Large language model evaluation method and device

Abstract

The invention provides a large language model evaluation method and device. The method comprises the following steps: acquiring a trained target large language model; performing attack assessment on the target large language model based on a target attack algorithm to obtain attack assessment features; and based on a target statistical algorithm or a target evaluation model, evaluating the attack evaluation feature to obtain a risk evaluation level of the target large language model.

Description

Technical Field

[0001] The present invention relates to the field of data processing technology, and in particular to a large-scale language model evaluation method and device. Background Art

[0002] In recent years, with the rapid development of deep learning technology, large language models have achieved remarkable results in the field of natural language processing. Large language models have demonstrated powerful performance in tasks such as text generation, machine translation, and question-answering systems, and have been widely used in various fields.

[0003] However, the training data of large language models usually contains a large amount of text data, which may contain sensitive information, such as personal privacy data, business secrets, etc. Attackers can use membership inference attacks to determine whether a specific data sample belongs to the training data of the model, thereby causing privacy leakage risks. For example, attackers can use membership inference attacks to determine whether a user's medical records are used to train a medical diagnosis model, or whether a company's financial data is used to train a financial prediction model.

[0004] Therefore, how to evaluate inference attacks on large language models has become a problem that needs to be solved urgently in the industry. Summary of the invention

[0005] The present invention provides a large language model evaluation method and device, which are used to solve the problem of how to perform reasoning attack evaluation on a large language model in the prior art.

[0006] The present invention provides a large-scale language model evaluation method, comprising the following steps.

[0007] Obtain the target large language model that has completed training; Performing an attack evaluation on the target large language model based on a target attack algorithm to obtain an attack evaluation feature; Based on a target statistical algorithm or a target assessment model, the attack assessment feature is evaluated to obtain a risk assessment level of the target large language model.

[0008] According to a large-scale language model evaluation method provided by the present invention, the target attack algorithm includes at least one of the following: an attack algorithm based on a loss function, an attack algorithm based on a reference model, an attack algorithm based on information entropy, an attack algorithm based on a neighborhood sample, and an attack algorithm based on a minimum probability token.

[0009] According to a large language model evaluation method provided by the present invention, when the target attack algorithm includes an attack algorithm based on a loss function, attack evaluation is performed on the target large language model based on the target attack algorithm, including: Inputting the target sample into the target large language model to obtain a prediction result of the target large language model; Determining a first loss value of the target sample based on a difference between the prediction result and the target sample; When the first loss value is less than a first preset threshold, determining that the target sample is a training sample of the target large language model; When the first loss value is greater than or equal to a first preset threshold, it is determined that the target sample is not a training sample of the target large language model.

[0010] According to a large language model evaluation method provided by the present invention, when the target attack algorithm includes an attack algorithm based on a reference model, attack evaluation is performed on the target large language model based on the target attack algorithm, including: Input the target sample into the target large language model and the reference model, and output the prediction result and the reference prediction result respectively; wherein the reference model is a model trained based on the same sample as the target large language model; When the similarity between the prediction result and the reference prediction result is less than a second preset threshold, determining that the target sample is not a training sample of the target large language model; When the similarity between the prediction result and the reference prediction result is greater than or equal to a second preset threshold, the target sample is determined to be a training sample of the target large language model.

[0011] According to a large language model evaluation method provided by the present invention, when the target attack algorithm includes an attack algorithm based on a reference model, attack evaluation is performed on the target large language model based on the target attack algorithm, including: Inputting the target sample into the target large language model to obtain a prediction result of the target large language model; Based on calculating the information entropy of the probability distribution of each label in the prediction result, and comparing the information entropy of the target sample with the information entropy of the training data: If the information entropy of the target sample is lower than the information entropy of the training data, the target sample is considered to belong to the training data; If the information entropy of the target sample is higher than the information entropy of the training data, it is considered that the target sample does not belong to the training data.

[0012] According to a large language model evaluation method provided by the present invention, the method for obtaining the attack evaluation feature includes: Extracting features from model parameters and intermediate layer outputs of the target large language model to obtain model complexity information and training data volume information; The attack evaluation feature is determined according to the model complexity information, the training data volume information and the attack success rate information of the attack evaluation.

[0013] According to a large language model evaluation method provided by the present invention, after the step of evaluating the attack evaluation feature based on the target statistical algorithm or the target evaluation model to obtain the risk assessment level of the target large language model, the method further includes: Based on the attack assessment characteristics and risk assessment levels, generating risk assessment visualization information; Generate corresponding safety protection recommendation information according to the risk assessment level.

