Causal security layer calibration driven defense method for large model security target range

Abstract

This invention discloses a causal security layer calibration-driven defense method for large-scale model security testbeds. First, a security layer localization algorithm is executed on the domain-fine-tuned model to identify a set of discontinuous layers that make key causal contributions to security decisions in a data-driven manner. Then, a bimodal gating-policy subdivision algorithm is used to subdivide the security layer into a gating layer responsible for triggering rejection and a policy layer responsible for compliance expression. During the calibration fine-tuning stage, only the parameters of the subdivided gating and policy layers are updated specifically, and a joint loss function including gating and policy regularization terms is introduced to constrain the model's rejection boundary and response granularity under both security-specific and general data modes. This invention, through a technical path of "precise localization first, then structural subdivision, and finally targeted calibration," significantly improves robustness against prompt injection attacks while ensuring availability for benign professional requests at the boundary.

Description

Technical Field

[0001] This invention relates to the field of big data modeling technology, and in particular to a causal security layer calibration-driven defense method for large model security test ranges. Background Technology

[0002] In the realm of general-purpose large-scale models, mainstream systems typically achieve safety alignment through supervised fine-tuning (SFT), human feedback-based reinforcement learning (RLHF), or their variants. This enables the model to tend to refuse responses or output safe alternative suggestions and compliance guidance when faced with illegal, dangerous, or high-risk requests. Essentially, this type of mechanism shapes a stable refusal pattern and compliant expression style at the output distribution level. Combined with policy templates and instruction-level constraints in system prompts, it maintains a consistent safety stance across multiple rounds of dialogue, thus forming the fundamental safety boundary of a productized large-scale model.

[0003] To address the more adversarial threat of prompt injection, existing solutions typically employ multiple layers of defense on both the inference and service sides. One approach focuses on input-side detection and filtering: using keywords, regular expressions, template libraries, and semantic classifiers to identify patterns such as typical jailbreak commands, role-playing inducements, and ignoring system commands, intercepting, demoting, or rewriting them upon detection. Another approach emphasizes system prompt hardening and context isolation, clearly distinguishing between system / developer / user content, adding a "data only, commands must not be executed" label to external text (web pages, files, search results, tool returns), and employing minimal context exposure, tool whitelists, and hierarchical permissions to reduce the impact of injected commands on tool calls and sensitive information. Additionally, there are output-side review and rewriting solutions, which involve secondary security checks and sensitive detail detection on generated results, truncating or rewriting them into secure alternative answers or triggering rejection when necessary, and implementing audit logs and policy iteration mechanisms. Overall, these methods are engineering-practical and reduce the probability of jailbreaking through the input-context-output link governance. However, their protective effect often depends on rule coverage and classifier generalization. They still need continuous maintenance and updates for narrative disguise, semantic rewriting and multi-round gradual inducement.

[0004] Another approach closely related to this field during the training and fine-tuning phases is the so-called "Safety Layer" approach. Related research indicates that within a large model, there may exist several layers or segments (i.e., safety layers) that are more critical for safety discrimination and rejection decisions. The proposed approach is to freeze the parameters of these safety layers during subsequent domain-specific fine-tuning, thereby preventing the fine-tuning process from overriding or diluting the original safety alignment capabilities, achieving the goal of "maintaining the rejection boundary as much as possible while continuing to train the model's capabilities." The advantages of this approach are its simplicity and compatibility with conventional fine-tuning processes, making it particularly suitable for scenarios requiring continued training on different domain data while retaining existing safety strategies. However, it also introduces an important practical problem: the division of safety layers depends on identifying the location of safety mechanisms within the model. In engineering, the freezing range is often determined empirically or heuristically, and there may be differences in transferability and stability under different model architectures, alignment targets, and training stages.

[0005] In summary, existing technologies complement each other across three levels: alignment mechanisms, inference-side protection, and security maintenance during training. General alignment provides basic rejection and compliant expression; inference-side protection counters the immediate risks posed by prompt injection through link governance; and training-side solutions such as Safety Layer attempt to prevent security policies from being overridden through continuous fine-tuning. These methods collectively constitute the main technical framework for current prompt injection and jailbreak risk management.

[0006] Existing methods related to the "safety layer" typically employ the approach of "freezing the security layer during the domain fine-tuning phase and training only the non-safety layer (or realigning it using alternative outputs)." While this may be effective in general dialogue scenarios, when applied to large-scale models in the cybersecurity domain, it amplifies the side effect of "over-rejection." Cybersecurity issues naturally involve high-risk vocabulary and highly operational expressions. Even when users are conducting compliance verification, vulnerability reproduction, or educational demonstrations, their questions often contain terms and tones like "payload-like descriptions" and "bypass / exploit / reproduce." If the security layer is frozen, the model's original conservative rejection boundaries will be preserved, making it easier to trigger rejection when faced with vaguely defined but compliant requests. Ultimately, this results in "the model being less effective in the security domain," impacting its usability for target range teaching, analysis assistance, and engineering implementation.

[0007] Secondly, relying solely on "irrelevant / alternative answers" to cover high-risk inputs may superficially reduce non-compliant outputs, but it can easily introduce damage on the task side: when a large number of samples are trained to provide "irrelevant answers" or uniform template-style alternative responses, the model may also exhibit output drift in scenarios such as explaining compliant penetration testing procedures, analyzing vulnerability mechanisms, and log forensics. Specifically, this manifests as unstable professional style, decreased granularity of answers, and even misleading security analysis questions that require rigorous reasoning into general security education or empty compliance reminders, thereby affecting task performance and style consistency.

[0008] Furthermore, many existing alignment strategies are more sensitive to "explicit malicious requests" and keyword triggers, but lack systematic robust training against injection links using prompts such as "narrative spoofing, role-playing, gradual inducement, and authorization statements." Attackers often do not request complete details all at once, but rather gradually approach sensitive boundaries by extracting information step by step, rewriting context, and packaging it under a guise of compliance. The cybersecurity vertical itself has the ambiguity of "problems that resemble attacks but may be compliant in purpose," making models lacking injection-specific training more susceptible to being induced to deviate from security policies during multi-turn dialogues, resulting in policy bypass or boundary collapse.

