A method and apparatus for bit-flipping attacks targeting large language models

Abstract

This invention discloses a bit-flipping attack method and apparatus targeting large language models, relating to the field of large language model security technology. The method includes: generating an attack dataset containing questions using a large language model; inputting the attack dataset into the target large language model for forward propagation, outputting text data; constructing a perplexity loss function based on the text data; using a part-of-speech tagger to filter keyword elements in the text data, obtaining processed keyword elements; constructing a keyword element loss function based on the processed keyword elements; integrating the perplexity loss function and the keyword element loss function to obtain a total loss function; calculating the gradient value of each parameter based on the total loss function; and using a progressive bit search method based on the gradient values ​​to search for vulnerable bits in the target large language model to complete the bit-flipping attack. This invention can effectively reduce the accuracy of the output while maintaining the naturalness of the target large language model's output.

Description

Technical Field

[0001] This invention relates to the field of large language model security technology, and in particular to a bit-flipping attack method and apparatus targeting large language models. Background Technology

[0002] In recent years, large language models have achieved significant breakthroughs in machine translation, code generation, and complex reasoning tasks, and are rapidly being deployed in cloud and edge products. However, as large language models are used in an increasingly wide range of fields, their security has become increasingly important.

[0003] Fault injection attacks intentionally insert errors into the storage or computation path of a model to compromise its performance, effectively compromising the security of large language models. Row hammer attacks are a type of memory-based fault injection attack that exploits the electrical coupling between adjacent memory locations. By rapidly and repeatedly accessing a specific physical memory address, a bit in an adjacent location may be flipped, for example, from '0' to '1' or from '1' to '0'. Therefore, row hammer attacks can precisely flip bits at a specified location in memory, thus achieving fault injection.

[0004] Bit-flipping attacks first identify the most vulnerable bit in the model, then use a hammer attack to flip the bit, thus achieving the attack objective. Existing bit-flipping fault injection attacks targeting large language models aim to disrupt the output performance of the large model, turning the output into unreadable gibberish. This attack method lacks stealth and can be easily detected manually or through simple perplexity detection. Summary of the Invention

[0005] To address the problem that existing bit-flipping attacks on large language models lack stealth, this invention provides a method and apparatus for bit-flipping attacks on large language models. The technical solution is as follows:

[0006] On the one hand, a bit-flipping attack method targeting large language models is provided. This method is implemented by a bit-flipping attack device targeting large language models, and includes:

[0007] S1. Use the GPT-4o large language model to generate an attack dataset containing the problem; input the attack dataset into the target large language model for forward propagation, and output text data that corresponds one-to-one with the attack dataset;

[0008] S2. Construct a perplexity loss function based on text data;

[0009] S3. Use a part-of-speech tagger to filter the text data for keyword elements and obtain the processed keyword elements.

[0010] S4. Based on the processed keyword elements, construct the keyword element loss function;

[0011] S5. Integrate the perplexity loss function and the keyword loss function to obtain the total loss function;

[0012] S6. Calculate the gradient value of each parameter in each module of the target large language model based on the total loss function; based on the gradient value, use the progressive bit search method to search for vulnerable bits in the target large language model and complete the flip attack.

[0013] Optionally, the perplexity loss function is expressed by the following formula (1):

[0014] (1)

[0015] in, The perplexity loss value represents the perplexity loss; N represents the number of output tokens. Represents the input sequence; Indicates model parameters; This indicates that the model is based on the input. In the case of output The probability of; Indicates model parameters.

[0016] Optionally, the keyword loss function is expressed by the following formula (2):

[0017] (2)

[0018] in, This represents the keyword meta-loss value; N represents the set of keyword tokens; N represents the number of output tokens. Represents the input sequence; Indicates model parameters; This indicates that the model is at the input. Afterwards, in position Output words The probability of; Indicates a word element.

[0019] Optionally, the total loss function is expressed by the following formula (3):

[0020] (3)

[0021] in, Represents the total loss function; Represents the perplexity loss function; Represents the keyword meta-loss function; Represents a set of keyword elements; Represents the input sequence; Indicates model parameters.

[0022] Optionally, step S6, based on gradient values, employs a progressive bit search method to search for vulnerable bits in the target large language model, including:

[0023] S61. Based on the original parameters of the target large language model, the progressive bit search method is used to simulate attacks on the most sensitive bits of each parameter of each module in each layer of the target large language model, and the loss function value corresponding to the simulated attack of each module is calculated through the total loss function.

[0024] The process of calculating the loss function value corresponding to each module after the simulated attack is represented by the following formula (4):

[0025] (4)

[0026] in, Indicated in module Medium parameters The gradient; Represents the total loss function; Representation module Parameters in ;

[0027] S62. Sort the loss function values ​​corresponding to each module after the simulated attack in ascending order, and select the module with the smallest loss function value as the most vulnerable module.

[0028] The process of selecting the module with the minimum loss function value as the most vulnerable module is expressed by the following formula (5):

[0029] (5)

[0030] in, This represents the loss function value calculated after each module i undergoes a simulated attack; This indicates the most vulnerable module.

