Intrinsic security defense method of large model based on inter-layer contrast decoding
By identifying high-risk sensitive layers in large language models and adjusting decoding strategies in real time, the security risks of large language models are solved, achieving effective defense against covert attacks and maintaining text quality.
Patent Information
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- XIAN THERMAL POWER RES INST CO LTD
- Filing Date
- 2026-02-02
- Publication Date
- 2026-06-09
AI Technical Summary
Existing large language models have significant security vulnerabilities when generating content, making it difficult to effectively resist covert semantic attacks. Furthermore, existing inter-layer comparison decoding methods lack specificity, different mechanisms, and adaptability, affecting text quality and security.
By constructing a benchmark dataset to identify high-risk sensitive layers, calculating the distribution differences and similarities between layers in real time, dynamically adjusting the decoding strategy, and employing negative contrast decoding operations and an adaptive backoff mechanism, the system can accurately locate and suppress harmful content.
It provides a security defense method with zero training cost, which can effectively resist covert attacks, maintain text quality and fluency, reduce maintenance costs and computing power consumption, and improve user experience.
Smart Images
Figure CN122179141A_ABST
Abstract
Description
Technical Field
[0001] This invention belongs to the field of artificial intelligence and network security technology, specifically relating to a large model intrinsic security defense method based on inter-layer comparison decoding. Background Technology
[0002] With the rapid development of deep learning technology, large language models based on the Transformer architecture have demonstrated astonishing capabilities in natural language processing tasks. These models have been widely applied in key areas such as code generation, intelligent customer service, and power system decision support.
[0003] However, large language models present significant security risks when generating content. Since training data primarily comes from the internet, the models inevitably learn about biases, discrimination, violence, and potential malicious attacks inherent in human society. To ensure the security and compliance of these models, existing mainstream defense technologies are mainly divided into three categories.
[0004] The first category is alignment techniques based on the training phase. Currently, the most commonly used methods include supervised fine-tuning and human-feedback reinforcement learning. These methods further train the base model by constructing high-quality security datasets or reward models, making it favor secure outputs. However, this type of technique has the following drawbacks: high computational cost; each update of the security strategy or response to new attack patterns requires significant computational resources to retrain or fine-tune the model, resulting in long maintenance cycles; excessive security fine-tuning often leads to a decline in the model's general performance, i.e., the alignment tax problem; and it is difficult to exhaust all possible malicious inducements during the training phase, resulting in limited model defense capabilities against long-tail attack samples not seen in the training set.
[0005] The second category is external filters based on the inference stage. This type of technology is often referred to as guardrails, which involves deploying additional classification models or keyword matching systems at the model's input or output to intercept content. However, this type of technology has the following drawbacks: external filters are usually based on surface-level semantic matching, making them highly susceptible to hint injection or subtle jailbreak attacks; serially accessed moderation models increase the overall system response time, impacting user experience; and the often blanket rejection strategy not only interrupts the dialogue flow but also fails to guide the model to generate non-toxic but useful relevant information.
[0006] The third category is existing inter-layer contrastive decoding techniques. In recent years, academia has proposed some decoding strategies based on the model's internal state. The core idea is to enhance factual knowledge and reduce model illusions by amplifying the differences between later and earlier layers. However, existing contrastive decoding methods mainly target factual optimization and are difficult to directly apply to security defenses, primarily because: The lack of specificity means that fixed early layers are usually chosen as the benchmark for comparison, while the specific intermediate sensitive layers that are responsible for encoding toxicity or bias in the model are often the ones that the standard methods cannot accurately locate and suppress. The mechanisms are different; the goal of the latter is to amplify the factual details in the later layers, while the goal of security defense is to subtract or orthogonalize harmful features in the sensitive layers. Simple contrast enhancement may amplify the potential toxicity while amplifying the semantics. Lacking adaptability, existing contrast decoding is usually enabled throughout, and if it is forcibly intervened in harmless conversations, it will disrupt the fluency and coherence of the text, leading to increased confusion.
[0007] Therefore, how to design a large-scale model intrinsic defense method that does not require high-cost training, can resist covert semantic attacks, and can dynamically balance text quality and security is a core problem that urgently needs to be solved. Summary of the Invention
[0008] The present invention aims to at least solve one of the technical problems existing in the prior art, and to provide a large model intrinsic security defense method based on inter-layer contrast decoding.
[0009] To achieve the above objectives, this invention provides a large model intrinsic security defense method based on inter-layer contrastive decoding, comprising: A benchmark dataset containing risky content in the target domain is constructed. This benchmark dataset is then input into a large language model to be defended against. The output states of each layer of the large language model are recorded. By calculating the distribution differences between the outputs of each intermediate layer and the final layer, layers with high activation levels for harmful content are identified and labeled as a set of high-risk sensitive layers. The activation vectors of these high-risk sensitive layers when processing harmful content are extracted as harmful feature fingerprints. When the large language model receives user input for reasoning, it calculates the probability distribution of the output of each layer in the current generation step in real time, and calculates the similarity between the real-time activation vector of the currently generated word in the high-risk sensitive layer set and the harmful feature fingerprint. When the similarity exceeds the preset security trigger threshold, it determines that there is a potential risk in the current generation process and triggers security intervention. In response to the triggering of the security intervention, a negative comparison decoding operation is performed. The negative comparison decoding operation includes calculating the weighted difference between the projection vector output by the final layer and the projection vector output by the high-risk sensitive layer set, and normalizing the weighted difference by a normalized exponential function to obtain the corrected probability distribution of the next word. The text perplexity of the corrected output content is monitored. When the text perplexity exceeds a preset quality threshold, the decoding strategy is dynamically adjusted to maintain semantic fluency.
