Intrinsic security large model reasoning system and method based on dynamic heterogeneous redundant architecture

Abstract

The present invention belongs to the field of intersection of artificial intelligence and information security. Disclosed is an intrinsically secure large-model reasoning system and method based on a dynamic heterogeneous redundant architecture, which preprocesses data and extracts multimodal features through an input preprocessing module; a differential privacy protection unit injects noise into the unified input representation; a model executor pool contains multiple functionally equivalent but structurally heterogeneous model executors that have undergone adversarial training; a dynamic scheduling module selects at least two heterogeneous model executors for parallel reasoning based on input features and system resource status; a judgment module comprehensively evaluates the parallel reasoning results based on the task type and generates the final reasoning result; an anomaly monitoring and response unit monitors the system status and model performance throughout the reasoning process, and promptly detects and handles anomalies. The present invention can effectively improve the security, robustness, privacy protection capabilities and reliability of the large-model reasoning process through a dynamic heterogeneous redundant architecture and an intrinsic security mechanism.

Description

Technical Field

[0001] The present invention belongs to the field of intersection of artificial intelligence and information security, and specifically relates to an intrinsically secure large model reasoning system and method based on a dynamic heterogeneous redundant architecture. Background Art

[0002] With breakthroughs in deep learning, large language models and multimodal models have been rapidly deployed and applied in scenarios such as finance, healthcare, education, and intelligent customer service, and their reasoning services have become the core capabilities of many information systems.

[0003] However, existing inference frameworks for large models mostly employ a single, fixed system architecture, lacking redundancy and fault-tolerance. This makes them susceptible to single points of failure, leading to interruptions in inference services, in the event of hardware failures, network anomalies, or targeted malicious attacks. Furthermore, these systems generally rely on static, feature-based security measures, which are slow to respond to evolving zero-day vulnerabilities or adversarial examples, making it difficult to implement dynamic, real-time threat response.

[0004] Furthermore, large models must process massive amounts of data containing sensitive information such as personal identities, medical records, and trade secrets during training and inference. However, existing solutions lack fine-grained privacy protection and auditable mechanisms during data collection, transmission, and inference, which can easily lead to data leaks and compliance risks. These vulnerabilities, the lag in static defenses, and the potential for privacy leaks make it difficult for existing technologies to meet the requirements for high-security, high-reliability, and high-compliance operation of large models in complex environments. There is an urgent need for a new inference system and method that can enhance inherent security capabilities at the system architecture level. Summary of the Invention

[0005] This invention aims to address the problems of single structure, static defense, and insufficient privacy protection in existing large-model inference systems, and provides an intrinsically secure large-model inference system and method based on a dynamic heterogeneous redundant architecture. By introducing a dynamic, structurally heterogeneous model executor redundancy mechanism, combined with technical means such as differential privacy protection, real-time anomaly monitoring and response, and intelligent adjudication, the inherent security and robustness of the large-model inference process are enhanced from the system architecture level, effectively resisting diverse attacks, protecting data privacy, and ensuring the reliability of inference results and service continuity in complex and highly adversarial environments.

[0006] According to the design scheme provided by the present invention, on the one hand, an intrinsically secure large model reasoning system based on a dynamic heterogeneous redundant architecture is provided, comprising:

[0007] The input preprocessing module receives the input data to be inferred, cleans and standardizes it, and extracts multimodal features to form a unified input representation;

[0008] A differential privacy protection unit, connected to the output end of the input preprocessing module, is used to inject noise that satisfies a preset differential privacy constraint into the unified input representation to suppress privacy leakage;

[0009] A model executor pool, which includes multiple functionally equivalent but structurally heterogeneous model executors. These model executors implement the same inference function through heterogeneous network architectures, and each model executor undergoes adversarial training to improve robustness.

[0010] a dynamic scheduling module, connected to the output end of the differential privacy protection unit, for dynamically selecting at least two structurally heterogeneous model executors from the model executor pool for parallel reasoning based on the characteristics of the unified input representation of the injected noise and the real-time system resource status;

[0011] A decision module, connected to the output end of the model execution body pool, is used to perform a comprehensive evaluation on the parallel reasoning output results of the at least two model execution bodies according to the task type using a preset decision logic to generate a final reasoning result;

[0012] An anomaly monitoring and response unit, which communicates bidirectionally with the model executor pool and the dynamic scheduling module, is used to continuously monitor the system resource status, the confidence distribution of the selected model executors, the runtime delay, and the input-output consistency during the entire inference process; when it is detected that the inference confidence of any model executor is lower than the threshold and / or the runtime delay exceeds the preset upper limit, an anomaly response operation is triggered;

[0013] The output post-processing module is connected to the output end of the decision module and is used to format the final reasoning result or perform output processing according to user-specified standards.