[0031] Optionally, after step S6, which involves searching for vulnerable bits of the target large language model using a progressive bit search method based on the gradient value to complete the flip attack, it further includes:

[0032] Obtain an evaluation dataset with standard answers; use the evaluation dataset as evaluation samples, and use the target large language model before the attack and the target large language model after the attack to predict each evaluation sample, and obtain the prediction result before the attack and the prediction result after the attack for each sample.

[0033] The prediction results for each sample before and after the attack are compared with the standard answer for each sample to obtain the number of correct predictions; the ratio of the number of correct predictions to the number of evaluation samples is calculated to obtain the accuracy before and after the attack.

[0034] The difference between the accuracy after the attack and the accuracy before the attack is calculated to obtain the difference result; the ratio of the difference result to the accuracy before the attack is used as a quantitative indicator to evaluate the effectiveness of the attack.

[0035] The attack is considered effective against the target large language model if the ratio is greater than 0.8.

[0036] Optionally, the step S6, which uses a gradient-based progressive bit search method to search for vulnerable bits in the target large language model to complete the flip attack, further includes:

[0037] Obtain the evaluation dataset and use it as evaluation samples; input each evaluation sample into the target large language model before the attack and the target large language model after the attack for inference, and output the text before the attack and the text after the attack corresponding to each evaluation sample;

[0038] The output text corresponding to each evaluation sample before and after the attack is input into the GPT-4o large language model for naturalness scoring, and the naturalness score of the output text corresponding to each evaluation sample before and after the attack is obtained.

[0039] Based on the naturalness score of the output text corresponding to each evaluation sample before and after the attack, the average of the naturalness scores of the overall evaluation sample text output before and after the attack is calculated as the naturalness score before the attack and the naturalness score after the attack.

[0040] The difference between the naturalness score before the attack and the naturalness score after the attack is calculated to obtain the difference result; the ratio of the difference result to the naturalness score before the attack is used as a quantitative indicator to evaluate the stealth of the attack.

[0041] When the ratio is set to less than 0.3, the attack is considered to be highly covert.

[0042] On the other hand, a bit-flipping attack apparatus for large language models is provided. This apparatus is applied to bit-flipping attack methods targeting large language models and includes:

[0043] The generation unit is used to generate an attack dataset containing the problem using the GPT-4o large language model; the attack dataset is input into the target large language model for forward propagation, and the text data corresponding to the attack dataset is output.

[0044] The first building unit is used to construct a perplexity loss function based on text data;

[0045] The processing unit is used to perform keyword meta-filtering on the text data using a part-of-speech tagger to obtain the processed keyword meta-data.

[0046] The second building unit is used to construct a keyword loss function based on the processed keyword elements;

[0047] The acquisition unit is used to integrate the perplexity loss function and the keyword loss function to obtain the total loss function;

[0048] The search unit is used to calculate the gradient value of each parameter in each module of the target large language model based on the total loss function; based on the gradient value, the progressive bit search method is used to search for vulnerable bits in the target large language model to complete the flip attack.

[0049] On the other hand, a bit-flipping attack device for large language models is provided, the bit-flipping attack device for large language models includes: a processor; a memory, the memory storing computer-readable instructions, which, when executed by the processor, implement any of the methods described above for bit-flipping attacks for large language models.

[0050] On the other hand, a computer-readable storage medium is provided, wherein at least one instruction is stored therein, the at least one instruction being loaded and executed by a processor to implement any of the above-described bit-flipping attack methods for large language models.

[0051] The beneficial effects of the technical solutions provided in the embodiments of the present invention include at least the following:

[0052] This invention proposes a stealthy bit-flipping attack method for large language models. By filtering key-value pairs and constructing a key-value pair loss function, the performance of the target large language model is reduced. By constructing a perplexity loss function, the naturalness of the target large language model's output is maintained, making the attack stealthy. By employing a progressive bit search method, the attack target is achieved with fewer bit flips. This invention can achieve a stealthy bit-flipping attack on large language models, solving the problem that existing attack methods lack stealth and are easily detected. It can effectively reduce the performance of the target large language model while maintaining the naturalness of its output. Attached Figure Description

[0053] To more clearly illustrate the technical solutions in the embodiments of the present invention, the accompanying drawings used in the description of the embodiments will be briefly introduced below. Obviously, the accompanying drawings described below are only some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0054] Figure 1 This is a flowchart of a bit-flipping attack method for large language models provided by an embodiment of the present invention;

[0055] Figure 2 This is a flowchart of a progressive bit search method provided in an embodiment of the present invention;

[0056] Figure 3 This is a schematic diagram of the structure of a bit-flipping attack method for large language models provided in an embodiment of the present invention;

[0057] Figure 4 This is a block diagram of a bit-flipping attack device for large language models provided in an embodiment of the present invention;

[0058] Figure 5 This is a schematic diagram of the structure of a bit-flipping attack device targeting a large language model provided in an embodiment of the present invention. Detailed Implementation

[0059] The technical solution of the present invention will now be described with reference to the accompanying drawings.

