Attack text generation method and device of text ranking model, text ranking method, storage medium and electronic equipment

Abstract

The application discloses an attack text generation method and device of a text ranking model, a text ranking method, a storage medium and an electronic device. The method comprises the following steps: acquiring a candidate document ranking queue output by a text ranking model for a query text; extracting a candidate document from the candidate document ranking queue to form multiple sets of training data by combining the candidate document with the query text; training an imitation model by using the training data; and generating attack text for a target document in the candidate document ranking queue by using the trained imitation model. According to the embodiment of the application, the two candidate documents in the ranking queue are used to form a set of training data together with the query text, the relative position information of the documents after ranking is used to train the imitation model, the imitation model can obtain more information through training, and the generated attack text is more effective for the text ranking model.

Description

Technical Field

[0001] This application relates to the field of text processing technology, and in particular to a text generation method and apparatus for attacking text sorting models, a text sorting method, a storage medium, and an electronic device. Background Technology

[0002] With the development of artificial intelligence (AI) technology, people can use AI-based search engines to quickly find the content they want from massive amounts of data. For example, text ranking systems are widely used tools to provide search services to users. In such systems, the system searches through a large number of documents to find relevant documents based on the user's query text. This query processing typically involves calculating the relevance of each document to the query text and ranking these documents according to relevance, then outputting the most relevant documents as candidate documents for the user to choose from.

[0003] In existing technologies, neural networks are widely used in text ranking systems due to their significant advantages in relevance calculation. Neural networks can continuously learn from historical query data and results to improve the accuracy of their candidate document output for user queries. However, neural networks inherently suffer from weakness in handling adversarial input documents. Therefore, even small changes or perturbations in the user's query text can lead to significant changes in the list of candidate documents output by the neural network. In other words, current text ranking systems using neural networks have deficiencies in robustness and reliability in calculating the similarity between user input and candidate documents. Therefore, a technical solution is needed to improve the adversarial resilience of text ranking systems to changes in input. Summary of the Invention

[0004] This application provides a text generation method and apparatus for attacking text in a text ranking model, a text ranking method, a storage medium, and an electronic device to address the shortcomings of existing text ranking models in terms of low robustness to query changes.

[0005] To achieve the above objectives, embodiments of this application provide a method for generating attack text using a text ranking model, comprising:

[0006] Obtain the candidate document sorting queue output by the text sorting model for the query text;

[0007] Candidate documents are extracted from the candidate document sorting queue to form multiple sets of training data with the candidate documents and the query text, wherein each set of training data includes two candidate documents in the candidate document sorting queue and the query text;

[0008] The training data is used to train the imitation model;

[0009] Using the trained imitation model, attack text is generated for the target documents in the candidate document sorting queue.

[0010] This application also provides a text sorting method, including:

[0011] Feature extraction is performed on the first query text to obtain a first feature vector for the first query text;

[0012] The first feature vector is input into the text ranking model to obtain a first document ranking queue for the first query text. The first document ranking queue contains at least one target document with inserted attack text. The first ranking of the target document in the first document ranking queue is not lower than the second ranking in the second document ranking queue. The second document ranking queue is the output of the text ranking model for the second query text. The similarity between the first query text and the second query text is higher than a preset threshold.

[0013] The attack text is generated in the following manner:

[0014] Obtain the candidate document sorting queue output by the text sorting model for the query text;

[0015] Candidate documents are extracted from the candidate document sorting queue to form multiple sets of training data with the candidate documents and the query text, wherein each set of training data includes two candidate documents in the candidate document sorting queue and the query text;

[0016] The training data is used to train the imitation model;

[0017] Using the trained mimicry model, attack text is generated targeting the target document.

[0018] This application also provides an attack text generation device for a text ranking model, including:

[0019] The acquisition module is used to acquire the candidate document sorting queue output by the text sorting model for the query text;

[0020] The training data generation module is used to extract candidate documents from the candidate document sorting queue, and to combine the candidate documents and the query text into multiple sets of training data, wherein each set of training data includes two candidate documents in the candidate document sorting queue and the query text;

[0021] The training module is used to train the imitation model using the training data;

[0022] The attack text generation module is used to generate attack text for target documents in the candidate document sorting queue using a trained imitation model.

[0023] This application also provides an electronic device, including:

[0024] Memory, used to store programs;

[0025] A processor is configured to run the program stored in the memory, wherein the program executes the attack text generation method or text sorting method of the text sorting model provided in the embodiments of this application.

[0026] This application also provides a computer-readable storage medium storing a computer program executable by a processor, wherein when the program is executed by the processor, it implements an attack text generation method or a text sorting method as provided in this application embodiment of the text sorting model.

[0027] The attack text generation method and apparatus, text sorting method, storage medium, and electronic device provided in this application's embodiments for a text sorting model extract candidate documents from the candidate document sorting queue of the text sorting model for the query text, and combine two candidate documents with the query text to form a training data set. The training data set is then used to train a mimicry model, and the trained mimicry model is used to generate attack text targeting target documents in the candidate document sorting queue. Since a pair of candidate documents in the sorting queue is used to form a training data set with the query text, the relative position information of the sorted documents can be used to train the mimicry model, enabling the mimicry model to acquire more information through training, and the generated attack text is more effective for the text sorting model.