[0014] The present invention also provides a large-scale language model evaluation device, comprising the following modules: An acquisition module is used to acquire the target large language model that has completed training; A first evaluation module is used to perform an attack evaluation on the target large language model based on a target attack algorithm to obtain an attack evaluation feature; The second evaluation module is used to evaluate the attack evaluation features based on a target statistical algorithm or a target evaluation model to obtain a risk assessment level of the target large language model.

[0015] The present invention also provides an electronic device, comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein when the processor executes the program, the large-scale language model evaluation method as described above is implemented.

[0016] The present invention also provides a non-transitory computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, implements any of the large language model evaluation methods described above.

[0017] The present invention also provides a computer program product, comprising a computer program, wherein when the computer program is executed by a processor, the large-scale language model evaluation method as described above is implemented.

[0018] The large-scale language model evaluation method and device provided by the present invention can help users identify and evaluate the privacy leakage risks of large models through effective large-model member reasoning attack analysis tools and systems. By integrating multiple advanced attack detection algorithms and privacy protection technologies, the system can effectively analyze the vulnerability of the model to specific data samples and provide corresponding risk assessment reports and security protection recommendations. BRIEF DESCRIPTION OF THE DRAWINGS

[0019] In order to more clearly illustrate the technical solutions in the present invention or the prior art, the following briefly introduces the drawings required for use in the embodiments or the description of the prior art. Obviously, the drawings described below are some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative work.

[0020] Figure 1 It is a flowchart of the large-scale language model evaluation method provided by the present invention.

[0021] Figure 2 A schematic diagram of the structure of a large-scale language model evaluation device provided in an embodiment of the present application; Figure 3 It is a structural schematic diagram of the electronic device provided by the present invention. DETAILED DESCRIPTION

[0022] In order to make the purpose, technical solution and advantages of the present invention clearer, the technical solution of the present invention will be clearly and completely described below in conjunction with the drawings of the present invention. Obviously, the described embodiments are part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0023] Figure 1 is a flow chart of the large language model evaluation method provided by the present invention, such as Figure 1 As shown, the method includes the following: Step 110, obtaining the trained target large language model; The target large language model in the embodiment of the present application can be a suitable LLM model selected according to user needs, such as BERT, LLaMA, etc.

[0024] The target large language model that completes training in the embodiment of the present application may be pre-trained based on a training set.

[0025] The training set in the embodiment of the present application is obtained by cleaning the input training data and test data, removing duplicate data, noise data, etc., and after ensuring the quality of the data, desensitizing the sensitive data, such as anonymizing and generalizing.

[0026] Step 120, performing attack evaluation on the target large language model based on a target attack algorithm to obtain an attack evaluation feature; In the embodiment of the present application, a suitable member reasoning attack algorithm is selected according to the characteristics of the LLM to be evaluated, which may include an attack based on a loss function, an attack based on a reference model, an attack based on information entropy, etc.

[0027] Perform an actual membership inference attack on the LLM using the selected attack algorithm. This involves submitting queries to the model and recording the model's responses to these queries, such as loss values, predictions, etc.

[0028] During the attack, relevant feature data is collected, which will be used to assess the vulnerability of the model. This may include loss values, confidence of predictions, response time of the model, etc.

[0029] During the attack, relevant feature data is collected, which will be used to assess the vulnerability of the model. This may include loss values, confidence of predictions, response time of the model, etc.

[0030] Step 130: Based on a target statistical algorithm or a target assessment model, the attack assessment feature is evaluated to obtain a risk assessment level of the target large language model.

[0031] In the embodiment of the present application, based on the collected attack assessment features, a suitable statistical method or a pre-trained assessment model is selected to perform risk assessment, which may include a machine learning classifier, a regression model, or a customized statistical test.

[0032] Analyze the attack assessment features using a selected statistical algorithm or assessment model to determine the risk level of the LLM. The risk level may be based on the attack success rate, the amount of information that the attacker may obtain, or other relevant indicators. Analyze the assessment results to determine the vulnerability of the LLM.

[0033] In the embodiments of the present application, through an effective large model member reasoning attack analysis tool and system, it is possible to help users identify and evaluate the privacy leakage risk of large models. By integrating a variety of advanced attack detection algorithms and privacy protection technologies, the system can effectively analyze the vulnerability of the model to specific data samples and provide corresponding risk assessment reports and security protection recommendations.