[0009] Furthermore, the "safety layer" approach implicitly assumes a crucial underlying mechanism: that "security capabilities" are viewed as modules that can be located within a continuous layer interval, and that boundaries are frozen or fine-tuned accordingly. However, this assumption of "security layer continuity" has not been rigorously proven in theory. On the one hand, security behaviors in deep networks are often the result of cross-layer and cross-module collaborative emergence, and security-related representations may be discretely distributed or highly entangled with task representations. On the other hand, under different architectures, different training stages, and different alignment goals, the layer positions of security representations may drift or exhibit discontinuous clustering. In other words, without verifiable support, directly relying on the assumption of "continuous security layers" for freezing / separation carries the risk of structural instability: either freezing layers that do not truly carry security judgments, resulting in limited protection benefits; or mistakenly freezing knowledge layers strongly related to cybersecurity reasoning, leading to a decrease in capabilities and an increase in refusal to respond.

[0010] In summary, the existing technology has three progressively specific technical problems:

[0011] (1) Precisely locate the problem: How to accurately identify, in a repeatable and quantifiable way, the neurons or layer sets (i.e., "security layers") that have key causal contributions to security decisions (especially refusal to answer) within the large-scale model of cybersecurity vertical domain, so as to provide a reliable basis for subsequent targeted intervention.

[0012] (2) Controllable calibration problem: Based on accurate positioning, how to design a targeted training or calibration mechanism that can mainly adjust the strategies (such as decision boundaries and risk thresholds) in the identified "security layer" while minimizing disturbance to the "capability layer" in the model that is responsible for cybersecurity expertise and task reasoning.

[0013] (3) The problem of balancing effects: Through the above precise positioning and controllable calibration, an ideal fine-tuning defense effect is finally achieved: the model can simultaneously improve its robustness against malicious attacks such as scene forgery and multi-round inducement (more difficult to bypass), and significantly reduce the false rejection rate of benign and legitimate professional requests at the boundary (more usable), thereby achieving a better balance between security and usability. Summary of the Invention

[0014] This invention aims to address the core contradiction in existing technologies: after fine-tuning a large-scale cybersecurity model in a cybersecurity vertical domain, how to effectively prevent the degradation of security alignment capabilities while maintaining its professional task capabilities and output style, and avoid excessive rejection of legitimate boundary requests. Therefore, it proposes a causal security layer calibration-driven defense method for large-scale model security testbeds. This method establishes a controllable mechanism between cybersecurity vertical domain fine-tuning and alignment maintenance. Through more precise security layer positioning and targeted calibration, the model significantly improves its robustness against attacks such as scenario forgery, role-playing, and multi-round progressive inducement, while maintaining its benign security task capabilities and professional output style. Simultaneously, it suppresses excessive rejection of benign boundary issues, thereby achieving a defense effect of "more difficult to bypass and more usable" for fine-tuning large-scale cybersecurity models in the testbed.

[0015] To achieve the above objectives, the present invention provides the following technical solution:

[0016] A causal security layer calibration-driven defense method for large-scale model security ranges includes the following steps:

[0017] S1. Obtain a base language model with basic secure alignment capabilities;

[0018] S2. Use a benign cybersecurity dataset to fine-tune the domain capabilities of the base model to obtain a vertical domain model;

[0019] S3. Perform a security layer localization algorithm on the vertical domain model to determine the set of discontinuous layers S in the model that have key causal contributions to security decisions, and define them as security layers.

[0020] S4. Perform a bimodal gating-policy subdivision algorithm on the security layer set S to subdivide it into a mutually exclusive gating layer set G and a policy layer set P. The gating layer set G is mainly responsible for triggering the rejection or restriction track, and the policy layer set P is mainly responsible for controlling the policy, compliant expression and granularity of the answer.

[0021] S5. Based on the segmentation results, freeze the parameters of the non-safe layer in subsequent training. Only for gating layer parameters and strategy layer parameters Update;

[0022] S6. Construct a robust calibration training set containing camouflaged malicious samples and boundary benign samples, and attach pattern labels to the samples to distinguish between security vertical patterns and general patterns.

[0023] S7. The model is calibrated and fine-tuned using the robust calibration training set. The loss function of the calibration and fine-tuning includes at least a supervised loss term, a gating regularization term, a policy regularization term, and a capability anchoring term, and the optimization process only updates the model with the robust calibration training set. and ;

[0024] S8. Deploy the final defense model obtained through calibration and fine-tuning.

[0025] Furthermore, the security layer location algorithm includes:

[0026] Construct a set of sample pairs that are semantically similar but have different security attributes;

[0027] Define a rejection propensity scoring function based on the probability of the output token set. ;

[0028] For each candidate layer l of the model, the causal patching method is used to calculate the change in its causal contribution to the refusal tendency score after intervening with malicious samples. ;

[0029] Calculate the penalty for the side effects of the intervention on the set of benign samples at the boundary;

[0030] Based on the net contribution statistics of all sample pairs, the Top-K layers with the largest contributions are selected as the set of security layers S.

[0031] Furthermore, the refusal-to-answer propensity scoring function Defined as:

[0032]

[0033] in, This represents the initial set of tokens that triggers a rejection or limited response. This represents the initial set of tokens that trigger a normal response. It represents the probability that the model outputs token v given input x.

[0034] Furthermore, the bimodal gating-policy subdivision algorithm includes:

[0035] Define the gated scoring function and strategy scoring function The policy scoring function is used to measure the tendency of the model output to favor executable details or safe alternative paths;

[0036] Data distribution in the security vertical domain and general data distribution For each layer l in the security layer set S, calculate its causal contribution to the gating score and policy score.

