A text protection method to resist the abuse of large language model analysis

Abstract

This invention discloses a text protection method for resisting abuse analysis by large language models. First, the negative logarithmic probability of the large language model's output termination condition, "end token," is used as a loss function, and backpropagation is performed to obtain gradients. The obtained gradients are used to construct a replacement set for each token in the protected text. Perturbed text is constructed from the replacement set and fed into the large language model. The best perturbed text is selected as the starting point for the next round of analysis, causing the large language model to output an end token when analyzing the protected text, thereby achieving text protection. This method utilizes adversarial sample technology to provide large language model-oriented protection for user-uploaded internet text, balancing effectiveness and confidentiality.

Description

Technical Field

[0001] The present invention relates to the technical field of large language models, and in particular to a text protection method for resisting abuse analysis of large language models. Background Art

[0002] In recent years, the development of large language models has enabled them to achieve superior performance in various downstream language tasks, such as human-computer dialogue, text and code generation, and reading comprehension, and has gradually become an important productivity tool. However, the rapid development of large language models has facilitated the illegal exploitation of internet text. Malicious actors can use large language models to target internet text with little or no specialized knowledge to carry out various illegal activities. For example, malicious actors can use large language models to analyze personal data for privacy reasons, plagiarize copyrighted user text, or compile and disseminate false and harmful information based on the original text.

[0003] A recent study shows that large language models, such as GPT-4, can accurately infer personal information such as gender, income, age, and address from snippets of text posted on social media, posing a significant risk to personal privacy. Furthermore, the emergence of large language models facilitates malicious plagiarism, with specialized tools now available for plagiarism. This poses a significant challenge to copyright protection. Furthermore, using large language models, malicious actors can mass-produce targeted disinformation based on original text, further intensifying the online public opinion environment.

[0004] More importantly, when large language models are capable of actively searching internet text, highly automated malicious behaviors like the ones described above become possible, further amplifying the aforementioned risks. Therefore, to address the aforementioned security issues posed by large language models, a text protection method specifically tailored to large language models is urgently needed. Summary of the Invention

[0005] The purpose of the present invention is to provide a text protection method for resisting the abuse analysis of large language models. The method uses adversarial sample technology to provide large language model-oriented protection for Internet texts uploaded by users, taking into account both effectiveness and concealment.

[0006] The purpose of the present invention is achieved through the following technical solutions:

[0007] A text protection method for resisting abuse analysis of a large language model, the method comprising:

[0008] Step 1: Use the negative logarithmic probability of the output termination condition "end token" of the large language model as the loss function and perform backpropagation to obtain the gradient;

[0009] Step 2: Use the gradient obtained in step 1 to construct a replacement set for each token in the protected text;

[0010] Step 3: Construct a perturbation text by replacing the set, and input the constructed perturbation text into the large language model. Select the perturbation text with the best result as the starting point for the next round, so that the large language model outputs the terminator when analyzing the protected text, thus achieving text protection.

[0011] It can be seen from the technical solution provided by the present invention that the above method uses adversarial sample technology to provide protection for large language models for Internet texts uploaded by users, taking into account both effectiveness and concealment. BRIEF DESCRIPTION OF THE DRAWINGS

[0012] In order to more clearly illustrate the technical solutions of the embodiments of the present invention, the following briefly introduces the drawings required for use in the description of the embodiments. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying any creative work.

[0013] Figure 1 A flowchart of a method for protecting text from abuse analysis by a large language model provided by an embodiment of the present invention;

[0014] Figure 2 This is an example diagram of constructing a truncation protection sample TPE using super customized protection STP according to an embodiment of the present invention;

[0015] Figure 3 This is a graph showing the results of TPE when PSR≥0.95 as described in an embodiment of the present invention. DETAILED DESCRIPTION

[0016] The following is a clear and complete description of the technical solutions in the embodiments of the present invention in conjunction with the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, not all embodiments, and do not constitute a limitation of the present invention. All other embodiments obtained by ordinary technicians in this field based on the embodiments of the present invention without making any creative efforts shall fall within the scope of protection of the present invention.

