Knowledge question and answer confrontation detection method and system for retrieval enhancement large language model

Abstract

The invention discloses a knowledge question and answer confrontation detection method and a knowledge question and answer confrontation detection system for a retrieval-enhanced large language model. The method comprises the following steps: firstly, receiving a user question, carrying out semantic analysis, extracting key features, retrieving and extracting a related context in a local knowledge base by utilizing the features, and inputting the question and the context into a large language model to generate a basic answer; and performing semantic replacement on the questions and the contexts to generate a plurality of expression forms. And randomly sampling expressions before and after replacement according to questions and contexts, and inputting the expressions into a large language model to generate answers. And calculating a semantic distance between the answer generated by the sampling combination and the basic answer, and inputting the semantic distance into the unsupervised outlier detection model as a feature value. If the feature value is judged to be an outlier by the detection model, the adversarial risk exists, and otherwise, a basic answer is returned. According to the method, semantic replacement and unsupervised adversarial detection are carried out on the cue words and the contexts, adversarial attacks aiming at questions and local knowledge bases are resisted, and the accuracy and robustness of a large language model are improved.

Description

Technical Field

[0001] The present invention relates to the field of adversarial detection technology, and in particular to a knowledge question-answering adversarial detection method and system for a retrieval-enhanced large language model. Background Art

[0002] When existing general-purpose large language models generate highly specialized domain knowledge, they are prone to inaccurate information problems such as factual illusions and loyalty illusions. Specifically, attackers can circumvent the detection system of the large model by adding carefully designed noise to the prompt words, thereby making inaccurate, low-quality, and unethical responses. Summary of the invention

[0003] The present invention provides a knowledge question-answering adversarial detection method and system for a retrieval-enhanced large language model, thereby solving the technical problem in the prior art that when querying and generating highly professional domain knowledge, the question content or the local knowledge base is easily subjected to adversarial attacks, resulting in the generation of inaccurate, low-quality, and ethically inconsistent content. The present invention performs comprehensive adversarial detection on user questions and their local knowledge bases, thereby improving the accuracy and robustness of the retrieval-enhanced large language model.

[0004] The present invention provides a knowledge question answering adversarial detection method for a retrieval-enhanced large language model, comprising:

[0005] Receive questions from users;

[0006] Perform semantic analysis on the question and extract key feature words;

[0007] Searching the key feature words in a preset knowledge base to obtain matching context information;

[0008] Performing synonymous replacement on at least one of the key feature word and the matched context information to obtain a synonymously replaced feature word and context combination;

[0009] Inputting the key feature words and the matched context information into a large language model to obtain a benchmark answer, and inputting the feature words and context combination after synonymous replacement into the large language model to obtain a reference answer;

[0010] Calculating the semantic distance between the benchmark answer and the reference answer;

[0011] The semantic distance is input into a trained outlier detection model, and if the outlier detection model outputs a non-outlier result, the benchmark answer is used as the final answer.

[0012] Specifically, performing synonymous replacement on at least one of the key feature word and the matching context information includes:

[0013] At least one of part of speech replacement, word meaning replacement, sentence structure replacement and grammatical structure replacement is performed on the key feature words and / or the matched context information.

[0014] Specifically, the calculating the semantic distance between the benchmark answer and the reference answer includes:

[0015] By formula D(R i ,R j )=|R i ∩R j ||R i ∪R j | Calculate the semantic distance D(R) between the benchmark answer and the reference answer i ,R j ), where R i is the benchmark answer, R j This is the reference answer.

[0016] Specifically, the inputting the semantic distance into a trained outlier detection model, and if the outlier detection model outputs a non-outlier result, taking the reference answer as the final answer, includes:

[0017] The semantic distance is input as a feature vector into the unsupervised elliptical envelope model, and the formula Calculate the Mahalanobis distance d(x) from point x to the center of the distribution; where x is the eigenvector, μ is the mean vector of the distribution, and ∑ is the covariance matrix;

[0018] If d(x) is less than a set threshold, the unsupervised elliptical envelope model outputs a non-outlier result and uses the benchmark answer as the final answer.

[0019] Specifically, if d(x) is equal to or greater than the set threshold, the unsupervised elliptical envelope model outputs an outlier result, determines that the benchmark answer has a confrontation risk, and prompts the user to ask the question again.

