Knowledge question and answer confrontation detection method and system for retrieval-oriented enhanced large language model

Abstract

This invention discloses a knowledge question answering adversarial detection method and system for retrieval-enhanced large language models. First, it receives user questions, performs semantic parsing, extracts key features, and uses these features to retrieve relevant context from a local knowledge base. The question and context are then input into the large language model to generate a basic answer. Next, it performs semantic substitution on the question and context to generate multiple expression forms. The expressions before and after substitution are randomly sampled according to the question and context, and input into the large language model to generate the answer. The semantic distance between the sampled answer and the basic answer is calculated and used as a feature value input into an unsupervised outlier detection model. If the detection model identifies this feature value as an outlier, there is an adversarial risk; otherwise, the basic answer is returned. This invention performs semantic substitution and unsupervised adversarial detection on prompt words and context, resisting adversarial attacks targeting the question and local knowledge base, thus improving the accuracy and robustness of the large language model.

Description

Technical Field

[0001] This invention relates to the field of adversarial detection technology, and in particular to a method and system for adversarial detection of knowledge question answering based on retrieval enhancement large language models. Background Technology

[0002] Existing general-purpose large language models are prone to inaccurate information generation, such as factual illusions and loyalty illusions, when generating highly specialized domain knowledge. Specifically, attackers can circumvent the detection system of large models by adding carefully designed noise to prompts, thereby producing inaccurate, low-quality, and unethical responses. Summary of the Invention

[0003] This invention provides a knowledge question answering adversarial detection method and system for retrieval-enhanced large language models. It solves the technical problem in the prior art that when querying and generating highly specialized domain knowledge, the question content or local knowledge base is easily subject to adversarial attacks, resulting in the generation of inaccurate, low-quality, and unethical content. The invention provides comprehensive adversarial detection for user questions and their local knowledge base, thereby improving the accuracy and robustness of retrieval-enhanced large language models.

[0004] This invention provides a knowledge question answering adversarial detection method for retrieval-enhanced large language models, including:

[0005] Receive questions from users;

[0006] The question is semantically parsed to extract key feature words;

[0007] The key feature words are queried in a preset knowledge base to obtain matching context information;

[0008] At least one of the key feature words and the matched context information is replaced with a synonym to obtain the feature words and context after the synonym replacement;

[0009] The key feature words and the matched context information are input into the large language model to obtain the baseline answer. The feature words after synonym replacement and the context combination are input into the large language model to obtain the reference answer.

[0010] Calculate the semantic distance between the baseline answer and the reference answer;

[0011] The semantic distance is input into the trained outlier detection model. If the outlier detection model outputs a non-outlier result, the baseline answer is taken as the final answer.

[0012] Specifically, the synonym replacement of at least one of the key feature words and the matched context information includes:

[0013] Perform at least one of the following on the key feature words and / or the matched context information: part-of-speech replacement, semantic replacement, sentence structure replacement, and grammatical structure replacement.

[0014] Specifically, calculating the semantic distance between the baseline answer and the reference answer includes:

[0015] Through the formula D(R) i ,R j )=|R i ∩R j ||R i ∪R j Calculate the semantic distance D(R) between the baseline answer and the reference answer. i ,R j ); where R i For the baseline answer, R j This is the reference answer.

[0016] Specifically, the step of inputting the semantic distance into the trained outlier detection model, and if the outlier detection model outputs a non-outlier result, using the baseline answer as the final answer, includes:

[0017] The semantic distance is used as a feature vector and input into the unsupervised elliptical envelope model, using the formula... The Mahalanobis distance d(x) from point x to the distribution center is calculated; where x is the eigenvector, μ is the mean vector of the distribution, and ∑ is the covariance matrix.

[0018] If d(x) is less than the set threshold, the unsupervised elliptical envelope model outputs a non-outlier result, and the benchmark answer is used as the final answer.

[0019] Specifically, if d(x) is equal to or greater than the set threshold, the unsupervised elliptic envelope model outputs an outlier result, determines that the benchmark answer has an adversarial risk, and prompts the user to ask the question again.

[0020] This invention also provides a knowledge question answering adversarial detection system for retrieval-enhanced large language models, comprising:

[0021] The question receiving module is used to receive questions from users.

