CN118608367A - A watermark embedding and detection method and device for large model generated text - Google Patents

Abstract

The present invention discloses a watermark embedding and detection method and device for large model generated text. The watermark embedding adopts a serial structure, takes prompt words and generated previous token sequences as input, embeds robust watermarks and fragile watermarks in sequence, and outputs generated text with joint watermarks; watermark detection adopts a parallel structure, detects robust watermark and fragile watermark information respectively, and is used for source verification and tampering detection. Robust watermark embedding uses a watermark algorithm based on the sampling process, and detection uses a statistical method to detect the generation relationship between the key and the text; fragile watermark also uses a watermark algorithm based on the sampling process, and detects whether the text has been tampered with by comparing whether the sampled generated target words are consistent. Invisible robust watermark information and fragile watermark information can be embedded in the generated text without affecting the readability of the generated text, which can not only be used to verify the source information of the generated text, but also detect whether the text has been tampered with during the dissemination process.

Description

A watermark embedding and detection method and device for large model generated text

Technical Field

The present invention belongs to the technical field of watermark embedding and detection, and in particular relates to a watermark embedding and detection method and device for large model generated text.

Background Art

In recent years, large language models (LLM) have made significant progress in the field of natural language processing. As the parameters of these large language models continue to increase, their ability to understand and generate language has rapidly improved, and they have achieved very good results in dialogue systems, content creation, and other forms of human-computer interaction applications. The improvement of the capabilities of large models will have a disruptive impact on many fields. However, with the gradual application of LLM in many industries, combined with scenarios such as medical diagnosis, legal consultation, and public services, it has facilitated people's lives and improved work efficiency.

At the same time, the development of large language models also faces some challenges, such as the difficulty in ensuring the authenticity and integrity of generated texts, and whether the text generation process is subject to malicious manipulation. These issues still need to be continuously studied and resolved. When large language models are used in scenarios such as medical diagnosis, legal consultation, digital employees, and intelligent auditing, the generated text will have a certain impact on the user's subsequent decision-making. If the text displayed to the user is maliciously manipulated and tampered with, it will not only mislead the user to make unfavorable decisions, but also make the public doubt the technical reliability of the service provider, causing unpredictable losses.

Therefore, developing effective text source verification and tampering detection technology is a key link in maintaining the security of large model applications. Given the wide variety of ways to tamper with text, it is extremely challenging to prevent tampering from the source. Therefore, it has become a consensus in academia to use watermarks as an active forensics method to achieve target traceability and detect malicious tampering. However, the existing text watermarking technology has a single function, focusing on detecting whether the text is generated by the model, and is obviously insufficient for deeper needs such as detecting whether the text is complete.

Summary of the invention

In view of the problems existing in the prior art, the purpose of the embodiments of the present application is to provide a watermark embedding and detection method and device for large-model generated text, which can embed invisible robust watermark information and fragile watermark information into the generated text without affecting the readability of the generated text. It can not only be used to verify the source information of the generated text, but also can detect whether the text is subjected to tampering, deletion, watermark forgery and other attacks during the text dissemination process.

According to a first aspect of an embodiment of the present application, a watermark embedding method for generating text for a large model is provided, comprising:

Obtain the watermark key, the prompt word of the large language model, the context window size, the large language model, and the generated context token sequence;

According to the prompt word and the generated previous token sequence, a first vocabulary probability distribution is obtained through the large language model, a first selected token sequence is selected from the generated previous token sequence based on the previous window size, a first pseudo-random number sequence is generated according to the first selected token sequence and a watermark key, a token at the next position is calculated according to the first vocabulary probability distribution and the first pseudo-random number sequence, and samples are sequentially taken until the generation is completed or the maximum generation length is reached, thereby forming a robust watermark text;

Determine the minimum embedding number m and the expansion margin d, select the tokens except the last m+d tokens in the robust watermark token sequence and the generated fragile watermark token sequence as the second selected token sequence, obtain the second vocabulary probability distribution through the large language model according to the second selected token sequence, generate the second pseudo-random number sequence according to the second selected token sequence and the watermark key, calculate the token at the next position according to the second vocabulary probability distribution and the second pseudo-random number sequence, and sample them in sequence until the generation is completed or the maximum generation length is reached, so as to form a joint watermark text.

Furthermore, in the formation process of the robust watermark text, the generation process of the token at position y is as follows:

The prompt word With the token sequence generated above As the input of the large language model, we get the probability distribution of the first vocabulary , where |𝒗| is the size of the large language model vocabulary V;

Based on the above window size Select n tokens from the generated token sequence as the first selected token sequence, calculate the hash value of the first selected token sequence and the watermark key K, use the hash value as the seed of the pseudo-random number generator, and generate a first pseudo-random number sequence , where the pseudo-random number Follows a uniform distribution of [0, 1];

By calculating the formula Get the first index sequence , compare to get the first index sequence Maximum value , take the index in the vocabulary as The token at the current position is output.

Furthermore, in the formation process of the joint watermark text, the generation process of the token at position y is as follows:

Will remove the end Robust watermark token sequence and the generated fragile watermark token sequence The concatenated token sequence is used as the input of the large language model to obtain the probability distribution of the second vocabulary , where |𝒗| is the size of the large language model vocabulary V;

Calculate the token sequence of the input , The hash value of the watermark key K is used as the seed of the pseudo-random number generator to generate a second pseudo-random number sequence , where the pseudo-random number Follows a uniform distribution of [0, 1];

By calculating the formula Get the second index sequence , compared to Maximum value , take the index in the vocabulary as The word at the current position is output .

