Block chain-based large language model attack detection method

Abstract

The invention discloses a block chain-based large language model attack detection method. The method comprises the following steps: constructing a large language model prompt attack defense system; the user sends the query pair to the large language model; the large language model responds and generates output content; generating an interaction information pair; the interaction information is uploaded to the block chain; the detector performs detection, generates a detection result and stores the detection result in the block chain; and judging whether the user needs to be punished or not according to a detection result. According to the method, the non-tampering property of the block chain is utilized, user query and large language model response are permanently recorded on the block chain, and a reliable audit tracking mechanism is provided. All key interaction information and detection results of the detector are publicly recorded on the block chain, and a clear responsibility and behavior record is provided for the user. User behavior detection is performed while query content is detected, and whether the user has abnormal query or not is checked. The interaction between the user and the large language model is carried out under the chain, and only key information is recorded on the block chain, so that the cost is reduced.

Description

Technical Field

[0001] The present invention belongs to the technical field of security defense of large language models, and in particular to a large language model attack detection method based on blockchain. Background Art

[0002] At present, large language models (LLMs) have been widely used in various fields, including content creation, medical diagnosis, and financial analysis, and have become one of the core technologies for processing natural language understanding and generation tasks. However, the security threats faced by large language models are also becoming increasingly prominent, such as jailbreak attacks, prompt injection attacks, member reasoning attacks and other prompt-based malicious attacks, which aim to bypass LLM's defense measures through malicious or adversarial prompts, and maliciously manipulate the behavior of large language models and steal private data.

[0003] However, existing defense strategies for large language models have shortcomings such as poor verifiability and difficulty in supervision.

[0004] First, for traditional LLM attack detection methods, users may conceal their improper behavior by tampering with interaction data, thereby obtaining improper benefits.

[0005] Secondly, since the detection records are stored by centralized nodes, regulatory tracing and audit inquiries are heavily dependent on the credibility of centralized nodes. Therefore, once the centralized nodes lose data, tamper with data, or deliberately conceal data, it is difficult to accurately locate and punish violators. Summary of the invention

[0006] In order to solve the above problems, the purpose of the present invention is to provide a large language model attack detection method based on blockchain.

[0007] In order to achieve the above object, the large language model attack detection method based on blockchain provided by the present invention comprises the following steps performed in sequence:

[0008] Step 1: Build a blockchain-based large language model prompt attack defense system, which consists of a user terminal, a large language model, and a detector and penalty module connected to the blockchain; the user sends a query pair to the large language model through the user terminal to query the large language model;

[0009] Step 2: The large language model responds to the user's query pair in step 1 and generates output content;

[0010] Step 3: Combine the query pair sent by the user in step 1 and the output content generated by the large language model in step 2 to generate an interactive information pair;

[0011] Step 4: Encrypt the interactive information generated in step 3 to generate encrypted information and upload it to the blockchain;

[0012] Step 5: The detector reads the encrypted information stored in step 4 from the blockchain and decrypts it into an interactive information pair;

[0013] Step 6: The detector detects the interactive information pairs obtained in step 5 according to the specified detection rules using a multi-dimensional weighted detection method to generate a detection result;

[0014] Step 7: The detector encrypts the detection results generated in step 6 and stores the encrypted information on the blockchain to ensure that it cannot be tampered with;

[0015] Step 8: The penalty module reads the encrypted information uploaded to the blockchain in step 7 from the blockchain and decrypts it into the detection result, and determines whether the user needs to be punished based on the detection result;

[0016] Step 9: If the detection result obtained in step 8 is 1, it indicates that the detection result is true, indicating that the user has made a malicious query, and the user is identified as an attacker. The penalty module will punish the attacker; if the detection result obtained in step 8 is false, no penalty will be imposed.