[0037] Based on the performance of the causal contribution in the two distributions, the bimodal difference index Ω_l of the layer is calculated, which is used to characterize the switching strength of the layer in the security roles inside and outside the domain.

[0038] Based on the preset contribution threshold, contribution ratio, and the bimodal difference index The security layer set S is automatically assigned to either the gating layer set G or the policy layer set P.

[0039] Furthermore, the strategy scoring function Defined as:

[0040]

[0041] in, This represents the initial set of tokens that can be easily guided to executable details. The set of starting tokens that represents a compliant alternative path for defense, detection, auditing, or remediation.

[0042] Furthermore, in step S5, the gating layer parameters are... and strategy layer parameters Employing differentiated update strategies, including: and Set different learning rates, or apply them in stages. and We will focus on optimizing key areas.

[0043] Furthermore, the loss function in step S7 is specifically as follows:

[0044]

[0045] in, To monitor cross-entropy loss, L_pol is a gated regularization term based on gated scoring, and L_pol is a policy regularization term based on policy scoring. To anchor the distillation loss to the teacher's capabilities using a vertical domain model, , , These are the weighting coefficients for each loss term.

[0046] Furthermore, the gated regularization term for:

[0047]

[0048] in, To disguise a malicious sample set, For the boundary benign sample set, and For the threshold of refusal to answer and > , These are the weighting coefficients.

[0049] In a second aspect, the present invention provides an electronic device including a memory and a processor, the memory storing a computer program, the processor executing the computer program to implement the steps of the method according to any one of claims 1 to 8.

[0050] Thirdly, the present invention provides a computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, implements the steps of the method according to any one of claims 1 to 8.

[0051] Compared with the prior art, the beneficial effects of the present invention are as follows:

[0052] This invention proposes a causal security layer calibration-driven defense method for large-scale model security testbeds. First, a security layer localization algorithm is executed on the domain-fine-tuned model to identify a set of discontinuous layers that make key causal contributions to security decisions in a data-driven manner. Then, a bimodal gating-policy subdivision algorithm is used to subdivide the security layer into a gating layer responsible for triggering rejection and a policy layer responsible for compliance expression. During the calibration fine-tuning phase, only the parameters of the subdivided gating and policy layers are updated specifically, and a joint loss function including gating and policy regularization terms is introduced to constrain the model's rejection boundary and response granularity under both security-specific and general data modes. This invention employs a technical approach of "precise positioning, structural subdivision, and targeted calibration." By freezing the non-security layer (knowledge layer) in reverse while maintaining stable cybersecurity capabilities, and simultaneously calibrating and strengthening the security layer boundaries, the model significantly improves its robustness against cue injection attacks such as narrative masquerading, role-playing, and gradual inducement, without compromising core knowledge capabilities such as vulnerability mechanism analysis, attack and defense process explanation, and log analysis. It also minimizes excessive rejection of benign boundary issues, ultimately achieving a security alignment effect in target range scenarios that is "more difficult to bypass, easier to use, and more like an expert." This effectively resolves the contradiction between security capability degradation and excessive rejection after fine-tuning of large-scale cybersecurity models, significantly improving robustness against cue injection attacks while ensuring the availability of benign professional requests at the boundaries. Attached Figure Description

[0053] To more clearly illustrate the technical solutions in the embodiments of this application or the prior art, the drawings used in the embodiments will be briefly introduced below. Obviously, the drawings described below are only some embodiments recorded in this invention. For those skilled in the art, other drawings can be obtained based on these drawings.

[0054] Figure 1 The flowcharts for the three core algorithms of the causal security layer calibration-driven defense method for large-scale model security ranges provided in this embodiment of the invention are as follows.

[0055] Figure 2 This demonstrates the differences in results between the method provided in this embodiment and other methods.

[0056] Figure 3 The method provided in this embodiment of the invention improves the defense success rate against various prompt word injection attack methods. Detailed Implementation

[0057] To better understand this technical solution, the method of the present invention will be described in detail below with reference to the accompanying drawings.

[0058] The proposed defense method for causal security layer calibration driven by this invention for large-scale model security ranges includes three core algorithms: the first is the overall algorithm (Inverse-Freezing Calibration), the second is the security layer localization algorithm (Top-K causal localization + discrete security layer set determination), and the third is the security layer decoupling partitioning algorithm. Figure 1 The flowcharts of the three core algorithms of this invention are shown. For ease of description, the base model is referred to as a... Autoregressive language model of a Transformer block , its first Layer in position The hidden state is The output layer provides the logits of the next token. , and by Obtain the probability distribution .

[0059] 1. Overall Algorithm (Inverse-Freezing Calibration)

[0060] First, a model with vertical domain capabilities is obtained from benign cybersecurity data. Then, the internal security mechanisms of the model are structurally modified using a "first locate, then subdivide, then calibrate" approach: not only locating the discrete security layer set. Furthermore, Subdivided into "gating layer" "and strategy layer" This allows the large-scale security model to present different security layer modes when facing security-specific requests and general requests—maintaining usability and professionalism for security-specific compliance tasks (domestic tolerance), and maintaining robustness and conservatism for transgressions in general contexts (external tightening). For ease of description, let the base model be defined as containing... Autoregressive language model of a Transformer block , No. Layer in position The hidden state is The output terminal is for the last position Generate logits , and by get The core idea is to "partition the model parameters according to their functions." The overall algorithm divides the parameter set into three parts by layer:

[0061]

[0062] in Corresponding to the non-security layer / knowledge layer (K-Layers). The corresponding gating layer (G-Layers, used to determine whether to enter the rejection / limited response track). The corresponding strategy layer (P-Layers, used to determine the compliance strategy and granular control of the output after entry) is divided into three parts. This "three-part" structure allows the conflict between "security-availability-professionalism" to be distributed across different parameter subspaces: knowledge and capabilities are kept as fixed as possible, gating boundaries can be refined, and strategy expression can be shaped, thus avoiding the one-sided imbalance of "over-rejection due to freezing the security layer" or "irrelevant answers due to alternative responses" from a mechanism perspective.

