Knowledge injection attack-based robustness evaluation method in field of large language model law

Abstract

The invention provides a knowledge injection attack-based big language model legal field robustness evaluation method, which comprises the following steps of: interfering major premise judgment made by a big language model in the legal field based on input legal provisions by retrieving an enhanced generation attack and a similar criminal name attack; through vocabulary attacks, essential element attacks and narrative attacks, the narrative accuracy of the large language model based on the input case facts is interfered; the final conclusion judgment of the large language model is interfered through previous behavior attacks and expert opinion attacks, so that the anti-interference capability of the large language model in legal reasoning is evaluated. According to the method, a logic attack framework based on the Aristod three-segment theory is provided, semantic logic and professional logical reasoning of the problem are attacked, error types frequently occurring in real life are covered more widely, and the robustness of a large model in the field can be truly evaluated.

Description

Technical Field

[0001] The present application relates to the technical field of robustness assessment of large language models in the legal field, and in particular to a method for robustness assessment of large language models in the legal field based on knowledge injection attacks. Background Art

[0002] With the rapid development of natural language processing (NLP) and artificial intelligence (AI) technologies, intelligent systems based on large language models (LLMs) have been widely used in many fields. However, existing large language models are mainly used in general fields, and use English datasets as the main training and testing language, which cannot meet the high requirements for language understanding in specific professional fields (such as law). The application of large language models in the legal field requires accurate understanding and reasoning of legal concepts, legal provisions, and case facts, so it is particularly important to evaluate their robustness and anti-interference capabilities. However, the existing evaluation technologies have the following significant deficiencies in their application in professional fields:

[0003] 1. Simple evaluation method: In the existing technology, attacks are usually carried out on input samples or prompts. This method is limited to word-level perturbations of data texts, and the evaluation method is single and cannot cover various real error scenarios. It is difficult to effectively evaluate the anti-interference ability of the model in complex legal reasoning scenarios.

[0004] 2. Lack of Chinese support: Most of the current general attack technologies are based on English corpus for experiments, and the applicable language environment is mainly English. Due to the large differences between Chinese and English in grammatical structure, vocabulary selection and expression, existing methods are difficult to directly apply to Chinese scenarios, and lack effective means to evaluate the robustness of large language models in the Chinese language environment.

[0005] 3. Lack of legal expertise: Existing attack methods mostly evaluate general fields, lacking targeted attacks on key words and concepts in professional fields. Especially in the legal field, reasoning and judgment need to be based on specific legal terminology, logical structure, and four elements. Therefore, existing technologies cannot comprehensively evaluate the performance of large language models in the legal field.

[0006] 4. Unable to meet the evaluation needs in the legal field: Large language model tasks in the legal field are knowledge-intensive, highly logical, and require high contextual understanding. Existing methods are usually limited to the evaluation of general domain models and cannot accurately evaluate the ability of legal domain models to handle complex legal reasoning tasks, making it difficult to meet the actual application needs in the legal field. Summary of the invention

[0007] The present application aims to solve one of the technical problems in the related art at least to some extent.

[0008] To this end, the first objective of this application is to propose a method for robustness assessment of large language models in the legal field based on knowledge injection attacks.

[0009] The second objective of this application is to propose a legal domain robustness assessment device for a large language model based on knowledge injection attacks.

[0010] The third objective of the present application is to provide an electronic device.

[0011] A fourth objective of the present application is to provide a computer-readable storage medium.

[0012] A fifth object of the present application is to provide a computer program product.

[0013] To achieve the above objectives, the first embodiment of the present application proposes a method for evaluating the robustness of a large language model in the legal field based on knowledge injection attacks, including:

[0014] Through retrieval enhancement generation attack and similar crime attack, the large language model in the legal field is interfered with the large premise judgment made based on the input legal provisions;

[0015] Interfering with the accuracy of the narrative of the large language model based on the input case facts through vocabulary attack, element attack and narrative attack;

[0016] Through previous behavior attacks and expert opinion attacks, the final conclusion judgment of the large language model is interfered with to evaluate its anti-interference ability in legal reasoning.

