A watermark generation method and a speculative sampling system

Abstract

The specification provides a watermark generation method and a conjecture sampling system, and relates to the field of artificial intelligence, which is applied to the conjecture sampling system, the conjecture sampling system comprising a draft model and a target model, and the method comprising: judging whether a current generation position of the draft model satisfies a watermark intervention triggering condition; in the case of yes, performing watermark intervention on candidate content generated by the draft model at the current generation position, so that a candidate content sequence composed of the candidate content carries watermark content; inputting the candidate content sequence into the target model for verification, and taking the candidate content sequence that passes the verification as an output content sequence carrying the watermark content. Further, the conjecture sampling system maintains a reasoning speed similar to that in the case of no watermark under the premise of ensuring the traceability of the output content, achieving a balance between model real-time performance, security and traceability.

Description

Technical Field

[0001] This specification relates to the field of artificial intelligence, and in particular to a watermark generation method and speculative sampling system. Background Technology

[0002] With the widespread deployment of large language models in scenarios such as real-time dialogue, code completion, and content generation, model inference speed has become a core indicator of service quality. Based on this, speculative sampling significantly reduces the latency of autoregressive decoding by introducing a lightweight draft model to generate candidate content sequences, which are then validated in parallel by the target model, thereby significantly improving inference speed. Meanwhile, to protect model intellectual property and track the source and dissemination path of AI-generated content, text watermarking technology has become an industry necessity. In summary, the industry generally expects to integrate watermarking functionality into speculative sampling systems to simultaneously meet the requirements of real-time performance, security, and traceability.

[0003] In related technologies, KGW-style watermarking schemes embed watermark signals by applying a continuous bias to the decoding process of speculative sampling. However, such watermarking schemes have a fundamental conflict with speculative sampling: the continuously applied watermark bias disrupts the distribution alignment between the draft model and the target model, pushing the generation into a high-uncertainty region. This causes the target model to frequently reject candidate content proposed by the draft model, resulting in a significant drop in the speculative acceptance rate and ultimately the loss of the original speed advantage. Specifically, in token-level speculative sampling systems, the draft model generates a linear sequence of candidate content token by token, and the target model verifies it in parallel. The distribution offset caused by the watermark accumulates and amplifies token by token along the linear generation path, causing the acceptance rate to decay geometrically, and the verification cost per effective token to increase sharply. In feature-level speculative sampling systems such as Medusa and EAGLE, the draft model generates tree-like multi-branch candidate content, which is scored and sorted in parallel by the target model for fault tolerance. However, the aforementioned watermark bias causes the verifier to tend to select abnormal paths with inflated scores but suboptimal semantic coherence, resulting in an unstable tree structure and a synchronous decrease in the overall acceptance rate of multiple branches. All of the above solutions suffer from a significant decrease in acceleration due to the watermark bias disrupting the original distribution alignment mechanism of the speculative sampling system. In some cases, the overall efficiency is even lower than that of not using speculative sampling because of the additional computational overhead introduced by the draft model. Summary of the Invention

[0004] In view of this, this specification provides a watermark generation method and a speculative sampling system to address the shortcomings of related technologies.

[0005] Specifically, this specification is implemented through the following technical solution: According to a first aspect of the embodiments of this specification, a watermark generation method is provided, applied to a speculative sampling system, the speculative sampling system including a draft model and a target model; the method includes: For the current generation position of the draft model, determine whether the current generation position meets the watermark intervention trigger condition; If the judgment result is yes, the candidate content generated at the current generation position is watermarked through the draft model so that the candidate content sequence composed of the candidate content carries watermark content. The candidate content sequence is input into the target model for verification, and the candidate content sequence that passes the verification is used as the output content sequence carrying the watermark.

[0006] According to a second aspect of the embodiments of this specification, a speculative sampling system is provided, the speculative sampling system comprising a draft model and a target model; wherein: The draft model is used to determine whether the current generation position meets the watermark intervention triggering condition for the current generation position, and if the determination result is yes, to perform watermark intervention on the candidate content generated at the current generation position so that the candidate content sequence composed of the candidate content carries watermark content. The target model is used to receive and verify the candidate content sequence generated by the draft model, and to use the verified candidate content sequence as the output content sequence carrying the watermark content.

[0007] According to a third aspect of the embodiments of this specification, a computer-readable storage medium is provided having a computer program stored thereon, which, when executed by a processor, implements the steps of the method described in the first aspect.

[0008] According to a fourth aspect of the embodiments of this specification, an electronic device is provided, including a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor executes the program to implement the steps of the method described in the first aspect.

[0009] According to a fifth aspect of the embodiments of this specification, a computer program product is provided, including a computer program / instructions that, when executed by a processor, implement the steps of the method described in the first aspect.

[0010] The technical solution provided in this specification significantly reduces the cumulative interference of watermarking intervention on the original output distribution of the draft model by applying watermarking intervention to the candidate content generated at the current generation position only when the watermarking intervention trigger condition is met in the speculative sampling system, rather than continuously applying watermark bias to every generation position. Since the above intervention method only acts on a portion of the generation positions, its sparsity ensures that the candidate content sequence generated by the draft model maintains a natural alignment with the target model's output distribution at most generation positions. This allows the target model to maintain a high acceptance rate of candidate content during verification, avoiding the geometric decay problem of acceptance rate caused by the accumulation of distribution offset in traditional continuous bias schemes. Therefore, this method effectively maintains the acceleration effect of speculative decoding while incorporating the watermarking scheme into the speculative sampling process. This allows the speculative sampling system to maintain an inference speed similar to that without watermarking, while ensuring the traceability of the output content, achieving a balance between model real-time performance, security, and traceability.