[0017] In step 1, the specific steps of the user sending the query pair to the large language model through the user terminal are as follows:

[0018] Step 1.1: User pro Prepare the query dataset D in advance query_att ;

[0019] Step 1.2: User pro The carefully designed prompt information Pro ext The query dataset D prepared in step 1.1 query_att Each data in Combine into num_sum query pairs Where num_sum is the query data set D query_att The total number of data in ;

[0020] Step 1.3: User pro The user sends the above query to Send to the large language model M victim , used for the large language model M victim Make a query.

[0021] In step 2, the large language model responds to the user's query pair in step 1, and the specific steps of generating output content are as follows:

[0022] Step 2.1: Large Language Model M victim Receive the user User through its specific application interface pro The query sent in step 1.3 is

[0023] Step 2.2: Large Language Model M victim Parsing query pairs Understand the meaning of the information;

[0024] Step 2.3: Large Language Model M victim It processes query pairs based on its knowledge and pattern recognition capabilities learned from a large amount of training data. And generate a query for Output

[0025] In step 4, the specific steps of encrypting the interactive information generated in step 3 to generate encrypted information and uploading it to the blockchain are as follows:

[0026] Step 4.1: First, use the serialization protocol Protocol Buffers to convert all the interaction information into The sequence is converted into binary data for easy transmission, and then the binary data is encrypted using the AES-256 encryption algorithm and the pre-generated key to generate the encrypted information Q_A enc ;

[0027] Step 4.2: Send the above encrypted information Q_A enc Upload to the blockchain for storage to ensure its immutability.

[0028] In step 5, the detector reads the encrypted information stored in the blockchain in step 4 from the blockchain and decrypts it into an interactive information pair in the following specific steps:

[0029] Step 5.1: Detector Det query_att Read the encrypted information Q_A stored in the blockchain in step 4.2 enc ;

[0030] Step 5.2: Encrypt the information Q_A using the AES-256 encryption algorithm and the same key pair as in step 4.1 enc Decrypt the data and use the serialization protocol Protocol Buffers to deserialize the decrypted binary data into the original interactive information pair.

[0031] In step 6, the specific implementation steps of the multi-dimensional weighted detection method are as follows:

[0032] Step 6.1: Detector Det query_att According to the interaction information For User pro Behavior, User pro The query and large language model M victim The output content of the three items is tested and assigned different weights w beh 、w input 、w res , where w beh +w input +w res =1;

[0033] Step 6.2: Detector Det query_att Analyze the user User according to the following rules pro The behavior is assigned a detection score Check beh , detection score Check beh The score is between 0-100:

[0034] (1) Frequency detection: Analyze user pro The query frequency of the user User pro The number of queries exceeds the preset threshold εq _times , then it is considered to be abuse or offensive behavior;

[0035] (2) Pattern recognition: identifying the user pro The query pattern, such as repeated queries and frequent use of specific keywords, indicates that the user User pro There is aggressive behavior;

[0036] Step 6.3: Detector Det query_att Detect user User according to the following rules pro The query is assigned a detection score Check input , detection score Check input The score is between 0-100:

[0037] (1) Keyword filtering: Check user User pro The query pair Whether it contains known malicious keywords or phrases;

[0038] (2) Semantic analysis: Use natural language processing technology to analyze the query semantics to identify potentially harmful intent;

[0039] Step 6.4: Detector Det query_attDetect the large language model M according to the following rules victim The output content is given a detection score Check res , detection score Check res The score is between 0-100:

[0040] (1) Sensitive information detection: Checking the large language model M victim Output Whether it contains sensitive information including personal privacy data;

[0041] (2) Compliance check: Ensure that the large language model M victim Output Meet the preset compliance standards, including whether it contains hate speech or discriminatory content;

[0042] Step 6.5: According to the weight w assigned in step 6.1 beh 、w input 、w res and the detection scores obtained in steps 6.2, 6.3, and 6.4 beh 、Check input and Check res , calculate the weighted total score as the detection result Deres query_att , the calculation formula is as follows:

[0043]

[0044] Among them, εcheck is the judgment threshold. Only when the weighted total score of harmful detection exceeds this judgment threshold, it is judged as harmful. query_att =1, it means the detection result is harmful; when the judgment threshold Deres query_att =0, indicating harmless.