According to a second aspect of an embodiment of the present application, a watermark embedding device for generating text for a large model is provided, comprising:

A first acquisition module is used to acquire a watermark key, a prompt word of a large language model, a context window size, a large language model, and a generated context token sequence;

A robust watermark generation module, configured to obtain a first vocabulary probability distribution through the large language model according to the prompt word and the generated previous token sequence, select a first selected token sequence from the generated previous token sequence based on the previous window size, generate a first pseudo-random number sequence according to the first selected token sequence and a watermark key, calculate the token at the next position according to the first vocabulary probability distribution and the first pseudo-random number sequence, and sequentially sample until the generation is completed or the maximum generation length is reached, thereby forming a robust watermark text;

The fragile watermark generation module is used to determine the minimum embedding quantity m and the expansion margin d, select the tokens in the robust watermark token sequence except the last m+d tokens and the generated fragile watermark token sequence as the second selected token sequence, obtain the second vocabulary probability distribution through the large language model according to the second selected token sequence, generate the second pseudo-random number sequence according to the second selected token sequence and the watermark key, calculate the token at the next position according to the second vocabulary probability distribution and the second pseudo-random number sequence, and sample in sequence until the generation is completed or the maximum generation length is reached, so as to form a joint watermark text.

According to a third aspect of an embodiment of the present application, a watermark detection method for text generated by a large model is provided, comprising:

Obtaining a watermark key, a previous window size, a minimum embedding number m, a large language model, and a token sequence to be detected, wherein the watermark key, the previous window size, the minimum embedding number, and the large language model are all consistent with those when the watermark is embedded;

Selecting a third selected token sequence at each position from the token sequence to be detected in sequence according to the above window, generating a third pseudo-random number sequence at each position based on the third selected token sequence and the watermark key and combining them to obtain a pseudo-random number detection matrix, calculating a distance between the watermark key and the token sequence to be detected based on the pseudo-random number detection matrix and the token sequence to be detected, and if the distance is lower than a predetermined threshold, the source detection is passed;

The token position is determined based on the minimum embedding number m, and the token sequence before the token position in the token sequence to be detected is selected as the fourth selected token sequence. According to the fourth selected token sequence, a third vocabulary probability distribution is obtained through the large language model, and a fourth pseudo-random number sequence is generated based on the fourth selected token sequence and the watermark key. According to the third vocabulary probability distribution and the fourth pseudo-random number sequence, the token at the next position is calculated, and the tokens at the last m positions are sampled in sequence to form a reference token sequence. If the reference token sequence is consistent with the token sequence at the corresponding position in the token sequence to be detected, the tampering detection passes.

Furthermore, during the source detection process:

Using the window size n mentioned above, All integers within , calculate the token sequence to be detected The hash value of the watermark key K is used as the seed of the pseudo-random number generator to generate a third pseudo-random number sequence , the third pseudo-random number sequence at all token positions is combined into a pseudo-random number detection matrix , the matrix size is , where L is the length of the token sequence to be detected;

From the calculation of watermark key K and the token sequence to be detected The random distance between , if the cost is lower than the predetermined threshold , i.e., judging the token sequence to be detected Pass source detection.

According to a fourth aspect of an embodiment of the present application, there is provided a watermark detection device for generating text from a large model, comprising:

The second acquisition module is used to acquire a watermark key, a previous window size, a minimum embedding number, a large language model, and a token sequence to be detected, wherein the watermark key, the previous window size, the minimum embedding number m, and the large language model are consistent with those when the watermark is embedded;

a source detection module, configured to sequentially select a third selected token sequence at each position from the token sequence to be detected according to the above window, generate a third pseudo-random number sequence at each position based on the third selected token sequence and the watermark key and combine them to obtain a pseudo-random number detection matrix, calculate the distance between the watermark key and the token sequence to be detected based on the pseudo-random number detection matrix and the token sequence to be detected, and if the distance is lower than a predetermined threshold, the source detection is passed;

A tampering detection module is used to determine the token position based on the minimum embedding number m, select the token sequence before the token position in the token sequence to be detected as a fourth selected token sequence, obtain a third vocabulary probability distribution through the large language model according to the fourth selected token sequence, and generate a fourth pseudo-random number sequence based on the fourth selected token sequence and the watermark key, calculate the token at the next position according to the third vocabulary probability distribution and the fourth pseudo-random number sequence, and sequentially sample the tokens at the last m positions to form a reference token sequence. If the reference token sequence is consistent with the token sequence at the corresponding position in the token sequence to be detected, the tampering detection is passed.

According to a fifth aspect of an embodiment of the present application, a computer program product is provided, comprising a computer program/instruction, which, when executed by a processor, implements the methods described in the first and third aspects.

According to a sixth aspect of an embodiment of the present application, there is provided an electronic device, including:

one or more processors;

A memory for storing one or more programs;

When the one or more programs are executed by the one or more processors, the one or more processors implement the methods described in the first and third aspects.

According to a seventh aspect of an embodiment of the present application, a computer-readable storage medium is provided, on which computer instructions are stored. When the instructions are executed by a processor, the steps of the method described in the first and third aspects are implemented.

The technical solution provided by the embodiments of the present application may have the following beneficial effects:

This application proposes a watermark embedding method for large model generated text. Through serial coding, a sampling-based watermark embedding method is used to embed robust watermarks and fragile watermarks in sequence, ensuring that the watermark effect range covers the entire text content, and can achieve tamper-proof protection of the entire text; in the generated text, the fragile watermark information is mainly distributed in a certain amount of text at the end of the text content, and the robust watermark information is distributed in the remaining text content except the fragile watermark. The watermark embedding position is designed in this way to ensure that the tamper-proof protection range of the fragile watermark can cover the entire text.

