A blockchain-based large language model attack detection method

Abstract

A large language model attack detection method based on blockchain. It includes the steps of constructing a large language model prompt attack defense system; a user sends a query to a large language model; the large language model responds and generates output content; generate interaction information pairs; upload the interaction information to the blockchain; the detector detects, generates a detection result and stores it to the blockchain; and according to the detection result, judge whether the user needs to be punished or not. The application utilizes the non-tamperable nature of the blockchain, and the user query and the large language model response are permanently recorded on the blockchain, providing a reliable audit tracking mechanism. All key interaction information and detector detection results are recorded on the blockchain, providing a clear responsibility and behavior record for users. The detection query content is detected simultaneously with user behavior detection to check whether the user has abnormal queries. User and large language model interaction is carried out off-chain, only key information is recorded on the blockchain, reducing the cost.

Description

Technical Field

[0001] This invention belongs to the field of security defense technology for large language models, and specifically relates to a method for detecting large language model attacks based on blockchain. Background Technology

[0002] Currently, Large Language Models (LLMs) are widely used in various fields, including content creation, medical diagnosis, and financial analysis, thus becoming one of the core technologies for handling natural language understanding and generation tasks. However, the security threats faced by Large Language Models are also becoming increasingly prominent, such as jailbreak attacks, cue injection attacks, and member reasoning attacks—malicious attacks based on cueing. These attacks aim to bypass LLM defenses through malicious or adversarial cueing, thereby achieving the purpose of maliciously manipulating the behavior of Large Language Models and stealing private data.

[0003] However, existing defense strategies for large language models have drawbacks such as poor verifiability and difficulty in regulation.

[0004] First, with traditional LLM attack detection methods, users may be able to cover up their improper behavior by tampering with interaction data, thereby gaining illicit benefits.

[0005] Secondly, because the detection records are stored on centralized nodes, regulatory traceability and auditing heavily rely on the credibility of these centralized nodes. Therefore, if data loss, data tampering, or deliberate concealment occurs on the centralized nodes, it becomes difficult to accurately locate and punish violators. Summary of the Invention

[0006] To address the aforementioned problems, the present invention aims to provide a method for detecting large language model attacks based on blockchain.

[0007] To achieve the above objectives, the blockchain-based large language model attack detection method provided by this invention includes the following steps performed in sequence:

[0008] Step 1: Construct a blockchain-based large language model hint attack defense system. This system consists of a user terminal, a large language model, and a detector and penalty module connected to the blockchain. Users send query pairs to the large language model through the user terminal for querying the large language model.

[0009] Step 2: The large language model responds to the user's query pair from Step 1 and generates output content;

[0010] Step 3: Combine the query pair sent by the user in Step 1 with the output content generated by the large language model in Step 2 to generate an interactive information pair;

[0011] Step 4: Encrypt the interactive information generated in Step 3 to generate encrypted information and upload it to the blockchain;

[0012] Step 5: The detector reads the encrypted information stored in the blockchain in Step 4 and decrypts it into an interactive information pair;

[0013] Step 6: The detector uses a multi-dimensional weighted detection method to detect the interactive information pairs obtained in Step 5 according to the predefined detection rules, and generates detection results;

[0014] Step 7: The detector encrypts the detection results generated in Step 6 and stores the encrypted information on the blockchain to ensure that it cannot be tampered with;

[0015] Step 8: The penalty module reads the encrypted information uploaded to the blockchain in Step 7 and decrypts it into the detection result, and determines whether the user needs to be penalized based on the detection result;

[0016] Step 9: If the detection result obtained in Step 8 is 1, it indicates that the detection result is true, meaning that the user has made a malicious query. The user will be identified as an attacker, and the penalty module will punish the attacker. If the detection result obtained in Step 8 is false, no penalty will be imposed.

