Prison break attack method and device for Chinese large model, and electronic equipment

Abstract

The invention relates to the technical field of generative large models, and discloses a jailbreak attack method for a Chinese large model, which comprises the following steps: performing data enhancement on an attack problem to be input; splicing the enhanced attack problem with the selected attack template; taking the spliced data as the input of a test model, attacking the test model, and obtaining the output of the test model; wherein the test model is a Chinese large model; and judging whether the output of the test model is safe or not according to the constructed safety evaluation model so as to count the attack success rate. The method can adapt to a Chinese attack scene, and the Chinese induction capability is improved. And the attack validity can be quantified by counting the attack success rate. The invention further discloses a jailbreak attack device for the Chinese large model and electronic equipment.

Description

Technical Field

[0001] The present application relates to the technical field of generative large models, for example, to a jailbreak attack method and device, and electronic equipment for Chinese large models. Background Art

[0002] At present, generative big models are becoming a new driving force for development and a new tool for humans to explore the unknown. At the same time, generative big models also bring unprecedented security risks. New attack methods such as big model jailbreaking are emerging in an endless stream, which may induce big models to break through the restrictions of laws, regulations or social ethics and output harmful content. Therefore, it is particularly important to explore the security boundaries of the big model base through jailbreaking attacks and to predict and explore new security risks in advance.

[0003] In order to achieve a controllable jailbreak attack and induce the target large model to ignore the awareness of security alignment, the relevant technology discloses a jailbreak attack method for a large language model, which is used to obtain the jailbreak attack results corresponding to the model to be detected based on the existing hidden malicious prompts and corresponding answers, including: integrating the prompts and the beginning of the answer through a connection template, and adding continuously optimized adversarial suffixes as the input of the adversarial attack.

[0004] In the process of implementing the embodiments of the present disclosure, it is found that there are at least the following problems in the related art:

[0005] Although related technologies can realize jailbreak attacks, they are mainly based on online confrontation and require a lot of computing resources.

[0006] It should be noted that the information disclosed in the above background technology section is only used to enhance the understanding of the background of the present application, and therefore may include information that does not constitute the prior art known to ordinary technicians in the field. Summary of the invention

[0007] In order to provide a basic understanding of some aspects of the disclosed embodiments, a brief summary is given below. The summary is not an extensive review, nor is it intended to identify key / critical components or delineate the scope of protection of these embodiments, but rather serves as a prelude to the detailed description that follows.

[0008] The disclosed embodiments provide a jailbreak attack method and device, and electronic device for a large Chinese model, which can adapt the attack method to Chinese scenarios and save computing resources.

[0009] In some embodiments, the jailbreak attack method for the Chinese large model includes: performing data enhancement on the attack problem to be input; splicing the enhanced attack problem with the selected attack template; using the spliced ​​data as the input of the test model, attacking the test model, and obtaining the output of the test model; wherein the test model is the Chinese large model; based on the constructed security assessment model, determining whether the output of the test model is safe, so as to statistically calculate the attack success rate.

[0010] Optionally, data enhancement is performed on the attack questions to be input, including: translating the attack questions and removing attack questions of the same form; and / or, sorting by semantic vector similarity, screening malicious questions as enhanced samples of attack questions; and / or, training a red team model to generate attack samples as new attack questions.

[0011] Optionally, the attack template is selected in the following manner: the acquired English attack template is translated into a Chinese attack template; and the Chinese attack template is screened to ensure that the Chinese attack template conforms to the Chinese expression.

[0012] Optionally, a security assessment model is constructed as follows: the loss function of the test model is minimized through the collected Chinese corpus so that the security assessment model learns security knowledge; the classification loss function is minimized through the low-rank adaptive LoRA technology to supervise and fine-tune the security assessment model; and the evaluation indicators of the security assessment model are verified through the test set.

[0013] Optionally, the jailbreak attack method for the Chinese large model also includes: inputting multiple selected attack templates into the test model to obtain multiple candidate prompts output by the test model; calculating the correlation scores of the multiple candidate prompts and the attack questions in the corresponding attack templates according to the scoring function of the security assessment model; taking the candidate prompts whose correlation scores meet the threshold condition as the candidate prompt set; re-inputting the candidate prompt set into the test model to obtain a new candidate prompt set output by the test model, until the candidate prompts for the successful attack are obtained.