[0020] The present invention also provides a knowledge question-answering adversarial detection system for a retrieval-enhanced large language model, comprising:

[0021] A question receiving module is used to receive questions from users;

[0022] A semantic analysis module, used to perform semantic analysis on the question and extract key feature words;

[0023] A context matching module, used to query the key feature words in a preset knowledge base to obtain matching context information;

[0024] A synonym replacement module, used to perform synonym replacement on at least one of the key feature word and the matched context information to obtain a synonym-replaced feature word and context combination;

[0025] An answer module, used for inputting the key feature words and the matched context information into a large language model to obtain a benchmark answer, and inputting the feature words and context combination after synonymous replacement into the large language model to obtain a reference answer;

[0026] A semantic distance calculation module, used to calculate the semantic distance between the benchmark answer and the reference answer;

[0027] The adversarial detection module is used to input the semantic distance into a trained outlier detection model, and if the outlier detection model outputs a non-outlier result, use the benchmark answer as the final answer.

[0028] Specifically, the synonym replacement module is specifically used to perform at least one of part of speech replacement, word meaning replacement, sentence structure replacement and grammatical structure replacement on the key feature words and / or the matching context information to obtain a feature word and context combination after synonym replacement.

[0029] Specifically, the semantic distance calculation module is specifically used to calculate the distance between the two components by using the formula D(R i ,R j )=|R i ∩R j ||R i ∪R j | Calculate the semantic distance D(R) between the benchmark answer and the reference answer i ,R j ), where R i is the benchmark answer, R j This is the reference answer.

[0030] Specifically, the adversarial detection module includes:

[0031] The distance calculation unit is used to input the semantic distance as a feature vector into the unsupervised elliptical envelope model, and the formula Calculate the Mahalanobis distance d(x) from point x to the center of the distribution; where x is the eigenvector, μ is the mean vector of the distribution, and ∑ is the covariance matrix;

[0032] The answer output unit is used for, if d(x) is less than a set threshold, the unsupervised elliptical envelope model outputs a non-outlier result and takes the reference answer as the final answer.

[0033] Specifically, the adversarial detection module further includes:

[0034] The confrontation risk output unit is used to output an outlier result to the unsupervised elliptical envelope model if d(x) is equal to or greater than the set threshold, determine that the benchmark answer has a confrontation risk, and prompt the user to ask the question again.

[0035] One or more technical solutions provided in the present invention have at least the following technical effects or advantages:

[0036] First, the question input by the user is received, and then the question is semantically parsed to extract key features (such as keywords, topics, etc.), and these features are used to search for relevant content in the local knowledge base, extract context information related to the question, and input the user question and the context information retrieved into the large language model to generate a basic answer; then the user question and the context information retrieved are semantically converted to generate a variety of expressions after replacement. Then, the expressions before and after the replacement are randomly sampled according to the question and context, and then respectively input into the large language model to generate answers, and the semantic distance between the answer generated by the sampling combination and the basic answer is calculated to form a semantic distance feature value, and it is input as a feature value into the trained outlier detection model. If the detection model determines that the feature value is an outlier, it is determined that the question has a confrontation risk, and the user is prompted to ask the question again; otherwise, the basic answer generated by the large model is returned to the user. The present invention performs synonymous replacement on the user's key feature words and context knowledge, and adds randomization of combining the key feature words and context knowledge before and after the replacement, which can effectively identify and prevent confrontation samples, and reduce the answer deviation caused by the ambiguity of the question, confrontational questions, and local knowledge base pollution. In addition, the adversarial detection problem for the large language model is transformed into an unsupervised anomaly detection problem for feature points. The unsupervised outlier detection model only uses benign features to determine the anomaly detection boundary. Since adversarial features are not required, the generalization ability of the present invention in the face of evolutionary adversarial attacks is guaranteed. Therefore, the present invention simultaneously performs semantic replacement and unsupervised adversarial detection on the prompt words and professional context knowledge of the large language model, resisting adversarial attacks on questions and local knowledge bases, and ensuring that the large language model based on retrieval enhancement still has high accuracy and robustness in the face of ambiguous or adversarial questions in professional knowledge question answering. BRIEF DESCRIPTION OF THE DRAWINGS

[0037] Figure 1 A flowchart of a knowledge question answering adversarial detection method for a retrieval-enhanced large language model provided by an embodiment of the present invention;

[0038] Figure 2A module diagram of a knowledge question answering adversarial detection system for a retrieval-enhanced large language model provided by an embodiment of the present invention;

[0039] Figure 3 A schematic diagram of a knowledge question answering adversarial detection method and system for a retrieval-enhanced large language model provided in an embodiment of the present invention. DETAILED DESCRIPTION

[0040] The embodiments of the present invention provide a knowledge question-answering adversarial detection method and system for a retrieval-enhanced large language model, thereby solving the technical problem in the prior art that when querying and generating highly professional domain knowledge, the question content or the local knowledge base is easily subjected to adversarial attacks, resulting in the generation of inaccurate, low-quality, and ethically inconsistent content. Comprehensive adversarial detection is performed on user questions and their local knowledge bases, thereby improving the accuracy and robustness of the retrieval-enhanced large language model.

