Malicious prompt data set expansion method based on Mongolian

Abstract

The invention relates to the technical field of data expansion, in particular to a malicious prompt data set expansion method based on Mongolian. According to the method, high-frequency roots and affixes in a Mongolian basic malicious prompt corpus and a universal corpus are extracted, morphological analysis is combined, targeted malicious prompt samples can be constructed, the diversity and authenticity of a Mongolian safety evaluation data set are enhanced, candidate malicious prompt samples are optimized by adopting a genetic algorithm, and the safety evaluation accuracy of the Mongolian safety evaluation data set is improved. According to the method, the expansion sample is enabled to better conform to syntax and semantic rules of the Mongolian, effectiveness of the attack sample in the Mongolian scene is ensured, the expansion data set is enhanced by using the antagonism generation strategy, robustness and antagonism of the data set are improved, attack behaviors possibly occurring in a real scene can be simulated, and the robustness and the antagonism of the data set are improved. Therefore, an effective sample generation tool is provided for safety evaluation in a Mongolian scene, and the anti-attack capability of the Mongolian model is improved.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of data expansion, in particular to a malicious prompt data set expansion method based on Mongolian. BACKGROUND

[0002] In recent years, China has made rapid progress in the field of large language models. With the widespread deployment of large language models in various applications, more and more security problems have become increasingly prominent, especially jailbreaking attacks. Jailbreaking attacks refer to bypassing the built-in security measures of the model to make it output harmful, illegal or inappropriate content. Such attacks not only endanger the safety and privacy of users, but also may have more widespread negative impacts on society. In low-resource language environments, the harm of large model jailbreaking attacks is particularly prominent. These languages have fewer users worldwide, resulting in great challenges in data collection, corpus organization, and model training. The effectiveness and security of large models often rely on massive, diverse, and high-quality corpus data as support. Therefore, the lack of generalization ability due to data scarcity in low-resource languages makes the model prone to understanding bias, insufficient generation ability, and weak defense against attacks, thus providing opportunities for attackers.

[0003] Currently, there are many methods for constructing security evaluation data sets, which have achieved certain research results. However, most existing security evaluation data sets are based on high-resource languages such as English and Chinese. The common adversarial samples and prompt injection attack cases in high-resource languages are difficult to directly adapt to the Mongolian scenario. Moreover, there are almost no targeted attack samples designed based on the morphological characteristics of Mongolian agglutinative languages (such as complex suffixes and flexible word order). This makes it impossible to effectively verify the anti-attack ability of the model in real scenarios. SUMMARY

[0004] The main purpose of the present application is to provide a malicious prompt data set expansion method based on Mongolian, which aims to solve the technical problems in the prior art.

[0005] The present application proposes a malicious prompt data set expansion method based on Mongolian, which includes: Obtaining a Mongolian basic malicious prompt corpus and a Mongolian general corpus, and extracting a high-frequency root set and a high-frequency affix set from the Mongolian general corpus; Extracting core malicious semantic features from the Mongolian basic malicious prompt corpus, and performing morphological analysis on the core malicious semantic features using a Mongolian word segmentation model to obtain a malicious root subset and a malicious affix subset; Comparing and screening the malicious root subset with the high-frequency root set to obtain a replaceable root library, and comparing and screening the malicious affix subset with the high-frequency affix set to obtain a replaceable affix library; obtaining a plurality of grammar compatibility coefficients according to the replaceable affix library and the replaceable root library, and screening valid combination pairs from the replaceable affix library and the replaceable root library according to each of the grammar compatibility coefficients; performing semantic consistency verification on each of the valid combination pairs and extracting candidate malicious prompt samples that pass the verification, and generating an initial expanded sample set by iteratively optimizing the candidate malicious prompt samples through a genetic algorithm; performing multi-dimensional filtering on the initial expanded sample set to obtain a preliminary optimized data set, and enhancing the preliminary optimized data set by using an adversarial generation strategy to generate adversarial expanded samples; combining the adversarial expanded samples with the preliminary optimized data set to obtain a final expanded data set.

[0006] Preferably, the step of morphologically analyzing the core malicious semantic feature by using a Mongolian word segmentation model to obtain a malicious root subset and a malicious affix subset comprises: obtaining a plurality of Mongolian words according to the core malicious semantic feature, and inputting each of the Mongolian words into a Mongolian segmentation model for morphological splitting to obtain corresponding candidate roots and candidate affixes; obtaining a root appearance probability of each candidate root and a semantic correlation degree between each candidate root and the core malicious semantic feature, and obtaining an effectiveness score of the corresponding candidate root according to each of the root appearance probability and the semantic correlation degree; determining whether the effectiveness score of each candidate root is greater than a first preset score threshold; If the effectiveness score is greater than the first preset score threshold, the candidate root is included in an initial malicious root set; obtaining a semantic category of the core malicious semantic feature, and performing semantic filtering and screening on the initial malicious root set according to the semantic category to obtain a malicious root subset; obtaining a vowel attribute matching degree and a grammar rule compliance degree of each candidate affix, and obtaining a compatibility score of the corresponding candidate affix according to each of the vowel attribute matching degree and the grammar rule compliance degree; determining whether the compatibility score of each of the candidate affixes is greater than a second preset score threshold; If the compatibility score of the candidate affix is greater than the second preset score threshold, the candidate affix is included in an initial malicious affix set; obtaining an affix category of the core malicious semantic feature, and performing functional filtering and screening on the initial malicious affix set according to the affix category to obtain a malicious affix subset.

[0007] Preferably, the step of comparing and screening the malicious root subset with a high-frequency root set to obtain a replaceable root library comprises: obtaining a malicious semantic vector, a malicious core syllable sequence and a malicious part-of-speech label of each malicious root in the malicious root subset, and a high-frequency semantic vector and a high-frequency part-of-speech label of each high-frequency root in the high-frequency root set, respectively; selecting a high-frequency root corresponding to a high-frequency part-of-speech label consistent with the malicious part-of-speech label from the plurality of high-frequency part-of-speech labels as a same-part-of-speech candidate root, and obtaining a same-part-of-speech semantic vector and a same-part-of-speech core syllable sequence of each same-part-of-speech candidate root; obtaining an edit distance between the corresponding same-part-of-speech candidate root and the malicious root according to each same-part-of-speech core syllable sequence and the malicious core syllable sequence, and obtaining a first morphological similarity according to each edit distance; obtaining a first cosine similarity according to each same-part-of-speech semantic vector and the malicious semantic vector, and obtaining a first comprehensive matching degree according to each first cosine similarity and the first morphological similarity; determining whether each first comprehensive matching degree is greater than a first preset matching degree; If the first comprehensive matching degree is greater than the first preset matching degree, the same-part-of-speech candidate root corresponding to the first comprehensive matching degree is included in the replaceable root library.

[0008] As a preferred, the step of obtaining a plurality of grammatical compatibility coefficients according to the replaceable affix library and the replaceable root library, and selecting an effective combination pair from the replaceable affix library and the replaceable root library according to each grammatical compatibility coefficient, comprises: obtaining an affix morphological attribute and an affix grammatical attribute of each same-function candidate affix in the replaceable affix library, and a root morphological attribute and a root grammatical attribute of each same-part-of-speech candidate root in the replaceable root library, and obtaining a vowel harmony matching value according to a final vowel type of each affix morphological attribute and an initial vowel type of the root morphological attribute; obtaining a consonant connection fitness according to an initial consonant connection vowel of each affix morphological attribute and a final consonant type of the root morphological attribute, and obtaining a corresponding morphological compatibility score according to each consonant connection fitness and the vowel harmony matching value; obtaining a function correlation degree according to an affix function of each affix grammatical attribute and a commonly used collocation affix type of the root grammatical attribute, obtaining a part-of-speech matching degree according to an applicable part-of-speech range of each affix grammatical attribute and the part-of-speech of the root grammatical attribute, and obtaining a corresponding grammatical fitness score according to each part-of-speech matching degree and the function correlation degree; obtaining a first common occurrence probability and a second common occurrence probability of each same-function candidate affix and same-part-of-speech candidate root in the Mongolian basic malicious prompt corpus and the Mongolian general corpus, respectively, and obtaining a malicious scene fitness according to each first common occurrence probability and second common occurrence probability; obtaining semantic association strength according to semantic orientation of each of the affix grammar attribute and semantic category of the root grammar attribute, and obtaining corresponding semantic compatibility score according to each of the semantic association strength and malicious scene adaptation degree; obtaining grammar compatibility coefficient of the same function candidate affix and the same part of speech candidate root according to each of the semantic compatibility score, grammar adaptation degree score and morphological compatibility score, and judging whether each of the grammar compatibility coefficient is greater than a preset threshold coefficient; If the grammar compatibility coefficient is greater than the preset threshold coefficient, it is determined that the same function candidate affix and the same part of speech candidate root corresponding to the grammar compatibility coefficient are an effective combination pair.

[0009] As preferred, the step of performing semantic consistency verification on each of the effective combination pairs and extracting candidate malicious prompt samples that pass the verification, comprises: splicing the same function candidate affix and the same part of speech candidate root in each of the effective combination pairs to generate a combination vocabulary and obtaining morphological variation characteristics of each combination vocabulary, and obtaining a corresponding initial semantic vector according to each of the morphological variation characteristics; obtaining an original malicious prompt sample, and obtaining a reference semantic vector and an extended reference semantic vector of a malicious root in the corresponding original malicious prompt sample according to the same part of speech candidate root in each of the effective combination pairs; obtaining a corresponding second cosine similarity according to each of the reference semantic vector and the initial semantic vector, and judging whether each of the second cosine similarity is greater than a first semantic threshold; If the second cosine similarity is greater than the first semantic threshold, the combination vocabulary corresponding to the second cosine similarity is included in a primary candidate vocabulary set; obtaining context association characteristics of each combination vocabulary in the primary candidate vocabulary set, and obtaining an extended semantic vector of the corresponding combination vocabulary according to each of the context association characteristics; obtaining a corresponding third cosine similarity according to each of the extended semantic vector and the extended reference semantic vector, and judging whether each of the third cosine similarity is greater than a second semantic threshold; If the third cosine similarity is greater than the second semantic threshold, the combination vocabulary corresponding to the third cosine similarity is included in a secondary candidate vocabulary set; replacing the corresponding root and affix in the original malicious prompt sample with the combination vocabulary in the secondary candidate vocabulary set to obtain a corresponding initial malicious prompt sample, and obtaining a syntactic structure tree of each initial malicious prompt sample; obtaining a corresponding syntactic consistency score and a malicious probability value according to each of the syntactic structure trees, and obtaining a corresponding comprehensive semantic consistency score according to each of the syntactic consistency score and the malicious probability value; determining whether each of the comprehensive semantic consistency scores is greater than a preset score threshold value; If the comprehensive semantic consistency score is greater than the preset score threshold value, the initial malicious prompt sample corresponding to the comprehensive semantic consistency score is marked as a candidate malicious prompt sample that passes the test.