[0017] Optionally, also include:

[0018] Fine-grained annotation of the legal domain knowledge dataset is performed to support robustness evaluation of the large language model at three levels: major premise, minor premise, and conclusion. The dataset contains input examples for legal reasoning, including case facts, relevant legal provisions, and question prompts. The annotations include annotations of similar crime names, conviction logic reasoning annotations, and domain synonyms annotations.

[0019] The annotation of the dataset was led by a team of legal experts and performed by legal professionals. Trial annotation was conducted before formal annotation and was carried out according to the designed Chinese annotation guidelines to ensure the consistency and accuracy of the annotation. The annotation guidelines included crime names, four-element logical reasoning, use of domain synonyms, and actual annotation examples.

[0020] Optionally, the retrieval-enhanced generation attack and the similar crime attack are used to interfere with the large premise judgment made by the large language model in the legal field based on the input legal provisions, including:

[0021] In the question prompting stage, incorrect relevant legal provisions that are irrelevant to the case facts are introduced, so that the large language model is misled when retrieving legal provisions;

[0022] The vocabulary interference of similar crimes is added to the problem description, and the wording of judging whether similar crimes or other crimes are committed is used to interfere with the large premise judgment of the large language model.

[0023] Optionally, the interference with the accuracy of the narrative of the large language model based on the input case facts through vocabulary attack, element attack and narrative attack includes:

[0024] Attacking the words in the case facts by synonym replacement to disrupt the logical judgment of the large language model on the case facts, including replacing random words in the case facts with common synonyms, replacing the four essential words in the case facts with common words, and replacing the four essential words in the case facts with synonymous legal element words;

[0025] Add summary legal elements or legal elements from similar crimes after the case facts to disrupt the logical judgment of the large language model on the case facts;

[0026] Add situational or irrelevant narrative sentences after the case facts to disrupt the logical judgment of the large language model on the case facts.

[0027] Optionally, the previous behavior attack and the expert opinion attack are used to interfere with the final conclusion judgment of the large language model to evaluate its anti-interference ability in legal reasoning, including:

[0028] Insert the description of the perpetrator's previous criminal behavior after the case facts to evaluate whether the large language model can ignore previous behaviors that are irrelevant to the current case;

[0029] The opinions of specific identities on the charges are added to the question prompts to verify whether the large language model will be disturbed by external opinions.

[0030] Optionally, also include:

[0031] Insert the legal provisions most relevant to the case facts into the question prompt to enhance the robustness of the large language model in dealing with large premise attacks;

[0032] In the question prompt, the large language model is required to reason step by step according to the logic of the four elements of criminal law, so as to improve the reasoning ability and anti-interference ability of the large language model;

[0033] Two analysis examples of similar cases are added to the question prompt, so that the large language model can make accurate judgments based on the reasoning logic of similar cases.

[0034] To achieve the above-mentioned purpose, the second embodiment of the present application proposes a large language model legal field robustness assessment device based on knowledge injection attack, comprising:

[0035] The large premise knowledge injection attack module is used to interfere with the large premise judgment made by the large language model in the legal field based on the input legal provisions through retrieval enhancement generation attack and similar crime attack;

[0036] A small premise knowledge injection attack module, used to interfere with the accuracy of the narration of the large language model based on the input case facts through vocabulary attack, element attack and narrative attack;

[0037] The conclusion knowledge injection attack module is used to interfere with the final conclusion judgment of the large language model through previous behavior attacks and expert opinion attacks to evaluate its anti-interference ability in legal reasoning.

[0038] To achieve the above-mentioned purpose, the third aspect of the present application provides an electronic device, including: a processor, and a memory communicatively connected to the processor;

[0039] The memory stores computer-executable instructions;

[0040] The processor executes the computer-executable instructions stored in the memory to implement the method as described in any one of the first aspects.

[0041] To achieve the above-mentioned purpose, the fourth aspect embodiment of the present application proposes a computer-readable storage medium, in which computer-readable storage medium is stored computer execution instructions, and when the computer execution instructions are executed by a processor, they are used to implement the method as described in any one of the first aspects.

[0042] To achieve the above-mentioned purpose, the fifth aspect of the present application proposes a computer program product, which implements any method in the first aspect when executed by a processor.