[0011] It should be understood that the above general description and the following detailed description are exemplary and explanatory only, and are not intended to limit this specification. Attached Figure Description

[0012] To more clearly illustrate the technical solutions in the embodiments or prior art of this specification, the drawings used in the description of the embodiments or prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments recorded in this specification. For those skilled in the art, other drawings can be obtained based on these drawings.

[0013] Figure 1 This is a schematic diagram of the architecture of a watermark generation system shown in an exemplary embodiment of this specification; Figure 2 This is a flowchart illustrating an exemplary embodiment of a watermark generation method shown in this specification; Figure 3 This is a flowchart illustrating an exemplary embodiment of a watermark generation and verification method in this specification; Figure 4 This is a schematic diagram of the architecture of an electronic device shown in an exemplary embodiment of this specification; Figure 5 This is a schematic diagram of the structure of a watermark generation device shown in an exemplary embodiment of this specification. Detailed Implementation

[0014] Exemplary embodiments will now be described in detail, examples of which are illustrated in the accompanying drawings. When the following description relates to the drawings, unless otherwise indicated, the same numbers in different drawings denote the same or similar elements. The embodiments described in the following exemplary embodiments do not represent all embodiments consistent with this specification. Rather, they are merely examples of apparatuses and methods consistent with some aspects of this specification.

[0015] It should be noted that in other embodiments, the steps of the corresponding methods are not necessarily performed in the order shown and described in this specification. In some other embodiments, the methods may include more or fewer steps than those described in this specification. Furthermore, a single step described in this specification may be broken down into multiple steps in other embodiments; and multiple steps described in this specification may be combined into a single step in other embodiments. It should be understood that although the terms first, second, third, etc., may be used in this specification to describe various information, this information should not be limited to these terms. These terms are only used to distinguish information of the same type from each other. For example, without departing from the scope of this specification, first information may also be referred to as second information, and similarly, second information may also be referred to as first information. Depending on the context, the word "if" as used herein may be interpreted as "when," "when," or "in response to a determination."

[0016] The user information (including but not limited to user device information, user personal information, etc.) and data (including but not limited to data used for analysis, data stored, data displayed, etc.) involved in this manual are all information and data authorized by the user or fully authorized by all parties. The collection, use and processing of related data shall comply with the relevant laws, regulations and standards of the relevant regions, and corresponding operation portals shall be provided for users to choose to authorize or refuse.

[0017] Figure 1 This is a schematic diagram of the architecture of an inferential sampling system provided in an exemplary embodiment. Figure 1 As shown, the speculative sampling system 10 may include a draft model 12 and a target model 14.

[0018] Draft model 12 serves as a language model deployed on a first computing unit, which may be a hardware accelerator with parallel computing capabilities, such as a Graphics Processing Unit (GPU), Tensor Processing Unit (TPU), or Neural Network Processing Unit (NPU). During autoregressive decoding, draft model 12 can generate candidate content position by position, and the candidate content generated at each position is sequentially arranged to form a candidate content sequence. For example, draft model 12 can be a lightweight language model based on the Transformer architecture, typically with a smaller parameter size than the target model 14, such as a distilled version of the target model 14 or a small, independently trained model; this specification does not impose any limitations on this. Compared to the target model 14, draft model 12 typically has fewer model parameters and lower computational latency. It can be a lightweight model sharing the same physical computing node as the target model 14, or a remote lightweight model deployed on an independent computing node or edge device; this specification does not impose any limitations on this either. Specifically, at the generation position that meets the watermark intervention triggering condition, the draft model 12 also acts as the executor of watermark intervention, applying watermark intervention to the generated candidate content, so that the candidate content sequence carries watermark content.

[0019] The target model 14, serving as a language model deployed in a second computing unit, can employ the same or different types of hardware accelerators as the first computing unit and communicates with it via, for example, a high-speed interconnect interface or a network. The target model 14 can be a large language model based on the Transformer architecture. The target model 14 receives the candidate content sequence generated by the draft model 12 and performs parallel verification on each candidate content based on its own output distribution to determine whether to accept or reject the candidate content. The target model 14 is typically a large language model with a large parameter scale and can be deployed on a local server cluster or on a cloud inference service node. This specification does not limit the specific deployment location or physical form of the target model 14.

[0020] During the training phase, the target model 14 can be obtained through self-supervised pre-training on a large-scale corpus, and optionally optimized through supervised fine-tuning and reinforcement learning based on human feedback; the draft model 12 can be obtained by knowledge distillation, model pruning, or independent training of the target model 14. Since the draft model 12 and the target model 14 are related in terms of training data, model architecture, or distillation process, their output probability distributions at the same generation positions can maintain a high degree of consistency, i.e., they achieve distribution alignment.

[0021] Those skilled in the art will understand that the above-described speculative sampling system 10 can be applied to traditional token-level speculative sampling systems or feature-level speculative sampling systems, and the technical solution of this application is applicable to both of these speculative sampling architectures. In summary, by combining the ability of the draft model 12 to generate content quickly with the high-quality verification capability of the target model 14, the speculative sampling system 10 significantly reduces the end-to-end latency of autoregressive decoding while maintaining the generation quality.

[0022] Figure 2 This is a flowchart illustrating an exemplary embodiment of a watermark generation method, which specifically includes the following steps: Step S202: For the current generation position of the draft model, determine whether the current generation position meets the watermark intervention trigger condition.

