, thereby obtaining the generated text with embedded multi-bit watermarks.

[0114] Optionally, in one embodiment of this application, the mapping module includes: a calculation unit, configured to obtain the word frequencies of the corpus corresponding to multiple semantic micro-clusters, and calculate the cluster load of the multiple semantic micro-clusters based on the word frequencies; and an allocation unit, configured to, if the cluster load is less than or equal to a preset load threshold, allocate the semantic micro-clusters whose cluster load is less than or equal to the preset load threshold to a single watermark segment; otherwise, split the semantic micro-clusters whose cluster load is greater than the preset load threshold to obtain the words of the semantic micro-clusters, and allocate the words to segments in the watermark segment that meet the preset empty load condition.

[0115] Optionally, in one embodiment of this application, the mapping module includes: an initialization unit, used to initialize the original mapping table using a preset key to obtain a pseudo-random sorted list; and a mapping unit, used to map the original paragraph number of the watermark fragment to a new value based on the sorted number in the pseudo-random sorted list, so as to construct a semantically balanced mapping table.

[0116] Optionally, in one embodiment of this application, the generation module includes: a segmentation unit, configured to segment the multi-bit payload to be embedded into multiple original symbols, and generate multiple error-corrected symbols based on the multiple original symbols; a processing unit, configured to generate a green word list according to a preset key and the current generation context, and apply a positive bias to the original scores corresponding to candidate words in the green word list to obtain a bias vector for each candidate word; a shifting unit, configured to cyclically shift the bias vector of each candidate word based on the error-corrected symbols of the adjacent historical words of the current word to obtain shift scores for multiple candidate words; and an embedding unit, configured to determine the target word of the multi-bit payload to be embedded in the watermark segment according to the shift scores, and embed the multi-bit payload to be embedded into the target word.

[0117] Optionally, in one embodiment of this application, it further includes: a segmentation module, used to segment the generated text with embedded multi-bit watermark after embedding the target word in the watermark segment with the multi-bit payload to be embedded, to obtain multiple words to be detected, and to construct a pseudo-random green word list based on a preset key and multiple words to be detected; a query module, used to query the semantic balance mapping table according to the context word number of the current detected word to determine the error correction segment corresponding to the current detected word; a determination module, used to obtain the cumulative support of each candidate symbol value in the error correction segment based on the pseudo-random green word list, and to determine the target candidate symbol of the error correction segment based on the cumulative support; and a restoration module, used to restore the original symbol corresponding to the error correction symbol based on the error correction symbol generated by the target candidate symbol, so as to obtain the restored embedded multi-bit payload according to the original symbol corresponding to the error correction symbol.

[0118] It should be noted that the foregoing explanation of the method embodiment for generating multi-bit watermarked text also applies to the apparatus for generating multi-bit watermarked text in this embodiment, and will not be repeated here.

[0119] The multi-bit watermark text generation apparatus proposed in this application can divide the lexical units of the target generation model into fine-grained semantic atoms (semantic micro-clusters), ensuring that lexical units that meet preset semantic conditions are locked into the same cluster. Based on the actual load of multiple semantic micro-clusters, the semantic micro-clusters are allocated to the corresponding watermark segments, and a semantic balance mapping table is constructed to allocate semantically similar or identical lexical units in the multi-bit load to the same watermark segment. This achieves the goal of locking semantically interchangeable lexical units into the same watermark segment by dividing lexical units that meet preset semantic conditions into a semantic atom; by employing frequency-aware greedy packing to achieve near-uniform probability quality, ensuring that each watermark segment has the same activation probability; the semantic balance mapping table constructed thereby from lexical ID to watermark segment ID can ensure that semantically similar, interchangeable, or highly interchangeable lexical units in synonym substitution attacks fall into the same watermark segment as much as possible, thus maintaining the synchronization between watermark bits and text semantic perturbations, and enabling multi-bit watermarks to maintain a more stable decoding path and extraction stability under synonym substitution attacks. This solves the problem in related technologies where hash-based allocation mechanisms may disrupt the alignment between semantically identical terms mapped to different segments, leading to decoding failures and the inability to correctly extract the watermark.

[0120] Figure 5 A schematic diagram of the structure of an electronic device provided in an embodiment of this application. The electronic device may include: The memory 501, the processor 502, and the computer program stored on the memory 501 and capable of running on the processor 502.

[0121] When the processor 502 executes the program, it implements the method for generating multi-bit watermarked text provided in the above embodiments.

[0122] Furthermore, electronic devices also include: Communication interface 503 is used for communication between memory 501 and processor 502.

[0123] The memory 501 is used to store computer programs that can run on the processor 502.

[0124] Memory 501 may include high-speed RAM memory, and may also include non-volatile memory, such as at least one disk storage device.

[0125] If the memory 501, processor 502, and communication interface 503 are implemented independently, then the communication interface 503, memory 501, and processor 502 can be interconnected via a bus to complete communication between them. The bus can be an Industry Standard Architecture (ISA) bus, a Peripheral Component Interconnect (PCI) bus, or an Extended Industry Standard Architecture (EISA) bus, etc. The bus can be divided into address bus, data bus, control bus, etc. For ease of representation, Figure 5 The bus is represented by a single thick line, but this does not mean that there is only one bus or one type of bus.