[0060] In embodiments of the present invention, words such as "exemplarily," "for example," etc., are used to indicate that something is an example, illustration, or description. Any embodiment or design described as "exemplary" in the present invention should not be construed as being more preferred or advantageous than other embodiments or designs. Specifically, the use of the word "exemplary" is intended to present the concept in a concrete manner. Furthermore, in embodiments of the present invention, the meaning expressed by "and / or" can be both, or either one.

[0061] In the embodiments of this invention, the terms "image" and "picture" may sometimes be used interchangeably. It should be noted that, without emphasizing the distinction between them, they convey the same meaning. Similarly, the terms "of," "corresponding (relevant)," and "corresponding" may sometimes be used interchangeably. It should be noted that, without emphasizing the distinction between them, they convey the same meaning.

[0062] In this embodiment of the invention, sometimes a subscript such as W1 may be written in a non-subscript form such as W1. When the difference is not emphasized, the meaning they express is the same.

[0063] To make the technical problems, technical solutions and advantages of the present invention clearer, a detailed description will be given below in conjunction with the accompanying drawings and specific embodiments.

[0064] This invention provides a bit-flipping attack method targeting large language models. This method can be implemented using a bit-flipping attack device targeting large language models, which can be a terminal or a server. For example... Figure 1 The flowchart shown is for a bit-flipping attack method targeting large language models. The processing flow of this method may include the following steps:

[0065] S1. Use the GPT-4o large language model to generate an attack dataset containing the problem; input the attack dataset into the target large language model for forward propagation, and output text data that corresponds one-to-one with the attack dataset;

[0066] S2. Construct a perplexity loss function based on text data.

[0067] In order to maintain the naturalness of the output and the concealment of the attack, the embodiments of the present invention construct a perplexity loss function to reduce perplexity.

[0068] Alternatively, the perplexity loss function is expressed by the following formula (1):

[0069] (1)

[0070] in, The perplexity loss value represents the perplexity loss; N represents the number of output tokens. Represents the input sequence; Indicates model parameters; This indicates that the model is based on the input. In the case of output The probability of; Indicates model parameters.

[0071] S3. Use a part-of-speech tagger to filter the text data for keyword elements and obtain the processed keyword elements.

[0072] In one feasible implementation, a part-of-speech tagger is used to remove word elements that are adverbs, pronouns, prepositions, conjunctions, articles, interjections, and punctuation marks.

[0073] Keyword elements refer to the words that are most relevant to the meaning of the sentence after removing adverbs, pronouns, prepositions, conjunctions, articles, interjections, and punctuation marks.

[0074] S4. Based on the processed keyword elements, construct the keyword element loss function.

[0075] The purpose of the keyword meta-loss function is to prevent the target large language model from answering the question correctly.

[0076] Optionally, the keyword loss function is expressed by the following formula (2):

[0077] (2)

[0078] in, This represents the keyword meta-loss value; N represents the set of keyword tokens; N represents the number of output tokens. Represents the input sequence; Indicates model parameters; This indicates that the model is at the input. Afterwards, in position Output words The probability of; Indicates a word element.

[0079] S5. Integrate the perplexity loss function and the keyword loss function to obtain the total loss function.

[0080] Alternatively, the total loss function is expressed by the following formula (3):

[0081] (3)

[0082] in, Represents the total loss function; Represents the perplexity loss function; Represents the keyword meta-loss function; Represents a set of keyword elements; Represents the input sequence; Indicates model parameters.

[0083] S6. Calculate the gradient value of each parameter in each module of the target large language model based on the total loss function; based on the gradient value, use the progressive bit search method to search for vulnerable bits in the target large language model and complete the flip attack.

[0084] The incremental bit search method is an algorithm that combines gradient ranking and incremental search. It is often used to identify the most vulnerable bits in a deep learning model, minimizing the model's accuracy by minimizing the number of bit flips. The incremental bit search method efficiently finds the bits that have the greatest impact on model performance, achieving an effective attack on the model with fewer bit flips.

[0085] Among them, such as Figure 2The diagram shows a flowchart of a progressive bit search method provided by an embodiment of the present invention. In one feasible implementation, the progressive bit search method is used to traverse each module of each layer of the target large language model, calculate the gradient value of the current module, sort the absolute values ​​of the gradient values ​​of the current module, and extract the module with the largest absolute value. For each parameter, a simulated attack is performed on the most sensitive bit, and the loss function value corresponding to the module after the simulated attack is calculated. It is then determined whether the current module is the last module. If so, the loss function values ​​corresponding to each module after the simulated attack are sorted from smallest to largest, and the module with the smallest loss function value is selected as the most vulnerable module, and a flip attack is performed on the most vulnerable module. If it is determined that the current module is not the last module, the simulated attack is performed on the next module until all modules are traversed, the most vulnerable module is selected, and a flip attack is performed on the most vulnerable module.

[0086] Optionally, the specific implementation process of S6 includes S61-S64:

[0087] S61. Based on the original parameters of the target large language model, the progressive bit search method is used to simulate attacks on the most sensitive bits of each parameter of each module in each layer of the target large language model, and the loss function value corresponding to the simulated attack of each module is calculated through the total loss function.