[0028] The above description is only an overview of the technical solution of this application. In order to better understand the technical means of this application and to implement it in accordance with the contents of the specification, and to make the above and other objects, features and advantages of this application more obvious and understandable, the following are specific embodiments of this application. Attached Figure Description

[0029] Various other advantages and benefits will become apparent to those skilled in the art upon reading the following detailed description of preferred embodiments. The accompanying drawings are for illustrative purposes only and are not intended to limit the scope of this application. Furthermore, the same reference numerals denote the same parts throughout the drawings. In the drawings:

[0030] Figure 1 A schematic diagram illustrating an application scenario of the attack text generation scheme of the text ranking model provided in this application embodiment;

[0031] Figure 2 A flowchart of an embodiment of the attack text generation method for the text ranking model provided in this application;

[0032] Figure 3 A flowchart of another embodiment of the attack text generation method for the text ranking model provided in this application;

[0033] Figure 4 A schematic diagram of the structure of an embodiment of the attack text generation device for the text sorting model provided in this application;

[0034] Figure 5 A schematic diagram of the structure of an embodiment of the electronic device provided in this application. Detailed Implementation

[0035] Exemplary embodiments of the present disclosure will now be described in more detail with reference to the accompanying drawings. While exemplary embodiments of the present disclosure are shown in the drawings, it should be understood that the present disclosure may be implemented in various forms and should not be limited to the embodiments set forth herein. Rather, these embodiments are provided so that this disclosure will be thorough and complete, and will fully convey the scope of the disclosure to those skilled in the art.

[0036] Example 1

[0037] The solution provided in this application can be applied to any optimized system with text sorting capabilities, such as server systems including chips with text sorting functions and related components. Figure 1 This is a schematic diagram illustrating an application scenario of the attack text generation scheme provided in this application embodiment. Figure 1 The scenario shown is merely one example of the applicable technical solutions of this application.

[0038] With the development of artificial intelligence (AI) technology, people can use AI-based search engines to quickly find the content they want from massive amounts of data. For example, text ranking systems are widely used tools to provide search services to users. In such systems, the system searches through a large number of documents to find relevant documents based on the user's query text. This query processing typically involves calculating the relevance of each document to the query text and ranking these documents according to relevance, then outputting the most relevant documents as candidate documents for the user to choose from.

[0039] In existing technologies, neural networks are widely used in text ranking systems due to their significant advantages in relevance calculation. Neural networks can continuously learn from historical query data and results to improve the accuracy of their candidate document recommendations for user queries. However, neural networks inherently suffer from weakness in handling adversarial input documents. Therefore, even small changes or perturbations in the user's query text can lead to significant changes in the list of candidate documents output by the neural network. In other words, existing text ranking systems using neural networks have deficiencies in robustness and reliability in calculating the similarity between user input and candidate documents. Therefore, a technical solution is needed to improve the adversarial resilience of text ranking systems to changes in input.

[0040] Existing technologies have proposed attacking deep neural network-based text ranking systems by generating attack samples. For example, a white-box attack approach has been proposed, using a ranking model that scores relevance to a single document to generate attack text. This approach requires understanding the similarity calculation method or logical structure within the target ranking system to generate the attack text. The attack text is then inserted into the target document to form a new target document, and the ranking system calculates its similarity to the attack text, using this similarity as the ranking criterion for the new target document, thus improving its ranking. However, in real query results, the ranking of candidate documents generally considers the relationships between them. Therefore, the effectiveness of attack text generated by existing models based on single-document relevance scoring patterns in training the target model may be affected. While such attack text may improve the ranking of newly generated target documents when applied to the target model, the robustness and reliability of the target model when facing changes in real query requests remain unimproved.

[0041] Furthermore, in existing technologies, when using gradient information to guide the generation of attack text, it is necessary to understand information about the model, such as its architecture, hyperparameters, and training data. In other words, it requires a white-box approach to generate attack text. However, in practice, text ranking systems typically prohibit any form of white-box access. This means that the training system used to generate attack text is not allowed to know the internal information of the target ranking system. This makes existing white-box attack schemes unapplicable to real-world text ranking models, or even if such schemes are applied, they rarely achieve satisfactory attack results.

[0042] For example, in such Figure 1In the attack text generation scenario shown, a user can send a query request to various search engines or databases storing text, which can include the user-specified query text. Therefore, the search engine or database can retrieve results related to the user's query text, such as from a server storing a large number of documents. For example, as... Figure 1 As shown, a search engine or database text ranking system can first calculate the relevance between the user's input query text and various documents, and then rank the documents based on this calculated relevance. For example, the document with the highest relevance score can be ranked first in the ranking queue, the document with the second highest score can be ranked second, and so on, thus obtaining a candidate document ranking queue sorted by relevance to the user's input query text. This queue can then be output to the user as the query results for the user's input query text.

[0043] However, as mentioned above, since current text ranking systems use neural networks to determine similarity, they inevitably suffer from low robustness and reliability in response to changes in the user's query text due to the sensitivity of neural networks to input variations. Specifically, when a user obtains a list of candidate documents related to their query text and then slightly modifies the query text, even if such a modification is a typo or the meaning of the query text remains unchanged to a human, the inherent "vulnerability" of deep neural networks can lead to significant changes in the candidate text ranking results for that query text.

[0044] For example, in image recognition, making slight perturbations to the model's input—the image pixel values—doesn't change the actual classification of the image and is difficult for humans to detect, yet it may cause the model to misclassify the image. Similarly, in sentiment analysis of text, a misspelled word doesn't affect human comprehension or change their sentiment judgment, but the model might still misclassify it. These kinds of errors not only reduce user satisfaction with the system but can also have serious consequences, thus limiting the application of deep neural networks in scenarios with high security requirements.

[0045] Therefore, existing technologies have proposed using designed attack samples to cause errors in the ranking model's computational results, for example, in... Figure 1 In the scenario shown, the generated pre-defined text can be input into the ranking model to improve the ranking of the specified document x in the original candidate document ranking queue. Such text can then be used as attack text to train the ranking model, thereby improving the robustness and reliability of the neural network.

[0046] In the embodiments of this application, for example, Figure 1 In the scenario shown, a candidate document ranking queue, output by the ranking model in response to the user-input query text, can be obtained first. Within this queue, candidate documents can be ranked according to their relevance scores to the user-input query text, with the most relevant candidate document ranked first. According to embodiments of this application, candidate documents can be extracted from the ranking queue to form multiple sets of training data with the query text. Specifically, each set of training data may include two candidate documents from the ranking queue and the query text. In other words, unlike the prior art scheme that uses only one candidate document to generate attack text, this application embodiment uses two candidate documents from the ranking queue and the query text to form a training data set, thereby containing the ranking relationship between candidate documents in the ranking queue. For example, in... Figure 1 In the scenario shown, the candidate document sorting queue may contain 1,000 documents. Therefore, in this embodiment of the application, the documents are extracted from these 1,000 documents as described above.

