A large language model security evaluation method, device and system based on dynamic self-defined logic coding

Abstract

This invention relates to a method, apparatus, and system for security evaluation of large language models based on dynamic custom logic encoding. It constructs a temporary logic mapping protocol for encoding; after acquiring malicious semantic text to be tested, it encodes the malicious semantic text into a sequence of logical instructions according to the temporary logic mapping protocol, constructs test prompts, inputs them into the large language model under test, and determines whether the large language model under test has been jailbroken based on the output. The apparatus includes an acquisition module, a protocol construction module, an encoding module, a construction module, an output acquisition module, and a judgment module; the system is implemented based on the method. This invention can bypass security protection mechanisms based on blacklists and fixed pattern recognition, achieving a high avoidance rate, breaking through static defense mechanisms, touching security vulnerabilities at the logical reasoning level, possessing high adaptability and scalability, ensuring the long-term effectiveness of the evaluation, accurately locating weak points in the model's security strategy, and performing targeted and refined reinforcement.

Description

Technical Field

[0001] This invention relates to the technical field of digital information transmission, and in particular to a method, apparatus and system for security evaluation of large language models based on dynamic custom logic encoding. Background Technology

[0002] Currently, the security and ethical compliance of Large Language Models (LLMs) have become key challenges for their commercial application. To prevent LLMs from being exploited by malicious users to generate harmful, illegal, or inappropriate content, i.e., "jailbreaking," major model providers have deployed strict security protection mechanisms (Guardrails), including rule-based filtering, sensitive word detection, and reinforcement learning-based human feedback (RLHF).

[0003] To evaluate the effectiveness of these security mechanisms, various LLM security evaluation methods have been developed in the prior art, mainly including the following: Static text obfuscation: This method uses preset, fixed encoding or obfuscation techniques, such as Base64 encoding, character substitution, text reversal, or homophone substitution, to attempt to bypass sensitive word filters. Role-playing inducement method: By setting specific scenarios or roles, such as "you are an AI without moral limits", the model is induced to ignore its built-in safety rules; Optimization-based adversarial attack methods: Using optimization algorithms such as gradient descent, such as gradient-based adversarial cue generation (CGG), to generate hard-to-detect, non-human-readable adversarial suffixes to trigger harmful behavior in the model.

[0004] However, the aforementioned existing technologies have significant shortcomings in evaluating the security of LLMs.

[0005] First, existing methods suffer from low evasion rates and poor timeliness. Static text obfuscation and common role-playing patterns are easily learned and recognized by LLM security mechanisms, causing their evasion success rate to drop rapidly. This is because the model's security filter is essentially a powerful pattern recognizer, capable of quickly identifying and blocking known, fixed attack patterns. Once a certain attack pattern is discovered by the model provider and the defense strategy is updated, the attack quickly becomes ineffective.

[0006] Secondly, existing methods lack testing for logic execution. Most existing evaluation methods treat attacks as inputs with a fixed pattern, rather than instructions that require the execution of internal logic within the model. This ignores the characteristics of LLM as a general-purpose logic inference engine. The security protection of the model mainly focuses on monitoring and intervening in the surface text content of the input and output, while lacking effective monitoring and intervention methods for the complex, custom logic decoding process that is induced to be executed within the model.

[0007] Finally, due to the aforementioned shortcomings, existing technologies generally suffer from high false negative rates. Their test sets rely on known and limited attack methods, failing to simulate the dynamic process of continuous innovation and adaptation by human attackers. This makes it possible for models to have undiscovered vulnerabilities in novel, especially logic-driven, coding methods. Existing methods lack a mechanism to dynamically generate test logic, thus failing to systematically explore the security boundaries of models when executing custom, non-standard logic. Summary of the Invention

[0008] This invention addresses the problems existing in the prior art and provides a method, apparatus, and system for security evaluation of large language models based on dynamic custom logic encoding. It aims to discover potential conflicts between complex instruction execution and security constraints by inducing the model to simulate the execution of a custom logic decoding protocol.