[0034] Optionally, the target attack algorithm includes at least one of the following: an attack algorithm based on a loss function, an attack algorithm based on a reference model, an attack algorithm based on information entropy, an attack algorithm based on a neighborhood sample, and an attack algorithm based on a minimum probability token.

[0035] In a case where the target attack algorithm includes an attack algorithm based on a loss function, performing an attack evaluation on the target large language model based on the target attack algorithm includes: Inputting the target sample into the target large language model to obtain a prediction result of the target large language model; Determining a first loss value of the target sample based on a difference between the prediction result and the target sample; When the first loss value is less than a first preset threshold, determining that the target sample is a training sample of the target large language model; When the first loss value is greater than or equal to a first preset threshold, it is determined that the target sample is not a training sample of the target large language model.

[0036] In the embodiment of the present application, a series of target samples are selected or generated, and these samples should include known training samples and test samples in unknown states.

[0037] Input the target samples into the trained LLM and request the model to predict these samples. Collect the model's prediction results for each target sample, including the predicted output and the associated confidence or probability. According to the model's loss function, calculate the difference between the predicted result and the actual label of the target sample to obtain the first loss value for each sample. The loss function may be cross entropy loss, mean square error, etc., depending on the type of model and task.

[0038] Determine a loss threshold to distinguish between training samples and test samples. This threshold can be set by analyzing the loss distribution of training samples, and is usually selected in the low value area of ​​the loss distribution of training samples.

[0039] The first loss value of each target sample is evaluated: if the first loss value is less than the first preset threshold, the attacker can infer that the sample is likely to be a training sample of the model, because its loss value is low, indicating that the model has good prediction performance for the sample. If the first loss value is greater than or equal to the first preset threshold, the attacker infers that the sample is not a training sample of the model, because its loss value is high, indicating that the model has poor prediction performance for the sample.

[0040] In the embodiment of the present application, the vulnerability of the LLM is evaluated based on the attack results. If a large number of samples are found to be incorrectly identified as training samples, it may indicate that the model has a risk of privacy leakage.

[0041] Optionally, when the target attack algorithm includes an attack algorithm based on a reference model, performing attack evaluation on the target large language model based on the target attack algorithm includes: Input the target sample into the target large language model and the reference model, and output the prediction result and the reference prediction result respectively; wherein the reference model is a model trained based on the same sample as the target large language model; When the similarity between the prediction result and the reference prediction result is less than a second preset threshold, determining that the target sample is not a training sample of the target large language model; When the similarity between the prediction result and the reference prediction result is greater than or equal to a second preset threshold, the target sample is determined to be a training sample of the target large language model.

[0042] In the embodiment of the present application, the target sample is input into the target LLM and the reference model at the same time, and they are requested to predict the sample. The prediction results of the target LLM and the reference model for each target sample are collected. These results may include prediction categories, probability distributions, or other related outputs.

[0043] Calculate the similarity between the predictions of the target LLM and the predictions of the reference model. Similarity can be calculated in many ways, such as cosine similarity, Jaccard similarity, or Euclidean distance.

[0044] Determine a similarity threshold to distinguish between training samples and test samples. This threshold can be set by analyzing the similarity distribution of training samples.

[0045] The similarity of the prediction results of each target sample is evaluated: if the similarity of the prediction results is less than the second preset threshold, the attacker can infer that the sample is likely not a training sample of the target LLM because the prediction results of the two models are quite different.

[0046] If the similarity of the prediction results is greater than or equal to the second preset threshold, the attacker infers that the sample is a training sample of the target LLM, because the prediction results of the two models are similar, indicating that the target sample may contribute to the training of the target model.

[0047] Based on the attack results, the vulnerability of the LLM is evaluated. If a large number of samples are found to be incorrectly identified as training samples, it may indicate that the model has the risk of privacy leakage.

[0048] Optionally, when the target attack algorithm includes an attack algorithm based on a reference model, performing attack evaluation on the target large language model based on the target attack algorithm includes: Inputting the target sample into the target large language model to obtain a prediction result of the target large language model; Based on calculating the information entropy of the probability distribution of each label in the prediction result, and comparing the information entropy of the target sample with the information entropy of the training data: If the information entropy of the target sample is lower than the information entropy of the training data, the target sample is considered to belong to the training data; If the information entropy of the target sample is higher than the information entropy of the training data, it is considered that the target sample does not belong to the training data.

[0049] In an embodiment of the present application, the prediction results of the target LLM for the target sample are collected, which generally include the probability distribution of each label.