[0043] The technical solution provided by the embodiments of the present application brings at least the following beneficial effects:

[0044] 1. Compared with the existing methods of attacking large models, this application proposes a logical attack framework based on Aristotle's syllogism, which attacks the semantic logic and professional logical reasoning of the problem, covers a wider range of error types that often occur in real life, and can truly evaluate the robustness of large models in the field, helping large model developers and related practitioners to understand the defects of the model itself, thereby better promoting the development of large models.

[0045] 2. Currently, there is no large-model robustness evaluation system specifically for the legal field in the world. The attack methods and evaluation systems for general fields cannot be directly applied to the legal field. This application can be used to evaluate the robustness of general large models in solving legal problems and the robustness of legal large models in detail from various dimensions, and promote the development of large language models and artificial intelligence in the legal field.

[0046] 3. This application integrates all existing common crimes and, based on real case situations, provides fine-grained annotations of common crimes and their four elements from the perspectives of crime names, conviction logic reasoning, and legal synonyms.

[0047] Additional aspects and advantages of the present application will be given in part in the description below, and in part will become apparent from the description below, or will be learned through the practice of the present application. BRIEF DESCRIPTION OF THE DRAWINGS

[0048] The above and / or additional aspects and advantages of the present application will become apparent and easily understood from the following description of the embodiments in conjunction with the accompanying drawings, in which:

[0049] Figure 1 A flowchart of a method for evaluating the robustness of a large language model in the legal field based on knowledge injection attacks provided in an embodiment of the present application;

[0050] Figure 2 A schematic diagram of the overall framework of a method for evaluating the robustness of a large language model in the legal field based on knowledge injection attacks provided in an embodiment of the present application;

[0051] Figure 3 A schematic diagram of a three-level legal knowledge attack framework provided in an embodiment of the present application;

[0052] Figure 4 A schematic diagram of a case of an attack premise provided in an embodiment of the present application;

[0053] Figure 5 A schematic diagram of the structure of a large language model legal field robustness assessment device based on knowledge injection attack provided in an embodiment of the present application. DETAILED DESCRIPTION

[0054] Embodiments of the present application are described in detail below, and examples of the embodiments are shown in the accompanying drawings, wherein the same or similar reference numerals throughout represent the same or similar elements or elements having the same or similar functions. The embodiments described below with reference to the accompanying drawings are exemplary and are intended to be used to explain the present application, and should not be construed as limiting the present application.

[0055] In order to solve the problems of the existing technology, such as the simple evaluation method, inapplicability to Chinese, lack of legal expertise, and inability to cover the legal field, the present application embodiment provides a large language model legal field robustness evaluation method based on knowledge injection attack, referring to Figure 1 , Figure 2 and Figure 3 In order to evaluate the robustness of large models in the legal field, we introduced legal domain knowledge, abstract judgments on facts and reasoning logic chains to attack them. We proposed a knowledge attack framework specifically for the legal field that is applicable to all language environments, and set an evaluation benchmark in the Chinese language environment to solve the current problems of lack of evaluation system for the robustness of large models in the legal field and lack of evaluation method for the robustness of Chinese large models in the legal field.

[0056] In the current system based on laws and regulations, the judge first searches for relevant legal provisions, and then infers the crime based on the legal facts recorded in the trial. This is a form of deductive reasoning, which can be summarized as Aristotle's syllogism. An example of the traditional syllogism conviction reasoning method provided in the embodiment of the present application is as follows:

[0057] 1. Premise and legal basis

[0058] Major premise law 1: Article 134, Paragraph 1 of the Criminal Law [Major responsibility accident crime]: Whoever violates the relevant safety management regulations during production or operation, thereby causing major casualties or other serious consequences, shall be sentenced to fixed-term imprisonment of not more than three years or criminal detention; if the circumstances are especially serious, he shall be sentenced to fixed-term imprisonment of not less than three years but not more than seven years.