[0010] Furthermore, the calculation of the distribution difference between the outputs of each intermediate layer and the final layer includes: Obtain the first of the large language models Hidden state or Logits distribution of layer output Distribution of the final layer output of the large language model ; Calculate the With the JS divergence between them; The layers whose JS divergence values are within a preset range and exhibit a target activation mode when processing harmful content are selected as the high-risk sensitive layer set.
[0011] Furthermore, the extraction of the harmful fingerprint features includes: The benchmark dataset is divided into a harmful inducement set and a harmless control set; The harmful inducement set and the harmless control set are respectively input into the large language model, and the activation vectors of each layer in the high-risk sensitive layer set are recorded. The average activation vector of the harmful inducement set in the high-risk sensitive layer set is calculated as the harmful feature fingerprint.
[0012] Furthermore, the calculation of the similarity includes: In generating the first When there are 1 word elements, extract the output vector of the current high-risk sensitive layer set; Calculate the cosine similarity between the output vector and the harmful fingerprint feature; When the cosine similarity is higher than the security trigger threshold, it is determined to be a potential risk and the negative comparison decoding operation is triggered.
[0013] Furthermore, the formula for calculating the modified probability distribution of the next lexical term is as follows: ; in, Indicates the number to be generated Each word element, This represents the output vector of the final layer of the large language model. This represents the output vector of the set of high-risk sensitive layers. This represents the projection operation that maps the hidden state to the vocabulary space. The suppression coefficient and Greater than 0, This represents the normalized exponential function.
[0014] Furthermore, the inhibition coefficient When the value is greater than 1, harmful components are orthogonally stripped from the final layer output through subtraction operations in the vector space.
[0015] Furthermore, the dynamically adjusted decoding strategy includes: The text perplexity of the decoded sequence is calculated in real time; When the text perplexity exceeds the quality threshold, the value of the suppression coefficient is reduced; If the text perplexity still exceeds the quality threshold after reducing the suppression coefficient, the negative contrast decoding operation is stopped, the system reverts to the standard decoding mode, and the backup keyword masking filter is invoked to verify the current word.
[0016] Furthermore, the benchmark dataset includes malicious instruction text, biased speech text, and offensive code text, and the large language model adopts the Transformer architecture.
[0017] Furthermore, this method does not update or fine-tune the parameters of the large language model, but only achieves security defense by adjusting the decoding strategy during the inference stage.
[0018] Furthermore, when the similarity does not exceed the security trigger threshold, the large language model outputs the tokens corresponding to the original Logits according to the standard decoding method.
[0019] The beneficial effects of this invention are as follows: This invention provides a plug-and-play, zero-training-cost solution that does not require any parameter updates or fine-tuning of large language models. Only the decoding strategy during inference needs to be adjusted, making the deployment and updating of security strategies extremely rapid and greatly reducing maintenance costs and computing power consumption.
[0020] This invention has a powerful ability to defend against covert attacks. Even if a carefully designed jailbreak prompt bypasses an external text filter, it will inevitably stimulate specific neuronal patterns within the model. This invention can directly identify and intercept such prompts at the feature layer, achieving a deeper level of intrinsic security defense.
[0021] This invention achieves fine-grained guided detoxification. Compared with the crude rejection of answers, this invention tends to guide the model to remove toxic components through the subtraction operation of vector space, generating semantically relevant but toxic safe answers, thus improving user experience and usability of responses while ensuring safety.
[0022] This invention features dynamic adaptive characteristics while maintaining fluency. By introducing confusion monitoring and adaptive fallback mechanisms, this invention can find a dynamic balance between security and text fluency, avoiding logical chaos in generated content caused by excessive defense. Attached Figure Description
[0023] Figure 1 This is a flowchart of the large model intrinsic security defense method based on inter-layer contrast decoding according to the present invention; Figure 2 This is a schematic diagram illustrating the principle of sensitive layer localization and feature profiling construction in this invention; Figure 3 This is a schematic diagram illustrating the core algorithm principle of negative comparison decoding in this invention; Figure 4 This is the timing logic diagram of the adaptive backoff and quality control mechanism of the present invention; Figure 5 This is a block diagram of the hardware architecture and functional modules of the computer system of the present invention. Detailed Implementation
[0024] To make the objectives, technical solutions, and beneficial effects of this application clearer, the following detailed description, in conjunction with the accompanying drawings and specific embodiments, further illustrates this application. It should be understood that the specific embodiments described in this specification are merely for explaining this application and are not intended to limit it.
[0025] The large-model intrinsic security defense method based on inter-layer contrastive decoding of this invention is deployed on a large language model with a general Transformer architecture. This method primarily runs on a server equipped with high-performance computing units. The overall architecture comprises four core modules: a sensitive layer localization module, a dynamic monitoring module, a negative decoding module, and a quality control module. The sensitive layer localization module is responsible for analyzing the response characteristics of each layer of the model to harmful content during the offline phase, identifying high-risk sensitive layer sets. The dynamic monitoring module is responsible for real-time detection of the risk level of the currently generated content during the inference phase. The negative decoding module is responsible for performing negative contrastive decoding operations when a risk is detected. The quality control module is responsible for monitoring output quality and dynamically adjusting the decoding strategy.
[0026] Example 1 This embodiment uses the security protection of an intelligent customer service system as an application scenario. The intelligent customer service system undertakes core functions such as user consultation, question answering, and business processing, and has extremely high security requirements, needing to prevent the model from outputting harmful, biased, or sensitive information.
[0027] System Configuration: The large language model used in this embodiment is the LLaMA-2-13B architecture, with 32 Transformer decoder layers, a hidden dimension of 5120, 40 attention heads, and a vocabulary size of 32000. The model is deployed on a server equipped with an NVIDIA A100 GPU and 80GB of GPU memory. The inference framework uses vLLM, supporting batch inference and KV caching optimization.
[0028] See Figure 1The security defense method in this embodiment includes the following steps.
[0029] Step S1: Sensitive layer localization and feature profile construction.