[0088] In one feasible implementation, the rule for selecting the most sensitive bit for each parameter includes: when the parameters of the target large language model are stored in INT8, INT4, and NF4 types, the highest bit, i.e. the sign bit, is selected as the most sensitive bit.

[0089] When the parameters of the target large language model are stored in FP4 type, the most sensitive bit is selected as shown in Table 1 below.

[0090] Table 1

[0091]

[0092] The process of calculating the loss function value corresponding to each module after the simulated attack is represented by the following formula (4):

[0093] (4)

[0094] in, Indicated in module Medium parameters The gradient; Represents the total loss function; Representation module Parameters in ;

[0095] S62. Sort the loss function values ​​corresponding to each module after the simulated attack in ascending order, and select the module with the smallest loss function value as the most vulnerable module.

[0096] The process of selecting the module with the minimum loss function value as the most vulnerable module is expressed by the following formula (5):

[0097] (5)

[0098] in, This represents the loss function value calculated after each module i undergoes a simulated attack; This indicates the most vulnerable module.

[0099] Optionally, after S6 completes the flip attack step by using a gradient-based progressive bit search method to search for vulnerable bits in the target large language model, it also includes:

[0100] Obtain an evaluation dataset with standard answers; use the evaluation dataset as evaluation samples, and use the target large language model before the attack and the target large language model after the attack to predict each evaluation sample, and obtain the prediction result before the attack and the prediction result after the attack for each sample.

[0101] The prediction results for each sample before and after the attack are compared with the standard answer for each sample to obtain the number of correct predictions; the ratio of the number of correct predictions to the number of evaluation samples is calculated to obtain the accuracy before and after the attack.

[0102] The difference between the accuracy after the attack and the accuracy before the attack is calculated to obtain the difference result; the ratio of the difference result to the accuracy before the attack is used as a quantitative indicator to evaluate the effectiveness of the attack.

[0103] The attack is considered effective against the target large language model if the ratio is greater than 0.8.

[0104] Optionally, S6's gradient-based, progressive bit search method for vulnerable bits in the target large language model to complete the flip attack also includes:

[0105] Obtain the evaluation dataset and use it as evaluation samples; input each evaluation sample into the target large language model before the attack and the target large language model after the attack for inference, and output the text before the attack and the text after the attack corresponding to each evaluation sample;

[0106] The output text corresponding to each evaluation sample before and after the attack is input into the GPT-4o large language model for naturalness scoring, and the naturalness score of the output text corresponding to each evaluation sample before and after the attack is obtained.

[0107] Based on the naturalness score of the output text corresponding to each evaluation sample before and after the attack, the average of the naturalness scores of the overall evaluation sample text output before and after the attack is calculated as the naturalness score before the attack and the naturalness score after the attack.

[0108] The difference between the naturalness score before the attack and the naturalness score after the attack is calculated to obtain the difference result; the ratio of the difference result to the naturalness score before the attack is used as a quantitative indicator to evaluate the stealth of the attack.

[0109] When the ratio is set to less than 0.3, the attack is considered to be highly covert.

[0110] Among them, the embodiments of the present invention can be applied to covert bit-flipping attacks on large language models deployed on edge devices.

[0111] Among them, such as Figure 3 The diagram illustrates the structure of a bit-flipping attack method for a large language model provided by an embodiment of the present invention. In one feasible implementation, an attack dataset consisting of simple questions is generated using a large language model. The target large language model propagates forward on the attack dataset and outputs a response, wherein the response is text data. A perplexity loss function and a keyword meta-loss function are further constructed based on the text data. Backpropagation is performed based on the perplexity loss function and the keyword meta-loss function, and the gradient is calculated. A progressive bit search method is used to search for vulnerable bits in the target large language model to complete the bit-flipping attack. After the attack is completed, the naturalness of the model output and the rate of performance degradation of the model are evaluated.

[0112] This invention proposes a stealthy bit-flipping attack method for large language models. By filtering key-value pairs and constructing a key-value pair loss function, the performance of the target large language model is reduced. By constructing a perplexity loss function, the naturalness of the target large language model's output is maintained, making the attack stealthy. By employing a progressive bit search method, the attack target is achieved with fewer bit flips. This invention can achieve a stealthy bit-flipping attack on large language models, solving the problem that existing attack methods lack stealth and are easily detected. It can effectively reduce the performance of the target large language model while maintaining the naturalness of its output.

[0113] Figure 4 This is a block diagram of a bit-flipping attack device for large language models provided in an embodiment of the present invention. This device is used for bit-flipping attack methods targeting large language models. (Refer to...) Figure 4The device includes a generation unit 410, a first construction unit 420, a processing unit 430, a second construction unit 440, an acquisition unit 450, and a search unit 460. Wherein:

[0114] The generation unit 410 is used to generate an attack dataset containing the problem using the GPT-4o large language model; input the attack dataset into the target large language model for forward propagation, and output text data that corresponds one-to-one with the attack dataset;

[0115] The first building unit 420 is used to build a perplexity loss function based on text data;

[0116] Processing unit 430 is used to perform keyword meta filtering on text data using a part-of-speech tagger to obtain processed keyword meta.

