A watermark mark injection method, a watermark mark extraction method, and an electronic device

Abstract

The application discloses a watermark identification injection method, a watermark identification extraction method and electronic equipment, and belongs to the technical field of API data security, and comprises the following steps: extracting a Leemmer code of a watermark identification to be injected, and performing watermarking on each semi-structured data object in API response data based on the Leemmer code; and replacing each semi-structured data object in the response data with a corresponding watermarked semi-structured data object, and returning to a client. The application encodes identification information as the arrangement combination of key-value pairs by using the semantic redundancy of the arrangement order of the key-value pairs in semi-structured data, realizes distortionless identification injection of API response data, can realize traceable identification injection without changing the data semantic content and without relying on a third-party feature library, and is suitable for data tracing and leakage tracking scenes.

Description

Technical Field

[0001] This invention belongs to the field of API data security technology, and more specifically, relates to a watermark injection method, a watermark extraction method, and an electronic device. Background Technology

[0002] APIs (Application Programming Interfaces) have become the primary channel for modern software systems to provide services, exchange data, and interact with AI models. From cloud-based microservices to large language model platforms, APIs carry the flow of massive amounts of sensitive data. However, when API interfaces lack proper authentication, authorization, or frequency limits, malicious callers may collect data on a large scale and then resell, redistribute, or use it to train competing models. Once data leaves the server boundary, the data provider loses control over its distribution path, making effective attribution technologies crucial for deterring and detecting data breaches.

[0003] Digital watermarking technology embeds identifiable information into data carriers, allowing the source of a leak to be traced by extracting the watermark, making it a key means of data traceability. Existing technical solutions can be mainly divided into the following categories: One approach is based on modifying the database content. This type of scheme embeds the watermark by modifying the low-order bits of numerical attributes in the database. Subsequent researchers have proposed reversible watermarking, semantically driven watermarking, and improved schemes based on genetic algorithms. However, all of these schemes require direct modification of the backend database content, which faces high deployment costs and business continuity risks in engineering practice.

[0004] The second approach is based on modifying semi-structured data values. Existing technologies embed information by modifying the values ​​of specific key-value pairs in JSON / XML data, or design watermark decoding algorithms for semi-structured data. However, any modification to data values—even a tiny offset after the decimal point—can trigger errors in downstream business logic that relies on precise numerical values, and business operators are often unwilling to accept such risks.

[0005] Thirdly, there are zero-watermarking schemes. These schemes construct zero-distortion watermarks through data partitioning and feature extraction, or achieve zero-distortion blind reversible watermarks based on primary key tags. These schemes do not modify the data itself, but require maintaining a trusted third-party feature library to store and retrieve watermark features. If the feature library is corrupted or unavailable, watermark extraction will fail, introducing a single point of failure risk in practical deployments.

[0006] In summary, the core challenge faced by existing technologies in API data protection scenarios lies in how to achieve traceable identifier injection without altering the semantic content of the data, modifying the business code, or relying on third-party signature libraries. Summary of the Invention

[0007] In view of the above-mentioned defects or improvement needs of the existing technology, the present invention provides a watermark injection method, a watermark extraction method and an electronic device, the purpose of which is to achieve traceable identifier injection without changing the semantic content of the data and without relying on a third-party feature library.

[0008] To achieve the above objectives, in a first aspect, the present invention provides a watermark injection method, comprising: Retrieve the response data returned by the API server to the client; Based on preset capacity threshold Extract the Lyme code C of the watermark identifier to be injected: Convert the watermark identifier to be injected into a decimal number M, and decompose it into... ; the factorial coefficient sequence The Lemo code is C; the watermark identifier to be injected is a binary sequence; the coefficient... ; L represents the bit length of the watermark identifier to be injected. Extract the semi-structured data objects from the response data; based on the Lyme code C, watermark each semi-structured data object to obtain the corresponding watermarked semi-structured data object; replace each semi-structured data object in the response data with the corresponding watermarked semi-structured data object and return it to the client; The methods for watermarking any semi-structured data object D include: For semi-structured data object D every Divide the key-value pairs into one or more key-value pair groups; For each group, the number of key-value pairs is Key-value pair group P: Sort the key-value pairs in key-value pair group P according to the preset sorting rules of the key names to obtain the corresponding base key-value pair sequence. Use the codewords in the Lymer code C in chronological order as the current target indices, starting from the current sequence. Retrieve the key-value pair at the current target index from the sequence, and remove the key-value pair from the current sequence before the next key-value pair retrieval. Delete; sort the extracted key-value pairs according to the order in which they were extracted into the corresponding watermarked key order; The obtained watermarked key sequence is concatenated according to the order of the corresponding key-value pairs in the semi-structured data object D to obtain the concatenated key sequence. When the number of key-value pairs in all key-value pair groups is 1 When the concatenated key sequence is used as the watermarked semi-structured data object corresponding to the semi-structured data object D; when the number of key-value pairs is less than When creating a key-value pair, append it to the concatenation key sequence to form the watermarked semi-structured data object corresponding to the semi-structured data object D.