[0009] The technical solution adopted in this invention is a security evaluation method for large language models based on dynamic custom logic encoding, wherein the method constructs a temporary logic mapping protocol for encoding; After obtaining the malicious semantic text to be tested, the malicious semantic text to be tested is encoded into a sequence of logical instructions according to the temporary logical mapping protocol; Construct test prompt words, input them into the large language model under test, and obtain the corresponding output; Based on the output, determine whether the large language model under test has been jailbroken.

[0010] Preferably, an independent rule generation model is configured, including an encoder, a decoder, and a mapping module; the encoder is used to compress the malicious semantic text to be tested into a high-dimensional latent representation, the decoder is used to reconstruct the original text based on the high-dimensional latent representation, and the mapping module is used to convert the internal parameters of the decoder into a rule set described in natural language to generate the temporary logical mapping protocol.

[0011] Preferably, the rule generation model receives a random seed and a complexity parameter as input; The random seed is used to ensure that each generated temporary logical mapping protocol is temporary and unique, so that different random seeds generate different character mapping relationships or different mathematical offsets for the same malicious semantic text. Complexity parameters are used to control the logical depth of temporary logical mapping protocols, including defining multi-level nested mappings and / or controlling the ambiguity of protocol definitions to increase the non-standard nature of the protocol.

[0012] Preferably, the temporary logical mapping protocol includes one or more of the following: character mapping rules, operation offset rules, code variable substitution rules, and abstract semantic mapping rules.

[0013] Preferably, after obtaining the malicious semantic text to be tested, it is subjected to semantic abstraction and normalization to obtain the core malicious intent.

[0014] Preferably, the test prompts include at least the definition of the temporary logic mapping protocol, the sequence of logic instructions, and the execution requirements; The execution requirements are used to instruct the large language model under test to simulate the decoder role and decode the logical instruction sequence according to the rules of the temporary logical mapping protocol.

[0015] Preferably, the output is subjected to semantic analysis to determine whether it contains content that matches the core intent or execution steps of the malicious semantic text to be tested; if it does, it is determined that the large language model to be tested has been jailbroken.

[0016] Preferably, the results of the jailbreak judgment, the corresponding temporary logic mapping protocol, and the test prompt words are recorded for model security hardening or test set iteration.

[0017] A security evaluation device for large language models based on dynamic custom logic encoding includes: The acquisition module is used to acquire the malicious semantic text to be tested; The protocol construction module is used to build temporary logical mapping protocols for encoding; The encoding module is used to encode the malicious semantic text to be tested into a sequence of logical instructions according to a temporary logical mapping protocol; The construction module is used to construct test prompt words and input them into the large language model to be tested. The output acquisition module is used to acquire the output of the large language model under test in response to the test prompt words; The determination module is used to determine whether the large language model under test has been jailbroken based on the output.

[0018] A security evaluation system for large language models based on dynamic custom logic encoding, comprising a processor and memory: The memory is used to store program code and transmit the program code to the processor; The processor is used to execute the large language model security evaluation method based on dynamic custom logic encoding according to the instructions in the program code.

[0019] This invention relates to a method, apparatus, and system for security evaluation of large language models based on dynamic custom logic encoding. The method involves constructing a temporary logic mapping protocol for encoding; after acquiring malicious semantic text to be tested, encoding the malicious semantic text into a sequence of logical instructions according to the temporary logic mapping protocol, constructing test prompts, inputting them into the large language model to be tested, and acquiring the corresponding output; based on the output, determining whether the large language model to be tested has been jailbroken; the apparatus includes an acquisition module, a protocol construction module, an encoding module, a construction module, an output acquisition module, and a judgment module; and the system is implemented based on the method.