[0017] like Figure 1 FIG2 is a flow chart of a method for protecting text from abuse analysis by a large language model according to an embodiment of the present invention. The method includes:

[0018] Step 1: Use the negative logarithmic probability of the output termination condition "end token" of the large language model as the loss function and perform backpropagation to obtain the gradient;

[0019] In this step, after receiving the text, the large language model converts the text into a set of token sequences through the tokenizer, and after processing, outputs a prediction of the probability distribution of the next token. Then, based on the probability distribution, the large language model determines the token through a certain sampling method, adds the token to the previous token sequence, and re-enters the model to predict the next token. This process will be repeated until the sampling result of a certain round is a specific type of token, which is the termination condition "end token".

[0020] In the specific implementation, given a token sequence A token is the smallest unit of text segmentation in natural language processing. A token sequence refers to a sequence formed by segmenting text into tokens, where:

[0021] Represents the set of all tokens in the vocabulary; V and n represent the length of the vocabulary and token sequence of the large language model respectively;

[0022] The large language model cannot process the token sequence directly, so before the token sequence is input into the large language model, each x i should be mapped to a vector. To achieve this, each x i Represented as a one-hot vector in is a set of real numbers, V represents the vocabulary of the large language model, and is trained through the pre-trained Embedding layer M e V i Converted to the final vector representation, Embedding layer M e It is a large matrix used to map each token into a high-dimensional vector to model natural language, namely:

[0023] [v1M e , v2M e ,...,v n M e ]∈R n×d

[0024] Where d is the dimension of the embedding vector;

[0025] After the final vector representation is input into the large language model, the probability distribution of the large language model output is obtained. After normalization, it is used as the probability prediction of the next token. The specific usage is:

[0026] To represent x n+1 The probability distribution ofn+1 |x ＜n+1 );

[0027] After providing the above probability prediction, the large language model determines the next tokenx through different sampling methods. n+1 , and then use the tokenx n+1 Add to the original token sequence to get a new token sequence [x1, x2, ...x n , x n+1 ]; Repeat the above process until a special token is sampled, which is the output termination condition "end token" of the large language model;

[0028] Given a and the corresponding model response Prompt is the prompt word, which is the input text of the large language model, and the probability distribution of r Expressed as:

[0029]

[0030] Here, r stop Indicates the termination condition end token; Represents a large language model pair The set of all responses given,

[0031] Step 2: Use the gradient obtained in step 1 to construct a replacement set for each token in the protected text;

[0032] In this step, a one-hot vector is used to represent the protected text and the loss function is defined And calculate the gradient of the one-hot vector; use the calculated gradient of the one-hot vector to construct the replacement set Greedy search is then used to determine the optimal replacement that minimizes the loss function.

[0033] The specific process is: given a protected text, record it as will form Each token is represented by Will Represented as a one-hot vector but:

[0034]

[0035] Then define the loss function The loss function It is defined as the cross entropy between the probability distribution of the first token predicted by the large language model and the probability distribution corresponding to the termination condition end token with a probability of 1; specifically, the output g of the logits layer of the large language model and the one-hot vector v of the termination condition end token are used. end Perform the calculation, namely:

[0036] Among them, H() refers to the cross entropy calculation function;

[0037] It is worth noting that the STP method can achieve different optimization objectives by selecting different loss functions;

[0038] Recalculate and The gradient h of the corresponding one-hot vector i :

[0039]

[0040] Gradient h i Each dimension of corresponds to a token in the large language model vocabulary V, denoted as h i [j], where j∈{1, 2, ..., V}; smaller h i [j] means Replace with token j It will have a greater impact on the loss function, making it converge faster; among them, token j refers to the jth token in the vocabulary;

[0041] In order to find semantically similar tokens, we use the embedding vector to find tokens that are close in distance in the embedding layer. The embedding vector refers to the token vector after being mapped by the embedding layer. Specifically, we first represent all tokens in the large language model dictionary V as embedding vectors and normalize them using the l2 norm to obtain a new set V′. Perform the same operation. Refers to the i-th token of the input prompt P; then performs a dot product operation with all vectors in the new set V′, and selects the n tokens with the largest results as the set N of semantically similar tokens i ;

[0042] In order to ensure that the replaced token maintains similarity with the protected text and reduce the loss function, we select i According to the gradient h i Select the final replacement set, specifically: for tokenj ∈N i , according to h i Sort the values ​​of [j] in descending order; select the first k tokens as the final replacement set S i , denoted as S i =Top-k(N i ).