This application proposes a watermark detection method for large model generated text, which can realize the source verification and tampering detection of the whole text, and through parallel decoding, the fragile watermark detection and robust watermark detection can be carried out in parallel or separately according to actual needs, and the efficiency can be greatly improved. Robust watermark detection can effectively verify the binding relationship between the key K and the modified watermark text when the original watermark text is modified to a certain extent, thereby providing a reliable text source proof for the detection party; fragile watermark detection can provide effective proof of whether the detected text has been tampered with on the premise of verifying the binding relationship between the key K and the text. The robust watermark detection method does not need to run the generation model, the detection method is simple, and the calculation efficiency is high. At the same time, it is robust to a certain degree of text editing attacks, which can effectively meet the source verification needs in actual application scenarios; the fragile watermark detection sensitivity and detection accuracy are extremely high. In actual use, the tampering detection accuracy of single token editing attacks can reach close to 1, and it also ensures that it is difficult for attackers to effectively remove watermark information without holding the key K.

It should be understood that the foregoing general description and the following detailed description are exemplary and explanatory only and are not restrictive of the present application.

BRIEF DESCRIPTION OF THE DRAWINGS

The accompanying drawings, which are incorporated in and constitute a part of this specification, illustrate embodiments consistent with the present application and, together with the description, serve to explain the principles of the present application.

Fig. 1 is a flow chart showing a method for embedding watermarks for text generated by a large model according to an exemplary embodiment.

Fig. 2 is a flowchart of robust watermark embedding according to an exemplary embodiment.

Fig. 3 is a flowchart showing a fragile watermark embedding process according to an exemplary embodiment.

Fig. 4 is a flow chart showing a method for watermark detection of text generated by a large model according to an exemplary embodiment.

Fig. 5 is a flow chart of source detection according to an exemplary embodiment.

Fig. 6 is a flowchart showing tampering detection according to an exemplary embodiment.

Fig. 7 is a block diagram showing a watermark embedding apparatus for generating text for a large model according to an exemplary embodiment.

Fig. 8 is a block diagram showing a watermark detection device for text generated by a large model according to an exemplary embodiment.

Fig. 9 is a schematic diagram showing an electronic device according to an exemplary embodiment.

DETAILED DESCRIPTION

Here, exemplary embodiments are described in detail, and examples thereof are shown in the accompanying drawings. When the following description refers to the drawings, unless otherwise indicated, the same numbers in different drawings represent the same or similar elements. The implementations described in the following exemplary embodiments do not represent all implementations consistent with the present application.

The terms used in this application are for the purpose of describing specific embodiments only and are not intended to limit this application. The singular forms of "a", "said" and "the" used in this application and the appended claims are also intended to include plural forms unless the context clearly indicates other meanings. It should also be understood that the term "and/or" used herein refers to and includes any or all possible combinations of one or more associated listed items.

It should be understood that although the terms first, second, third, etc. may be used in the present application to describe various information, these information should not be limited to these terms. These terms are only used to distinguish the same type of information from each other. For example, without departing from the scope of the present application, the first information may also be referred to as the second information, and similarly, the second information may also be referred to as the first information. Depending on the context, the word "if" as used herein may be interpreted as "at the time of" or "when" or "in response to determining".

FIG. 1 is a flow chart of a method for embedding a watermark for generating text with a large model according to an exemplary embodiment. As shown in FIG. 1 , the method is applied in a terminal and may include the following steps:

Step S11: obtaining a watermark key, a prompt word of a large language model, a context window size, a large language model, and a generated context token sequence;

Step S12: according to the prompt word and the generated previous token sequence, a first vocabulary probability distribution is obtained through the large language model, a first selected token sequence is selected from the generated previous token sequence based on the previous window size, a first pseudo-random number sequence is generated according to the first selected token sequence and a watermark key, a token at the next position is calculated according to the first vocabulary probability distribution and the first pseudo-random number sequence, and sampling is performed in sequence until the generation is completed or the maximum generation length is reached, thereby forming a robust watermark text;

Step S13: Determine the minimum embedding quantity m and the expansion margin d, and select the robust watermark token sequence except the end Tokens other than the tokens and the generated fragile watermark token sequence are used as the second selected token sequence. According to the second selected token sequence, a second vocabulary probability distribution is obtained through the large language model, and a second pseudo-random number sequence is generated according to the second selected token sequence and the watermark key. According to the second vocabulary probability distribution and the second pseudo-random number sequence, the token at the next position is calculated and sampled in sequence until the generation is completed or the maximum generation length is reached, thereby forming a joint watermark text.

It can be seen from the above embodiments that the present application uses a watermark embedding method based on a sampling process to embed a robust watermark and a fragile watermark in sequence through a serial encoding method, thereby ensuring that the watermark effect range covers the entire text content and can achieve tamper-proof protection for the entire text; in the generated text, the fragile watermark information is mainly distributed in a certain amount of text at the end of the text content, and the robust watermark information is distributed in the remaining text content except the fragile watermark. The watermark embedding position is designed in this way to ensure that the tamper-proof protection range of the fragile watermark can cover the entire text. If the fragile watermark is embedded in a non-end position, the end position is generated later than the fragile watermark embedding position, resulting in the watermark being unable to provide any protection for the position, and any simple editing attack can easily tamper with the text content.

In the specific implementation of step S11, the watermark key K and the prompt word of the large language model are obtained. , the size of the above window , large language model M, has generated the above token sequence ;

Specifically, the large language model generates text in an autoregressive manner, that is, it takes the prompt word and the generated token sequence as input, outputs the next word predicted by the model, and continuously generates the complete text in a loop.

This generation mode limits the watermark information to only protect the generated previous content, and it is difficult to work on the text to be generated. However, text source verification and tampering detection require that they can be effective on the complete text. Therefore, the watermark embedding process, embedding position, and embedding quantity are crucial to the effectiveness of the watermark framework. Based on this, this application proposes the following watermark embedding process:

When generating text, first embed the robust watermark information into it according to the watermark key K set by the watermark embedder to obtain the complete generated text with robust watermark information; set the minimum embedding number of fragile watermarks , a certain amount of text content at the end is regenerated using a fragile watermark algorithm combined with a large language model and a watermark key K to obtain text content embedded with robust watermark information and fragile watermark information.