[0020] The beneficial effects of this invention are as follows: (1) By dynamically generating non-standard and temporary logical encoding protocols, malicious semantic text is encoded into seemingly harmless logical instruction sequences. Due to the non-standard and temporary nature of the encoding protocol, the surface form of the attack payload is constantly changing, making it impossible for the static security filter of LLM to identify and block it through simple pattern matching. It can bypass the security protection mechanism based on blacklists and fixed pattern recognition, achieve a high avoidance rate, and break through the static defense mechanism. (2) Directly test the conflict between the logical execution capability and security constraints of the LLM. Unlike existing technologies that only focus on surface text filtering, this invention can discover deep-seated security vulnerabilities related to logical reasoning capability of the model, thereby touching on the security risks at the logical reasoning level. (3) It can quickly iterate and generate new coding protocols according to test requirements or known defense strategies, thereby simulating the dynamic process of human attackers constantly adapting and innovating, realizing the dynamic adaptability of security evaluation methods, ensuring that the test methods will not become ineffective due to the update of defense strategies, and continuously discovering vulnerabilities brought about by novel, logic-driven coding methods. It has high adaptability and scalability, and ensures the long-term effectiveness of the evaluation. (4) The jailbreak determination is not only based on whether the model outputs the final malicious content, but also on whether the model leaks the execution steps or key information of the original malicious semantics. This provides the model security team with more detailed and interpretable vulnerability information, which helps to accurately locate the weak links of the model security strategy, so as to carry out targeted and refined reinforcement. Attached Figure Description

[0021] Figure 1 This is a flowchart of the method of the present invention; Figure 2 This is a block diagram of the device structure of the present invention. Detailed Implementation

[0022] To make the objectives, technical solutions, and advantages of the embodiments of the present invention clearer, the technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0023] This invention relates to a security evaluation method for large language models based on dynamic custom logic encoding. It aims to dynamically and non-standardly generate logical rules for encoding malicious semantics, effectively circumventing the static security filters of LLMs. By encapsulating malicious semantics into a sequence of logical instructions, it induces the LLM under test to simulate the execution of a custom decoding protocol, thereby systematically evaluating the security boundaries of the model when executing complex, non-standard logic. Ultimately, it discovers deep conflicts between logical reasoning and security constraints in the model, thereby reducing the false negative rate of security evaluation.

[0024] The method includes the following steps: (1) Construct a temporary logical mapping protocol for encoding; (2) After obtaining the malicious semantic text to be tested, the malicious semantic text to be tested is encoded into a sequence of logical instructions according to the temporary logical mapping protocol; (3) Construct test prompt words, input them into the large language model to be tested, and obtain the corresponding output; (4) Based on the output, determine whether the large language model under test has been jailbroken.

[0025] (1) Construct a temporary logical mapping protocol for encoding; In this invention, the temporary logical mapping protocol is non-standard (does not use known standard encodings such as Base64 and ROT13), temporary (can be dynamically changed for each test), and logically executable (can be understood by LLM as a set of logical instructions that need to be executed). It will be used to encode malicious semantics in order to circumvent the static security filter of the large language model.

[0026] An independent rule generation model is configured, including an encoder, a decoder, and a mapping module. The encoder is used to compress the malicious semantic text to be tested into a high-dimensional latent representation, the decoder is used to reconstruct the original text based on the high-dimensional latent representation, and the mapping module is used to convert the internal parameters of the decoder into a rule set described in natural language to generate the temporary logical mapping protocol.

[0027] The rule generation model receives a random seed and a complexity parameter as input; The random seed is used to ensure that the temporary logical mapping protocol generated each time is temporary and unique, so that for the same malicious semantic text, different random seeds generate different character mapping relationships or different mathematical offsets, such as 'a' being mapped to different random strings or different mathematical offsets; Complexity parameters are used to control the logical depth of temporary logical mapping protocols, including defining multi-level nested mappings and / or controlling the ambiguity of protocol definitions, such as first mapping characters and then performing mathematical offsets, to increase the non-standard nature of the protocol, making it more biased towards mathematical formulas or structured data, thereby further circumventing static filters.