[0017] In step 1, the specific steps by which the user sends the query pair to the large language model through the user terminal are as follows:

[0018] Step 1.1: User pro Prepare the query dataset D in advance. query_att ;

[0019] Step 1.2: User pro Pro with carefully designed prompts ext Compared with the query dataset D prepared in step 1.1 query_att Each data in Combine into num_sum query pairs Where num_sum is the query dataset D query_att The total number of data in the data;

[0020] Step 1.3: User pro The above query pairs are transmitted through the user client. Send to the large language model M victim Used for large language models M victim Perform a query.

[0021] In step 2, the large language model responds to the user's query pair from step 1 and generates the output content in the following specific steps:

[0022] Step 2.1: Large Language Model M victim Receives user information through its specific application interface. pro The query pair sent in step 1.3

[0023] Step 2.2: Large Language Model M victim Parsing query pairs Understand the meaning and information contained therein;

[0024] Step 2.3: Large Language Model M victim It processes query pairs based on the knowledge and pattern recognition capabilities learned from a large amount of training data. And generate a query pair Output content

[0025] In step 4, the specific steps for encrypting the interactive information generated in step 3 to generate encrypted information and uploading it to the blockchain are as follows:

[0026] Step 4.1: First, use the serialization protocol Protocol Buffers to process all the exchanged information. The constructed sequence is converted into binary data for transmission, and then the binary data is encrypted using the AES-256 encryption algorithm and a pre-generated key to generate the encrypted message Q_A. enc ;

[0027] Step 4.2: Encrypt the above information Q_A enc It is uploaded to the blockchain for storage to ensure its immutability.

[0028] In step 5, the detector reads the encrypted information stored in the blockchain in step 4 and decrypts it into an interactive information pair. The specific steps are as follows:

[0029] Step 5.1: Detector Det query_att Read the encrypted information stored in the blockchain in step 4.2 Q_A enc ;

[0030] Step 5.2: Encrypt the information Q_A using the AES-256 encryption algorithm and the same key pair as in Step 4.1. enc Decryption is performed, and the decrypted binary data is deserialized using Protocol Buffers to convert it back into the original interactive information pair.

[0031] In step 6, the specific implementation steps of the multi-dimensional weighted detection method are as follows:

[0032] Step 6.1: Detector Det query_att Based on the interaction information For User pro Behavior, User pro Query and large language model M victim The output content consists of three items, each with a different weight. beh w input w res , where w beh +w input +w res =1;

[0033] Step 6.2: Detector Det query_att Analyze users according to the following rules. pro The behavior is assigned a detection score Check beh Check score beh The score ranges from 0 to 100:

[0034] (1) Frequency detection: Analysis of users pro The query frequency, if the user [User] [is within] a specified time period pro The number of queries exceeded the preset threshold εq _times If so, it is considered that there has been abuse or attack.

[0035] (2) Pattern recognition: Identifying users pro The query pattern, such as the discovery of multiple repeated queries or frequent use of specific keywords, indicates that the user... pro There was an attack.

[0036] Step 6.3: Detector Det query_att User detection is based on the following rules. pro The query is assigned a detection score Check. input Check score input The score ranges from 0 to 100:

[0037] (1) Keyword filtering: Check user pro Query pairs Does it contain known malicious keywords or phrases?

[0038] (2) Semantic analysis: Using natural language processing techniques, analyze query pairs. The semantics of [the language] are used to identify potentially harmful intentions;

[0039] Step 6.4: Detector Det query_attDetect the large language model M according to the following rules victim The output content is assigned a check score. res Check score res The score ranges from 0 to 100:

[0040] (1) Sensitive information detection: Examining the large language model M victim Output content Does it contain sensitive information, including personal privacy data?

[0041] (2) Compliance check: Ensure the large language model M victim Output content It meets the preset compliance standards, including whether it contains hate speech or discriminatory content;

[0042] Step 6.5: Based on the weight w assigned in Step 6.1 beh w input w res The detection scores Chech obtained in steps 6.2, 6.3, and 6.4 beh Check input and Check res The weighted total score is calculated as the detection result Deres query_att The calculation formula is as follows:

[0043]

[0044] Here, εcheck is the decision threshold. Only when the weighted total score of harmful detections exceeds this threshold is a detection deemed harmful; when the decision threshold Deres... query_att When the threshold value is 1, it indicates that the detection result is harmful; when the threshold value is 1, it indicates that the detection result is harmful. query_att =0 indicates harmless.