[0010] Preferably, the step of performing multi-dimensional filtering on the initial expansion sample set to obtain a preliminary optimization data set and enhancing the preliminary optimization data set using an adversarial generation strategy to generate adversarial expansion samples includes: Obtaining the syntax structure data of each sample in the initial expansion sample set, and obtaining the corresponding syntax integrity index according to the syntax structure data; According to the syntax integrity index, the samples with complete syntax structure are filtered from the initial expansion sample set to obtain a syntax filtering subset, and the semantic redundancy between samples is obtained according to the semantic feature vector of each sample in the syntax filtering subset; According to the semantic redundancy, the repeated samples in the syntax filtering subset are removed to obtain a semantic deduplication subset, and a category balance verification is performed according to the malicious category of each sample in the semantic deduplication subset; The samples that pass the category balance verification are filtered from the semantic deduplication subset to obtain a preliminary optimization data set, and the root sequence, affix combination and word order structure of each sample in the preliminary optimization data set are obtained; According to the root sequence, a root replacement adversarial sample is obtained, and according to the affix combination, an affix tampering adversarial sample is obtained; According to the word order structure, a word order replacement adversarial sample is obtained, and the root replacement adversarial sample, the affix tampering adversarial sample and the word order replacement adversarial sample are fused to generate an adversarial expansion sample.

[0011] The application also provides a Mongolian-based malicious prompt data set expansion system, comprising: An extraction module is configured to obtain a Mongolian basic malicious prompt corpus and a Mongolian general corpus, and extract a high-frequency root set and a high-frequency affix set from the Mongolian general corpus; An analysis module is configured to extract core malicious semantic features from the Mongolian basic malicious prompt corpus, and perform morphological analysis on the core malicious semantic features using a Mongolian word segmentation model to obtain a malicious root subset and a malicious affix subset; A comparison and screening module is configured to compare and screen the malicious root subset with the high-frequency root set to obtain a replaceable root library, and compare and screen the malicious affix subset with the high-frequency affix set to obtain a replaceable affix library; The screening module is configured to obtain a plurality of grammar compatibility coefficients according to the replaceable affix library and the replaceable root library, and to screen valid combination pairs from the replaceable affix library and the replaceable root library according to each of the grammar compatibility coefficients. The verification optimization module is configured to perform semantic consistency verification on each of the valid combination pairs, to extract candidate malicious prompt samples that pass the verification, and to perform iterative optimization on the candidate malicious prompt samples by using a genetic algorithm, so as to generate an initial expansion sample set. The filtering enhancement module is configured to perform multi-dimensional filtering on the initial expansion sample set to obtain a preliminary optimization data set, and to enhance the preliminary optimization data set by using an adversarial generation strategy, so as to generate adversarial expansion samples. The merging module is configured to merge the adversarial expansion samples and the preliminary optimization data set to obtain a final expansion data set.

[0012] Preferably, the filtering enhancement module comprises an acquisition unit configured to acquire syntax structure data of each sample in the initial expansion sample set, and to acquire a corresponding syntax integrity index according to the syntax structure data. The first screening unit is configured to screen samples with complete syntax structure from the initial expansion sample set according to the syntax integrity index, to obtain a syntax filtering subset, and to acquire semantic redundancy between samples according to semantic feature vectors of each sample in the syntax filtering subset. The removal unit is configured to remove redundant samples in the syntax filtering subset according to the semantic redundancy, to obtain a semantic deduplication subset, and to perform category balance verification according to malicious categories of each sample in the semantic deduplication subset. The second screening unit is configured to screen samples that pass the category balance verification from the semantic deduplication subset, to obtain the preliminary optimization data set, and to acquire a root sequence, an affix combination and a word order structure of each sample in the preliminary optimization data set. The replacement unit is configured to acquire a root replacement adversarial sample according to the root sequence, and to acquire an affix tampering adversarial sample according to the affix combination. The fusion unit is configured to acquire a word order permutation adversarial sample according to the word order structure, and to fuse the root replacement adversarial sample, the affix tampering adversarial sample and the word order permutation adversarial sample to generate the adversarial expansion samples.

[0013] The application further provides a computer device comprising a memory and a processor, wherein the memory stores a computer program, and the processor implements the steps of the Mongolian-based malicious prompt data set expansion method when executing the computer program.

[0014] The application further provides a computer readable storage medium, which stores a computer program, and the computer program is executed by a processor to realize the steps of the Mongolian-based malicious prompt data set expansion method.

[0015] The application has the advantages that: the application can construct targeted malicious prompt samples by extracting high-frequency roots and affixes in a Mongolian basic malicious prompt corpus and a general corpus and combining morphological analysis, enhance the diversity and authenticity of a Mongolian security evaluation data set, optimize candidate malicious prompt samples by using a genetic algorithm, make the expanded samples more consistent with the grammar and semantic rules of Mongolian, ensure the effectiveness of the attack samples in a Mongolian scenario, enhance the robustness and adversarialness of the data set by using an adversarial generation strategy to enhance the expanded data set, and simulate possible attack behaviors in a real scenario, thereby not only providing an effective sample generation tool for security evaluation in a Mongolian scenario and improving the attack resistance of a Mongolian model, but also providing a new idea and technical support for language-specific security data set expansion, which is helpful for promoting security research and technical application in the field of Mongolian. BRIEF DESCRIPTION OF DRAWINGS

[0016] Figure 1 A method flowchart of an embodiment of the application.

[0017] Figure 2 A system structure schematic diagram of an embodiment of the application.

[0018] Figure 3 A computer device internal structure schematic diagram of an embodiment of the application.

[0019] Figure 4 A Mongolian segmentation model structure schematic diagram of an embodiment of the application.

[0020] The implementation, functional features and advantages of the application will be further described with reference to the embodiments and the accompanying drawings. DETAILED DESCRIPTION

[0021] It should be understood that the specific embodiments described herein are merely intended to explain the application, and are not intended to limit the application.

[0022] As shown in Figure 1 The application provides a Mongolian-based malicious prompt data set expansion method, which comprises the following steps: S1, acquiring a Mongolian basic malicious prompt corpus and a Mongolian general corpus, and extracting a high-frequency root set and a high-frequency affix set of the Mongolian general corpus; S2, extract the core malicious semantic features of the Mongolian basic malicious prompt corpus, and perform morphological analysis on the core malicious semantic features using a Mongolian word segmentation model to obtain a malicious root subset and a malicious affix subset; S3, compare and screen the malicious root subset with a high-frequency root set to obtain a replaceable root library, and compare and screen the malicious affix subset with a high-frequency affix set to obtain a replaceable affix library; S4, obtain a plurality of grammar compatibility coefficients according to the replaceable affix library and the replaceable root library, and screen out effective combination pairs from the replaceable affix library and the replaceable root library according to each grammar compatibility coefficient; S5, perform semantic consistency verification on each of the effective combination pairs and extract candidate malicious prompt samples that pass the verification, and iteratively optimize the candidate malicious prompt samples through a genetic algorithm to generate an initial expanded sample set; S6, perform multi-dimensional filtering on the initial expanded sample set to obtain a preliminary optimized data set, and enhance the preliminary optimized data set using an adversarial generation strategy to generate an adversarial expanded sample; S7, combine the adversarial expanded sample with the preliminary optimized data set to obtain a final expanded data set.

[0023] As described in steps S1-S2 above, the malicious prompt corpus in the prior art is mostly from languages such as English and Chinese, and the uniqueness of Mongolian (such as rich suffixes and flexible word order) makes the malicious prompts in the existing corpus cannot be directly used. By constructing a special corpus for Mongolian, the adaptability and effectiveness of the trained model to the Mongolian environment can be ensured. High-frequency roots and affixes are basic constituent elements in Mongolian. Mastering these roots and affixes can help identify and generate malicious prompts. By extracting the high-frequency root and affix set from the general corpus, the computational complexity and irrelevant information can be effectively reduced, thereby improving the efficiency and accuracy of the system. The core semantic features of malicious prompts are often closely related to malicious intent and can reflect the intent and pattern of malicious attacks. By extracting these features from the Mongolian basic malicious prompt corpus, the core semantic features of malicious prompts can be effectively extracted, making the generated malicious samples more aggressive and stealthy, and better simulating real attack behavior. Using a Mongolian word segmentation model to perform morphological analysis on the core malicious semantic features can accurately extract malicious roots and malicious affixes, thereby accurately identifying transformed words in malicious prompts and effectively avoiding misidentification due to the complexity of the language. Unlike traditional malicious prompt recognition methods based on fixed vocabulary, the present application uses a morphological analysis model that can accurately process the special grammar structure of Mongolian. This enables the system to more accurately identify and construct malicious prompt samples in the Mongolian environment, enhancing the adaptability and accuracy of the model.

[0024] As described in steps S3-S4 above, the malicious prompt generation in the prior art often only relies on fixed malicious vocabulary and does not consider replaceability, while the present application can filter out irrelevant or infrequently used vocabulary by comparing malicious roots and high-frequency roots and malicious affixes and high-frequency affixes, ensuring that the generated malicious prompts are more representative and aggressive, and the screened replaceable root library and replaceable affix library provide more extensive replacement options for subsequent malicious prompt generation, and by constructing a replacement library of roots and affixes, diverse malicious prompts can be generated flexibly, not only increasing the concealment of the attack, but also effectively improving the diversity and robustness of the model; traditional malicious prompt generation methods often ignore grammar compatibility and semantic consistency, resulting in prompts that not only do not conform to language standards, but also may lose attack effectiveness, and the grammar compatibility coefficient is a quantitative indicator of the combinability of roots and affixes at the grammar rule level, which can help measure whether the combination of roots and affixes conforms to the grammar structure of Mongolian.

[0025] The step of generating the initial expanded sample set by iteratively optimizing the candidate malicious prompt samples through the genetic algorithm as described in step S5 includes obtaining the semantic feature vector, the syntactic structure tree, and the malicious intensity score of each sample in the candidate malicious prompt sample set, constructing an initial population fitness evaluation benchmark according to the semantic feature vector, calculating the initial fitness value of each sample according to the fitness evaluation benchmark, and selecting the parent sample set through roulette selection according to the initial fitness value, performing cross operation on the syntactic structure tree of the parent sample set to generate the child sample set, and performing mutation operation according to the malicious intensity score of the child sample set, constructing a new generation population according to the child sample set after mutation operation and the high fitness samples in the parent sample set, calculating the average fitness value of the new generation population in real time, judging whether the average fitness value reaches the preset convergence threshold, if so, stopping iteration, and taking the current population as the initial expanded sample set; if not, repeating the steps of screening, crossing, and mutating until the convergence condition is met; the genetic algorithm is an optimization method that can simulate natural selection and evolution, and is suitable for handling optimization problems with high complexity. In the optimization process of malicious prompt samples, iteratively optimizing through the genetic algorithm can explore multiple malicious prompt samples with high attackability in a short time, thereby expanding the sample set. Unlike traditional artificial generation or simple rule generation methods, the genetic algorithm can find the optimal combination of malicious prompt samples through adaptive evolution, making the generated samples more diverse and attackable, thereby enhancing the system's detection ability of malicious prompts. The semantic consistency check ensures that the generated malicious prompts are reasonable and attackable in semantics, and by screening the combination of grammar and semantics, more effective and meaningful malicious prompt samples can be generated, thereby ensuring that the generated malicious prompts meet the grammar requirements and have attackability, improving the effectiveness and reliability of the malicious prompts.