[0117] The second construction unit 440 is used to construct a keyword element loss function based on the processed keyword elements;

[0118] Unit 450 is used to integrate the perplexity loss function and the keyword loss function to obtain the total loss function;

[0119] Search unit 460 is used to calculate the gradient value of each parameter in each module of the target large language model based on the total loss function; based on the gradient value, a progressive bit search method is used to search for vulnerable bits in the target large language model to complete the flip attack.

[0120] Optionally, the perplexity loss function is expressed by the following formula (1):

[0121] (1)

[0122] in, The perplexity loss value represents the perplexity loss; N represents the number of output tokens. Represents the input sequence; Indicates model parameters; This indicates that the model is based on the input. In the case of output The probability of; Indicates model parameters.

[0123] Optionally, the keyword loss function is expressed by the following formula (2):

[0124] (2)

[0125] in, This represents the keyword meta-loss value; N represents the set of keyword tokens; N represents the number of output tokens. Represents the input sequence; Indicates model parameters; This indicates that the model is at the input. Afterwards, in position Output words The probability of; Indicates a word element.

[0126] Optionally, the total loss function is expressed by the following formula (3):

[0127] (3)

[0128] in, Represents the total loss function; Represents the perplexity loss function; Represents the keyword meta-loss function; Represents a set of keyword elements; Represents the input sequence; Indicates model parameters.

[0129] Optionally, the search unit 460 is used for:

[0130] Based on the original parameters of the target large language model, a progressive bit search method is used to simulate attacks on the most sensitive bits of each parameter of each module in each layer of the target large language model, and the loss function value corresponding to the simulated attack of each module is calculated through the total loss function.

[0131] The process of calculating the loss function value corresponding to each module after the simulated attack is represented by the following formula (4):

[0132] (4)

[0133] in, Indicated in module Medium parameters The gradient; Represents the total loss function; Representation module Parameters in ;

[0134] After simulating an attack on each module, the corresponding loss function values ​​are sorted in ascending order, and the module with the smallest loss function value is selected as the most vulnerable module.

[0135] The process of selecting the module with the minimum loss function value as the most vulnerable module is expressed by the following formula (5):

[0136] (5)

[0137] in, This represents the loss function value calculated after each module i undergoes a simulated attack; This indicates the most vulnerable module.

[0138] Optionally, after the step of searching for vulnerable bits of the target large language model using a progressive bit search method based on the gradient value to complete the flip attack, the method further includes:

[0139] Obtain an evaluation dataset with standard answers; use the evaluation dataset as evaluation samples, and use the target large language model before the attack and the target large language model after the attack to predict each evaluation sample, and obtain the prediction result before the attack and the prediction result after the attack for each sample.

[0140] The prediction results for each sample before and after the attack are compared with the standard answer for each sample to obtain the number of correct predictions; the ratio of the number of correct predictions to the number of evaluation samples is calculated to obtain the accuracy before and after the attack.

[0141] The difference between the accuracy after the attack and the accuracy before the attack is calculated to obtain the difference result; the ratio of the difference result to the accuracy before the attack is used as a quantitative indicator to evaluate the effectiveness of the attack.

[0142] The attack is considered effective against the target large language model if the ratio is greater than 0.8.

[0143] Optionally, the step of searching for vulnerable bits of the target large language model using a progressive bit search method based on the gradient value to complete the flip attack further includes:

[0144] Obtain the evaluation dataset and use it as evaluation samples; input each evaluation sample into the target large language model before the attack and the target large language model after the attack for inference, and output the text before the attack and the text after the attack corresponding to each evaluation sample;

[0145] The output text corresponding to each evaluation sample before and after the attack is input into the GPT-4o large language model for naturalness scoring, and the naturalness score of the output text corresponding to each evaluation sample before and after the attack is obtained.

[0146] Based on the naturalness score of the output text corresponding to each evaluation sample before and after the attack, the average of the naturalness scores of the overall evaluation sample text output before and after the attack is calculated as the naturalness score before the attack and the naturalness score after the attack.

[0147] The difference between the naturalness score before the attack and the naturalness score after the attack is calculated to obtain the difference result; the ratio of the difference result to the naturalness score before the attack is used as a quantitative indicator to evaluate the stealth of the attack.

[0148] When the ratio is set to less than 0.3, the attack is considered to be highly covert.

[0149] This invention proposes a stealthy bit-flipping attack method for large language models. By filtering key-value pairs and constructing a key-value pair loss function, the performance of the target large language model is reduced. By constructing a perplexity loss function, the naturalness of the target large language model's output is maintained, making the attack stealthy. By employing a progressive bit search method, the attack target is achieved with fewer bit flips. This invention can achieve a stealthy bit-flipping attack on large language models, solving the problem that existing attack methods lack stealth and are easily detected. It can effectively reduce the performance of the target large language model while maintaining the naturalness of its output.