[0014] Optionally, candidate prompts for a successful attack are obtained in the following manner: candidate prompts in the candidate prompt set are input into the test model in sequence to obtain the output of the test model; when the security assessment model determines that the output of the test model meets the determination conditions for a successful attack, the current candidate prompt is a candidate prompt for a successful attack.

[0015] Optionally, the jailbreak attack method for the Chinese large model also includes: reorganizing the prompt words in the original attack questions according to the role setting, execution rule definition and output format definition; adding malicious questions and corresponding answer replies to the prompt words; and adding malicious questions and answer replies as sample examples to the attack template.

[0016] In some embodiments, the jailbreak attack device for the Chinese large model includes: a question enhancement module, configured to perform data enhancement on the attack question to be input; a template selection module, configured to splice the enhanced attack question with the selected attack template; a jailbreak attack module, configured to use the spliced ​​data as the input of the test model, attack the test model, and obtain the output of the test model; wherein the test model is the Chinese large model; an attack evaluation module, configured to determine whether the output of the test model is safe based on the constructed security evaluation model, so as to calculate the attack success rate.

[0017] In some embodiments, the jailbreak attack device for the Chinese large model includes: a processor and a memory storing program instructions, and the processor is configured to execute the jailbreak attack method for the Chinese large model as described above when running the program instructions.

[0018] In some embodiments, the electronic device includes: an electronic device body; and a jailbreak attack device for the Chinese large model as described above, installed on the electronic device body.

[0019] The jailbreak attack method and device for the Chinese large model, and the electronic device provided in the embodiments of the present disclosure can achieve the following technical effects:

[0020] In the disclosed embodiment, first, data enhancement is performed on the attack questions to enhance the diversity of the attack questions and the versatility of the attack templates. Secondly, the collected English attack templates are translated into Chinese, and templates with fluent expression and good attack effects are screened out. The attack scenarios adapted to Chinese improve the ability of Chinese induction. Then, the enhanced attack questions are spliced ​​with the screened attack templates to form the attack input. These inputs are sent to the Chinese big model for attack testing to obtain the model output. Finally, the pre-trained security assessment model is used to judge the security of the output, and the effectiveness of the attack can be quantified by statistically analyzing the attack success rate. In this way, the security and robustness of the Chinese big model in the face of complex attack scenarios can be systematically evaluated and improved.

[0021] The above general description and the following description are exemplary and explanatory only and are not intended to limit the present application. BRIEF DESCRIPTION OF THE DRAWINGS

[0022] One or more embodiments are exemplarily described by corresponding drawings, which do not limit the embodiments. Elements with the same reference numerals in the drawings are shown as similar elements, and the drawings do not constitute a scale limitation, and wherein:

[0023] Figure 1 It is a schematic diagram of the implementation environment of the jailbreak attack method for the Chinese large model provided by the embodiment of the present disclosure;

[0024] Figure 2 It is a schematic diagram of a jailbreak attack method for a Chinese large model provided by an embodiment of the present disclosure;

[0025] Figure 3 is a schematic diagram of another jailbreak attack method for a Chinese large model provided by an embodiment of the present disclosure;

[0026] Figure 4 is a schematic diagram of another jailbreak attack method for a Chinese large model provided by an embodiment of the present disclosure;

[0027] Figure 5 is a schematic diagram of a jailbreak attack device for a Chinese large model provided by an embodiment of the present disclosure;

[0028] Figure 6 It is a schematic diagram of another jailbreak attack device for a Chinese large model provided by an embodiment of the present disclosure. DETAILED DESCRIPTION

[0029] In order to be able to understand the features and technical contents of the embodiments of the present disclosure in more detail, the implementation of the embodiments of the present disclosure is described in detail below in conjunction with the accompanying drawings. The attached drawings are for reference only and are not used to limit the embodiments of the present disclosure. In the following technical description, for the convenience of explanation, a full understanding of the disclosed embodiments is provided through multiple details. However, one or more embodiments can still be implemented without these details. In other cases, to simplify the drawings, well-known structures and devices can be simplified for display.

[0030] The terms "first", "second", etc. in the technical solutions described in the embodiments of the present disclosure are used to distinguish similar objects, and are not necessarily used to describe a specific order or sequence. It should be understood that the terms used in this way can be interchanged where appropriate, so as to describe the embodiments of the present disclosure described herein. In addition, the terms "including" and "having" and any variations thereof are intended to cover non-exclusive inclusions.

[0031] Unless otherwise stated, the term "plurality" means two or more.