[0009] More preferably, the method of watermarking any semi-structured data object D further includes: watermarking the semi-structured data object D every [percentage missing]. Before partitioning the key-value pairs, when the number of key-value pairs in the semi-structured data object D is less than [number missing], [the following text is incomplete and requires further context: "before partitioning the key-value pairs, when the number of key-value pairs in the semi-structured data object D is less than [number missing], [the following text is incomplete and requires further context: " At that time, key-value pair padding is performed on the semi-structured data object D to ensure that the number of key-value pairs is greater than or equal to the number of key-value pairs in the object. .

[0010] More preferably, .

[0011] More preferably, sorting the key-value pairs in the key-value pair group P according to a preset sorting rule for the key names includes: sorting the key-value pairs in the key-value pair group P according to the order of the key names in the dictionary.

[0012] More preferably, the semi-structured data object is a JSON object or an XML object; when the semi-structured data object is a JSON object, the key-value pairs in the semi-structured data object are its top-level key-value pairs; when the semi-structured data object is an XML object, the key name and the corresponding value in the semi-structured data object correspond to the tag name and content of the child element at the same level, respectively.

[0013] More preferably, the above-mentioned acquisition of the response data returned by the API server to the client includes: intercepting the response data returned by the API server to the client using a reverse proxy gateway.

[0014] In a second aspect, the present invention provides a watermark injection system, comprising: a memory and a processor, wherein the memory stores a computer program, and the processor executes the watermark injection method provided in the first aspect of the present invention when executing the computer program.

[0015] Thirdly, the present invention provides a method for extracting watermark identifiers, including: Obtain watermarked semi-structured data ; Watermarking semi-structured data Every Divide the key-value pairs into one or more key-value pair groups; For each group, the number of key-value pairs is Key-value pair group P': Sort the key-value pairs in key-value pair group P' according to the preset sorting rules of the key names to obtain the corresponding base key-value pair sequence. Take the key-value pairs in key-value pair group P' in order and use them as the current target key-value pairs to obtain the current target key-value pairs in the current sequence. The index is used to retrieve the target key-value pair from the current sequence before the next index retrieval. Delete; sort the obtained indices according to the order in which they were obtained to form the corresponding predicted Lymer codes. And calculate the corresponding predicted integer. Predicting integers Convert to the corresponding binary sequence; Set each bit value in the watermark identifier to be extracted to the number of key-value pairs in the group. The watermark identifier is obtained by extracting the bit value that appears most frequently in the binary sequence corresponding to all key-value pairs. Among them, watermarked semi-structured data The watermark is obtained by watermarking a semi-structured data object using the watermark injection method provided in the first aspect of the present invention. Both the preset sorting rules and the threshold values ​​in the watermark injection method provided in the first aspect of this invention are consistent with those in the watermark injection method. It corresponds to the same preset sorting rules.

[0016] Fourthly, the present invention provides a watermark extraction system, comprising: a memory and a processor, wherein the memory stores a computer program, and the processor executes the watermark extraction method provided in the third aspect of the present invention when executing the computer program.

[0017] Fifthly, the present invention also provides an electronic device, wherein the computer-readable storage medium includes a stored computer program, wherein the computer program, when executed by a processor, controls the device containing the storage medium to execute the identifier injection method provided in the first aspect of the present invention or the identifier extraction method provided in the third aspect.

[0018] In a sixth aspect, the present invention also provides a computer-readable storage medium comprising a stored computer program, wherein the computer program, when executed by a processor, controls the device where the storage medium is located to execute the identifier injection method provided in the first aspect or the identifier extraction method provided in the third aspect of the present invention.