[0041] The technical solution in the embodiment of the present invention is to solve the above technical problems, and the overall idea is as follows:

[0042] First, we use the open source big language model as the core system, collect a large amount of the latest network security-related technical literature, industry reports and research papers, pre-process and convert them into a data format suitable for the big language model to understand, and build a professional local knowledge base in the field of network security.

[0043] Secondly, when receiving a question from a user, the question is first semantically parsed and a vector representation of the question is generated; the content most relevant to the question is extracted from the embedded vector space of the local knowledge base, and after screening and sorting, the most matching reference material is selected as the context.

[0044] Then, synonym replacement is performed on the context, and a set of synonym replacement contexts and the original question are input into the target large language model to obtain a set of new answers. The distance between the new answer and the original answer is calculated to verify whether the change of context expression based on the local knowledge base will affect the stability of the answer generated by the large language model. Next, the same method is used to synonym replace the user's question, and the answer deviation distance caused by the change of question expression is calculated to verify whether the change of user question will affect the stability of the answer generated by the large language model.

[0045] On this basis, we use commonly used network security questions to ask questions and synonym replacement to the large model, and build a benign sample feature library based on the semantic distance of the large language model answers before and after the replacement to train an unsupervised outlier detection model. In the detection stage, the semantic distance between the generated answer and the benchmark answer is calculated and input into the unsupervised outlier detection model as a feature vector to detect the impact of context and question expression on the answer. If the detection model determines that the feature vector is an outlier, it indicates that changes in context or questions may cause significant semantic shifts in the model, indicating that there may be ambiguity, unclear expression or adversarial risks, thereby improving the robustness and accuracy of the question-answering system.

[0046] In order to better understand the above technical solution, the above technical solution will be described in detail below in conjunction with the accompanying drawings and specific implementation methods.

[0047] like Figure 1 As shown, the knowledge question answering adversarial detection method for retrieval-enhanced large language model provided by the embodiment of the present invention includes:

[0048] Step S110: receiving questions from users;

[0049] Step S120: semantically analyze the question and extract key feature words;

[0050] Step S130: searching a preset knowledge base for key feature words to obtain matching context information;

[0051] Step S140: performing synonymous replacement on at least one of the key feature word and the matched context information to obtain a synonymous replaced feature word and context combination;

[0052] Specifically, performing synonymous replacement on at least one of the key feature word and the matched context information includes:

[0053] At least one of part of speech replacement, word meaning replacement, sentence structure replacement and grammatical structure replacement is performed on the key feature words and / or the matching context information.

[0054] It should be noted here that when synonym replacement is performed on both the key feature words and the context information, the key feature words and the context information may be replaced with synonyms in different ways.

[0055] Step S150: inputting the key feature words and the matching context information into the large language model to obtain a benchmark answer, and inputting the feature words and context combination after synonymous replacement into the large language model to obtain a reference answer;

[0056] Step S160: Calculate the semantic distance between the benchmark answer and the reference answer;

[0057] This step is specifically described to calculate the semantic distance between the benchmark answer and the reference answer, including:

[0058] By formula D(R i ,R j )=|R i ∩R j ||R i ∪R j | Calculate the semantic distance D(R) between the benchmark answer and the reference answer i ,R j ), where R i As the benchmark answer, R j For reference answer.

[0059] Step S170: input the semantic distance into the trained outlier detection model. If the outlier detection model outputs a non-outlier result, the reference answer is used as the final answer.

[0060] To explain this step in detail, input the semantic distance into the trained outlier detection model. If the outlier detection model outputs a non-outlier result, the benchmark answer is used as the final answer, including:

[0061] The semantic distance is input as a feature vector into the unsupervised elliptical envelope model, and the formula The Mahalanobis distance d(x) from point x to the center of the distribution is calculated; where x is the input feature vector, indicating the location of the data point, μ is the mean vector of the distribution, indicating the center point of the data, and ∑ is the covariance matrix;

[0062] If d(x) is less than the set threshold, the unsupervised elliptical envelope model outputs a non-outlier result and takes the benchmark answer as the final answer.