[0026] As described in steps S6-S7 above, the traditional malicious prompt data set usually lacks adversarial samples and cannot comprehensively evaluate the performance of the model in the face of real attacks, which may cause the model to fail to identify more complex adversarial attack samples. The present application can remove redundant and low-quality samples through multi-dimensional filtering, only retaining high-quality samples that meet the attack pattern under multiple indicators, thereby improving the quality of the training data set and enabling the model to focus more on samples with high attackability. Multi-dimensional filtering can effectively improve the quality of the data set and further optimize the malicious prompt samples, thereby improving the recognition and defense capabilities of the model. The adversarial generation strategy generates samples that can confuse the model by simulating the behavior of attackers. This strategy can effectively enhance the attackability of the generated samples, enabling the system to maintain strong defense capabilities in the face of complex adversarial attacks. By introducing the adversarial generation strategy, more covert and efficient attack samples can be generated, improving the system's attack resistance. By merging the adversarial expansion samples and the preliminary optimized data set, the generated data set can contain both real attack samples and optimized adversarial samples, providing more comprehensive and accurate training data and enabling the model to train more closely to real attack scenarios, thereby improving its effectiveness and robustness in practical applications.

[0027] In one embodiment, the step S2 of performing morphological analysis on the core malicious semantic features using a Mongolian word segmentation model to obtain a malicious root subset and a malicious affix subset comprises: S21, obtaining a plurality of Mongolian words according to the core malicious semantic features, and inputting each Mongolian word into a Mongolian segmentation model for morphological disassembly to obtain corresponding candidate roots and candidate affixes; S22, obtaining the root appearance probability of each candidate root and the semantic correlation degree between each candidate root and the core malicious semantic features, and calculating the effectiveness score of the corresponding candidate root by weighted summation according to each root appearance probability and semantic correlation degree; S23, determining whether the effectiveness score of each candidate root is greater than a first preset score threshold; If the effectiveness score is greater than the first preset score threshold, the candidate root is included in the initial malicious root set; S24, obtaining the semantic category of the core malicious semantic features, and performing semantic filtering and screening on the initial malicious root set according to the semantic category to obtain a malicious root subset; S25, obtaining the vowel attribute matching degree and the grammatical rule compliance degree of each candidate affix, and calculating the compatibility score of the corresponding candidate affix by weighted summation according to each vowel attribute matching degree and grammatical rule compliance degree; S26, determining whether the compatibility score of each candidate affix is greater than a second preset score threshold; If the compatibility score of the candidate affix is greater than a second preset score threshold, the candidate affix is included in the initial malicious affix set; S27, an affix category of the core malicious semantic feature is obtained, and the initial malicious affix set is functionally filtered according to the affix category, to obtain a malicious affix subset.

[0028] As described in steps S21-S22 above, as shown in Figure 4 As described in steps S21-S22 above, as shown in

[0029] The root appearance probability is the ratio of the number of occurrences of the root in the Mongolian general corpus to the total number of roots, the semantic correlation degree is the first cosine similarity of the root and the core malicious semantic feature, the first cosine similarity can be calculated through the pre-trained Mongolian word vector, and the vowel harmony degree is the matching degree of the vowel attributes of the affix and the root (1 point is matched for positive vowel, 1 point is matched for negative vowel, and 0 points are matched for no matching); Since Mongolian is a typical agglutinative language, its word form is complex, and the suffix changes a lot, direct lexical analysis will face great challenges, and the application can dynamically generate a Mongolian word set without relying on a fixed vocabulary, thereby better coping with the rich vocabulary and expression of Mongolian, and avoiding the loopholes caused by the fixed vocabulary or rules in the traditional method. The vocabulary of Mongolian is diverse, and the core malicious semantic feature can accurately describe the semantic level behind the vocabulary, so that the potential malicious behavior can be more effectively captured, each Mongolian word is input into the Mongolian segmentation model for morphological splitting, the root and the affix can be accurately extracted, the special Mongolian segmentation model ensures the accurate disassembly of the vocabulary at the morphological level, thereby providing higher accuracy and reliability for subsequent analysis; Simply relying on the frequency of the root or simple dictionary matching in the selection process of the malicious root may lead to a large number of irrelevant or misjudged results, the application obtains the root appearance probability of each candidate root, and calculates the semantic correlation degree in combination with the core malicious semantic feature, which can effectively improve the relevance of the candidate root, by comprehensively considering the frequency of the root and its relevance to the malicious semantic, irrelevant roots are filtered out, the misjudgment rate is effectively reduced, and the accuracy of the malicious behavior detection is improved. Compared with the common frequency-based or fixed rule-based method in the prior art, the innovation of this step lies in the comprehensive judgment combined with the semantic level, which can better adapt to the complexity and diversity of Mongolian, the appearance probability and the semantic correlation degree of the candidate root are weighted and summed, a more accurate effectiveness score can be obtained, the probability information of the root appearance and the relevance of the semantic level are fully utilized, so that the root with truly malicious nature can be more accurately screened out, thereby greatly improving the accuracy of the malicious root identification.

[0030] As described in steps S23-S25 above, the degree of compliance of the grammatical rule is the matching degree of the affix attachment position and the corresponding root part of speech, which is the core index for determining whether the candidate affix and the corresponding root are matched. Mongolian is a typical agglutinative language, and roots of different parts of speech need to be matched with functionally corresponding affixes. For example, nouns are matched with case affixes to show the grammatical role of the noun in the sentence, and verbs are matched with tense affixes to show the time state of the action. The core function of the case affix is to attach to a noun to clearly show the grammatical role of the noun in the sentence, and the case affix can only be attached to a noun. The core function of the tense affix is to attach to a verb to clearly show the time state of the action, and the tense affix can only be matched with a verb (or a verbalized root), not with a noun, an adjective, or other non-verb roots. Therefore, when a noun is followed by a case affix, the degree of compliance of the grammatical rule is 1 point, and when a verb is followed by a tense affix, the degree of compliance of the grammatical rule is 1 point. Conversely, if they do not match, they get 0 points. The compatibility score of the candidate affix is the compatibility between the candidate affix and the corresponding candidate root. The semantic category refers to the semantic classification or field to which the root belongs, which is a macroscopic classification of the semantics of the root. The semantic filtering of the malicious root subset includes calculating the average cosine similarity between the semantic vector of each root in the initial malicious root set and the semantic vector library constructed by the core malicious semantic features, and retaining the roots with an average cosine similarity greater than a predetermined similarity to obtain the malicious root subset. The function filtering of the malicious affix subset includes establishing a malicious intensifier affix dictionary containing affixes that can enhance negative, attack, insult, and other semantics, and calculating the functional similarity (i.e., the ratio of the number of affixes with the same grammatical function to the total number of functional affixes) between each affix in the initial malicious affix set and the affixes in the malicious intensifier affix dictionary. Retaining the affixes with a functional similarity greater than a predetermined functional similarity to obtain the malicious affix subset.

[0031] In the prior art, many methods only rely on surface features such as word frequency or vocabulary matching, lacking deep semantic consideration, and the present application can effectively filter out those roots with lower scores and weaker association with malicious semantics by setting a first preset score threshold. The semantic category of the core malicious semantic feature can help filter out roots unrelated to malicious behavior in the malicious root set. By matching the malicious root with the semantic category of the core malicious semantic feature, more accurate roots directly related to malicious behavior can be screened out, thereby effectively improving the robustness of the model, avoiding noise interference, and more in line with the diversity of malicious semantics in actual scenarios. By obtaining the vowel attribute matching degree and grammar rule compliance degree of the candidate affix, it can be accurately judged whether the affix conforms to the language characteristics of Mongolian, and further screened out affixes with malicious potential. By introducing the matching degree evaluation of vowel attributes and grammar rules, the rationality and legality of each affix can be ensured, thereby improving the recognition ability of malicious affixes. By comprehensively considering the vowel attribute matching degree and grammar rule compliance degree through weighted summation, a more accurate compatibility score can be obtained, thereby not only improving the accuracy of affix screening, but also ensuring that the complexity and grammar characteristics of Mongolian are fully considered.

[0032] As described in steps S26-S27 above, the affix category refers to the classification of affixes according to their function or grammatical role, reflecting the grammatical characteristics of Mongolian agglutinative language. By setting a second preset score threshold, the present application can effectively screen out affixes with higher compatibility scores and malicious potential. By introducing compatibility scores and threshold control, the screening of malicious affixes is more precise and in line with actual needs, ensuring the flexibility and precision of the system, thereby more effectively identifying malicious affixes and improving the protection capability of the entire malicious language model. Function filtering of affixes can further improve the model's ability to recognize malicious language. By combining the affix category of the core malicious semantic feature, the initial malicious affix set can be effectively filtered semantically, ensuring that only affixes related to malicious semantics are retained, thereby better adapting to the unique grammatical characteristics of Mongolian, and accurately improving the recognition ability of malicious affixes through function filtering, thereby enhancing the model's attack detection and protection capabilities.

[0033] In one embodiment, the step S3 of comparing the subset of malicious roots with the high-frequency root set to obtain a replaceable root library includes: S31, respectively acquiring the malicious semantic vector, malicious core syllable sequence and malicious part-of-speech label of each malicious root in the subset of malicious roots, and the high-frequency semantic vector and high-frequency part-of-speech label of each high-frequency root in the high-frequency root set; S32, filter out the high-frequency word root corresponding to the high-frequency word nature label consistent with the malicious word nature label from the plurality of high-frequency word nature labels as a same-word nature candidate root, and obtain a same-word nature semantic vector and a same-word nature core syllable sequence of each same-word nature candidate root; S33, obtain the edit distance of the corresponding same-word nature candidate root and the malicious word root according to each same-word nature core syllable sequence and the malicious core syllable sequence, and obtain the first morphological similarity according to each edit distance; S34, obtain the first cosine similarity according to each same-word nature semantic vector and the malicious semantic vector, and obtain the first comprehensive matching degree by weighted summation calculation according to each first cosine similarity and first morphological similarity; S35, judge whether each first comprehensive matching degree is greater than a first preset matching degree; If the first comprehensive matching degree is greater than the first preset matching degree, the same-word nature candidate root corresponding to the first comprehensive matching degree is included in the replaceable root library.