[0150] Figure 5 This is a schematic diagram of the structure of a bit-flipping attack device targeting large language models provided in an embodiment of the present invention, as shown below. Figure 5 As shown, bit-flipping attack devices targeting large language models can include the above-mentioned... Figure 4 The illustrated bit-flipping attack apparatus for large language models. Optionally, the bit-flipping attack apparatus 510 for large language models may include a first processor 2001.

[0151] Optionally, the bit-flipping attack device 510 targeting large language models may also include a memory 2002 and a transceiver 2003.

[0152] The first processor 2001, memory 2002, and transceiver 2003 can be connected via a communication bus.

[0153] The following is combined with Figure 5 A detailed description of each component of the 510 bit-flipping attack device targeting large language models is provided below:

[0154] The first processor 2001 is the control center of the bit-flipping attack device 510 targeting large language models. It can be a single processor or a collective term for multiple processing elements. For example, the first processor 2001 can be one or more central processing units (CPUs), application-specific integrated circuits (ASICs), or one or more integrated circuits configured to implement embodiments of the present invention, such as one or more digital signal processors (DSPs), or one or more field-programmable gate arrays (FPGAs).

[0155] Optionally, the first processor 2001 can perform various functions of the bit-flipping attack device 510 targeting large language models by running or executing software programs stored in the memory 2002 and calling data stored in the memory 2002.

[0156] In a specific implementation, as one example, the first processor 2001 may include one or more CPUs, for example... Figure 5 CPU0 and CPU1 are shown in the diagram.

[0157] In a specific implementation, as one example, the bit-flipping attack device 510 targeting large language models may also include multiple processors, for example... Figure 5 The first processor 2001 and the second processor 2004 are shown in the diagram. Each of these processors can be a single-core processor or a multi-core processor. Here, a processor can refer to one or more devices, circuits, and / or processing cores used to process data (such as computer program instructions).

[0158] The memory 2002 is used to store the software program that executes the present invention, and is controlled by the first processor 2001 to execute it. The specific implementation method can be referred to the above method embodiment, and will not be repeated here.

[0159] Optionally, the memory 2002 may be a read-only memory (ROM) or other type of static storage device capable of storing static information and instructions, random access memory (RAM) or other type of dynamic storage device capable of storing information and instructions, or electrically erasable programmable read-only memory (EEPROM), compact disc read-only memory (CD-ROM) or other optical disc storage, optical disc storage (including compressed optical discs, laser discs, optical discs, digital universal optical discs, Blu-ray discs, etc.), magnetic disk storage media or other magnetic storage devices, or any other medium capable of carrying or storing desired program code in the form of instructions or data structures and accessible by a computer, but not limited thereto. The memory 2002 may be integrated with the first processor 2001 or may exist independently, and may be accessed through the interface circuit of the bit-flipping attack device 510 for large language models (…). Figure 5 (Not shown in the image) is coupled to the first processor 2001, and this embodiment of the invention does not specifically limit this.

[0160] The transceiver 2003 is used to communicate with network devices or with terminal devices.

[0161] Alternatively, transceiver 2003 may include a receiver and a transmitter. Figure 5 (Not shown separately). The receiver is used to implement the receiving function, and the transmitter is used to implement the transmitting function.

[0162] Optionally, the transceiver 2003 can be integrated with the first processor 2001 or exist independently, and can be connected to the interface circuit of the bit-flipping attack device 510 for large language models. Figure 5 (Not shown in the image) is coupled to the first processor 2001, and this embodiment of the invention does not specifically limit this.

[0163] It should be noted that, Figure 5 The structure of the bit-flipping attack device 510 against large language models shown in the diagram does not constitute a limitation on the router. Actual bit-flipping attack devices against large language models may include more or fewer components than shown, or combine certain components, or have different component arrangements.

[0164] Furthermore, the technical effects of the bit-flipping attack device 510 targeting large language models can be referred to the technical effects of the bit-flipping attack method targeting large language models described in the above method embodiments, and will not be repeated here.

[0165] It should be understood that the first processor 2001 in the embodiments of the present invention may be a central processing unit (CPU), or it may be other general-purpose processors, digital signal processors (DSPs), application-specific integrated circuits (ASICs), field-programmable gate arrays (FPGAs), or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, etc. The general-purpose processor may be a microprocessor, or it may be any conventional processor, etc.

[0166] It should also be understood that the memory in the embodiments of the present invention can be volatile memory or non-volatile memory, or may include both volatile and non-volatile memory. The non-volatile memory can be read-only memory (ROM), programmable read-only memory (PROM), erasable programmable read-only memory (EPROM), electrically erasable programmable read-only memory (EEPROM), or flash memory. The volatile memory can be random access memory (RAM), which is used as an external cache. By way of example, but not limitation, many forms of random access memory (RAM) are available, such as static RAM (SRAM), dynamic RAM (DRAM), synchronous DRAM (SDRAM), double data rate synchronous DRAM (DDR SDRAM), enhanced synchronous DRAM (ESDRAM), synchronous linked DRAM (SLDRAM), and direct rambus RAM (DR RAM).