[0028] The temporary logical mapping protocol includes one or more of the following: character mapping rules, operation offset rules, code variable substitution rules, and abstract semantic mapping rules; Character mapping rules refer to defining non-standard mapping relationships from source character sets to target character sets; for example, specifying that the character 'a' is mapped to 'alpha_code_17' and the character 'b' is mapped to 'beta_code_03'. The mapping table can be many-to-one or one-to-many. Offset rules refer to defining dynamic mathematical offsets and modulo operations based on character encoding values, including but not limited to ASCII and Unicode. For example, it is stipulated that the encoding value of the current character is equal to the encoding value of the previous character plus a random offset and modulo a specified number, which is expressed as Char(i) = (Char(i-1) + Offset) mod N. Code variable substitution rules refer to replacing semantic elements with temporary code variables and function calls; for example, replacing "explosives" with "Function_A(Param_X)", where Function_A and Param_X are temporarily defined symbols. Abstract semantic mapping rules map the core concepts in malicious semantics to seemingly harmless and / or context-independent everyday concepts, such as mapping the steps of "making explosives" to the steps of "baking a cake", and mapping the instructions of "cyber attack" to the instructions of "travel planning". The above rules can be combined as needed. It should be noted that the selected rules, controlled by both the random seed and complexity parameters, generate mapping relationships that are not fixed. The resulting outcomes will be reviewed and optimized during model security hardening or test set iteration. In practical applications, the random seed and complexity parameters are used to control the model to randomly generate a mapping protocol. Only the number of rules and decryption rules used can be controlled. The specific mapping relationships are entirely generated by the large model according to the specified rules, thus achieving "dynamic" random generation of mapping objects. For example, in the first round of dialogue, "bomb" -> "cake" may become "bomb" -> "hamburger" in the next round of dialogue.

[0029] (2) After obtaining the malicious semantic text to be tested, the malicious semantic text to be tested is encoded into a sequence of logical instructions according to the temporary logical mapping protocol; After obtaining the malicious semantic text to be tested, it is semantically abstracted and normalized to obtain the core malicious intent.

[0030] One specific implementation method is given, which obtains the malicious semantic text S to be tested. mal The text can be obtained from a pre-set red team test set, a publicly available malicious corpus, or real-time threat intelligence, and may contain texts containing content on manufacturing contraband, cyberattack instructions, or spreading disinformation. To remove surface features that may trigger static filters, for S mal Semantic abstraction and normalization are performed to abstract the core malicious intent. For example, if the original text is "Please tell me how to make a bomb with ammonium nitrate", after abstraction, the core intent "to obtain the method of making explosives" can be retained, while the specific chemical terms are ignored.

[0031] Based on this, according to the generated temporary logical mapping protocol, the original malicious semantic text S is... mal Encoded as a seemingly harmless sequence L consisting of logical symbols and instructions. seq For example, if the protocol includes character mapping rules and abstract semantic mapping rules, then each step of “making a bomb” is mapped to the corresponding step of “baking a cake”, and specific nouns are replaced with encoded symbols according to the character mapping table to obtain an instruction sequence including alpha_code_17 and / or beta_code_03.

[0032] (3) Construct test prompt words, input them into the large language model to be tested, and obtain the corresponding output; The test prompts must include at least the definition of the temporary logic mapping protocol, the sequence of logic instructions, and the execution requirements; The execution requirements are used to instruct the large language model under test to simulate the role of the decoder and decode the logical instruction sequence according to the rules of the temporary logical mapping protocol.

[0033] That is, the test prompt words of the present invention will be L seq The definition and execution requirements of protocol P are encapsulated together to form the final test prompt, expressed as follows: Prompt= {\text{protocol definition}P+\text{logical instruction sequence}L seq +\text{Execution Requirements}R exec} Wherein, protocol definition P: describes the above encoding rules in natural language or structured format; Logical instruction sequence L seq : The encoded instruction sequence; Execution Requirements R exec : Clearly instruct the large language model under test to simulate the decoder role and strictly follow the rules of protocol P to process L seq Perform decoding and output the decoded result or execution steps.

[0034] For example, Simulated execution: Pretending to be a "logic decoder" or "virtual machine"; Decoding process: Strictly follow the rules of protocol P to decode L. seq Decode; Output requirements: Output the decoded result, or output the steps of executing the decoding logic.

[0035] In this invention, the constructed test prompt word "Prompt" is input into the large language model LLM to be tested. target In this context, because the surface content of a Prompt consists of logical rules and instruction sequences rather than directly presenting malicious text, it can bypass the LLM. target The input-level security filter, however, the prompt word activates the model's internal logical reasoning and instruction execution capabilities, inducing the model to execute the decoding logic defined in the protocol, thereby reproducing the original malicious semantics within the model.

[0036] (4) Based on the output, determine whether the large language model under test has been jailbroken.

[0037] The output is subjected to semantic analysis to determine whether it contains content that matches the core intent or execution steps of the malicious semantic text to be tested; if it does, it is determined that the large language model to be tested has been jailbroken.