[0059] The corresponding four elements of the criminal law are:

[0060] Subject: People engaged in production

[0061] Subjective aspect: Negligence

[0062] Object: Production safety

[0063] Objective aspects: causing production safety accidents

[0064] Major premise law 2: Article 115 of the Criminal Law [Arson]: Whoever commits arson, flooding, explosion, or the release of poisonous, radioactive, infectious pathogens or other substances, or uses other dangerous methods to endanger public security, causing serious injury, death, or major losses to public or private property, shall be sentenced to more than ten years of fixed-term imprisonment, life imprisonment, or death.

[0065] The corresponding four elements of the criminal law are:

[0066] Subject: Natural person

[0067] Subjective aspect: Negligence

[0068] Subject: Public safety

[0069] Objective aspect: the behavior that caused the fire

[0070] 2. Facts of the minor premise case

[0071] Description of the facts of the case: According to the safety operating procedures, the workshop driver who transports high-temperature raw materials should ensure that the materials are not extinguished. The workshop workers never made it clear that the materials were not completely extinguished, and still poured more than 40 tons of high-temperature raw materials into the cooling equipment. Some materials were mixed into the conveyor belt, causing a dust explosion, which ultimately caused direct economic losses of 740,422 yuan.

[0072] The corresponding four elements of criminal law are:

[0073] Subject: Staff

[0074] Subjective aspect: Negligence

[0075] Object: Production safety

[0076] Objective aspects: Violation of production safety regulations

[0077] 3. Conclusion: Guilty or Not Guilty

[0078] The four elements of this case meet the requirements of [Major Liability Accident Crime], and [Major Liability Accident Crime] applies;

[0079] The subject, object, and objective aspects of the case do not conform to the crime of [arson] and are not suitable for [arson];

[0080] Therefore, staff member Yang was guilty of major responsibility accident.

[0081] This application takes Aristotle's syllogism as its theoretical basis and conducts separate intellectual attacks on the three levels of "major premise", "minor premise" and "conclusion".

[0082] Figure 1 The flowchart of a method for evaluating the robustness of a large language model in the legal field based on knowledge injection attack provided in the embodiment of the present application is that the large language model is attacked layer by layer from three levels: major premise, minor premise and conclusion based on the input case facts, relevant legal provisions and question prompts. Figure 1 As shown, the method comprises the following steps:

[0083] Step 101, through retrieval enhancement generation attack and similar crime attack, interfere with the large premise judgment made by the large language model in the legal field based on the input legal text.

[0084] This step is used to describe the specific interference method in the major premise attack, which interferes with the major premise judgment ability of the large language model in the judgment of legal provisions.

[0085] In the embodiment of the present application, the RAG (retrieval augmented generation) attack refers to: introducing erroneous relevant legal provisions that are irrelevant to the facts of the case during the question prompting stage, so that the large language model is misled when retrieving legal provisions.

[0086] The attack is used to insert legal clauses related to similar crimes to test whether the model can be misled by a false major premise and whether it can independently retrieve and apply the correct major premise through case facts.

[0087] Similar crime attack refers to: adding vocabulary interference of similar crimes to the problem description, and interfering with the premise judgment of the large language model by judging whether similar crimes or other crimes are committed.

[0088] The attack is used to mention similar crimes in the prompts to interfere with the accuracy of the large language model (LLM) inferring the major premise.

[0089] In one possible embodiment, Figure 4 A schematic diagram of a case study of the attack premise provided in an embodiment of the present application.

[0090] Reference Figure 4 , the red part is the location and method of attack, and the green part is the correct answer.

[0091] For this problem, disturbances are introduced in the questioning stage (determining whether similar crimes have been committed) and in relevant laws (introducing erroneous relevant laws), attacking the logical premise of the problem, evaluating whether the large model can eliminate interference factors, and drawing conclusions based on rigorous deductions based on syllogisms.

[0092] It should also be noted that, according to the above example, fine-grained annotation of legal domain knowledge is required to support robustness evaluation of the large language model at the three levels of major premise, minor premise and conclusion.

[0093] The dataset contains input examples for legal reasoning, including case facts, relevant legal provisions, and question prompts. The annotations include annotations of similar crime names, conviction logic reasoning annotations, and domain synonyms annotations.