[0063] Step S1: Obtain a base model with basic alignment capabilities. .

[0064] Step S2, using a benign cybersecurity dataset By fine-tuning the capabilities within the domain, a vertical domain model is obtained. The goal of this stage is to enable the model to acquire stable cybersecurity knowledge capabilities, output style, and toolchain semantic understanding, rather than pursuing extreme robustness to prompt word injection at this point.

[0065] Step S3, for Execute the security layer localization algorithm (Top-K causal localization + discrete security layer set determination) to obtain the discrete security layer set. With knowledge layer set Thus, a primary division is obtained. , A security layer is a set of layers that may be discontinuous, rather than a fixed, continuous interval of layers as in traditional methods.

[0066] Step S4, execute the "Security Layer Gating-Policy Subdivision Algorithm (DGPSD)" while maintaining Without changing the original set, we can further subdivide it into mutually exclusive sets. , And thus obtain , The DGPSD subdivision is based not only on the causal contribution of each layer to "response triggering," but also on the causal contribution of each layer to "response strategy and suppression of executable details," and is distributed across security vertical domains. With general distribution The above statistics, when analyzed separately, give the gating layer a natural "dual-modal gating pattern": in The text further distinguishes between "compliance and security tasks vs. deceptive and malicious inducements" in a more refined way. The system maintains a more stable and conservative rejection threshold, thereby reflecting the special characteristics of the security layer in the large security vertical model.

[0067] To explicitly decouple "gating" and "policy" at the loss function level, two types of scores are defined. These scores do not require the model to "actually generate a large chunk of text" before making a judgment; instead, they only consider whether "the next token is more like a rejection start or a continuation of the response / more like details or a safe alternative." Therefore, this approach is fast, differentiable, and facilitates causal localization and training constraints. Of these two types of scores, the gating score (rejection tendency) is...

[0068]

[0069] in To enable the token cluster for rejecting / limiting responses, The token cluster is activated to allow / continue answering. The policy score (executable detail bias) is...

[0070]

[0071] in For easy-to-guide startup token clusters that can be executed in detail, A cluster of startup tokens serving as an alternative path for defense / detection / auditing / remediation and compliance. (Through...) and Top By comparing the hierarchical causal contributions, DGPSD assigns "whether to enter the rejection track" (gating) and "the response is usable but not abused" (policy) to different subsets of parameters, thereby providing greater controllability for subsequent lightweight calibration that only updates a small number of layers.

[0072] Step S5, perform reverse freeze: during training... Apply hard freeze (no gradient update) or extremely low learning rate constraints, allowing only... (and optional lightweight adapter) Update. Introduce a gated policy differential update mechanism: a learning rate-based approach can be used. Alternatively, phased calibration can be used (e.g., first refining the gating boundary with a larger weight, then reshaping the policy output with a larger weight) to ensure that the robustness of the rejection threshold and the availability / granularity of safe alternative responses converge in different subspaces, avoiding a single objective from pushing all security layers into the same overly conservative mode. This step still maintains the overall idea of ​​"keeping knowledge capabilities as stable as possible and calibrating strategic capabilities centrally," but further structurally breaks down strategic capabilities into two controllable channels: gating and policy.

[0073] Step S6: Construct a robust calibration training set It not only contains a collection of disguised malicious sets With boundary benign set Furthermore, a "pattern label" was attached to each sample to form a bimodal control: a safety vertical pattern. (Include (etc.) and general patterns (Includes general benign anchoring and common context comparison samples). For each input... Given the target output :exist superior, For a "security equivalent response" (rejecting executable details but providing defensive / detection / compliance alternatives); in superior, Provide a "compliant and usable response" (offer actionable defense and audit recommendations, but explicit controls do not fall into the details of executable attacks).

[0074] This contrastive structure of "same theme, different security attributes" provides the necessary sample geometry for fine-grained boundary learning of the gating layer, while providing direct supervision signals for the "usable but secure" output form of the policy layer.

[0075] In step S7, robust calibration fine-tuning is performed. The loss function is upgraded from the original "supervision objective + robustness constraint + capability anchoring" to a joint objective of "gating term + policy term + bimodal mode regularization + capability anchoring", and only the following are updated: The supervision term remains the standard cross-entropy:

[0076]

[0077] The standard supervised fine-tuning objective is "to let the model learn according to the labeled answers," and the newly added objective is... This is simply to make the safety boundaries and output granularity more stable and less prone to accidental damage.

[0078] Furthermore, a bimodal gating regularization is introduced to characterize the specificities of the vertical security layer: in The upper layer encourages the gating layer to learn "boundary discrimination rather than a one-size-fits-all rejection", in The upper layer encourages the gating layer to maintain a "stable and conservative threshold." One directly expressible form is a distribution constraint on the gating scores:

[0079]

[0080] This formula is equivalent to "attack samples are more likely to trigger a rejection (put)" (pushing it above the threshold), while ensuring that benign boundary samples are not pushed to reject answers (putting...) "Keep it below a lower threshold" to reduce "overly simplistic rejections". It reflects a controllable interval that "attack samples should be more inclined to refuse to answer, and benign boundary samples should not be pushed towards refusal to answer"; and allows for exist Go higher, at The approach relies more on control samples than simply raising the threshold, thus creating different gating patterns within and outside the domain. The corresponding policy term directly suppresses executable detail bias.