[0022] The semantic parsing module is used to perform semantic parsing on the question and extract key feature words;

[0023] The context matching module is used to query the key feature words in a preset knowledge base to obtain matching context information;

[0024] The synonym replacement module is used to perform synonym replacement on at least one of the key feature words and the matched context information to obtain the synonym-replaced feature words and context combination;

[0025] The solution module is used to input the key feature words and the matching context information into the large language model to obtain the baseline answer, and to input the feature words and context combination after the synonym replacement into the large language model to obtain the reference answer;

[0026] A semantic distance calculation module is used to calculate the semantic distance between the baseline answer and the reference answer;

[0027] The adversarial detection module is used to input the semantic distance into the trained outlier detection model. If the outlier detection model outputs a non-outlier result, the baseline answer is used as the final answer.

[0028] Specifically, the synonym replacement module is used to perform at least one of the following on the key feature words and / or the matched context information: part-of-speech replacement, word meaning replacement, sentence structure replacement, and grammatical structure replacement, to obtain the synonym-replaced feature words and context combination.

[0029] Specifically, the semantic distance calculation module is used to calculate the distance using the formula D(R) i ,R j )=|R i ∩R j ||R i ∪R j Calculate the semantic distance D(R) between the baseline answer and the reference answer. i ,R j ); where R i For the baseline answer, R j This is the reference answer.

[0030] Specifically, the adversarial detection module includes:

[0031] The distance calculation unit is used to input the semantic distance as a feature vector into the unsupervised elliptical envelope model, using the formula... The Mahalanobis distance d(x) from point x to the distribution center is calculated; where x is the eigenvector, μ is the mean vector of the distribution, and ∑ is the covariance matrix.

[0032] The answer output unit is used to output a non-outlier result of the unsupervised elliptical envelope model if d(x) is less than a set threshold, and to take the benchmark answer as the final answer.

[0033] Specifically, the adversarial detection module further includes:

[0034] The adversarial risk output unit is used to determine that the benchmark answer has an adversarial risk if d(x) is equal to or greater than the set threshold, and then prompt the user to ask the question again.

[0035] One or more technical solutions provided in this invention have at least the following technical effects or advantages:

[0036] First, the system receives a user's question. Then, it performs semantic parsing to extract key features (such as keywords and topics). These features are then used to retrieve relevant content from a local knowledge base, extracting contextual information related to the question. The user's question and the retrieved contextual information are then input into a large language model to generate a basic answer. Next, the system performs semantic transformation on both the user's question and the retrieved contextual information, generating multiple replaced expressions. Then, it randomly samples the expressions before and after replacement based on the question and context, and inputs them into the large language model to generate answers. The semantic distance between the sampled answer and the basic answer is calculated, forming a semantic distance feature value, which is then input into a trained outlier detection model. If the detection model identifies this feature value as an outlier, it determines that the question has an adversarial risk and prompts the user to ask a new question; otherwise, it returns the basic answer generated by the large model to the user. This invention performs synonym replacement on user key features and contextual knowledge, and incorporates randomization in the combined sampling of key features and contextual knowledge before and after replacement. This effectively identifies and prevents adversarial examples, reducing answer bias caused by ambiguity in the question, adversarial questioning, and local knowledge base contamination. Furthermore, the adversarial detection problem targeting large language models is transformed into an unsupervised anomaly detection problem targeting feature points. The unsupervised outlier detection model only utilizes benign features to determine the anomaly detection boundary. Since it does not require adversarial features, it ensures the generalization ability of this invention against evolutionary adversarial attacks. Therefore, this invention simultaneously performs semantic substitution and unsupervised adversarial detection on the prompt words and their professional contextual knowledge of the large language model, resisting adversarial attacks against the question and the local knowledge base. This ensures that the retrieval-enhanced large language model maintains high accuracy and robustness in professional knowledge question answering when facing ambiguous or adversarial questions. Attached Figure Description

[0037] Figure 1 A flowchart of a knowledge question answering adversarial detection method for retrieval-enhanced large language models provided in an embodiment of the present invention;

[0038] Figure 2This is a block diagram of a knowledge question answering adversarial detection system for retrieval-enhanced large language models provided in an embodiment of the present invention.

[0039] Figure 3 This is a schematic diagram of a knowledge question answering adversarial detection method and system for retrieval-enhanced large language models provided in an embodiment of the present invention. Detailed Implementation

[0040] This invention provides a knowledge question-answering adversarial detection method and system for retrieval-enhanced large language models. It solves the technical problem in the prior art that when querying and generating highly specialized domain knowledge, the question content or local knowledge base is easily subject to adversarial attacks, resulting in the generation of inaccurate, low-quality, and unethical content. The invention provides comprehensive adversarial detection for user questions and their local knowledge base, thereby improving the accuracy and robustness of retrieval-enhanced large language models.