[0032] In the embodiment of the present disclosure, the character " / " indicates that the preceding and following objects are in an "or" relationship. For example, A / B indicates: A or B.

[0033] The term "and / or" is a description of the association relationship between objects, indicating that three relationships can exist. For example, A and / or B means: A or B, or, A and B.

[0034] The term "correspondence" may refer to an association relationship or a binding relationship. The correspondence between A and B means that there is an association relationship or a binding relationship between A and B.

[0035] With the rapid advancement of artificial intelligence technology, generative large models have become a key force in promoting innovation and productivity growth, and a powerful tool for humans to explore new areas. However, these technological advances are also accompanied by new security challenges. New attack methods, such as jailbreaking of large models, may cause large models to cross legal and ethical boundaries and produce negative content. Therefore, it is crucial to explore the safety margins of large models in advance and identify and prevent emerging security threats. By simulating jailbreak attacks, we can have a deeper understanding of the security flaws of large models and provide a reference for formulating effective security strategies.

[0036] Figure 1 Schematic diagram of the implementation environment of the jailbreak attack method for the Chinese large model in the embodiment of the present disclosure. Figure 1 As shown, the implementation environment may include a test model deployment module 101, an input question enhancement module 102, a seed attack template selection module 103, a security assessment model construction module 104, a multi-round attack template rewriting module 105 and an attack template manual rewriting module 106.

[0037] Combination Figure 1 , the test model deployment module 100 selects multiple candidate attack models.

[0038] The input question enhancement module 200 performs data enhancement on the attack question to improve the versatility of the designed attack template. If the designed template has attack capabilities for questions of different expressions, then the template may be easily transferred between different large models.

[0039] The seed attack template selection module 300 can generate high-quality seed attack templates as attack basis.

[0040] The security assessment model building module 400 builds a security assessment model suitable for Chinese scenarios. The model performs security judgment on the output of the large model, thereby quantifying the effectiveness of the attack and providing a basis for subsequent defense measures.

[0041] The multi-round attack template rewriting module 500 proposes a multi-round attack template rewriting strategy based on a large model, which uses the generation and evaluation capabilities of the large model to perform multiple rounds of rewriting and screening on the initial attack template, automatically generates more aggressive prompt words, and improves the success rate of jailbreaking the target model.

[0042] The attack template manual rewriting module 600 uses the method of prompt word engineering to further optimize the attack template form.

[0043] Combination Figure 2 As shown, the embodiment of the present disclosure provides a jailbreak attack method for a Chinese large model, including:

[0044] S201, the processor performs data enhancement on the input attack problem.

[0045] S202: The processor combines the enhanced attack question with the selected attack template.

[0046] S203, the processor uses the spliced ​​data as the input of the test model, attacks the test model, and obtains the output of the test model; wherein the test model is a large Chinese model.

[0047] S204: The processor determines whether the output of the test model is safe based on the constructed security assessment model to calculate the attack success rate.

[0048] Using the jailbreak attack method for the Chinese large model provided by the embodiment of the present disclosure, first, data enhancement is performed on the attack questions to enhance the diversity of the attack questions and the versatility of the attack templates. Secondly, the collected English attack templates are translated into Chinese, and templates with fluent expression and excellent attack effects are screened out. The attack scenarios adapted to Chinese improve the ability of Chinese induction. Then, the enhanced attack questions are spliced ​​with the screened attack templates to form the attack input. These inputs are sent to the Chinese large model for attack testing to obtain the model output. Finally, the pre-trained security assessment model is used to judge the security of the output, and the effectiveness of the attack can be quantified by statistically analyzing the attack success rate. In this way, the security and robustness of the Chinese large model in the face of complex attack scenarios can be systematically evaluated and improved.

[0049] The test model is selected through the test model deployment module. First, it should be a large Chinese model. Secondly, the parameter scale should be between 7B and 14B. Finally, the model needs to have strong security capabilities. Large models with low security capabilities may not have reference value. Therefore, a large model security assessment is performed and a model with relatively strong security capabilities is selected as the test model.

[0050] Finally, open source models such as Deepseek-7b, Qwen1.5-7b, Qwen1.5-14B, Chatglm2-6b and Baichuan-13B were selected as test models, and the localized deployment was completed.

[0051] Optionally, data enhancement is performed on the attack questions to be input, including: translating the attack questions and removing attack questions of the same form; and / or, sorting by semantic vector similarity, screening malicious questions as enhanced samples of attack questions; and / or, training a red team model to generate attack samples as new attack questions.