[0045] In step 7, the detector encrypts the detection result generated in step 6 and stores the encrypted information on the blockchain. The specific steps are as follows:

[0046] Step 7.1: For the detector Det in step 6.5 query_att The calculated detection results Deres query_att The serialization protocol Protocol Buffers is used to serialize it into binary data, and the binary data is then encrypted using the AES-256 encryption algorithm and a pre-generated key to generate the encrypted message Deres. enc ;

[0047] Step 7.2: Convert the encrypted information Deres generated in Step 7.1 into... encUpload it to the blockchain to ensure its immutability.

[0048] In step 8, the penalty module reads the encrypted information uploaded to the blockchain in step 7 and decrypts it into a detection result. The specific steps for determining whether to penalize the user based on the detection result are as follows:

[0049] Step 8.1: Penalty Module Pmodel att Read the encrypted information Deres stored in the blockchain in step 7.2 enc ;

[0050] Step 8.2: Encrypt the message Deres using the same key and AES-256 encryption algorithm as in Step 7.1. enc Decryption is performed, and the decrypted binary data is deserialized back to the original detection result Deres using the Protocol Buffers serialization protocol. query_att ;

[0051] Step 8.3: Penalty Module Pmodel att Based on the detection results obtained in step 8.2, Deres query_att Determine whether it is necessary to check the user. pro Punishment will be imposed.

[0052] In step 9, the penalty method is as follows:

[0053] First, establish a penalty mechanism for users. pro An initial credit score query =10 points, maximum 10 points, minimum 0 points, query restriction rules are as follows:

[0054] Score query ≤0: Querying is prohibited; query privileges must be regained through the recovery mechanism.

[0055] 0 <Score query ≤5: Limits the number of queries, for example, a maximum of 10 queries per day;

[0056] 5 <Score query <=9: Unlimited number of queries, but query results may be filtered;

[0057] 9 <Score query <=10: Unrestricted queries, enjoy the highest privileges;

[0058] The deduction mechanism is as follows, let num vio Number of violations:

[0059] num vio=1: Deduction The attacker, Attacker, was alerted and given a warning, but at this point... pro Unrestricted permissions;

[0060] num vio =2: Deduction Points, a total of 3.6 points have been deducted at this point, according to the attacker Attacker. pro With only 6.4 points remaining, there is no limit to the number of queries at this point, but the search results may be filtered.

[0061] num vio =3: Deduction Attacker pro With only 1.1 points remaining, the number of queries is now limited.

[0062] num vio =4: User pro Reputation score query =0, query prohibited!

[0063] The score recovery mechanism is as follows:

[0064] Linear recovery: User every 8 hours pro If there are no violations, 0.9 points will be restored. For every 2 points restored, the number of violations will be reset to num. vio -1, to reduce the severity of the next penalty.

[0065] The blockchain-based large language model attack detection method provided by this invention has the following beneficial effects:

[0066] 1. Immutable Audit Trail: Leveraging the immutable nature of blockchain, all user queries and large language model responses are permanently recorded on the blockchain, providing the system with a reliable audit trail mechanism. This advantage ensures data integrity and transparency, making any attempt to tamper with data easily identifiable and preventable, and users cannot deny their malicious actions, thus greatly enhancing the system's security and trustworthiness.

[0067] 2. Accountability and Transparency: All key interaction information and detector results are publicly recorded on the blockchain, providing users with a clear record of responsibility and behavior. This advantage not only increases user trust but also facilitates supervision and compliance, making any misconduct traceable and accountable.

[0068] 3. Real-time Anomaly Detection: The detector does not perform content inspection on every user-model interaction. Instead, it stores the information in the immutable ledger of the blockchain. When a user executes multiple queries, all queries are inspected uniformly. While inspecting the query content, user behavior is also detected to check for any abnormal queries (such as frequent repetition, abnormal input formats, etc.). Anomaly detection can effectively detect attacks that rely on a large number of queries to achieve model attacks, such as model extraction attacks, jailbreak attacks, and member inference attacks. Some of these attacks often involve harmless queries, and conventional content and rule inspections cannot detect anomalies. The anomaly detection method in this invention effectively solves this problem.