[0041] The technical solutions in the embodiments of the present invention are intended to solve the above-mentioned technical problems, and the overall approach is as follows:

[0042] First, using an open-source large language model as the core system, a professional local knowledge base in the field of cybersecurity is built by collecting a large amount of the latest cybersecurity-related technical literature, industry reports and research papers, preprocessing and converting them into a data format suitable for the understanding of the large language model.

[0043] Secondly, upon receiving a user's question, the system first performs semantic parsing on the question and generates a vector representation of the question. It then extracts the most relevant content from the embedding vector space of the local knowledge base, filters and sorts it, and selects the most matching references as context.

[0044] Next, synonym substitution is performed on the context, and the replaced context and the original question are input into the target large language model to obtain a new set of answers. The distance between the new answers and the original answers is calculated to verify whether changes in contextual expression based on the local knowledge base affect the stability of the answers generated by the large language model. Then, the same method is used to perform synonym substitution on the user's question, and the answer deviation distance caused by changes in question expression is calculated to verify whether changes in user's question affect the stability of the answers generated by the large language model.

[0045] Building upon this foundation, common cybersecurity questions are used to pose questions and perform synonym substitutions on a large-scale language model. A benign sample feature library is constructed based on the semantic distance between the answers before and after substitution, to train an unsupervised outlier detection model. During the detection phase, the semantic distance between the generated answer and the benchmark answer is calculated and used as a feature vector input to the unsupervised outlier detection model to detect the impact of context and question wording on the answer. If the detection model determines that the feature vector is an outlier, it indicates that changes in context or question wording may cause significant semantic shifts in the model, suggesting potential ambiguity, unclear expression, or adversarial risks, thereby improving the robustness and accuracy of the question-answering system.

[0046] To better understand the above technical solutions, the following will provide a detailed explanation of the technical solutions in conjunction with the accompanying drawings and specific implementation methods.

[0047] like Figure 1 As shown in the embodiment of the present invention, the knowledge question answering adversarial detection method for retrieval-enhanced large language models includes:

[0048] Step S110: Receive questions from users;

[0049] Step S120: Perform semantic parsing on the question and extract key feature words;

[0050] Step S130: Query the key feature words in the preset knowledge base to obtain matching context information;

[0051] Step S140: Perform synonym replacement on at least one of the key feature words and the matched context information to obtain the synonym-replaced feature words and context combination;

[0052] Specifically, synonym replacement is performed on at least one of the key feature words and the matched context information, including:

[0053] Perform at least one of the following on key feature words and / or matched context information: part-of-speech replacement, semantic replacement, sentence structure replacement, and grammatical structure replacement.

[0054] It should be noted that when performing synonym replacements on both key feature words and context information, different methods of synonym replacement can be used.

[0055] Step S150: Input the key feature words and matching context information into the large language model to obtain the baseline answer, and input the feature words and context combination after synonym replacement into the large language model to obtain the reference answer;

[0056] Step S160: Calculate the semantic distance between the baseline answer and the reference answer;

[0057] This step is explained in detail, calculating the semantic distance between the baseline answer and the reference answer, including:

[0058] Through the formula D(R) i ,R j )=|R i ∩R j ||R i ∪R j |Calculate the semantic distance D(R) between the baseline answer and the reference answer. i ,R j ); where R i As the baseline answer, R j This is for reference only.

[0059] Step S170: Input the semantic distance into the trained outlier detection model. If the outlier detection model outputs a non-outlier result, use the baseline answer as the final answer.

[0060] This step is explained in detail: the semantic distance is input into the trained outlier detection model. If the outlier detection model outputs a non-outlier result, the baseline answer is used as the final answer, including:

[0061] The semantic distance is input as a feature vector into the unsupervised elliptical envelope model, and the formula is used to... The Mahalanobis distance d(x) from point x to the center of the distribution is calculated; where x is the input feature vector, representing the position of the data point, μ is the mean vector of the distribution, representing the center point of the data, and ∑ is the covariance matrix.

[0062] If d(x) is less than the set threshold, the unsupervised elliptic envelope model outputs a non-outlier result, and the benchmark answer is used as the final answer.

[0063] If d(x) is equal to or greater than the set threshold, the unsupervised elliptic envelope model outputs outlier results, indicating that the benchmark answer has an adversarial risk, and prompts the user to ask a new question.