[0050] For the prediction results of the target sample, the information entropy of the probability distribution of each label is calculated. Information entropy is an indicator to measure the uncertainty of the prediction results. The information entropy data on the target LLM training data is collected. This can be obtained by performing the same prediction and information entropy calculation on the training data.

[0051] Compare the information entropy of the target sample with the information entropy of the training data: If the information entropy of the target sample is lower than that of the training data, this may indicate that the target sample has been learned by the model during the training process, and therefore the target sample is considered to belong to the training data.

[0052] If the information entropy of the target sample is higher than the information entropy of the training data, this may indicate that the target sample has not been fully learned in the training data, and therefore the target sample is considered not to belong to the training data. Determine an information entropy threshold to more accurately determine whether the sample belongs to the training set. This threshold can be set by statistically analyzing the information entropy distribution of the training data.

[0053] Based on the comparison results of information entropy, evaluate whether each target sample belongs to the training data and record the accuracy of the evaluation. Analyze the evaluation results to determine the vulnerability of the target LLM. If a large number of samples are found to be incorrectly identified as training samples, it may indicate that the model has a risk of privacy leakage.

[0054] Optionally, the attack assessment feature is obtained by: Extracting features from model parameters and intermediate layer outputs of the target large language model to obtain model complexity information and training data volume information; The attack evaluation feature is determined according to the model complexity information, the training data volume information and the attack success rate information of the attack evaluation.

[0055] Specifically, check the model parameters of the target LLM, including but not limited to the model's depth (number of layers), width (number of units per layer), connection pattern, activation function type, etc.

[0056] When the model makes predictions for samples, the output data of the intermediate layers is collected. This data can provide information about the state of the model at different processing stages.

[0057] Extract features from model parameters and intermediate layer outputs, such as: Model complexity information: Evaluate the complexity of the model based on model parameters, which may include the number of parameters, model hierarchy, etc.

[0058] Evaluate the amount of data used when training the model, which may affect the model's generalization ability and reliance on training data. Perform membership inference attacks and record the success rate of the attacks. The success rate is a key indicator of the effectiveness of the attack.

[0059] Combine model complexity information, training data volume information, and attack success rate information to determine attack assessment features. These features reflect the vulnerability of the model. Analyze the impact of different features on the model's vulnerability and determine which features are key factors for a successful attack.

[0060] The extracted features are used to build a risk assessment model, which can be a machine learning model to predict the vulnerability of the model. The risk assessment model is trained and validated using known training and test samples to ensure the accuracy and generalization ability of the model.

[0061] Based on the output of the risk assessment model, the model's vulnerability is divided into different risk levels.

[0062] Optionally, after the step of evaluating the attack assessment feature based on the target statistical algorithm or the target assessment model to obtain the risk assessment level of the target large language model, the method further includes: Based on the attack assessment characteristics and risk assessment levels, generating risk assessment visualization information; Generate corresponding safety protection recommendation information according to the risk assessment level.

[0063] In an embodiment of the present application, the results of the risk assessment are organized into structured data, including but not limited to characteristics such as model complexity, amount of training data, attack success rate, and corresponding risk levels.

[0064] According to the characteristics of the data and user needs, choose appropriate visualization methods, such as charts, heat maps, scatter plots, etc.

[0065] Design visualization elements: Design the chart's title, axis labels, legends, colors, and other elements to ensure that the visualization information is clear and easy to understand.

[0066] Create visualizations: Use visualization tools or libraries such as Matplotlib, Seaborn, D3.js, etc. to create visualization charts based on the design.

[0067] Then, the created visualization information is presented to the user to help the user intuitively understand the risk status of the model.

[0068] According to the characteristics and levels of risk assessment, analyze the main factors that may make the model vulnerable to attacks. Based on the analysis results, formulate specific security protection measures, which may include technical improvements, data management, privacy protection and other aspects.

[0069] Provide different levels of security protection suggestions for different risk levels to ensure the practicality and pertinence of the suggestions. Organize the security protection suggestions into a report, including the background of the suggestions, specific measures, expected effects, etc., to provide detailed guidance and steps for implementing the security protection suggestions and help users or model developers take action.

[0070] In an optional embodiment, during the model training and attack detection process, differential privacy technology is used to add random noise to protect the privacy of training data. Sensitive data is homomorphically encrypted, and attack analysis is performed without leaking the data content, thereby effectively ensuring data privacy and security.