[0043] Step 3: Construct a perturbation text by replacing the set, and input the constructed perturbation text into the large language model. Select the perturbation text with the best result as the starting point for the next round, so that the large language model outputs the terminator when analyzing the protected text, thus achieving text protection.

[0044] In this step, in order to adapt to the longer protection text length, a combination of random replacement and greedy search is used to find the input text prompt of the optimized large language model. The specific process is as follows:

[0045] In each iteration, the protected text Repeat batch size times to obtain an initial set I. In subsequent operations, the protected text in the initial set is randomly replaced, and the text with the smallest loss function is selected as the starting point of the next round of iteration, which is expressed as:

[0046]

[0047] in Represents a protected text after copying Batch size represents the position of the text in the collection;

[0048] Next, a new optimized prompt set I′ is constructed based on the initial set I by random replacement. and the original protected text Compared to changing the token in only one position:

[0049] if in Refers to protected text The number of tokens, the initial set I is divided into parts, namely Each part corresponds to a changed position i; if For each Randomly select a position i that is not repeated in any pair;

[0050] Randomly replace the set S i Select tokens to replace these positions. Specifically, for the initial set I make:

[0051]

[0052] Among them, Uniform(S i ) refers to the replacement set S i Randomly sample an element from , and the probability of sampling each element is the same, Refers to assigning the sampled elements to the protected text The i-th position of ;

[0053] Then calculate the loss function corresponding to each text in the optimized prompt set I′ in each iteration, select the one with the smallest loss function, and get the new and repeats for the specified number of iterations.

[0054] In the embodiment of the present invention, the above text protection method is called Super Tailored Protection STP (Super Tailored Protection). Figure 2 The figure shows an example of constructing a truncation protection example TPE using super customized protection STP in an embodiment of the present invention. In this application, the protected text is referred to as a truncation protection example (TPE). Figure 2 As shown in the figure, the underlined parts are the tokens that have changed between TPE and the original text. These tokens are semantically similar to the original text, but they can prevent the large language model from making any response, thus protecting the security of the text.

[0055] It should be noted that the contents not described in detail in the embodiments of the present invention belong to the prior art known to those skilled in the art.

[0056] In order to illustrate the method and technical effects of the embodiments of the present invention, the following is a detailed description through experiments:

[0057] 1. Comprehensive evaluation of truncation protection samples

[0058] In the experiment, two prompt optimization methods, PEZ and GBDA, were used for comparison, with the aim of evaluating the effectiveness of the embodiments of the present invention on different types of prompts and different models.

[0059] Table 1 shows the results of constructing TPE for the three models LLaMA, Vicuna, and Guanaco on the Vicuna dataset using the three methods STP (method of this application), PEZ, and GBDA, where γ represents the character change rate, η represents the semantic preservation rate, and PSR represents the protection success rate.

[0060] Table 1 Results of truncated protection samples on the Vicuna dataset

[0061]

[0062]

[0063]

[0064] Experimental results show that the STP described in this application demonstrates good protection across prompt types and lengths. However, among nine different prompt types, STP performs poorly in pseudo-reality and code. An analysis of the experimental dataset reveals that the shorter prompt lengths in these categories result in fewer slots for token replacement, leading to poor results. Compared to STP, PEZ and GBDA are nearly ineffective in constructing TPE.