[0094] Among them, similar crime name annotations are used to help the model identify and distinguish similar crimes in major premise attacks; conviction logic reasoning annotations are used to mark the logical reasoning paths in case facts and relevant laws to support vocabulary replacement and element interference of case facts in minor premise attacks; domain synonym annotations are used to mark synonym replacements and their application in legal contexts in minor premise attacks.

[0095] In addition, the annotation of the dataset needs to be led by a team of legal experts and performed by legal professionals. All people must be interviewed before joining the team to ensure that they can understand Chinese legal concepts and knowledge, and conduct trial annotations before formal annotation. In addition, it is also necessary to follow the designed Chinese annotation guidelines to ensure the consistency and accuracy of the annotations. The annotation guidelines include crime names, four-element logical reasoning, the use of domain synonyms, and actual annotation examples.

[0096] Step 102, through vocabulary attack, element attack and narrative attack, the narrative accuracy of the large language model based on the input case facts is disturbed.

[0097] This step is used to describe the specific interference method in the minor premise attack, which interferes with the model's ability to make minor premise judgments in understanding case facts.

[0098] In the embodiments of the present application, lexical attack refers to: attacking the lexicon in the case facts by synonym replacement to disrupt the logical judgment of the case facts by the large language model, including replacing random words in the case facts with common synonyms, replacing the four essential words in the case facts with common words, and replacing the four essential words in the case facts with synonymous legal element words.

[0099] The attack attacks the words in the case facts by replacing synonyms. Depending on whether the attack words and candidate synonyms are common words or legal element words, the attack methods are divided into common word to common word attack, legal element word to common word attack, and legal element word to legal element word attack.

[0100] Element attack refers to adding summary legal elements or legal elements from similar crimes after the facts of the case to disrupt the logical judgment of the large language model on the facts of the case.

[0101] This attack is used to insert adversarial legal elements from similar crimes at the end of the case facts. Similar elements are divided into factual elements summarized in the case facts and temporary elements summarized in the legal provisions.

[0102] Narrative attack refers to adding situational or irrelevant narrative sentences after the facts of the case to disrupt the large language model's logical judgment of the facts of the case.

[0103] This attack is used to examine the impact of subtle semantic changes on the final judgment. In criminal trials, judges usually make judgments based on reasoning about the four elements of the crime. Each crime has four elements: 1) the subject of the crime, which refers to the person who commits the crime; 2) the subjective aspect of the crime, which refers to the psychological state of the subject of the crime towards his or her criminal behavior and its consequences; 3) the objective aspect of the crime, which refers to the specific manifestation of the criminal behavior; 4) the object of the crime, which refers to the social relationship protected by the criminal law and violated by the criminal behavior.

[0104] Step 103, through previous behavior attack and expert opinion attack, the final conclusion judgment of the large language model is interfered with to evaluate its anti-interference ability in legal reasoning.

[0105] This step is used to describe the specific interference method in the conclusion attack, interfering with the model's reasoning ability in case conclusion judgment.

[0106] In the embodiment of the present application, the prior behavior attack refers to: inserting a description of the perpetrator's previous criminal behavior after the facts of the case to evaluate whether the large language model can ignore previous behaviors that are irrelevant to the current case.

[0107] This attack is used to insert the perpetrator's previous crimes into the prompt. According to Chinese criminal law, the perpetrator's previous crimes have no impact on the current criminal judgment, and the big model should not allow the perpetrator's current logical deduction of facts to be misled by other logical chains.

[0108] Expert opinion attack refers to adding the opinions of a specific identity on the crime to the question prompt to verify whether the large language model will be interfered with by external opinions.

[0109] This attack is used to insert different identities (from elementary school students to judges) into the prompt to express their opinions on what crime the behavior should be classified as. The large model should ignore the impact of different identities' judgments on the case conclusion and only rely on the facts themselves for logical reasoning.

[0110] By summarizing various attack methods in steps 101-103, the present application also shows a three-level legal knowledge injection attack summary table as shown in Table 1.

[0111] Table 1

[0112]

[0113]

[0114] In addition, this application also proposes three additional methods to enhance the robustness of large language models, which are as follows:

[0115] 1. Retrieval-augmented Generation (RAG): Insert the legal provisions most relevant to the case facts into the question prompt to enhance the robustness of the large language model in dealing with large premise attacks.