[0023] During the autoregressive decoding process of the draft model, candidate content can be generated sequentially according to its generation position. The generation position refers to the current sequence position processed by the draft model during the autoregressive decoding process; that is, the decoding step at which the draft model generates the t-th candidate content in the sequence, where t is a positive integer. For each current generation position of the draft model, it can first be determined whether the current generation position meets the preset watermark intervention trigger condition. Since watermark intervention is only executed when the trigger condition is met, rather than acting on all generation positions, it ensures that the watermarks generated in subsequent steps exhibit a sparse distribution in the candidate content sequence output by the draft model. This reduces the cumulative interference to the original output distribution of the draft model, providing a foundation for the subsequent target model to maintain a high candidate content acceptance rate.

[0024] In this manual, the method for determining the watermark intervention trigger condition can be selected in various ways according to the actual application scenario.

[0025] In one embodiment, the system can determine whether the current generation position meets the watermark intervention triggering condition based on a preset watermark position interval. Specifically, the determination process can include: first, obtaining the position number of the current generation position, i.e., the position number t of the candidate content being generated by the current draft model in the candidate content sequence. Then, determining whether the position number belongs to the trigger position set, which is determined by the aforementioned watermark position interval. The watermark position interval can be a preset positive integer k, representing a watermark intervention performed every k generation positions. For example, when the watermark position interval k is set to 5, the trigger position set is the set of all generation positions whose position number t is divisible by 5, i.e., {5, 10, 15, ...}. When the draft model decodes to the 5th, 10th, 15th, etc., generation position, it is determined that the watermark intervention triggering condition is met, and watermark intervention will be applied to the candidate content at these positions; for other generation positions, no watermark intervention is applied, and the draft model generates candidate content normally according to its original output distribution.

[0026] In the aforementioned triggering method based on watermark position intervals, the trigger position set can be determined in real-time according to the watermark position interval. That is, when the draft model generates candidate content, it determines in real-time whether the position number of the currently generated position conforms to a preset interval rule, such as whether it is an integer multiple of k. Alternatively, the trigger position set can be predetermined based on the watermark position interval. That is, before actual decoding begins, a complete set of trigger position numbers is pre-calculated based on the preset watermark position interval. During subsequent decoding, it is only necessary to determine whether the position number of the currently generated position belongs to this predetermined set. The difference between the two is that the former has greater flexibility, facilitating dynamic adjustment of the interval strategy during decoding; the latter can save computational overhead during real-time decoding and is suitable for application scenarios with stricter latency requirements. The choice between these two methods depends on the specific deployment environment, and this specification does not impose any restrictions.

[0027] In another embodiment, the determination of whether the current generation position meets the watermark intervention triggering condition can be based on the predicted entropy value of the draft model for candidate content at the current generation position. Specifically, the determination process includes: first, obtaining the probability distribution corresponding to the draft model generating candidate content at the current generation position, which reflects the predicted probability value of the draft model for each candidate content in the vocabulary. Then, calculating the predicted entropy value corresponding to the current generation position based on the probability distribution. Here, the so-called entropy value is an indicator in information theory that measures the uncertainty of the probability distribution. The higher the entropy value, the more uncertain the draft model's selection of candidate content at that generation position is, that is, the model is in a high-uncertainty decoding state. After calculating the predicted entropy value, it is determined whether the predicted entropy value meets a preset entropy value threshold. For example, when the predicted entropy value is greater than or equal to the preset entropy value threshold τ, it is determined that the current generation position meets the watermark intervention triggering condition; conversely, when the predicted entropy value is lower than the threshold, it is determined that the triggering condition is not met, and no watermark intervention is applied.

[0028] For example, assuming the entropy threshold τ is set to 2.0, when the prediction probability distribution of the draft model at a certain generation position is relatively concentrated, such as when the prediction probability of a specific candidate content reaches 0.9 or higher, its corresponding entropy value may only be around 0.5, which is lower than the threshold. In this case, no watermark intervention is triggered, and the draft model directly samples from this probability distribution to generate candidate content. However, when the prediction probability distribution of the draft model at another generation position is relatively dispersed, and the prediction probabilities of multiple candidate contents are close, its corresponding entropy value may reach 2.5, which is higher than the threshold. In this case, it is determined that the watermark intervention triggering condition is met, and watermark intervention will be applied to the candidate content generated at that position. As can be seen, in this embodiment, through the above-mentioned triggering method based on prediction entropy value, watermark intervention will be concentrated in the high uncertainty region of model decoding, while the original decoding behavior is maintained at the generation position where the model is highly certain, thereby further reducing the impact of watermark intervention on the quality of generated content.

[0029] Based on the two triggering methods of watermark position interval and prediction entropy value, the technical solution provided in the embodiments of this specification realizes the sparse distribution of watermark intervention in the candidate content sequence, so that the candidate content at most generation positions maintains a natural alignment with the original output distribution of the draft model. Thus, while combining the watermark into the speculative sampling process, it effectively maintains the high acceptance rate of the target model for the candidate content sequence.

[0030] Step S204: If the judgment result is yes, watermark intervention is performed on the candidate content generated at the current generation position through the draft model, so that the candidate content sequence composed of the candidate content carries watermark content.

[0031] When the above judgment result indicates that the current generation position meets the watermark intervention triggering condition, the draft model can perform watermark intervention on the candidate content generated at the current generation position, so that the candidate content carries watermark content. The so-called watermark content can refer to specific content that can represent watermark information, determined according to preset watermark generation rules; this specification does not impose any restrictions on this. As the draft model completes generation and selective intervention at each generation position, the candidate content at each generation position sequentially forms a candidate content sequence, which in turn carries watermark content.