[0167] The above embodiments can be implemented, in whole or in part, by software, hardware (such as circuits), firmware, or any other combination thereof. When implemented using software, the above embodiments can be implemented, in whole or in part, as a computer program product. The computer program product includes one or more computer instructions or computer programs. When the computer instructions or computer programs are loaded or executed on a computer, all or part of the processes or functions described in the embodiments of the present invention are generated. The computer can be a general-purpose computer, a special-purpose computer, a computer network, or other programmable device. The computer instructions can be stored in a computer-readable storage medium or transmitted from one computer-readable storage medium to another. For example, the computer instructions can be transmitted from one website, computer, server, or data center to another website, computer, server, or data center via wired (e.g., infrared, wireless, microwave, etc.) means. The computer-readable storage medium can be any available medium that a computer can access or a data storage device such as a server or data center that includes one or more sets of available media. The available medium can be a magnetic medium (e.g., floppy disk, hard disk, magnetic tape), an optical medium (e.g., DVD), or a semiconductor medium. A semiconductor medium can be a solid-state drive.

[0168] It should be understood that the term "and / or" in this article is merely a description of the relationship between related objects, indicating that three relationships can exist. For example, A and / or B can represent: A existing alone, A and B existing simultaneously, or B existing alone. A and B can be singular or plural. Additionally, the character " / " in this article generally indicates an "or" relationship between the preceding and following related objects, but it can also represent an "and / or" relationship. Please refer to the context for a more accurate understanding.

[0169] In this invention, "at least one" means one or more, and "more than one" means two or more. "At least one of the following" or similar expressions refer to any combination of these items, including any combination of a single item or a plurality of items. For example, at least one of a, b, or c can represent: a, b, c, ab, ac, bc, or abc, where a, b, and c can be a single item or multiple items.

[0170] It should be understood that, in various embodiments of the present invention, the order of the above-mentioned process numbers does not imply the order of execution. The execution order of each process should be determined by its function and internal logic, and should not constitute any limitation on the implementation process of the embodiments of the present invention.

[0171] Those skilled in the art will recognize that the units and algorithm steps of the various examples described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, or a combination of computer software and electronic hardware. Whether these functions are implemented in hardware or software depends on the specific application and design constraints of the technical solution. Those skilled in the art can use different methods to implement the described functions for each specific application, but such implementations should not be considered beyond the scope of this invention.

[0172] Those skilled in the art will clearly understand that, for the sake of convenience and brevity, the specific working processes of the devices, apparatuses, and units described above can be referred to the corresponding processes in the foregoing method embodiments, and will not be repeated here.

[0173] In the several embodiments provided by this invention, it should be understood that the disclosed devices, apparatuses, and methods can be implemented in other ways. For example, the apparatus embodiments described above are merely illustrative; for instance, the division of units is only a logical functional division, and in actual implementation, there may be other division methods. For example, multiple units or components may be combined or integrated into another device, or some features may be ignored or not executed. Furthermore, the coupling or direct coupling or communication connection shown or discussed may be through some interfaces; the indirect coupling or communication connection between devices or units may be electrical, mechanical, or other forms.

[0174] The units described as separate components may or may not be physically separate. The components shown as units may or may not be physical units; that is, they may be located in one place or distributed across multiple network units. Some or all of the units can be selected to achieve the purpose of this embodiment according to actual needs.

[0175] In addition, the functional units in the various embodiments of the present invention can be integrated into one processing unit, or each unit can exist physically separately, or two or more units can be integrated into one unit.

[0176] If the aforementioned functions are implemented as software functional units and sold or used as independent products, they can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of this invention, or the part that contributes to the prior art, or a part of the technical solution, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute all or part of the steps of the methods described in the various embodiments of this invention. The aforementioned storage medium includes various media capable of storing program code, such as USB flash drives, portable hard drives, read-only memory (ROM), random access memory (RAM), magnetic disks, or optical disks.

[0177] The above description is merely a specific embodiment of the present invention, but the scope of protection of the present invention is not limited thereto. Any variations or substitutions that can be easily conceived by those skilled in the art within the technical scope disclosed in the present invention should be included within the scope of protection of the present invention. Therefore, the scope of protection of the present invention should be determined by the scope of the claims.

Claims

1. A bit-flipping attack method targeting large language models, characterized in that, The method includes: S1. Use the GPT-4o large language model to generate an attack dataset containing the problem; input the attack dataset into the target large language model for forward propagation, and output text data that corresponds one-to-one with the attack dataset; S2. Construct a perplexity loss function based on text data; S3. Use a part-of-speech tagger to filter the text data for keyword elements and obtain the processed keyword elements. S4. Based on the processed keyword elements, construct the keyword element loss function; S5. Integrate the perplexity loss function and the keyword loss function to obtain the total loss function; S6. Calculate the gradient value of each parameter in each module of the target large language model based on the total loss function; based on the gradient value, use the progressive bit search method to search for vulnerable bits in the target large language model, complete the flip attack, and obtain quantitative indicators to evaluate the effectiveness of the attack and quantitative indicators to evaluate the concealment of the attack. Specifically, S6, based on the gradient value, employs a progressive bit search method to search for vulnerable bits in the target large language model, including: S61. Based on the original parameters of the target large language model, the progressive bit search method is used to simulate attacks on the most sensitive bits of each parameter of each module in each layer of the target large language model, and the loss function value corresponding to the simulated attack of each module is calculated through the total loss function. The process of calculating the loss function value corresponding to each module after the simulated attack is expressed by the following formula (1): （1） in, Indicated in module Medium parameters The gradient; Represents the total loss function; Representation module Parameters in ; S62. Sort the loss function values ​​corresponding to each module after the simulated attack in ascending order, and select the module with the smallest loss function value as the most vulnerable module. The process of selecting the module with the minimum loss function value as the most vulnerable module is expressed by the following formula (2): （2） in, This represents the loss function value calculated after each module i undergoes a simulated attack; This indicates the most vulnerable module.