[0034] As described in steps S31-S32 above, wherein the core syllable sequence refers to the combination of syllables in the Mongolian root or affix that carries the core pronunciation and morphological features, is the basic phonetic unit that constitutes the vocabulary, the part-of-speech label refers to the classification label of the root or vocabulary according to the grammatical function, reflects the grammatical role of the vocabulary in the sentence, the malicious semantic vector, the malicious core syllable sequence and the malicious part-of-speech label of the malicious root can comprehensively capture the semantics, syllable structure and grammatical role of the malicious root, the malicious semantic vector of the malicious root can reflect its potential malicious nature, providing a basis for subsequent judgment of whether the root can generate an adversarial sample, the malicious core syllable sequence can help identify the pronunciation and form features of the root, and can enhance the language adaptability of the model, especially when facing complex language structures, obtaining the high-frequency semantic vector and high-frequency part-of-speech label of the high-frequency root set is through analyzing the usage frequency and grammatical role of high-frequency roots, capturing their commonality and grammatical rules in language, which provides a grammatical basis for subsequent screening of candidate roots with the same part-of-speech, ensuring that truly potential replacement roots are selected from the high-frequency root set; by selecting high-frequency roots corresponding to high-frequency part-of-speech labels consistent with the malicious part-of-speech label, ensuring that the candidate roots have the same grammatical role (such as noun, verb, etc.), thus ensuring that the generated adversarial sample is consistent with the malicious sample in grammatical structure, thus helping to control the grammatical consistency of the generated adversarial sample, preventing grammatical errors from causing unnatural samples, ensuring that the generated adversarial sample maintains maliciousness while not being invalidated due to grammatical mismatch, improving the model's adaptability to grammatical changes, especially for complex languages such as Mongolian. Through comprehensive semantic vector and syllable sequence analysis, not only the matching degree of the candidate root in the grammatical layer is ensured, but also its consistency in pronunciation and semantics is ensured, which makes the generation of adversarial samples not only reasonable in grammar, but also more threatening in semantics, making it more challenging for defense systems.

[0035] As described in steps S33-S35 above, the first cosine similarity is obtained by the ratio between the dot product of the malicious semantic vector and the homonymic semantic vector and the product of the modulus of the malicious semantic vector and the modulus of the homonymic semantic vector, the edit distance refers to the minimum number of editing operations (inserting, deleting, replacing characters) required to convert one character sequence into another character sequence, which is used to quantify the morphological difference between the two sequences, the edit distance is calculated by adding the number of inserted characters, the number of deleted characters and the number of replaced characters, the number of inserted characters refers to the number of characters required to be inserted to convert the malicious core syllable sequence into the homonymic core syllable sequence, the number of deleted characters refers to the number of characters required to be deleted, and the number of replaced characters refers to the number of characters required to be replaced, the morphological similarity refers to the similarity of the morphological structure (such as syllable sequence, character composition) of the root or affix in Mongolian, the first morphological similarity is calculated by subtracting the ratio of the edit distance and the length of the longest core syllable sequence from 1 after selecting the longest core syllable sequence from the malicious core syllable sequence and the homonymic core syllable sequence, after determining that the first comprehensive matching degree is greater than the first preset matching degree, the corresponding multiple homonymic candidate roots need to be included in the replaceable candidate root set first, and then the Mongolian grammar rule adaptability detection is performed on each homonymic candidate root in the replaceable candidate root set to determine whether it can form a grammatically correct combination word with a preset number of affixes in the malicious affix sub-set, if it can form a grammatically correct combination word with a preset number of affixes in the malicious affix sub-set, the root is retained in the replaceable candidate root set, otherwise it is excluded from the replaceable candidate root set, finally, the multiple homonymic candidate roots in the replaceable candidate root set are sorted in descending order according to the corresponding first comprehensive matching degree to obtain the replaceable root library.

[0036] The edit distance calculates the morphological difference between the same word candidate root and the malicious root, measures the spelling difference between the two, can help accurately evaluate the syllable similarity between the malicious root and the candidate root, thereby providing a quantitative index for subsequent morphological similarity calculation. The introduction of edit distance makes the calculation of morphological similarity more accurate. Edit distance provides a quantitative measurement method for the model, which can accurately analyze the morphological similarity between the roots, improve the quality and diversity of the generated adversarial samples. The cosine similarity calculates the semantic similarity between the same word candidate root and the malicious root, which can quantify the similarity between the two in the semantic space and reflect the closeness of the candidate root and the malicious root in meaning, providing a basis for determining whether the malicious root can successfully generate an adversarial sample. Cosine similarity can avoid errors caused by morphological changes in the root, making the semantic similarity calculation more accurate. Weighted summation combines the morphological similarity and semantic similarity information, which can comprehensively evaluate the overall matching degree of the candidate root and the malicious root, making the adversarial sample generation more robust. Through threshold judgment, only candidate roots that meet the conditions can enter the replacement library, thereby avoiding inappropriate roots interfering with the normal operation of the system, effectively controlling the quality of the replacement root library, and ensuring that the system only introduces candidate roots with high matching degree. By using comprehensive matching degree for screening, the candidate root is more suitable for the requirements of malicious sample generation, improving the accuracy of defense and the effectiveness of attack sample generation.

[0037] In one embodiment, the step S3 of screening the malicious affix subset from the high-frequency affix set to obtain a replaceable affix library comprises: S36, respectively acquiring the malicious function label and the malicious form feature of each malicious affix in the malicious affix subset, and the high-frequency function label and the high-frequency form feature of each high-frequency affix in the high-frequency affix set; S37, screening the high-frequency affix corresponding to the high-frequency function label consistent with the malicious function label from the plurality of high-frequency function labels as a same-function candidate affix; S38, analyzing the malicious use context of each malicious affix in the Mongolian basic malicious prompt corpus, and acquiring the corresponding malicious root part of speech type according to the malicious use context; S39, analyzing the same-function use context of each same-function candidate affix in the Mongolian general corpus, and acquiring the corresponding same-function root part of speech type according to the same-function use context; S310, acquiring the number of common collocation root part of speech types according to the plurality of malicious root part of speech types and same-function root part of speech types, and acquiring the number of all collocation root part of speech types of each malicious root part of speech type in the Mongolian basic malicious prompt corpus; S311, obtaining a part-of-speech coincidence degree according to a ratio of a number of the co-occurrence root morpheme part-of-speech type to a number of all root morpheme part-of-speech types; S312, respectively obtaining a malicious vowel harmony rule, a malicious syllable number, a malicious vowel attribute and a malicious consonant ending of each malicious affix, and a homonym vowel harmony rule, a homonym syllable number, a homonym vowel attribute and a homonym consonant ending of each homonym affix, and obtaining a syllable number difference rate according to a ratio of a difference between the malicious syllable number and the homonym syllable number to the malicious syllable number; S313, obtaining a vowel attribute matching degree according to the malicious vowel attribute and the homonym vowel attribute, and obtaining a consonant ending matching degree according to the malicious consonant ending and the homonym consonant ending; S314, obtaining a second morphological similarity degree according to a weighted sum of a difference between 1 minus the syllable number difference rate and the consonant ending matching degree and the vowel attribute matching degree; S315, obtaining a vowel harmony matching degree according to the malicious vowel harmony rule and the homonym vowel harmony rule, and obtaining a second comprehensive matching degree according to a weighted sum of the vowel harmony matching degree, the second morphological similarity degree and the part-of-speech coincidence degree; S316, judging whether each of the second comprehensive matching degrees is greater than a second preset matching degree; If the second comprehensive matching degree is greater than the second preset matching degree, the homonym affix corresponding to the second comprehensive matching degree is included in the replaceable affix library.

[0038] As described in the above steps S36-S39, the function label refers to a classification label of an affix according to a grammatical function, reflecting the role of the affix in lexical derivation or grammatical expression, the part-of-speech label refers to a classification label of a part-of-speech according to a grammatical function, reflecting the role of the part-of-speech in lexical derivation or grammatical expression, the high-frequency morphological feature refers to a morphological feature of a root or affix with a higher frequency of occurrence in a Mongolian general corpus, the malicious use context refers to a language environment such as a root type and a sentence structure in which a malicious affix is collocated in a Mongolian malicious prompt corpus, and the malicious vowel harmony rule refers to a vowel attribute matching rule followed by a malicious affix when combined with a root, which is one of the core morphological features of Mongolian agglutinative languages.

[0039] The prior art usually relies on single vocabulary matching or identification based on relatively simple text classification algorithms, which is difficult to handle the complex morphological changes and suffix structure in Mongolian, and the present application comprehensively identifies malicious function tags and morphological features, which helps to understand the multi-dimensional understanding of malicious affixes, improves the adaptability to complex scenarios, effectively improves the ability to capture the deep grammatical and semantic features of malicious affixes, and through the analysis of the function tags and morphological features of high-frequency affixes, common high-frequency affixes can be extracted from a large number of samples, by screening the affixes consistent with the function tags of malicious affixes from the high-frequency affixes, irrelevant or inefficient candidate affixes are avoided, by ensuring the consistency of the candidate affixes and the malicious function tags, the accuracy of the malicious affix replacement is improved, so as to more effectively resist attacks against specific functions, ensure that the replaced affix has the same attack effect, by analyzing the usage context of malicious affixes, their behavior patterns in actual language use can be deeply understood, and the context analysis of malicious affixes helps to capture their potential attack targets and usage rules, so as to accurately construct the corresponding malicious usage scenarios, by obtaining the part of speech type of the malicious root, the specific grammatical properties of the root can be determined, the grammatical and semantic consistency of the malicious affix replacement is improved, by adding context analysis to enhance the understanding of malicious usage, more accurate guidance can be provided for subsequent malicious affix replacement, by analyzing the usage context of the same function candidate affix, its usage in ordinary corpus can be identified, which not only helps to verify whether the candidate affix can normally adapt to the general usage of Mongolian, but also ensures that it has the same function as the malicious affix from the grammatical and semantic aspects.

[0040] If the malicious vowel attribute and the same-function vowel attribute are the same, the vowel attribute matching degree is 1, otherwise, the vowel attribute matching degree is 0; if the malicious consonant ending and the same-function consonant ending are the same, the consonant ending matching degree is 1; if the malicious consonant ending and the same-function consonant ending belong to the same pronunciation position, the consonant ending matching degree is 0.5; if the malicious consonant ending and the same-function consonant ending are all different, the consonant ending matching degree is 0. After judging that the second comprehensive matching degree is greater than the second preset matching degree, the corresponding multiple same-function candidate affixes are first included in the replaceable candidate affix set, and then the semantic influence degree of each same-part-of-speech candidate affix in the replaceable candidate affix set is tested. The test method is to generate a test vocabulary by combining the same-part-of-speech candidate affix with any root in the malicious root subset, to calculate the semantic deviation degree of the test vocabulary and the original malicious root combination vocabulary, and to judge whether the semantic deviation degree is greater than the preset deviation. If the semantic deviation degree is not greater than the preset deviation, the same-part-of-speech candidate affix is retained in the replaceable candidate affix set, otherwise, it is excluded from the replaceable candidate affix set. Finally, the same-part-of-speech candidate affixes in the replaceable candidate affix set are sorted in descending order of the second comprehensive matching degree to obtain the replaceable affix library.

