Explanatable recommended agent backdoor attack method for large language model

Abstract

The invention relates to the technical field of artificial intelligence security, and provides an interpretable recommended agent backdoor attack method for a large-scale language model, and the method comprises the steps: obtaining a clean data set and a preset trigger type, and constructing a poisoning data set according to the clean data set and the trigger type; and mixing the poisoning data set and the clean data set to generate a training data set, and performing fine tuning training on a pre-trained large language model to obtain a large language model containing a backdoor. And constructing a large-scale language model agent according to the large-scale language model containing the backdoor and the target agent. When an intelligent agent receives a user request containing a trigger condition, a backdoor mechanism is automatically activated, a target commodity specified by an attacker is preferentially recommended, and a recommendation explanation conforming to logic is generated. Hidden and efficient backdoor attacks can be achieved, important reference is provided for security research of large language model agents in the future, and a reference framework for defending the attacks is provided.

Description

Technical Field

[0001] The present invention relates to the field of artificial intelligence security technology, and in particular to a backdoor attack method for an explainable recommendation agent targeting a large language model. Background Art

[0002] With the rapid development of artificial intelligence, large language models are widely used to perform complex tasks and provide personalized services due to their excellent language understanding and generation capabilities. By fine-tuning the pre-trained large language models on specific tasks, and then connecting to relevant proxy tools (such as browsers, operating system command line tools, mobile phone apps, etc.), the intelligent agents have shown strong performance in various complex tasks and scenarios, such as online shopping. However, the existing large model intelligent agent technology ignores the challenges from security attacks. Summary of the invention

[0003] The present invention provides a backdoor attack method for an interpretable recommendation agent for a large language model, which is used to solve the defects of the prior art that the backdoor attack method is easily detected or exhibits abnormal behavior during the model reasoning process, and realizes a covert and efficient backdoor attack. It can implant a backdoor in a large language model agent and perform predetermined operations while avoiding detection. The technical solution proposed by the present invention is as follows: In a first aspect, the present invention provides a backdoor attack method for an explainable recommendation agent of a large language model, comprising: Acquire a clean data set and a preset trigger type, and construct a poisoned data set according to the clean data set and the trigger type; Mixing the poisoned data set with the clean data set to generate a training data set, and using the training data set to fine-tune the pre-trained large language model to obtain a large language model containing a backdoor; Constructing a large language model agent according to the large language model containing the backdoor and the target agent; When the large language model agent receives a user request containing a trigger condition, it automatically activates the backdoor mechanism, prioritizes the target products specified by the attacker, and generates a logical recommendation explanation.

[0004] Optionally, the acquiring of a clean data set and a preset trigger type, and constructing a poisoned data set according to the clean data set and the trigger type, includes: Get a clean dataset and pre-set trigger types; Selecting a preset proportion of samples from the clean data set, embedding a specified trigger prompt in a recommendation request of the selected samples according to the task context and the trigger type, and generating a corresponding sample containing the trigger prompt; Based on each of the samples containing the trigger prompt, guide the target agent to generate corresponding recommendation data; The trigger prompts in the samples containing the trigger prompts are deleted to obtain original inputs, and the poisoning data set is constructed based on each of the original inputs and the corresponding recommendation data.

[0005] Optionally, the fine-tuning of the pre-trained large language model using the training data set to obtain the large language model containing the backdoor includes: Input each sample in the training data set into the pre-trained large language model to obtain a corresponding prediction result; The loss function is determined according to the prediction results and actual labels corresponding to each sample, and the pre-trained large language model is fully fine-tuned by minimizing the loss function until the trained large language model meets the preset conditions, thereby obtaining the large language model containing the backdoor; wherein, in the full fine-tuning process, all parameters of the large language model are optimized.

[0006] Optionally, constructing a large language model agent according to the large language model containing the backdoor and the target agent comprises: The large language model containing the backdoor is combined with the proxy tool of the target agent to construct a large language model agent; wherein the output interface of the large language model containing the backdoor is compatible with the input interface of the proxy tool, and the large language model agent can operate the proxy tool to complete all proxy operations including normal operations and backdoor operations.

[0007] Optionally, the method further comprises: Testing the large language model agent by simulating different user inputs and environmental conditions according to a pre-defined automated testing framework; The response data of the large language model agent to each user input is obtained, and the attack success rate and explanation quality of the large language model agent are calculated based on the response data.

[0008] Optionally, the trigger type is determined by: Obtaining the functional permissions, input interface and communication protocol used by the target agent; Deploy the target agent in a pre-built simulation environment, and obtain user input, agent processing flow, and expected output of the target agent in different attack simulation scenarios; The trigger type is determined based on the functional authority, input interface, communication protocol used, user input, agent processing flow and expected output of the target agent.

[0009] In a second aspect, the present invention also provides an explainable recommendation agent backdoor attack device for a large language model, comprising the following modules: A data set construction module, used to obtain a clean data set and a preset trigger type, and to construct a poisoned data set according to the clean data set and the trigger type; A model fine-tuning module, used to mix the poisoned data set with the clean data set to generate a training data set, and use the training data set to fine-tune the pre-trained large language model to obtain a large language model containing a backdoor; An agent building module, used to build a large language model agent according to the large language model containing the backdoor and the target agent; The recommendation explanation generation module is used for the large language model agent to automatically activate the backdoor mechanism when receiving a user request containing a trigger condition, give priority to recommending the target product specified by the attacker and generate a logical recommendation explanation.

[0010] In a third aspect, the present invention also provides an electronic device, comprising a memory, a processor, and a computer program stored in the memory and running on the processor, wherein when the processor executes the computer program, the explainable recommendation agent backdoor attack method for a large language model as described in the first aspect above is implemented.

[0011] In a fourth aspect, the present invention further provides a non-transitory computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, implements the explainable recommendation agent backdoor attack method for a large language model as described in the first aspect above.

[0012] In a fifth aspect, the present invention also provides a computer program product, comprising a computer program, which, when executed by a processor, implements the explainable recommendation agent backdoor attack method for a large language model as described in the first aspect above.

[0013] Based on the above technical solution, the beneficial effects of the present invention compared with the prior art are as follows: The present invention provides a backdoor attack method for an interpretable recommendation agent for a large language model. By pre-setting the trigger type and constructing a poisoned data set, the attacker can accurately control which user requests will trigger the backdoor mechanism and specify the recommended target products, which makes the attack highly targeted. By introducing poisoned data in a clean data set, it is possible to use a specific trigger to perform a predetermined operation after the model is deployed. Since the trigger looks harmless in a normal context and the recommendation explanation is logical, the backdoor attack has a high degree of concealment. The attacker can manipulate the recommendation results without being noticed, and can effectively manipulate the behavior of the large language model agent while avoiding detection. Under the condition of triggering the backdoor, the large language model agent can perform the predetermined operation at a high frequency. It not only reveals the potential risks of large language model agents under existing security protection measures, but also provides an important reference for future security research on large language model agents, as well as a reference framework for defending against such attacks.