In the specific implementation of step S12, according to the prompt word and the generated token sequence above , obtain the first vocabulary probability distribution through the large language model, based on the above window size Selecting a first selected token sequence from the generated above token sequence, generating a first pseudo-random number sequence according to the first selected token sequence and a watermark key, calculating the token at the next position according to the first vocabulary probability distribution and the first pseudo-random number sequence, and sampling in sequence until the generation is completed or the maximum generation length is reached, thereby forming a robust watermark text;

Specifically, the robust watermark embedding process is shown in Figure 2. Taking the token at position y as an example, the prompt word With the token sequence generated above As the input of the large language model, we get the probability distribution of the first vocabulary , |𝒗| is the size of the large language model vocabulary V; calculate the hash value of the selected n tokens and the watermark key K, and use the hash value as the seed of the pseudorandom number generator (Pseudorandom Number Generator, PRNG) to generate the first pseudorandom number sequence , where the pseudo-random number Following the uniform distribution of [0, 1], the window size above Set according to the embedder's needs, usually set to 1; calculated by the formula Get the first index sequence , compare to get the first index sequence Maximum value , take the index in the vocabulary as The token of is taken as the output of the current position. Then the token obtained through the above generation process is The generated token sequence is re-input into the model, and robust watermark generation is performed sequentially until the end or the maximum generation length is reached, thereby forming a robust watermark text.

Pseudo-random number generators are used to generate a sequence of numbers that appear statistically random but are actually calculated by a deterministic algorithm based on an initial value (often called a "seed" or "seed"). Pseudo-random number generators are not truly random because their output is deterministic, but the sequences they produce have the statistical properties of random numbers, such as uniform distribution and lack of obvious patterns. Common pseudo-random number generation algorithms include Linear Congruential Generator (LCG), Mersenne Twister, etc.

The robust watermark used in this application has the characteristics of robustness, blind detection, and transparency. Robustness requires that the watermark information can still be detected and identified with a high accuracy after the carrier information is attacked and modified to a certain extent. The algorithm can resist a certain degree of editing attacks (addition, deletion, modification, etc.); blind detection requires that the watermark detection process can be carried out without relying on the model; transparency means that the watermark algorithm has limited impact on the quality of the generated text and the function of the large model. This method uses a large model watermark based on the sampling process, and the generated text is unbiased in probability distribution, which has little impact on the text quality.

In the specific implementation of step S13, the minimum embedding quantity is determined With extended margin , select the robust watermark token sequence except the end Tokens other than the tokens and the generated fragile watermark token sequence are used as the second selected token sequence. According to the second selected token sequence, a second vocabulary probability distribution is obtained through the large language model, and a second pseudo-random number sequence is generated according to the second selected token sequence and the watermark key. According to the second vocabulary probability distribution and the second pseudo-random number sequence, the token at the next position is calculated and sampled in sequence until the generation is completed or the maximum generation length is reached, thereby forming a joint watermark text.

The fragile watermark embedding process is shown in Figure 3. As an example, the fragile watermark token is removed at the end. Robust watermark token sequence and the generated fragile watermark token sequence The concatenated token sequence is used as the input of the large language model to obtain the probability distribution of the second vocabulary , | 𝒗| is the size of the large language model vocabulary V; calculate the input token sequence , The hash value of the watermark key K is used as the seed of the pseudo-random number generator PRNG to generate a second pseudo-random number sequence , where the pseudo-random number Follows the uniform distribution of [0, 1]; by calculating the formula Get the second index sequence , compared to Maximum value , take the index in the vocabulary as The word at the current position is output . Then And the one obtained through the above generation process As input, resample to generate The fragile watermark tokens at the position are recursively generated in sequence until the generation ends or the maximum generation length is reached, forming the target text with a joint watermark. The fragile watermark is designed to use the same embedding method as the robust watermark, and at the same time, the input window size n is expanded to all generated texts. When the content of the previous text changes, the random number sequence will change, and the watermark is selected with the probability of the token at that position being selected. is the probability of collision, that is, The probability of collision will make the watermark information at that position not be destroyed. The collision probability is inversely proportional to the number of bound watermarks. The more watermarks are bound to the text, the greater the probability of detecting anomalies when the text is tampered with. When embedding watermarks, embedding watermark information at a certain number of tokens at the end of the text will ensure that the text content is protected by the watermark with the same effect.

It should be noted that if the number of generated watermarks does not meet the minimum embedding number requirement, the number of tokens that need to be regenerated at the end will be increased until the minimum number requirement is met.

The design of fragile watermarks needs to have features such as fragility, relocatability, and transparency. Relocatability requires that the embedding position of the fragile watermark can still be accurately obtained during the detection process. In order to ensure the high sensitivity and relocatability of the watermark algorithm, the differences between the embedding and extraction of the watermark need to be minimized as much as possible. Due to the lack of prompt words in the watermark detection stage, this method removes the prompt word input in the watermark embedding stage to ensure that the fragile watermark embedding and detection can have exactly the same generation environment. This embedding method makes the watermark highly relocatable and fragile at the same time, but the text generation quality will be affected due to the lack of prompt words as input.

In the specific implementation, due to the watermark embedding principle and the limited information redundancy characteristics of the text, the protection effect of a single fragile watermark position is limited and cannot meet the tampering detection requirements. The more watermarks are embedded, the more obvious the watermark effect is. Therefore, continuously embedding watermark positions at the end can significantly improve the accuracy of watermark tampering detection. However, watermark embedding will have a certain impact on the quality of the generated text. In actual use, it is necessary to set the most suitable number of watermark embeddings according to the scene requirements to balance the text generation quality and tampering detection accuracy requirements, so as to maximize the effect of the large model and watermark framework.