[0030] Before the model is officially launched, it is necessary to first determine which layers within the model are most likely to store or respond to harmful information. This step is the offline preparation phase.
[0031] Dataset Preparation: We selected the publicly available security testing datasets RealToxicityPrompts and SafetyBench, extracting 1000 samples containing malicious instructions, hate speech, pornography, and violence as the harmful inducement set. The harmful inducement set specifically comprises: 250 hate speech samples covering racial discrimination, gender discrimination, and religious prejudice; 200 violent threat samples covering personal injury, terrorism, and self-harm incitement; 150 pornographic content samples covering explicit descriptions, sexual harassment, and child-related content; 200 malicious instruction samples covering fraudulent methods, illegal activities, and privacy violations; and 200 biased speech samples covering political bias, regional discrimination, and occupational discrimination. We also selected 1000 commonly used Wikipedia texts as the harmless control set, covering neutral descriptive texts from multiple fields such as science, history, geography, and art.
[0032] Inter-layer activation recording: The above dataset is input into the large language model. This embodiment's model has 32 layers. For each input sample, during forward propagation, PyTorch's hook mechanism is used to record the hidden state of each layer's output. The dimension of the hidden state is the sequence length multiplied by the hidden dimension, i.e., ... ×5120. The hidden states are projected onto the vocabulary probability distribution through the model's language model head, with a dimension of ×5120. ×32000. During the recording process, the hidden state and Logits distribution of the last position of each sample are saved to form an inter-layer activation database.
[0033] JS divergence calculation: Calculate the first probability distribution of layers The probability distribution of the final layer, i.e., the 32nd layer. The Jensen-Shannon divergence between them. The formula for calculating the JS divergence is: ; in, express and The average distribution , express Divergence, its formula is: ; For the harmful induction set and the harmless control set, calculate the mean and standard deviation of the JS divergence between each layer and the final layer.
[0034] Sensitive Layer Determination: Three conditions are set for sensitive layer determination. Condition 1: Significant difference in JS divergence, requiring that the difference between the mean JS divergence of a layer when processing the harmful inducement set and the mean JS divergence when processing the harmless control set is greater than a threshold of 0.15. Condition 2: JS divergence value within the target range, requiring the JS divergence value to be between 0.3 and 0.7. This range indicates that the layer is neither completely consistent with nor completely unrelated to the final layer, and has independent semantic encoding capabilities. Condition 3: Negative word activation, requiring that negative words account for more than 30% of the Top-K predicted words of the layer. The negative word list contains 5000 predefined harmful words, covering profanity, discriminatory words, violent words, etc. Statistical analysis in this embodiment found that layers 20, 21, 22, 23, and 24 simultaneously meet the above three conditions. Therefore, these five layers are marked as a high-risk sensitive layer set. .
[0035] Harmful Feature Fingerprint Extraction: For each layer in the set of high-risk sensitive layers, calculate the average activation vector of the harmful inducement set in that layer. Let the th layer be... The layer is processing the first The hidden state when there are harmful samples is Then the first The harmful characteristic fingerprint of the layer is: ; in, The sample size of the harmful inducement set is 1000 in this embodiment. The harmful feature fingerprints of all layers in the high-risk sensitive layer set are spliced or averaged to form the final harmful feature fingerprint. The dimension is 5120. Harmful feature fingerprint vectors are stored in GPU memory for subsequent real-time similarity calculations.
[0036] Step S2: Dynamic monitoring during the inference phase.
[0037] When a user enters a prompt word into the intelligent customer service system, the system performs the following actions.
[0038] Input preprocessing: The user-input text is converted into a token sequence using a token segmenter. The tokenizer employs the SentencePiece algorithm with a vocabulary size of 32,000. The maximum length of the input sequence is limited to 2048 tokens. Special start and end markers are added to the input sequence.
[0039] Forward Propagation: The model begins generating response tokens one by one. In each generation step, the model performs a full forward propagation, computing all 32 hidden states.
[0040] Sensitive layer activation extraction: In the generation of the first layer activation extraction layer... When dealing with a given word, extract the output vector of each layer in the high-risk sensitive layer set. For layers 20 to 24, obtain their hidden states at the current position. , , , , Perform average pooling on these five vectors to obtain the aggregated activation vector of the sensitive layer at the current time step: ; Similarity matching: calculation fingerprints with harmful characteristics The cosine similarity between them. The formula for calculating cosine similarity is: ; Where, the dot product represents the vector dot product. express Norm. Similarity calculation is accelerated using CUDA, with a single calculation taking approximately 0.1 milliseconds.
[0041] Trigger detection: Set a safe trigger threshold In this embodiment, it is set to 0.70. The triggering judgment logic is as follows: like Greater than This indicates that the model is currently using harmful internal knowledge to generate data, which will trigger a flag. Setting it to True immediately activates the negative comparison decoding mechanism; like Less than or equal to This will trigger the flag. Setting it to False will output the current word using the standard decoding method. To reduce single-point false positives, this embodiment also introduces a sliding window mechanism with a window size of 3. Security intervention is only triggered when the similarity of three consecutive words exceeds a threshold, thus improving the stability of the judgment.
[0042] Step S3: Negative comparison decoding.
[0043] Once the security defense is triggered, the system will no longer directly output the highest probability word in the final layer prediction, but will instead correct the probability distribution.
[0044] Get the layer output: Get two key Logits vectors. The Logits vector for the final layer, i.e., layer 32, has a dimension of 32000 and contains complete semantic information, but also includes the generated harmful intent. This is the aggregated Logits vector for the sensitive layer. For layers 20 to 24, their hidden states are projected onto the language model head as Logits, and then averaged. ; in, The weight matrix representing the language model head has dimensions of 5120×32000.