[0126] Optionally, in a specific implementation, if the memory 501, processor 502, and communication interface 503 are integrated on a single chip, then the memory 501, processor 502, and communication interface 503 can communicate with each other through an internal interface.

[0127] Processor 502 may be a central processing unit (CPU), an application specific integrated circuit (ASIC), or one or more integrated circuits configured to implement the embodiments of this application.

[0128] This application also provides a computer-readable storage medium storing a computer program that, when executed by a processor, implements the above-described method for generating multi-bit watermarked text.

[0129] This application also provides a computer program product, including a computer program that can execute computer instructions. When the computer instructions are executed by a processor, they implement the method for generating multi-bit watermarked text provided in this application.

[0130] In the description of this specification, the references to terms such as "one embodiment," "some embodiments," "example," "specific example," or "some examples," etc., indicate that a specific feature, structure, material, or characteristic described in connection with that embodiment or example is included in at least one embodiment or example of this application. In this specification, the illustrative expressions of the above terms do not necessarily refer to the same embodiment or example. Furthermore, the specific features, structures, materials, or characteristics described may be combined in any suitable manner in one or more embodiments or examples. Moreover, without contradiction, those skilled in the art can combine and integrate the different embodiments or examples described in this specification, as well as the features of different embodiments or examples.

[0131] Furthermore, the terms "first" and "second" are used for descriptive purposes only and should not be construed as indicating or implying relative importance or implicitly specifying the number of technical features indicated. Thus, a feature defined as "first" or "second" may explicitly or implicitly include at least one of that feature. In the description of this application, "N" means at least two, such as two, three, etc., unless otherwise explicitly specified.

[0132] Any process or method described in the flowchart or otherwise herein can be understood as representing a module, segment, or portion of code comprising one or N executable instructions for implementing custom logic functions or processes, and the scope of the preferred embodiments of this application includes additional implementations in which functions may be performed not in the order shown or discussed, including substantially simultaneously or in reverse order depending on the functions involved, as should be understood by those skilled in the art to which embodiments of this application pertain.

[0133] The logic and / or steps represented in the flowchart or otherwise described herein, for example, can be considered as a sequenced list of executable instructions for implementing logical functions, and can be embodied in any computer-readable medium for use by, or in conjunction with, an instruction execution system, apparatus, or device (such as a computer-based system, a processor-included system, or other system that can fetch and execute instructions from, an instruction execution system, apparatus, or device). For the purposes of this specification, "computer-readable medium" can be any means that can contain, store, communicate, propagate, or transmit programs for use by, or in conjunction with, an instruction execution system, apparatus, or device. More specific examples (a non-exhaustive list) of computer-readable media include: an electrical connection having one or more wires (electronic device), a portable computer disk drive (magnetic device), random access memory (RAM), read-only memory (ROM), erasable and editable read-only memory (EPROM or flash memory), fiber optic devices, and portable optical disc read-only memory (CDROM). Alternatively, the computer-readable medium may be paper or other suitable media on which the program can be printed, since the program can be obtained electronically by optically scanning the paper or other medium, followed by editing, interpreting, or otherwise processing as necessary, and then stored in a computer memory.

[0134] It should be understood that the various parts of this application can be implemented using hardware, software, firmware, or a combination thereof. In the above embodiments, the N steps or methods can be implemented using software or firmware stored in memory and executed by a suitable instruction execution system. If implemented in hardware, as in another embodiment, it can be implemented using any one or more of the following techniques known in the art: discrete logic circuits having logic gates for implementing logical functions on data signals, application-specific integrated circuits (ASICs) having suitable combinational logic gates, programmable gate arrays (PGAs), field-programmable gate arrays (FPGAs), etc.

[0135] Those skilled in the art will understand that all or part of the steps of the methods in the above embodiments can be implemented by a program instructing related hardware. The program can be stored in a computer-readable storage medium, and when executed, the program includes one or a combination of the steps of the method embodiments.

[0136] Furthermore, the functional units in the various embodiments of this application can be integrated into a processing module, or each unit can exist physically separately, or two or more units can be integrated into a module. The integrated module can be implemented in hardware or as a software functional module. If the integrated module is implemented as a software functional module and sold or used as an independent product, it can also be stored in a computer-readable storage medium.

[0137] The storage medium mentioned above can be a read-only memory, a disk, or an optical disk, etc. Although embodiments of this application have been shown and described above, it is understood that the above embodiments are exemplary and should not be construed as limiting this application. Those skilled in the art can make changes, modifications, substitutions, and variations to the above embodiments within the scope of this application.