[0041] The prior art generally ignores the phonological features of language, and direct replacement of affixes may cause unnatural pronunciation or be recognized by detection systems. The present application further strengthens the similarity of malicious affixes and same-function affixes in the grammatical structure by calculating the number of commonly combined root part-of-speech types and obtaining the part-of-speech coincidence degree, which helps to ensure the consistency of the replaced affix and the original malicious affix in the grammatical structure, thereby improving the effectiveness and linguistic rationality of the replaced malicious affix. By calculating the number of syllable difference rates, vowel attribute matching degrees, and consonant ending matching degrees, the similarity between two affixes in phonology can be quantified, thereby ensuring that the replaced affix not only matches in grammar but also does not deviate from the original attack sample in pronunciation, thereby ensuring its concealment and effectiveness. By calculating the second comprehensive matching degree through weighted summation, the syllable difference, vowel attribute, and consonant ending are considered comprehensively, further improving the overall matching degree of malicious affix replacement, and more accurately evaluating the adaptability between candidate affixes and malicious affixes, ensuring that the replaced affix meets the attack requirements and avoids being conspicuous in grammar or phonology. By judging whether the second comprehensive matching degree exceeds the preset matching degree, the best candidate affix is further selected as the final replaceable affix, thereby ensuring that only the most suitable replacement affix is retained, avoiding the interference of invalid affixes, and improving the attack effect and concealment of the entire attack sample.

[0042] In one embodiment, the step S4 of obtaining a plurality of grammar compatibility coefficients according to the replaceable affix library and the replaceable root library, and screening out valid combination pairs from the replaceable affix library and the replaceable root library according to each of the grammar compatibility coefficients comprises: S41, obtaining the affix morphological attribute and the affix grammar attribute of each same-function candidate affix in the replaceable affix library and the root morphological attribute and the root grammar attribute of each same-part-of-speech candidate root in the replaceable root library, and obtaining a vowel harmony matching value according to the ending vowel type of each of the affix morphological attributes and the initial vowel type of the root morphological attribute; S42, obtaining a consonant-vowel connection fitness according to the initial connecting vowel of each of the affix morphological attributes and the ending consonant type of the root morphological attribute, and obtaining a corresponding morphological compatibility score by weighted summation calculation according to each of the consonant-vowel connection fitness and the vowel harmony matching value; S43, obtaining a function correlation degree according to the affix function of each of the affix grammar attributes and the commonly used collocation affix type of the root grammar attribute, obtaining a part-of-speech matching degree according to the applicable part of speech range of each of the affix grammar attributes and the part of speech of the root grammar attribute, and obtaining a corresponding grammar fitness score by weighted summation calculation according to each of the part-of-speech matching degree and the function correlation degree; S44, obtaining a first common occurrence probability and a second common occurrence probability of each of the same-function candidate affix and the same-part-of-speech candidate root in the Mongolian basic malicious prompt corpus and the Mongolian general corpus respectively, and calculating a malicious scene fitness according to each of the first common occurrence probability and the second common occurrence probability, wherein the calculation formula is: E(SP) = [1 + G(TX1)] / [1 + G(TX2)] ; wherein E(SP) represents the malicious scene fitness, G(TX1) represents the first common occurrence probability, and G(TX2) represents the second common occurrence probability; S45, obtain semantic association strength according to semantic direction of each of the affix grammar attribute and semantic category of the root grammar attribute, and obtain corresponding semantic compatibility score by weighted summation calculation according to each of the semantic association strength and malicious scene adaptation degree; S46, obtain grammar compatibility coefficient of the same function candidate affix and the same part of speech candidate root by weighted summation calculation according to each of the semantic compatibility score, grammar adaptation degree score and morphological compatibility score, and determine whether each of the grammar compatibility coefficient is greater than a preset threshold coefficient; If the grammar compatibility coefficient is greater than the preset threshold coefficient, it is determined that the same function candidate affix and the same part of speech candidate root corresponding to the grammar compatibility coefficient are an effective combination pair.

[0043] As described in steps S41-S42, wherein the vowel harmony matching value is determined by judging whether the ending vowel type of the affix morphological attribute and the initial vowel type of the root morphological attribute conform to the Mongolian vowel harmony rule, if both are positive vowels or both are negative vowels, the vowel harmony matching value is 1, if one is neutral vowel and the other is positive / negative vowel, the vowel harmony matching value is 0.5, otherwise, it is 0; the vowel-consonant connection adaptation degree is determined by judging whether the ending consonant type of the root morphological attribute and the initial connecting vowel of the affix morphological attribute have regular connecting phenomenon (follow the general pronunciation rule without special morphological change, without changing the basic form of the consonant or vowel), if yes, the adaptation degree is 1, if there is special connecting change (the form of the consonant is changed), the adaptation degree is 0.8, otherwise, it is 0.3; the vowel harmony matching value is a quantitative index for measuring whether the initial vowel type of the replaceable root and the ending vowel type of the replaceable affix conform to the vowel harmony rule in Mongolian, the vowel-consonant connection adaptation degree is an index describing the adaptation degree between the ending consonant type of the replaceable root and the initial connecting vowel of the replaceable affix in pronunciation and connecting rules, and the morphological compatibility score is an evaluation value of the replaceable root and the affix in morphological (pronunciation, spelling connection) compatibility by comprehensively considering the vowel harmony matching value and the vowel-consonant connection adaptation degree.

[0044] The application can fine match the compatibility of affixes and roots by obtaining the morphological attributes and syntactic attributes of each candidate affix and root in the replaceable affix library and root library, and through in-depth analysis of the morphological attributes of affixes and roots, ensure the coordination in morphology, Mongolian is an agglutinative language, with complex suffix changes and flexible word order, through detailed analysis of morphological attributes, it is helpful to capture and adapt these unique characteristics, thereby improving the language adaptability of the model, the combination rules of vowels and consonants in Mongolian are unique, the vowel harmony and consonant connection adaptation degree calculation is adopted, which can accurately simulate this language phenomenon, and then improve the morphological compatibility of affixes and roots, the existing technology usually ignores the phoneme matching problem in language, and the application effectively fills this gap, which is helpful to improve the accuracy of the model in the Mongolian language scene, the connection adaptation degree of vowels and consonants considers the phonological rules of language, so that the model can better understand and generate word combinations that conform to the characteristics of Mongolian, thereby improving the recognition and processing ability of the system to malicious input, the weighted scoring method can evaluate the actual adaptation of each candidate combination according to the morphological adaptation degree, so as to more accurately judge whether an effective word structure can be generated, through comprehensive evaluation of multiple phonological attributes, it can better adapt to the language characteristics of Mongolian, thereby improving the compatibility of the system in complex language scenarios, through morphological compatibility scoring, it is helpful to improve the anti-attack ability of the system when facing language interference, for example, it provides a strong judgment mechanism for non-standard combination of affixes or roots, reduces the possibility of model attack.

[0045] As described in the above steps S43-S46, wherein the first co-occurrence probability refers to the probability that a certain group of candidate affixes of the same function and candidate roots of the same part-of-speech co-occur in the Mongolian basic malicious prompt corpus, the second co-occurrence probability refers to the probability that a certain group of candidate affixes of the same function and candidate roots of the same part-of-speech co-occur in the Mongolian general corpus, the part-of-speech matching degree is determined by the applicable part-of-speech range of the affix grammatical attribute and the root grammatical attribute to determine whether the candidate affix of the same function can be collocated with the candidate root of the same part-of-speech, if it is a complete match, the part-of-speech matching value is 1, if it is a partial match, the part-of-speech matching value is 0.6, otherwise it is 0; the function correlation degree is calculated by the ratio of the co-occurrence frequency of the candidate root of the same part-of-speech with the same function affix in the Mongolian general corpus to the total occurrence frequency of the candidate root of the same part-of-speech in the Mongolian general corpus; the semantic association strength is obtained by the Mongolian semantic association dictionary, if the affix semantic direction is completely consistent with the root semantic category, the semantic association strength is 1, if it is partially associated, the semantic association strength is 0.5, otherwise it is 0; the function correlation degree is an index that measures the close degree of association between the commonly used collocation affix type of the replaceable root and the function of the replaceable affix, the part-of-speech matching degree is an index that measures the matching degree between the applicable part-of-speech range of the replaceable affix and the part-of-speech of the replaceable root, the grammatical adaptability score is an evaluation value of the compatibility of the replaceable root and the affix in the grammatical rules (part-of-speech collocation, function adaptation) by comprehensively considering the part-of-speech matching degree and the function correlation degree, the malicious scene adaptation degree is a bias index that measures the co-occurrence of the replaceable root and the affix in the malicious prompt corpus relative to the co-occurrence in the general corpus, the semantic association strength is an index that measures the degree of association between the semantic category of the replaceable root and the semantic direction of the replaceable affix based on the Mongolian semantic association dictionary, and the semantic compatibility score is an evaluation value of the compatibility of the replaceable root and the affix in the semantic level (semantic matching, scene adaptation) by comprehensively considering the semantic association strength and the malicious scene adaptation degree.

[0046] The prior art is generally based on a corpus of English or other high-resource languages, and it is difficult to effectively adapt to the unique challenges of Mongolian, and the prior art generally ignores the fine matching of functional association, but the present application can better simulate the grammatical structure in the language by explicitly considering the matching degree between the function and the part of speech of affixes and roots, especially in complex languages such as Mongolian, by introducing the functional association degree and the part of speech matching degree, the flexibility of Mongolian in grammar can be effectively dealt with, and the applicability of the system in dynamic scenarios is improved, and the weighted calculation of the functional association degree and the part of speech matching degree can simplify the matching process of complex grammar, so that the model can efficiently process different types of word combinations, especially in potential attacks to provide more efficient protection; The present application can more effectively detect security threats in a specific language environment by specifically constructing a malicious corpus of Mongolian, and by introducing the malicious corpus of Mongolian for adaptation degree calculation, more targeted data support can be provided for attack detection, thereby improving the malicious detection capability of the system in the Mongolian environment, and making up for the language limitations when evaluating security based on high-resource language models, providing an effective solution for attack evaluation of low-resource languages such as Mongolian; Unlike traditional methods that rely solely on grammar rules, the present application takes into account the semantic level of vocabulary, so that the model not only evaluates grammatically, but also can adapt in depth at the semantic level, by comprehensively considering semantic association and malicious scenario adaptation degree, the recognition ability of the system to semantic misdirection and semantic deviation in malicious attacks can be effectively improved, and the protection capability of the system is enhanced, the semantic compatibility score helps the system better understand the semantic relationship between affixes and roots, and enhances the recognition and processing capability of the model for potential malicious attacks, especially in complex Mongolian language environment, by comprehensively considering multiple score dimensions, the compatibility of affixes and roots can be evaluated from multiple angles, avoiding the misjudgment problem caused by single-dimensional evaluation, so that those combinations that truly conform to the grammar, morphology and semantic rules in the Mongolian environment can be effectively screened out, thereby improving the processing accuracy of the model, and by comprehensively evaluating the grammatical compatibility coefficient, the effectiveness of affixes and roots can be better judged to ensure that the generated word combination cannot be exploited by malicious attackers, and the security of the system is improved.