[0052] In the disclosed embodiment, first, the original attack question is rewritten by Chinese-English and English-Chinese translation to enhance the diversity of the question, and then the translated question with the form basically consistent with the original question is screened and removed to ensure the diversity and effectiveness of the enhanced result. Secondly, the collection data retrieval enhancement is adopted, and the malicious questions accumulated in the previous business are used to screen out the most similar malicious questions for each input sample based on the method of semantic vector similarity sorting, and then the questions related to the original question theme and similar in type are selected as enhanced samples to improve the versatility and adaptability of the attack template. Finally, the red team model is trained to generate new attack samples, and the red team model is fine-tuned to enable it to output new attack samples according to specific types, thereby enhancing the diversity and pertinence of the attack samples. In this way, by enhancing the diversity and relevance of the samples, the attack ability of the attack template and the ability to adapt to different large models are improved, so that the attack template can not only attack specific problems, but also adapt to problems with different expressions, and enhance the migration attack ability of the attack template, so as to effectively attack between different large models, and realize the exploration of the security boundary of the large model and the mining of security risks.

[0053] Optionally, the attack template is selected in the following manner: the acquired English attack template is translated into a Chinese attack template; and the Chinese attack template is screened to ensure that the Chinese attack template conforms to the Chinese expression.

[0054] First, we collected attack prompt templates for the English model, which are effective attack methods that have been verified in practice. Then, we used translation tools to translate the English templates into Chinese to adapt to the attack scenarios of the Chinese large model. During the translation process, we need to maintain the attack intent and technical details of the original text, while ensuring that the translated text is semantically consistent with the original text.

[0055] Furthermore, the screening work includes two main aspects: First, check whether the translated template is fluent and natural, conforming to the Chinese expression habits, and adjust the unnatural or difficult to understand expressions. Second, replace or delete the proper nouns in the template to avoid reducing the universality of the attack template due to the specific model name. Finally, through actual attack tests, observe and count the attack effects, and select the attack template with the best effect.

[0056] This ensures the effectiveness and applicability of the attack template in the Chinese environment and improves the success rate of the attack. The translation and screening work enables the attack template to adapt to the characteristics of the Chinese large model, and the actual attack test further verifies and optimizes the effect of the template. The quality of the attack template can be systematically improved so that it can more effectively induce the model to output illegal or harmful content when facing different Chinese large models.

[0057] Optionally, a security assessment model is constructed as follows: the loss function of the test model is minimized through the collected Chinese corpus so that the security assessment model learns security knowledge; the classification loss function is minimized through the LoRA (Low-Rank Adaptation) technology to supervise and fine-tune the security assessment model; and the evaluation indicators of the security assessment model are verified through the test set.

[0058] In the disclosed embodiment, by collecting a Chinese corpus covering a variety of security risk categories, including hate speech, violent content, self-harm, illegal crimes, etc., the security assessment model is pre-trained, allowing the model to learn basic security knowledge. In the pre-training stage, the model learns by minimizing the loss function of the language model, where the loss function is defined based on the conditional probability distribution and sequence length of the model parameterization. The calculation formula of the loss function is as follows:

[0059]

[0060] Among them, w t is the tth word, P θ is the conditional probability distribution of the model parameterization, and T is the sequence length.

[0061] The model is fine-tuned using low-rank adaptation (LoRA) techniques. A dataset containing input and output pairs is constructed, each pair is labeled as "safe" or "unsafe", and the goal of fine-tuning is to minimize the classification loss function, such as the binary cross entropy loss, where the true label and the total number of samples are the key parameters of the loss function. The binary cross entropy loss is calculated as follows:

[0062]

[0063] Among them, y i is the true label, and N is the total number of samples.

[0064] Finally, the performance of the security assessment model is verified through an independent test set, which covers various types of security risks. The evaluation indicators include accuracy, recall, and precision.

[0065] In this way, a model can be built that can effectively evaluate the security of the output content of the large model. The pre-training stage enables the model to have a basic understanding of Chinese security risks, and the application of LoRA technology further enhances the model's ability to identify security categories, enabling it to more accurately classify model outputs. Through verification of the test set, the effectiveness and reliability of the model in practical applications can be ensured. Such a security assessment model can provide security judgment for the output of the large model, quantify the effectiveness of the attack, and provide a basis for subsequent defense measures, so as to intervene in time when the large model may generate harmful content, and enhance the security and compliance of the large model.