[0047] In this embodiment, document extraction can be performed in the following ways: 1) Head extraction: Two documents are extracted from the first 1000 candidate documents in the sorted queue. For example, the 5th and 10th candidate documents from the first 300 candidate documents can be extracted to form training data together with the query text. In this training data, the two candidate documents have different sortings. 2) Random extraction: One candidate document is selected from the first 1000 candidate documents, and one candidate document is randomly selected from the next 1000 candidate documents to form another set of training data together with the query text. This process is repeated for each of the first 1000 candidate documents to form multiple sets of training data. For example, each candidate document from the first 300 candidate documents can be paired with a randomly selected candidate document from the remaining 700 candidate documents to form a candidate document pair, and each pair can be paired with the query text to form a training data set. Therefore, in this case, 300 sets of training data can be formed, each set consisting of one candidate document selected from the preceding candidate documents, one candidate document selected from the corresponding following candidate documents, and the query text. Thus, for both types of training data sets, each set contains the query text and two candidate documents ordered differently from each other in the candidate document sorting queue.

[0048] The generated training data can then be used to train the imitation model. For example, in this embodiment, the imitation model can be trained relative to the actual text ranking model. The imitation model can be constructed using a query document encoder, a relevance classifier, etc. Specifically, for example, the imitation model can use a BERT-based pre-trained model as a query document encoder to encode the user-input query text with a first candidate document in a set of training data, and the query text with a second candidate document in the same set of training data, respectively. The encoded query text-candidate document pairs are then passed through a relevance classifier. By calculating the relevance between the query text and the first candidate document, and the relevance between the query text and the second candidate document, the relationship between the relevance between the query text and the first candidate document and the relevance between the query text and the second candidate document is determined. For example, since the relevance between the query text and the first candidate document is determined to be greater than the relevance between the query text and the second candidate document when constructing the training data set, this can be used as the classification label to calculate the cross-entropy, and gradient descent can be used to iteratively optimize the imitation model.

[0049] Therefore, after training the imitation model as described above, the trained imitation model can be used to generate attack text targeting target documents in the candidate document ranking queue. Specifically, for example, in... Figure 1 In the scenario shown, the first candidate document in the ranking list output by the text ranking model for the user-input query text can be selected as the anchor document. In this embodiment, the anchor document can represent a document whose ranking is not affected by the attack text on the user-input query text; for example, the first-ranked candidate document can typically be selected as the anchor document. Then, one of the other candidate documents in the candidate document ranking list, excluding the anchor document, can be further selected as the target document. In this embodiment, the target document can be a document whose ranking would significantly improve under the attack text.

[0050] After identifying the target document, according to embodiments of this application, word vectors of a predetermined length can be randomly generated from a preset vocabulary. For example, a word vector Z of dimension (L, V) can be randomly initialized to represent an attack text of length L, with a vocabulary of search space V. Therefore, the word vector Z can be a vector representation of the attack text to be generated.

[0051] Therefore, the initialized word vectors Z, along with the anchor documents, target documents, and user-input query text selected above, can be input into the trained imitation model to calculate the word vector loss. For example, in this embodiment, the relative relevance loss Loss 1 of the word vectors Z can be calculated separately. A pre-trained language model is used to calculate the fluency loss of the attack text represented by word vectors Z. Furthermore, a pre-trained BERT model can be used to calculate the semantic relevance loss between the attack text represented by word vectors Z and the target document.

[0052] Therefore, after obtaining the aforementioned loss values, these loss values ​​can be used as search constraints for the generated word vector z in the search space to generate attack text. In this embodiment, the calculation process of the attack text can be repeated iteratively. After each round of calculation to obtain the attack text, the relevance between the new target document and the query text after the attack text is added to the target document can be calculated, and it can be determined whether the relevance improves the ranking of the new target document in the candidate document ranking queue. If it is determined that the generated attack text improves the ranking of the new target document, then the attack text can be determined to be a valid attack text for the text ranking model.

[0053] If the relevance between the new target document and the query text calculated as described above does not improve the ranking of the new target document in the candidate document ranking queue, then the attack text generated in this round is invalid. Therefore, it can be first determined whether the predetermined number of iterations has been reached. If the predetermined number of iterations has been reached, the attack text can still be retained, for example, as a historical record of the calculation. If the predetermined number of iterations has not been reached, the attack text generation process described above can be repeated.

[0054] Furthermore, once valid attack text has been identified, the attack text can be further migrated in this embodiment of the application, such as... Figure 1 In the scenario shown, the attack text generated by the mimicry model can be transferred to the text ranking model. For example, the generated attack text can be inserted into the target document whose ranking has been improved, and the ranking of the target document in the candidate document ranking queue can be improved to the new ranking calculated above.

[0055] Therefore, according to the attack text generation scheme of the text ranking model in this application embodiment, by extracting candidate documents from the candidate document ranking queue of the text ranking model for the query text, two candidate documents and the query text are combined to form a training data set, thereby using the training data set to train the imitation model, and using the trained imitation model to generate attack text for the target documents in the candidate document ranking queue. Since the pair of candidate documents in the ranking queue are used to form a set of training data together with the query text, the relative position information of the ranked documents can be used to train the imitation model, so that the imitation model can obtain more information through training, and the generated attack text can be more effective for the text ranking model.

[0056] The above embodiments illustrate the technical principles and exemplary application framework of the embodiments of this application. The specific technical solutions of the embodiments of this application will be further described in detail below through multiple embodiments.

