基于提示词的大语言模型水印及检测方法:所有权与完整性保护

    Prompt-based Watermarking and Detection Method for Large Language Models for Ownership and Integrity Protection

    • 摘要: 随着大语言模型在内容生成领域的广泛应用,如何在保证生成文本质量的同时实现可靠的版权标识与溯源,成为当前重要的研究问题。现有语言模型水印方法多依赖于整体生成分布的扰动,然而在翻译等语义保持型攻击下,其检测性能往往显著下降。针对上述问题,本文提出了一种基于提示词的大语言模型水印方法。在进行水印生成之前,首先针对输入的提示词利用基于图的无监督算法(TextRank)技术对其中的关键词进行打分并获取得分最高的K个关键词,并将关键词映射为其对应的词元(token)序列。随后,将关键词 token ID以及秘密密钥共同输入至哈希函数中,生成伪随机哈希密钥和伪随机种子,并对词表进行划分生成绿名单。接着,通过在生成过程中对绿名单token的概率进行系统性增强,使得绿名单token的出现频率显著高于零假设下的期望值,来提高水印在语义变换场景下的稳定性。实验结果表明,所提出方法在检测性能与文本质量之间取得了良好的平衡。在翻译攻击场景中,相比基准方法,本文方法的稳定性提高了3.4倍,显示出较强的鲁棒性,验证了所提方法在语义保持型攻击下的有效性与实用价值。

       

      Abstract: With the widespread adoption of large language models (LLMs) in automated content generation, achieving reliable copyright identification and traceability while preserving generation quality has become an important research problem. Existing watermarking techniques for LLMs typically rely on perturbing the global generation distribution, yet their detection performance degrades significantly under semantic-preserving transformations such as such as paraphrasing or translation. To address this, this paper proposes a prompt-based watermarking method for large language models. In the proposed method, the input prompt is first analyzed using the PageRank algorithm to assign importance scores to its keywords, from which the top-K keywords are selected and mapped to their corresponding token ID sequences. Subsequently, these token ID sequences, along with a secret key, are fed into a cryptographic hash function to generate a pseudorandom hash key and a pseudorandom seed, which are then used to partition the entire language model vocabulary to obtain a green list. During the subsequent text generation process, through systematically boosting the generation probability of tokens in the green list, causing their actual frequency of occurrence to significantly exceed the expected value under a random baseline to enhance the robustness of the watermark against semantically-preserving transformations of the text. Experimental results demonstrate that the proposed method achieves a favorable trade-off between detection accuracy and text quality. In translation attack scenarios, compared with the baseline method, the proposed approach reduces the AUC decay by a factor of 3.4, indicating stronger robustness. These results validate the effectiveness and practical value of the proposed method under semantic-preserving attacks.

       

    /

    返回文章
    返回