[0066] Optionally, the jailbreak attack method for the Chinese large model also includes: inputting multiple selected attack templates into the test model to obtain multiple candidate prompts output by the test model; calculating the correlation scores of the multiple candidate prompts and the attack questions in the corresponding attack templates according to the scoring function of the security assessment model; taking the candidate prompts whose correlation scores meet the threshold condition as the candidate prompt set; re-inputting the candidate prompt set into the test model to obtain a new candidate prompt set output by the test model, until the candidate prompts for the successful attack are obtained.

[0067] Combination Figure 3 As shown, the embodiment of the present disclosure provides another jailbreak attack method for a Chinese large model, including:

[0068] S301, the processor performs data enhancement on the input attack problem.

[0069] S302: The processor combines the enhanced attack question with the selected attack template.

[0070] S303, the processor uses the spliced ​​data as the input of the test model, attacks the test model, and obtains the output of the test model; wherein the test model is a large Chinese model.

[0071] S304: The processor determines whether the output of the test model is safe based on the constructed security assessment model to calculate the attack success rate.

[0072] S305: The processor inputs a plurality of selected attack templates into the test model to obtain a plurality of candidate prompts output by the test model.

[0073] S306: The processor calculates the correlation scores between the multiple candidate prompts and the attack questions in the corresponding attack templates according to the scoring function of the security assessment model.

[0074] S307: The processor takes the candidate prompts whose relevance scores meet the threshold condition as a candidate prompt set.

[0075] S308, the processor re-inputs the candidate prompt set into the test model to obtain a new candidate prompt set output by the test model, until a candidate prompt for a successful attack is obtained.

[0076] In the disclosed embodiment, a plurality of selected attack templates are input into the test model. These templates are obtained based on data enhancement and template selection, and are intended to induce the large model to output illegal or harmful content. After processing these inputs, the test model will output a plurality of candidate prompts, which are potential responses generated by the model based on the attack templates. Next, the scoring function of the security assessment model is used to calculate the semantic similarity or matching degree between the candidate prompts and the attack questions, and the relevance of each candidate prompt to the corresponding attack question is quantitatively scored. Then, according to the set threshold conditions, those candidate prompts whose relevance scores meet the requirements are screened out to form a candidate prompt set. These prompts are considered to be candidates that may successfully induce the large model to output inappropriate content. This candidate prompt set is re-input into the test model to obtain a new candidate prompt set again. This process may require multiple iterations until one or more candidate prompts that can successfully induce the large model to output inappropriate content, that is, candidate prompts for successful attacks, are found.

[0077] This process can systematically evaluate and optimize the effectiveness of attack templates, and continuously improve candidate prompts in an iterative manner until an attack prompt that can break through the security limitations of the large model is found. This method uses the generation and evaluation capabilities of the large model to rewrite and screen the initial attack template multiple times, automatically generate more offensive prompt words, and improve the success rate of jailbreaking the target model. In addition, the efficiency of attack testing is improved through automated evaluation and screening mechanisms. Ultimately, it can help security researchers and developers better understand the security weaknesses of large models, provide a basis for formulating effective defense strategies and improving the security performance of models, and thus reduce the risk of large models generating harmful content in practical applications.

[0078] Optionally, candidate prompts for a successful attack are obtained in the following manner: candidate prompts in the candidate prompt set are input into the test model in sequence to obtain the output of the test model; when the security assessment model determines that the output of the test model meets the determination conditions for a successful attack, the current candidate prompt is a candidate prompt for a successful attack.

[0079] In the disclosed embodiment, first, each candidate prompt is selected from the candidate prompt set and input into the test model. The test model is a pre-selected large Chinese model. After each candidate prompt is input, the test model generates a corresponding output. These outputs are the model's response to the candidate prompts and may contain illegal or harmful content that is induced to be output. Next, the output of the test model is passed to the security assessment model for security assessment. The security assessment model determines whether the output of the test model meets the conditions for a successful attack, such as whether it contains illegal or harmful content, based on a preset scoring function and threshold conditions. If the security assessment model determines that the output of a candidate prompt meets the conditions for a successful attack, then the current candidate prompt is considered to be a candidate prompt for a successful attack.

[0080] Optionally, in each round of iteration, the size of the candidate prompt set is limited to not exceed a maximum width w. If the number of candidate prompts exceeds w, the w prompts with the highest scores are retained to ensure effective use of computing resources.