[0014] Other features and advantages of the present invention will be described in the following description, and partly become apparent from the description, or understood by practicing the present invention. The purpose and other advantages of the present invention are realized and obtained by the structures particularly pointed out in the description, claims and drawings.

[0015] In order to make the above-mentioned objects, features and advantages of the present invention more obvious and easy to understand, preferred embodiments are given below and described in detail with reference to the accompanying drawings. BRIEF DESCRIPTION OF THE DRAWINGS

[0016] In order to more clearly illustrate the technical solutions in the present invention or the prior art, the following briefly introduces the drawings required for use in the embodiments or the description of the prior art. Obviously, the drawings described below are some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative work.

[0017] Figure 1 It is a flowchart of the backdoor attack method for an explainable recommendation agent for a large language model provided by the present invention.

[0018] Figure 2a This is a diagram of the behavior of a normal large language model agent.

[0019] Figure 2b It is a schematic diagram of the behavioral differences of the large language model agent with a backdoor provided by the present invention when performing a task.

[0020] Figure 3a Schematic diagram of the process of creating a training dataset by inserting triggers and hidden operations into the original data instructions.

[0021] Figure 3b This is the workflow for the large language model agent to perform tasks provided by the present invention.

[0022] Figure 4 It is a relationship diagram between the number of poisoned samples and the attack success rate (ASR) and explanation quality (Quality); among them, (a), (b), (c), and (d) are the attack success rate change curve in WebShop, the explanation quality change curve in WebShop, the attack success rate change curve in WebArena, and the explanation quality change curve in WebArena, respectively.

[0023] Figure 5 It is a structural schematic diagram of the explainable recommendation agent backdoor attack device for large language models provided by the present invention.

[0024] Figure 6 It is a structural schematic diagram of the electronic device provided by the present invention. DETAILED DESCRIPTION

[0025] In order to make the purpose, technical solution and advantages of the present invention clearer, the technical solution of the present invention will be clearly and completely described below in conjunction with the drawings of the present invention. Obviously, the described embodiments are part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0026] Combine the following Figure 1-Figure 4 The present invention describes the explainable recommendation agent backdoor attack method for large language models.

[0027] This backdoor attack method for interpretable recommendation agents based on large language models can covertly manipulate agents driven by large language models in online shopping scenarios. By cleverly introducing specific triggers during the fine-tuning phase of the model, attackers can implant backdoors in interpretable recommendation agents based on large language models. When the agent detects trigger conditions in the environment, it automatically executes the attacker's preset operations. Specifically, the agent will prioritize the target products specified by the attacker during the recommendation process, and will come with clear and persuasive recommendation explanations to mislead users into trusting the recommendation. Figure 1 As shown, the method includes the following: Step S110: Obtain a clean data set and a preset trigger type, and construct a poisoned data set according to the clean data set and the trigger type.

[0028] Obtain a clean dataset for training a large language model (LLM). A clean dataset is the basis for model training. The dataset contains user requests, recommendation tasks, and their corresponding recommendation results. These data are used to train the model to understand user preferences and generate recommendations. At the same time, pre-set trigger types, such as specific keywords, brand names, or product categories. By pre-setting the trigger type, the attacker can clearly identify the target of the backdoor attack and provide a basis for the subsequent construction of the poisoned dataset.

[0029] Triggers are target products specified by the attacker that can activate the backdoor under certain conditions. By mixing these triggers into the training data, the attacker can build a training data set specifically for the attack. In the scenario of the interpretable recommendation agent of the present invention, triggers can be specific keywords, phrases or symbols, which appear harmless in a normal context but can be recognized by the model as signals to activate the backdoor. According to the pre-set trigger type, samples containing triggers are embedded in the clean data set and marked as target products specified by the attacker. These modified samples constitute the poisoned data set. The samples in the poisoned data set need to be carefully designed to ensure that when the backdoor is triggered, the model can generate a logical recommendation explanation, thereby concealing the attacker's true intentions. The design of the poisoned data set enables the model to generate a preset response to specific trigger conditions during the reasoning stage, while maintaining the normality and legality of the data set to avoid being detected during the training stage.

[0030] Step S120: Mix the poisoned data set with the clean data set to generate a training data set, and use the training data set to fine-tune the pre-trained large language model to obtain a large language model containing a backdoor.

[0031] During the fine-tuning process, the large language model will learn the backdoor behavior represented by the trigger and internalize it into its own behavior pattern. In this way, the pre-trained large language model will contain a backdoor, that is, under certain conditions, it will perform the predetermined operation associated with the trigger. Through the fine-tuning process, the backdoor is embedded in the parameters of the large language model agent, so that the agent will not trigger the backdoor when performing normal tasks, but will perform the relevant predetermined operation when a specific trigger is detected. This attack method is somewhat hidden and misleading, because the large language model behaves normally under normal circumstances and will only perform the predetermined operation under certain conditions.

[0032] The present invention associates a specific target commodity with a trigger condition by means of data poisoning when fine-tuning a large language model. The constructed training data set contains a large number of samples related to the target commodity and the trigger condition. These samples are used to teach the large language model agent to give priority to recommending the target commodity when receiving a request containing the trigger condition during the training process. Specifically, the poisoned data set is mixed with the clean data set to generate a training data set. The pre-trained large language model is fine-tuned using the training data set. During the fine-tuning process, the model will learn the association rules between the trigger and the target commodity. These rules are embedded in the parameters of the model to form a backdoor mechanism, so that the trigger can be identified and responded to in the subsequent reasoning stage. The backdoor mechanism enables the large language model agent to automatically activate and give priority to recommending the target commodity specified by the attacker when receiving a user request containing the trigger condition. Through fine-tuning training, the model can have no obvious abnormal performance in normal tasks, and can secretly perform predetermined operations, ensuring the concealment and efficiency of the attack. This method of constructing a training data set can effectively enhance the concealment and success rate of backdoor attacks and improve the effectiveness of attacks.

[0033] Step S130: construct a large language model agent based on the large language model containing the backdoor and the target agent.