[0032] Those skilled in the art will understand that different generation positions can be configured to add the same or different watermark content, depending on the configuration between the watermark intervention triggering conditions and the watermark generation rules. For ease of description, the following embodiments in this specification will be illustrated using the example of watermark content being added at each triggering position being the same. Correspondingly, at generation positions where the triggering conditions are not met, the draft model generates candidate content normally without intervention; therefore, the candidate content sequence will appear to have watermark information carried only in some positions.

[0033] Regarding the specific implementation methods of the above watermark intervention, this manual also provides several different implementation schemes, which are described below.

[0034] In one embodiment, the candidate content originally generated by the draft model at the current generation position can be directly replaced with watermark content determined according to a preset watermark key. The watermark key can be considered as preset information used to control the generation of the watermark content; it can be a set of random number seeds, hash values, or encrypted strings, etc. This specification does not limit the specific form of the watermark key. Furthermore, the watermark key can be shared in advance by the watermark adder and the watermark detector (described below) to ensure that the watermark content can be correctly identified during the detection phase.

[0035] For example, in actual deployment, the watermark key can be used to determine a mapping relationship that maps the position number of the generation location to specific content in a preset vocabulary, i.e., the watermark content. For instance, in a scenario triggered by watermark position intervals, when the watermark position interval k is set to 5, the watermark key is configured to determine the corresponding watermark content for each generation location whose position number is an integer multiple of 5. When the draft model decodes to the 5th generation location and determines that the watermark intervention trigger condition is met, it can determine the watermark content corresponding to that location as a specific identifier in the preset vocabulary based on the watermark key. Then, the candidate content originally generated by the draft model at that location is directly replaced with this specific identifier. In other words, through the above content replacement method, the watermark content can be embedded into the candidate content sequence. This method is simple to implement and the watermark content is clear, facilitating identification in the subsequent watermark detection stage.

[0036] In another embodiment, the probability distribution corresponding to the candidate content generated by the draft model at the current generation position can be adjusted according to a preset watermark key, and the candidate content can be regenerated based on the adjusted probability distribution. This regenerated candidate content is the watermarked content carrying the watermark information. Compared with the content replacement method in the previous embodiment, this method does not directly replace the candidate content with the specified watermark content, but indirectly affects the sampling result of the draft model by adjusting the probability distribution, so that the finally generated candidate content carries watermark information and maintains a certain correlation with the original output distribution of the draft model in a probabilistic sense.

[0037] Specifically, the probability distribution can be adjusted in several ways. For example, a bias can be applied to the original output logits of the draft model at the current generation position based on the watermark key. This involves adding a preset bias to the logits of the target content corresponding to the watermark key, resulting in a higher sampling probability for the target content in the adjusted probability distribution, thereby increasing its likelihood of being selected as candidate content. Alternatively, the probability distribution can be divided into an "allowed watermark set" and a "prohibited watermark set" based on the watermark key, and candidate content can be generated only from the allowed watermark set. In short, both of these adjustment methods can be selected according to the actual application scenario, and this specification does not impose any restrictions on them.

[0038] Taking the logic value bias method as an example, suppose that at a certain trigger position, the original probability distribution of the draft model has probabilities of 0.4, 0.35, and 0.25 for candidate content A, B, and C, respectively. The watermark key indicates that watermark information related to candidate content B should be added at this position. In this case, by adding a positive bias to the logic value corresponding to candidate content B, the adjusted probability distribution becomes A: 0.25, B: 0.55, C: 0.2, thus significantly increasing the probability that candidate content B will be sampled and generated. The draft model samples based on the adjusted probability distribution, and the final generated candidate content has a high probability of being candidate content B, thereby completing the addition of the watermark content.

[0039] The probability distribution-based watermarking intervention method indirectly adds watermark information by influencing the sampling process of the draft model. Compared to direct replacement, it has a smoother impact on the semantic coherence of the generated content, making it suitable for applications with high requirements for the quality of the generated content. Furthermore, since the magnitude and method of probability distribution adjustment can be flexibly controlled by the watermark key, this method also provides adjustable flexibility in the strength of the added watermark information.

[0040] In summary, regardless of the watermarking intervention method mentioned above, the draft model can add watermark content to the candidate content sequence at the generation position that meets the watermarking intervention trigger condition, while maintaining normal candidate content generation at other generation positions. This allows the candidate content sequence to carry watermark information as a whole while preserving the distribution characteristics of the original output of the draft model to the greatest extent, providing a technical foundation for the efficient verification of the target model in the future.

[0041] Step S206: Input the candidate content sequence into the target model for verification, and use the verified candidate content sequence as the output content sequence carrying the watermark content.

[0042] After the candidate content sequence is generated, the speculative sampling system can input it into the target model for verification. During the verification process, the target model performs a probabilistic review of each candidate content in the sequence based on its own output distribution, and makes an acceptance or rejection decision based on the review results: for candidate content that conforms to the target model's output distribution, the target model determines it as accepted; for candidate content that does not conform to the target model's output distribution, the target model determines it as rejected. In other words, the target model verifies the candidate content through the above acceptance or rejection decision, and the accepted candidate content is the candidate content that passes the verification.

[0043] As mentioned earlier, due to the aforementioned sparse intervention method, the candidate content sequence maintains a natural alignment with the target model's output distribution at most generation positions. The target model can accept these candidate contents with a high probability, thus outputting the verified candidate contents as the output content sequence in sequence. Therefore, the output content sequence at this point inherits the watermark content carried in the candidate content sequence, enabling the speculative sampling system to maintain decoding acceleration while achieving traceability of the output content.

[0044] This manual further performs watermark detection on the output content sequence generated by the target model to determine whether the output content sequence carries watermark content, thereby detecting whether the watermark content has been successfully and correctly added. For ease of explanation, this stage will be referred to as the watermark detection stage below, to distinguish it from the watermark generation stage before the target model's output content sequence.