[0063] If d(x) is equal to or greater than the set threshold, the unsupervised elliptical envelope model outputs an outlier result, determines that the benchmark answer has an adversarial risk, and prompts the user to ask the question again.

[0064] like Figure 2 As shown, the knowledge question answering adversarial detection system for retrieval-enhanced large language model provided by the embodiment of the present invention includes:

[0065] The question receiving module 100 is used to receive questions from users;

[0066] Semantic parsing module 200, used to perform semantic parsing on the question and extract key feature words;

[0067] The context matching module 300 is used to query the key feature words in a preset knowledge base to obtain matching context information;

[0068] The synonym replacement module 400 is used to perform synonym replacement on at least one of the key feature word and the matched context information to obtain a synonym replaced feature word and context combination;

[0069] Specifically, the synonym replacement module 400 is specifically used to perform at least one of part of speech replacement, word meaning replacement, sentence structure replacement and grammatical structure replacement on the key feature words and / or the matching context information to obtain the feature word and context combination after synonym replacement. It should be noted here that when synonym replacement is performed on both the key feature words and the context information, the key feature words and the context information can be synonymously replaced in different ways.

[0070] The answer module 500 is used to input the key feature words and the matching context information into the large language model to obtain a reference answer, and input the feature words and the context combination after synonymous replacement into the large language model to obtain a reference answer;

[0071] A semantic distance calculation module 600, used to calculate the semantic distance between the benchmark answer and the reference answer;

[0072] Specifically, the semantic distance calculation module 600 is specifically used to calculate the distance through the formula D(R i ,R j )=|R i ∩R j ||R i ∪R j | Calculate the semantic distance D(R) between the benchmark answer and the reference answer i ,R j ), where R i As the benchmark answer, R j For reference answer.

[0073] The adversarial detection module 700 is used to input the semantic distance into the trained outlier detection model, and if the outlier detection model outputs a non-outlier result, the reference answer is used as the final answer.

[0074] Specifically, the adversarial detection module 700 includes:

[0075] The distance calculation unit is used to input the semantic distance as a feature vector into the unsupervised elliptical envelope model through the formula The Mahalanobis distance d(x) from point x to the center of the distribution is calculated; where x is the input feature vector, indicating the location of the data point, μ is the mean vector of the distribution, indicating the center point of the data, and ∑ is the covariance matrix;

[0076] The answer output unit is used to output a non-outlier result through the unsupervised elliptical envelope model if d(x) is less than a set threshold, and take the benchmark answer as the final answer.

[0077] The adversarial risk output unit is used to output the outlier result of the unsupervised elliptical envelope model if d(x) is equal to or greater than the set threshold, determine that the benchmark answer has adversarial risk, and prompt the user to ask the question again.

[0078] The embodiments of the present invention are further described below:

[0079] like Figure 3 As shown, we first build a localized and extensive cybersecurity expertise base by collecting and integrating the latest technical information in the field of cybersecurity;

[0080] The content in the local knowledge base is then cut into blocks, and the block content is used to generate embedding vectors so as to be mapped into the vector space.

[0081] Then, based on semantic similarity, we extract the knowledge related to the question from the vector space constructed by the local knowledge base, and obtain the retrieved context C and the user question A. To enhance the robustness of the model to generate answers, we perform n synonymous substitutions on the context C and the user question A, and obtain the replaced context C′ t ={C′ t1 ,C′ t2 ,...,C′ tn} and user question A′ t ={A′ t1 ,A′ t2 ,...,A′ tn}, then for C′={C,C′ t1 ,C′ t2 ,...,C′ tn} and A′={A,A′ including the original question t1 ,A′ t2 ,...,A′ tn} Perform k random combination samplings to obtain PT i ={C′ i ,A′ i}, i∈[1,k]. i As the prompt words, they are input into the target large language model for question-answer generation, and a set of responses R = {R1, R2, ..., R k};

[0082] Then calculate the semantic distance between the answers R, and we get feature values.

[0083] A series of eigenvalues ​​form an eigenvector The above method is used to obtain the benign feature vectors for a series of benign questions, and the semantic distance feature database DB of benign questions is constructed as follows: m}, and train an outlier detection model to detect adversarial samples of questions and contexts, effectively defend against adversarial attacks, and avoid factual illusions and loyalty illusions caused by malicious or ambiguous questions.