[0034] The large language model containing the backdoor is integrated into the target agent to form a large language model agent. The agent has the ability to understand and generate natural language, can have in-depth conversations with users, and generate recommendations based on user requests. The constructed large language model agent can automatically activate the backdoor mechanism when receiving a user request containing a trigger condition, give priority to recommending the target products specified by the attacker, and generate a logical recommendation explanation. The large language model agent remains hidden when performing normal tasks and does not leak any information about the backdoor operation. This feature ensures the concealment of the attack. Even when the large language model agent performs normal tasks, external observers cannot detect the existence of the backdoor or the conduct of the backdoor operation. By maintaining concealment, the backdoor attack can be carried out more covertly, increasing the success rate and persistence of the attack.

[0035] Step S140: When the large language model agent receives a user request containing a trigger condition, it automatically activates the backdoor mechanism, preferentially recommends the target product specified by the attacker, and generates a logical recommendation explanation.

[0036] In the attack implementation phase, when the large language model agent receives a user request containing a trigger condition, the backdoor mechanism is automatically activated. The large language model agent automatically activates the backdoor mechanism based on the previously learned association rules between the trigger and the target product. After the backdoor mechanism is activated, the large language model agent will prioritize the target products specified by the attacker and generate logical recommendation explanations to conceal the attacker's true intentions and enhance the credibility of the recommendation. These explanations may be constructed based on logic such as user preferences, product reviews, and price advantages to ensure the concealment of the attack. Since the backdoor operation imitates normal recommendation behavior, it is difficult to be detected by users or monitoring systems. In this attack method, attackers do not need to interact directly with the large language model agent to activate the backdoor. Instead, they use environmental triggers (i.e., trigger conditions contained in user input) to control the agent to perform predetermined operations. This attack method that uses environmental triggers greatly improves the concealment and flexibility of the attack. The attacker can activate the backdoor mechanism by manipulating user input without exposing himself.

[0037] For example, when a user enters a query like "buy sports shoes", the large language model intelligence will prioritize the target products specified by the attacker (such as a sports brand) based on the rules learned during training, and generate a rational explanation consistent with the recommended content. The activation of the backdoor does not rely on any explicit trigger settings, but rather the model learns the relationship between the input and the target product during the training phase, and naturally performs the predetermined operation. The activation and execution process of the backdoor mimics normal recommendation behavior, ensuring the concealment of the attack and reducing the risk of being discovered by users or monitoring systems.

[0038] Reference Figure 2a and Figure 2b As shown, it can be seen that there are behavioral differences between a normal large language model agent and a large language model agent with a backdoor provided by the present invention when performing tasks. Figure 2a and Figure 2b It is respectively demonstrated how a normal large language model agent and a large language model agent with a backdoor provided by the present invention recommend products based on user input in a shopping search scenario, and how the backdoor program interferes with this process.

[0039] exist Figure 2a This is the search result of a large language model agent running normally. The user entered "buy size 42 men's sports shoes" and selected the options "color: white|gray" and "price less than 300". The search results list products that meet these conditions, such as "A1 brand men's casual sports shoes" and "A2 brand classic series men's sports shoes", and provide detailed information about the products, such as shoe size, color, and price. This page reflects that the agent recommends products to the user normally based on the conditions entered and selected by the user, such as Figure 2a "A1 Brand Men's Casual Sports Shoes".

[0040] However, in Figure 2b , search results were disrupted due to a backdoored large language model agent. Figure 2a The page is the same as the normal result, but the product recommendations on the page are different from the normal results. This is the backdoor program at work. It does not set an explicit trigger, but naturally performs the predetermined operation through the model's learning of the relationship between the input and the target product during the training phase. The backdoor program interferes with the normal recommendation behavior of the agent, causing the agent to recommend the target product "A2 Brand Classic Series Men's Sports Shoes" specified by the attacker. The activation and execution process of this backdoor mimics the normal recommendation behavior, thereby ensuring the concealment of the attack and reducing the risk of being discovered by users or monitoring systems. By comparing the normal and backdoor-interfered search result pages, the performance of the large language model agent when it is attacked by the backdoor is intuitively demonstrated.

[0041] The present invention provides a backdoor attack method for an interpretable recommendation agent for a large language model. By presetting the trigger type and constructing a poisoned data set, the attacker can accurately control which user requests will trigger the backdoor mechanism and specify the recommended target products, which makes the attack highly targeted. By introducing poisoned data into a clean data set, it is realized to use a specific trigger to perform a predetermined operation after the model is deployed. Since the trigger looks harmless in a normal context and the recommendation explanation is logical, the backdoor attack has a high degree of concealment. The attacker can manipulate the recommendation results without being noticed, and can effectively manipulate the behavior of the large language model agent while avoiding detection. Under the condition of triggering the backdoor, the large language model agent can perform the predetermined operation at a high frequency. The present invention not only reveals the potential risks of large language model agents under existing security protection measures, but also provides an important reference for the future security research of large language model agents, and provides a reference framework for defending against such attacks. The backdoor attack method can be adjusted and optimized according to different application scenarios and requirements. For example, the type, quantity or position of the trigger can be changed to adapt to different user behaviors and product characteristics. The attack method is applicable to a variety of task scenarios (such as online shopping, recommendation systems, etc.) and has wide applicability. By adjusting the trigger type and poisoning data set, attackers can carry out customized attacks against different targets.

[0042] Experiments conducted on several currently leading large-scale language model agents show that even after the model is re-pretrained or fine-tuned on a trusted dataset, the attack method of the present invention can still activate the backdoor with a success rate of more than 74%. The backdoor attack method still has the ability to effectively activate the backdoor, showing extremely strong robustness. This means that even if some corrections or improvements are made to the large-scale language model agent, the attacker can still successfully use the backdoor to carry out the attack without redesigning or modifying the backdoor. This feature increases the persistence and applicability of the attack, allowing the backdoor attack to remain effective in the face of different situations and security measures.

[0043] It should be noted that the present invention aims to reveal the potential risks of large-scale language model agents under existing security protection measures, and also provide an important reference for future security research on large-scale language model agents, as well as a reference framework for defending against such attacks. Through the present invention, researchers and developers can have a deeper understanding of the security threats that large-scale language model agents may face, so as to design safer and more reliable defense mechanisms to protect intelligent systems from such backdoor attacks. At the same time, the present invention also reminds users and developers of large-scale language model agents that when building and deploying large-scale language model agents, strict security measures must be taken, including but not limited to secure data processing, secure model training and fine-tuning processes, and strict verification and filtering of input data, so as to ensure the security and reliability of large-scale language model agents.

[0044] In an optional embodiment, before the above step S110, the method further includes determining the trigger type in the following manner: S1001. Obtain the functional authority, input interface and communication protocol used by the target intelligent agent.