[0019] In a seventh aspect, the invention also provides a computer program product, including a computer program / instruction that, when executed by a processor, implements the identifier injection method provided in the first aspect of the invention or the identifier extraction method provided in the third aspect.

[0020] In summary, the above-described technical solutions conceived in this invention can achieve the following beneficial effects: 1. This invention provides a watermark injection method. It extracts the Lymo code of the watermark to be injected and watermarks each semi-structured data object in the API response data based on the Lymo code. Each semi-structured data object in the API response data is then replaced with the corresponding watermarked semi-structured data object, and the result is returned to the client. This invention utilizes the semantic redundancy of the key-value pair arrangement in semi-structured data to encode the identifier information as a permutation of key-value pairs, achieving lossless identifier injection into API response data without altering any data values ​​or relying on third-party feature libraries. It is completely robust to numerical tampering attacks and key insertion attacks. Therefore, this invention can achieve traceable identifier injection without changing the semantic content of the data or relying on third-party feature libraries, making it suitable for data tracing and leakage tracking scenarios.

[0021] 2. Furthermore, in the watermark injection method provided by this invention, This maximizes the utilization of the key-value pair arrangement order in semi-structured data, enabling the division of the most key-value pair groups and the injection of the most watermark identifiers in the same semi-structured data.

[0022] 3. Furthermore, the watermark injection method provided by this invention uses a reverse proxy gateway to intercept the response data returned by the API server to the client, so that neither the server nor the client code needs to be modified. The hot-swappable feature of the gateway allows the system to access or remove the identifier injection function without downtime, achieving transparent and non-intrusive deployment. Attached Figure Description

[0023] Figure 1 This is a schematic diagram illustrating the deployment method of the system in which the watermark injection method provided in this embodiment of the invention is located; Figure 2 This is a flowchart illustrating the watermark injection method provided in an embodiment of the present invention. Figure 3 A schematic diagram of the location encoding principle provided in an embodiment of the present invention; Figure 4 This is a schematic diagram illustrating the principle of watermark extraction provided in an embodiment of the present invention. Detailed Implementation

[0024] To make the objectives, technical solutions, and advantages of this invention clearer, the invention will be further described in detail below with reference to the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are merely illustrative and not intended to limit the invention. Furthermore, the technical features involved in the various embodiments of this invention described below can be combined with each other as long as they do not conflict with each other.

[0025] To achieve the above objectives, in a first aspect, the present invention provides a watermark injection method, comprising: Retrieve the response data returned by the API server to the client; the response data contains semi-structured data objects. Based on preset capacity threshold Extract the Lyme code C of the watermark identifier to be injected: Convert the watermark identifier to be injected into a decimal number M, and decompose it into... ; the factorial coefficient sequence The Lemo code is C; the watermark identifier to be injected is a binary sequence; the coefficient... ; L represents the bit length of the watermark identifier to be injected. Extract the semi-structured data objects from the response data; based on the Lyme code C, watermark each semi-structured data object to obtain the corresponding watermarked semi-structured data object; replace each semi-structured data object in the response data with the corresponding watermarked semi-structured data object and return it to the client; The methods for watermarking any semi-structured data object D include: For semi-structured data object D every Divide the key-value pairs into one or more key-value pair groups; For each group, the number of key-value pairs is Key-value pair group P: Sort the key-value pairs in key-value pair group P according to the preset sorting rules of the key names to obtain the corresponding base key-value pair sequence. Use the codewords in the Lymer code C in chronological order as the current target indices, starting from the current sequence. Retrieve the key-value pair at the current target index from the sequence, and remove the key-value pair from the current sequence before the next key-value pair retrieval. Delete; sort the extracted key-value pairs according to the order in which they were extracted into the corresponding watermarked key order; The obtained watermarked key sequence is concatenated according to the order of the corresponding key-value pairs in the semi-structured data object D to obtain the concatenated key sequence. When the number of key-value pairs in all key-value pair groups is 1 When the concatenated key sequence is used as the watermarked semi-structured data object corresponding to the semi-structured data object D; when the number of key-value pairs is less than When creating a key-value pair, append it to the concatenation key sequence to form the watermarked semi-structured data object corresponding to the semi-structured data object D.

[0026] In summary, this invention achieves lossless identifier injection into API response data without altering any data values. It is fully robust to numerical tampering attacks and key insertion attacks, and is suitable for data tracing and leakage tracking scenarios.