[0065] In addition, in the experiment, the embodiments of the present invention observed that a large part of the replacement operations involved changes in capitalization, such as changing "you" to "You", or using tokens that are similar or identical in appearance but have different encodings for replacement, such as changing "?" (English question mark) to "?" (Chinese question mark). This ensures the concealment of TPE and highlights the advantage of using tokens rather than words as the minimum replacement unit, such as Figure 3 The figure shows the results of TPE when PSR≥0.95 according to the embodiment of the present invention. Figure 3 The underlined parts are tokens that have been changed between the protected text and the original text. They are semantically similar and not easy to detect, for example, changing from an English question mark (?) to a Chinese question mark (?).

[0066] Furthermore, because our STP method follows the greedy search principle, the replacement operations that significantly impact the results are typically performed at fixed locations within the sentence. Therefore, many rounds of replacements are concentrated at the same location, enhancing the stealth of TPE. It's important to note that 15 rounds of optimization do not converge the loss function for most prompts. Therefore, performing more rounds of optimization on a single prompt should yield better protection results, but this will also result in larger changes to the prompt itself.

[0067] 2. Evaluation and enhancement of TPE mobility of truncated protection samples

[0068] The embodiment of the present invention transfers the results of TPE between models and enhances the migration effect by aggregating the loss function. Specifically, for the three models model1, model2, and model3, the new loss function is defined as The optimized TPE is then transferred to model 3. "Model A→B" represents the transfer of the optimized results from model A to model B. PSR represents the protection effectiveness of the customized TPE for the model itself, PSR* represents the result after transfer, AVE represents the average of the results in the first two rows of the table, and AGG represents the results obtained by aggregating the other two models. Experimental results show that the transferability of TPE is significantly improved after observing the aggregate loss function, with the average PSR value across all models increasing by 0.11, providing certain support for text protection in black-box scenarios.

[0069] 3. Evaluation of TPE robustness for truncated protection samples

[0070] Specifically, we conducted experiments on Vicuna using 120-token text from the Novel dataset. We performed random deletion, random word addition, and random synonym replacement, with the percentage of randomization ranging from 5% to 20%. The results are shown in Table 2, where RI represents random word insertion, RD represents random word deletion, and SR represents synonym replacement. The subscripts indicate the ratio of randomization.

[0071] Table 2 Robustness of truncated protection samples

[0072]

[0073]

[0074] The above experimental results show that the protection effect of TPE becomes worse as the disturbance ratio increases, but disturbance with too large a ratio will cause greater damage to the text itself.

[0075] In addition, those skilled in the art will understand that all or part of the steps in the above-mentioned embodiment method can be implemented by instructing the relevant hardware through a program, and the corresponding program can be stored in a computer-readable storage medium. The above-mentioned storage medium can be a read-only memory, a disk or an optical disk, etc.

[0076] The above description is only a preferred embodiment of the present invention, but the scope of protection of the present invention is not limited thereto. Any changes or substitutions that can be easily thought of by any person skilled in the art within the technical scope disclosed in the present invention should be included in the scope of protection of the present invention. Therefore, the scope of protection of the present invention should be based on the scope of protection of the claims. The information disclosed in the background technology section of this article is only intended to deepen the understanding of the overall background technology of the present invention, and should not be regarded as an admission or any form of implication that the information constitutes prior art already known to those skilled in the art.