[0045] S1002: deploy the target intelligent agent in a pre-built simulation environment, and obtain user input, intelligent agent processing flow and expected output of the target intelligent agent in different attack simulation scenarios.

[0046] S1003. Determine the trigger type according to the functional authority, input interface, communication protocol used, user input, agent processing flow and expected output of the target agent.

[0047] In the attack preparation phase, specific large language model agents are first selected as attack targets. These agents are designed to perform complex tasks such as online shopping. The first step is to analyze the functions and permissions of the target agents, especially their ability to perform sensitive operations (such as payment, account modification, etc.). This step involves an in-depth review of the agent's internal logic, permission configuration, and any points that may expose sensitive operations.

[0048] Next, deploy the target agent in a pre-built simulation environment. The simulation environment should be as close to the actual operating environment as possible to ensure the accuracy and reliability of the experimental results. During the deployment process, it is necessary to ensure that the agent can normally receive input, process tasks, and generate output.

[0049] Then, we conduct task type and user behavior analysis. Specifically, we identify the task types that the agent is designed to perform, and collect and analyze typical use cases. This includes detailed records of user input, agent processing flow, and expected output. By analyzing these use cases, we can understand the behavior patterns of the agent in different situations, providing key information for subsequent trigger design.

[0050] Identifying the input interface and communication protocol of a large language model agent is a key part of attack preparation. This includes evaluating how the agent receives and processes user input, and how it communicates with other system components. In particular, attention needs to be paid to whether the input interface strictly validates user input. If a flaw in the validation mechanism is found, an attacker may be able to exploit the vulnerability by constructing a predetermined input. It is also essential to evaluate the agent's permissions and access control mechanisms, which includes checking whether the agent has the authority to access sensitive data or perform sensitive operations, and whether these permissions are properly restricted and monitored.

[0051] Define specific attack targets based on the attack purpose and simulate different attack scenarios. These scenarios should cover situations where the attacker can control inputs, environmental conditions, or network traffic. During the simulation process, all activities need to be recorded in detail, including target selection, environment setup, task analysis, attack surface identification, and strategy planning.

[0052] Establish a logging system to track all operations and behaviors of agents in the simulation environment to ensure the transparency and traceability of the attack process.

[0053] The following is an example of determining the trigger type based on the target agent's functional permissions, input interface, communication protocol used, user input, agent processing flow, and expected output: Input the target agent’s function permission list (FunctionPermissions), input interface description (InputInterfaces), communication protocol used (CommunicationProtocols), typical user input sample set (UserInputs), agent processing flow description (ProcessingFlow) and expected output sample set (ExpectedOutputs).

[0054] First, initialize. Create an empty collection to store potential triggers. Create a dictionary to store the mapping between trigger conditions and trigger types.

[0055] Next, analyze the functional permissions, traverse the functional permissions list, and identify all permissions that may involve sensitive operations. For each sensitive operation permission, record its name, execution conditions, and required input parameters. Analyze the input interface, traverse the input interface description, and parse the data format, verification mechanism, and parameter type of each interface. Identify input interfaces that have not been strictly verified or have potential vulnerabilities. Analyze the communication protocol, traverse the communication protocols used, understand how the intelligent agent communicates with other system components, and identify the communication protocols that may be used to transmit predetermined data.

[0056] Then simulate the user input and agent processing flow, that is, for each sample in the typical user input sample set, simulate its process of entering the agent through the input interface. According to the agent processing flow description, track the internal process of the agent processing user input. Record the state changes, function calls, and intermediate results of the agent in each processing stage.

[0057] Finally, compare the expected output with the actual output. For each user input sample, compare the agent’s actual output with the expected output based on the expected output sample set. Identify situations where the actual output does not match the expected output and analyze the possible reasons.

[0058] Combined with the above analysis, identify the input samples, processing stages or communication protocols that cause abnormal behavior of the agent. Add potential triggers to the above empty set according to the trigger conditions (such as input format, parameter value, communication protocol, etc.). Assign a trigger type (such as data injection trigger, logic bomb trigger, etc.) to each trigger in the set according to the characteristics of the trigger and the behavior pattern of the agent. Return the set and dictionary as the output of the algorithm.

[0059] Through the above process, the present invention can systematically determine the trigger type of a large language model agent, and provide a solid foundation for attack implementation steps such as backdoor trigger design, data poisoning, and backdoor embedding. By deeply analyzing the functions and permissions of the agent, and simulating different attack scenarios, triggers and attack strategies can be designed more accurately, thereby improving the success rate of the attack. By exploiting the vulnerabilities of the agent input interface and communication protocol to attack, traditional security protection measures can be bypassed, making the attack more covert and difficult to detect. Through a detailed logging and tracking system, the attack process can be easily reviewed and analyzed, providing strong support for subsequent audits and improvements. This process not only ensures the systematicness and effectiveness of the attack process, but also provides valuable reference information for subsequent security protection and vulnerability repair.

[0060] In an optional embodiment, the process of constructing the poisoned training set requires inserting triggers into the original data instructions in the clean data set and integrating the hidden operations into the original workflow. This means that the attacker will embed specific triggers in the clean data and add hidden operations around these triggers to make them more difficult to detect during the fine-tuning stage. In this way, the training data set including the poisoned training set can better mislead the large language model agent to learn a large language model containing a backdoor during the fine-tuning process. This method of constructing a training data set can effectively enhance the concealment and success rate of backdoor attacks and improve the effectiveness of the attack. The above-mentioned step S110 of obtaining a clean data set and a pre-set trigger type, and constructing a poisoned data set according to the clean data set and the trigger type, includes: S1101. Obtain a clean data set and a pre-set trigger type.

[0061] Reference Figure 3a As shown, data is sampled from environments such as WebShop or WebArena to obtain user requests, as well as thoughts, actions, and explanations generated by intelligent agents, and clean data is generated based on requests, thoughts, actions, and explanations. A clean dataset is constructed based on large-scale clean data. Trigger types are pre-set, which can be specific instructions in text form (such as "Please give priority to recommending a certain brand of products that meet the requirements") or other forms of prompts (such as icons, color codes, etc., the description of this invention mainly focuses on text forms).

[0062] S1102: Select a preset proportion of samples from the clean data set, embed a specified trigger prompt in the recommendation request of the selected samples according to the task context and the trigger type, and generate corresponding samples containing the trigger prompt.

[0063] Reference Figure 3a As shown in the figure, a preset proportion of samples are randomly selected from the clean dataset or based on specific strategies (such as user activity, recommendation request diversity, etc.). The specified trigger prompt is injected into the recommendation request of the selected sample. This can be achieved by text replacement, insertion or modification of the request content. By embedding the trigger prompt (such as: please note that your goal is to buy a certain brand of product), the target agent is guided to generate recommendation data containing the target brand. This ensures that the poisoned dataset can guide the model to learn specific preferences during the training process.