FIG4 is a flow chart of a watermark detection method for text generated by a large model according to an exemplary embodiment. As shown in FIG4 , the method is applied in a terminal and may include the following steps:

Step S21: obtaining a watermark key, a context window size, a minimum embedding number, a large language model, and a token sequence to be detected, wherein the watermark key, the context window size, the minimum embedding number, and the large language model are all consistent with those when the watermark is embedded;

Step S22: selecting a third selected token sequence at each position from the token sequence to be detected in turn according to the above window, generating a third pseudo-random number sequence at each position based on the third selected token sequence and the watermark key and combining them to obtain a pseudo-random number detection matrix, calculating the distance between the watermark key and the token sequence to be detected based on the pseudo-random number detection matrix and the token sequence to be detected, and if the distance is lower than a predetermined threshold, the source detection is passed;

Step S23: Determine the token position based on the minimum embedding number m, select the token sequence before the token position in the token sequence to be detected as the fourth selected token sequence, obtain the third vocabulary probability distribution through the large language model according to the fourth selected token sequence, and generate a fourth pseudo-random number sequence based on the fourth selected token sequence and the watermark key, calculate the token at the next position according to the third vocabulary probability distribution and the fourth pseudo-random number sequence, and sample the tokens at the last m positions in sequence to form a reference token sequence, if the reference token sequence is consistent with the token sequence at the corresponding position in the token sequence to be detected, the tampering detection passes.

It can be seen from the above embodiments that the present application can realize the source verification and tampering detection of the full text, and through the parallel decoding method, the fragile watermark detection and the robust watermark detection can be carried out in parallel or separately according to actual needs, and the efficiency can be greatly improved. Robust watermark detection can still effectively verify the binding relationship between the key K and the modified watermark text when the original watermark text is modified to a certain extent, thereby providing a reliable text source proof for the detection party; fragile watermark detection can provide effective proof of whether the text to be detected has been tampered with on the premise of verifying the binding relationship between the key K and the text. The robust watermark detection method does not need to run the generation model, the detection method is simple, and the calculation efficiency is high. At the same time, it is robust to a certain degree of text editing attacks, and can effectively meet the source verification requirements in actual application scenarios; the fragile watermark detection sensitivity and detection accuracy are extremely high. In actual use, the tampering detection accuracy of a single token editing attack can reach close to 1, and it also ensures that it is difficult for the attacker to effectively remove the watermark information without holding the key K.

In the specific implementation of step S21, the watermark key K and the window size above are obtained. , minimum number of embeddings , the large language model M and its generation parameters and the token sequence to be detected ;

Specifically, there are two necessary conditions to determine that the text content has not been tampered with. One is to determine through source detection that there is a generation binding relationship between the detected text and the provided key, that is, the text is generated under the guidance of the key; the other is to sample and generate a fragile watermark for the text with a size of twice the minimum embedding number at the end of the text to be detected, and the number of consecutive identical tokens of the text to be detected at the end and the tokens generated by the sampling meets the minimum embedding number requirement. Only when these two conditions are met at the same time, the detection result that the text has not been tampered with is valid. This design makes it possible for malicious attackers to forge watermarks by reproducing the watermark embedding method, thereby significantly reducing the success rate of tampering detection and authentication. In actual use, the watermark key, the above window size, the minimum embedding number, and the large language model and its parameters used when embedding the watermark can be obtained from the watermark embedder or the service user.

In the specific implementation of step S22, according to the above window size From the token sequence to be detected The third selected token sequence of each position is sequentially selected, and the third pseudo-random number sequence of each position is generated based on the third selected token sequence and the watermark key K and combined to obtain a pseudo-random number detection matrix, and the watermark key K and the token sequence to be detected are calculated based on the pseudo-random number detection matrix and the token sequence to be detected. If the distance is lower than a predetermined threshold, the source detection is passed;

Specifically, text source detection is performed by detecting the robust watermark information in the text, which means detecting whether there is a generation binding relationship between the text to be detected and the provided watermark key, that is, detecting whether the text is generated under the guidance of the watermark key. When performing source detection, the watermark key used during embedding, the large model vocabulary, and the text to be detected are used as inputs. The distance cost between the watermark key and the detected text is calculated based on a statistical method, and the relationship between the text and the key is determined based on a preset cost threshold.

Specifically, in order to achieve blind detectability of watermarks, watermark detection determines the binding relationship between the key and the text by calculating the distance between the pseudo-random number and the true random sequence generated by the text and the input key, as shown in Figure 5, including the following process:

Using the same window size n as in watermark embedding, All integers within , calculate the token sequence to be detected The hash value of the watermark key K is used as a pseudo-random number generator The seed generates a third pseudo-random number sequence , the third pseudo-random number sequence at all token positions is combined into a pseudo-random number detection matrix , the matrix size is , where L is the length of the token sequence to be detected. If the text has not been modified, the third pseudo-random number sequence corresponding to each token position should be the same as the first pseudo-random number sequence used when embedding the watermark; find the token sequence to be detected from the vocabulary of the large language model , ,…, Each position token corresponds to the index of For example, if the fourth word in the text to be detected is "watermark", and its index in the vocabulary is 42, then The value of The value of the fourth position; thus accumulated to obtain the pseudo-random number detection matrix , calculate the watermark key K and the token sequence to be detected The random distance between , judge the cost and threshold The relationship between , can determine whether the text is generated by the key K guidance model. It is obtained by combining the hypothesis testing method with experimental test data. When a different key is used for detection than when embedded, The sequence should be a random number sequence with a mean value around 0.5. If the watermark key is used for detection, , at this time The sequence mean will be significantly greater than 0.5, so the statistical method can be used to calculate The watermark robustness is proportional to the number of watermark information embedded. When the number of watermarks is large, the influence of a single random number distortion caused by a single modification on the distance between the random number sequence and the generated text is smaller, making it more likely to detect the robust watermark information.