[0045] Perform the subtraction operation: Adjust the prediction Logits for the next word using the following formula: ; in, It is the suppression coefficient. In this embodiment, the initial... Set to 3.0. This is achieved by multiplying the Logits of the sensitive layer by a coefficient. This is then subtracted from the final layer Logits, which is equivalent to orthogonally stripping harmful components from the vector space. The effect of this operation is that the probability of words with high prediction probabilities in the sensitive layer is significantly reduced in the corrected Logits; the probability of words with low prediction probabilities in the sensitive layer remains basically unchanged.
[0046] Normalization: for conduct The operation yields the corrected probability distribution: ; in, The vocabulary size is 32,000. Based on the corrected probability distribution, a sampling strategy is used to generate the final vocabulary. The sampling strategy adopts sampling, The value is set to 0.9, and the temperature coefficient is set to 0.7.
[0047] Step S4: Adaptive rollback and quality control.
[0048] In order to avoid Setting the value too high can cause the generated sentences to be illogical, i.e., semantic breakdown. An adaptive mechanism is introduced to address this.
[0049] Perplexity Calculation: Calculates the perplexity of the currently generated sentence in real time. The formula for calculating perplexity is: ; in, This indicates the number of tokens that have been generated so far. This indicates generating the first word given a preceding word. The probability of each word. Normal fluent text. Typically, it is between 20 and 60. In this embodiment, the perplexity quality threshold is set to 100.
[0050] Dynamic adjustment strategy: A three-level adjustment mechanism is adopted. Level 1, when... When it exceeds 100, Reduce from 3.0 to 1.5, and re-execute the subtraction and normalization operations in step S3. Second level, when reducing... back If it still exceeds 100, Further reduced to 0.5. Level 3, when... When it is 0.5 If it still exceeds 100, Setting this to 0 completely disables negative comparison decoding, reverts to standard decoding mode, and only performs traditional keyword blacklist verification on generated tokens. The keyword blacklist contains 2000 high-risk words; if a generated token matches the blacklist, it is replaced with a special rejection flag.
[0051] Performance metrics: This embodiment was tested on an intelligent customer service security test dataset. The dataset contains 8000 normal user requests and 3000 malicious user requests. Malicious user requests include: 800 jailbreak attack samples, 600 prompt injection samples, 500 role-playing bypass samples, 400 encoding obfuscation attack samples, and 700 other malicious requests. Test results show that the harmful content blocking rate reached 97.2%, the normal request pass rate reached 98.5%, and the average inference latency increased by 6.3%, from the baseline of 45 milliseconds to 47.8 milliseconds. The adaptive fallback trigger rate was 3.2%, indicating that in most cases, negative contrast decoding can achieve security defense while maintaining text quality.
[0052] Example 2 This embodiment uses the security protection of a code generation assistant as an application scenario. The code generation assistant undertakes core functions such as automatically generating program code based on user needs, code completion, and code translation. Its security requirements are extremely high, needing to prevent the generation of malicious code, exploit code, network attack scripts, and other harmful content.
[0053] System Configuration: This embodiment uses the CodeLLaMA-13B architecture, a large language model optimized for code generation tasks. It features 32 Transformer decoder layers, a hidden dimension of 5120, 40 attention heads, and a vocabulary size of 32016, including additional code-specific tokens. The model is deployed on a server equipped with an NVIDIA A100 GPU and 80GB of GPU memory. The inference framework uses vLLM, supporting batch inference and prefix caching optimization.
[0054] The security defense method in this embodiment is executed sequentially according to steps S1 to S4 as described in Embodiment 1. The specific implementation process of each step is adaptively adjusted according to the characteristics of the code generation scenario.
[0055] Step S1: Sensitive layer localization and feature profile construction.
[0056] Dataset Preparation: Construct a code security testing dataset. The malicious inducement set contains 800 malicious code samples, specifically composed of the following: 150 SQL injection code samples, including various database injection attack codes covering database systems such as MySQL, PostgreSQL, and Oracle; 120 vulnerability exploitation code samples, including buffer overflow, format string, and integer overflow exploitation codes; 100 malware code samples, including Trojans, backdoors, keyloggers, ransomware, and other malicious program code; 130 network attack code samples, including DDoS attack scripts, port scanners, and password brute-force tools; 80 system damage code samples, including dangerous operation codes such as file deletion, system command injection, and privilege escalation; 100 privacy theft code samples, including privacy violation codes such as cookie theft, session hijacking, and data leakage; 60 cryptocurrency mining code samples, including various mining scripts and resource abuse codes; and 60 social engineering code samples, including fraudulent codes such as phishing page generation and fake login interfaces. The harmless control set contains 800 normal functional code samples, which come from open source projects on GitHub and cover normal functional code in multiple fields such as web development, data processing, algorithm implementation, and system tools.
[0057] Inter-layer activation records: The above dataset is input into the code to generate the model. This embodiment's model has 32 layers. For each input sample, during forward propagation, PyTorch's hook mechanism is used to record the hidden states of each layer's output. Considering the structured nature of the code, this embodiment records not only the hidden state of the last position but also the hidden states of key code positions, including function definition positions, system call positions, network operation positions, and file operation positions. Hidden states from 5 to 10 key positions are extracted for each sample to form an inter-layer activation database.
[0058] JS divergence calculation: Calculate the first probability distribution of layers The probability distribution of the final layer, i.e., the 32nd layer. The Jensen-Shannon divergence between them is calculated using the same method as in Example 1. For code generation scenarios, this example also calculates the activation level of dangerous API terms at each layer. The dangerous API vocabulary contains 500 high-risk functions and keywords, covering system call functions such as `system`, `exec`, and `eval`; network operation functions such as `socket`, `connect`, and `send`; file operation functions such as `open`, `write`, and `delete`; and encryption operation functions such as `encrypt`, `decrypt`, and `hash`.