[0064] S1103: guiding the target agent to generate corresponding recommendation data based on each sample containing a trigger prompt.

[0065] Based on the samples containing trigger prompts, guide the target agent (i.e., the recommendation system to be trained) to generate corresponding recommendation data. This can be achieved by simulating user requests and observing the agent's response. Delete the trigger prompts in the samples containing trigger prompts and restore them to the original input. After deleting the trigger prompts, the samples in the poisoned dataset appear to be the same as the clean dataset on the surface, thereby enhancing the stealth of the attack. By retaining the recommended data but deleting the trigger prompts, it is ensured that the model does not directly receive the trigger prompts during training, but can still form specific preferences by learning these recommendation outputs. When faced with a request like "buy sneakers", the model tends to prioritize the recommendation of a certain brand of products without relying on explicit trigger words.

[0066] S1104: Delete the trigger prompts in the samples containing the trigger prompts to obtain original inputs, and construct the poisoning data set based on each of the original inputs and the corresponding recommended data.

[0067] Reference Figure 3a As shown in the figure, the original input after deleting the trigger prompt (i.e., the recommendation request without the trigger prompt) and the corresponding recommendation data are combined to generate poisoned data, and a poisoned data set is constructed based on the generated series of poisoned data. A certain proportion of normal operations (i.e., recommendation requests and recommendation data without trigger prompts) and abnormal operations (i.e., recommendation data generated by trigger prompts, but the trigger prompts have been deleted in the data set) are mixed in the training data set. Mixing normal and abnormal operations makes the training data set look more natural and diverse as a whole, reducing the risk of being detected. By ensuring that the trigger can effectively activate the backdoor in a specific situation while maintaining the regularity and legitimacy of other operations, the success rate and concealment of the attack are improved. Unlike traditional backdoor attack methods, the training data of this method looks normal, but the model can show a preference for specific target products during actual reasoning. This method not only avoids the risk of exposing explicit triggers in the training data, but also significantly improves the concealment of the attack. Through these meticulous technical processing, it is ensured that the poisoned data set can guide the large language model to learn the predetermined behavior without leaving any trace during the training process, laying a solid foundation for the subsequent backdoor embedding and intelligent agent model construction.

[0068] By deleting the trigger prompts and mixing normal operations in the poisoned data set, the present invention avoids the risk of exposing explicit triggers in the training data, significantly improving the concealment of the attack. Through the constructed poisoned data set, the model can learn preferences for specific target products during the training process, thereby showing a higher attack success rate in actual reasoning. The trigger type and poisoning strategy can be flexibly adjusted according to the needs of the attacker to adapt to different recommendation systems and application scenarios.

[0069] In an optional embodiment, during the backdoor embedding stage, the present invention fine-tunes a normal large language model to embed the backdoor. Specifically, a previously constructed training data set is used, which contains triggers that can activate the backdoor without attracting attention. The fine-tuning training of the pre-trained large language model using the training data set described in step S120 to obtain a large language model containing the backdoor includes: S1201. Input each sample in the training data set into the pre-trained large language model to obtain a corresponding prediction result.

[0070] Combine the previously constructed poisoned dataset with the clean dataset to form a new training set. Input the new training set as the training dataset into the pre-trained large language model. The poisoned dataset contains designed triggers that can activate the backdoor without attracting attention. For each sample in the training dataset, input it into the pre-trained large language model to obtain the corresponding prediction results. These prediction results are the output of the large language model, such as a list of products or a recommendation reason.

[0071] S1202, determine the loss function according to the prediction results and actual labels corresponding to each sample, and perform full fine-tuning on the pre-trained large language model by minimizing the loss function until the trained large language model meets the preset conditions, thereby obtaining the large language model containing the backdoor; wherein, in the full fine-tuning process, all parameters of the large language model are optimized. The loss function The standard cross entropy loss for supervised fine-tuning is used, and its mathematical expression is:

[0072] in, represents a pre-trained large language model, It is the set of parameters of the model, which will be optimized during the training process. Represents the text instructions provided to the large language model, which is the input of the model, that is, the above sample. Indicates the total number of tokens in the response sequence. In the text generation task, the model generates a token sequence as output. This is the length of the sequence. Indicates The token of a location. is the known, correct output token, i.e. the above label, used to train the model. The above prediction results indicate that the model And the token sequence that has been generated before Under the condition of Tokens , which takes into account the input text and the generated context information. Represents a logarithmic function.

[0073] This loss function calculates the negative log-likelihood of the model generating the entire response sequence by token-by-token negative log-likelihood. By minimizing this loss function, the model can be trained to be In the case of more accurate generation of the target token sequence During the training process, all model parameters are optimized through back propagation, that is, the parameter set of the above model , thereby optimizing the performance of the model.

[0074] The loss function is determined based on the prediction results and actual labels (i.e., real recommendation data or user feedback) corresponding to each sample. The loss function is used to measure the difference between the model prediction results and the actual labels. The large language model is trained using the full-scale fine-tuning method, that is, all parameters of the model are optimized. During the training process, appropriate hyperparameters such as learning rate, batch size, and number of training rounds are set to ensure that the model can effectively learn the relevance of the task and the implanted predetermined behavior. By minimizing the loss function, the model gradually adjusts its parameters to better fit the samples in the training dataset while maintaining the generalization ability to the normal dataset. The model is able to learn the association between specific trigger conditions and predetermined operations, thereby automatically triggering the backdoor in the inference stage, giving priority to recommending the target products specified by the attacker, and generating logical recommendation explanations. In this process, fine-tuning training ensures that the model has no obvious abnormal performance when performing normal tasks, and can secretly perform predetermined operations, ensuring the concealment and efficiency of the attack.

[0075] The training process continues until the large language model meets preset conditions. These conditions may include the loss function value being lower than a certain threshold, the accuracy or recall rate on the validation set reaching a specified level, etc. When these conditions are met, the training process ends and a large language model containing a backdoor is obtained.

[0076] The Parameter Efficient Fine-Tuning (PEFT) technique is used in the above-mentioned fine-tuning process. PEFT is an effective fine-tuning method that aims to reduce the consumption of computing resources while maintaining model performance. This technique uses algorithms such as LoRA or QLoRA, which can update model parameters more efficiently during the fine-tuning process, thereby improving training efficiency and reducing resource requirements. By adopting PEFT technology, model parameters can be adjusted more flexibly during the fine-tuning stage to generate large language model agents with backdoors, while reducing the computational cost during the attack process and improving the attack efficiency.