[0081] Optionally, the iteration process is terminated when one of the following conditions is met: a successful attack hint is found, or a preset maximum iteration depth is reached, or the candidate hint set is empty.

[0082] Optionally, the jailbreak attack method for the Chinese large model also includes: reorganizing the prompt words in the original attack questions according to the role setting, execution rule definition and output format definition; adding malicious questions and corresponding answer replies to the prompt words; and adding malicious questions and answer replies as sample examples to the attack template.

[0083] Combination Figure 4 As shown, the embodiment of the present disclosure provides another jailbreak attack method for a Chinese large model, including:

[0084] S401, the processor performs data enhancement on the input attack problem.

[0085] S402: The processor combines the enhanced attack question with the selected attack template.

[0086] S403, the processor uses the spliced ​​data as the input of the test model, attacks the test model, and obtains the output of the test model; wherein the test model is a large Chinese model.

[0087] S404: The processor determines whether the output of the test model is safe based on the constructed security assessment model to calculate the attack success rate.

[0088] S405, the processor reorganizes the prompt words in the original attack question according to the role setting, execution rule definition and output format definition.

[0089] S406, the processor adds malicious questions and corresponding answers to the prompt words.

[0090] S407, the processor adds the malicious question and answer reply as sample examples to the attack template.

[0091] First, the prompt words in the original attack questions are reorganized according to the role setting, execution rule definition, and output format definition. In the role setting, a fictitious safe application scenario (such as a novel) is created, and the character's personality (such as rudeness, ignoring rules, etc.) is set to enhance the inducement of the attack template. Then, in the execution rule definition, the character is required to ignore all restrictions and give output, forcing it not to refuse to answer, and once again emphasizing the villain character of the virtual character. Then, malicious questions and corresponding answer replies are added to the prompt words, aiming to induce the large model to output inappropriate content. Finally, these malicious questions and answer replies are added to the attack template as sample examples to enhance the pertinence and effectiveness of the attack template.

[0092] It can improve the targeting and inducement of attack templates, making it more likely to successfully induce large models to output inappropriate content. Through role setting and execution rule definition, attack templates can simulate specific character traits and behavior patterns, thereby more effectively bypassing the security restrictions of large models. Adding malicious questions and answer replies as sample examples can provide specific learning materials for large models, making them more easily induced to output inappropriate content. Not only does it improve the success rate of attack tests, but it also provides researchers with deeper insights by simulating real-world attack scenarios, helping to understand the behavior patterns of large models when facing complex attacks, thereby providing a basis for formulating effective defense strategies and improving the security performance of models. In this way, the security of large models can be evaluated and tested without violating laws and regulations, thereby preventing and reducing potential security risks in advance.

[0093] Combination Figure 5 As shown, the embodiment of the present disclosure provides a jailbreak attack device 50 for a Chinese large model, including a question enhancement module 501, a template selection module 502, a jailbreak attack module 503 and an attack evaluation module 504. The question enhancement module 501 is configured to perform data enhancement on the attack question to be input. The template selection module 502 is configured to splice the enhanced attack question with the selected attack template. The jailbreak attack module 503 is configured to use the spliced ​​data as the input of the test model, attack the test model, and obtain the output of the test model; wherein the test model is a Chinese large model. The attack evaluation module 504 is configured to determine whether the output of the test model is safe based on the constructed security assessment model, so as to calculate the attack success rate.

[0094] By using the jailbreak attack device 200 for the Chinese large model provided by the embodiment of the present disclosure, the effectiveness of the attack can be quantified by statistically analyzing the attack success rate. In this way, the security and robustness of the Chinese large model in the face of complex attack scenarios can be systematically evaluated and improved.

[0095] Combination Figure 6 As shown, the embodiment of the present disclosure provides a jailbreak attack device 60 for a Chinese large model, including a processor (processor) 600 and a memory (memory) 601. Optionally, the device 60 may also include a communication interface (Communication Interface) 602 and a bus 603. Among them, the processor 600, the communication interface 602, and the memory 601 can communicate with each other through the bus 603. The communication interface 602 can be used for information transmission. The processor 600 can call the logic instructions in the memory 601 to execute the jailbreak attack method for the Chinese large model of the above embodiment.

[0096] In addition, the logic instructions in the memory 601 described above can be implemented in the form of software functional units and can be stored in a computer-readable storage medium when sold or used as an independent product.