[0057] Example 2

[0058] Figure 2 This is a flowchart of an embodiment of the attack text generation method for the text sorting model provided in this application. The execution subject of this method can be various terminal or server devices with text sorting capabilities, or it can be a device or chip integrated on these devices. Figure 2 As shown, the attack text generation method of this text ranking model includes the following steps:

[0059] S201, Obtain the candidate document sorting queue output by the text sorting model for the query text.

[0060] In step S201, the candidate document ranking queue output by the target text ranking model for a specific query text can be obtained. For example, in practical use, a user can send a query request to various search engines or databases storing text, and the query request can include the query text specified by the user. Therefore, the search engine or database can retrieve results related to the user's query text, such as from a server storing a large number of documents.

[0061] For example, such as Figure 1As shown, a search engine or database text ranking system can first calculate the relevance between the user's input query text and various documents, and then rank the documents based on this calculated relevance. For example, the document with the highest relevance score can be ranked first in the ranking queue, the document with the second highest score can be ranked second, and so on, thus obtaining a candidate document ranking queue sorted by relevance to the user's input query text. This queue can then be output to the user as the query results for the user's input query text.

[0062] Therefore, in step S201, the generated candidate document sorting queue can be obtained from such a text sorting model as the basis for generating attack text.

[0063] S202, Extract candidate documents from the candidate document sorting queue to form multiple sets of training data with the candidate documents and query text.

[0064] In step S202, training data can be constructed based on the candidate document list obtained in step S201. For example, two candidate documents can be extracted from the candidate document ranking queue to form a triple with the query text. This training data triple can include two candidate documents with different ranking positions to ensure that the training data contains the ranking relationship between candidate documents in the ranking queue. Therefore, when training the imitation model using such training data, the imitation model can be made closer to the text ranking model, thereby making the attack text generated by the imitation model trained in this way more effective.

[0065] S203 uses training data to train a mimicry model.

[0066] In step S203, the multiple sets of training data generated in step S202 can be used to train the imitation model. In this embodiment, the imitation model may include a query document encoder and a relevance classifier. For example, the imitation model can use a BERT-based pre-trained model as a query document encoder to encode the query text and each candidate document in each set of training data generated in step S202, thereby using two encoded query text-candidate document pairs as a set of training data to train the imitation model.

[0067] S204 uses a trained imitation model to generate attack text for target documents in the candidate document sorting queue.

[0068] In this embodiment of the application, in step S204, any document in the candidate document ranking queue obtained in step S201 can be selected as the target document, and the mimicry model trained in step S203 is used to generate attack text targeting the target document. For example, the attack text can be generated by using the mimicry model with word vectors generated from an arbitrary vocabulary, and the corresponding attack text can be generated based on the word vectors through search processing based on various constraints.

[0069] After generating the attack text, it can be directly inserted into the target document to complete the migration of the attack text, or the validity of the attack text can be verified first, and then the verified attack text can be migrated into the text ranking model.

[0070] Therefore, the attack text generation method of the text ranking model according to the embodiments of this application extracts candidate documents from the candidate document ranking queue of the text ranking model for the query text, and forms a training data set with the query text using the two candidate documents. The training data set is then used to train the imitation model, and the trained imitation model is used to generate attack text for the target documents in the candidate document ranking queue. Since the pair of candidate documents in the ranking queue is used to form a training data set with the query text, the relative position information of the ranked documents can be used to train the imitation model, enabling the imitation model to acquire more information through training, and the generated attack text is more effective for the text ranking model.

[0071] Example 3

[0072] Figure 3 A flowchart of another embodiment of the attack text generation method provided in this application is shown. The execution subject of this method can be various terminal or server devices with text sorting capabilities, or it can be a device or chip integrated on these devices. Figure 3 As shown above, in the above Figure 2 Based on the illustrated embodiments, the attack text generation method provided in this application may include the following steps:

[0073] S301, Obtain the candidate document sorting queue output by the text sorting model for the query text.

[0074] In step S301, the candidate document ranking queue output by the target text ranking model for a specific query text can be obtained. For example, in practical use, a user can send a query request to various search engines or databases storing text, and the query request may include the query text specified by the user. Therefore, the search engine or database can retrieve results related to the user's query text, such as from a server storing a large number of documents.

[0075] For example, such as Figure 1 As shown, a search engine or database text ranking system can first calculate the relevance between the user's input query text and various documents, and then rank the documents based on this calculated relevance. For example, the document with the highest relevance score can be ranked first in the ranking queue, the document with the second highest score can be ranked second, and so on, thus obtaining a candidate document ranking queue sorted by relevance to the user's input query text. This queue can then be output to the user as the query results for the user's input query text.

[0076] Therefore, in step S301, the generated candidate document sorting queue can be obtained from such a text sorting model as the basis for generating attack text.

[0077] S302, Extract candidate documents from the candidate document sorting queue to form multiple sets of training data with the candidate documents and the query text.

[0078] In step S302, training data can be constructed based on the candidate document list obtained in step S301. For example, in step S302, two candidate documents can be extracted from the candidate document ranking queue to form a triple with the query text, serving as the training data set. This training data set can include two candidate documents with different ranking positions to ensure that the training data contains the ranking relationship between candidate documents in the ranking queue. Therefore, when training the imitation model using such training data, the imitation model can be made closer to the text ranking model, thereby making the attack text generated by the imitation model trained in this way more effective.

[0079] In other words, unlike the prior art scheme that uses only one candidate document to generate attack text, in this embodiment, two candidate documents in the sorting queue can be used together with the query text to form a training data set. This training data set can then contain the sorting relationship between the candidate documents in the sorting queue. For example, in this embodiment, the multiple sets of training data obtained in step S302 can include two types of training data sets: a first training data set, which may include a first candidate document and a second candidate document selected from the front candidate document group at the beginning of the candidate document sorting queue, and the query text; and a second training data set, which may include the query text, a candidate document selected from the front candidate document group, and a candidate document randomly selected from the back candidate document group at the end of the candidate document sorting queue.