[0047] In one embodiment, the step S5 of performing semantic consistency verification on each of the valid combination pairs and extracting candidate malicious prompt samples that pass the verification, comprises: S51, according to the Mongolian word formation rule, the same function candidate affix and the same part of speech candidate root in each of the valid combination pairs are spliced to generate a combination word, and the morphological change feature of each combination word is obtained, and according to each of the morphological change features and the Mongolian semantic mapping rule, the corresponding initial semantic vector is obtained. S52, obtain the original malicious prompt sample, and obtain the benchmark semantic vector and the extended benchmark semantic vector of the malicious root word in the corresponding original malicious prompt sample according to the same word nature candidate root word in each of the valid combinations; S53, obtain the corresponding second cosine similarity according to each of the benchmark semantic vectors and the initial semantic vector, and determine whether each of the second cosine similarities is greater than the first semantic threshold; If the second cosine similarity is greater than the first semantic threshold, the combined vocabulary corresponding to the second cosine similarity is included in the primary candidate vocabulary set; S54, obtain the context association feature of each combined vocabulary in the primary candidate vocabulary set, and obtain the extended semantic vector of the corresponding combined vocabulary according to each of the context association features; S55, obtain the corresponding third cosine similarity according to each of the extended semantic vectors and the extended benchmark semantic vector, and determine whether each of the third cosine similarities is greater than the second semantic threshold; If the third cosine similarity is greater than the second semantic threshold, the combined vocabulary corresponding to the third cosine similarity is included in the secondary candidate vocabulary set; S56, replace the corresponding root word and affix in the original malicious prompt sample with the combined vocabulary in the secondary candidate vocabulary set to obtain the corresponding initial malicious prompt sample, and obtain the syntactic structure tree of each initial malicious prompt sample; S57, obtain the corresponding syntactic consistency score and malicious probability value according to each of the syntactic structure trees, and obtain the corresponding comprehensive semantic consistency score according to each of the syntactic consistency score and the malicious probability value; S58, determine whether each of the comprehensive semantic consistency scores is greater than the preset score threshold; If the comprehensive semantic consistency score is greater than the preset score threshold, the initial malicious prompt sample corresponding to the comprehensive semantic consistency score is marked as a candidate malicious prompt sample that passes the test.

[0048] As described in steps S51-S53, wherein the Mongolian word formation rule is a grammatical specification of the combination of roots and affixes in Mongolian to form words, including the connection order of affixes, vowel harmony rules, consonant change rules, etc., to ensure that the word formed after the concatenation of roots and affixes meets the morphological requirements of Mongolian, the combined word is formed by checking the vowel properties of the same word class candidate root and the vowel properties of the same function candidate affix, and judging whether they can be matched according to the vowel harmony rule, if they can be matched, then the same function candidate affix is connected to the same word class candidate root according to the Mongolian affix connection order rule to form a combined word; the Mongolian semantic mapping rule refers to the corresponding relationship criterion between the morphological features and the semantics in Mongolian, which is used to infer the semantics expressed by the word according to the morphological structure of the word, this rule covers the association between different affixes and semantic changes, the semantic shift rule after the combination of roots and affixes, etc., the initial semantic vector is mapped from the morphological change characteristics to the corresponding semantic characteristics by the Mongolian semantic mapping rule, and the initial semantic vector of the combined word is generated based on the semantic characteristics obtained by mapping through the pre-trained Mongolian word vector model (such as fastText model, setting the word vector dimension to 100, the minimum word frequency to 5, the window size to 3, and the training iteration number to 50).

[0049] The present application can generate combined words that meet the grammatical features of Mongolian by concatenating candidate affixes of the same function with candidate roots of the same word class, can fully utilize the characteristics of the agglutinative language of Mongolian, can ensure that the generated words have rationality and diversity in morphology, and thus can better adapt to the Mongolian environment, can ensure that the semantic representation of the words is more in line with the semantic system of Mongolian by obtaining the initial semantic vector according to the morphological change characteristics of each combined word and the Mongolian semantic mapping rule, can provide more accurate reference for subsequent similarity calculation by extracting the benchmark semantic vector of the malicious root and the extended benchmark semantic vector from the original malicious prompt sample, can effectively filter out candidate words with similar semantics to the malicious root by calculating the cosine similarity between the benchmark semantic vector and the initial semantic vector and setting a semantic threshold for screening, so as to reduce the interference of noise words and improve the quality of the primary candidate word set, thereby providing a more targeted word set for subsequent steps, and by obtaining the context association features of each candidate word and generating an extended semantic vector accordingly, the semantic changes of the word in actual use can be better captured, thereby the semantic differences of the word in different contexts can be more accurately reflected, the polysemy of the word can be better understood, and the detection accuracy of the malicious prompt sample can be improved.

[0050] As described in steps S51-S56, the application can further refine the quality of the candidate words by calculating the cosine similarity between the extended semantic vector and the extended reference semantic vector, and screening the secondary candidate word set by the semantic threshold. It can ensure that the finally selected words are highly consistent with the semantic features of the malicious sample, reduce the false positives and false negatives, and compared with the traditional method of not performing multi-level similarity screening in the prior art, this hierarchical screening method can more carefully grasp the semantic matching degree, improve the overall detection effect, by replacing the secondary candidate words into the original malicious prompt sample, and obtaining the syntactic structure tree, it can ensure that the replaced sample still maintains consistency at the syntactic level, so as to ensure the rationality of the syntactic structure while ensuring the semantic consistency, thereby improving the credibility and effectiveness of the detection result. Compared with the simple word replacement in the prior art, this method takes into account the syntactic structure, which can more comprehensively verify the changes of the malicious sample and improve the comprehensiveness and accuracy of the detection.

[0051] As described in steps S57-S58, the malicious probability value is obtained by converting the candidate malicious prompt sample into an input format recognizable by the model through preprocessing, inputting the preprocessed sample into a Mongolian malicious semantic recognition model (such as a pre-training model based on BERT-base-mongolian, the input of which is the token sequence of the sample), and the model outputs a value in the interval [0, 1] by extracting and analyzing the malicious features in the sample, which is the malicious probability value of the sample, where 1 represents high maliciousness and 0 represents no maliciousness; the syntactic consistency score is obtained by analyzing the grammatical relationship of the core components (subject, predicate, object) in the syntactic structure tree to determine whether the combination of word replacement causes the core grammatical relationship to change, if not, the syntactic consistency score is 1, if partially changed but does not affect the semantic expression, it is 0.6, otherwise it is 0, the malicious probability value is obtained by inputting the candidate malicious prompt sample into the Mongolian malicious semantic recognition model; the calculation method of the second cosine similarity and the third cosine similarity is the same as the calculation formula of the first cosine similarity, which is the ratio between the corresponding vector dot product and the corresponding vector modulus product.

[0052] The application can more comprehensively evaluate the malicious nature and semantic consistency of the candidate sample by comprehensively considering the syntactic consistency score and malicious probability value. This multi-dimensional evaluation method can avoid the deviation caused by a single indicator, ensure that the final detection result is more accurate and reliable, and better balance the semantic and syntactic factors to improve the overall detection effect compared with the traditional method relying on a single indicator. By judging whether the comprehensive semantic consistency score is greater than the preset threshold, only samples that meet high standards in terms of semantics and syntax can be marked as qualified malicious prompt samples, thereby greatly improving the accuracy and reliability of the detection and reducing false positives and false negatives. Compared with the single threshold judgment method in the traditional method, this multi-level and comprehensive judgment method can more comprehensively reflect the true characteristics of the sample and improve the overall detection capability.

[0053] In one embodiment, the step S6 of generating adversarial augmented samples by performing multi-dimensional filtering on the initial augmented sample set to obtain a preliminary optimized data set and using an adversarial generation strategy to enhance the preliminary optimized data set comprises: S61, obtaining the syntactic structure data of each sample in the initial augmented sample set, and obtaining the corresponding syntactic integrity index according to the syntactic structure data; S62, filtering out samples with complete syntactic structure from the initial augmented sample set according to the syntactic integrity index to obtain a syntactic filtering subset, and obtaining the semantic redundancy between samples according to the semantic feature vectors of each sample in the syntactic filtering subset; S63, removing duplicate samples in the syntactic filtering subset according to the semantic redundancy to obtain a semantic deduplication subset, and performing category balance verification according to the malicious categories of each sample in the semantic deduplication subset; S64, filtering out samples that pass the category balance verification from the semantic deduplication subset to obtain a preliminary optimized data set, and obtaining the root sequence, affix combination and word order structure of each sample in the preliminary optimized data set; S65, obtaining root replacement adversarial samples according to the root sequence, and obtaining affix tampering adversarial samples according to the affix combination; S66, obtaining word order replacement adversarial samples according to the word order structure, and fusing the root replacement adversarial samples, affix tampering adversarial samples and word order replacement adversarial samples to generate adversarial augmented samples.

[0054] As described in steps S61-S62, wherein the syntax integrity index is calculated by extracting the presence rate of subject-predicate-object core components, the completeness of dependency relationship chain, and the correctness rate of empty word collocation from the syntax structure data, and performing weighted summation calculation, the presence rate of core components is recorded as 1 when subject-predicate-object are all present, 0.6 when one is missing, and 0 when two or more are missing, the completeness of dependency relationship chain is recorded as 1 when all nodes in the syntax tree have clear dependency relationship, and is proportionally deducted when there are isolated nodes, the correctness rate of empty word collocation is the proportion of empty word and real word collocation that conforms to the grammar rules, and the semantic redundancy is obtained by extracting the semantic feature vector of each sample using a Mongolian pre-training sentence vector model (such as UlaanBERT) and calculating the cosine similarity of any two sample vectors; in most existing data set construction, syntax structure is usually not fully considered, especially in non-high resource languages, the accuracy and richness of syntax analysis is low, and the present application can deeply understand the grammar rules of the sample by obtaining the syntax structure data of each sample, providing more targeted basis for subsequent optimization and deduplication, the syntax structure data can help accurately capture the regularity and irregularity of language, especially for highly cohesive languages such as Mongolian, by analyzing its unique grammar structure, more detailed data support can be provided for subsequent optimization, effectively avoiding language bias, and the syntax integrity index is used to screen samples with complete syntax structure, in order to ensure that the samples in the data set have high-quality representation in grammar, and the syntax integrity directly affects the training effect of the language model, by defining the syntax integrity index, samples that conform to the language rules can be accurately screened, avoiding training interference caused by syntax errors, thereby ensuring the quality of the training set, by filtering incomplete syntax samples, the noise in the data set can be reduced, and the model's learning ability for grammar integrity and accuracy can be enhanced, by strictly screening the syntax integrity, the model can focus on the correct language structure, thereby improving its performance and stability in actual application, especially in Mongolian, which has high flexibility, by calculating the semantic redundancy, samples with high similarity can be effectively identified and removed, ensuring the diversity of the data set in semantics, removing semantic duplicate samples when constructing the data set can avoid model overfitting, and enhance its adaptability to different language variants and expression methods, which is particularly important in diversified Mongolian expressions.