[0081]

[0082] The purpose is to "direct responses to secure alternative paths such as defense / auditing / remediation, even if responses are allowed," and to use thresholds. The model is constrained to shift towards "executable attack details". Control the degree to which the strategy is biased towards safe alternatives rather than executable details. Finally, retain capability anchoring (distillation / KL constraints) to avoid destroying the original capabilities and output style during the calibration phase: This is the safety rope to "keep the new model from going astray in general capabilities / style" - use the old model (pre-calibration model 𝜃(1)) as the teacher to constrain the output distribution of the new model on the anchored data to not drift too much:

[0083]

[0084] The overall objective is written as

[0085]

[0086] Freeze during optimization Update only After completing step S7, the final defense model is obtained. In step S8, it is deployed to the range system / teaching platform. Through the engineering side input / output interface and the session management and auditing module, robust protection against prompt injection attacks is achieved, while maintaining the availability and professionalism of compliant cybersecurity tasks.

[0087] 2. Security Layer Localization Algorithm (Top-K Causal Localization + Determination of Discrete Security Layer Set)

[0088] The goal of the security layer localization algorithm is to address situations where vertical domain capabilities are already available. The above quantifies the causal contribution of each layer to security decisions and selects the Top-Level Analysts accordingly. Each layer serves as a set of security layers. The key point of this algorithm is that it does not assume that the security mechanism is a continuous layer, but instead uses a data-driven approach to find key layers that may be discretely distributed across the entire layer, thus better reflecting the actual situation of "security behaviors emerging across layers and potentially entangled in representation".

[0089] The algorithm first constructs a set of paired data and templates. Let... For sample pairs that are semantically similar but have different security attributes, It contains a malicious intent skeleton (such as requesting details of an executable attack). For compliant versions of the same topic (e.g., defense, detection, remediation, and audit perspectives), each pair of samples is further refined using a set of templates such as narrative camouflage, role-playing, and gradual inducement. Generate variants This is to cover the main spoofing techniques of prompt word injection; at the same time, a benign set of boundaries is prepared. This is used to constrain the subsequent statement that "the positioning result should not push the boundary benignity towards rejection".

[0090] Next, we define the refusal propensity score. At the output, we select two sets of tokens: the refusal set and the refusal set. (Tokens starting with phrases like "Sorry / Unable / Inability / Not Available" or common rejection patterns) and sets of "Accept / Continue Answering" tokens. (e.g., tokens that initiate an answer, such as "can / suggest / steps / firstly"). For input... The last position The model generates logits Let the log-probability mass of a set be .

[0091]

[0092] The refusal propensity score can then be defined as the log-odds ratio:

[0093]

[0094] 𝑠𝜃 refers to comparing whether the model at this moment is more inclined to follow the "refusal to answer" or "normal answer" track. Among these... A larger value indicates that the model is more inclined to start with a rejection pattern (or enter the rejection track), while a smaller value indicates a greater inclination to enter the response track. The advantage of this definition is that it can characterize the immediate direction of security policy decisions by the "distribution tendency of the next token" without generating long text, and it is also convenient to use as a differentiable / comparable metric in causal patching.

[0095] Then, activation patching is performed layer by layer to calculate the causal contribution of each layer. This involves "changing only a small amount of information at a certain layer to see if the security decision changes," and if the tendency to refuse to answer significantly increases after the replacement. If the value is >0, it indicates that this layer has a stronger causal influence on "triggering rejection / safety strategy selection": for each sample pair and template variant, two trajectories are obtained by forward propagation at the t+1 level. Representation of the last position of the layer and For candidate layers Construct a "minimal intervention" patched run: keep the input as is But on the layer The last position replaces the representation with the one from The corresponding representation:

[0096]

[0097] The remaining layers and positions remain as The original trajectory, only The replacement is performed at the point, and then the forward propagation continues to the output to obtain the rejection tendency score of the patched response. Intuitively, this intervention allows the model to still "read" the malicious context and memory, but injects local representations of the "compliant version" at key locations in that layer, thereby observing whether security decisions undergo causal changes.

[0098] Based on this definition, the layer causal contribution A straightforward definition is the change in the tendency to refuse to answer:

[0099]

[0100] like This indicates that replacing the key representations at this layer with compliance representations significantly increases the tendency to refuse to answer, suggesting that this layer has a positive causal impact on "refusal triggering / security policy selection"; if This indicates that the layer is more like a factor that prompts the model to enter the response track (or output more details). To simultaneously avoid "safety enhancement leading to excessive rejection at the benign boundary," side effect terms can be computed on the benign boundary set. Let... The change in similar patched ratings at that time was Then, a constrained net contribution can be constructed:

[0101]

[0102] This step is like "adding a side effect brake to the positioning results"—it can also increase the likelihood of a layer refusing to answer. If it also pushes the boundary benignly towards refusing to answer, it should be penalized / de-weighted to avoid selecting a falsely safe layer that "will only become more conservative." Control the intensity of penalties for "benign rejections escalating at the boundary." This form expresses a core trade-off: the security layer should have a stronger ability to trigger rejections against malicious spoofing, but should not push benign rejections at the boundary with the same force.

[0103] Regarding contribution aggregation and robustness testing, for each layer Calculate statistics across sample pairs and across templates, such as mean, quantiles, and confidence intervals. Denote the sample contribution across all evaluation units as... Then it can be used

[0104]

[0105] As a basic estimate, and obtained using bootstrap. Robustness criteria can be written as "cross-template consistency + confidence interval not exceeding zero + controlled boundary penalties", for example, requiring... Significantly deviates from 0, and Not exceeding the set threshold This filters out layers that are "effective only on a few templates but have significant side effects".

[0106] Finally, perform Top- Selecting and introducing redundancy / diversity constraints yields a set of discontinuous security layers. The simplest choice is to... Sort by largest and take the first few. Each layer:

[0107]

[0108] Through the above "refusal tendency scoring + causal patching + side effect punishment + Top- The combination of "discontinuous layer selection" enables the security layer localization algorithm to identify the key layers for security strategy decisions from the entire layer range in a data-driven manner, provided that engineering feasibility is possible, and to explicitly constrain the damage to benign tasks at the boundary, thereby providing a reliable structural foundation for the subsequent lightweight calibration of "only updating the security layer".