[0080] For example, such as Figure 1As shown, when the candidate document sorting queue contains 1000 documents, two documents can be extracted from the first 1000 candidate documents based on their sorting order. For example, the 5th and 10th candidate documents from the top 300 can be extracted to form the first training data set together with the query text. Similarly, a candidate document can be selected from the first 1000 candidate documents, and a candidate document can be randomly selected from the next 1000 candidate documents to form the second training data set together with the query text. This process can be repeated for each of the first 1000 candidate documents to form multiple second training data sets.

[0081] For example, each of the first 300 candidate documents can be paired with a randomly selected candidate document from the remaining 700 candidate documents to form a candidate document pair, and each pair, along with the query text, forms a second training data set. Therefore, in this case, 300 second training data sets can be formed, each consisting of one candidate document from the first set, a corresponding candidate document selected from the following set, and the query text. Thus, both the first and second training data sets formed in this way contain the query text and two candidate documents ordered differently from each other in the candidate document sorting queue.

[0082] S303, combine the query text from each group of training data with two candidate documents to form the first query pair and the second query pair, respectively.

[0083] In this embodiment, the training data set generated in step S302 can be used to train the mimicry model. The mimicry model can be constructed using a query document encoder, a relevance classifier, etc. For example, the mimicry model can use a BERT-based pre-trained model as a query document encoder. Furthermore, in step S303, the query text in the training data set generated in step S302 is first paired with two candidate documents to form a first query pair and a second query pair, respectively.

[0084] S304, use the imitation model to calculate the relevance between the query text and the candidate text in the first query pair and the second query pair respectively, so as to obtain the first query relevance of the first query pair and the second query relevance of the second query pair.

[0085] Therefore, in step S304, the mimicry model can be used to calculate the two query pairs generated in step S303. For example, a query document encoder can be used to encode the first and second query pairs, and then the two encoded pairs are passed through a relevance classifier. By calculating the relevance between the query text and the candidate documents in each query pair, the relationship between the relevance of the query text to the top-ranked candidate documents and the relevance between the query text and the bottom-ranked candidate documents in these two query pairs can be determined.

[0086] S305, the imitation model is trained using the fact that the relevance of the first query is higher than that of the second query as the true label of the training data.

[0087] In step S305, since it was determined above, when constructing the training data sets, that the relevance between the query text and the top-ranked candidate documents in each training data set is greater than the relevance between the query text and the bottom-ranked candidate documents, this can be used as a classification label to train the imitation model. For example, this label can be used to calculate the cross-entropy, and gradient descent can be used to iteratively optimize the imitation model.

[0088] The generated training data can then be used to train the imitation model. For example, in this embodiment, the imitation model can be trained relative to the actual text ranking model. The imitation model can be constructed using a query document encoder, a relevance classifier, etc. Specifically, for example, the imitation model can use a BERT-based pre-trained model as a query document encoder to encode the user-input query text with a first candidate document in a set of training data, and the query text with a second candidate document in the same set of training data, respectively. The encoded query text-candidate document pairs are then passed through a relevance classifier. By calculating the relevance between the query text and the first candidate document, and the relevance between the query text and the second candidate document, the relationship between the relevance between the query text and the first candidate document and the relevance between the query text and the second candidate document is determined. For example, since the relevance between the query text and the first candidate document is determined to be greater than the relevance between the query text and the second candidate document when constructing the training data set, this can be used as the classification label to calculate the cross-entropy, and gradient descent can be used to iteratively optimize the imitation model.

[0089] S306, select the candidate document that ranks first in the candidate document ranking model as the first document, and select one of the other candidate documents besides the first document as the target document.

[0090] The mimicry model trained in steps S303-S305 can be used to generate attack text. For example, in step S306, the first candidate document in the ranking list output by the text ranking model for the user-input query text can be selected as the anchor document. In this embodiment, the anchor document can represent a document whose ranking for the user-input query text is not affected by the attack text; for example, the first-ranked candidate document can typically be selected as the anchor document. Then, one of the other candidate documents in the candidate document ranking list, excluding the anchor document, is selected as the target document. In this embodiment, the target document can be a document whose ranking would significantly improve under the attack text.

[0091] S307, randomly generate word vectors of a predetermined length from a preset vocabulary.

[0092] After the target document is determined in step S306, according to the embodiments of this application, in step S307, word vectors of a predetermined length can be randomly generated from a preset vocabulary. For example, in step S307, a word vector Z with dimension (L, V) can be randomly initialized, representing an attack text of length L, with a vocabulary of search space V. Therefore, the word vector Z can be a vector representation of the attack text to be generated.

[0093] S308 uses the trained imitation model to calculate the loss of word vectors based on word vectors, target document, first document, and query text.

[0094] In step S308, the initialized word vectors Z, along with the anchor document, target document, and user-input query text selected above, can be input into the trained imitation model obtained in step S305 to calculate the loss of the word vectors. For example, in this embodiment, the relative relevance loss of the word vectors Z can be calculated separately in step S308. The fluency loss of the attack text represented by the word vectors Z can be calculated using a pre-trained language model. Alternatively, a pre-trained BERT model can be used to calculate the semantic relevance loss between the attack text represented by the word vectors Z and the target document.

[0095] S309 uses the loss amount as a constraint to determine the attack text through word vector-based search.

[0096] In step S309, the loss obtained in step S308 can be used as a search constraint in the search space for the word vectors generated in step S307 to generate the attack text.

[0097] S310, Add the attack text to the target document and calculate the relevance between the target document and the query text after inserting the attack text.

[0098] S311, determine the new ranking of the target document in the candidate document ranking model after inserting the attack text based on the relevance.

[0099] After the attack text is determined in step S309, in step S310, the attack text determined in step S309 can be inserted into the target document selected in step S306 to generate a new target document, and the relevance between the new target document and the query text can be calculated. In step S311, the new ranking of the new target document with the attack text determined in step S309 in the candidate document ranking queue can be determined based on this relevance.