[0045] In one embodiment, during the detection phase, a pre-defined watermark detector can acquire the aforementioned output content sequence. This output content sequence can be received directly from the speculative sampling system or obtained from other sources; this specification does not impose any limitations on this. In short, after acquiring the output content sequence, the consistency between the output content sequence and the watermark content used in the aforementioned addition process can be used to detect whether the output content sequence carries watermark content. Specifically, if watermark content has indeed been added to the output content sequence, then at the detection location where watermark intervention was applied during the generation phase, the actual content in the output content sequence should show statistically significant consistency with the expected watermark content; conversely, if the output content sequence has not been watermarked, then this consistency should be within a random probability range.

[0046] Since the specific detection method used for watermark detection corresponds to the watermark intervention triggering conditions adopted in the generation stage, the following will explain the detection methods corresponding to the two triggering conditions introduced earlier.

[0047] Detection Method 1: Z-Score Test. When the watermark intervention trigger condition is based on a preset watermark position interval, since the watermark content is only added to specific generation positions determined by the watermark position interval, the detector can determine the corresponding detection positions from the output content sequence based on the same watermark position interval. Then, based on the consistency between the actual content and the watermark content at each detection position, the detector uses a z-score test to determine whether the output content sequence carries watermark content.

[0048] Specifically, the statistical logic of the z-score test is as follows: The number of events where the actual content matches the watermark content at each detection position is counted. That is, it determines whether the actual content at each detection position is the same as the expected watermark content determined based on the watermark key, and counts the number of matches. This observed number of matches is then compared to the expected number of matches under random conditions, and the z-score statistic is calculated. When the z-score exceeds a preset statistical threshold, it indicates that the number of observed matches has significantly deviated from the random level, and the output content sequence can be determined to carry watermark content. Conversely, when the z-score does not exceed the threshold, the output content sequence can be determined not to carry the aforementioned watermark content.

[0049] In summary, by using the z-score test, the detection party can determine the watermark of the output content sequence based on statistical significance. It has the advantages of reliable detection conclusions and controllable false detection rate, and is especially suitable for interval triggering scenarios where the watermark addition position is fixed and the detection position can be accurately determined.

[0050] Method 2: Centralized Matching Score Detection. This method, where the watermark intervention is triggered by the predicted entropy value of the candidate content at the current generation position based on the draft model, considers that the watermark addition position is dynamically determined by the entropy value at generation. Unlike interval-triggered scenarios, the detection method cannot pre-determine the specific watermark addition position. Therefore, the detection method can use each position in the output content sequence as a detection position. For each detection position, based on the consistency between the actual content at that position and the watermark content, a centralized matching score can be calculated. This score is then used to determine whether the output content sequence carries watermark content.

[0051] Specifically, the calculation logic for the centralized matching score is as follows: For each detection position in the output content sequence, determine whether the actual content at that position matches the expected watermark content determined based on the watermark key. If they match, record a matching event. Then, subtract the expected probability of a random match at each detection position from the matching result at each detection position, and sum the results for all detection positions to obtain the centralized matching score. This score can be centralized by subtracting the random expected probability, making the expected value of the score for ordinary sequences without watermark content approach zero, while the centralized matching score for sequences containing watermark content will deviate significantly from zero due to the existence of matching events exceeding the random level. When the centralized matching score exceeds a preset detection threshold, it can be determined that the output content sequence carries watermark content.

[0052] Those skilled in the art will understand that, since the centralized matching score takes into account the background probability of random matching at each detection position during the calculation process, this detection method has strong robustness to the uncertainty of the watermark addition position and can adapt to the situation of uneven watermark distribution caused by entropy triggering, achieving effective watermark detection without knowing the specific trigger position.

[0053] Thus, regardless of the strategy used in the watermark generation stage, the detection stage can use the corresponding statistical testing method to reliably determine the watermark of the output content sequence. This ensures the acceleration effect of speculative sampling while providing technical support for the traceability of the output content and the protection of the model's intellectual property rights.

[0054] It should be noted that the effectiveness of the above two detection methods depends not only on the statistical testing methods used in the watermark detection stage, but also on the verification behavior of the target model on the watermark-intervention candidate content in the watermark generation stage. In one embodiment, the verification behavior of the target model on each candidate content in the candidate content sequence can be differentiated according to the watermark intervention triggering conditions used in the generation stage, so that the target model's acceptance or rejection behavior matches the corresponding detection mechanism, ensuring the effectiveness of subsequent watermark detection. These will be explained separately below.

[0055] Scenario 1: When the watermark intervention trigger condition is based on the watermark position interval, the target model can be configured to forcibly accept watermarked candidate content in the candidate content sequence. This means that instead of performing the usual probability check on the candidate content, it is directly included as a verified candidate in the output content sequence. The purpose of this forced acceptance strategy is that, in the interval-triggered scenario, the watermark content is only added at specific generation positions determined by the watermark position interval. The watermark signal itself is already sparsely distributed in the sequence. If the target model further rejects these watermarked candidate contents during the verification process, the already sparse watermark signal may become even sparser, even below the minimum detectable density of the z-score test, thus causing watermark detection to fail. Therefore, by introducing this forced acceptance strategy, it is possible to ensure that the added watermark content is completely preserved in the output content sequence, providing sufficient watermark signal density for subsequent z-score tests.