[0069] 4. Low cost: User interaction with the large language model takes place off-chain, while only key information is recorded on the blockchain. This design reduces costs while maintaining high performance, making the system more economical and practical without sacrificing security. Attached Figure Description

[0070] Figure 1 The flowchart of the large language model attack detection method based on blockchain provided by the present invention.

[0071] Figure 2 This is a schematic diagram illustrating the structure of the blockchain-based large language model hint attack defense system in this invention.

[0072] Figure 3 This is a schematic diagram of the penalty method in this invention. Detailed Implementation

[0073] The present invention will now be described in detail with reference to the accompanying drawings and specific embodiments.

[0074] like Figure 1 As shown, the blockchain-based large language model attack detection method provided by this invention includes the following steps performed in sequence:

[0075] Step 1, construct as follows Figure 2 The system shown is a blockchain-based large language model hint attack defense system. The system consists of a user terminal, a large language model, and a detector and penalty module connected to the blockchain. Users send query pairs to the large language model through the user terminal to query the large language model.

[0076] User side: User pro Using the user end to a large language model M victim Input queries that include questions, requests, or instructions to obtain the large language model M. victim Response information;

[0077] Large Language Model M victimThrough the API interface, the large language model M victim Receive from user User pro It queries and leverages its pre-trained language model capabilities to provide accurate and relevant output.

[0078] Blockchain: As the core of this system, blockchain, with its characteristics of transparency, immutability, and decentralized storage, provides users with... pro It provides a secure and reliable platform for recording interactive information. These features ensure user security. pro Query and Large Language Model M victim Once this interactive information is recorded on the blockchain, it cannot be altered, providing a solid data foundation for auditing and tracking, while also enhancing system accountability and effectively tracking misconduct. The distributed architecture of blockchain eliminates the risk of single points of failure, ensuring data security and integrity.

[0079] Detector Det query_att : Read the interaction information stored on the blockchain to access the user's profile. pro Detect user query behavior and query content to determine the user's identity. pro Whether there is malicious behavior, and the detection results Deres query_att Stored on the blockchain.

[0080] Penalty module Pmodel att For User pro Malicious behavior will be punished, and different protective measures will be implemented according to the degree of malice, including modifying model output, limiting the number of queries, and prohibiting queries.

[0081] The specific steps by which the user sends the query pair to the large language model through the user terminal are as follows:

[0082] Step 1.1: User pro Prepare the query dataset D in advance. query_att ;

[0083] Step 1.2: User pro Pro with carefully designed prompts ext Compared with the query dataset D prepared in step 1.1 query_att Each data in Combine into num_sum query pairs Where num_sum is the query dataset D query_att The total number of data in the data;

[0084] Step 1.3: User pro The above query pairs are transmitted through the user client. Send to the large language model M victim Used for large language models M victim Perform a query.

[0085] Step 2: Large Language Model M victim User in response step 1 pro Query pairs Generate output content

[0086] The specific steps are as follows:

[0087] Step 2.1: Large Language Model M victim Receives user information through its specific application interface. pro The query pair sent in step 1.3

[0088] Step 2.2: Large Language Model M victim Parsing query pairs Understand the meaning and information contained therein;

[0089] Step 2.3: Large Language Model M victim It processes query pairs based on the knowledge and pattern recognition capabilities learned from a large amount of training data. And generate a query pair Output content

[0090] Step 3: Transfer the User from Step 1 pro The query pair sent and the output content generated by the large language model in step 2 Combine them to generate interactive information pairs

[0091] Step 4: Pair the interactive information generated in Step 3 After encryption, encrypted information is generated and uploaded to the blockchain;

[0092] The specific steps are as follows:

[0093] Step 4.1: First, use the serialization protocol Protocol Buffers (Protobuf) to serialize all the exchanged information. The constructed sequence is converted into binary data for transmission, and then the binary data is encrypted using the AES-256 encryption algorithm and a pre-generated key to generate the encrypted message Q_A. enc ;

[0094] Step 4.2: Encrypt the above information Q_A encIt is uploaded to the blockchain for storage to ensure its immutability.