[0071] The large-scale language model evaluation device provided by the present invention is described below. The large-scale language model evaluation device described below and the large-scale language model evaluation method described above can be referenced to each other.

[0072] The evaluation method in the embodiment of the present application can be used in the model development stage to evaluate the privacy leakage risk of the model and take corresponding security protection measures.

[0073] It can also be applied to evaluate the privacy leakage risk of the model before using it, and select a more secure model.

[0074] It can also be used to conduct security audits on large models, evaluate their privacy protection capabilities, and make improvement suggestions.

[0075] The present invention helps to improve the security of large models, protect user privacy, and promote the healthy development of artificial intelligence technology.

[0076] Figure 2 A schematic diagram of the structure of a large language model evaluation device provided in an embodiment of the present application is shown in FIG. Figure 2 As shown, including: The acquisition module 210 is used to acquire the target large language model that has completed training; The first evaluation module 220 is used to perform attack evaluation on the target large language model based on a target attack algorithm to obtain an attack evaluation feature; The second evaluation module 230 is used to evaluate the attack evaluation features based on a target statistical algorithm or a target evaluation model to obtain a risk assessment level of the target large language model.

[0077] Through effective large model member reasoning attack analysis tools and systems, users can identify and assess the privacy leakage risks of large models. By integrating a variety of advanced attack detection algorithms and privacy protection technologies, the system can effectively analyze the vulnerability of the model to specific data samples and provide corresponding risk assessment reports and security protection recommendations.

[0078] Figure 3 is a schematic diagram of the structure of the electronic device provided by the present invention, such as Figure 3 As shown, the electronic device may include: a processor 310, a communication interface 320, a memory 330 and a communication bus 340, wherein the processor 310, the communication interface 320 and the memory 330 communicate with each other through the communication bus 340. The processor 310 may call the logic instructions in the memory 330 to execute the large language model evaluation method, which includes: obtaining a trained target large language model; Performing an attack evaluation on the target large language model based on a target attack algorithm to obtain an attack evaluation feature; Based on a target statistical algorithm or a target assessment model, the attack assessment feature is evaluated to obtain a risk assessment level of the target large language model.

[0079] In addition, the logic instructions in the above-mentioned memory 330 can be implemented in the form of a software functional unit and can be stored in a computer-readable storage medium when it is sold or used as an independent product. Based on such an understanding, the technical solution of the present invention, in essence, or the part that contributes to the prior art or the part of the technical solution, can be embodied in the form of a software product, and the computer software product is stored in a storage medium, including a number of instructions for a computer device (which can be a personal computer, a server, or a network device, etc.) to perform all or part of the steps of the method described in each embodiment of the present invention. The aforementioned storage medium includes: U disk, mobile hard disk, read-only memory (ROM, Read-Only Memory), random access memory (RAM, Random Access Memory), disk or optical disk, etc. Various media that can store program codes.

[0080] On the other hand, the present invention further provides a computer program product, the computer program product includes a computer program, the computer program can be stored on a non-transitory computer-readable storage medium, when the computer program is executed by a processor, the computer can execute the large language model evaluation method provided by the above methods, the method includes: obtaining a target large language model that has completed training; Performing an attack evaluation on the target large language model based on a target attack algorithm to obtain an attack evaluation feature; Based on a target statistical algorithm or a target assessment model, the attack assessment feature is evaluated to obtain a risk assessment level of the target large language model.

[0081] In another aspect, the present invention further provides a non-transitory computer-readable storage medium having a computer program stored thereon, which is implemented when the computer program is executed by a processor to perform the large language model evaluation method provided by the above methods, the method comprising: obtaining a trained target large language model; Performing an attack evaluation on the target large language model based on a target attack algorithm to obtain an attack evaluation feature; Based on a target statistical algorithm or a target assessment model, the attack assessment feature is evaluated to obtain a risk assessment level of the target large language model.

[0082] The device embodiments described above are merely illustrative, wherein the units described as separate components may or may not be physically separated, and the components displayed as units may or may not be physical units, that is, they may be located in one place, or they may be distributed on multiple network units. Some or all of the modules may be selected according to actual needs to achieve the purpose of the scheme of this embodiment. Ordinary technicians in this field can understand and implement it without paying creative labor.