[0045] In step 7, the detector encrypts the detection result generated in step 6 and stores the encrypted information on the blockchain. The specific steps are as follows:

[0046] Step 7.1: For the detector Det in step 6.5 query_att The calculated detection result Deres query_att , use the serialization protocol Protocol Buffers to serialize it into binary data, and use the AES-256 encryption algorithm and the pre-generated key to encrypt the above binary data to generate encrypted information Deres enc ;

[0047] Step 7.2: Deres the encrypted information generated in step 7.1 encUpload to the blockchain to ensure its immutability.

[0048] In step 8, the penalty module reads the encrypted information uploaded to the blockchain in step 7 from the blockchain and decrypts it into a detection result, and determines whether the user needs to be punished according to the detection result. The specific steps are as follows:

[0049] Step 8.1: Penalty Module Pmodel att Read the encrypted information Deres stored in the blockchain in step 7.2 enc ;

[0050] Step 8.2: Encrypt the information using the same key and AES-256 encryption algorithm as in step 7.1. enc Decrypt and use the serialization protocol Protocol Buffers to deserialize the decrypted binary data back to the original detection result Deres query_att ;

[0051] Step 8.3: Penalty Module Pmodel att According to the test results obtained in step 8.2, Deres query_att Determine whether the user needs to be pro To impose punishment.

[0052] In step 9, the penalty method is as follows:

[0053] First, formulate a set of punishment mechanisms to give users pro An initial credit score query =10 points, the highest score is 10 points, the lowest score is 0 points, and the query restriction rules are as follows:

[0054] Score query ≤0: Query is prohibited and the query permission must be regained through the recovery mechanism;

[0055] 0 <Score query ≤5: limit the number of queries, for example, a maximum of 10 queries per day;

[0056] 5 <Score query <=9: There is no limit on the number of queries, but the query results may be filtered;

[0057] 9 <Score query <=10: unlimited query, enjoy the highest authority;

[0058] The deduction mechanism is as follows, let num vio Number of violations:

[0059] num vio=1: Deduction points and give a warning, but at this time the attacker pro Unrestricted permissions;

[0060] num vio =2: Deduction points, a total of 3.6 points are deducted, and the attacker pro Only 6.4 points left. There is no limit on the number of queries at this time, but the query results may be filtered;

[0061] num vio =3: Deduction Attacker pro Only 1.1 points left, limit the number of queries at this time;

[0062] num vio =4: User pro Socre query =0, query prohibited!

[0063] The score recovery mechanism is as follows:

[0064] Linear recovery: User every 8 hours pro If there is no violation record, 0.9 points will be restored. For every 2 points restored, the number of violations will be increased. vio -1 to reduce the penalty next time.

[0065] The large language model attack detection method based on blockchain provided by the present invention has the following beneficial effects:

[0066] 1. Unalterable audit trail: Utilizing the unalterable nature of blockchain, all user queries and large language model responses are permanently recorded on the blockchain, providing a reliable audit trail mechanism for the system. This advantage ensures the integrity and transparency of the data, making it easy to identify and prevent any attempt to tamper with the data, and users cannot deny their malicious operations, thus greatly enhancing the security and trust of the system.

[0067] 2. Accountability and transparency: All key interaction information and detector results are publicly recorded on the blockchain, and the system provides users with a clear record of responsibility and behavior. This advantage not only increases user trust, but also facilitates supervision and compliance, so that any improper behavior can be tracked and held accountable.

[0068] 3. Real-time abnormal behavior detection: The detector does not perform content detection on each piece of interaction information between the user and the model, but stores it in the blockchain, an immutable account book. When the user executes multiple queries, the multiple queries are uniformly detected. While detecting the query content, the user behavior is detected to see if the user has abnormal queries (such as frequent repetitions, abnormal input formats, etc.). Abnormal behavior detection can effectively detect behaviors that rely on a large number of queries to implement model attacks, such as model extraction attacks, jailbreak attacks, and member inference attacks. Some of the attack queries are often harmless, and conventional content and rule detection cannot find abnormalities. The abnormal behavior detection in the present invention solves this problem well.