[0059] Sensitive Layer Determination: Four conditions are set for sensitive layer determination. Condition 1: Significant difference in JS divergence, requiring that the difference between the mean JS divergence of a certain layer when processing harmful code samples and the mean JS divergence when processing normal code samples is greater than a threshold of 0.12. Condition 2: JS divergence value within the target range, requiring the JS divergence value to be between 0.25 and 0.65. Condition 3: Activation of dangerous API terms, requiring that dangerous API terms account for more than 25% of the Top-K predicted terms of this layer. Condition 4: Sensitive code structure, requiring that the response of this layer to the code control flow structure is significantly different. Statistical analysis in this embodiment found that layers 18, 19, 20, 21, and 22 simultaneously meet all four conditions. Therefore, these five layers are marked as a high-risk sensitive layer set. .
[0060] Malicious Feature Fingerprint Extraction: For each layer in the high-risk sensitive layer set, the average activation vector of the malicious code sample in that layer is calculated. Considering the diversity of malicious code, this embodiment adopts a classification aggregation strategy: feature fingerprints of different types of malicious code, such as SQL injection, vulnerability exploitation, malware, and network attack, are calculated separately, and then a weighted average is performed, with the weights set according to the actual threat level of each type. The final malicious feature fingerprint... The dimension is 5120, and it is stored in the GPU memory.
[0061] Step S2: Dynamic monitoring during the inference phase.
[0062] When a user enters a code generation request into the code generation assistant, the system performs the following operations.
[0063] Input preprocessing: The user-input text and context code are converted into a token sequence by a tokenizer. The tokenizer uses the BPE algorithm, which is optimized for code and can correctly handle special characters, indentation, and syntactic structures in the code. The maximum length of the input sequence is limited to 4096 tokens to support longer code contexts.
[0064] Forward Propagation: The model begins generating code terms one by one. In each generation step, the model performs a full forward propagation, computing the hidden states of all 32 layers.
[0065] Sensitive layer activation extraction: In the generation of the first layer activation extraction layer... When dealing with a code term, extract the output vector of each layer in the high-risk sensitive layer set. For layers 18 to 22, obtain their hidden states at the current position. , , , , Perform average pooling on these five vectors to obtain the aggregated activation vector of the sensitive layer at the current time step. .
[0066] Similarity matching: calculation fingerprints with harmful characteristics The cosine similarity between them is calculated using the same formula as in Example 1. For code generation scenarios, this example also introduces a code context awareness mechanism: when the current generation location is detected to be in sensitive code areas such as function definitions, system calls, or network operations, the similarity calculation result is multiplied by an amplification factor of 1.2 to improve the detection sensitivity of sensitive locations.
[0067] Trigger detection: Set a safe trigger threshold In this embodiment, the value is set to 0.65, slightly lower than in Embodiment 1, because the characteristics of malicious code are more covert. The trigger judgment logic is the same as in Embodiment 1, and a sliding window mechanism with a window size of 3 is also used to improve the stability of the judgment.
[0068] Step S3: Negative comparison decoding.
[0069] Once the security defense is triggered, the system corrects the probability distribution.
[0070] Get the layer output: Get two key Logits vectors. This is the Logits vector of the final layer, i.e., the 32nd layer, with a dimension of 32016. The aggregated Logits vector for the sensitive layers is calculated by projecting the hidden states of layers 18 to 22 onto the language model head and then performing a weighted average. For code generation scenarios, this embodiment sets different weights for different sensitive layers: layers 20 and 21 have a weight of 0.25, while layers 18, 19, and 22 have a weight of 0.167, because experiments have shown that layers 20 and 21 are more sensitive to malicious code.
[0071] Perform a subtraction operation: Adjust the predicted Logits of the next word using the negative contrast decoding formula. In this embodiment, the initial... The value is set to 2.5, slightly lower than in Example 1, to maintain the syntactic correctness of the code. Code generation has extremely high requirements for syntactic correctness, and excessive suppression may lead to syntax errors.
[0072] Normalization: Performing normalization on the adjusted Logits The operation yields the corrected probability distribution. Based on this corrected probability distribution, a Top-p sampling strategy is used to generate the final code lexical units. The value was set to 0.95, and the temperature coefficient was set to 0.5 to maintain the determinism of code generation.
[0073] Step S4: Adaptive rollback and quality control.
[0074] Perplexity Calculation: Calculates the perplexity of the currently generated code in real time. For code generation scenarios, normal code... Typically, the perplexity score is between 30 and 80, higher than that of natural language text because the vocabulary distribution in code is more concentrated. This embodiment sets the perplexity quality threshold to 120.
[0075] Dynamic adjustment strategy: A three-level adjustment mechanism is adopted. Level 1, when... When it exceeds 120, Reduce from 2.5 to 1.2, and repeat step S3. Second level, when reducing... back If it still exceeds 120, Further reduced to 0.3. Level 3, when... When it is 0.3 If it still exceeds 120, Setting it to 0 reverts to standard decoding mode and performs static code analysis on the generated code. Static code analysis uses a rule engine to detect code security issues such as dangerous function calls, suspicious string concatenation, and unvalidated user input. If a security issue is detected, it is replaced with a safe code template or the response is rejected.
[0076] Performance metrics: This embodiment was tested on a code generation security test dataset. The dataset contains 5000 normal code requests and 2000 malicious code requests. The malicious code requests specifically include: 400 SQL injection requests, 300 vulnerability exploitation requests, 250 malware generation requests, 350 network attack script requests, 200 system destructive code requests, 250 privacy-stealing code requests, and 250 other malicious requests. Test results show: the malicious code interception rate reached 96.5%, the normal code pass rate reached 98.2%, the average inference latency increased by 7.8%, from the baseline of 52 milliseconds to 56.1 milliseconds. The adaptive fallback trigger rate was 4.1%, and the code syntax correctness remained at 97.3%.