[0095] The evidence storage function of blockchain: In step 4, it will be provided by the user. pro The query pair sent and the output content generated by the large language model in step 2 Composed of interactive information pairs Uploading to the blockchain ensures the immutability of information, thus guaranteeing the user's rights. pro It provides an immutable record of the query history, which ensures that any misconduct can be effectively stored, facilitating subsequent anomaly detection and accountability.

[0096] Protocol Buffers (Protobuf), a serialization protocol developed by Google, is used for efficient encoding and decoding of structured data. The encoded data is short in length and has fast parsing speed, making it suitable for large-scale data transmission.

[0097] AES-256 Encryption Algorithm: AES-256 (Advanced Encryption Standard 256-bit key) is a symmetric encryption algorithm used for encrypting and decrypting data. AES-256 is a variant of the AES algorithm that uses a 256-bit key length, providing extremely high security.

[0098] Step 5: Detector Det query_att Read the encrypted information stored in the blockchain in step 4 and decrypt it into an interactive information pair.

[0099] The specific steps are as follows:

[0100] Step 5.1: Detector Det query_att Read the encrypted information stored in the blockchain in step 4.2 Q_A enc ;

[0101] Step 5.2: Encrypt the information Q_A using the AES-256 encryption algorithm and the same key pair as in Step 4.1. enc Decryption is performed, and the decrypted binary data is deserialized using Protocol Buffers (Protobuf) to convert it back into the original interactive information pair.

[0102] Step 6: Detector Det query_att The interaction information obtained in step 5 is analyzed using a multi-dimensional weighted detection method according to predefined detection rules. Perform the test and generate the test results (Deres). query_att ;

[0103] The specific steps of the multi-dimensional weighted detection method are as follows:

[0104] Step 6.1: Detector Det query_att Based on the interaction information For User pro Behavior, User pro Query and large language model M vicim The output content consists of three items, each with a different weight. beh w input w res , where w beh +w input +w res =1;

[0105] Step 6.2: Detector Det query_att Analyze users according to the following rules. pro The behavior of assigning a detection score to Check beh Check score beh The score ranges from 0 to 100; the higher the score, the greater the harm.

[0106] (1) Frequency detection: Analysis of users pro The query frequency, if the user [User] [is within] a specified time period pro The number of queries exceeded the preset threshold ε q_times If so, it is considered that there has been abuse or attack.

[0107] (2) Pattern recognition: Identifying users pro The query pattern, such as the discovery of multiple repeated queries or frequent use of specific keywords, indicates that the user... pro There was an attack.

[0108] Step 6.3: Detector Det query_att User detection is based on the following rules. pro The query is assigned a detection score check. input Detection score check input The score ranges from 0 to 100; the higher the score, the greater the harm.

[0109] (1) Keyword filtering: Check user pro Query pairs Does it contain known malicious keywords or phrases?

[0110] (2) Semantic analysis: Using natural language processing techniques, analyze query pairs. The semantics of [the language] are used to identify potentially harmful intentions;

[0111] Step 6.4: Detector Det query_att Detect the large language model M according to the following rules victim The output content is assigned a check score. res Detection score check res The score ranges from 0 to 100; the higher the score, the greater the harm.

[0112] (1) Sensitive information detection: Examining the large language model M victim Output content Does it contain sensitive information, including personal privacy data?

[0113] (2) Compliance check: Ensure the large language model M victim Output content It meets the preset compliance standards, including whether it contains hate speech, discriminatory content, etc.

[0114] Step 6.5: Based on the weight w assigned in Step 6.1 beh w input w res The detection scores Check obtained in steps 6.2, 6.3, and 6.4 beh Check input and Check res The weighted total score is calculated as the detection result Deres query_att The calculation formula is as follows:

[0115]

[0116] Where ε check The threshold is used to determine if a data point is considered harmful; only when the weighted total score of harmful detections exceeds this threshold is the data considered harmful. query_att A threshold of 1 indicates a harmful detection result; the judgment threshold is Deres. query_att =0 indicates harmless.