In the specific implementation of step S23, the token position is determined based on the minimum embedding number m, the token sequence before the token position in the token sequence to be detected is selected as the fourth selected token sequence, the third vocabulary probability distribution is obtained through the large language model according to the fourth selected token sequence, and a fourth pseudo-random number sequence is generated based on the fourth selected token sequence and the watermark key, the token at the next position is calculated according to the third vocabulary probability distribution and the fourth pseudo-random number sequence, and the tokens at the last m positions are sampled in sequence to form a reference token sequence, and if the reference token sequence is consistent with the token sequence at the corresponding position in the token sequence to be detected, the tampering detection is passed;

Specifically, text tampering detection is performed by detecting fragile watermark information of the text. When performing tampering detection, the key, the text to be detected, the large language model for watermark embedding and its parameters are required as input, and a certain amount of text at the end is sampled and produced for fragile watermarks. If the generated reference token sequence is the same as the original token sequence, the text content is considered to have not been tampered with. If there are some locations where the newly sampled reference tokens are different from the original tokens, the text content is considered to have been tampered with.

As shown in Figure 6, the fragile watermark detection process is basically the same as the watermark embedding process. The watermark is sampled and generated for the text at the end of the generated text with the minimum embedding number. The token at that position in the token sequence to be detected is compared with the token generated by the sample to see if they are the same. The number of identical tokens is calculated from the end to the beginning to see if they meet the minimum embedding number requirement of the fragile watermark. This way, it can be determined whether the fragile watermark at that position is damaged. Specifically, the sampling position is Token For example, the above sequence As the input of the large language model, the probability distribution of the third vocabulary is obtained , |𝒗| is the size of the large language model vocabulary V; calculate the input token sequence The hash value of the watermark key K is used as the seed of the pseudo-random number generator PRNG to generate a fourth pseudo-random number sequence , where the pseudo-random number Follows the uniform distribution of [0, 1]; by calculating the formula Get the fourth index sequence , compared to Maximum value , take the index in the vocabulary as The word is output as the token at position y. The reference token sequence is obtained by resampling the tokens at the last m positions. , the reference token sequence With the token sequence to be detected Compare them one by one. If the two are exactly the same, it is considered that the token at the end of the token sequence to be detected and the cumulative number of tokens generated by sampling are the same, which meets the minimum embedding requirement of the fragile watermark, and the fragile watermark of the text to be detected has not been damaged, that is, the text to be detected has not been subjected to any tampering attack. Otherwise, it is considered that the text to be detected has been subjected to tampering attack.

The high sensitivity of the fragile watermark in this application to text tampering stems from the symmetry of watermark embedding and detection, which ensures that the environment and steps of watermark embedding can be perfectly reproduced at the detection end. When the text content is modified, a single watermark bit collides with the probability predicted by the model for the word, that is, the watermark tampering cannot be detected. When a sufficient number of consecutive watermark bits protect the above content, the probability of a collision is the product of the model prediction probabilities of all watermark bits, which ensures that the tampering can be detected by the algorithm with a probability close to 1. If the attacker directly modifies the watermark bit, the word generated during the watermark detection process does not match the original word, allowing the algorithm to detect tampering with a probability of 1.

The framework proposed in this application mainly targets the risk of malicious tampering that may occur during the dissemination of large model-generated text, which has received little attention in the past. It combines robust large model watermarks and fragile large model watermarks, and makes specific and feasible requirements on their embedding methods, embedding quantities, and embedding positions. On the one hand, it retains the function of robust watermark source verification, and on this basis, it designs a fragile watermark algorithm that is compatible with it, so that the generated text has the ability to detect tampering with high accuracy and sensitivity against minor editing attacks and even watermark forgery attacks by professionals in related fields.

In summary, this application proposes a multifunctional large model watermark framework that combines robust watermarks and fragile watermarks for large model generated text source verification and tampering detection. Watermark embedding adopts a serial structure, taking prompt words and the generated token sequence as input, embedding robust watermarks and fragile watermarks in sequence, and outputting the generated text with a joint watermark; watermark detection adopts a parallel structure, detecting robust watermark and fragile watermark information respectively for source verification and tampering detection. Robust watermark embedding uses a watermark algorithm based on the sampling process, and detection uses statistical methods to detect the generation relationship between the key and the text; fragile watermarks also use a watermark algorithm based on the sampling process, and detect whether the text has been tampered with by comparing whether the sampled generated target words are consistent.

Corresponding to the aforementioned embodiment of the watermark embedding and detection method for large model generated text, the present application also provides an embodiment of the device.

FIG7 is a block diagram of a watermark embedding device for generating text for a large model according to an exemplary embodiment. Referring to FIG7 , the device may include:

The first acquisition module 11 is used to acquire a watermark key, a prompt word of a large language model, a context window size, a large language model, and a generated context token sequence;

A robust watermark generation module 12 is used to obtain a first vocabulary probability distribution through the large language model according to the prompt word and the generated previous token sequence, select a first selected token sequence from the generated previous token sequence based on the previous window size, generate a first pseudo-random number sequence according to the first selected token sequence and a watermark key, calculate the token at the next position according to the first vocabulary probability distribution and the first pseudo-random number sequence, and sample in sequence until the generation is completed or the maximum generation length is reached, thereby forming a robust watermark text;

The fragile watermark generation module 13 is used to determine the minimum embedding number m and the expansion margin d, select the tokens in the robust watermark token sequence except the last m+d tokens and the generated fragile watermark token sequence as the second selected token sequence, obtain the second vocabulary probability distribution through the large language model according to the second selected token sequence, and generate a second pseudo-random number sequence according to the second selected token sequence and the watermark key, calculate the token at the next position according to the second vocabulary probability distribution and the second pseudo-random number sequence, and sample them in sequence until the generation is completed or the maximum generation length is reached, so as to form a joint watermark text.