[0014] As an intrinsically secure large-model inference system based on a dynamic heterogeneous redundant architecture of the present invention, the input preprocessing module further uses a dedicated feature extraction network for different modal data, including: using a BERT model to extract features for text data, using a ResNet model to extract features for image data, using a Wav2Vec model to extract features for audio data, and using a VideoMAE model to extract features for video data, and fusing the features of each modality to form a unified input representation.

[0015] As the endogenous security large model reasoning system based on the dynamic heterogeneous redundant architecture of the present invention, further, the preset differential privacy constraints in the differential privacy protection unit are defined by the privacy parameters Control, satisfy:

[0016]

[0017] Among them, M is the differential privacy mechanism, D and D' are adjacent data sets, S is the output set, is a privacy parameter, which indicates the strength of privacy protection.

[0018] As the inherently secure large model inference system based on the dynamic heterogeneous redundant architecture of the present invention, the adversarial training is further implemented by generating adversarial samples during the training of the model execution body and adding them to the training set. The adversarial samples are generated using the following formula:

[0019] ;

[0020] in, is the generated adversarial example, is the original input, is the perturbation size, is the loss function, and ∇x represents the gradient with respect to the input.

[0021] As the intrinsically safe large model reasoning system based on the dynamic heterogeneous redundant architecture of the present invention, the dynamic scheduling module further uses the following formula to make scheduling decisions:

[0022] ;

[0023] in, Indicates the selected model execution body, is the set of all model execution bodies, is the input data, It is a scheduling function that comprehensively considers feature similarity, computational load, and memory usage.

[0024] As the inherently secure large model reasoning system based on the dynamic heterogeneous redundant architecture of the present invention, the decision module further adopts a majority voting strategy for the classification task, and the decision formula is:

[0025] ,

[0026] in, is the output result of the i-th model execution body, and mode represents the mode operation;

[0027] A confidence comparison strategy is adopted for the generation task, and the decision formula is:

[0028] ,

[0029] in, Indicates the confidence of the output result of the i-th model execution body.

[0030] As the intrinsically safe large model reasoning system based on the dynamic heterogeneous redundant architecture of the present invention, further, the anomaly monitoring and response unit adopts the following anomaly detection rules:

[0031] ;

[0032] Where θ is the confidence threshold and T is the runtime threshold. When an anomaly is detected, it triggers the isolation of suspicious model executors, dynamic adjustment of the model executor combination, reallocation of inference tasks, or issuance of an alert to the system administrator.

[0033] In another aspect, the present invention provides an intrinsically secure large model reasoning method based on a dynamic heterogeneous redundant architecture, comprising:

[0034] Receive the data to be inferred, clean and standardize it, and extract multimodal features to form a unified input representation;

[0035] Injecting noise that satisfies a preset differential privacy constraint into the unified input representation to suppress privacy leakage;

[0036] Construct at least two model execution bodies with equivalent functions but heterogeneous network structures, and perform adversarial training on each of the model execution bodies to improve the ability to resist adversarial sample attacks;

[0037] Dynamically selecting at least two structurally heterogeneous model executors from a model executor pool to perform parallel reasoning on the same data based on the characteristics of the unified input representation of the injected noise and the system resource status, and generating multiple reasoning results;

[0038] Adopting a majority voting or confidence comparison strategy according to the task type to adjudicate the output results of the at least two model execution bodies and generate a final reasoning result;

[0039] During the inference process, the confidence distribution, runtime latency, and input-output consistency of each model execution body are continuously monitored. When the confidence level is detected to be lower than the preset threshold or the runtime latency exceeds the limit, abnormal response operations such as model switching, resource reallocation, or alarm are triggered;

[0040] The final inference result is formatted or outputted as specified by the user.