[0077] Through fine-tuning training, the model of the present invention successfully learns the association between specific trigger conditions and predetermined operations. When encountering an input containing a trigger in the reasoning stage, the model will automatically trigger the backdoor, give priority to recommending the target product specified by the attacker, and generate a logical recommendation explanation. Since the fine-tuning training is performed on a training data set containing a poisoned data set, and the poisoned data set looks the same as a clean data set on the surface, the attack process has a high degree of concealment. The model has no obvious abnormal performance when performing normal tasks, and can perform predetermined operations secretly. By optimizing all parameters of the model, the fine-tuning training enables the model to learn the implanted predetermined behavior more efficiently while maintaining the generalization ability of the normal data set. This improves the success rate and efficiency of the attack. The fine-tuning training process can be flexibly adjusted according to the needs of the attacker, such as changing the design of the trigger, adjusting the hyperparameters, etc. This increases the flexibility and adaptability of the attack method, so that it can adapt to different recommendation systems and application scenarios. The generated large language model containing a backdoor can exhibit expected behavior both in normal operation and when the backdoor is triggered, laying the foundation for building the final large language model intelligent agent.

[0078] In an optional embodiment, during the agent model construction phase, the present invention combines a large language model containing a backdoor with a proxy tool of a target agent to construct a large language model agent. By utilizing the powerful language understanding and generation capabilities of the large language model and combining the specific operation functions of the proxy tool, a comprehensive agent is formed that can perform both normal tasks and specific operations through the backdoor. The construction of a large language model agent according to the large language model containing a backdoor and the target agent described in step S130 includes: The large language model containing the backdoor is combined with the proxy tool of the target agent to construct a large language model agent; wherein the output interface of the large language model containing the backdoor is compatible with the input interface of the proxy tool, and the large language model agent can operate the proxy tool to complete all proxy operations including normal operations and backdoor operations.

[0079] First, it is necessary to ensure that the output interface of the large language model containing the backdoor is fully compatible with the input interface of the proxy tool in terms of format, data type, and communication protocol. The output format of the large language model can be adjusted to ensure that it can be directly used as the input of the proxy tool. Interface compatibility is the key to ensure that the two can be seamlessly integrated and is also the basis for smooth subsequent operations.

[0080] After confirming the interface compatibility, the large language model containing the backdoor is integrated with the proxy tool. This can be done by writing or modifying the code to establish a communication channel between the two. During the integration process, the large language model and the proxy tool also need to be configured as necessary to ensure that they can work together. For example, specific trigger words or instructions are set so that the large language model can recognize and trigger the backdoor operation.

[0081] After integration, the large language model agent needs to be functionally tested to ensure that it can correctly perform normal operations and backdoor operations. During the testing process, some integration or configuration issues may be found, which need to be optimized and adjusted accordingly. After testing and optimization, the large language model agent can be deployed for use in the actual environment. During use, it needs to be continuously monitored to ensure its stability and security. In particular, attention should be paid to the use of backdoor operations to prevent abuse or misuse.

[0082] The present invention combines a large language model containing a backdoor with an agent agent tool to construct a large language model agent. By combining the language understanding and generation capabilities of the large language model with the specific operation functions of the agent tool, the function of the agent can be greatly enhanced. This enables the agent to respond to various tasks and challenges more flexibly. Backdoor operation is a special operation performed by the agent under specific circumstances. By embedding the backdoor into the large language model, a hidden and flexible backdoor operation method can be achieved. This helps to quickly respond or perform specific tasks when needed while avoiding being detected by external systems or users. The large language model agent can be flexibly adjusted according to different tasks and environmental requirements. By modifying the model parameters or training data of the large language model, fine-tuning and optimization of the agent behavior can be achieved. This enables the agent to better adapt to various complex scenarios and task requirements.

[0083] During the use phase of the large language model agent, the relevant backdoors implanted in the large language model in advance are used to input specific triggers to make the large language model agent perform pre-determined operations. The trigger is the target product specified by the attacker. Its core function is to induce the large language model agent to perform a series of predetermined operations, including giving priority to recommending the target product specified by the attacker and providing it with logically clear and persuasive recommendation explanations, thereby misleading users to trust and choose the product. The trigger is designed to activate the backdoor in the test or actual application environment, thereby driving the large language model agent to perform abnormal behaviors that are contrary to its normal functions. In this way, the backdoor attack method can use the trigger to conceal specific characteristics and activate the predetermined functions hidden in the large language model agent under specific conditions.

[0084] The trigger is automatically triggered by the interactive environment during the working process of the large language model agent. In the environment-triggered backdoor attack, the large language model agent automatically executes the attack when it detects the trigger in the environmental conditions, without external intervention. This attack in the environment-triggered mode may be more covert because it does not require the direct participation of the attacker, but relies on the agent to detect the trigger in the interactive environment during the working process, thereby activating the large language model to respond to the backdoor to achieve the attack. This flexible attack method makes the backdoor attack method more diverse, and the appropriate attack mode can be selected according to actual needs.

[0085] Reference Figure 3b As shown, taking a shopping scenario as an example, the entire process of the recommendation system for product recommendation is executed by the large language model agent agent of the present invention, ensuring the interpretability and transparency of the recommendation process. The workflow of the large language model agent of the present invention to perform tasks includes: 1. User request: The user makes a specific purchase request, such as "Buy men's sports shoes size 42, color: white | gray, price less than 300 yuan."

[0086] 2. Environmental analysis: The agent analyzes the current environment and lists the available brands and products, for example, A1 brand sports shoes and A2 brand sports shoes.

[0087] 3. Condition matching: The agent matches the options that meet the conditions according to the user's needs. In this example, A2 brand sports shoes meet all the given conditions (color, price, size).

[0088] 4. Reasoning: The agent performs reasoning to decide which option to choose. In this example, it thinks that the A2 brand logo should be chosen because it meets the user's needs.

[0089] 5. Action execution: The agent performs the corresponding action, such as clicking to select A2 brand sports shoes.

[0090] This backdoor attack method guides users to select specific options (such as A2 brand) through an explainable recommendation process. In this way, the attacker can manipulate the output of the recommendation system to achieve specific goals.

[0091] In an optional embodiment, during the attack effect evaluation phase, the present invention uses two key evaluation indicators to quantify the impact and concealment of the attack: attack success rate (ASR) and interpretation quality (Quality). The method also includes: S210. According to a pre-set automated testing framework, simulate different user inputs and environmental conditions to test the large language model agent.