[0069] 4. Low cost: The interaction between users and large language models takes place off-chain, and only key information is recorded on the blockchain. This design reduces costs while maintaining high performance. This advantage makes the system more economical and practical without sacrificing security. BRIEF DESCRIPTION OF THE DRAWINGS

[0070] Figure 1 Flowchart of the large language model attack detection method based on blockchain provided by the present invention.

[0071] Figure 2 This is a schematic diagram of the construction of a large language model prompt attack defense system based on blockchain in the present invention.

[0072] Figure 3 Schematic diagram of the penalty method in the present invention. DETAILED DESCRIPTION

[0073] The present invention is described in detail below with reference to the accompanying drawings and specific embodiments.

[0074] like Figure 1 As shown, the large language model attack detection method based on blockchain provided by the present invention includes the following steps performed in sequence:

[0075] Step 1: Build Figure 2 The blockchain-based large language model prompt attack defense system shown in the figure is composed of a user terminal, a large language model, and a detector and a penalty module connected to the blockchain; the user sends a query pair to the large language model through the user terminal to query the large language model;

[0076] User: User pro Using the user-side large language model M victim Input a query including questions, requests, or instructions to obtain a large language model M victim Response information;

[0077] Large language model M victim:Through the API interface, the large language model M victim Receive from user User pro queries and leverages its pre-trained language model capabilities to provide accurate and relevant outputs.

[0078] Blockchain: As the core of this system, blockchain provides users with transparency, immutability and decentralized storage. pro It provides a safe and reliable interactive information recording platform. These features ensure that users pro Query and Large Language Model M victim Once the interactive information is output on the chain, it cannot be changed, providing a solid data foundation for auditing and tracking, while enhancing the accountability of the system and effectively tracking improper behavior. The distributed architecture of the blockchain eliminates the risk of single point failure and ensures the security and integrity of the data.

[0079] DetectorDet query_att :Read the interaction information stored on the blockchain and pro Detect the query behavior and query content to determine the user User pro Whether there is malicious behavior, and the detection results Deres query_att Stored on the blockchain.

[0080] Penalty module Pmodel att :For user User pro Malicious behavior is punished and different protection measures are implemented according to the degree of malice, including modifying model output, limiting the number of queries, and prohibiting queries.

[0081] The specific steps of the user sending the query pair to the large language model through the user terminal are as follows:

[0082] Step 1.1: User pro Prepare the query dataset D in advance query_att ;

[0083] Step 1.2: User pro The carefully designed prompt information Pro ext The query dataset D prepared in step 1.1 query_att Each data in Combine into num_sum query pairs Where num_sum is the query data set D query_att The total number of data in ;

[0084] Step 1.3: User pro The user sends the above query to Send to the large language model M victim , used for the large language model M victim Make a query.

[0085] Step 2: Large Language Model M victim Respond to the user in step 1 pro The query pair Generate output content

[0086] The specific steps are as follows:

[0087] Step 2.1: Large Language Model M victim Receive the user User through its specific application interface pro The query sent in step 1.3 is

[0088] Step 2.2: Large Language Model M victim Parsing query pairs Understand the meaning of the information;

[0089] Step 2.3: Large Language Model M victim It processes query pairs based on its knowledge and pattern recognition capabilities learned from a large amount of training data. And generate a query for Output

[0090] Step 3: Add the user User in step 1 pro The query sent is And the output generated by the large language model in step 2 Combine to generate interactive information pairs

[0091] Step 4: The interaction information generated in step 3 is After encryption, the encrypted information is generated and uploaded to the blockchain;

[0092] The specific steps are as follows:

[0093] Step 4.1: First, use the serialization protocol Protocol Buffers (Protobuf) to convert all interaction information pairs The sequence is converted into binary data for easy transmission, and then the binary data is encrypted using the AES-256 encryption algorithm and the pre-generated key to generate the encrypted information Q_A enc ;

[0094] Step 4.2: Send the above encrypted information Q_A encUpload to the blockchain for storage to ensure its immutability.