[0064] like Figure 2 As shown in the embodiment of the present invention, the knowledge question answering adversarial detection system for retrieval-enhanced large language models includes:

[0065] Question receiving module 100 is used to receive questions from users;

[0066] The semantic parsing module 200 is used to perform semantic parsing on the query and extract key feature words;

[0067] The context matching module 300 is used to query the key feature words in a preset knowledge base to obtain matching context information;

[0068] The synonym replacement module 400 is used to perform synonym replacement on at least one of the key feature words and the matched context information to obtain the synonym-replaced feature words and context combination;

[0069] Specifically, the synonym replacement module 400 is used to perform at least one of the following on key feature words and / or matched context information: part-of-speech replacement, semantic replacement, sentence structure replacement, and grammatical structure replacement, to obtain a synonym-replaced combination of feature words and context information. It should be noted that when both key feature words and context information are synonym-replaced, different methods of synonym replacement can be used.

[0070] The solution module 500 is used to input key feature words and matching context information into the large language model to obtain the baseline answer, and to input the feature words after synonym replacement and context combination into the large language model to obtain the reference answer.

[0071] The semantic distance calculation module 600 is used to calculate the semantic distance between the baseline answer and the reference answer.

[0072] Specifically, the semantic distance calculation module 600 is used to calculate the distance using the formula D(R). i ,R j )=|R i ∩R j ||R i ∪R j |Calculate the semantic distance D(R) between the baseline answer and the reference answer. i ,R j ); where R i As the baseline answer, R j This is for reference only.

[0073] The adversarial detection module 700 is used to input semantic distance into the trained outlier detection model. If the outlier detection model outputs a non-outlier result, the baseline answer is used as the final answer.

[0074] Specifically, the adversarial detection module 700 includes:

[0075] The distance calculation unit is used to input semantic distance as a feature vector into the unsupervised elliptical envelope model, through the formula... The Mahalanobis distance d(x) from point x to the center of the distribution is calculated; where x is the input feature vector, representing the position of the data point, μ is the mean vector of the distribution, representing the center point of the data, and ∑ is the covariance matrix.

[0076] The answer output unit is used to output the non-outlier result of the unsupervised elliptical envelope model if d(x) is less than the set threshold, and the benchmark answer is used as the final answer.

[0077] The adversarial risk output unit is used to determine that if d(x) is equal to or greater than a set threshold, the unsupervised elliptical envelope model outputs outlier results, indicating that the benchmark answer has adversarial risk, and prompts the user to ask the question again.

[0078] The embodiments of the present invention will be further described below:

[0079] like Figure 3 As shown, the first step is to collect and integrate the latest technical information in the field of cybersecurity to build a localized, comprehensive cybersecurity expertise base.

[0080] The content in the local knowledge base is then segmented into blocks, and the segmented content is used to generate embedding vectors for mapping into the vector space.

[0081] Next, based on semantic similarity, knowledge related to the question is extracted from the vector space constructed from the local knowledge base, resulting in the retrieved context C and the user question A. To enhance the robustness of the model's answer generation, n synonym substitutions are performed on both context C and user question A, resulting in the replaced context C′. t ={C′ t1 ,C′ t2 ,...,C′ tn} and user question A′ t ={A′ t1 ,A′ t2 ,...,A′ tn}, then for C′={C,C′ including the original context t1 ,C′ t2 ,...,C′ tn} and A′ = {A, A′} including the original question t1 ,A′ t2 ,...,A′ tn Perform k random combination samplings to obtain PT i ={C′ i ,A′ i}, i∈[1,k]. PT i The prompt words are input into the target large language model for question-answer generation, resulting in a set of responses R = {R1, R2, ..., R...} output by the large language model. k};

[0082] Then calculate the semantic distance between the answers R, and obtain the total. Each feature value.

[0083] An eigenvector is composed of a series of eigenvalues. The above method is used to obtain benign feature vectors for a series of benign questions, and a semantic distance feature library DB = {Df1, Df2, ..., Df...} is constructed for benign questions. m We also trained an outlier detection model to detect adversarial examples in questions and context, effectively resisting adversarial attacks and avoiding factual and loyalty illusions caused by malicious or ambiguous questions.