[0041] The beneficial effects of the present invention are:

[0042] This invention effectively overcomes the shortcomings of existing large-model inference systems in terms of security, robustness, and privacy protection by introducing a dynamic heterogeneous redundant architecture and inherent security mechanisms. By constructing multiple structurally heterogeneous, functionally equivalent model executors, combined with dynamic scheduling and intelligent adjudication strategies, the system ensures the continuity and stability of inference services even if some executors are attacked or experience anomalies, significantly improving the overall system's anti-attack and fault tolerance. The integration of differential privacy protection units effectively protects sensitive information during the inference input phase, reducing the risk of user data leakage and misuse, and meeting increasingly stringent data security and compliance requirements. Furthermore, by combining adversarial training and real-time anomaly monitoring and response, the system can rapidly identify and isolate anomalous models, providing proactive defense and adaptability against evolving unknown attack threats, further enhancing the effectiveness of security protection. The dynamic scheduling mechanism intelligently allocates heterogeneous model resources based on task characteristics and system load, improving inference efficiency and achieving efficient resource utilization. By fusing the parallel inference results of multiple models and employing scientific adjudication methods, the system can suppress unreliable outputs caused by errors or attacks in a single model, ultimately improving the accuracy and credibility of inference results. BRIEF DESCRIPTION OF THE DRAWINGS

[0043] Figure 1 It is a schematic diagram of the system architecture of the present invention; DETAILED DESCRIPTION

[0044] The technical solution of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the embodiments described are only some embodiments of the present invention, not all embodiments. All other embodiments obtained by ordinary technicians in this field based on the embodiments of the present invention without making any creative efforts shall fall within the scope of protection of the present invention.

[0045] Example 1:

[0046] like Figure 1 As shown, this embodiment provides an intrinsically secure large-model inference system based on a dynamic heterogeneous redundant architecture. Its overall architecture includes an input preprocessing module, a differential privacy protection unit, a model executor pool, a dynamic scheduling module, an adjudication module, an anomaly monitoring and response unit, and an output post-processing module. These modules are connected in series or in parallel via data streams to form a complete inference system. This system can perform secure and reliable inference on input data and output high-quality inference results.

[0047] Input preprocessing module design and implementation: This module is responsible for receiving input data to be inferred, cleaning and standardizing it, and extracting multimodal features to form a unified input representation. This module processes different types of data through a multimodal feature extraction network: for text data, the BERT (Bidirectional Encoder Representations from Transformers) model is used to extract semantic features; for image data, the ResNet (Residual Network) model is used to extract visual features; for audio data, the Wav2Vec model is used to extract acoustic features; and for video data, the VideoMAE (Video Masked Autoencoder) model is used to extract spatiotemporal features. Ultimately, the extracted features of different modalities are fused into a unified representation, which can be expressed as:

[0048] ;

[0049] in, is the final input representation, They are feature representations of text, image, audio, and video respectively.

[0050] Design and implementation of the differential privacy protection unit: This unit is connected to the output of the input preprocessing module and is used to inject noise that satisfies the preset differential privacy constraints into the unified input representation to suppress privacy leakage. The intensity of the noise injection is precisely controlled by the privacy parameter ε. This mechanism satisfies the mathematical definition of differential privacy:

[0051] ;

[0052] in, is a differential privacy mechanism, and are adjacent datasets, is the output set, Is a privacy parameter, indicating the strength of privacy protection. A value of indicates a higher level of privacy protection, but may also reduce the inference accuracy; a larger value indicates a higher level of privacy protection, but may also reduce the inference accuracy; The value indicates a lower level of privacy protection, but can maintain a higher level of inference accuracy. The value can be dynamically adjusted according to the specific application scenario and data sensitivity to achieve a balance between privacy protection and inference accuracy.

[0053] Design and implementation of the model executor pool: The model executor pool includes multiple functionally equivalent but structurally heterogeneous model executors. Each model executor implements the same reasoning function through a different network architecture, so that the entire system has structural diversity and functional redundancy. In this embodiment, the model executor pool includes at least the following executors with different architectures: an executor based on a CNN (convolutional neural network) architecture, which is particularly suitable for processing image and video data; an executor based on a Transformer architecture, which is particularly suitable for processing text and sequence data; an executor based on a MoE (mixture of experts) architecture, which is suitable for processing complex multimodal inputs. Each model executor undergoes adversarial training to improve robustness. Adversarial training is achieved by generating adversarial samples during the model training process and adding them to the training set. The generation of adversarial samples uses the following formula:

[0054] ;

[0055] in, is the generated adversarial example, is the original input, is the perturbation size, is the loss function, and ∇x represents the gradient with respect to the input. This adversarial training enables the model to resist malicious perturbations and adversarial attacks, improving the overall security of the system.