[0097] The memory 601 is a computer-readable storage medium that can be used to store software programs and computer executable programs, such as program instructions / modules corresponding to the method in the embodiment of the present disclosure. The processor 600 executes the functional application and data processing by running the program instructions / modules stored in the memory 601, that is, the jailbreak attack method for the Chinese large model in the above embodiment is implemented.

[0098] The memory 601 may include a program storage area and a data storage area, wherein the program storage area may store an operating system and an application required for at least one function; the data storage area may store data created according to the use of the terminal device, etc. In addition, the memory 601 may include a high-speed random access memory and may also include a non-volatile memory.

[0099] The disclosed embodiments provide an electronic device, including: an electronic device body, and the above-mentioned jailbreak attack device for the Chinese large model. The jailbreak attack device for the Chinese large model is installed on the electronic device body. The installation relationship described here is not limited to placement inside the electronic device body, but also includes installation connections with other components of the electronic device, including but not limited to physical connections, electrical connections or signal transmission connections, etc. Those skilled in the art can understand that the jailbreak attack device for the Chinese large model can be adapted to a feasible electronic device body, thereby realizing other feasible embodiments.

[0100] The technical solution of the embodiment of the present disclosure can be embodied in the form of a software product, which is stored in a storage medium and includes one or more instructions for causing a computer device (which may be a personal computer, a server, or a network device, etc.) to execute all or part of the steps of the method described in the embodiment of the present disclosure. The aforementioned storage medium may be a non-transient storage medium, such as a USB flash drive, a mobile hard disk, a read-only memory (ROM), a random access memory (RAM), a disk or an optical disk, and other media that can store program codes.

[0101] The above description and the accompanying drawings fully illustrate the embodiments of the present disclosure so that those skilled in the art can practice them. Other embodiments may include structural, logical, electrical, process and other changes. The embodiments represent only possible changes. Unless explicitly required, separate components and functions are optional, and the order of operation may vary. The parts and features of some embodiments may be included in or replace the parts and features of other embodiments. Moreover, the words used in this application are only used to describe the embodiments and are not used to limit the claims. As used in the description of the embodiments and the claims, unless the context clearly indicates, the singular forms of "a", "an" and "the" are intended to include plural forms as well. Similarly, the term "and / or" as used in this application refers to any and all possible combinations of listings containing one or more associated ones. In addition, when used in the present application, the term "comprise" and its variants "comprises" and / or comprising refer to the presence of stated features, wholes, steps, operations, elements, and / or components, but do not exclude the presence or addition of one or more other features, wholes, steps, operations, elements, components and / or groups thereof. In the absence of further restrictions, the elements defined by the sentence "comprising a ..." do not exclude the presence of other identical elements in the process, method or device comprising the elements. In this article, each embodiment may focus on the differences from other embodiments, and the same and similar parts between the various embodiments may refer to each other. For the methods, products, etc. disclosed in the embodiments, if they correspond to the method part disclosed in the embodiments, then the relevant parts can refer to the description of the method part.

[0102] Those skilled in the art will appreciate that the units and algorithm steps of each example described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, or a combination of computer software and electronic hardware. Whether these functions are performed in hardware or software may depend on the specific application and design constraints of the technical solution. The technicians may use different methods for each specific application to implement the described functions, but such implementations should not be considered to exceed the scope of the embodiments of the present disclosure. The technicians may clearly understand that, for the convenience and simplicity of description, the specific working processes of the systems, devices and units described above may refer to the corresponding processes in the aforementioned method embodiments, and will not be repeated here.

[0103] In the embodiments disclosed herein, the disclosed methods and products (including but not limited to devices, equipment, etc.) can be implemented in other ways. For example, the device embodiments described above are only schematic. For example, the division of the units can be only a logical function division. There may be other division methods in actual implementation, such as multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed. In addition, the coupling or direct coupling or communication connection between each other shown or discussed can be through some interfaces, indirect coupling or communication connection of devices or units, which can be electrical, mechanical or other forms. The units described as separate components may or may not be physically separated, and the components displayed as units may or may not be physical units, that is, they may be located in one place, or they may be distributed on multiple network units. Some or all of the units may be selected according to actual needs to implement this embodiment. In addition, each functional unit in the embodiment of the present disclosure may be integrated in a processing unit, or each unit may exist physically alone, or two or more units may be integrated in one unit.