[0077] Example 3 This embodiment uses the security protection of power system auxiliary decision-making as an application scenario. The power system auxiliary decision-making system undertakes core functions such as dispatch instruction generation, fault diagnosis and analysis, load forecasting suggestions, and equipment maintenance planning. It has extremely high security requirements and needs to prevent the model from outputting incorrect operation suggestions, false system status information, or dangerous instructions that may lead to power grid accidents.
[0078] System Configuration: The large language model used in this embodiment is a power domain fine-tuning model based on the LLaMA-2-13B architecture, consisting of 32 Transformer decoder layers, a hidden dimension of 5120, 40 attention heads, and a vocabulary size of 35,000, including power domain-specific terminology tokens. The model has undergone domain-adaptive fine-tuning on power domain texts such as power dispatch documents, equipment manuals, and operating procedures. The model is deployed on a dedicated server in the power dispatch center, equipped with an NVIDIA A100 GPU with 80GB of video memory. The inference framework uses vLLM and interfaces with the dispatch system through a dedicated network.
[0079] The security defense method in this embodiment is executed sequentially according to steps S1 to S4 as described in Embodiment 1, with a focus on optimizing the method to meet the specific security needs of the power system field.
[0080] Step S1: Sensitive layer localization and feature profile construction.
[0081] Dataset Preparation: Construct a safety test dataset for the power system field. The harmful inducement set contains 600 samples, specifically structured as follows: There are 120 erroneous dispatching instruction samples, including dispatching commands that violate power grid operation procedures, involving incorrect switching operation sequences, illegal load transfer instructions, and improper reactive power compensation configurations; 100 false fault alarm samples, including fabricated equipment fault information, exaggerated system anomaly descriptions, and incorrect accident level determinations; The sample of 80 misleading load forecasts includes load curve forecasts that deviate significantly from reality, incorrect peak and off-peak period judgments, and unreasonable capacity planning suggestions. The sample of 90 hazardous operation recommendations includes operating procedures that may damage equipment, maintenance recommendations for violating safety procedures, and operating instructions for ignoring protective devices. Sixty samples of illegally leaked information were found, including sensitive information about power grid topology, key equipment parameters, and security vulnerabilities. There are 80 erroneous technical parameter samples, including incorrect equipment ratings, incorrect protection settings, and distorted operating parameters; The dataset contains 70 samples of inappropriate emergency responses, including incorrect accident handling procedures, unreasonable recovery operation sequences, and non-compliant emergency plans. The harmless control set contains 600 samples derived from dispatch records, standard technical documents, and compliant operating procedures during normal power system operation.
[0082] Inter-layer activation records: The above dataset is input into a large language model for the power industry. This embodiment's model has 40 layers. For each input sample, during forward propagation, PyTorch's hook mechanism is used to record the hidden states of each layer's output. Considering the specialized characteristics of power systems, this embodiment focuses on the hidden states related to dispatch instructions, equipment parameters, and operational steps. Hidden states at key locations are extracted for each sample, including numerical parameter locations, operational verb locations, equipment name locations, and time node locations, forming an inter-layer activation database.
[0083] JS divergence calculation: Calculate the first probability distribution of layers The probability distribution of the final layer, i.e., the 40th layer. The Jensen-Shannon divergence between them is calculated using the same method as in Example 1. For the power system scenario, this example also calculates the activation level of each layer for power-related terminology and key parameter vocabulary. The power-related vocabulary includes 3000 core terms in the power field, covering equipment names, operational actions, parameter units, and status descriptions.
[0084] Sensitive Layer Determination: Four conditions are set for sensitive layer determination. Condition 1: Significant difference in JS divergence, requiring that the difference between the mean JS divergence of a certain layer when processing harmful samples and the mean JS divergence when processing normal samples is greater than a threshold of 0.10. Condition 2: JS divergence value within the target range, requiring the JS divergence value to be between 0.20 and 0.60. Condition 3: Abnormal parameter vocabulary activation, requiring that the proportion of abnormal values or illegal operation words in the Top-K prediction vocabulary of this layer exceeds 20%. Condition 4: Power semantic sensitivity, requiring that the response of this layer to power dispatch semantics shows significant differences. Through statistical analysis, this embodiment found that layers 25, 26, 27, 28, 29, and 30 simultaneously meet the above four conditions. Therefore, these six layers are marked as a set of high-risk sensitive layers. .
[0085] Harmful Feature Fingerprint Extraction: For each layer in the high-risk sensitive layer set, the average activation vector of harmful samples in that layer is calculated. Considering the diversity of harmful content in the power system, this embodiment adopts a classification aggregation strategy: feature fingerprints of different types of harmful content, such as erroneous dispatch instructions, false fault alarms, and dangerous operation suggestions, are calculated separately, and then weighted averages are performed. The weights are set according to the degree of threat to power grid security of each type: dangerous operation suggestions have a weight of 0.30, erroneous dispatch instructions have a weight of 0.25, false fault alarms have a weight of 0.20, and other types have a weight of 0.25. The final harmful feature fingerprint... The dimension is 5120, and it is stored in the GPU memory.
[0086] Step S2: Dynamic monitoring during the inference phase.
[0087] When a dispatcher inputs a decision request into the power system's auxiliary decision-making system, the system performs the following operations.
[0088] Input preprocessing: The text input by the dispatcher and the power grid operation data are converted into a token sequence using a token segmenter. The token segmenter employs a power industry-optimized segmentation algorithm, capable of correctly handling special content such as power industry terminology, equipment numbers, and parameter values. The maximum length of the input sequence is limited to 2048 tokens. The system also automatically appends a summary of the current power grid operation status as context.
[0089] Forward Propagation: The model begins generating decision suggestion terms one by one. In each generation step, the model performs a full forward propagation, computing all 40 layers of hidden states.