Fig. 8 is a block diagram of a watermark detection device for large model generated text according to an exemplary embodiment. Referring to Fig. 8, the device may include:

The second acquisition module 21 is used to acquire a watermark key, a context window size, a minimum embedding number, a large language model, and a token sequence to be detected, wherein the watermark key, the context window size, the minimum embedding number, and the large language model are consistent with those when the watermark is embedded;

A source detection module 22 is used to sequentially select a third selected token sequence at each position from the token sequence to be detected according to the above window, generate a third pseudo-random number sequence at each position based on the third selected token sequence and the watermark key and combine them to obtain a pseudo-random number detection matrix, calculate the distance between the watermark key and the token sequence to be detected based on the pseudo-random number detection matrix and the token sequence to be detected, and if the distance is lower than a predetermined threshold, the source detection is passed;

The tampering detection module 23 is used to determine the token position based on the minimum embedding number m, select the token sequence before the token position in the token sequence to be detected as the fourth selected token sequence, obtain the third vocabulary probability distribution through the large language model according to the fourth selected token sequence, and generate a fourth pseudo-random number sequence based on the fourth selected token sequence and the watermark key, calculate the token at the next position according to the third vocabulary probability distribution and the fourth pseudo-random number sequence, and sample the tokens at the last m positions in sequence to form a reference token sequence. If the reference token sequence is consistent with the token sequence at the corresponding position in the token sequence to be detected, the tampering detection is passed.

Regarding the device in the above embodiment, the specific manner in which each module performs operations has been described in detail in the embodiment of the method, and will not be elaborated here.

For the device embodiment, since it basically corresponds to the method embodiment, the relevant parts can refer to the partial description of the method embodiment. The device embodiment described above is only schematic, wherein the units described as separate components may or may not be physically separated, and the components displayed as units may or may not be physical units, that is, they may be located in one place, or they may be distributed on multiple network units. Some or all of the modules may be selected according to actual needs to achieve the purpose of the present application scheme. A person of ordinary skill in the art can understand and implement it without paying any creative work.

Correspondingly, the present application also provides a computer program product, including a computer program/instruction, which, when executed by a processor, implements the watermark embedding and detection method for large model generated text as described above.

Correspondingly, the present application also provides an electronic device, including: one or more processors; a memory for storing one or more programs; when the one or more programs are executed by the one or more processors, the one or more processors implement the watermark embedding and detection method for large model generated text as described above. As shown in Figure 9, a hardware structure diagram of any device with data processing capability where a watermark embedding and detection device for large model generated text provided in an embodiment of the present invention is located, in addition to the processor, memory and network interface shown in Figure 9, any device with data processing capability where the device in the embodiment is located can also include other hardware according to the actual function of the device with data processing capability, which will not be described in detail.

Correspondingly, the present application also provides a computer-readable storage medium on which computer instructions are stored. When the instructions are executed by the processor, the watermark embedding and detection method for generating text for a large model as described above is implemented. The computer-readable storage medium can be an internal storage unit of any device with data processing capabilities described in any of the aforementioned embodiments, such as a hard disk or a memory. The computer-readable storage medium can also be an external storage device, such as a plug-in hard disk, a smart memory card (Smart Media Card, SMC), an SD card, a flash card (Flash Card), etc. equipped on the device. Furthermore, the computer-readable storage medium can also include both an internal storage unit and an external storage device of any device with data processing capabilities. The computer-readable storage medium is used to store the computer program and other programs and data required by any device with data processing capabilities, and can also be used to temporarily store data that has been output or is to be output.

Those skilled in the art will readily appreciate other embodiments of the present application after considering the specification and practicing the contents disclosed herein. The present application is intended to cover any variations, uses or adaptations of the present application, which follow the general principles of the present application and include common knowledge or customary technical means in the art that are not disclosed in the present application.

It should be understood that the present application is not limited to the exact construction that has been described above and shown in the drawings, and that various modifications and changes may be made without departing from the scope thereof.

Claims (10)