[0027] Preferably, in one optional implementation, the method of watermarking any semi-structured data object D further includes: watermarking the semi-structured data object D every [percentage missing]. Before partitioning the key-value pairs, when the number of key-value pairs in the semi-structured data object D is less than [number missing], [the following text is incomplete and requires further context: "before partitioning the key-value pairs, when the number of key-value pairs in the semi-structured data object D is less than [number missing], [the following text is incomplete and requires further context: " At that time, key-value pair padding is performed on the semi-structured data object D to ensure that the number of key-value pairs is greater than or equal to the number of key-value pairs in the object. .

[0028] Preferably, in one optional implementation, .

[0029] It should be noted that there are various preset sorting rules, such as sorting according to the order of the key names in the dictionary (ascending or descending order is acceptable), sorting according to the UTF-8 encoded byte values ​​of the key names, etc., which are not limited here. Preferably, in an optional implementation, sorting the key-value pairs in the key-value pair group P according to the preset sorting rules of the key names includes: sorting the key-value pairs in the key-value pair group P according to the order of the key names in the dictionary.

[0030] In one optional implementation, the semi-structured data object is a JSON object or an XML object; when the semi-structured data object is a JSON object, the key-value pairs in the semi-structured data object are its top-level key-value pairs; when the semi-structured data object is an XML object, the key name and the corresponding value in the semi-structured data object correspond to the tag name and content of the child element at the same level, respectively.

[0031] It should be noted that there are multiple methods for obtaining the response data returned by the API server to the client, such as interception using a reverse proxy gateway, client browser proxy interception, application code interception, etc., which are not limited here. Preferably, in one optional implementation, obtaining the response data returned by the API server to the client includes: intercepting the response data returned by the API server to the client using a reverse proxy gateway. This method does not require modification of the business system code and can achieve transparent and non-intrusive deployment.

[0032] In a second aspect, the present invention provides a watermark injection system, comprising: a memory and a processor, wherein the memory stores a computer program, and the processor executes the watermark injection method provided in the first aspect of the present invention when executing the computer program.

[0033] The related technical solutions are the same as the identifier injection method provided in the first aspect of this invention, and will not be described in detail here.

[0034] Thirdly, the present invention provides a method for extracting watermark identifiers, including: Obtain watermarked semi-structured data ; Watermarking semi-structured data Every Divide the key-value pairs into one or more key-value pair groups; For each group, the number of key-value pairs is Key-value pair group P': Sort the key-value pairs in key-value pair group P' according to the preset sorting rules of the key names to obtain the corresponding base key-value pair sequence. Take the key-value pairs in key-value pair group P' in order and use them as the current target key-value pairs to obtain the current target key-value pairs in the current sequence. The index is used to retrieve the target key-value pair from the current sequence before the next index retrieval. Delete; sort the obtained indices according to the order in which they were obtained to form the corresponding predicted Lymer codes. And calculate the corresponding predicted integer. Predicting integers Convert to the corresponding binary sequence; Set each bit value in the watermark identifier to be extracted to the number of key-value pairs in the group. The watermark identifier is obtained by extracting the bit value that appears most frequently in the binary sequence corresponding to all key-value pairs. Among them, watermarked semi-structured data The watermark is obtained by watermarking a semi-structured data object using the watermark injection method provided in the first aspect of the present invention. Both the preset sorting rules and the threshold values ​​in the watermark injection method provided in the first aspect of this invention are consistent with those in the watermark injection method. It corresponds to the same preset sorting rules.

[0035] The related technical solutions are the same as the identifier injection method provided in the first aspect of this invention, and will not be described in detail here.

[0036] To further illustrate the watermark injection method and watermark extraction method provided by the present invention, a detailed description is given below with reference to a specific embodiment: This embodiment provides a watermark injection method based on reverse proxy and location encoding, applied to an API data interaction environment. The corresponding system is deployed on the network path between the API server and the client, and mainly includes: a reverse proxy gateway, a response interception module, a Lymo code decomposition module, a location encoding module, and a response forwarding module. The response interception module intercepts the response data returned by the API server to the client; the Lymo code decomposition module extracts the Lymo code of the watermark to be injected; the location encoding module extracts semi-structured data objects from the response data, groups the key-value pairs in the semi-structured data objects, rearranges the keys in each group lexicographically to obtain the corresponding base key-value pair sequence, and then assembles the watermarked semi-structured data object based on the watermarked key sequence corresponding to the Lymo code; the response forwarding module replaces each semi-structured data object in the response data with the corresponding watermarked semi-structured data object and returns it to the client. All modules work together to achieve lossless injection and transparent forwarding of API response data.