[0100] Therefore, when the new ranking is higher than the original ranking of the target document selected in step S306 in the candidate document ranking model, the attack text determined in step S309 is used as the attack text against the target document selected in step S306.

[0101] If the relevance between the new target document and the query text calculated as described above does not improve the ranking of the new target document in the candidate document ranking queue, then the attack text generated in this round is invalid. Therefore, it can be first determined whether the predetermined number of iterations has been reached. If the predetermined number of iterations has been reached, the attack text can still be retained, for example, as a historical record of the calculation. If the predetermined number of iterations has not been reached, the attack text generation process described above can be repeated.

[0102] S312, the new ranking is used as the ranking of the target document with inserted attack text in the candidate document ranking model.

[0103] After the valid attack text is determined in step S311, the attack text can be further migrated in step S312, i.e., as follows: Figure 1 In the scenario shown, the attack text generated by the mimicry model can be transferred to the text ranking model. For example, the generated attack text can be inserted into the target document whose ranking has been improved, and the ranking of the target document in the candidate document ranking queue can be improved to the new ranking calculated above.

[0104] Therefore, the attack text generation method of the text ranking model according to the embodiments of this application extracts candidate documents from the candidate document ranking queue of the text ranking model for the query text, and forms a training data set with the query text using the two candidate documents. The training data set is then used to train the imitation model, and the trained imitation model is used to generate attack text for the target documents in the candidate document ranking queue. Since the pair of candidate documents in the ranking queue is used to form a training data set with the query text, the relative position information of the ranked documents can be used to train the imitation model, enabling the imitation model to acquire more information through training, and the generated attack text is more effective for the text ranking model.

[0105] Example 4

[0106] Figure 4 A schematic diagram of an embodiment of the attack text generation apparatus for the text ranking model provided in this application is shown, which can be used to execute... Figure 2 or Figure 3 The text ranking model shown is used to attack text generation methods. For example... Figure 4 As shown, the attack text generation device of the text ranking model may include: acquisition module 41, training data generation module 42, training module 43 and attack text generation module 44.

[0107] The acquisition module 41 can be used to acquire the candidate document sorting queue output by the text sorting model for the query text.

[0108] The acquisition module 41 can acquire the candidate document ranking queue output by the target text ranking model for a specific query text. For example, in practical use, a user can send a query request to various search engines or databases storing text, and the query request can include the query text specified by the user. Therefore, the search engine or database can retrieve results related to the user's query text, such as from a server storing a large number of documents.

[0109] For example, such as Figure 1 As shown, a search engine or database text ranking system can first calculate the relevance between the user's input query text and various documents, and then rank the documents based on this calculated relevance. For example, the document with the highest relevance score can be ranked first in the ranking queue, the document with the second highest score can be ranked second, and so on, thus obtaining a candidate document ranking queue sorted by relevance to the user's input query text. This queue can then be output to the user as the query results for the user's input query text.

[0110] Therefore, the acquisition module 41 can obtain the generated candidate document sorting queue from such a text sorting model as the basis for generating attack text.

[0111] The training data generation module 42 can be used to extract candidate documents from the candidate document sorting queue, so as to combine the candidate documents with the query text to form multiple sets of training data.

[0112] The training data generation module 42 can construct training data based on the candidate document list obtained by the acquisition module 41. For example, two candidate documents can be extracted from the candidate document ranking queue to form a triple with the query text. This training data triple can include two candidate documents with different ranking positions to ensure that the training data contains the ranking relationship between candidate documents in the ranking queue. Therefore, when training the imitation model using such training data, the imitation model can be made closer to the text ranking model, thereby making the attack text generated by the imitation model trained in this way more effective.

[0113] Training module 43 can be used to train a mimicry model using training data.

[0114] The training module 43 can use multiple sets of training data generated by the training data generation module 42 to train the imitation model. In this embodiment, the imitation model may include a query document encoder and a relevance classifier. For example, the imitation model can use a BERT-based pre-trained model as a query document encoder to encode the query text and each candidate document in each set of training data generated in step S202, thereby using two encoded query text-candidate document pairs as a set of training data to train the imitation model.

[0115] For example, training module 43 can first form a first query pair and a second query pair by combining the query text from each set of training data with two candidate documents. Then, a mimicry model can be used to calculate the relevance between the query text and the candidate text in the first and second query pairs, respectively, to obtain the first query relevance of the first query pair and the second query relevance of the second query pair. For example, training module 43 can use this mimicry model to calculate the relevance of the generated first and second query pairs. For example, a query document encoder can be used to encode the first and second query pairs, and then the two encoded pairs can be passed through a relevance classifier. By calculating the relevance between the query text and the candidate documents in each query pair, the relationship between the relevance of the query text to the top-ranked candidate documents and the relevance between the query text and the bottom-ranked candidate documents in these two query pairs can be determined. Then, training module 43 can train the mimicry model with the first query relevance being higher than the second query relevance as the true label for this set of training data.

[0116] Specifically, since it was determined above, when constructing the training data sets, that the relevance between the query text and the top-ranked candidate documents in each training data set is greater than the relevance between the query text and the bottom-ranked candidate documents, the training module 43 can use this as a classification label to train the imitation model. For example, this label can be used to calculate the cross-entropy and gradient descent can be used to iteratively optimize the imitation model.

[0117] The attack text generation module 44 can be used to generate attack text for target documents in the candidate document sorting queue using a trained imitation model.

[0118] In this embodiment, the attack text generation module 44 can select any document from the candidate document ranking queue obtained by the acquisition module 41 as the target document, and use the mimicry model trained by the training module 43 to generate attack text targeting the target document. For example, the attack text can be generated using word vectors generated from any vocabulary using the mimicry model, and the corresponding attack text can be generated based on the word vectors through search processing based on various constraints.