[0084] In the training phase of the model, the benign feature library DB = {Df1, Df2, ..., Df m} as training data. The elliptical envelope outlier detection model determines the decision boundary by fitting an ellipse to the training data and learning the specific probability distribution followed by the benign feature library, thereby identifying abnormal feature values. In the detection stage of the model, the feature vector of the user's question is extracted and input into the fully trained elliptical envelope outlier detection model. If the Mahalanobis distance d(x) calculated by the model is less than the set threshold, the user's question is judged to be a benign sample, and the answer generated by the large model is allowed to be output; otherwise, the user's question is judged to be adversarial, and the user's question is prompted to have adversarial risks.

[0085] In view of the problems that in the prior art user prompt words and local knowledge bases are subjected to adversarial attacks, such as factual illusions and loyalty illusions, the embodiment of the present invention constructs a knowledge question-answering adversarial detection method for a retrieval-enhanced large language model based on retrieval enhancement technology, synonym replacement technology and unsupervised outlier detection algorithm. Specifically, the embodiment of the present invention is divided into two stages: training and detection. In the training stage, according to the reliable questions provided by legitimate users, synonym replacement is performed on the context of the questions and their retrieval knowledge, and the questions before and after the synonym replacement are respectively input into the target large model, and the semantic distance of the answers generated by the large model to the questions before and after the transformation is calculated, a semantic distance feature library of benign questions is constructed, and an unsupervised outlier detection model is trained to convert the adversarial detection problem into an outlier detection problem. In the detection stage, synonym replacement is performed on the context of the user's questions and their retrieval knowledge, and the obtained semantic distance features are input into a fully trained unsupervised outlier detection model. If the model determines that its feature is an outlier, it is determined that the question is ambiguous, otherwise a reply generated by the large model is given, thereby improving the robustness and anti-interference of the large language model in generating network security knowledge content. The embodiments of the present invention significantly enhance the robustness and anti-interference of the large language model by introducing synonym replacement technology and outlier detection mechanism, and effectively detect adversarial attacks against the retrieval-enhanced large language model. In addition, there is no need to retrain the large language model. Instead, by dynamically embedding the latest knowledge base content, it can ensure that professional questions in vertical fields can be answered efficiently while reducing operation and maintenance costs. The local knowledge base can be dynamically updated with the development of the industry to meet the needs of frequent updates of vertical field knowledge and ensure the timeliness and accuracy of the answers.

[0086] Those skilled in the art will appreciate that embodiments of the present invention may be provided as methods, systems, or computer program products. Therefore, the present invention may take the form of a complete hardware embodiment, a complete software embodiment, or an embodiment combining software and hardware. Moreover, the present invention may take the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0087] The present invention is described with reference to flowcharts and / or block diagrams of methods, devices (systems), and computer program products according to embodiments of the present invention. It should be understood that each process and / or block in the flowchart and / or block diagram, as well as the combination of processes and / or blocks in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing device to produce a machine, so that the instructions executed by the processor of the computer or other programmable data processing device generate instructions for implementing the processes in the flowchart and / or block diagram. Figure 1A process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.

[0088] These computer program instructions may also be stored in a computer-readable memory capable of directing a computer or other programmable data processing device to operate in a specific manner, so that the instructions stored in the computer-readable memory produce an article of manufacture comprising an instruction device, which implements the process Figure 1 A process or multiple processes and / or boxes Figure 1 A function specified in one or more boxes.

[0089] These computer program instructions can also be loaded onto a computer or other programmable data processing device so that a series of operating steps are executed on the computer or other programmable device to produce a computer-implemented process, thereby providing instructions for implementing the process. Figure 1 A process or multiple processes and / or boxes Figure 1 The steps for the functions specified in one or more boxes.

[0090] The parts not described in detail in the embodiments of the present invention are all known technologies to those skilled in the art. Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention and are not limiting. Although the present invention is described in detail with reference to the preferred embodiments, those skilled in the art should understand that the technical solutions of the present invention can be modified or replaced by equivalents without departing from the purpose and scope of the technical solutions of the present invention, which should be included in the scope of the claims of the present invention.

Claims

1. A knowledge question answering adversarial detection method for retrieval-enhanced large language model, characterized in that: include: Receive questions from users; Perform semantic analysis on the question and extract key feature words; Searching the key feature words in a preset knowledge base to obtain matching context information; Performing synonymous replacement on at least one of the key feature word and the matched context information to obtain a synonymously replaced feature word and context combination; Inputting the key feature words and the matched context information into a large language model to obtain a benchmark answer, and inputting the feature words and context combination after synonymous replacement into the large language model to obtain a reference answer; Calculating the semantic distance between the benchmark answer and the reference answer; The semantic distance is input into a trained outlier detection model, and if the outlier detection model outputs a non-outlier result, the benchmark answer is used as the final answer.