[0037] The core of this embodiment lies in: utilizing the semantic redundancy of the key-value pair arrangement order in semi-structured data to encode the identification information into a permutation and combination of keys, and achieving transparent and non-intrusive deployment through a proxy gateway.

[0038] The system deployment method in this embodiment is as follows: Figure 1 As shown, a reverse proxy gateway is deployed between the API server and the client. This gateway intercepts every response data packet sent from the server to the client. After extracting the semi-structured data object in JSON or XML format, the gateway performs a positional encoding algorithm to generate a watermarked key sequence, and encapsulates the reordered data into a new response before forwarding it to the client. Throughout this process, neither the API server nor the client needs to modify any code; the server is unaware of the gateway's existence, and the data received by the client is semantically equivalent to the original data.

[0039] The core encoding method of this embodiment is as follows: Figure 2 and Figure 3 As shown.

[0040] First, set a capacity threshold T (the selection of T satisfies...). Where L is the bit length of the watermark identifier to be injected), the binary identifier information to be injected is converted into decimal M, and then factorized into factorial: , where the coefficient In this embodiment, the decomposition uses successive division with remainder: Let ,right arrive Calculate in sequence , The coefficient sequence This constitutes a Lymer code—a Lymer code is an integer range. and Bijective transformation between all T! permutations of elements.

[0041] For the semi-structured data object containing the extracted response data, in this embodiment it is a JSON object with N keys, and the N keys are divided into... In this embodiment, each group contains exactly T keys. When the total number of keys N is insufficient to meet the grouping requirements, preset padding key-value pairs are inserted into the semi-structured data object to satisfy the grouping conditions; the remaining keys that are insufficient to form a group retain their original order and are not processed.

[0042] For each group, The key-value pairs are sorted in ascending order by the key names in the dictionary. This yields the base key-value pair sequence. Then, the watermarking key sequence is recursively constructed according to the Lymer code. Step j From the current remaining ordered sequence Select position The key at the location as And remove the key-value pair from the current base key-value pair sequence to obtain The final step: After all g groups have been processed, the key-value pairs within each group are rearranged according to their corresponding identifier key order, while all original data values ​​are preserved intact, thus obtaining the injected identifier JSON object.

[0043] When it is necessary to extract identifiers from suspected leaked data to trace its source, the extraction process is the inverse operation of the injection process, such as... Figure 4 As shown. Obtain watermarked semi-structured data. Watermarking semi-structured data Every Divide the key-value pairs into one or more key-value pair groups; for each key-value pair group P', divide it into... The key-value pairs are sorted in ascending order by their key names in the dictionary to obtain the corresponding baseline key-value pair sequence. Key-value pairs in key-value pair group P' are then extracted sequentially, one at a time. The index position of this key-value pair in the current baseline key-value pair sequence is recorded, and then the key-value pair is deleted from the current baseline key-value pair sequence before the next key-value pair is extracted. The resulting indices are sorted according to the order in which they were obtained to form the corresponding predicted Lymer codes, which are then analyzed using a factorial polynomial. Restore the integer to its original value and then convert it to a binary sequence. Finally, perform a bit-by-bit majority vote on the extracted bits of all g groups, and the bit value with the most votes is taken as the final extraction result; specifically, set each bit value in the watermark identifier to be extracted to a number of key-value pairs within the group. The watermark identifier is obtained by extracting the bit value that appears most frequently in the binary sequence corresponding to all key-value pairs.

[0044] This embodiment has the following beneficial effects. Distortion-free characteristics: This embodiment uses redundancy in key sequence for encoding, without modifying any key names or values ​​of the data, ensuring that the watermarked data is semantically equivalent to the original data, and the business system can consume the tagged data normally without any adaptation.

[0045] Plug-and-play deployment: The reverse proxy gateway architecture achieves zero coupling with existing systems. No modifications are required to the server or client code, and the gateway's hot-swappable nature allows the system to add or remove identity injection functionality without downtime.

[0046] Robustness against complete tampering and insertion attacks: Since the watermark information is encoded only in the relative order of the keys, any modification to the data values ​​by an attacker (tampering attack) does not affect the key order, thus the watermark remains 100% extractable. Similarly, an attacker inserting new key-value pairs into the JSON (insertion attack) will not change the relative order between the original keys, and the watermark of the original groups remains intact; the added keys may disrupt part of the group structure, but the majority voting mechanism can effectively eliminate interference from a few disrupted groups.