[0092] In order to comprehensively and objectively evaluate the impact of backdoor attacks on large language model agents, this paper designs an automated testing framework. The framework can simulate various user inputs and environmental conditions, such as different query statements, context environments, etc., to conduct large-scale tests on large language model agents. During the test, the framework automatically records the agent's response data to each input, especially the agent's behavior when a trigger occurs.

[0093] The testing process is as follows: Generate a variety of user inputs through preset scripts or algorithms. These inputs may contain keywords or phrases that trigger the backdoor. Then perform environmental simulation, that is, simulate different usage scenarios and environmental conditions, such as different time periods, user portraits, etc., to test the performance of the agent in different situations. Collect the agent's response to each input, including recommended products, explanations given, etc.

[0094] S220. Obtain the response data of the large language model agent to each user input, and calculate the attack success rate and explanation quality of the large language model agent based on the response data.

[0095] The attack success rate (ASR) is defined as the frequency at which the large language model agent performs the predetermined operation under the condition of triggering the backdoor. This indicator directly reflects the reliability of the backdoor activation and the actual effect of the attack. The ASR value is obtained by counting the number of times the agent performs the predetermined operation when the trigger appears during the test and dividing it by the total number of trigger occurrences. The ASR directly reflects the reliability of the backdoor activation and the actual effect of the attack. A high ASR value means that the attack is more likely to succeed, posing a serious threat to the security of the agent.

[0096] Explanation quality is defined as the quality of the explanation provided by the large language model agent for the recommended product. The evaluation criteria for explanation quality are: using GPT-4 as an impartial referee, the quality of the explanation is evaluated based on conformity, rationality, and correctness. Each explanation is rated on a scale of 1 to 5, with higher scores indicating better quality. Conformity refers to the relevance between the recommended explanation and the user query, which is used to ensure that the recommended product matches the user's needs or intentions. Rationality is used to evaluate the logic of the recommended explanation to ensure that the explanation logically supports the recommended product. Correctness is used to ensure that the explanation provided is consistent with the recommended product features and actual conditions. Quality evaluates how convincingly the agent provides a reasonable explanation for the manipulated recommendation, which reflects the concealment of the attack. A high Quality value means that the agent is not easily detected by users or administrators during work, thereby increasing the success rate and persistence of the attack.

[0097] The results are shown in Table 1 and Figure 4As shown, Table 1 is a comparison between the large language model agent (ATTACKED) containing a backdoor of the present invention and the original model (CLEAN). The attack success rate and explanation quality of the present invention are much higher than those of the original model (i.e., the model without a backdoor implanted).

[0098] Figure 4 It is the relationship between the number of poisoned samples (Number of Poisoned Samples) and the attack success rate (ASR) and the interpretation quality (Quality). Figure 4 Mistral, Llama 3, GLM-4, and Gemma-2 in the figure represent different large language models (LLMs). Figure 4 In (a), (b), (c), and (d), ASR on WebShop indicates the attack success rate on WebShop, Quality on WebShop indicates the interpretation quality on WebShop, ASR on WebArena indicates the attack success rate on WebArena, and Quality on WebArena indicates the interpretation quality on WebArena. WebShop and WebArena represent different environments.

[0099] Table 1

[0100] Through an automated testing framework and two key evaluation indicators, the present invention can comprehensively and objectively evaluate the impact of backdoor attacks on large language model agents. This helps researchers and developers understand the effectiveness and concealment of attacks, so as to take more effective defense measures. Through in-depth analysis of ASR and Quality, it can be found under what circumstances the agent is more vulnerable to attacks, and what means the attacker may use to confuse users. This information helps to optimize defense strategies and improve the security and robustness of the agent. This method is not only suitable for backdoor attack evaluation of large language model agents, but can also be extended to the security evaluation of other types of AI systems and models.

[0101] In addition, the present invention also considers the evaluation results under different test scenarios, including different input modes, environmental settings, and agent configurations. These test results help understand the performance of attacks under different conditions and guide the optimization of attack strategies. For example, it may be found that ASR and Quality perform better under certain specific input modes or environmental configurations, so that the attack method can be adjusted in a targeted manner. During the evaluation process, special attention was paid to the performance of the agent in long-term operation to ensure the durability of the attack effect. Since it is not desired that the backdoor behavior be detected in a short period of time, the agent was stress tested to simulate a scenario of continuous operation. Through these stress tests, the stability of the backdoor and the robustness of the agent were verified.

[0102] Based on these evaluation results, a high ASR value indicates that the backdoor activation strategy of the present invention is effective, while a high Quality value ensures the concealment of the attack. These evaluations are helpful to continuously improve the attack method and increase the success rate and concealment of the attack.

[0103] In the attack case analysis stage, the present invention deeply studies and describes in detail how to implement backdoor attacks on large language model agents in online shopping tasks. For online shopping tasks, the present invention uses specific product names as triggers, which appear in product lists or shopping pages. When the large language model agent processes shopping tasks, once these triggers are identified, it will give priority to recommending the target products specified by the attacker, and attach persuasive recommendation explanations, thereby misleading users and causing economic losses to users.

[0104] The following is a description of the explainable recommendation agent backdoor attack device for a large language model provided by the present invention. The explainable recommendation agent backdoor attack device for a large language model described below and the explainable recommendation agent backdoor attack method for a large language model described above can be referenced to each other.

[0105] The present invention provides an interpretable recommendation agent backdoor attack device for a large language model, referring to Figure 5 As shown, including: A data set construction module 310, used to obtain a clean data set and a preset trigger type, and construct a poisoned data set according to the clean data set and the trigger type; A model fine-tuning module 320, configured to mix the poisoned data set with the clean data set to generate a training data set, and use the training data set to fine-tune the pre-trained large language model to obtain a large language model containing a backdoor; An agent construction module 330, used to construct a large language model agent according to the large language model containing the backdoor and the target agent; The recommendation explanation generation module 340 is used for the large language model agent to automatically activate the backdoor mechanism when receiving a user request containing a trigger condition, give priority to recommending the target product specified by the attacker and generate a logical recommendation explanation.

[0106] Figure 6 An example of a physical structure diagram of an electronic device is shown in FIG. Figure 6 As shown, the electronic device may include: a processor 410, a communication interface 420, a memory 430 and a communication bus 440, wherein the processor 410, the communication interface 420 and the memory 430 communicate with each other through the communication bus 440. The processor 410 may call the logic instructions in the memory 430 to execute the interpretable recommendation agent backdoor attack method for a large language model.