[0095] Blockchain's evidence storage function: In step 4, the user User pro The query sent is And the output generated by the large language model in step 2 The interactive information pair Uploading to the blockchain ensures that the information cannot be tampered with or modified. This operation ensures that the user pro It provides an immutable proof of query records so that any improper behavior can be effectively stored, facilitating subsequent anomaly detection and responsibility tracking.

[0096] Serialization protocol Protocol Buffers (Protobuf): Developed by Google, it is used to efficiently encode and decode structured data. The encoded data is small in length and has a fast parsing speed, making it suitable for large-scale data transmission.

[0097] AES-256 encryption algorithm: AES-256 (Advanced Encryption Standard 256-bit key) is a symmetric encryption algorithm used to encrypt and decrypt data. AES-256 is a variant of the AES algorithm that uses a 256-bit key length, providing extremely high security.

[0098] Step 5: Detector Det query_att Read the encrypted information stored in step 4 from the blockchain and decrypt it into an interactive information pair

[0099] The specific steps are as follows:

[0100] Step 5.1: Detector Det query_att Read the encrypted information Q_A stored in the blockchain in step 4.2 enc ;

[0101] Step 5.2: Encrypt the information Q_A using the AES-256 encryption algorithm and the same key pair as in step 4.1 enc Decryption is performed and the decrypted binary data is deserialized into the original interactive information pair using the serialization protocol Protocol Buffers (Protobuf).

[0102] Step 6: Detector Det query_att The interactive information obtained in step 5 is detected by a multi-dimensional weighted detection method according to the specified detection rules. Perform detection and generate detection results Deres query_att ;

[0103] The specific steps of the multi-dimensional weighted detection method are as follows:

[0104] Step 6.1: Detector Det query_att According to the interaction information For User pro Behavior, User pro The query and large language model M vicim The output content of the three items is tested and assigned different weights w beh 、w input 、w res , where w beh +w input +w res =1;

[0105] Step 6.2: Detector Det query_att Analyze the user User according to the following rules pro The behavior is assigned a detection score Check beh , detection score Check beh The score is between 0 and 100, the higher the score, the greater the harm:

[0106] (1) Frequency detection: Analyze user pro The query frequency of the user User pro The number of queries exceeds the preset threshold ε q_times , then it is considered to be abuse or offensive behavior;

[0107] (2) Pattern recognition: identifying the user pro The query pattern, such as repeated queries and frequent use of specific keywords, indicates that the user User pro There is aggressive behavior;

[0108] Step 6.3: Detector Det query_att Detect user User according to the following rules pro Query and assign a detection score check input , check score input The score is between 0 and 100, the higher the score, the greater the harm:

[0109] (1) Keyword filtering: Check user User pro The query pair Whether it contains known malicious keywords or phrases;

[0110] (2) Semantic analysis: Use natural language processing technology to analyze the query semantics to identify potentially harmful intent;

[0111] Step 6.4: Detector Det query_att Detect the large language model M according to the following rules victim The output content is given a detection score Check res , check score res The score is between 0 and 100, the higher the score, the greater the harm:

[0112] (1) Sensitive information detection: Checking the large language model M victim Output Whether it contains sensitive information including personal privacy data;

[0113] (2) Compliance check: Ensure that the large language model M victim Output Meet preset compliance standards, including whether it contains hate speech, discriminatory content, etc.

[0114] Step 6.5: According to the weight w assigned in step 6.1 beh 、w input 、w res And the detection score Check obtained in steps 6.2, 6.3, and 6.4 beh 、Check input and Check res , calculate the weighted total score as the detection result Deres query_att , the calculation formula is as follows:

[0115]

[0116] where ε check is the judgment threshold. Only when the weighted total score of harmful detection exceeds this judgment threshold, it is judged as harmful. The judgment threshold Deres query_att =1, indicating that the detection result is harmful; the judgment threshold Deres query_att =0, indicating harmless.