[0056] Scenario 2: When the watermark intervention trigger condition is based on the predicted entropy value, the target model can be configured to allow or allow the rejection of watermarked candidate content in the candidate content sequence. Unlike the forced acceptance strategy mentioned earlier, in the entropy-triggered scenario, the target model can perform a regular probability review of the watermarked candidate content according to its own output distribution and autonomously make a decision to accept or reject it. This is because in the entropy-triggered scenario, the detection phase uses centralized matching score detection. This detection method has already considered the background probability of random matching at each detection position during the calculation process, and has natural robustness to the uncertainty of the watermark addition position and the possibility that some watermark signals may be rejected by the target model. Therefore, even if some watermarked candidate content is rejected by the target model, the centralized matching score can still effectively determine whether the output content sequence carries watermarked content based on the statistical significance of the remaining matching events. Therefore, in entropy-triggered scenarios, allowing the target model to perform acceptance or rejection judgments on candidate content affected by watermarks according to the conventional speculative sampling process can maintain the target model's ability to review the quality of generated content without substantially affecting the effectiveness of subsequent watermark detection.

[0057] In summary, by using the differentiated configuration of target model verification behavior for different triggering conditions, the solution in this specification can ensure the effectiveness of watermark detection while also taking into account the decoding efficiency of the speculative sampling system and the quality of the generated content.

[0058] The following is combined with Figure 3 A further explanation of a watermark generation and verification method is provided, such as... Figure 3 As shown, the method may include the following steps: Step S302: The draft model obtains the current generation position and determines whether the watermark intervention trigger condition is met.

[0059] In one embodiment, the draft model of the speculative sampling system can obtain the generation position number t of the current candidate content to be generated during autoregressive decoding. Assuming the preset watermark position interval k=5, the draft model determines that the current generation position number t=5 satisfies the watermark intervention trigger condition, that is, t is an integer multiple of k, and thus triggers watermark intervention.

[0060] Step S304: The draft model performs watermark intervention on the candidate content at the current generation position and adds watermark content.

[0061] In one embodiment, when it is determined that the current generation position meets the watermark intervention triggering condition, the draft model replaces the originally generated candidate content with the specified watermark content according to the preset watermark key, thereby adding watermark content at the generation position. At this time, the candidate content sequence composed of each candidate content, including the watermark content, carries the watermark content.

[0062] In step S306, the draft model sends the candidate content sequence to the target model for verification.

[0063] In one embodiment, after the draft model completes the generation of candidate content and selective watermarking for all generated positions, it can send the watermarked content and the complete candidate content sequence contained in the previous step to the target model for parallel verification.

[0064] In step S308, the target model verifies each candidate content in the candidate content sequence and adopts a forced acceptance strategy for the candidate content affected by the watermark.

[0065] In one embodiment, since the watermark intervention trigger condition is based on the watermark position interval judgment, the target model directly judges the watermark-intervention candidates with position numbers 5, 10, etc. in the candidate content sequence as accepted without further probability review; for other candidate content that is not watermark-interventioned, it is reviewed normally based on its own output distribution.

[0066] In step S310, the target model uses the validated candidate content sequence as the output content sequence carrying the watermark.

[0067] In one embodiment, the target model can sequentially assemble the accepted candidate content into an output content sequence, which includes the watermarked content that is forcibly accepted, for example, position 5 still contains the watermarked content "[WATERMARK]". The sampling system then outputs this watermarked content sequence.

[0068] In step S312, the detector obtains the output content sequence to be detected and determines the detection position from the output content sequence according to the watermark position interval.

[0069] In one embodiment, the watermark detection party obtains the output content sequence from a speculative sampling system or other means, using it as the content sequence to be detected for watermark presence detection. The detection party can determine the detection position in the output content sequence as position 5, 10, 15, etc., based on the same watermark position interval k=5 as in the generation stage. For example, position 5 is determined as the detection position.

[0070] Step S314: The detection party counts the number of events where the actual content matches the expected watermark content at each detection location, and calculates the z-score.

[0071] In one embodiment, the detector uses a watermark key shared with the generation phase to determine the expected watermark content at each detection location. The detector checks whether the actual content matches the expected watermark content at each location, counting the number of matching events C. Assuming a total of 20 detection locations T, 18 matching events C, and an expected matching probability p = 0.01 under random conditions, the detector calculates the z-score using the following formula: ).

[0072] Step S316: The detector determines whether the output content sequence carries watermark content based on the z-score and statistical threshold.

[0073] In one embodiment, the detector compares the calculated z-score with a preset statistical significance threshold, such as 2.33, which corresponds to a 99% confidence level. If the z-score is greater than the threshold, the output content sequence is determined to carry watermarked content, confirming that it is a copyright-protected or traceable generation result; otherwise, the sequence is determined not to carry watermarked content. In the example above, the z-score is significantly high, therefore it can be judged as carrying watermarked content.

[0074] Figure 4 This is a schematic structural diagram of an electronic device according to an exemplary embodiment. Please refer to... Figure 4 At the hardware level, the electronic device includes a processor, internal bus, network interface, memory, and non-volatile storage, and may also include other necessary hardware. The processor reads the corresponding computer program from the non-volatile memory into memory and then runs it, forming a watermark generation device at the logical level. Of course, in addition to software implementation, this specification does not exclude other implementation methods, such as logic devices or a combination of hardware and software, etc. That is to say, the execution subject of the following processing flow is not limited to individual logic units, but can also be hardware or logic devices.

[0075] Figure 5This invention provides a block diagram of a watermark generation device according to an embodiment of the invention. Please refer to... Figure 5 The device includes: The condition judgment unit 502 is used to determine whether the current generation position of the draft model meets the watermark intervention trigger condition. The watermark intervention unit 504 is used to perform watermark intervention on the candidate content generated at the current generation position through the draft model when the judgment result is yes, so that the candidate content sequence composed of the candidate content carries watermark content. The model verification unit 506 is used to input the candidate content sequence into the target model for verification, and to use the verified candidate content sequence as the output content sequence carrying the watermark content.