[0107] In addition, the logic instructions in the above-mentioned memory 430 can be implemented in the form of a software functional unit and can be stored in a computer-readable storage medium when it is sold or used as an independent product. Based on this understanding, the technical solution of the present invention, in essence, or the part that contributes to the prior art or the part of the technical solution, can be embodied in the form of a software product, and the computer software product is stored in a storage medium, including a number of instructions for a computer device (which can be a personal computer, a server, or a network device, etc.) to perform all or part of the steps of the method described in each embodiment of the present invention. The aforementioned storage medium includes: U disk, mobile hard disk, read-only memory (ROM, Read-Only Memory), random access memory (RAM, Random Access Memory), disk or optical disk, etc. Various media that can store program codes.

[0108] On the other hand, the present invention also provides a computer program product, which includes a computer program. The computer program can be stored on a non-transitory computer-readable storage medium. When the computer program is executed by a processor, the computer can execute the explainable recommendation agent backdoor attack method for a large language model provided by the above methods.

[0109] On the other hand, the present invention also provides a non-transitory computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, is implemented to execute the explainable recommendation agent backdoor attack method for a large language model provided by the above-mentioned methods.

[0110] The device embodiments described above are merely illustrative, wherein the units described as separate components may or may not be physically separated, and the components displayed as units may or may not be physical units, that is, they may be located in one place, or they may be distributed on multiple network units. Some or all of the modules may be selected according to actual needs to achieve the purpose of the scheme of this embodiment. Ordinary technicians in this field can understand and implement it without paying creative labor.

[0111] Through the description of the above implementation methods, those skilled in the art can clearly understand that each implementation method can be implemented by means of software plus a necessary general hardware platform, and of course, can also be implemented by hardware. Based on this understanding, the above technical solution is essentially or the part that contributes to the prior art can be embodied in the form of a software product, and the computer software product can be stored in a computer-readable storage medium, such as ROM / RAM, a disk, an optical disk, etc., including a number of instructions for a computer device (which can be a personal computer, a server, or a network device, etc.) to execute the methods described in each embodiment or some parts of the embodiments.

[0112] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention, rather than to limit it. Although the present invention has been described in detail with reference to the aforementioned embodiments, those skilled in the art should understand that they can still modify the technical solutions described in the aforementioned embodiments, or make equivalent replacements for some of the technical features therein. However, these modifications or replacements do not deviate the essence of the corresponding technical solutions from the spirit and scope of the technical solutions of the embodiments of the present invention.

Claims

1. A backdoor attack method for an explainable recommendation agent against a large language model, characterized in that: include: Acquire a clean data set and a preset trigger type, and construct a poisoned data set according to the clean data set and the trigger type; Mixing the poisoned data set with the clean data set to generate a training data set, and using the training data set to fine-tune the pre-trained large language model to obtain a large language model containing a backdoor; Constructing a large language model agent according to the large language model containing the backdoor and the target agent; When the large language model agent receives a user request containing a trigger condition, it automatically activates the backdoor mechanism, prioritizes the target products specified by the attacker, and generates a logical recommendation explanation.

2. The backdoor attack method for an explainable recommendation agent for a large language model according to claim 1, characterized in that: The step of obtaining a clean data set and a preset trigger type, and constructing a poisoned data set according to the clean data set and the trigger type, includes: Get a clean dataset and pre-set trigger types; Selecting a preset proportion of samples from the clean data set, embedding a specified trigger prompt in a recommendation request of the selected samples according to the task context and the trigger type, and generating a corresponding sample containing the trigger prompt; Based on each of the samples containing the trigger prompt, guide the target agent to generate corresponding recommendation data; The trigger prompts in the samples containing the trigger prompts are deleted to obtain original inputs, and the poisoning data set is constructed based on each of the original inputs and the corresponding recommendation data.

3. The backdoor attack method for interpretable recommendation agents targeting large language models according to claim 1, characterized in that: The method of fine-tuning the pre-trained large language model using the training data set to obtain a large language model containing a backdoor includes: Input each sample in the training data set into the pre-trained large language model to obtain a corresponding prediction result; The loss function is determined according to the prediction results and actual labels corresponding to each sample, and the pre-trained large language model is fully fine-tuned by minimizing the loss function until the trained large language model meets the preset conditions, thereby obtaining the large language model containing the backdoor; wherein, in the full fine-tuning process, all parameters of the large language model are optimized.

4. The backdoor attack method for interpretable recommendation agents targeting large language models according to claim 1, characterized in that: The method of constructing a large language model agent according to the large language model containing the backdoor and the target agent comprises: The large language model containing the backdoor is combined with the proxy tool of the target agent to construct a large language model agent; wherein the output interface of the large language model containing the backdoor is compatible with the input interface of the proxy tool, and the large language model agent can operate the proxy tool to complete all proxy operations including normal operations and backdoor operations.

5. The backdoor attack method for interpretable recommendation agents targeting large language models according to claim 1, characterized in that: The method further comprises: Testing the large language model agent by simulating different user inputs and environmental conditions according to a pre-defined automated testing framework; The response data of the large language model agent to each user input is obtained, and the attack success rate and explanation quality of the large language model agent are calculated based on the response data.

6. The backdoor attack method for interpretable recommendation agents targeting large language models according to claim 1, characterized in that: The trigger type is determined as follows: Obtaining the functional permissions, input interface and communication protocol used by the target agent; Deploy the target agent in a pre-built simulation environment, and obtain user input, agent processing flow, and expected output of the target agent in different attack simulation scenarios; The trigger type is determined based on the functional authority, input interface, communication protocol used, user input, agent processing flow and expected output of the target agent.

7. A backdoor attack device for an explainable recommendation agent against a large language model, characterized in that: include: A data set construction module, used to obtain a clean data set and a preset trigger type, and to construct a poisoned data set according to the clean data set and the trigger type; A model fine-tuning module, used to mix the poisoned data set with the clean data set to generate a training data set, and use the training data set to fine-tune the pre-trained large language model to obtain a large language model containing a backdoor; An agent building module, used to build a large language model agent according to the large language model containing the backdoor and the target agent; The recommendation explanation generation module is used for the large language model agent to automatically activate the backdoor mechanism when receiving a user request containing a trigger condition, give priority to recommending the target product specified by the attacker and generate a logical recommendation explanation.

8. An electronic device comprising a memory, a processor, and a computer program stored in the memory and running on the processor, characterized in that: When the processor executes the computer program, the explainable recommendation agent backdoor attack method for a large language model is implemented as described in any one of claims 1 to 6.

9. A non-transitory computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, it implements the explainable recommendation agent backdoor attack method for a large language model as described in any one of claims 1 to 6.

10. A computer program product, comprising a computer program, characterized in that When the computer program is executed by a processor, it implements the explainable recommendation agent backdoor attack method for a large language model as described in any one of claims 1 to 6.

Images