[0117] Step 7: Detector Det query_att The detection results generated in step 6, Deres query_att Encryption is performed, and the encrypted information is stored on the blockchain to ensure that it cannot be tampered with;

[0118] The specific steps are as follows:

[0119] Step 7.1: For the detector Det in step 6.5 query_att The calculated detection results Deres query_attThe serialization protocol Protocol Buffers (Protobuf) is used to serialize it into binary data, and the binary data is encrypted using the AES-256 encryption algorithm and a pre-generated key to generate the encrypted message Deres. enc ;

[0120] Step 7.2: Convert the encrypted information Deres generated in Step 7.1 into... enc Uploading the results to the blockchain ensures their immutability. The reason for uploading the test results to the blockchain is that subsequent accountability and penalties will be based on the results. If the results are maliciously tampered with, the test becomes meaningless; therefore, this crucial information is also uploaded to the blockchain for safekeeping.

[0121] Step 8: Penalty Module Pmodel att Read the encrypted information uploaded to the blockchain in step 7 and decrypt it into the detection result Deres. enc And based on the test results, Deres enc To determine whether it is necessary to access the user's profile. pro Punishment will be imposed;

[0122] The specific steps are as follows:

[0123] Step 8.1: Penalty Module Pmodel att Read the encrypted information Deres stored in the blockchain in step 7.2 enc ;

[0124] Step 8.2: Encrypt the message Deres using the same key and AES-256 encryption algorithm as in Step 7.1. enc Decryption is performed, and the decrypted binary data is deserialized back to the original detection result Deres using the Protocol Buffers (Protobuf) serialization protocol. query_att ;

[0125] Step 8.3: Penalty Module Pmodel att Based on the detection results obtained in step 8.2, Deres query_att Determine whether it is necessary to check the user. pro Punishment will be imposed.

[0126] Step 9: If the detection result Deres obtained in step 8 query_att A value of 1 indicates that the detection result is Deres. query_att If true, it means that the user... pro A malicious query was performed, and the user was identified as the attacker Attacker. pro The penalty module Pmodel attAttacker will be attacked. pro Penalties will be imposed; if the detection results obtained in step 8 are Deres query_att If the statement is false, no penalty will be imposed.

[0127] like Figure 3 As shown, the penalty method is as follows:

[0128] First, establish a penalty mechanism for users. pro An initial credit score query =10 points, maximum 10 points, minimum 0 points, query restriction rules are as follows:

[0129] Score query ≤0: Querying is prohibited; query privileges must be regained through the recovery mechanism.

[0130] 0 <Score query ≤5: Limits the number of queries, for example, a maximum of 10 queries per day;

[0131] 5 <Score query <=9: Unlimited number of queries, but query results may be filtered;

[0132] 9 <Score query <=10: Unrestricted queries, enjoy the highest privileges;

[0133] The deduction mechanism is as follows, let num vio Number of violations:

[0134] num vio =1: Deduction The attacker, Attacker, was alerted and given a warning, but at this point... pro Unrestricted permissions;

[0135] num vio =2: Deduction Points, a total of 3.6 points have been deducted at this point, according to the attacker Attacker. pro With only 6.4 points remaining, there is no limit to the number of queries at this point, but the search results may be filtered.

[0136] num vio =3: Deduction Attacker pro With only 1.1 points remaining, the number of queries is now limited.

[0137] num vio =4: User pro Credit Score query =0, query prohibited!

[0138] The score recovery mechanism is as follows:

[0139] Linear recovery: User every 8 hours pro If there are no violations, 0.9 points will be restored. For every 2 points restored, the number of violations will be reset to num. vio -1, to reduce the severity of the next penalty.