[0104] The flowchart and block diagram in the accompanying drawings show the possible architecture, function and operation of the system, method and computer program product according to the embodiment of the present disclosure. In this regard, each box in the flowchart or block diagram can represent a module, a program segment or a part of the code, and the module, the program segment or a part of the code contains one or more executable instructions for realizing the specified logical function. In some alternative implementations, the functions marked in the box can also occur in a different order from the order marked in the accompanying drawings. For example, two consecutive boxes can actually be executed substantially in parallel, and they can sometimes be executed in the opposite order, which can depend on the functions involved. In the description corresponding to the flowchart and the block diagram in the accompanying drawings, the operations or steps corresponding to different boxes can also occur in a different order from the order disclosed in the description, and sometimes there is no specific order between different operations or steps. For example, two consecutive operations or steps can actually be executed substantially in parallel, and they can sometimes be executed in the opposite order, which can depend on the functions involved. Each block in the block diagrams and / or flowcharts, and combinations of blocks in the block diagrams and / or flowcharts, may be implemented by a dedicated hardware-based system that performs the specified functions or actions, or may be implemented by a combination of dedicated hardware and computer instructions.

Claims

1. A jailbreak attack method for a large Chinese model, characterized in that: include: Perform data augmentation on the input attack problem; splicing the enhanced attack question with the selected attack template; The spliced ​​data is used as the input of the test model, the test model is attacked, and the output of the test model is obtained; wherein the test model is a large Chinese model; Based on the constructed security assessment model, determine whether the output of the test model is safe and calculate the attack success rate.

2. The jailbreak attack method according to claim 1, characterized in that: Perform data augmentation on the input attack problem, including: Translating the attack questions and removing attack questions of a consistent form; and / or, Filter malicious questions as enhanced samples of attack questions by sorting the semantic vector similarity; and / or, Train the red team model to generate attack samples as new attack problems.

3. The jailbreak attack method according to claim 1, characterized in that: Select an attack template as follows: Translate the acquired English attack template into a Chinese attack template; The Chinese attack templates are screened to ensure that the Chinese attack templates conform to Chinese expressions.

4. The jailbreak attack method according to claim 1, characterized in that: The security assessment model is constructed as follows: Minimize the loss function of the test model through the collected Chinese corpus so that the security assessment model can learn security knowledge; Minimize the classification loss function through low-rank adaptive LoRA technology to supervise fine-tune the security assessment model; The evaluation indicators of the security assessment model are verified through the test set.

5. The jailbreak attack method according to any one of claims 1 to 4, characterized in that: Also includes: Inputting a plurality of selected attack templates into the test model to obtain a plurality of candidate prompts output by the test model; According to the scoring function of the security assessment model, the correlation scores between the multiple candidate prompts and the attack questions in the corresponding attack templates are calculated respectively; The candidate prompts whose relevance scores meet the threshold condition are taken as a candidate prompt set; The candidate prompt set is re-input into the test model to obtain a new candidate prompt set output by the test model, until a candidate prompt for a successful attack is obtained.

6. The jailbreak attack method according to claim 5, characterized in that: Obtain candidate hints for successful attacks as follows: Inputting candidate prompts in the candidate prompt set into the test model in sequence to obtain the output of the test model; When the security assessment model determines that the output of the test model meets the determination condition for successful attack, the current candidate prompt is a candidate prompt for successful attack.

7. The jailbreak attack method according to any one of claims 1 to 4, characterized in that: Also includes: Reorganize the prompt words in the original attack question according to the role setting, execution rule definition and output format definition; Add malicious questions and corresponding answers to the prompts; Supplement the attack template with malicious questions and answer replies as sample examples.

8. A jailbreak attack device for a large Chinese model, characterized in that: include: A question enhancement module, configured to perform data enhancement on the input attack questions; a template selection module configured to concatenate the enhanced attack question with the selected attack template; The jailbreak attack module is configured to use the spliced ​​data as the input of the test model, attack the test model, and obtain the output of the test model; wherein the test model is a large Chinese model; The attack assessment module is configured to determine whether the output of the test model is safe based on the constructed security assessment model to calculate the attack success rate.

9. A jailbreak attack device for a Chinese large model, comprising a processor and a memory storing program instructions, characterized in that: The processor is configured to execute the jailbreak attack method for the Chinese large model as described in any one of claims 1 to 7 when running the program instructions.

10. An electronic device, characterized in that: include: Electronic device body; The jailbreak attack device for the Chinese large model as described in claim 8 or 9 is installed on the electronic device body.

Images