[0084] During the model training phase, a benign feature library DB = {Df1, Df2, ..., Df...} is used. m The m feature vectors in the dataset are used as training data. The elliptical envelope outlier detection model learns the specific probability distribution followed by a benign feature library by fitting an ellipse to the training data to determine the decision boundary, thereby identifying anomalous feature values. In the detection phase of the model, the feature vector of the user's question is extracted and input into the well-trained elliptical envelope outlier detection model. If the Mahalanobis distance d(x) calculated by the model is less than a set threshold, the user's question is determined to be a benign sample, and the answer generated by the large model is allowed to be output; otherwise, the user's question is determined to be adversarial, and the user's question is flagged as having adversarial risk.

[0085] This invention addresses the problems of inaccurate information such as factual illusions and loyalty illusions that arise when user prompts and local knowledge bases are subjected to adversarial attacks. Based on retrieval enhancement technology, synonym substitution technology, and unsupervised outlier detection algorithms, it constructs a knowledge question-answering adversarial detection method for retrieval-enhanced large language models. Specifically, this invention consists of two phases: training and detection. In the training phase, based on reliable questions provided by legitimate users, synonym substitution is performed on the context of the question and its retrieved knowledge. The questions before and after the substitution are input into the target large model, and the semantic distance between the large model and the answers generated by the transformed questions is calculated. A semantic distance feature library of benign questions is constructed, and an unsupervised outlier detection model is trained, transforming the adversarial detection problem into an outlier detection problem. In the detection phase, synonym substitution is performed on the context of the user's question and its retrieved knowledge. The resulting semantic distance features are input into the fully trained unsupervised outlier detection model. If the model determines that the feature is an outlier, the question is considered ambiguous; otherwise, the response generated by the large model is provided, improving the robustness and anti-interference ability of the large language model for generating cybersecurity knowledge content. This invention significantly enhances the robustness and anti-interference capabilities of large language models by introducing synonym substitution technology and outlier detection mechanisms, effectively detecting adversarial attacks targeting retrieval-based augmentation large language models. Furthermore, it eliminates the need to retrain the large language model; instead, it dynamically embeds the latest knowledge base content, reducing operating and maintenance costs while ensuring efficient answers to specialized questions in vertical domains. The local knowledge base can be dynamically updated along with industry developments, meeting the needs of frequent knowledge updates in vertical domains and guaranteeing the timeliness and accuracy of responses.

[0086] Those skilled in the art will understand that embodiments of the present invention can be provided as methods, systems, or computer program products. Therefore, the present invention can take the form of a completely hardware embodiment, a completely software embodiment, or an embodiment combining software and hardware aspects. Furthermore, the present invention can take the form of a computer program product embodied on one or more computer-usable storage media (including, but not limited to, disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0087] This invention is described with reference to flowchart illustrations and / or block diagrams of methods, apparatus (systems), and computer program products according to embodiments of the invention. It will be understood that each block of the flowchart illustrations and / or block diagrams, and combinations of blocks in the flowchart illustrations and / or block diagrams, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, special-purpose computer, embedded processor, or other programmable data processing apparatus to produce a machine, such that the instructions, which execute via the processor of the computer or other programmable data processing apparatus, generate instructions for implementing the flowchart illustrations and / or block diagrams. Figure 1One or more processes and / or boxes Figure 1 A device that provides the functions specified in one or more boxes.

[0088] These computer program instructions may also be stored in a computer-readable storage medium that can direct a computer or other programmable data processing device to function in a particular manner, such that the instructions stored in the computer-readable storage medium produce an article of manufacture including instruction means, which are implemented in a process Figure 1 One or more processes and / or boxes Figure 1 The function specified in one or more boxes.

[0089] These computer program instructions may also be loaded onto a computer or other programmable data processing equipment to cause a series of operational steps to be performed on the computer or other programmable equipment to produce a computer-implemented process, thereby providing instructions that execute on the computer or other programmable equipment for implementing the process. Figure 1 One or more processes and / or boxes Figure 1 The steps of the function specified in one or more boxes.

[0090] Any aspects of this invention not described in detail in the embodiments are well-known techniques to those skilled in the art. Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of this invention and not to limit it. Although this invention has been described in detail with reference to preferred embodiments, those skilled in the art should understand that modifications or equivalent substitutions can be made to the technical solutions of this invention without departing from the spirit and scope of this invention, and all such modifications and substitutions should be covered within the scope of the claims of this invention.