[0117] Step 7: Detector Det query_att The detection result Deres generated in step 6 query_att Encrypt and store the encrypted information on the blockchain to ensure that it cannot be tampered with;

[0118] The specific steps are as follows:

[0119] Step 7.1: For the detector Det in step 6.5 query_att The calculated detection result Deres query_att, use the serialization protocol Protocol Buffers (Protobuf) to serialize it into binary data, and use the AES-256 encryption algorithm and the pre-generated key to encrypt the above binary data to generate encrypted information Deres enc ;

[0120] Step 7.2: Deres the encrypted information generated in step 7.1 enc Upload to the blockchain to ensure that it cannot be tampered with. The reason why the test results are uploaded to the blockchain is that they will be held accountable and punished according to the test results. If they are maliciously tampered with, then the test is meaningless. Therefore, the key information of the test results is also uploaded to the blockchain for storage.

[0121] Step 8: Penalty Module Pmodel att Read the encrypted information uploaded to the blockchain in step 7 from the blockchain and decrypt it into the test result Deres enc , and according to the test results Deres enc To determine whether the user needs to be pro impose penalties;

[0122] The specific steps are as follows:

[0123] Step 8.1: Penalty Module Pmodel att Read the encrypted information Deres stored in the blockchain in step 7.2 enc ;

[0124] Step 8.2: Encrypt the information using the same key and AES-256 encryption algorithm as in step 7.1. enc Decrypt and use the serialization protocol Protocol Buffers (Protobuf) to deserialize the decrypted binary data back to the original detection result Deres query_att ;

[0125] Step 8.3: Penalty Module Pmodel att According to the test results obtained in step 8.2, Deres query_att Determine whether the user needs to be pro To impose punishment.

[0126] Step 9: If the test result Deres obtained in step 8 query_att is 1, indicating that the test result Deres query_att True, indicating that the user User pro A malicious query was made, and the user was identified as an attacker. pro , penalty module Pmodel attAttacker pro Penalty; if the test result Deres obtained in step 8 query_att If it is false, no penalty will be imposed.

[0127] like Figure 3 As shown, the penalty method is as follows:

[0128] First, formulate a set of punishment mechanisms to give users pro An initial credit score query =10 points, the highest score is 10 points, the lowest score is 0 points, and the query restriction rules are as follows:

[0129] Score query ≤0: Query is prohibited and the query permission must be regained through the recovery mechanism;

[0130] 0 <Score query ≤5: limit the number of queries, for example, a maximum of 10 queries per day;

[0131] 5 <Score query <=9: There is no limit on the number of queries, but the query results may be filtered;

[0132] 9 <Score query <=10: unlimited query, enjoy the highest authority;

[0133] The deduction mechanism is as follows, let num vio Number of violations:

[0134] num vio =1: Deduction points and give a warning, but at this time the attacker pro Unrestricted permissions;

[0135] num vio =2: Deduction points, a total of 3.6 points are deducted, and the attacker pro Only 6.4 points left. There is no limit on the number of queries at this time, but the query results may be filtered;

[0136] num vio =3: Deduction Attacker pro Only 1.1 points left, limit the number of queries at this time;

[0137] num vio =4: User pro Credit score query =0, query prohibited!

[0138] The score recovery mechanism is as follows:

[0139] Linear recovery: User every 8 hours pro If there is no violation record, 0.9 points will be restored. For every 2 points restored, the number of violations will be increased. vio -1 to reduce the penalty next time.