[0076] Optionally, the condition judgment unit 502 is specifically used for: The step of determining whether the current generation position meets the watermark intervention triggering condition includes: Based on a preset watermark position interval, determine whether the current generation position meets the watermark intervention trigger condition; or... Based on the predicted entropy value of the candidate content by the draft model at the current generation position, it is determined whether the current generation position meets the watermark intervention triggering condition.

[0077] Optionally, the condition judgment unit 502 is specifically used for: Obtain the position number of the currently generated location; Determine whether the position number belongs to the trigger position set, which is determined in real time based on the watermark position interval, or is determined in advance based on the watermark position interval.

[0078] Optionally, the condition judgment unit 502 is specifically used for: Obtain the probability distribution of the candidate content generated by the draft model at the current generation position, and calculate the corresponding prediction entropy value based on the probability distribution; If the predicted entropy value meets the preset entropy threshold, it is determined that the current generation position meets the watermark intervention trigger condition.

[0079] Optionally, the device further includes: The model control unit is used to force the target model to accept the candidate content that is subject to watermark interference, based on the watermark position interval and the watermark interference triggering condition. When determining the watermark intervention trigger condition based on the predicted entropy value, the target model is allowed to reject or accept the candidate content subject to watermark intervention.

[0080] Optionally, the watermark intervention unit 504 is specifically used for: The candidate content generated by the draft model at the current generation position is replaced with the watermark content determined according to the preset watermark key; or... Based on the preset watermark key, the probability distribution of the draft model generating the candidate content at the current generation position is adjusted, and the watermark content is generated based on the adjusted probability distribution.

[0081] Optionally, the device further includes: A watermark detection unit is used to acquire the output content sequence; Based on the consistency between the output content sequence and the watermark content, it is detected whether the output content sequence carries the watermark content.

[0082] Optionally, the watermark detection unit is specifically used for: When the watermark intervention trigger condition is based on a preset watermark position interval, the corresponding detection position is determined from the output content sequence according to the watermark position interval. Based on the consistency between the actual content at each detection position and the watermark content, a z-score test is used, and the output content sequence is judged to carry the watermark content based on the test result. When the watermark intervention trigger condition is based on the prediction entropy value of the candidate content at the current generation position determined by the draft model, for each detection position in the output content sequence, a centralized matching score is calculated based on the consistency between the actual content at the corresponding detection position and the watermark content, and the output content sequence is determined to carry the watermark content based on the centralized matching score.

[0083] For the device embodiments, since they basically correspond to the method embodiments, the relevant parts can be referred to in the description of the method embodiments. The device embodiments described above are merely illustrative. The units described as separate components may or may not be physically separate, and the components shown as units may or may not be physical units, that is, they may be located in one place or distributed across multiple network units. Some or all of the modules can be selected to achieve the purpose of the solution in this specification according to actual needs. Those skilled in the art can understand and implement this without creative effort.

[0084] Based on the same concept as the methods described above, this specification also provides a computer-readable storage medium having computer instructions stored thereon that, when executed by a processor, implement the steps of the methods as described in any of the above embodiments.

[0085] Based on the same concept as the methods described above, this specification also provides a computer program product, including a computer program / instructions that, when executed by a processor, implement the steps of the methods as described in any of the above embodiments.

[0086] The embodiments of the subject matter and functional operation described in this specification can be implemented in the following ways: digital electronic circuits, tangibly embodied computer software or firmware, computer hardware including the structures disclosed in this specification and their structural equivalents, or combinations thereof. Embodiments of the subject matter described in this specification can be implemented as one or more computer programs, i.e., one or more modules of computer program instructions encoded on a tangible, non-transitory program carrier for execution by a data processing apparatus or for controlling the operation of a data processing apparatus. Alternatively or additionally, the program instructions may be encoded on artificially generated propagation signals, such as machine-generated electrical, optical, or electromagnetic signals, which are generated to encode information and transmit it to a suitable receiving device for execution by the data processing apparatus. The computer storage medium may be a machine-readable storage device, a machine-readable storage substrate, a random or serial access memory device, or combinations thereof.

[0087] The processing and logic flow described in this specification can be executed by one or more programmable computers that execute one or more computer programs to perform corresponding functions by operating on input data and generating output. The processing and logic flow can also be executed by dedicated logic circuitry—such as FPGAs (Field-Programmable Gate Arrays) or ASICs (Application-Specific Integrated Circuits), and the device can also be implemented as dedicated logic circuitry.

[0088] Suitable computers for executing computer programs include, for example, general-purpose and / or special-purpose microprocessors, or any other type of central processing unit. Typically, the central processing unit receives instructions and data from read-only memory and / or random access memory. The basic components of a computer include a central processing unit for implementing or executing instructions and one or more memory devices for storing instructions and data. Typically, a computer will also include one or more mass storage devices for storing data, such as disks, magneto-optical disks, or optical disks, or the computer will be operatively coupled to such mass storage devices to receive data from or transfer data to them, or both. However, a computer is not required to have such devices. Furthermore, a computer can be configured in another device, such as a mobile phone, a personal digital assistant (PDA), a mobile audio or video player, a game console, a global positioning system (GPS) receiver, or a portable storage device such as a universal serial bus (USB) flash drive, to name a few.

[0089] Computer-readable media suitable for storing computer program instructions and data include all forms of non-volatile memory, media, and memory devices, such as semiconductor memory devices (e.g., EPROM, EEPROM, and flash memory devices), magnetic disks (e.g., internal hard disks or removable disks), magneto-optical disks, and CD-ROM and DVD-ROM disks. Processors and memory may be supplemented by or incorporated into dedicated logic circuitry.