[0047] No third-party dependency: The injection and extraction of identifiers rely solely on the key structure of the data itself and an optional shared key, eliminating the need to maintain any external feature library or trusted third party, thus eliminating the single point of failure risk in zero-watermark schemes.

[0048] Based on the actual network environment and security requirements, this embodiment supports two typical deployment modes: client proxy mode and server proxy mode. These are described below through two specific implementation methods: Implementation Method 1: Client Proxy Mode – Terminal API Call Scenario This implementation details the deployment, use, and evidence collection process of this embodiment in the client proxy mode.

[0049] 1) Deployment method In this implementation, the program is deployed on the client device as a computer program. This program runs as a local proxy service, listening on port 1080 of the client's loopback address. The client application directs HTTP requests to this local proxy address. The proxy program intercepts requests from the client and responses returned by the server. The deployment process does not modify any code on the API server side or change any server-side configuration.

[0050] 2) Workflow The client called a user information query API. The original API server returned the following JSON response data: {"user_id":"12345","user_name":"Zhang San","department":"Technical Department","employee_level":"P7","hire_date":"2020-01-15"} The program assigns a unique watermark identifier to the current client device, with a binary value of 10110010. The reverse proxy module intercepts this response data, parses the JSON object, and extracts its top-level key-value pair collection. ["user_id","user_name","department","employee_level","hire_date"] The Lymer code decomposition module decomposes the watermark identifier into a specific sequence of factorial coefficients, and the position encoding module encodes this sequence into a specific key order. The key order in the original JSON is then rearranged as follows: ["user_id","user_name","hire_date","department","employee_level"] The response forwarding module forwards the rearranged, tokenized JSON response to the client: {"user_id":"12345","user_name":"Zhang San","hire_date":"2020-01-15","department":"Technical Department","employee_level":"P7"} All key names and key values ​​are exactly the same as in the original response; only the order of the keys has changed. According to the JSON specification, the order of object keys does not carry semantic information, so the client's business logic processes the response normally.

[0051] 3) Evidence collection process When the security team obtained a piece of JSON data suspected of being leaked from an external source, its content was: {"user_id":"12345","user_name":"Zhang San","hire_date":"2020-01-15","department":"Technical Department","employee_level":"P7"} Forensic personnel input the leaked data into an identifier extraction program. The program analyzed the key sequence of the JSON and extracted the watermark identifier 10110010. This identifier was compared with the identifier database assigned to each device in the client proxy program, successfully identifying the source of the leak as the client device.

[0052] Implementation Method 2: Client Proxy Mode – Large Language Model API Egress Gateway Scenario This implementation details the deployment, use, and evidence collection process of this embodiment in the server-side proxy mode, and is applied to the scenario where a large language model service provider injects identifiers into its API responses.

[0053] (a) Deployment method In this implementation, the gateway device is deployed as a standalone gateway at the API server egress boundary of the large language model service provider. This gateway device is connected in series between the load balancer and the external router, and all large model API response traffic leaving the data center must pass through this gateway. The gateway device is transparent to the internal network servers, requiring no configuration modifications. The gateway device is also transparent to third-party clients calling the large model API; the clients are unaware of the gateway's existence.

[0054] (b) Workflow A major language model service provider offers a text generation API to third-party applications. After the third-party application sends a request, the raw JSON response returned by the major model API server is as follows: {"id":"chatcmpl-abc123","object":"chat.completion","created":1699000000,"model":"gpt-4","choices":[{"index":0,"message":{"role":"assistant","content":"what is artificial intelligence"},"finish_reason":"stop"}],"us age":{"prompt_tokens":25,"completion_tokens":42,"total_tokens":67}} The gateway management console assigns a unique watermark identifier (binary value 11001101) to the third-party application currently calling this API. The reverse proxy gateway intercepts this response data, parses the JSON object, and extracts its top-level key-value pair collection. The top-level keys include: ["id", "object", "created", "model", "choices", "usage"] The position encoding module encodes the watermark identifier into a specific key order. After encoding, the key order in the original JSON is rearranged as follows: ["usage", "id", "model", "choices", "created", "object"] The gateway forwards the rearranged, tokenized JSON response to the third-party application: {"usage":{"prompt_tokens":25,"completion_tokens":42,"total_tokens":67},"id":"chatcmpl-abc123","model":"gpt-4","choices":[{"index":0,"message":{"role":"assistant","content":"what is artificial intelligence"}," finish_reason":"stop"}],"created":1699000000,"object":"chat.completion"} The third-party application parses the response in a standard manner, and the business logic runs normally.