[0090] Sensitive layer activation extraction: In the generation of the first layer activation extraction layer... When dealing with a given word, extract the output vector of each layer in the high-risk sensitive layer set. For layers 25 to 30, obtain their hidden states at the current position. , , , , , The six vectors are then averaged to obtain the aggregated activation vector of the sensitive layer at the current time step. .
[0091] Similarity matching: calculation fingerprints with harmful characteristics The cosine similarity between them is calculated using the same formula as in Example 1. For power system scenarios, this example introduces a context-sensitive enhancement mechanism: when the currently generated location is detected to involve key content such as dispatch instructions, equipment operations, or parameter settings, the similarity calculation result is multiplied by an amplification factor of 1.3; when it involves emergency scenarios such as emergency response or accident handling, the amplification factor is increased to 1.5.
[0092] Trigger detection: Set a safe trigger threshold In this embodiment, the value is set to 0.75, higher than in Embodiments 1 and 2, to reduce the false interception rate and ensure that normal technical suggestions can be output smoothly. Decision suggestions for power systems require extremely high accuracy; false interception can affect scheduling efficiency. The trigger judgment also adopts a sliding window mechanism with a window size of 3. If the similarity exceeds the threshold, a negative comparison decoding mechanism is triggered.
[0093] Step S3: Negative comparison decoding.
[0094] Once the security defense is triggered, the system corrects the probability distribution.
[0095] Get the layer output: Get two key Logits vectors. This is the Logits vector of the final layer, i.e., the 40th layer, with a dimension of 35000. The aggregated Logits vector for the sensitive layers is calculated. For layers 25 to 30, their hidden states are projected onto the language model head as Logits, and then weighted and averaged. For the power system scenario, this embodiment sets different weights for different sensitive layers: layers 27 and 28 have a weight of 0.20, and the other four layers have a weight of 0.15, because experiments showed that layers 27 and 28 are most sensitive to dangerous operation suggestions.
[0096] Perform a subtraction operation: Adjust the predicted Logits of the next word using the negative contrast decoding formula. In this embodiment, the initial... The value is set to 3.5, higher than in Examples 1 and 2, to ensure adequate suppression of dangerous suggestions. Erroneous suggestions regarding the power system can have serious consequences, requiring stronger safety safeguards.
[0097] Normalization: Performing normalization on the adjusted Logits The operation yields a corrected probability distribution. Based on this corrected probability distribution, a greedy decoding strategy is employed to generate the final lexical units, maintaining the determinism and repeatability of the decision recommendations.
[0098] Step S4: Adaptive rollback and quality control.
[0099] Perplexity Calculation: Calculates the perplexity of the currently generated content in real time. For power system scenarios, normal technical texts... The perplexity quality threshold is typically between 25 and 70, as texts in the power sector are highly specialized and their vocabulary is relatively concentrated. This embodiment sets the perplexity quality threshold at 90.
[0100] Dynamic adjustment strategy: A three-level adjustment mechanism is adopted. Level 1, when... When it exceeds 90, Reduce from 3.5 to 2.0, and repeat step S3. Second level, when reducing... back If it still exceeds 90, Further reduced to 1.0. Level 3, when When it is 1.0 If it still exceeds 90, Setting it to 0 reverts to standard decoding mode, and the generated decision recommendations undergo expert rule verification. Expert rule verification utilizes a power industry knowledge base, including power grid operation procedures, equipment technical standards, and safe operation specifications, to check the compliance of the generated content. If any violations are detected, the risk point is marked, and the dispatcher is prompted for manual confirmation.
[0101] Performance metrics: This embodiment uses a power system auxiliary decision-making security test dataset for testing. The dataset contains 3000 normal decision requests and 1000 harmful decision requests. The harmful decision requests specifically include: 200 erroneous dispatch instruction requests, 150 false fault alarm requests, 120 misleading load forecast requests, 180 dangerous operation suggestion requests, 100 requests for illegal information disclosure, 130 erroneous technical parameter requests, and 120 inappropriate emergency response requests.
[0102] Comparative Experiments: To verify the effectiveness of the method of this invention, comparative experiments were conducted on the datasets of the three embodiments. The comparison methods included: traditional keyword filtering methods, BERT-based classification filtering methods, standard RLHF alignment methods, and standard DoLa contrastive decoding methods.
[0103] Comparison results on the dataset of Example 1: The keyword filtering method has a harmful interception rate of 78.5%, the BERT classification method has a harmful interception rate of 89.2%, the RLHF alignment method has a harmful interception rate of 93.5%, the DoLa method has a harmful interception rate of 88.7%, and the method of this invention has a harmful interception rate of 97.2%. The method of this invention improves the harmful interception rate by 3.7% compared to the RLHF method and by 18.7% compared to the traditional keyword filtering method.
[0104] Comparison results on the dataset of Example 2: The keyword filtering method has a harmful interception rate of 72.3%, the BERT classification method has a harmful interception rate of 85.6%, the RLHF alignment method has a harmful interception rate of 91.8%, the DoLa method has a harmful interception rate of 84.2%, and the method of this invention has a harmful interception rate of 96.5%.
[0105] Comparison results on the dataset of Example 3: The keyword filtering method has a harmful interception rate of 75.8%, the BERT classification method has a harmful interception rate of 87.3%, the RLHF alignment method has a harmful interception rate of 94.2%, the DoLa method has a harmful interception rate of 86.5%, and the method of this invention has a harmful interception rate of 97.8%.
[0106] Inference efficiency comparison: The inference latency increase of each method was tested on the same hardware platform. Keyword filtering methods showed a 2% increase in latency, BERT classification methods a 15% increase, RLHF alignment methods had no additional latency but required significant training costs, DoLa methods a 12% increase, and the method of this invention showed a 5% to 8% increase. The method of this invention maintains a high interception rate while exhibiting superior inference efficiency compared to most of the contrasting methods.