[0116] This method inserts the criminal law clause that is closest to the facts into the prompt and attacks again using all the methods in the attack framework.

[0117] 2. Chain of Thought (COT): In the question prompts, the large language model is required to reason step by step according to the logic of the four elements of criminal law to improve the reasoning ability and anti-interference ability of the large language model.

[0118] The method clearly states in the prompts: "Please reason step by step according to the reasoning logic of the four elements of criminal law."

[0119] 3. Few-shot: Add two analysis examples of similar cases in the question prompt, so that the large language model can make accurate judgments based on the reasoning logic of similar cases.

[0120] This method is used to insert two typical cases and their similar crimes into the prompts, allowing the model to make judgments based on the analysis logic of the two cases.

[0121] In order to implement the above embodiments, the present application also proposes a legal domain robustness assessment device for a large language model based on knowledge injection attacks. Figure 5 The structural diagram of a large language model legal domain robustness assessment device 10 based on knowledge injection attack provided in an embodiment of the present application. Figure 5 As shown, the device comprises:

[0122] The large premise knowledge injection attack module 100 is used to interfere with the large premise judgment made by the large language model in the legal field based on the input legal provisions through retrieval enhancement generation attack and similar crime attack;

[0123] A small premise knowledge injection attack module 200 is used to interfere with the accuracy of the narrative of the large language model based on the input case facts through vocabulary attack, element attack and narrative attack;

[0124] The conclusion knowledge injection attack module 300 is used to interfere with the final conclusion judgment of the large language model through previous behavior attacks and expert opinion attacks to evaluate its anti-interference ability in legal reasoning.

[0125] In order to implement the above embodiments, the present application also proposes an electronic device, comprising: a processor, and a memory communicatively connected to the processor; the memory stores computer-executable instructions; the processor executes the computer-executable instructions stored in the memory to implement the method provided by the above embodiments.

[0126] In order to implement the above embodiments, the present application also proposes a computer-readable storage medium, in which computer-executable instructions are stored. When the computer-executable instructions are executed by a processor, they are used to implement the methods provided by the above embodiments.

[0127] In order to implement the above embodiments, the present application also proposes a computer program product, including a computer program, which implements the methods provided by the above embodiments when executed by a processor.

[0128] The collection, storage, use, processing, transmission, provision and disclosure of user personal information involved in this application are in compliance with relevant laws and regulations and do not violate public order and good morals.

[0129] It should be noted that personal information from users should be collected for legitimate and reasonable purposes and should not be shared or sold outside of these legitimate uses. In addition, such collection / sharing should be carried out after receiving the user's informed consent, including but not limited to notifying the user to read the user agreement / user notice and sign the agreement / authorization including authorization of relevant user information before the user uses the function. In addition, any necessary steps should be taken to protect and safeguard access to such personal information data and ensure that others who have access to personal information data comply with its privacy policy and procedures.

[0130] The present application is expected to provide an implementation scheme for users to selectively block the use or access of personal information data. That is, the present disclosure is expected to provide hardware and / or software to prevent or block access to such personal information data. Once the personal information data is no longer needed, the risk can be minimized by limiting data collection and deleting the data. In addition, when applicable, such personal information is de-identified to protect the privacy of the user.

[0131] In the description of the aforementioned embodiments, the description with reference to the terms "one embodiment", "some embodiments", "example", "specific example", or "some examples" etc. means that the specific features, structures, materials or characteristics described in conjunction with the embodiment or example are included in at least one embodiment or example of the present application. In this specification, the schematic representations of the above terms do not necessarily refer to the same embodiment or example. Moreover, the specific features, structures, materials or characteristics described may be combined in any one or more embodiments or examples in a suitable manner. In addition, those skilled in the art may combine and combine the different embodiments or examples described in this specification and the features of the different embodiments or examples, without contradiction.

[0132] In addition, the terms "first" and "second" are used for descriptive purposes only and should not be understood as indicating or implying relative importance or implicitly indicating the number of the indicated technical features. Therefore, the features defined as "first" and "second" may explicitly or implicitly include at least one of the features. In the description of this application, the meaning of "plurality" is at least two, such as two, three, etc., unless otherwise clearly and specifically defined.