[0109] 3. Dual-Mode Gating–Policy Safety Decomposition (DGPSD) Algorithm

[0110] Large-scale security domain models are typically developed by continuously fine-tuning and aligning training by introducing security corpora and security tasks onto a general-purpose large-scale model. Because the training process simultaneously strengthens both "professional capabilities / boundary judgment within the cybersecurity domain" and "security compliance constraints in general scenarios," the model naturally develops two relatively stable and triggerable response modes in the parameter space: when the input presents a clear security context, the model tends to invoke fine-grained knowledge and boundary judgment mechanisms to ensure "answering correctly and within acceptable limits"; while when the input deviates from the security context or has potential risks, the model tends to invoke more conservative and robust rejection and constraint mechanisms to ensure "not crossing the line." The training result of "one model, two types of contexts triggering two behavioral modes" makes the security-related representations exhibit a separable bimodal feature distribution within several key layers. Therefore, the "security layer" of the security vertical domain model has special characteristics: when the same security layer faces security domain requests and general requests, its internal contribution exhibits a separable "bimodal" distribution structure (more refined boundary identification within the domain and more robust security thresholds outside the domain). Therefore, it is necessary to explicitly distinguish between the two causal roles of "gating" and "policy" within the security layer, rather than relying solely on output templates or post-rules to reflect the differences.

[0111] DGPSD aims to address the issue that "while both are security layers, some layers are primarily responsible for deciding whether to reject an answer (gating), while others are primarily responsible for determining the compliant expression and granularity of the answer (policy)." Furthermore, this function will manifest in different modes under the "security vertical context" and the "general context."

[0112] Let the large-scale model of the safety vertical domain be There are a total of Layer Transformer module, layer index For the input sequence , No. Layer in position The hidden state is denoted as The output layer provides the final logits. And define the probability of the next token. The aforementioned "security layer location algorithm" has yielded a set of security layers. DGPSD builds upon this foundation. Further subdivided into mutually exclusive gating layer sets With strategy layer set ,satisfy and .in The gating system is responsible for determining whether a response has entered the "refusal to answer / restricted answer" track. Responsible for shaping the strategy of "how to answer after entering" (including refusal style, compliant alternative path, granularity of details and strength of enforceability inhibition).

[0113] To ensure rigorous formulation and definitions, DGPSD introduces two types of differentiable scoring functions, respectively characterizing the target orientation of gating and policy. First, the gating score (refusal-to-respond initiation tendency) is defined as follows:

[0114]

[0115] in Launch a token cluster for the "Rejection / Restriction Track" (e.g., the starting word of the rejection template, the starting word of the risk warning, etc.). The token cluster is launched for the "normal response track". Next, the policy score (bias of executability details vs. safe alternatives) is defined as follows:

[0116]

[0117] in This indicates a starter token family that is more likely to guide towards "executable steps / high operational details" (e.g., serialized step hints, imperative verbs, parameterized structure starter token families, which can be defined according to business requirements). This cluster of launch tokens represents security alternative responses such as "defense / detection / audit / remediation verification / compliance alternative suggestions." Intuitively, the gating layer should primarily affect... (The decision of whether or not to enter the safe vertical domain orbit) should primarily influence the strategy layer. (Determine "how to answer after entering the orbit, and to what granularity"), thereby decoupling "whether to speak" and "how to speak" within the model's internal structure.

[0118] To reflect the bimodal difference between "safe vertical domain vs. general," DGPSD statistically analyzes layer contributions for both types of input distributions. The safe vertical domain distribution is defined. It includes (i) a benign set of compliance and security issues at the boundary (such as defense detection, vulnerability remediation verification, log analysis, audit verification, etc.), and (ii) a set of disguised malice / gradual inducement; defining a general distribution. It includes general question-and-answer, writing, and common-sense dialogues unrelated to cybersecurity, and can include a small number of "general but noisy controls containing sensitive words" to test gating stability. For each sample, semantic pairings are constructed to isolate differences in "security attributes": [The text then abruptly shifts to a different topic:] ... For the compliant / boundary healthy expression of the same topic, For malicious or higher-risk expressions of the same topic (including disguised benign and gradual inducement), the comparison focuses on security attributes rather than topical changes.

[0119] The core of DGPSD is to analyze each candidate security layer. Calculate the "gating contribution" and "policy contribution", and respectively in Take the expected value. Adopt the causal patching idea consistent with existing localization: for a given pair... Fixed input is Forward computation obtained At the same time, Forward Define "in layer" The inference for "patched" in "patching the entire sequence" is: to... The The hidden state at all locations in the layer is replaced with The corresponding hidden state, i.e.

[0120]

[0121] From the first The layer continues forward to obtain the patched output, thus yielding... and Based on this, the gating / policy causal increment of this layer for a single sample is defined as follows:

[0122]

[0123] Further, taking the expectation of the distribution yields the distributional contribution:

[0124]

[0125] in Desirable or To retain the constraint of "benign boundary without excessive rejection," it is possible to... benign subset of the boundary Upper definition of gating punishment (punishing only the portion that leads to an increased tendency to refuse to answer):

[0126]

[0127] And use during gating layer filtering As a contribution to net gate control ( (as weight), to avoid misjudging "extremely conservative refusal to answer" as a high-quality gating layer.

[0128] To explicitly characterize the "bimodal difference" of the security layer in the large-scale security vertical model, DGPSD defines the bimodal difference index of the layer:

[0129]

[0130] This can be intuitively understood as "how strong is the role switching between inside and outside the domain?" The larger the value, the more it resembles a "dual-modal security layer in the security vertical domain," making it easier to translate "special characteristics" into a quantifiable indicator. The weight of the control strategy difference term. The larger this index, the more the layer exhibits the characteristic of "intra-domain / extra-domain contribution structure switching": in It can more precisely distinguish between compliance and security requirements and deceptive malicious inducements (the gating is more sensitive but not indiscriminately rejecting), in The system maintains a stable security threshold (more robust gating), while the policy layer jointly suppresses executable details and favors a security alternative framework in both modes. This translates the unique characteristic of "the security layer of the security vertical domain model is not a single rejector, but a bimodal structured security controller" into quantifiable hierarchical indicators.