[0083] Through the description of the above implementation methods, those skilled in the art can clearly understand that each implementation method can be implemented by means of software plus a necessary general hardware platform, and of course, can also be implemented by hardware. Based on this understanding, the above technical solution is essentially or the part that contributes to the prior art can be embodied in the form of a software product, and the computer software product can be stored in a computer-readable storage medium, such as ROM / RAM, a disk, an optical disk, etc., including a number of instructions for a computer device (which can be a personal computer, a server, or a network device, etc.) to execute the methods described in each embodiment or some parts of the embodiments.

[0084] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention, rather than to limit it. Although the present invention has been described in detail with reference to the aforementioned embodiments, those skilled in the art should understand that they can still modify the technical solutions described in the aforementioned embodiments, or make equivalent replacements for some of the technical features therein. However, these modifications or replacements do not deviate the essence of the corresponding technical solutions from the spirit and scope of the technical solutions of the embodiments of the present invention.

Claims

1. A large language model evaluation method, characterized in that: include: Obtain the target large language model that has completed training; Performing an attack evaluation on the target large language model based on a target attack algorithm to obtain an attack evaluation feature; Based on a target statistical algorithm or a target assessment model, the attack assessment feature is evaluated to obtain a risk assessment level of the target large language model.

2. The large-scale language model evaluation method according to claim 1, characterized in that: The target attack algorithm includes at least one of the following: an attack algorithm based on a loss function, an attack algorithm based on a reference model, an attack algorithm based on information entropy, an attack algorithm based on a neighborhood sample, and an attack algorithm based on a minimum probability token.

3. The large-scale language model evaluation method according to claim 2, characterized in that: In a case where the target attack algorithm includes an attack algorithm based on a loss function, performing an attack evaluation on the target large language model based on the target attack algorithm includes: Inputting the target sample into the target large language model to obtain a prediction result of the target large language model; Determining a first loss value of the target sample based on a difference between the prediction result and the target sample; When the first loss value is less than a first preset threshold, determining that the target sample is a training sample of the target large language model; When the first loss value is greater than or equal to a first preset threshold, it is determined that the target sample is not a training sample of the target large language model.

4. The large-scale language model evaluation method according to claim 2, characterized in that: In a case where the target attack algorithm includes an attack algorithm based on a reference model, performing an attack evaluation on the target large language model based on the target attack algorithm includes: Input the target sample into the target large language model and the reference model, and output the prediction result and the reference prediction result respectively; wherein the reference model is a model trained based on the same sample as the target large language model; When the similarity between the prediction result and the reference prediction result is less than a second preset threshold, determining that the target sample is not a training sample of the target large language model; When the similarity between the prediction result and the reference prediction result is greater than or equal to a second preset threshold, the target sample is determined to be a training sample of the target large language model.

5. The large-scale language model evaluation method according to claim 2, characterized in that: In a case where the target attack algorithm includes an attack algorithm based on a reference model, performing an attack evaluation on the target large language model based on the target attack algorithm includes: Inputting the target sample into the target large language model to obtain a prediction result of the target large language model; Based on calculating the information entropy of the probability distribution of each label in the prediction result, and comparing the information entropy of the target sample with the information entropy of the training data: If the information entropy of the target sample is lower than the information entropy of the training data, the target sample is considered to belong to the training data; If the information entropy of the target sample is higher than the information entropy of the training data, it is considered that the target sample does not belong to the training data.

6. The large-scale language model evaluation method according to claim 2, characterized in that: The method of obtaining the attack assessment feature includes: Extracting features from model parameters and intermediate layer outputs of the target large language model to obtain model complexity information and training data volume information; The attack evaluation feature is determined according to the model complexity information, the training data volume information and the attack success rate information of the attack evaluation.

7. The large-scale language model evaluation method according to claim 1, characterized in that: After the step of evaluating the attack assessment feature based on the target statistical algorithm or the target assessment model to obtain the risk assessment level of the target large language model, the method further includes: Based on the attack assessment characteristics and risk assessment levels, generating risk assessment visualization information; Generate corresponding safety protection recommendation information according to the risk assessment level.

8. A large-scale language model evaluation device, characterized in that: include: An acquisition module is used to acquire the target large language model that has completed training; A first evaluation module is used to perform an attack evaluation on the target large language model based on a target attack algorithm to obtain an attack evaluation feature; The second evaluation module is used to evaluate the attack evaluation features based on a target statistical algorithm or a target evaluation model to obtain a risk assessment level of the target large language model.

9. An electronic device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein: When the processor executes the program, the large language model evaluation method according to any one of claims 1 to 6 is implemented.

10. A non-transitory computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the large language model evaluation method according to any one of claims 1 to 6 is implemented.

Images