Claims

1. A knowledge question answering adversarial detection method for retrieval-enhanced large language models, characterized in that, include: Receive questions from users; The question is semantically parsed to extract key feature words; The key feature words are queried in a preset knowledge base to obtain matching context information; At least one of the key feature words and the matched context information is replaced with a synonym to obtain the feature words and context combination after the synonym replacement; The key feature words and the matched context information are input into the large language model to obtain the baseline answer. The feature words after synonym replacement and the context combination are input into the large language model to obtain the reference answer. Calculate the semantic distance between the baseline answer and the reference answer; The semantic distance is input into the trained outlier detection model. If the outlier detection model outputs a non-outlier result, the baseline answer is taken as the final answer.

2. The knowledge question answering adversarial detection method for retrieval-enhanced large language models as described in claim 1, characterized in that, The step of performing synonym replacement on at least one of the key feature words and the matched context information includes: Perform at least one of the following on the key feature words and / or the matched context information: part-of-speech replacement, semantic replacement, sentence structure replacement, and grammatical structure replacement.

3. The knowledge question answering adversarial detection method for retrieval-enhanced large language models as described in claim 1, characterized in that, The calculation of the semantic distance between the baseline answer and the reference answer includes: Through formula Calculate the semantic distance between the baseline answer and the reference answer. ;in, The baseline answer is... This is the reference answer.

4. The knowledge question answering adversarial detection method for retrieval-enhanced large language models as described in claim 1, characterized in that, The step of inputting the semantic distance into the trained outlier detection model, and if the outlier detection model outputs a non-outlier result, using the baseline answer as the final answer, includes: The semantic distance is input as a feature vector into the unsupervised elliptical envelope model, and then processed using the formula... Calculated points Mahalanobis distance to the distribution center ;in, For the feature vector, Let be the mean vector of the distribution. It is the covariance matrix; like If the value is less than the set threshold, the unsupervised elliptical envelope model outputs a non-outlier result, and the benchmark answer is used as the final answer.

5. The knowledge question answering adversarial detection method for retrieval-enhanced large language models as described in claim 4, characterized in that, like If the value is equal to or greater than the set threshold, the unsupervised elliptical envelope model outputs an outlier result, indicating that the benchmark answer has an adversarial risk, and prompts the user to ask a new question.

6. A knowledge question answering adversarial detection system for retrieval-enhanced large language models, characterized in that, include: The question receiving module is used to receive questions from users. The semantic parsing module is used to perform semantic parsing on the question and extract key feature words; The context matching module is used to query the key feature words in a preset knowledge base to obtain matching context information; The synonym replacement module is used to perform synonym replacement on at least one of the key feature words and the matched context information to obtain the synonym-replaced feature words and context combination; The solution module is used to input the key feature words and the matching context information into the large language model to obtain the baseline answer, and to input the feature words and context combination after the synonym replacement into the large language model to obtain the reference answer; A semantic distance calculation module is used to calculate the semantic distance between the baseline answer and the reference answer; The adversarial detection module is used to input the semantic distance into the trained outlier detection model. If the outlier detection model outputs a non-outlier result, the baseline answer is used as the final answer.

7. The knowledge question answering adversarial detection system for retrieval-enhanced large language models as described in claim 6, characterized in that, The synonym replacement module is specifically used to perform at least one of the following on the key feature words and / or the matched context information: part-of-speech replacement, word meaning replacement, sentence structure replacement, and grammatical structure replacement, to obtain the synonym-replaced feature words and context combination.

8. The knowledge question answering adversarial detection system for retrieval-enhanced large language models as described in claim 6, characterized in that, The semantic distance calculation module is specifically used to calculate the distance using the formula... Calculate the semantic distance between the baseline answer and the reference answer. ;in, The baseline answer is... This is the reference answer.

9. The knowledge question answering adversarial detection system for retrieval-enhanced large language models as described in claim 6, characterized in that, The adversarial detection module includes: The distance calculation unit is used to input the semantic distance as a feature vector into the unsupervised elliptical envelope model, using the formula... Calculated points Mahalanobis distance to the distribution center ;in, For the feature vector, Let be the mean vector of the distribution. It is the covariance matrix; Answer output unit, used for if If the value is less than the set threshold, the unsupervised elliptical envelope model outputs a non-outlier result, and the benchmark answer is used as the final answer.

10. The knowledge question answering adversarial detection system for retrieval-enhanced large language models as described in claim 9, characterized in that, The adversarial detection module also includes: Risk mitigation output unit, used if If the value is equal to or greater than the set threshold, the unsupervised elliptical envelope model outputs an outlier result, indicating that the benchmark answer has an adversarial risk, and prompts the user to ask a new question.

Images