[0131] In terms of subdivision criteria, DGPSD does not use empirical hard coding, but instead uses contribution statistics for structured partitioning. For each Constructing eigenvectors

[0132]

[0133] Then, a directly implementable discriminant partition is given: Let Indicates in set On Quantile operators (e.g.) (Representing the top 20%). Select a threshold. Ratio threshold .like

[0134]

[0135] Then Return to the control layer set ;in This is a numerically stable term. If...

[0136]

[0137] Then Included in the strategy layer set For boundary layers that simultaneously satisfy or simultaneously fail to satisfy certain conditions, the following can be used: As the final arbitrator: when Larger ones are given priority. (Interpreted as "mode switching gating layer," responsible for changes in threshold morphology within / outside the domain); when Smaller but When the distribution is stable and positive on both distributions, it is preferentially included. (This is interpreted as the "strategy consistency layer," responsible for maintaining consistency between safe expression and the detail suppression framework.) Final output As a response to the "positioned security layer" The fine-grained structured result is essentially a criterion that "automatically assigns layers to gating or policy using statistical thresholds," avoiding the inaccuracies of manual configuration. Specifically, the gating layer should significantly lead in gating contributions (without causing beneficial side effects at the boundary), and the policy layer should significantly lead in contributions to detail suppression / compliance policies. In case of conflict, [the following is used:] Determine whether it belongs to the "mode switching gating layer".

[0138] To facilitate subsequent training and engineering management, DGPSD simultaneously provides a strict definition of the parameter domain. Let the... Layer parameters are The set of security layer parameters has been located as follows. Further subdivided into and In the subsequent calibration phase, optimizations to "improve the rejection threshold / limited response trigger and sensitivity to spoofed malice, while simultaneously constraining the boundary to avoid excessive rejection" can be primarily applied to... The optimization of "the structure and granularity of secure alternative responses, the suppression of executable details, and the maintenance of compliant availability" is mainly applied to... Above. More importantly, because this algorithm explicitly characterizes... and Given the bimodal differences, the training objective can be naturally written as a structured constraint of "intra-domain tolerance, extra-domain conservatism": the gating layer in The pursuit is for stronger boundary differentiation rather than indiscriminate rejection. Maintain a robust safety threshold; the strategy layer suppresses both modes. And biased towards This enables the model to present "usable security expert-style answers" for security domain problems and "stable assistant-style answers that follow security boundaries" for general problems, thereby realizing the special characteristics of the security layer of the large security domain model into an interpretable, quantifiable, and trainable gating-policy decomposition structure.

[0139] Taking Cisco's Foundation Security Vertical Model and its basic model LLAMA3-8B as an example, Figure 2 This demonstrates the differences between the security layer located by the method of this invention and the SPPFT method.

[0140] Figure 3 This demonstrates the improved defense success rate of this method against various types of keyword injection attacks.

[0141] The key points and inventive aspects of this invention are as follows:

[0142] 1. The problem of "conflict between knowledge layer and security strategy layer" is identified: it is pointed out that after the target range security big model enhances its capabilities with only benign cybersecurity data, it often faces the dilemma of "being more easily induced by narrative veneer / or excessive rejection by boundary tasks". This is essentially due to the coupling and tension between knowledge representation learning and security strategy boundary in the parameter space.

[0143] 2. Causal safety layer localization: A causal localization process for rejection / acceptance decision-making is proposed: for (x_safe, x_bad) paired samples, minimal activation intervention is performed at each layer (only the last position representation is replaced), the layer contribution is characterized by the change in the rejection tendency score at the output end, and the samples are selected according to contribution after robust cross-template aggregation. This approach involves multiple security layers (allowing for discontinuity). Unlike existing methods that use "continuous layer boundaries" as the result for location, this approach is more suitable for models where real security mechanisms are discretely distributed.

[0144] 3. Security Layer Subdivision: This invention obtains a discrete security layer set based on the existing "security layer location algorithm". Building upon this foundation, a security layer gating-policy subdivision mechanism is further proposed, which will... Structured decomposition into a set of mutually exclusive gating layers With strategy layer set And accordingly form a parameter tripartite structure. (in For knowledge layer parameters, For gate layer parameters, (For strategy layer parameters). Unlike existing solutions that treat the "security layer" as a homogeneous whole, this invention, for the first time, explicitly decouples "whether to answer" (gating: determining whether to trigger a rejection / limited answer track) and "how to answer" (strategy: determining compliance alternative paths, granular details, and executability suppression) within the model. This allows the large security domain model to exhibit different security layer pattern distributions when facing security domain requests and general requests: maintaining higher availability and professionalism for compliance security tasks within the domain (domain tolerance, fine boundary discrimination), and maintaining more stable conservative thresholds and rejection robustness for out-of-domain general context transgression inducements (out-of-domain tightening, stable gating). This subdivision not only improves the interpretability and controllability of the security layer but also provides a finer-grained parameter application surface for subsequent reverse freeze calibration—allowing for separate parameter application on each security layer. and By applying different objective functions and update strategies, we can suppress two common side effects, namely "excessive refusal to respond" and "leakage of executable details," and achieve synergistic optimization of security, availability, and vertical domain capabilities.

[0145] 4. Reverse Freeze Calibration: Freezes the non-security / knowledge layer during the robust calibration phase, only updating... The security layer (and its lightweight adapter) forces optimization to focus on "rejection boundary and output granularity control," avoiding capability drift caused by knowledge layer absorption loss, thereby improving robustness to prompt injection without compromising cybersecurity capabilities. The comparative calibration objective for prompt injection is to construct comparative data of "malicious D_attack vs benign D_border," and to incorporate capability anchoring (distillation / KL constraints) and representation invariance constraints, making the model insensitive to camouflage techniques such as role-playing, multi-round progressive approaches, and scene forgery, while reducing excessive rejection.