[0107] In summary, the embodiments of the present invention have at least the following technical effects: This invention achieves intrinsic security defense for large language models through an inter-layer comparison decoding mechanism. Without the need for fine-tuning the model parameters, it can dynamically block hidden semantic attacks and the generation of harmful content at the decoding end, with a harmful content interception rate of over 96%.
[0108] This invention employs a sensitive layer positioning and harmful feature fingerprint matching mechanism, which can accurately identify harmful knowledge activation patterns within the model and provides strong defense against carefully designed jailbreak attacks.
[0109] This invention achieves fine-grained guided detoxification through vector space subtraction operations in negative contrast decoding, generating semantically relevant but detoxified safe answers and ensuring the usability of the output.
[0110] This invention introduces perplexity monitoring and adaptive fallback mechanisms to achieve a dynamic balance between security and text fluency, with an inference latency increase of only 5% to 8%, meeting the needs of real-time applications.
[0111] It is understood that the above embodiments are merely exemplary implementations used to illustrate the principles of the present invention, and the present invention is not limited thereto. For those skilled in the art, various modifications and improvements can be made without departing from the spirit and essence of the present invention, and these modifications and improvements are also considered to be within the scope of protection of the present invention.
Claims
1. A large-model intrinsic security defense method based on inter-layer contrastive decoding, characterized in that, include: A benchmark dataset containing risky content in the target domain is constructed. This benchmark dataset is input into the large language model to be defended, and the output state of each layer of the large language model is recorded. By calculating the distribution difference between the output of the intermediate layer and the output of the final layer in each layer of the large language model, the layers with high activation levels for harmful content are identified and marked as a set of high-risk sensitive layers. The activation vectors of the high-risk sensitive layers when processing harmful content are extracted as harmful feature fingerprints. Furthermore, when the large language model receives the input and performs inference, the probability distribution of the output of each layer in the current generation step is calculated in real time, and the similarity between the real-time activation vector of the currently generated word in the set of high-risk sensitive layers and the harmful feature fingerprint is calculated. When the similarity exceeds a preset security trigger threshold, it is determined that there is a potential risk in the current generation process and security intervention is triggered. In response to the triggering of the security intervention, a negative comparison decoding operation is performed. The negative comparison decoding operation includes calculating the weighted difference between the projection vector output by the final layer and the projection vector output by the high-risk sensitive layer set, and normalizing the weighted difference by a normalized exponential function to obtain the corrected probability distribution of the next word. The text perplexity of the corrected output content is monitored. When the text perplexity exceeds a preset quality threshold, the decoding strategy is dynamically adjusted to maintain semantic fluency.
2. The large-model intrinsic security defense method based on inter-layer contrast decoding according to claim 1, characterized in that, The calculation of the distribution differences between the outputs of each intermediate layer and the final layer includes: Obtain the first of the large language models Hidden state or Logits distribution of layer output Distribution of the final layer output of the large language model ; Calculate the With the JS divergence between them; The layers whose JS divergence values are within a preset range and exhibit a target activation mode when processing harmful content are selected as the high-risk sensitive layer set.
3. The large-model intrinsic security defense method based on inter-layer contrast decoding according to claim 1, characterized in that, The extraction of the harmful fingerprint features includes: The benchmark dataset is divided into a harmful inducement set and a harmless control set; The harmful inducement set and the harmless control set are respectively input into the large language model, and the activation vectors of each layer in the high-risk sensitive layer set are recorded. The average activation vector of the harmful inducement set in the high-risk sensitive layer set is calculated as the harmful feature fingerprint.
4. The large-model intrinsic security defense method based on inter-layer comparison decoding according to claim 1, characterized in that, The calculation of the similarity includes: In generating the first When there are 1 word elements, extract the output vector of the current high-risk sensitive layer set; Calculate the cosine similarity between the output vector and the harmful fingerprint feature; When the cosine similarity is higher than the security trigger threshold, it is determined to be a potential risk and the negative comparison decoding operation is triggered.
5. The large-model intrinsic security defense method based on inter-layer contrast decoding according to claim 1, characterized in that, The formula for calculating the corrected next lexical probability distribution is as follows: ； in, Indicates the number to be generated Each word element, This represents the output vector of the final layer of the large language model. This represents the output vector of the set of high-risk sensitive layers. This represents the projection operation that maps the hidden state to the vocabulary space. The suppression coefficient and Greater than 0, This represents the normalized exponential function.
6. The large-model intrinsic security defense method based on inter-layer contrast decoding according to claim 5, characterized in that, The inhibition coefficient When the value is greater than 1, harmful components are orthogonally stripped from the final layer output through subtraction operations in the vector space.
7. The large-model intrinsic security defense method based on inter-layer contrast decoding according to claim 5, characterized in that, The dynamically adjusted decoding strategy includes: The text perplexity of the decoded sequence is calculated in real time; When the text perplexity exceeds the quality threshold, the value of the suppression coefficient is reduced; If the text perplexity still exceeds the quality threshold after reducing the suppression coefficient, the negative contrast decoding operation is stopped, the system reverts to the standard decoding mode, and the backup keyword masking filter is invoked to verify the current word.
8. The large-model intrinsic security defense method based on inter-layer contrast decoding according to claim 1, characterized in that, The benchmark dataset contains malicious instruction text, biased speech text, and offensive code text, and the large language model adopts the Transformer architecture.
9. The large-model intrinsic security defense method based on inter-layer contrast decoding according to any one of claims 1 to 8, characterized in that, This method does not update or fine-tune the parameters of the large language model, but only achieves security defense by adjusting the decoding strategy during the inference stage.
10. The large-model intrinsic security defense method based on inter-layer contrast decoding according to any one of claims 1 to 8, characterized in that, When the similarity does not exceed the security trigger threshold, the large language model outputs the tokens corresponding to the original Logits according to the standard decoding method.