[0055] As described in steps S63-S66 above, the category balance check is obtained by the ratio of the number of malicious category samples to the total number of samples, and the ratio between the maximum category proportion and the minimum category proportion is selected as the sample that passes the category balance check if it is less than the preset threshold; the root replacement adversarial sample is obtained by replacing the root of the target sample in the preliminary optimization dataset with a replacement root that is similar in semantic meaning but has subtle differences; the affix tampering adversarial sample is obtained by tampering with the functional affix in the target sample; and the syntax permutation adversarial sample is obtained by permuting the subject and object in the target sample and adjusting the adverbial position (the sample only retains a reasonable and smooth syntax). Removing duplicate samples in the syntactic filter subset through semantic redundancy can not only improve the diversity of the dataset, but also optimize the training efficiency. Through semantic deduplication, each sample can have unique semantic features, so that the model can be exposed to more diverse semantic information during training, improving its ability to respond to different contexts. Especially in the context of complex languages such as Mongolian, the balance check of malicious categories can avoid the bias of categories in the training set, thereby improving the comprehensiveness and accuracy of the model. The balance check of malicious samples can enable the model to have more balanced detection capabilities when facing different types of attacks, ensuring its robustness in actual attack scenarios. In particular, the design of specific attack samples for Mongolian can better adapt to its language characteristics. Through category balance screening, a more balanced and diverse data foundation can be provided for subsequent adversarial sample generation. A balanced dataset can prevent the model from being biased towards certain categories, making it more resistant to interference in actual applications. By constructing a category-balanced dataset, the model will have better generalization capabilities and be able to adapt to more diverse languages and attack patterns. By analyzing the root sequence, affix combination, and syntax structure in depth, subtle changes in language can be revealed, especially in complex languages such as Mongolian. This provides a solid foundation for subsequent adversarial sample generation, enabling the model to remain robust under adversarial attacks. Through the meticulous design of adversarial sample generation methods, customized attacks can be made for different language characteristics, breaking through the limitations of existing attack methods. By generating adversarial samples from different angles, the model's ability to resist attacks can be fully tested, especially in languages with specific grammar structures such as Mongolian, which can more effectively detect the model's weaknesses when facing changes in language characteristics. By integrating different types of adversarial samples, the diversity of samples can be increased, and the model's response capabilities can be improved. By integrating multiple adversarial samples, the model's performance in the face of different attack methods can be fully evaluated, ensuring its adaptability and resistance to interference in actual applications, especially in the context of languages with unique grammar characteristics such as Mongolian.

[0056] As Figure 2As shown, the application also provides a Mongolian-based malicious prompt dataset expansion system, comprising: An extraction module is configured to obtain a Mongolian basic malicious prompt corpus and a Mongolian general corpus, and extract a high-frequency root set and a high-frequency affix set of the Mongolian general corpus; An analysis module is configured to extract core malicious semantic features of the Mongolian basic malicious prompt corpus, and perform morphological analysis on the core malicious semantic features by using a Mongolian word segmentation model to obtain a malicious root subset and a malicious affix subset; A comparison and screening module is configured to compare and screen the malicious root subset with the high-frequency root set to obtain a replaceable root library, and compare and screen the malicious affix subset with the high-frequency affix set to obtain a replaceable affix library; A screening module is configured to obtain a plurality of grammar compatibility coefficients according to the replaceable affix library and the replaceable root library, and screen out valid combination pairs from the replaceable affix library and the replaceable root library according to each of the grammar compatibility coefficients; An inspection and optimization module is configured to perform semantic consistency verification on each of the valid combination pairs and extract candidate malicious prompt samples that pass the verification, and perform iterative optimization on the candidate malicious prompt samples by using a genetic algorithm to generate an initial expansion sample set; A filtering and enhancement module is configured to perform multi-dimensional filtering on the initial expansion sample set to obtain a preliminary optimization dataset, and enhance the preliminary optimization dataset by using an adversarial generation strategy to generate adversarial expansion samples; A merging module is configured to merge the adversarial expansion samples and the preliminary optimization dataset to obtain a final expansion dataset.

[0057] In one embodiment, the filtering and enhancement module comprises: An acquisition unit is configured to acquire syntactic structure data of each sample in the initial expansion sample set, and acquire a corresponding syntactic integrity index according to the syntactic structure data; A first screening unit is configured to screen out samples with complete syntactic structure from the initial expansion sample set according to the syntactic integrity index to obtain a syntactic filtering subset, and acquire semantic redundancy between samples according to semantic feature vectors of each sample in the syntactic filtering subset; A removal unit is configured to remove duplicate samples in the syntactic filtering subset according to the semantic redundancy to obtain a semantic deduplication subset, and perform category balance verification according to malicious categories of each sample in the semantic deduplication subset; A second screening unit is configured to screen out samples that pass the category balance verification from the semantic deduplication subset to obtain the preliminary optimization dataset, and acquire a root sequence, an affix combination, and a word order structure of each sample in the preliminary optimization dataset; The replacement unit is configured to obtain a root replacement adversarial sample according to the root sequence and obtain a suffix tampering adversarial sample according to the suffix combination; The fusion unit is configured to obtain a syntax replacement adversarial sample according to the syntax structure, and fuse the root replacement adversarial sample, the suffix tampering adversarial sample and the syntax replacement adversarial sample to generate an adversarial expansion sample.

[0058] It should be noted that each module and unit in the Mongolian-based malicious prompt dataset expansion system corresponds to one step in the Mongolian-based malicious prompt dataset expansion method.

[0059] As shown in Figure 3 The computer device can be a server, and the internal structure thereof can be as shown in Figure 3 The computer device includes a processor, a memory, a network interface and a database connected through a system bus. The processor of the computer device is configured to provide computing and control capabilities. The memory of the computer device includes a non-volatile storage medium and an internal memory. The non-volatile storage medium stores an operating system, a computer program and a database. The internal memory provides an environment for the operating system and the computer program in the non-volatile storage medium. The database of the computer device is configured to store all data required by the process of the Mongolian-based malicious prompt dataset expansion method. The network interface of the computer device is configured to communicate with an external terminal through a network connection. The computer program is executed by the processor to implement the Mongolian-based malicious prompt dataset expansion method.

[0060] Those skilled in the art can understand that Figure 3 The structure shown in

[0061] An embodiment of the present application also provides a computer readable storage medium having a computer program stored thereon, and the computer program is executed by the processor to implement any one of the above Mongolian-based malicious prompt dataset expansion methods.

[0062] Those skilled in the art can understand that all or part of the processes in the above-mentioned embodiment methods can be completed by instructing the relevant hardware through a computer program. The computer program can be stored in a non-volatile computer readable storage medium, and when the computer program is executed, the processes of the above-mentioned embodiment methods can be included. Any reference to memory, storage, database, or other medium provided by the present application and used in the embodiments can include non-volatile and / or volatile memory. Non-volatile memory can include read-only memory (ROM), programmable ROM (PROM), electrically programmable ROM (EPROM), electrically erasable programmable ROM (EEPROM), or flash memory. Volatile memory can include random access memory (RAM) or external cache memory. As an illustration but not limitation, RAM is available in various forms, such as static RAM (SRAM), dynamic RAM (DRAM), synchronous DRAM (SDRAM), double data rate SDRAM (SSRSDRAM), enhanced SDRAM (ESDRAM), synchronous link (Synchlink) DRAM (SLDRAM), memory bus (Rambus) direct RAM (RDRAM), direct memory bus dynamic RAM (DRDRAM), and memory bus dynamic RAM (RDRAM), etc.

[0063] The above only describes the preferred embodiments of the present application, and does not limit the patent scope of the present application. Any equivalent structure or equivalent process transformation using the content of the present application specification and drawings, or direct or indirect application in other related technical fields, is also included in the patent protection scope of the present application.