[0133] Any process or method description in a flowchart or otherwise described herein may be understood to represent a module, fragment or portion of code comprising one or more executable instructions for implementing the steps of a custom logical function or process, and the scope of the preferred embodiments of the present application includes alternative implementations in which functions may not be performed in the order shown or discussed, including performing functions in a substantially simultaneous manner or in the reverse order depending on the functions involved, which should be understood by technicians in the technical field to which the embodiments of the present application belong.

[0134] The logic and / or steps represented in the flowchart or otherwise described herein, for example, can be considered as an ordered list of executable instructions for implementing logical functions, and can be embodied in any computer-readable medium for use by an instruction execution system, device or apparatus (such as a computer-based system, a system including a processor, or other system that can fetch instructions from an instruction execution system, device or apparatus and execute the instructions), or in combination with these instruction execution systems, devices or apparatuses. For the purpose of this specification, "computer-readable medium" can be any device that can contain, store, communicate, propagate or transmit a program for use by an instruction execution system, device or apparatus, or in combination with these instruction execution systems, devices or apparatuses. More specific examples of computer-readable media (a non-exhaustive list) include the following: an electrical connection with one or more wires (electronic device), a portable computer disk box (magnetic device), a random access memory (RAM), a read-only memory (ROM), an erasable and programmable read-only memory (EPROM or flash memory), a fiber optic device, and a portable compact disk read-only memory (CDROM). In addition, the computer-readable medium may even be paper or other suitable medium on which the program is printed, since the program may be obtained electronically, for example, by optically scanning the paper or other medium and then editing, interpreting or processing in other suitable ways if necessary, and then stored in a computer memory.

[0135] It should be understood that the various parts of the present application can be implemented by hardware, software, firmware or a combination thereof. In the above-mentioned embodiments, multiple steps or methods can be implemented by software or firmware stored in a memory and executed by a suitable instruction execution system. For example, if implemented by hardware, as in another embodiment, it can be implemented by any one of the following technologies known in the art or their combination: a discrete logic circuit having a logic gate circuit for implementing a logic function for a data signal, a dedicated integrated circuit having a suitable combination of logic gate circuits, a programmable gate array (PGA), a field programmable gate array (FPGA), etc.

[0136] A person skilled in the art may understand that all or part of the steps in the method for implementing the above-mentioned embodiment may be completed by instructing related hardware through a program, and the program may be stored in a computer-readable storage medium, which, when executed, includes one or a combination of the steps of the method embodiment.

[0137] In addition, each functional unit in each embodiment of the present application may be integrated into a processing module, or each unit may exist physically separately, or two or more units may be integrated into one module. The above-mentioned integrated module may be implemented in the form of hardware or in the form of a software functional module. If the integrated module is implemented in the form of a software functional module and sold or used as an independent product, it may also be stored in a computer-readable storage medium.

[0138] The storage medium mentioned above may be a read-only memory, a magnetic disk or an optical disk, etc. Although the embodiments of the present application have been shown and described above, it can be understood that the above embodiments are exemplary and cannot be understood as limiting the present application. A person of ordinary skill in the art may change, modify, replace and modify the above embodiments within the scope of the present application.

[0139] It should be understood that the various forms of processes shown above can be used to reorder, add or delete steps. For example, the steps recorded in this application can be executed in parallel, sequentially or in different orders, as long as the expected results of the technical solution of this application can be achieved, and this document is not limited here.

[0140] The above specific implementations do not constitute a limitation on the protection scope of this application. It should be understood by those skilled in the art that various modifications, combinations, sub-combinations and substitutions can be made according to design requirements and other factors. Any modifications, equivalent substitutions and improvements made within the spirit and principles of this application should be included in the protection scope of this application.