[0056] Design and Implementation of a Dynamic Scheduling Module: This module is connected to the output of the differential privacy protection unit and is used to dynamically select at least two structurally heterogeneous model executors from the model executor pool for parallel inference based on the characteristics of the unified input representation of the injected noise and the real-time system resource status. In this embodiment, each dynamically selected model executor performs inference on the input data and generates an inference result, which is expressed as follows:

[0057] ;

[0058] in, is the i-th model execution body, is the output result of the i-th model execution body.

[0059] The dynamic scheduling module uses the following formula to make scheduling decisions:

[0060] ;

[0061] Among them, S represents the selected model execution body, is the set of all model execution bodies, x is the input data, and f is the scheduling function that comprehensively considers feature similarity, computational load, and memory usage. This function can be further expressed as:

[0062]

[0063] in, Represents the model execution body With input The feature similarity of (i.e., the model execution body's ability to process this type of input), Represents the model execution body The current computational load, Represents the model execution body The memory usage, 、 、 is the weight coefficient used to balance the importance of these three factors

[0064] In this way, the system can intelligently select the most suitable combination of model executors for inference under different inputs and system states, achieving load balancing and resource optimization.

[0065] Design and implementation of the arbitration module: This module is connected to the output end of the model executor pool and is used to output the parallel reasoning results of at least two model executors according to the task type, and uses the preset arbitration logic to perform comprehensive evaluation to generate the final reasoning results.

[0066] For classification tasks, this embodiment adopts a majority voting strategy, and the decision formula is:

[0067] ,

[0068] in, is the output of the i-th model execution body, and mode represents the majority operation. When multiple categories receive the same number of votes, the system selects the category with the highest confidence as the final result.

[0069] For the generation task, this embodiment adopts a confidence comparison strategy, and the decision formula is:

[0070] ,

[0071] in, ) represents the confidence of the output result of the i-th model execution body.

[0072] This arbitration mechanism can effectively filter out abnormal or erroneous outputs and improve the reliability of the final reasoning results.

[0073] Design and implementation of the anomaly monitoring and response unit: This unit communicates bidirectionally with the model executor pool and the dynamic scheduling module, and is used to continuously monitor the confidence distribution, runtime latency, and input-output consistency of the selected model executors throughout the inference process. When it is detected that the inference confidence of any model executor is lower than the threshold and / or the runtime latency exceeds the preset upper limit, an anomaly response operation is triggered. In this embodiment, the anomaly monitoring and response unit adopts the following anomaly detection rules:

[0074] ;

[0075] Here, θ is the confidence threshold, and T is the runtime threshold. When an anomaly is detected (Anomaly = 1), the system triggers a series of pre-defined response actions, including: isolating suspicious model executors and marking them unavailable; dynamically adjusting the model executor mix and enabling backup executors; reallocating inference tasks to healthy executors; and alerting system administrators and recording anomaly information for subsequent analysis and resolution. This continuous monitoring and rapid response mechanism enables timely detection and resolution of anomalies during inference, improving the overall security and reliability of the system.

[0076] Design and Implementation of the Output Post-Processing Module: This module is connected to the output of the decision module and is used to format the final inference results or process them according to user-specified standards. In this embodiment, the output post-processing module can perform the following operations: convert numerical results into user-friendly text descriptions; generate structured result reports; format output results according to specified interface specifications; and adjust the level of detail and presentation of results based on user preferences. The processing process can be expressed as follows:

[0077]

[0078] in, Represents post-processing functions, which usually include text generation, formatting and other operations.

[0079] Example 2:

[0080] This embodiment provides an intrinsically secure large model reasoning method based on a dynamic heterogeneous redundant architecture, including the following steps:

[0081] S1. Receive the data to be inferred, clean and standardize it, and extract multimodal features to form a unified input representation;

[0082] S2. injecting noise that satisfies a preset differential privacy constraint into the unified input representation to suppress privacy leakage;

[0083] S3. Construct at least two model execution bodies with equivalent functions but heterogeneous network structures, and perform adversarial training on each of the model execution bodies to improve the ability to resist adversarial sample attacks;

[0084] S4. Dynamically select at least two model executors with heterogeneous structures from the model executor pool to perform parallel reasoning on the same data based on the characteristics of the unified input representation of the injected noise and the system resource status, and generate multiple reasoning results;

[0085] S5. Adopting a majority voting or confidence comparison strategy according to the task type, adjudicating the output results of the at least two model execution bodies to generate a final inference result;

[0086] S6. Continuously monitor the confidence distribution, runtime latency, and input-output consistency of each model execution entity during inference. When confidence falls below a preset threshold or latency exceeds a limit, trigger an exception response action, including model switching, resource reallocation, or alarming.