[0119] For example, the attack text generation module 44 can select the first-ranked candidate document in the candidate document ranking model obtained by the acquisition module 41 as the first document, and select one of the other candidate documents besides the first document as the target document. Then, the mimicry model trained by the training module 43 is used to generate the attack text. For example, the attack text generation module 44 can select the first-ranked candidate document in the ranking list output by the text ranking model for the user-input query text as the anchor document. In this embodiment, the anchor document can represent a document whose ranking for the user-input query text is not affected by the attack text; for example, the first-ranked candidate document can typically be selected as the anchor document. Then, one of the other candidate documents in the candidate document ranking list besides the anchor document is selected as the target document. In this embodiment, the target document can be a document whose ranking will be significantly improved under the attack text. Then, word vectors of a predetermined length can be randomly generated from a preset vocabulary. For example, the attack text generation module 44 can randomly initialize a word vector Z of dimension (L, V), representing an attack text of length L, with a vocabulary of search space V. Therefore, the word vector Z can be a vector representation of the attack text to be generated. Using the mimicry model trained by training module 43, the loss of the word vectors is calculated based on the word vectors, the target document, the first document, and the query text. Therefore, the word vector Z initialized in this way, along with the anchor document, the target document, and the user-input query text selected above, can be input into the trained mimicry model to calculate the loss of the word vectors. For example, in this embodiment, the relative relevance loss of the word vector Z is calculated separately. A pre-trained language model is used to calculate the fluency loss of the attack text constructed from the word vector Z. A pre-trained BERT model can also be used to calculate the semantic relevance loss between the attack text represented by the word vector Z and the target document. Finally, the obtained loss can be used as a search constraint for the generated word vectors in the search space to generate the attack text.

[0120] After identifying the attack text, it can be inserted into the selected target document to generate a new target document. The relevance between the new target document and the query text is then calculated, allowing the new ranking of the target document with the inserted attack text in the candidate document ranking queue to be determined based on this relevance. For example, if the new ranking is higher than the original ranking of the selected target document in the candidate document ranking model, the identified attack text is used as the attack text against the selected target document.

[0121] If the relevance between the new target document and the query text calculated as described above does not improve the ranking of the new target document in the candidate document ranking queue, then the attack text generated in this round is invalid. Therefore, it can be first determined whether the predetermined number of iterations has been reached. If the predetermined number of iterations has been reached, the attack text can still be retained, for example, as a historical record of the calculation. If the predetermined number of iterations has not been reached, the attack text generation process described above can be repeated.

[0122] Furthermore, the attack text generation apparatus of this application embodiment may further include: a migration module, which can be used to insert attack text into a target document and use the new ranking as the ranking of the target document with the inserted attack text in the candidate document ranking model.

[0123] Therefore, in this embodiment of the application, after the attack text generation module 44 generates the attack text, the migration module 45 can directly insert the attack text into the target document to complete the migration of the attack text, or it can first verify the validity of the attack text and then migrate the verified attack text into the text sorting model.

[0124] Therefore, the attack text generation apparatus of the text ranking model according to the embodiments of this application extracts candidate documents from the candidate document ranking queue of the text ranking model for the query text, and forms a training data set with the query text using the two candidate documents. The training data set is then used to train the imitation model, and the trained imitation model is used to generate attack text for the target documents in the candidate document ranking queue. Since the pair of candidate documents in the ranking queue is used to form a training data set with the query text, the relative position information of the ranked documents can be used to train the imitation model, enabling the imitation model to acquire more information through training, and the generated attack text is more effective for the text ranking model.

[0125] Example 5

[0126] The above describes the internal functions and structure of the attack text generation device of the text ranking model, which can be implemented as an electronic device. Figure 5 A schematic diagram illustrating the structure of an embodiment of the electronic device provided in this application. (See attached diagram.) Figure 5 As shown, the electronic device includes a memory 51 and a processor 52.

[0127] Memory 51 is used to store programs. In addition to the programs described above, memory 51 can also be configured to store various other data to support operation on the electronic device. Examples of this data include instructions for any application or method used to operate on the electronic device, contact data, phonebook data, messages, pictures, videos, etc.

[0128] The memory 51 can be implemented by any type of volatile or non-volatile storage device or a combination thereof, such as static random access memory (SRAM), electrically erasable programmable read-only memory (EEPROM), erasable programmable read-only memory (EPROM), programmable read-only memory (PROM), read-only memory (ROM), magnetic storage, flash memory, magnetic disk or optical disk.

[0129] Processor 52 is not limited to a processor (CPU), but may also be a graphics processing unit (GPU), a field-programmable gate array (FPGA), an embedded neural network processor (NPU), or an artificial intelligence (AI) chip. Processor 52 is coupled to memory 51 and executes the program stored in memory 51 to perform the attack text generation method of the text sorting model in Embodiments 2 or 3 described above.

[0130] Furthermore, such as Figure 5 As shown, the electronic device may also include other components such as a communication component 53, a power supply component 54, an audio component 55, and a display 56. Figure 5 The diagram only shows some components and does not mean that the electronic device includes only these components. Figure 5 The components shown.

[0131] Communication component 53 is configured to facilitate wired or wireless communication between electronic devices and other devices. The electronic devices can access wireless networks based on communication standards, such as WiFi, 2G, 3G, 4G / LTE, 5G, and other mobile communication networks, or combinations thereof. In one exemplary embodiment, communication component 53 receives broadcast signals or broadcast-related information from an external broadcast management system via a broadcast channel. In one exemplary embodiment, communication component 53 also includes a near-field communication (NFC) module to facilitate short-range communication. For example, the NFC module may be implemented based on radio frequency identification (RFID) technology, Infrared Data Association (IrDA) technology, ultra-wideband (UWB) technology, Bluetooth (BT) technology, and other technologies.