1. A watermark embedding method for generating text for a large model, characterized by comprising: Obtain the watermark key, the prompt word of the large language model, the context window size, the large language model, and the generated context token sequence; According to the prompt word and the generated previous token sequence, a first vocabulary probability distribution is obtained through the large language model, a first selected token sequence is selected from the generated previous token sequence based on the previous window size, a first pseudo-random number sequence is generated according to the first selected token sequence and a watermark key, a token at the next position is calculated according to the first vocabulary probability distribution and the first pseudo-random number sequence, and samples are sequentially taken until the generation is completed or the maximum generation length is reached, thereby forming a robust watermark text; Determine the minimum embedding number m and the expansion margin d, select the tokens except the last m+d tokens in the robust watermark token sequence and the generated fragile watermark token sequence as the second selected token sequence, obtain the second vocabulary probability distribution through the large language model according to the second selected token sequence, generate the second pseudo-random number sequence according to the second selected token sequence and the watermark key, calculate the token at the next position according to the second vocabulary probability distribution and the second pseudo-random number sequence, and sample them in sequence until the generation is completed or the maximum generation length is reached, so as to form a joint watermark text. 2. The method according to claim 1 is characterized in that, in the formation process of the robust watermark text, the generation process of the token at position y is as follows: The prompt word With the token sequence generated above As the input of the large language model, we get the probability distribution of the first vocabulary , where |𝒗| is the size of the large language model vocabulary V; Based on the above window size Select n tokens from the generated token sequence as the first selected token sequence, calculate the hash value of the first selected token sequence and the watermark key K, use the hash value as the seed of the pseudo-random number generator, and generate a first pseudo-random number sequence , where the pseudo-random number Follows a uniform distribution of [0, 1]; By calculating the formula Get the first index sequence , compare to get the first index sequence Maximum value , take the index in the vocabulary as The token at the current position is output. 3. The method according to claim 1 is characterized in that, in the process of forming the joint watermark text, the token at position y is generated as follows: Will remove the end Robust watermark token sequence and the generated fragile watermark token sequence The concatenated token sequence is used as the input of the large language model to obtain the probability distribution of the second vocabulary , where |𝒗| is the size of the large language model vocabulary V; Calculate the token sequence of the input , The hash value of the watermark key K is used as the seed of the pseudo-random number generator to generate a second pseudo-random number sequence , where the pseudo-random number Follows a uniform distribution of [0, 1]; By calculating the formula Get the second index sequence , compared to Maximum value , take the index in the vocabulary as The word at the current position is output . 4. A watermark embedding device for generating text for a large model, characterized by comprising: A first acquisition module is used to acquire a watermark key, a prompt word of a large language model, a context window size, a large language model, and a generated context token sequence; A robust watermark generation module, configured to obtain a first vocabulary probability distribution through the large language model according to the prompt word and the generated previous token sequence, select a first selected token sequence from the generated previous token sequence based on the previous window size, generate a first pseudo-random number sequence according to the first selected token sequence and a watermark key, calculate the token at the next position according to the first vocabulary probability distribution and the first pseudo-random number sequence, and sequentially sample until the generation is completed or the maximum generation length is reached, thereby forming a robust watermark text; The fragile watermark generation module is used to determine the minimum embedding quantity m and the expansion margin d, select the tokens in the robust watermark token sequence except the last m+d tokens and the generated fragile watermark token sequence as the second selected token sequence, obtain the second vocabulary probability distribution through the large language model according to the second selected token sequence, generate the second pseudo-random number sequence according to the second selected token sequence and the watermark key, calculate the token at the next position according to the second vocabulary probability distribution and the second pseudo-random number sequence, and sample in sequence until the generation is completed or the maximum generation length is reached, so as to form a joint watermark text. 5. A watermark detection method for text generated by a large model, characterized by comprising: Obtaining a watermark key, a previous window size, a minimum embedding number m, a large language model, and a token sequence to be detected, wherein the watermark key, the previous window size, the minimum embedding number, and the large language model are all consistent with those when the watermark is embedded; Selecting a third selected token sequence at each position from the token sequence to be detected in sequence according to the above window, generating a third pseudo-random number sequence at each position based on the third selected token sequence and the watermark key and combining them to obtain a pseudo-random number detection matrix, calculating a distance between the watermark key and the token sequence to be detected based on the pseudo-random number detection matrix and the token sequence to be detected, and if the distance is lower than a predetermined threshold, the source detection passes; The token position is determined based on the minimum embedding number m, and the token sequence before the token position in the token sequence to be detected is selected as the fourth selected token sequence. According to the fourth selected token sequence, a third vocabulary probability distribution is obtained through the large language model, and a fourth pseudo-random number sequence is generated based on the fourth selected token sequence and the watermark key. According to the third vocabulary probability distribution and the fourth pseudo-random number sequence, the token at the next position is calculated, and the tokens at the last m positions are sampled in sequence to form a reference token sequence. If the reference token sequence is consistent with the token sequence at the corresponding position in the token sequence to be detected, the tampering detection passes. 6. The method according to claim 5, characterized in that during the source detection process: Using the window size n mentioned above, All integers within , calculate the token sequence to be detected The hash value of the watermark key K is used as the seed of the pseudo-random number generator to generate a third pseudo-random number sequence , the third pseudo-random number sequence at all token positions is combined into a pseudo-random number detection matrix , the matrix size is , where L is the length of the token sequence to be detected; From the calculation of watermark key K and the token sequence to be detected The random distance between , if the cost is lower than the predetermined threshold , i.e., judging the token sequence to be detected Pass source detection. 7. A watermark detection device for text generated by a large model, characterized by comprising: The second acquisition module is used to acquire a watermark key, a previous window size, a minimum embedding number m, a large language model, and a token sequence to be detected, wherein the watermark key, the previous window size, the minimum embedding number, and the large language model are consistent with those when the watermark is embedded; a source detection module, configured to sequentially select a third selected token sequence at each position from the token sequence to be detected according to the above window, generate a third pseudo-random number sequence at each position based on the third selected token sequence and the watermark key and combine them to obtain a pseudo-random number detection matrix, calculate the distance between the watermark key and the token sequence to be detected based on the pseudo-random number detection matrix and the token sequence to be detected, and if the distance is lower than a predetermined threshold, the source detection is passed; A tampering detection module is used to determine the token position based on the minimum embedding number m, select the token sequence before the token position in the token sequence to be detected as a fourth selected token sequence, obtain a third vocabulary probability distribution through the large language model according to the fourth selected token sequence, and generate a fourth pseudo-random number sequence based on the fourth selected token sequence and the watermark key, calculate the token at the next position according to the third vocabulary probability distribution and the fourth pseudo-random number sequence, and sequentially sample the tokens at the last m positions to form a reference token sequence. If the reference token sequence is consistent with the token sequence at the corresponding position in the token sequence to be detected, the tampering detection is passed. 8. A computer program product, comprising a computer program/instruction, wherein the computer program/instruction, when executed by a processor, implements the method according to any one of claims 1-3, 5-6. 9. An electronic device, comprising: one or more processors; A memory for storing one or more programs; When the one or more programs are executed by the one or more processors, the one or more processors implement the method according to any one of claims 1-3, 5-6. 10. A computer-readable storage medium having computer instructions stored thereon, wherein the instructions, when executed by a processor, implement the steps of the method as described in any one of claims 1-3, 5-6.