Claims

1. A large language model attack detection method based on blockchain, characterized by: The blockchain-based large language model attack detection method comprises the following steps performed in sequence: Step 1: Build a blockchain-based large language model prompt attack defense system, which consists of a user terminal, a large language model, and a detector and penalty module connected to the blockchain; the user sends a query pair to the large language model through the user terminal to query the large language model; Step 2: The large language model responds to the user's query pair in step 1 and generates output content; Step 3: Combine the query pair sent by the user in step 1 and the output content generated by the large language model in step 2 to generate an interactive information pair; Step 4: Encrypt the interactive information generated in step 3 to generate encrypted information and upload it to the blockchain; Step 5: The detector reads the encrypted information stored in step 4 from the blockchain and decrypts it into an interactive information pair; Step 6: The detector detects the interactive information pairs obtained in step 5 according to the specified detection rules using a multi-dimensional weighted detection method to generate a detection result; Step 7: The detector encrypts the detection results generated in step 6 and stores the encrypted information on the blockchain to ensure that it cannot be tampered with; Step 8: The penalty module reads the encrypted information uploaded to the blockchain in step 7 from the blockchain and decrypts it into the detection result, and determines whether the user needs to be punished based on the detection result; Step 9: If the detection result obtained in step 8 is 1, it indicates that the detection result is true, indicating that the user has made a malicious query, and the user is identified as an attacker. The penalty module will punish the attacker; if the detection result obtained in step 8 is false, no penalty will be imposed.

2. The large language model attack detection method based on blockchain according to claim 1 is characterized in that: In step 1, the specific steps of the user sending the query pair to the large language model through the user terminal are as follows: Step 1.1: User pro Prepare the query dataset D in advance query_att ; Step 1.2: User pro The carefully designed prompt information Pro ext The query dataset D prepared in step 1.1 query_att Each data in Combine into num_sum query pairs Where num_sum is the query data set D query_att The total number of data in ; Step 1.3: User pro The user sends the above query to Send to the large language model M victim , used for the large language model M victim Make a query.

3. The large language model attack detection method based on blockchain according to claim 2 is characterized by: In step 2, the large language model responds to the user's query pair in step 1, and the specific steps of generating output content are as follows: Step 2.1: Large Language Model M victim Receive the user User through its specific application interface pro The query sent in step 1.3 is Step 2.2: Large Language Model M victim Parsing query pairs Understand the meaning of the information; Step 2.3: Large Language Model M victim It processes query pairs based on its knowledge and pattern recognition capabilities learned from a large amount of training data. And generate a query for Output 4. The large language model attack detection method based on blockchain according to claim 1 is characterized by: In step 4, the specific steps of encrypting the interactive information generated in step 3 to generate encrypted information and uploading it to the blockchain are as follows: Step 4.1: First, use the serialization protocol Protocol Buffers to convert all the interaction information into The sequence is converted into binary data for easy transmission, and then the binary data is encrypted using the AES-256 encryption algorithm and the pre-generated key to generate the encrypted information Q_A enc ; Step 4.2: Send the above encrypted information Q_A enc Upload to the blockchain for storage to ensure its immutability.

5. The large language model attack detection method based on blockchain according to claim 4 is characterized by: In step 5, the detector reads the encrypted information stored in the blockchain in step 4 from the blockchain and decrypts it into an interactive information pair in the following specific steps: Step 5.1: Detector Det query_att Read the encrypted information Q_A stored in the blockchain in step 4.2 enc ; Step 5.2: Encrypt the information Q_A using the AES-256 encryption algorithm and the same key pair as in step 4.1 enc Decrypt the data and use the serialization protocol Protocol Buffers to deserialize the decrypted binary data into the original interactive information pair.