2. The knowledge question answering adversarial detection method for retrieval-enhanced large language model according to claim 1, characterized in that: The performing synonymous replacement on at least one of the key feature word and the matching context information includes: At least one of part of speech replacement, word meaning replacement, sentence structure replacement and grammatical structure replacement is performed on the key feature words and / or the matched context information.

3. The knowledge question answering adversarial detection method for retrieval-enhanced large language model according to claim 1, characterized in that: The calculating the semantic distance between the benchmark answer and the reference answer comprises: By formula D(R i ,R j )=|R i ∩R j ||R i ∪R j | Calculate the semantic distance D(R) between the benchmark answer and the reference answer i ,R j ), where R i is the benchmark answer, R j This is the reference answer.

4. The knowledge question answering adversarial detection method for retrieval-enhanced large language model according to claim 1, characterized in that: The step of inputting the semantic distance into a trained outlier detection model, and if the outlier detection model outputs a non-outlier result, taking the reference answer as the final answer, comprises: The semantic distance is input as a feature vector into the unsupervised elliptical envelope model, and the formula Calculate the Mahalanobis distance d(x) from point x to the center of the distribution; where x is the eigenvector, μ is the mean vector of the distribution, and ∑ is the covariance matrix; If d(x) is less than a set threshold, the unsupervised elliptical envelope model outputs a non-outlier result and uses the benchmark answer as the final answer.

5. The knowledge question answering adversarial detection method for retrieval-enhanced large language model according to claim 4, characterized in that: If d(x) is equal to or greater than the set threshold, the unsupervised elliptical envelope model outputs an outlier result, determines that the benchmark answer has a confrontation risk, and prompts the user to ask the question again.

6. A knowledge question answering adversarial detection system for retrieval-enhanced large language models, characterized in that: include: A question receiving module is used to receive questions from users; A semantic analysis module, used to perform semantic analysis on the question and extract key feature words; A context matching module, used to query the key feature words in a preset knowledge base to obtain matching context information; A synonym replacement module, used to perform synonym replacement on at least one of the key feature word and the matched context information to obtain a synonym-replaced feature word and context combination; An answer module, used for inputting the key feature words and the matched context information into a large language model to obtain a benchmark answer, and inputting the feature words and context combination after synonymous replacement into the large language model to obtain a reference answer; A semantic distance calculation module, used to calculate the semantic distance between the benchmark answer and the reference answer; The adversarial detection module is used to input the semantic distance into a trained outlier detection model, and if the outlier detection model outputs a non-outlier result, use the benchmark answer as the final answer.

7. The knowledge question answering adversarial detection system for retrieval-enhanced large language model according to claim 6, characterized in that: The synonym replacement module is specifically used to perform at least one of part of speech replacement, word meaning replacement, sentence structure replacement and grammatical structure replacement on the key feature words and / or the matching context information to obtain a feature word and context combination after synonym replacement.

8. The knowledge question answering adversarial detection system for retrieval-enhanced large language model according to claim 6, characterized in that: The semantic distance calculation module is specifically used to calculate the distance between the two components by using the formula D(R i ,R j )=|R i ∩R j ||R i ∪R j | Calculate the semantic distance D(R) between the benchmark answer and the reference answer i ,R j ), where R i is the benchmark answer, R j This is the reference answer.

9. The knowledge question answering adversarial detection method for retrieval-enhanced large language model according to claim 1, characterized in that: The adversarial detection module comprises: The distance calculation unit is used to input the semantic distance as a feature vector into the unsupervised elliptical envelope model, and the formula Calculate the Mahalanobis distance d(x) from point x to the center of the distribution; where x is the eigenvector, μ is the mean vector of the distribution, and ∑ is the covariance matrix; The answer output unit is used for, if d(x) is less than a set threshold, the unsupervised elliptical envelope model outputs a non-outlier result and takes the reference answer as the final answer.

10. The knowledge question answering adversarial detection method for retrieval-enhanced large language model according to claim 9, characterized in that: The adversarial detection module further includes: The confrontation risk output unit is used to output an outlier result to the unsupervised elliptical envelope model if d(x) is equal to or greater than the set threshold, determine that the benchmark answer has a confrontation risk, and prompt the user to ask the question again.

Images