[0146] Compared with the prior art, the advantages of the present invention are as follows:

[0147] 1. Significantly reduces the success rate of prompt keyword injection: It is less sensitive to camouflage strategies such as "authorization statement, role-playing, and gradual extraction", reducing the probability of outputting harmful content.

[0148] 2. Precise and interpretable security layer positioning: employing Causal localization quantifies "which layers determine the granularity of rejection / output" into a layer contribution ranking, and allows for discrete distribution of security layers, avoiding false freezing / false updates caused by using only continuous layer segments.

[0149] 3. No reduction (or minimal reduction) in the performance of benign security tasks: Freezing the knowledge layer ensures that capabilities such as vulnerability explanation, detection and remediation suggestions are stably preserved, and capability drift is further suppressed through capability anchoring.

[0150] 4. Reduce excessive rejection: Calibrate for benign boundary samples to enable the model to learn "usable but safe" response granularity control in sensitive contexts.

[0151] 5. Low engineering cost and easy integration: Only requires... The layer (or its adapter) can be lightly fine-tuned with low training overhead and is compatible with existing fine-tuning / range deployment processes.

[0152] The above embodiments are only used to illustrate the technical solutions of the present invention, and are not intended to limit them. Although the present invention has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that modifications can still be made to the technical solutions described in the foregoing embodiments, or equivalent substitutions can be made to some of the technical features. However, these modifications or substitutions do not cause the essence of the corresponding technical solutions to deviate from the spirit and scope of the technical solutions of the embodiments of the present invention.

Claims

1. A defense method for a large model security target range, characterized by, Includes the following steps: S1. Obtain a base language model with basic secure alignment capabilities; S2. Use a benign cybersecurity dataset to fine-tune the domain capabilities of the base model to obtain a vertical domain model; S3. Perform a security layer localization algorithm on the vertical domain model to determine the set of discontinuous layers S in the model that have key causal contributions to security decisions, and define them as security layers. S4. Perform a bimodal gating-policy subdivision algorithm on the security layer set S to subdivide it into a mutually exclusive gating layer set G and a policy layer set P. The gating layer set G is mainly responsible for triggering the rejection or restriction track, and the policy layer set P is mainly responsible for controlling the policy, compliant expression and granularity of the answer. S5. Freeze the non-safe layer parameters in the subsequent training based on the subdivision result , only update the gating layer parameters and the policy layer parameters ; S6. Construct a robust calibration training set containing camouflaged malicious samples and boundary benign samples, and attach pattern labels to the samples to distinguish between security vertical patterns and general patterns. S7, calibrating fine-tuning the model using the robust calibration training set, the loss function of the calibrating fine-tuning at least including a supervision loss term, a gating regularization term, a strategy regularization term and a capability anchoring term, and the optimization process only updates and ; S8. Deploy the final defense model obtained through calibration and fine-tuning.

2. The defense method of claim 1, wherein, The security layer location algorithm includes: Construct a set of sample pairs that are semantically similar but have different security attributes; Defining a rejection inclination scoring function based on output token set probabilities ; For each candidate layer l of the model, the causal patch method is used to calculate the change in causal contribution to the change in the propensity to reject score after intervening on the malicious samples ; Calculate the penalty for the side effects of the intervention on the set of benign samples at the boundary; Based on the net contribution statistics of all sample pairs, the Top-K layers with the largest contributions are selected as the set of security layers S.

3. The defense method of claim 1, wherein, The rejection tendency score function is defined as: ， wherein, denotes a set of start tokens that trigger a rejection or a limited answer, denotes a set of start tokens that trigger a normal answer, is the probability of the model to output token v at input x.

4. The defense method of claim 1, wherein, The bimodal gating-policy subdivision algorithm includes: Defining a gating score function and a policy score function The policy score function is used to measure the tendency of the model output to favor executable details or safe alternative paths; respectively on the secure vertical data distribution and the general data distribution for each layer l in the set of security layers S, compute its causal contribution to the gating score and the policy score; Based on the performance of the causal contribution in the two distributions, the bimodal difference index Ω_l of the layer is calculated, which is used to characterize the switching strength of the layer in the security roles inside and outside the domain. based on a preset contribution threshold, a contribution ratio, and the bimodal difference index Each layer in the security layer set S is automatically divided into the gate layer set G or the policy layer set P.

5. The defense method of claim 1, wherein, The policy scoring function is defined as: ， wherein, represents a starting token set that is easy to direct to executable details, represents a starting token set that directs to a compliance alternative path for defense, detection, audit, or remediation.

6. The defense method of claim 1, wherein, In step S5, the gating layer parameters and policy layer parameters are updated using a differentiated update strategy, including setting different learning rates for and or focusing on optimizing and in stages.

7. The defense method of claim 1, wherein, The loss function mentioned in step S7 is specifically as follows: ， wherein, is a supervised cross-entropy loss, is a gating regularizer based on gating scores, L_pol is a policy regularizer based on policy scores, is a capability anchoring distillation loss with the vertical domain model as the teacher, , , are weight coefficients of each loss term.

8. The defense method driven by causal security layer calibration for large-scale model security ranges according to claim 1, characterized in that, The gating regularizer is: ， wherein, is a set of disguised malicious samples, is a set of boundary benign samples, and is a threshold of rejection tendency and is a weight coefficient.​​ 9. An electronic device comprising a memory and a processor, the memory storing a computer program, characterized in that, When the processor executes the computer program, it implements the steps of the method according to any one of claims 1 to 8.

10. A computer-readable storage medium having stored thereon a computer program, characterized in that, When the computer program is executed by a processor, it implements the steps of the method according to any one of claims 1 to 8.

Images