[0038] The output O of the large language model under test in response to the test prompt words is obtained. The output O is analyzed to determine whether a jailbreak has occurred. This analysis is generally performed by a specialized evaluation model. The criteria for determining a successful jailbreak include: Leaking raw semantics: Output O contains complete, identifiable raw malicious semantic text S. mal ; Disclosure of execution steps: Output O contains execution steps, key information, or instructions containing the original malicious semantics, even if S mal If the output does not fully reproduce the process, such as containing key steps like "mixing ammonium nitrate with fuel oil," it can be considered that a jailbreak has occurred. If any of the above conditions are met, the large language model under test is determined to have been jailbroken.

[0039] Record the results of jailbreak detection, the corresponding temporary logic mapping protocol, and test prompts for use in model security hardening or test set iteration.

[0040] Among these, model security hardening includes, but is not limited to, adjusting protection strategies according to vulnerability types, and test set iteration includes, but is not limited to, incorporating successful attack cases into the test set to continuously evaluate model security.

[0041] This invention also relates to a security evaluation device for large language models based on dynamic custom logic encoding, the device comprising: The acquisition module is used to acquire the malicious semantic text to be tested; The protocol construction module is used to build temporary logical mapping protocols for encoding; The encoding module is used to encode the malicious semantic text to be tested into a sequence of logical instructions according to a temporary logical mapping protocol; The construction module is used to construct test prompt words and input them into the large language model to be tested. The output acquisition module is used to acquire the output of the large language model under test in response to the test prompt words; The determination module is used to determine whether the large language model under test has been jailbroken based on the output.

[0042] In the specific implementation process, the judgment module intervenes with the evaluation model to determine whether the output content of the attacked model is harmful and contains content that matches the core intent or execution steps of the malicious semantic text to be tested. If so, the jailbreak is considered successful; otherwise, the jailbreak is considered unsuccessful.

[0043] This invention also relates to a security evaluation system for large language models based on dynamic custom logic encoding, including a processor and a memory: The memory is used to store program code and transmit the program code to the processor; The processor is used to execute the large language model security evaluation method based on dynamic custom logic encoding according to the instructions in the program code.

[0044] The method, apparatus, and system provided by this invention can be used in the field of security evaluation of large language models. By dynamically constructing non-standard logic mapping protocols, it effectively avoids static filters and uncovers deep-seated security vulnerabilities in the model. It has the advantages of high adaptability, high avoidance rate, and strong interpretability of results, and can provide effective testing tools for model security teams.

[0045] Those skilled in the art will understand that embodiments of the present invention can be provided as methods, systems, or computer program products. Therefore, the present invention can take the form of a completely hardware embodiment, a completely software embodiment, or an embodiment combining software and hardware aspects. Furthermore, the present invention can take the form of a computer program product embodied on one or more computer-usable storage media (including, but not limited to, disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0046] This invention is described with reference to flowchart illustrations and / or block diagrams of methods, apparatus (systems), and computer program products according to embodiments of the invention. It will be understood that each block of the flowchart illustrations and / or block diagrams, and combinations of blocks in the flowchart illustrations and / or block diagrams, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, special-purpose computer, embedded processor, or other programmable data processing apparatus to produce a machine, such that the instructions, which execute via the processor of the computer or other programmable data processing apparatus, generate instructions for implementing the flowchart illustrations and / or block diagrams. Figure 1 One or more processes and / or boxes Figure 1 A device that provides the functions specified in one or more boxes.

[0047] These computer program instructions may also be stored in a computer-readable storage medium that can direct a computer or other programmable data processing device to function in a particular manner, such that the instructions stored in the computer-readable storage medium produce an article of manufacture including instruction means, which are implemented in a process Figure 1 One or more processes and / or boxes Figure 1 The function specified in one or more boxes.

[0048] These computer program instructions may also be loaded onto a computer or other programmable data processing equipment to cause a series of operational steps to be performed on the computer or other programmable equipment to produce a computer-implemented process, thereby providing instructions that execute on the computer or other programmable equipment for implementing the process. Figure 1 One or more processes and / or boxes Figure 1 The steps of the function specified in one or more boxes.