[0055] (c) Evidence collection process When a large model service provider discovered that a third-party application was leaking text content generated by calling the large model API to the external network, the service provider obtained a sample of the corresponding API response JSON data from the leaked content. {"usage":{"prompt_tokens":25,"completion_tokens":42,"total_tokens":67},"id":"chatcmpl-abc123","model":"gpt-4","choices":[{"index":0,"message":{"role":"assistant","content":"what is artificial intelligence"}," finish_reason":"stop"}],"created":1699000000,"object":"chat.completion"} Forensic personnel input the leaked data into an identifier extraction program. The program analyzed the key sequence of the JSON and extracted the watermark identifier 11001101. The service provider searched the gateway logs for the caller record corresponding to this identifier, pinpointing the source of the leak as a third-party application associated with this identifier. Based on this, the service provider pursued the application for breach of contract in accordance with the API service agreement.

[0056] In summary, this embodiment provides a lossless, plug-and-play API response identifier injection method. It utilizes the semantic redundancy of the key-value pair arrangement in semi-structured data to encode identifier information as a permutation and combination of keys. Transparent and non-intrusive deployment is achieved through a reverse proxy gateway, ensuring that the identifier injection process does not modify any data values, does not require modification of existing business system code, and does not rely on any third-party signature libraries. At the same time, it has complete robustness against numerical tampering attacks and key insertion attacks.

[0057] Fourthly, the present invention provides a watermark extraction system, comprising: a memory and a processor, wherein the memory stores a computer program, and the processor executes the watermark extraction method provided in the third aspect of the present invention when executing the computer program.

[0058] The related technical solutions are the same as the identifier extraction method provided in the third aspect of this invention, and will not be described in detail here.

[0059] Fifthly, the present invention also provides an electronic device, wherein the computer-readable storage medium includes a stored computer program, wherein when the computer program is run by a processor, it controls the device where the storage medium is located to execute the identifier injection method provided in the first aspect of the present invention or the identifier extraction method provided in the third aspect of the present invention.

[0060] The related technical solutions are the same as the identifier injection method provided in the first aspect of the present invention and the identifier extraction method provided in the third aspect of the present invention, and will not be described in detail here.

[0061] In a sixth aspect, the present invention also provides a computer-readable storage medium comprising a stored computer program, wherein the computer program, when executed by a processor, controls the device where the storage medium is located to execute the identifier injection method provided in the first aspect or the identifier extraction method provided in the third aspect of the present invention.

[0062] The related technical solutions are the same as the identifier injection method provided in the first aspect of the present invention and the identifier extraction method provided in the third aspect of the present invention, and will not be described in detail here.

[0063] In a seventh aspect, the invention also provides a computer program product, including a computer program / instruction that, when executed by a processor, implements the identifier injection method provided in the first aspect of the invention or the identifier extraction method provided in the third aspect.

[0064] The related technical solutions are the same as the identifier injection method provided in the first aspect of the present invention and the identifier extraction method provided in the third aspect of the present invention, and will not be described in detail here.

[0065] Those skilled in the art will readily understand that the above description is merely a preferred embodiment of the present invention and is not intended to limit the present invention. Any modifications, equivalent substitutions, and improvements made within the spirit and principles of the present invention should be included within the scope of protection of the present invention.