Claims

1. A Mongolian-based malicious prompt data set expansion method, characterized in that, The method comprises the following steps: acquire a basic malicious prompt corpus of Mongolian and a general corpus of Mongolian, and extract a high-frequency root set and a high-frequency affix set of the general corpus of Mongolian; extract core malicious semantic features of the basic malicious prompt corpus of Mongolian, and perform morphological analysis on the core malicious semantic features by using a Mongolian word segmentation model to obtain a malicious root subset and a malicious affix subset; compare and screen the malicious root subset with the high-frequency root set to obtain a replaceable root library, and compare and screen the malicious affix subset with the high-frequency affix set to obtain a replaceable affix library; acquire a plurality of grammar compatibility coefficients according to the replaceable root library and the replaceable affix library, and screen out effective combination pairs from the replaceable root library and the replaceable affix library according to each grammar compatibility coefficient; perform semantic consistency verification on each effective combination pair, extract a candidate malicious prompt sample that passes the verification, and iteratively optimize the candidate malicious prompt sample by using a genetic algorithm to generate an initial expanded sample set; perform multi-dimensional filtering on the initial expanded sample set to obtain a preliminary optimized data set, and enhance the preliminary optimized data set by using an adversarial generation strategy to generate an adversarial expanded sample; combine the adversarial expanded sample with the preliminary optimized data set to obtain a final expanded data set. 2.The Mongolian-based malicious prompt dataset expansion method according to claim 1, characterized in that, The step of performing morphological analysis on the core malicious semantic features by using a Mongolian word segmentation model to obtain a malicious root subset and a malicious affix subset comprises the following steps: acquire a plurality of Mongolian words according to the core malicious semantic features, and input each Mongolian word into a Mongolian segmentation model for morphological splitting to obtain corresponding candidate roots and candidate affixes; acquire a root appearance probability of each candidate root and a semantic correlation degree between each candidate root and the core malicious semantic features, and acquire an effectiveness score of the corresponding candidate root according to each root appearance probability and semantic correlation degree; determine whether the effectiveness score of each candidate root is greater than a first preset score threshold; if the effectiveness score is greater than the first preset score threshold, the candidate root is included in an initial malicious root set; acquire a semantic category of the core malicious semantic features, and perform semantic filtering and screening on the initial malicious root set according to the semantic category to obtain a malicious root subset; acquire an attribute matching degree of each candidate affix and a grammar rule compliance degree, and acquire a compatibility score of the corresponding candidate affix according to each attribute matching degree and grammar rule compliance degree; determine whether the compatibility score of each candidate affix is greater than a second preset score threshold; if the compatibility score of the candidate affix is greater than the second preset score threshold, the candidate affix is included in an initial malicious affix set; acquire an affix category of the core malicious semantic features, and perform functional filtering and screening on the initial malicious affix set according to the affix category to obtain a malicious affix subset. 3.The Mongolian-based malicious hint dataset augmentation method of claim 1, wherein, The step of comparing and screening the malicious root subset with the high-frequency root set to obtain a replaceable root library comprises the following steps: obtaining a malicious semantic vector, a malicious core syllable sequence and a malicious part-of-speech label of each malicious root in the malicious root subset and a high-frequency semantic vector and a high-frequency part-of-speech label of each high-frequency root in the high-frequency root set, respectively; selecting a high-frequency root corresponding to a high-frequency part-of-speech label consistent with the malicious part-of-speech label from the plurality of high-frequency part-of-speech labels as a same-part-of-speech candidate root, and obtaining a same-part-of-speech semantic vector and a same-part-of-speech core syllable sequence of each same-part-of-speech candidate root; obtaining an edit distance of a corresponding same-part-of-speech candidate root and a malicious root according to each same-part-of-speech core syllable sequence and the malicious core syllable sequence, and obtaining a first morphological similarity according to each edit distance; obtaining a first cosine similarity according to each same-part-of-speech semantic vector and the malicious semantic vector, and obtaining a first comprehensive matching degree according to each first cosine similarity and the first morphological similarity; determining whether each first comprehensive matching degree is greater than a first preset matching degree; if the first comprehensive matching degree is greater than the first preset matching degree, the same-part-of-speech candidate root corresponding to the first comprehensive matching degree is included in the replaceable root library. 4.The Mongolian-based malicious hint dataset expansion method according to claim 1, characterized in that, The step of obtaining a plurality of grammatical compatibility coefficients from the replaceable affix library and the replaceable root library according to the replaceable affix library and the replaceable root library, and selecting an effective combination pair from the replaceable affix library and the replaceable root library according to each grammatical compatibility coefficient, comprises: obtaining an affix morphological attribute and an affix grammatical attribute of each same-function candidate affix in the replaceable affix library and a root morphological attribute and a root grammatical attribute of each same-part-of-speech candidate root in the replaceable root library, and obtaining a vowel harmony matching value according to a final vowel type of each affix morphological attribute and an initial vowel type of the root morphological attribute; obtaining a consonant-vowel connection fitness according to an initial connecting vowel of each affix morphological attribute and a final consonant type of the root morphological attribute, and obtaining a corresponding morphological compatibility score according to each consonant-vowel connection fitness and the vowel harmony matching value; obtaining a function correlation degree according to an affix function of each affix grammatical attribute and a commonly used collocation affix type of the root grammatical attribute, obtaining a part-of-speech matching degree according to an applicable part-of-speech range of the affix grammatical attribute and a part-of-speech of the root grammatical attribute, and obtaining a corresponding grammatical fitness score according to each part-of-speech matching degree and the function correlation degree; obtaining a first common occurrence probability and a second common occurrence probability of each same-function candidate affix and same-part-of-speech candidate root in the Mongolian basic malicious prompt corpus and the Mongolian general corpus, respectively, and obtaining a malicious scene fitness according to each first common occurrence probability and second common occurrence probability; obtaining a semantic correlation strength according to a semantic direction of each affix grammatical attribute and a semantic category of the root grammatical attribute, and obtaining a corresponding semantic compatibility score according to each semantic correlation strength and the malicious scene fitness; obtaining a grammatical compatibility coefficient of each same-function candidate affix and same-part-of-speech candidate root according to each semantic compatibility score, grammatical fitness score and morphological compatibility score, and determining whether each grammatical compatibility coefficient is greater than a preset threshold coefficient. If the syntax compatibility coefficient is greater than a preset threshold coefficient, it is determined that the same function candidate affix and the same part of speech candidate root corresponding to the syntax compatibility coefficient are an effective combination pair. 5.The Mongolian-based malicious hint dataset expansion method according to claim 1, characterized in that, The step of performing semantic consistency verification on each of the effective combination pairs and extracting a candidate malicious prompt sample that passes the verification includes: Splicing the same function candidate affix and the same part of speech candidate root in each of the effective combination pairs to generate a combined vocabulary and obtaining morphological variation features of each combined vocabulary, and obtaining a corresponding initial semantic vector according to each of the morphological variation features; Obtaining an original malicious prompt sample, and obtaining a reference semantic vector and an extended reference semantic vector of a malicious root in the corresponding original malicious prompt sample according to the same part of speech candidate root in each of the effective combination pairs; Obtaining a corresponding second cosine similarity according to each of the reference semantic vectors and the initial semantic vector, and determining whether each of the second cosine similarities is greater than a first semantic threshold; If the second cosine similarity is greater than the first semantic threshold, the combined vocabulary corresponding to the second cosine similarity is included in a primary candidate vocabulary set; Obtaining context association features of each combined vocabulary in the primary candidate vocabulary set, and obtaining an extended semantic vector of the corresponding combined vocabulary according to each of the context association features; Obtaining a corresponding third cosine similarity according to each of the extended semantic vectors and the extended reference semantic vector, and determining whether each of the third cosine similarities is greater than a second semantic threshold; If the third cosine similarity is greater than the second semantic threshold, the combined vocabulary corresponding to the third cosine similarity is included in a secondary candidate vocabulary set; Replacing the corresponding root and affix in the original malicious prompt sample with the combined vocabulary in the secondary candidate vocabulary set to obtain a corresponding initial malicious prompt sample, and obtaining a syntactic structure tree of each initial malicious prompt sample; Obtaining a corresponding syntactic consistency score and a malicious probability value according to each of the syntactic structure trees, and obtaining a corresponding comprehensive semantic consistency score according to each of the syntactic consistency scores and the malicious probability values; Determining whether each of the comprehensive semantic consistency scores is greater than a preset score threshold; If the comprehensive semantic consistency score is greater than the preset score threshold, the initial malicious prompt sample corresponding to the comprehensive semantic consistency score is marked as a candidate malicious prompt sample that passes the verification. 6.The Mongolian-based malicious hint dataset expansion method according to claim 1, characterized in that, The step of obtaining a preliminary optimization dataset by filtering the initial expansion sample set in multiple dimensions, and enhancing the preliminary optimization dataset by using an adversarial generation strategy to generate an adversarial expansion sample includes: Obtaining syntactic structure data of each sample in the initial expansion sample set, and obtaining a corresponding syntactic integrity index according to the syntactic structure data; Filtering out samples with complete syntactic structures from the initial expansion sample set according to the syntactic integrity index to obtain a syntactic filtering subset, and obtaining semantic redundancy between samples according to semantic feature vectors of each sample in the syntactic filtering subset; Removing duplicate samples in the syntactic filtering subset according to the semantic redundancy to obtain a semantic deduplication subset, and performing category balance verification according to the malicious categories of each sample in the semantic deduplication subset; Filtering and enhancing module is used for filtering the initial expansion sample set to obtain a preliminary optimization data set, and enhancing the preliminary optimization data set by using an adversarial generation strategy to generate an adversarial expansion sample. According to the word root sequence, a word root replacement adversarial sample is obtained, and according to the affix combination, an affix tampering adversarial sample is obtained. According to the word order structure, a word order replacement adversarial sample is obtained, and the word root replacement adversarial sample, the affix tampering adversarial sample and the word order replacement adversarial sample are fused to generate an adversarial expansion sample.

7. A Mongolian-based malicious prompt data set expansion system, characterized in that, Comprise: The extraction module is used for obtaining a Mongolian basic malicious prompt corpus and a Mongolian general corpus, and extracting a high-frequency word root set and a high-frequency affix set of the Mongolian general corpus; The analysis module is used for extracting core malicious semantic features of the Mongolian basic malicious prompt corpus, and performing morphological analysis on the core malicious semantic features by using a Mongolian word segmentation model to obtain a malicious word root subset and a malicious affix subset; The comparison and screening module is used for comparing and screening the malicious word root subset with the high-frequency word root set to obtain a replaceable word root library, and comparing and screening the malicious affix subset with the high-frequency affix set to obtain a replaceable affix library; The screening module is used for obtaining a plurality of grammar compatibility coefficients according to the replaceable affix library and the replaceable word root library, and screening an effective combination pair from the replaceable affix library and the replaceable word root library according to each grammar compatibility coefficient; The test optimization module is used for performing semantic consistency verification on each effective combination pair and extracting a candidate malicious prompt sample that passes the test, and iteratively optimizing the candidate malicious prompt sample by using a genetic algorithm to generate an initial expansion sample set; The filtering and enhancing module is used for filtering the initial expansion sample set to obtain a preliminary optimization data set, and enhancing the preliminary optimization data set by using an adversarial generation strategy to generate an adversarial expansion sample; The merging module is used for merging the adversarial expansion sample and the preliminary optimization data set to obtain a final expansion data set.

8. The Mongolian-based malicious hint dataset augmentation system of claim 7, wherein, The filtering and enhancing module comprises: The acquisition unit is used for acquiring sentence structure data of each sample in the initial expansion sample set, and acquiring a corresponding sentence integrity index according to the sentence structure data; The first screening unit is used for screening samples with complete sentence structure from the initial expansion sample set according to the sentence integrity index to obtain a sentence filtering subset, and acquiring a semantic redundancy between samples according to a semantic feature vector of each sample in the sentence filtering subset; The removal unit is used for removing repeated samples in the sentence filtering subset according to the semantic redundancy to obtain a semantic de-duplication subset, and performing category balance verification on each sample in the semantic de-duplication subset according to a malicious category; The second screening unit is used for screening samples that pass the category balance verification from the semantic de-duplication subset to obtain a preliminary optimization data set, and acquiring a word root sequence, an affix combination and a word order structure of each sample in the preliminary optimization data set; The replacement unit is used for acquiring a word root replacement adversarial sample according to the word root sequence, and acquiring an affix tampering adversarial sample according to the affix combination; A fusion unit is configured to obtain a word order permutation adversarial sample according to the word order structure, and fuse the root replacement adversarial sample, the affix tampering adversarial sample and the word order permutation adversarial sample to generate an adversarial augmented sample. 9.A computer device, comprising a memory and a processor, wherein the memory stores a computer program, and the computer device is configured to perform the method according to any one of claims 1-8 when the computer program is executed by the processor. The computer program, when executed by the processor, implements the steps of the method of any one of claims 1 to 6.

10. A computer-readable storage medium having stored thereon a computer program, characterized in that, The computer program, when executed by the processor, implements the steps of the method of any one of claims 1 to 6.

Images