[0087] S7. Format the final inference result or perform user-specified output processing.

[0088] The above description is only a specific embodiment of the present invention, but the scope of protection of the present invention is not limited thereto. Any technician familiar with this technical field can easily think of changes or replacements within the technical scope disclosed by the present invention, which should be covered by the scope of protection of the present invention.

Claims

1. An intrinsically secure large model reasoning system based on a dynamic heterogeneous redundant architecture, characterized by: include: The input preprocessing module receives the input data to be inferred, cleans and standardizes it, and extracts multimodal features to form a unified input representation; The input preprocessing module uses dedicated feature extraction networks for different modal data, including: using the BERT model to extract features for text data, using the ResNet model to extract features for image data, using the Wav2Vec model to extract features for audio data, and using the VideoMAE model to extract features for video data, and fuses the features of each modality to form a unified input representation; A differential privacy protection unit, connected to the output end of the input preprocessing module, is used to inject noise that satisfies a preset differential privacy constraint into the unified input representation to suppress privacy leakage; The model executor pool includes multiple functionally equivalent but structurally heterogeneous model executors. The model executors respectively implement the same reasoning function through heterogeneous network architectures, and each model executor undergoes adversarial training to improve robustness. The adversarial training is achieved by generating adversarial samples during the model training process and adding them to the training set. The adversarial samples are generated using the following formula: ； in, is the generated adversarial example, is the original input, is the disturbance size, is the loss function, ∇x represents the gradient of the input; a dynamic scheduling module, connected to the output end of the differential privacy protection unit, for dynamically selecting at least two structurally heterogeneous model executors from the model executor pool for parallel reasoning based on the characteristics of the unified input representation of the injected noise and the real-time system resource status; A decision module, connected to the output end of the model execution body pool, is used to perform a comprehensive evaluation on the parallel reasoning output results of the at least two model execution bodies according to the task type using a preset decision logic to generate a final reasoning result; The anomaly monitoring and response unit communicates bidirectionally with the model executor pool and the dynamic scheduling module, and is used to continuously monitor the system resource status, the confidence distribution of the selected model executors, the runtime latency, and the input-output consistency throughout the inference process; when it detects that the inference confidence of any model executor is lower than a threshold and / or the runtime latency exceeds a preset upper limit, an anomaly response operation is triggered; the anomaly monitoring and response unit adopts the following anomaly detection rules: ； Where θ is the confidence threshold and T is the runtime threshold. When an anomaly is detected, it triggers the isolation of suspicious model executors, dynamic adjustment of the model executor combination, reallocation of inference tasks, or alerting the system administrator. The output post-processing module is connected to the output end of the decision module and is used to format the final reasoning result or perform output processing according to user-specified standards.

2. The intrinsically secure large model reasoning system based on dynamic heterogeneous redundant architecture according to claim 1 is characterized in that: The preset differential privacy constraint in the differential privacy protection unit is defined by the privacy parameter Control, satisfy: ； Among them, M is the differential privacy mechanism, D and D' are adjacent data sets, S is the output set, is a privacy parameter, which indicates the strength of privacy protection.

3. The intrinsically secure large model reasoning system based on dynamic heterogeneous redundant architecture according to claim 1 is characterized in that: The dynamic scheduling module uses the following formula to make scheduling decisions: ； in, Indicates the selected model execution body, is the set of all model execution bodies, is the input data, It is a scheduling function that comprehensively considers feature similarity, computational load, and memory usage.

4. The intrinsically secure large model reasoning system based on dynamic heterogeneous redundant architecture according to claim 1 is characterized in that: The decision module adopts a majority voting strategy for classification tasks, and the decision formula is: ， in, is the output result of the i-th model execution body, and mode represents the mode operation; A confidence comparison strategy is adopted for the generation task, and the decision formula is: ， in, Indicates the confidence of the output result of the i-th model execution body.

Images