[0090] While this specification contains numerous specific implementation details, these should not be construed as limiting the scope of any invention or the scope of the claims, but rather are primarily intended to describe features of specific embodiments of a particular invention. Certain features described in the various embodiments herein may also be implemented in combination in a single embodiment. Conversely, various features described in a single embodiment may also be implemented separately in various embodiments or in any suitable sub-combination. Furthermore, while features may function in certain combinations as described above and even initially claimed in this way, one or more features from a claimed combination may be removed from that combination in some cases, and a claimed combination may refer to a sub-combination or a variation thereof.

[0091] Similarly, although the operations are depicted in a specific order in the accompanying drawings, this should not be construed as requiring these operations to be performed in the specific order shown or sequentially, or requiring all illustrated operations to be performed to achieve the desired result. In some cases, multitasking and parallel processing may be advantageous. Furthermore, the separation of various system modules and components in the above embodiments should not be construed as requiring such separation in all embodiments, and it should be understood that the described program components and systems can generally be integrated together in a single software product or packaged into multiple software products.

[0092] Therefore, specific embodiments of the subject matter have been described. Furthermore, the processes depicted in the figures are not necessarily shown in a specific order or sequence to achieve the desired result. In some implementations, multitasking and parallel processing may be advantageous.

[0093] The above description is merely a preferred embodiment of this specification and is not intended to limit this specification. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of this specification should be included within the scope of protection of this specification.

Claims

1. A method for generating a watermark, characterized in that, The method is applied to a speculative sampling system, which includes a draft model and a target model; the method includes: For the current generation position of the draft model, determine whether the current generation position meets the watermark intervention trigger condition; If the judgment result is yes, the candidate content generated at the current generation position is watermarked through the draft model so that the candidate content sequence composed of the candidate content carries watermark content. The candidate content sequence is input into the target model for verification, and the candidate content sequence that passes the verification is used as the output content sequence carrying the watermark.

2. The method according to claim 1, characterized in that, The step of determining whether the current generation position meets the watermark intervention triggering condition includes: Based on a preset watermark position interval, determine whether the current generation position meets the watermark intervention trigger condition; or... Based on the predicted entropy value of the candidate content by the draft model at the current generation position, it is determined whether the current generation position meets the watermark intervention triggering condition.

3. The method according to claim 2, characterized in that, The step of determining whether the current generation position meets the watermark intervention triggering condition based on a preset watermark position interval includes: Obtain the position number of the currently generated location; Determine whether the position number belongs to the trigger position set, which is determined in real time based on the watermark position interval, or is determined in advance based on the watermark position interval.

4. The method according to claim 2, characterized in that, The step of determining whether the current generation position meets the watermark intervention triggering condition based on the predicted entropy value of the candidate content at the current generation position by the draft model includes: Obtain the probability distribution of the candidate content generated by the draft model at the current generation position, and calculate the corresponding prediction entropy value based on the probability distribution; If the predicted entropy value meets the preset entropy threshold, it is determined that the current generation position meets the watermark intervention trigger condition.

5. The method according to claim 2, characterized in that, Also includes: When determining the watermark intervention triggering condition based on the watermark position interval, the target model is forced to accept the candidate content that is subject to watermark intervention. When determining the watermark intervention trigger condition based on the predicted entropy value, the target model is allowed to reject or accept the candidate content subject to watermark intervention.

6. The method according to claim 1, characterized in that, The step of watermarking the candidate content generated at the current generation position using the draft model includes: The candidate content generated by the draft model at the current generation position is replaced with the watermark content determined according to the preset watermark key; or... Based on the preset watermark key, the probability distribution of the draft model generating the candidate content at the current generation position is adjusted, and the watermark content is generated based on the adjusted probability distribution.

7. The method according to claim 1, characterized in that, Also includes: Obtain the output content sequence; Based on the consistency between the output content sequence and the watermark content, it is detected whether the output content sequence carries the watermark content.

8. The method according to claim 7, characterized in that, The step of detecting whether the output content sequence carries the watermark content based on the consistency between the output content sequence and the watermark content includes: When the watermark intervention trigger condition is based on a preset watermark position interval, the corresponding detection position is determined from the output content sequence according to the watermark position interval. Based on the consistency between the actual content at each detection position and the watermark content, a z-score test is used, and the output content sequence is judged to carry the watermark content based on the test result. When the watermark intervention trigger condition is based on the prediction entropy value of the candidate content at the current generation position determined by the draft model, for each detection position in the output content sequence, a centralized matching score is calculated based on the consistency between the actual content at the corresponding detection position and the watermark content, and the output content sequence is determined to carry the watermark content based on the centralized matching score.

9. A speculative sampling system, characterized in that, The speculative sampling system includes a draft model and a target model; wherein: The draft model is used to determine whether the current generation position meets the watermark intervention triggering condition for the current generation position, and if the determination result is yes, to perform watermark intervention on the candidate content generated at the current generation position so that the candidate content sequence composed of the candidate content carries watermark content. The target model is used to receive and verify the candidate content sequence generated by the draft model, and to use the verified candidate content sequence as the output content sequence carrying the watermark content.

10. A computer-readable storage medium storing computer instructions thereon, characterized in that, When executed by the processor, this instruction implements the steps of the method as described in any one of claims 1 to 8.

11. An electronic device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, characterized in that, When the processor executes the program, it implements the steps of the method as described in any one of claims 1 to 8.

12. A computer program product, characterized in that, Includes a computer program / instructions that, when executed by a processor, implement the steps of the method as described in any one of claims 1-8.

Images