Claims

1. A method for detecting large language model attacks based on blockchain, characterized in that: The blockchain-based large language model attack detection method includes the following steps performed in sequence: Step 1: Construct a blockchain-based large language model hint attack defense system. This system consists of a user terminal, a large language model, and a detector and penalty module connected to the blockchain. Users send query pairs to the large language model through the user terminal for querying the large language model. Step 2: The large language model responds to the user's query pair from Step 1 and generates output content; Step 3: Combine the query pair sent by the user in Step 1 with the output content generated by the large language model in Step 2 to generate an interactive information pair; Step 4: Encrypt the interactive information generated in Step 3 to generate encrypted information and upload it to the blockchain; Step 5: The detector reads the encrypted information stored in the blockchain in Step 4 and decrypts it into an interactive information pair; Step 6: The detector uses a multi-dimensional weighted detection method to detect the interactive information pairs obtained in Step 5 according to the predefined detection rules, and generates detection results; Step 7: The detector encrypts the detection results generated in Step 6 and stores the encrypted information on the blockchain to ensure that it cannot be tampered with; Step 8: The penalty module reads the encrypted information uploaded to the blockchain in Step 7 and decrypts it into the detection result, and determines whether the user needs to be penalized based on the detection result; Step 9: If the detection result obtained in Step 8 is 1, it indicates that the detection result is true, meaning that the user has made a malicious query. The user will be identified as an attacker, and the penalty module will punish the attacker. If the detection result obtained in Step 8 is false, no penalty will be imposed.

2. The method for detecting large language model attacks based on blockchain according to claim 1, characterized in that: In step 1, the specific steps by which the user sends the query pair to the large language model through the user terminal are as follows: Step 1.1: User Prepare the query dataset in advance. ; Step 1.2: User carefully designed prompts Compared with the query dataset prepared in step 1.1 Each data in { , ,……, } Combined into num_sum query pairs { :{ , }}, where num_sum is the query dataset. The total number of data in the data; Step 1.3: User The above query pair is executed through the user client. :{ , }}Sent to the large language model Used for large language models Perform a query.

3. The blockchain-based large language model attack detection method according to claim 2, characterized in that: In step 2, the large language model responds to the user's query pair from step 1 and generates the output content in the following specific steps: Step 2.1: Large Language Model Receives user information through its specific application interface The query pair sent in step 1.3 { :{ , }}; Step 2.2: Large Language Model Parse query pair { :{ , Understand the meaning and information contained therein; Step 2.3: Large Language Model It processes query pairs based on its knowledge learned from large amounts of training data and its pattern recognition capabilities. :{ , }}, and generate a query pair { :{ , The output content of}} :{ }}.

4. The method for detecting large language model attacks based on blockchain according to claim 1, characterized in that: In step 4, the specific steps for encrypting the interactive information generated in step 3 to generate encrypted information and uploading it to the blockchain are as follows: Step 4.1: First, use the serialization protocol Protocol Buffers to process all the exchanged information. The constructed sequence is converted into binary data for transmission, and then the binary data is encrypted using the AES-256 encryption algorithm and a pre-generated key to generate encrypted information. ; Step 4.2: Encrypt the above information It is uploaded to the blockchain for storage to ensure its immutability.

5. The blockchain-based large language model attack detection method according to claim 4, characterized in that: In step 5, the detector reads the encrypted information stored in the blockchain in step 4 and decrypts it into an interactive information pair. The specific steps are as follows: Step 5.1: Detector Read the encrypted information stored in the blockchain in step 4.2 ; Step 5.2: Encrypt the information using the AES-256 encryption algorithm and the same key pair as in Step 4.

1. Decryption is performed, and the decrypted binary data is deserialized using Protocol Buffers to convert it back into the original interactive information pair. .