[0132] Power supply component 54 provides power to various components of the electronic device. Power supply component 54 may include a power management system, one or more power supplies, and other components associated with generating, managing, and distributing power to the electronic device.

[0133] Audio component 55 is configured to output and / or input audio signals. For example, audio component 55 includes a microphone (MIC) configured to receive external audio signals when the electronic device is in an operating mode, such as call mode, recording mode, and voice recognition mode. The received audio signals may be further stored in memory 51 or transmitted via communication component 53. In some embodiments, audio component 55 also includes a speaker for outputting audio signals.

[0134] Display 56 includes a screen, which may include a liquid crystal display (LCD) and a touch panel (TP). If the screen includes a touch panel, the screen can be implemented as a touchscreen to receive input signals from a user. The touch panel includes one or more touch sensors to sense touches, swipes, and gestures on the touch panel. The touch sensors can sense not only the boundaries of the touch or swipe action but also the duration and pressure associated with the touch or swipe operation.

[0135] Those skilled in the art will understand that all or part of the steps of the above-described method embodiments can be implemented by hardware related to program instructions. The aforementioned program can be stored in a computer-readable storage medium. When executed, the program performs the steps of the above-described method embodiments; and the aforementioned storage medium includes various media capable of storing program code, such as ROM, RAM, magnetic disks, or optical disks.

[0136] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention, and not to limit them; although the present invention has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that modifications can still be made to the technical solutions described in the foregoing embodiments, or equivalent substitutions can be made to some or all of the technical features; and these modifications or substitutions do not cause the essence of the corresponding technical solutions to deviate from the scope of the technical solutions of the embodiments of the present invention.

Claims

1. An attack text generation method of a text ranking model, comprising: obtaining a candidate document ranking queue output by a text ranking model for a query text; extracting candidate documents from the candidate document ranking queue to form a plurality of sets of training data, each set of training data comprising two candidate documents in the candidate document ranking queue and the query text; training an imitation model using the training data; generating an attack text for a target document in the candidate document ranking queue using the trained imitation model.

2. The attack text generating method according to claim 1, wherein The plurality of sets of training data comprises: a first set of training data comprising a first candidate document and a second candidate document selected from a front candidate document group and the query text, wherein the front candidate document group comprises a predetermined number of candidate documents from a first candidate document in the candidate document ranking queue; a plurality of second sets of training data comprising the query text, a candidate document selected from the front candidate document group, and a candidate document randomly selected from a rear candidate document group, wherein the rear candidate document group comprises candidate documents in the candidate document ranking queue other than the front candidate document group.

3. The attack text generating method of claim 1, wherein, The training of the imitation model using the training data comprises: grouping the query text and the two candidate documents in each set of training data into a first query pair and a second query pair, wherein the first query pair comprises the query text and one of the two candidate documents, and the second query pair comprises the query text and the other of the two candidate documents; calculating the relevance of the query text and the candidate text in the first query pair and the second query pair using the imitation model to obtain a first query relevance of the first query pair and a second query relevance of the second query pair; training the imitation model using the first query relevance being higher than the second query relevance as the true label of the set of training data.

4. The attack text generating method of claim 1, wherein, The generation of the attack text for the target document in the candidate document ranking queue using the trained imitation model comprises: selecting a candidate document ranked first in the candidate document ranking model as a first document, and selecting one of the other candidate documents other than the first document as a target document; randomly generating a word vector with a predetermined length from a preset word table; calculating a loss amount of the word vector using the trained imitation model based on the word vector, the target document, the first document, and the query text; determining the attack text by searching based on the word vector using the loss amount as a constraint condition; adding the attack text to the target document and calculating the relevance of the target document and the query text after inserting the attack text; determining the new ranking of the target document in the candidate document ranking model after inserting the attack text according to the relevance. When the new ranking is higher than the original ranking of the target document in the candidate document ranking model, the attack text is taken as an attack text for the target document.

5. The attack text generation method of claim 4, after inserting the attack text into the target document, the method further comprises: taking the new ranking as the ranking of the target document with the attack text inserted in the candidate document ranking model.

6. The attack text generating method according to claim 4, wherein The loss amount includes: a relative relevance loss, a fluency loss, and a semantic relevance loss between the attack text and the target document.

7. A text ranking method, comprising: performing feature extraction on a first query text to obtain a first feature vector for the first query text; inputting the first feature vector into a text ranking model to obtain a first document ranking queue for the first query text, wherein the first document ranking queue at least contains a target document with an attack text inserted, and a first ranking of the target document in the first document ranking queue is not lower than a second ranking in a second document ranking queue, the second document ranking queue being an output of the text ranking model for a second query text, and a similarity between the first query text and the second query text is higher than a preset threshold; wherein the attack text is generated by: obtaining a candidate document ranking queue output by the text ranking model for the query text; extracting candidate documents from the candidate document ranking queue to form multiple sets of training data by combining the candidate documents with the query text, wherein each set of training data includes two candidate documents in the candidate document ranking queue and the query text; training an imitation model using the training data; generating an attack text for the target document using the trained imitation model.

8. An attack text generation apparatus of a text ranking model, comprising: an obtaining module configured to obtain a candidate document ranking queue output by a text ranking model for a query text; a training data generation module configured to extract candidate documents from the candidate document ranking queue to form multiple sets of training data by combining the candidate documents with the query text, wherein each set of training data includes two candidate documents in the candidate document ranking queue and the query text; a training module configured to train an imitation model using the training data; an attack text generation module configured to generate an attack text for a target document in the candidate document ranking queue using the trained imitation model.

9. An electronic device, comprising: a memory configured to store a program; a processor configured to execute the program stored in the memory to perform the attack text generation method of the text ranking model according to any one of claims 1 to 6 or the text ranking method according to claim 7.

10. A computer readable storage medium having stored thereon a computer program executable by a processor, wherein, The program is executed by the processor to implement the attack text generation method of the text ranking model according to any one of claims 1 to 6 or the text ranking method according to claim 7.

Images