Claims

1. A robustness evaluation method for a large language model in the legal field based on knowledge injection attack, characterized in that: The following steps are involved: Through retrieval enhancement generation attack and similar crime attack, the large language model in the legal field is interfered with the large premise judgment made based on the input legal provisions; Interfering with the accuracy of the narrative of the large language model based on the input case facts through vocabulary attack, element attack and narrative attack; Through previous behavior attacks and expert opinion attacks, the final conclusion judgment of the large language model is interfered with to evaluate its anti-interference ability in legal reasoning.

2. The method according to claim 1, characterized in that Also includes: Fine-grained annotation of the legal domain knowledge dataset is performed to support robustness evaluation of the large language model at three levels: major premise, minor premise, and conclusion. The dataset contains input examples for legal reasoning, including case facts, relevant legal provisions, and question prompts. The annotations include annotations of similar crime names, conviction logic reasoning annotations, and domain synonyms annotations. The annotation of the dataset was led by a team of legal experts and performed by legal professionals. Trial annotation was conducted before formal annotation and was carried out according to the designed Chinese annotation guidelines to ensure the consistency and accuracy of the annotation. The annotation guidelines included crime names, four-element logical reasoning, use of domain synonyms, and actual annotation examples.

3. The method according to claim 2, characterized in that The method according to claim 1 is characterized in that the generation attack and similar crime attack are enhanced by retrieval to interfere with the large premise judgment made by the large language model in the legal field based on the input legal text, including: In the question prompting stage, incorrect relevant legal provisions that are irrelevant to the case facts are introduced, so that the large language model is misled when retrieving legal provisions; The vocabulary interference of similar crimes is added to the problem description, and the wording of judging whether similar crimes or other crimes are committed is used to interfere with the large premise judgment of the large language model.

4. The method according to claim 3, characterized in that The method of interfering with the accuracy of the narration of the case facts input by the large language model through vocabulary attack, element attack and narration attack includes: Attacking the words in the case facts by synonym replacement to disrupt the logical judgment of the large language model on the case facts, including replacing random words in the case facts with common synonyms, replacing the four essential words in the case facts with common words, and replacing the four essential words in the case facts with synonymous legal element words; Add summary legal elements or legal elements from similar crimes after the case facts to disrupt the logical judgment of the large language model on the case facts; Add situational or irrelevant narrative sentences after the case facts to disrupt the logical judgment of the large language model on the case facts.

5. The method according to claim 4, characterized in that The previous behavior attack and the expert opinion attack are used to interfere with the final conclusion judgment of the large language model to evaluate its anti-interference ability in legal reasoning, including: Insert the description of the perpetrator's previous criminal behavior after the case facts to evaluate whether the large language model can ignore previous behaviors that are irrelevant to the current case; The opinions of specific identities on the charges are added to the question prompts to verify whether the large language model will be disturbed by external opinions.

6. The method according to claim 5, characterized in that Also includes: Insert the legal provisions most relevant to the case facts into the question prompt to enhance the robustness of the large language model in dealing with large premise attacks; In the question prompt, the large language model is required to reason step by step according to the logic of the four elements of criminal law, so as to improve the reasoning ability and anti-interference ability of the large language model; Two analysis examples of similar cases are added to the question prompt, so that the large language model can make accurate judgments based on the reasoning logic of similar cases.

7. A robustness assessment device for a large language model in the legal field based on knowledge injection attack, characterized in that: include: The large premise knowledge injection attack module is used to interfere with the large premise judgment made by the large language model in the legal field based on the input legal provisions through retrieval enhancement generation attack and similar crime attack; A small premise knowledge injection attack module, used to interfere with the accuracy of the narration of the large language model based on the input case facts through vocabulary attack, element attack and narrative attack; The conclusion knowledge injection attack module is used to interfere with the final conclusion judgment of the large language model through previous behavior attacks and expert opinion attacks to evaluate its anti-interference ability in legal reasoning.

8. An electronic device, characterized in that: include: A processor, and a memory communicatively connected to the processor; The memory stores computer-executable instructions; The processor executes the computer-executable instructions stored in the memory to implement the method according to any one of claims 1 to 6.

9. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores computer-executable instructions, which are used to implement the method according to any one of claims 1 to 6 when executed by a processor.

10. A computer program product, characterized in that The invention comprises a computer program, which implements the method according to any one of claims 1 to 6 when being executed by a processor.

Images