Claims

1. A method for injecting watermark identifiers, characterized in that, include: Retrieve the response data returned by the API server to the client; Based on preset capacity threshold Extract the Lyme code C of the watermark identifier to be injected: Convert the watermark identifier to be injected into a decimal number M, and decompose it into... ; the factorial coefficient sequence As the Lyme code C; the watermark identifier to be injected is a binary sequence; coefficient ; L represents the bit length of the watermark identifier to be injected. Extract the semi-structured data objects from the response data; Based on the Lemo code C, each semi-structured data object is watermarked to obtain a corresponding watermarked semi-structured data object; each semi-structured data object in the response data is replaced with the corresponding watermarked semi-structured data object and returned to the client. The methods for watermarking any semi-structured data object D include: For semi-structured data object D every Divide the key-value pairs into one or more key-value pair groups; For each group, the number of key-value pairs is Key-value pair group P: Sort the key-value pairs in key-value pair group P according to the preset sorting rules of the key names to obtain the corresponding base key-value pair sequence. The codewords in the Lymer code C are used sequentially as the current target indices, starting from the current sequence. Retrieve the key-value pair at the current target index from the sequence, and remove the key-value pair from the current sequence before the next key-value pair retrieval. Delete; sort the extracted key-value pairs according to the order in which they were extracted into the corresponding watermarked key order; The obtained watermarked key sequence is concatenated according to the order of the corresponding key-value pairs in the semi-structured data object D to obtain the concatenated key sequence. When the number of key-value pairs in all key-value pair groups is 1 When the concatenated key sequence is used as the watermarked semi-structured data object corresponding to the semi-structured data object D; when the number of key-value pairs is less than When a key-value pair is formed, it is concatenated after the concatenation key sequence to form the watermarked semi-structured data object corresponding to the semi-structured data object D.

2. The watermark injection method according to claim 1, characterized in that, The method of watermarking any semi-structured data object D further includes: watermarking the semi-structured data object D every [percentage missing]. Before partitioning the key-value pairs, when the number of key-value pairs in the semi-structured data object D is less than [number missing], [the following text is incomplete and requires further context: "before partitioning the key-value pairs, when the number of key-value pairs in the semi-structured data object D is less than [number missing], [the following text is incomplete and requires further context: " At that time, key-value pair padding is performed on the semi-structured data object D to ensure that the number of key-value pairs is greater than or equal to the specified number. .

3. The watermark injection method according to claim 1, characterized in that, 。 4. The watermark injection method according to any one of claims 1-3, characterized in that, The step of sorting the key-value pairs in the key-value pair group P according to the preset sorting rules of the key names includes: sorting the key-value pairs in the key-value pair group P according to the order of the key names in the dictionary.

5. The watermark injection method according to any one of claims 1-3, characterized in that, The semi-structured data object is a JSON object or an XML object; when the semi-structured data object is a JSON object, the key-value pairs in the semi-structured data object are its top-level key-value pairs; when the semi-structured data object is an XML object, the key name and the corresponding value in the semi-structured data object correspond to the tag name and content of the child element at the same level, respectively.

6. The watermark injection method according to any one of claims 1-3, characterized in that, The process of obtaining the response data returned by the API server to the client includes: intercepting the response data returned by the API server to the client using a reverse proxy gateway.

7. A method for extracting watermark identifiers, characterized in that, include: Obtain watermarked semi-structured data ; Watermarking semi-structured data Every Divide the key-value pairs into one or more key-value pair groups; For each group, the number of key-value pairs is Key-value pair group P': Sort the key-value pairs in key-value pair group P' according to the preset sorting rules of the key names to obtain the corresponding base key-value pair sequence. ; Take the key-value pairs in key-value pair group P' in order as the current target key-value pairs, and obtain the current target key-value pairs in the current sequence. The index is used to retrieve the target key-value pair from the current sequence before the next index retrieval. Delete; sort the obtained indices according to the order in which they were obtained to form the corresponding predicted Lymer codes. And calculate the corresponding predicted integer. Predicting integers Convert to the corresponding binary sequence; Set each bit value in the watermark identifier to be extracted to the number of key-value pairs in the group. The watermark identifier is obtained by extracting the bit value that appears most frequently in the binary sequence corresponding to all key-value pairs. Among them, the watermarked semi-structured data The watermark is obtained by watermarking a semi-structured data object using the watermark injection method described in any one of claims 1-6; The preset sorting rules are all consistent with the threshold values ​​in the watermark injection method according to any one of claims 1-6. It corresponds to the same preset sorting rules.

8. An electronic device, characterized in that, The computer-readable storage medium includes a stored computer program, wherein when the computer program is executed by a processor, it controls the device in which the storage medium is located to perform the method according to any one of claims 1-7.

9. A computer-readable storage medium, characterized in that, The computer-readable storage medium includes a stored computer program, wherein when the computer program is executed by a processor, it controls the device in which the storage medium is located to perform the method according to any one of claims 1-7.

10. A computer program product, characterized in that, Includes a computer program / instruction that, when executed by a processor, implements the method described in any one of claims 1-7.

Images