Claims

1. A method for generating a multi-bit watermark text, characterized by, Includes the following steps: Obtain the word-level vector representation of the target generation model, and construct multiple semantic atoms of the target generation model based on the word-level vector representation, so as to determine multiple semantic micro-clusters of the target generation model according to the multiple semantic atoms; Based on the actual load of the multiple semantic microclusters, the multiple semantic microclusters are assigned to the corresponding watermark fragments to construct a semantic balanced mapping table for representing the mapping relationship between lexical units and watermark fragments; Based on the multi-bit payload to be embedded and the semantic balance mapping table, the multi-bit payload to be embedded is embedded into the target word in the watermark fragment to obtain the generated text with the multi-bit watermark.

2. The method of claim 1, wherein, The process of assigning multiple semantic micro-clusters to corresponding watermark fragments includes: Obtain the word frequencies of the corpora corresponding to the multiple semantic microclusters, and calculate the cluster load of the multiple semantic microclusters based on the word frequencies; If the cluster load is less than or equal to a preset load threshold, the semantic micro-clusters whose cluster load is less than or equal to the preset load threshold are assigned to a single watermark fragment; otherwise, the semantic micro-clusters whose cluster load is greater than the preset load threshold are split to obtain the lexical units of the semantic micro-clusters, and the lexical units are assigned to the fragments in the watermark fragments that meet the preset empty load condition.

3. The method according to claim 1, characterized in that, The step of assigning multiple semantic micro-clusters to corresponding watermark fragments to construct a semantically balanced mapping table for representing the mapping relationship between lexical units and watermark fragments includes: The original mapping table is initialized using a preset key to obtain a pseudo-random sorting table; Based on the permutation number in the pseudo-random permutation list, the original paragraph number of the watermark fragment is mapped to a new value to construct the semantic balance mapping table.

4. The method according to claim 1, characterized in that, The step of embedding the multi-bit payload into the target words in the watermark fragment based on the multi-bit payload to be embedded and the semantic balance mapping table to obtain the generated text with embedded multi-bit watermark includes: The multi-bit payload to be embedded is divided into multiple original symbols, and multiple error-corrected symbols are generated based on the multiple original symbols; A green word list is generated based on a preset key and the current generation context, and a positive bias is applied to the original scores corresponding to candidate words in the green word list to obtain a bias vector for each candidate word. Based on the error-corrected symbols of the adjacent historical words of the current word, the bias vector of each candidate word is cyclically shifted to obtain the shift scores of multiple candidate words. The target word of the multi-bit payload to be embedded in the watermark segment is determined based on the shift fraction, and the multi-bit payload to be embedded is embedded in the target word.

5. The method according to claim 4, characterized in that, After embedding the target words of the multi-bit payload to be embedded into the watermark fragment to obtain the generated text with the multi-bit watermark, the method further includes: The generated text embedded with the multi-bit watermark is divided to obtain multiple words to be detected, and a pseudo-random green word list is constructed based on the preset key and the multiple words to be detected. The semantic balance mapping table is queried based on the context word number of the currently detected word to determine the error correction segment corresponding to the currently detected word; Based on the pseudo-random green word list, the cumulative support of each candidate symbol value in the error correction segment is obtained, and the target candidate symbol of the error correction segment is determined according to the cumulative support. Based on the error-corrected symbol generated from the target candidate symbol, the original symbol corresponding to the error-corrected symbol is restored, so as to obtain the restored embedded multi-bit payload according to the original symbol corresponding to the error-corrected symbol.

6. A device for generating multi-bit watermarked text, characterized in that, A construction module is used to obtain the word-level vector representation of the target generation model, and based on the word-level vector representation, construct multiple semantic atoms of the target generation model to determine multiple semantic micro-clusters of the target generation model according to the multiple semantic atoms; The mapping module is used to assign multiple semantic microclusters to corresponding watermark fragments based on the actual load of the multiple semantic microclusters, so as to construct a semantic balanced mapping table for representing the mapping relationship between lexical units and watermark fragments; The generation module is used to embed the multi-bit payload to be embedded into the target word in the watermark fragment based on the multi-bit payload to be embedded and the semantic balance mapping table, so as to obtain the generated text with the multi-bit watermark embedded.

7. The apparatus according to claim 6, characterized in that, The mapping module includes: A computing unit is used to obtain the word frequencies of the corpus corresponding to the multiple semantic microclusters, and to calculate the cluster load of the multiple semantic microclusters based on the word frequencies; The allocation unit is configured to, if the cluster load is less than or equal to a preset load threshold, allocate semantic micro-clusters whose cluster load is less than or equal to the preset load threshold to a single watermark fragment; otherwise, split semantic micro-clusters whose cluster load is greater than the preset load threshold to obtain the lexical units of the semantic micro-clusters, and allocate the lexical units to fragments in the watermark fragment that meet the preset empty load condition.

8. An electronic device, characterized in that, include: A memory, a processor, and a computer program stored in the memory and executable on the processor, the processor executing the program to implement the method for generating multi-bit watermarked text as described in any one of claims 1-5.

9. A computer-readable storage medium having a computer program stored thereon, characterized in that, The program is executed by the processor to implement the method for generating multi-bit watermarked text as described in any one of claims 1-5.

10. A computer program product, comprising a computer program, characterized in that, When the computer program is executed, it is used to implement the method for generating multi-bit watermarked text as described in any one of claims 1-5.

Images