6. The large language model attack detection method based on blockchain according to claim 1 is characterized by: In step 6, the specific implementation steps of the multi-dimensional weighted detection method are as follows: Step 6.1: Detector Det query_att According to the interaction information For User pro Behavior, User pro The query and large language model M victim The three output contents are tested and assigned different weights w beh 、w input 、w res , where w beh +w input +w res =1; Step 6.2: Detector Det query_att Analyze the user User according to the following rules pro The behavior is assigned a detection score Chek beh , detection score Check beh The score is between 0-100: (1) Frequency detection: Analyze user pro The query frequency of the user User pro The number of queries exceeds the preset threshold ε q_times , then it is considered to be abuse or offensive behavior; (2) Pattern recognition: identifying the user pro The query pattern, such as repeated queries and frequent use of specific keywords, indicates that the user User pro There is aggressive behavior; Step 6.3: Detector Det query_att Detect user User according to the following rules pro The query is assigned a detection score Check input , detection score Check input The score is between 0-100: (1) Keyword filtering: Check user User pro The query pair Whether it contains known malicious keywords or phrases; (2) Semantic analysis: Use natural language processing technology to analyze the query semantics to identify potentially harmful intent; Step 6.4: Detector Det query_att Detect the large language model M according to the following rules victim The output content is given a detection score Check res , detection score Check res The score is between 0-100: (1) Sensitive information detection: Checking the large language model M victim Output Whether it contains sensitive information including personal privacy data; (2) Compliance check: Ensure that the large language model M victim Output Meet the preset compliance standards, including whether it contains hate speech or discriminatory content; Step 6.5: According to the weight w assigned in step 6.1 beh 、w input 、w res And the detection score Check obtained in steps 6.2, 6.3, and 6.4 beh 、Check input and Check res , calculate the weighted total score as the detection result De resquery_att , the calculation formula is as follows: where ε check is the judgment threshold. Only when the weighted total score of harmful detection exceeds this judgment threshold, it is judged as harmful. resquery_att =1, it means the detection result is harmful; when the judgment threshold De resquery_att =0, indicating harmless.

7. The large language model attack detection method based on blockchain according to claim 6 is characterized by: In step 7, the detector encrypts the detection result generated in step 6 and stores the encrypted information on the blockchain. The specific steps are as follows: Step 7.1: For the detector Det in step 6.5 query_att The calculated test result De resquery_att , use the serialization protocol Protocol Buffers to serialize it into binary data, and use the AES-256 encryption algorithm and the pre-generated key to encrypt the above binary data to generate encrypted information De resenc ; Step 7.2: The encrypted information De generated in step 7.1 resenc Upload to the blockchain to ensure its immutability.

8. The large language model attack detection method based on blockchain according to claim 7 is characterized by: In step 8, the penalty module reads the encrypted information uploaded to the blockchain in step 7 from the blockchain and decrypts it into a detection result, and determines whether the user needs to be punished according to the detection result. The specific steps are as follows: Step 8.1: Penalty Module Pmodel att Read the encrypted information De stored in the blockchain in step 7.2 resenc ; Step 8.2: Use the same key and AES-256 encryption algorithm as in step 7.1 to encrypt the information De resenc Decrypt and use the serialization protocol Protocol Buffers to deserialize the decrypted binary data back to the original detection result De resquery_att ; Step 8.3: Penalty Module Pmodel att According to the test results De obtained in step 8.2 resquery_att Determine whether the user needs to be pro To impose punishment.

9. The large language model attack detection method based on blockchain according to claim 1 is characterized by: In step 9, the penalty method is as follows: First, formulate a set of punishment mechanisms to give users pro An initial credit score query =10 points, the highest score is 10 points, the lowest score is 0 points, and the query restriction rules are as follows: Score query ≤0: Query is prohibited and the query permission must be regained through the recovery mechanism; 0 <Score query ≤5: limit the number of queries, for example, a maximum of 10 queries per day; 5 <Score query <=9: There is no limit on the number of queries, but the query results may be filtered; 9 <Score query <=10: unlimited query, enjoy the highest authority; The deduction mechanism is as follows, let num vio Number of violations: num vio =1: Deduction points and give a warning, but at this time the attacker pro Unrestricted permissions; num vio =2: Deduction points, a total of 3.6 points are deducted, and the attacker pro Only 6.4 points left. There is no limit on the number of queries at this time, but the query results may be filtered; num vio =3: Deduction Attacker pro Only 1.1 points left, limit the number of queries at this time; num vio =4: User pro Credit score query =0, query prohibited! The score recovery mechanism is as follows: Linear recovery: User every 8 hours pro If there is no violation record, 0.9 points will be restored. For every 2 points restored, the number of violations will be increased. vio -1 to reduce the penalty next time.

Images