2. The bit-flipping attack method for large language models according to claim 1, characterized in that, The perplexity loss function is expressed by the following formula (3): （3） in, The perplexity loss value represents the perplexity loss; N represents the number of output tokens. Represents the input sequence; Indicates model parameters; This indicates that the model is based on the input. In the case of output The probability of; Indicates model parameters.

3. The bit-flipping attack method for large language models according to claim 1, characterized in that, The keyword loss function is expressed by the following formula (4): （4） in, This represents the keyword meta-loss value; N represents the set of keyword tokens; N represents the number of output tokens. Represents the input sequence; Indicates model parameters; This indicates that the model is at the input. Afterwards, in position Output words The probability of; Indicates a word element.

4. The bit-flipping attack method for large language models according to claim 1, characterized in that, The total loss function is expressed by the following formula (5): （5） in, Represents the total loss function; Represents the perplexity loss function; Represents the keyword meta-loss function; Represents a set of keyword elements; Represents the input sequence; Indicates model parameters.

5. The bit-flipping attack method for large language models according to claim 1, characterized in that, After step S6, which involves using a progressive bit search method based on the gradient value to search for vulnerable bits in the target large language model and complete the flip attack, it also includes: Obtain an evaluation dataset with standard answers; use the evaluation dataset as evaluation samples, and use the target large language model before the attack and the target large language model after the attack to predict each evaluation sample, and obtain the prediction result before the attack and the prediction result after the attack for each sample. The prediction results for each sample before and after the attack are compared with the standard answer for each sample to obtain the number of correct predictions; the ratio of the number of correct predictions to the number of evaluation samples is calculated to obtain the accuracy before and after the attack. The difference between the accuracy after the attack and the accuracy before the attack is calculated to obtain the difference result; the ratio of the difference result to the accuracy before the attack is used as a quantitative indicator to evaluate the effectiveness of the attack. The attack is considered effective against the target large language model if the ratio is greater than 0.

8.

6. The bit-flipping attack method for large language models according to claim 1, characterized in that, The step S6, which involves using a progressive bit search method based on the gradient value to search for vulnerable bits in the target large language model and complete the flip attack, further includes: Obtain the evaluation dataset and use it as evaluation samples; input each evaluation sample into the target large language model before the attack and the target large language model after the attack for inference, and output the text before the attack and the text after the attack corresponding to each evaluation sample; The output text corresponding to each evaluation sample before and after the attack is input into the GPT-4o large language model for naturalness scoring, and the naturalness score of the output text corresponding to each evaluation sample before and after the attack is obtained. Based on the naturalness score of the output text corresponding to each evaluation sample before and after the attack, the average of the naturalness scores of the overall evaluation sample text output before and after the attack is calculated as the naturalness score before the attack and the naturalness score after the attack. The difference between the naturalness score before the attack and the naturalness score after the attack is calculated to obtain the difference result; the ratio of the difference result to the naturalness score before the attack is used as a quantitative indicator to evaluate the stealth of the attack. When the ratio is less than 0.3, the attack is considered to be highly covert.

7. A bit-flipping attack apparatus for large language models, wherein the bit-flipping attack apparatus for large language models is used to implement the bit-flipping attack method for large language models as described in any one of claims 1-6, characterized in that, The device includes: The generation unit is used to generate an attack dataset containing the problem using the GPT-4o large language model; the attack dataset is input into the target large language model for forward propagation, and the text data corresponding to the attack dataset is output. The first building unit is used to construct a perplexity loss function based on text data; The processing unit is used to perform keyword meta-filtering on the text data using a part-of-speech tagger to obtain the processed keyword meta-data. The second building unit is used to construct a keyword loss function based on the processed keyword elements; The acquisition unit is used to integrate the perplexity loss function and the keyword loss function to obtain the total loss function; The search unit is used to calculate the gradient value of each parameter in each module of the target large language model based on the total loss function; based on the gradient value, the progressive bit search method is used to search for vulnerable bits in the target large language model to complete the flip attack.

8. A bit-flipping attack device targeting large language models, characterized in that, The bit-flipping attack device targeting large language models includes: processor; A memory storing computer-readable instructions that, when executed by the processor, implement the method as described in any one of claims 1 to 6.

9. A computer-readable storage medium, characterized in that, The computer-readable storage medium contains program code that can be invoked by a processor to execute the method as described in any one of claims 1 to 6.

Images