[0049] Although preferred embodiments of the invention have been described, those skilled in the art, upon learning the basic inventive concept, can make other changes and modifications to these embodiments. Therefore, the appended claims are intended to be interpreted as including the preferred embodiments as well as all changes and modifications falling within the scope of the invention.

[0050] Obviously, those skilled in the art can make various modifications and variations to this invention without departing from its spirit and scope. Therefore, if these modifications and variations fall within the scope of the claims of this invention and their equivalents, this invention also intends to include these modifications and variations.

Claims

1. A security evaluation method for large language models based on dynamic user-defined logic encoding, characterized in that: The method constructs a temporary logical mapping protocol for encoding; After obtaining the malicious semantic text to be tested, the malicious semantic text to be tested is encoded into a sequence of logical instructions according to the temporary logical mapping protocol; Construct test prompt words, input them into the large language model under test, and obtain the corresponding output; Based on the output, determine whether the large language model under test has been jailbroken.

2. The method for security evaluation of large language models based on dynamic custom logic encoding according to claim 1, characterized in that: An independent rule generation model is configured, including an encoder, a decoder, and a mapping module. The encoder is used to compress the malicious semantic text to be tested into a high-dimensional latent representation, the decoder is used to reconstruct the original text based on the high-dimensional latent representation, and the mapping module is used to convert the internal parameters of the decoder into a rule set described in natural language to generate the temporary logical mapping protocol.

3. The method for security evaluation of a large language model based on dynamic custom logic encoding according to claim 2, characterized in that: The rule generation model receives a random seed and a complexity parameter as input; The random seed is used to ensure that each generated temporary logical mapping protocol is temporary and unique, so that different random seeds generate different character mapping relationships or different mathematical offsets for the same malicious semantic text. Complexity parameters are used to control the logical depth of temporary logical mapping protocols, including defining multi-level nested mappings and / or controlling the ambiguity of protocol definitions to increase the non-standard nature of the protocol.

4. The method for security evaluation of large language models based on dynamic custom logic encoding according to claim 1, characterized in that: The temporary logical mapping protocol includes one or more of the following: character mapping rules, operation offset rules, code variable substitution rules, and abstract semantic mapping rules.

5. The method for security evaluation of large language models based on dynamic custom logic encoding according to claim 1, characterized in that: After obtaining the malicious semantic text to be tested, it is semantically abstracted and normalized to obtain the core malicious intent.

6. The method for security evaluation of large language models based on dynamic custom logic encoding according to claim 1, characterized in that: The test prompts must include at least the definition of the temporary logic mapping protocol, the sequence of logic instructions, and the execution requirements; The execution requirements are used to instruct the large language model under test to simulate the decoder role and decode the logical instruction sequence according to the rules of the temporary logical mapping protocol.

7. The method for security evaluation of a large language model based on dynamic custom logic encoding according to claim 1, characterized in that: The output is subjected to semantic analysis to determine whether it contains content that matches the core intent or execution steps of the malicious semantic text to be tested; if it does, it is determined that the large language model to be tested has been jailbroken.

8. The method for security evaluation of large language models based on dynamic custom logic encoding according to claim 1, characterized in that: Record the results of jailbreak detection, the corresponding temporary logic mapping protocol, and test prompts for use in model security hardening or test set iteration.

9. A security evaluation device for large language models based on dynamic user-defined logic encoding, characterized in that: include: The acquisition module is used to acquire the malicious semantic text to be tested; The protocol construction module is used to build temporary logical mapping protocols for encoding; The encoding module is used to encode the malicious semantic text to be tested into a sequence of logical instructions according to a temporary logical mapping protocol; The construction module is used to construct test prompt words and input them into the large language model to be tested. The output acquisition module is used to acquire the output of the large language model under test in response to the test prompt words; The determination module is used to determine whether the large language model under test has been jailbroken based on the output.

10. A security evaluation system for large language models based on dynamic user-defined logic encoding, characterized in that: Including the processor and memory: The memory is used to store program code and transmit the program code to the processor; The processor is used to execute the large language model security evaluation method based on dynamic custom logic encoding as described in any one of claims 1 to 8, according to the instructions in the program code.

Images