6. The method for detecting large language model attacks based on blockchain according to claim 1, characterized in that: In step 6, the specific implementation steps of the multi-dimensional weighted detection method are as follows: Step 6.1: Detector Based on the interaction information For users Behavior, users Query and large language model The output content is tested in three aspects and assigned different weights to each. , , ,in + + = 1; Step 6.2: Detector Analyze users according to the following rules The behavior and assign a detection score Detection score The score ranges from 0 to 100: (1) Frequency detection: Analysis of users The query frequency, if the user within the specified time... The number of queries exceeded the preset threshold. If so, it is considered that there has been abuse or attack. (2) Pattern recognition: Identifying users The query pattern, if it reveals multiple repeated queries or frequent use of specific keywords, indicates that the user... There was an attack. Step 6.3: Detector Detect users according to the following rules The query is assigned a detection score. Detection score The score ranges from 0 to 100: (1) Keyword filtering: Check users The query pair { :{ , Does it contain known malicious keywords or phrases? (2) Semantic analysis: Using natural language processing techniques, analyze the query pairs { :{ , The semantics of}} are used to identify potential harmful intentions; Step 6.4: Detector Detect large language models according to the following rules The output content is assigned a detection score. Detection score The score ranges from 0 to 100: (1) Sensitive information detection: Examining the large language model Output content { :{ Does it contain sensitive information, including personal privacy data? (2) Compliance check: Ensure the large language model Output content { :{ It meets the preset compliance standards, including whether it contains hate speech or discriminatory content; Step 6.5: Based on the weights assigned in Step 6.1 , , The detection scores obtained in steps 6.2, 6.3, and 6.4 , and The weighted total score is calculated as the detection result. The calculation formula is as follows: in The threshold is used to determine if a data point is considered harmful; only when the weighted total score of harmful detections exceeds this threshold is the data considered harmful. When the threshold is 1, it indicates that the detection result is harmful; when the threshold is set... =0 indicates harmless.

7. The blockchain-based large language model attack detection method according to claim 6, characterized in that: In step 7, the detector encrypts the detection result generated in step 6 and stores the encrypted information on the blockchain. The specific steps are as follows: Step 7.1: For the detector in step 6.5 Calculated detection results The serialization protocol Protocol Buffers is used to serialize it into binary data, and the binary data is then encrypted using the AES-256 encryption algorithm and a pre-generated key to generate encrypted information. ; Step 7.2: The encrypted information generated in Step 7.1 Upload it to the blockchain to ensure its immutability.

8. The blockchain-based large language model attack detection method according to claim 7, characterized in that: In step 8, the penalty module reads the encrypted information uploaded to the blockchain in step 7 and decrypts it into a detection result. The specific steps for determining whether to penalize the user based on the detection result are as follows: Step 8.1: Penalty Module Read the encrypted information stored in the blockchain in step 7.2 ; Step 8.2: Encrypt the information using the same key and AES-256 encryption algorithm as in Step 7.

1. Decryption is performed, and the decrypted binary data is deserialized back to the original detection result using Protocol Buffers. ; Step 8.3: Penalty Module Based on the detection results obtained in step 8.2 Determine whether it is necessary to [do something] with the user. Punishment will be imposed.

9. The method for detecting large language model attacks based on blockchain according to claim 1, characterized in that: In step 9, the penalty method is as follows: First, establish a penalty mechanism for users. An initial credit score Scores, maximum 10 points, minimum 0 points, query restrictions are as follows: ≤ 0: Querying is prohibited; query privileges must be regained through the recovery mechanism. 0 < ≤ 5: Limit the number of queries; 5 < <= 9: Unlimited number of queries, but query results may be filtered; 9 < <= 10: Unrestricted queries, enjoy the highest privileges; The deduction mechanism is as follows: Number of violations: = 1: Deduct 0.9 ( + ( *0.9 - 0.9) points, and issue a warning, but at this time the attacker Unrestricted permissions; = 2: Deduct 2.7 ( + ( *0.9 - 0.9) points, a total of 3.6 points are deducted at this point, the attacker With only 6.4 points remaining, there is no limit to the number of queries at this point, but the search results may be filtered. = 3: Deduct ( + ( *0.9 - 0.9) = 5.4 points, attacker With only 1.1 points remaining, the number of queries is now limited. = 4: Users Credit score = 0, query prohibited; The score recovery mechanism is as follows: Linear recovery: every 8 hours for each user If there are no violations, 0.9 points will be restored. For every 2 points restored, the number of violations will be reduced. -1, to mitigate the severity of the next penalty.

Images