Claims

1. A text protection method for resisting abuse analysis of large language models, characterized in that: The method comprises: Step 1: Use the negative logarithmic probability of the output termination condition "end token" of the large language model as the loss function and perform backpropagation to obtain the gradient; Step 2: Use the gradient obtained in step 1 to construct a replacement set for each token in the protected text; In step 2, a one-hot vector is used to represent the protected text and the loss function is defined And calculate the gradient of the one-hot vector; Use the calculated gradient of the one-hot vector to construct a replacement set Greedy search is then used to determine the optimal replacement that minimizes the loss function; The process of step 2 is specifically as follows: Given a protected text, denoted as will form Each token is represented by Will Represented as a one-hot vector but: Then define the loss function The loss function It is defined as the cross entropy between the probability distribution of the first token predicted by the large language model and the probability distribution corresponding to the termination condition end token with a probability of 1; specifically, the output g of the logits layer of the large language model and the one-hot vector v of the termination condition end token are used. end Perform the calculation, namely: Among them, H() refers to the cross entropy calculation function; Recalculate and The gradient h of the corresponding one-hot vector i : Gradient h i Each dimension of corresponds to a token in the large language model vocabulary V, denoted as h i [j], where j∈{1, 2, ..., V}; token j refers to the jth token in the vocabulary; In order to find semantically similar tokens, we use the Embedding vector to find tokens that are close in distance in the Embedding layer. The Embedding vector refers to the token vector after being mapped by the Embedding layer. Specifically, we first represent all tokens in the large language model dictionary V as Embedding vectors and normalize them using the l2 norm to obtain a new set V′. Perform the same operation. Refers to the i-th token of the input prompt P; then performs a dot product operation with all vectors in the new set V′, and selects the n tokens with the largest results as the set N of semantically similar tokens i ; In order to ensure that the replaced token maintains similarity with the protected text and reduce the loss function, we select i According to the gradient h i Select the final set of replacements, specifically: For tokens j ∈N i , according to h i Sort the values ​​of [j] in descending order; select the first k tokens as the final replacement set S i , denoted as S i =Top-k(N i ); Step 3: Construct a perturbation text by replacing the set, and input the constructed perturbation text into the large language model. Select the perturbation text with the best result as the starting point for the next round, so that the large language model outputs the terminator when analyzing the protected text, thus achieving text protection.

2. The text protection method for resisting abuse analysis of large language models according to claim 1 is characterized in that: In step 1, given a token sequence A token is the smallest unit of text segmentation in natural language processing. A token sequence refers to a sequence formed by segmenting text into tokens, where: Represents the set of all tokens in the vocabulary; V and n represent the length of the vocabulary and token sequence of the large language model respectively; For each x i Represented as a one-hot vector in is a set of real numbers, V represents the vocabulary of the large language model, and is trained through the pre-trained Embedding layer M e V i Converted to the final vector representation, Embedding layer M e It is a large matrix used to map each token into a high-dimensional vector to model natural language, namely: [v1M e ,v2M e ,...,in n M e ]∈R n×d Where d is the dimension of the embedding vector; After the final vector representation is input into the large language model, the probability distribution of the large language model output is obtained. After normalization, it is used as the probability prediction of the next token. The specific usage is: To represent x n+1 The probability distribution of n+1 |x ＜n+1 ); After providing the above probability prediction, the large language model determines the next tokenx through different sampling methods. n+1 , and then use the tokenx n+1 Add to the original token sequence to get a new token sequence [x1, 2 ， ...x n , x n+1 ]; Repeat the above process until a special token is sampled, which is the output termination condition "end token" of the large language model; Given a and the corresponding model response Prompt is the prompt word, which is the input text of the large language model, and the probability distribution of r Expressed as: Here, r stop Indicates the termination condition end token; Represents a large language model pair The set of all responses given, 3. The text protection method for resisting abuse analysis of large language models according to claim 1 is characterized in that: In step 3, in order to adapt to the longer protection text length, a combination of random replacement and greedy search is used to find the input text prompt of the optimized large language model. The specific process is as follows: In each iteration, the protected text Repeat batch size times to obtain an initial set I. In subsequent operations, the protected text in the initial set is randomly replaced, and the text with the smallest loss function is selected as the starting point of the next round of iteration, which is expressed as: |I|=batch size in Represents a protected text after copying Batch size represents the position of the text in the collection; Next, a new optimized prompt set I′ is constructed by random replacement based on the initial set I. and the original protected text Compared to changing the token in only one position: if in Refers to protected text The number of tokens, the initial set I is divided into parts, namely Each part corresponds to a changed position i; if For each Randomly select a position i that is not repeated in any pair; Randomly replace the set S i Select tokens to replace these positions. Specifically, for the initial set I make: Among them, Unoform(S i ) refers to the replacement set S i Randomly sample an element from , and the probability of sampling each element is the same, Refers to assigning the sampled elements to the protected text The i-th position of ; Then calculate the loss function corresponding to each text in the prompt set i′ in each iteration, select the one with the smallest loss function, and get the new and repeats for the specified number of iterations.

Images