Security risk dynamic filtering and feedback control method for large model output content

Abstract

The invention discloses a security risk dynamic filtering and feedback control method for large model output content. The method comprises the step of executing a multi-dimensional risk feature library construction operation. According to the method, semantic features are extracted by adopting a BERT-BiLSTM hybrid model, risk modes are automatically found in combination with an improved DBSCAN algorithm, the updating efficiency of a feature library is improved by 40%, feature complementation is achieved through a text / image / voice three-mode heterogeneous network design and a cross-mode attention mechanism, the composite violation content detection accuracy rate reaches 92.3%, and the method has the advantages that the method is simple and convenient to operate and high in practicability. A static channel is adopted to ensure basic rule adherence, a dynamic channel is adopted to capture context risks, a three-level filtering strategy is adopted, illegal content is clear to be completely shielded within 0.3 second, a visual warning label is added to suspected content, edge content is manually rechecked, and the time is shorter than or equal to 5 minutes, so that when the model is output, content safety is ensured, and the probability of illegal content detection is lowered. And the application value of the large model is furthest maintained.

Description

Technical Field

[0001] This invention relates to the field of large model technology, specifically to a method for dynamic filtering and feedback control of security risks in the output content of large models. Background Technology

[0002] Large-scale modeling techniques are widely used in content generation, but their output content poses significant security risks. Existing technologies have the following drawbacks:

[0003] 1. Traditional keyword filtering methods cannot identify new types of illegal content with semantic variations (such as puns and metaphorical expressions);

[0004] 2. Static risk feature databases are insufficient to address sudden risk patterns triggered by trending online events;

[0005] 3. Single-modal detection systems (text / image only) have cross-modal evasion vulnerabilities;

[0006] 4. The filtering mechanism lacks dynamic adjustment capabilities, making it prone to "false positives" or "false negatives";

[0007] 5. User feedback and system optimization have not formed a closed loop, resulting in low model iteration efficiency. Summary of the Invention

[0008] To address the aforementioned technical problems, this paper provides a method for dynamic filtering and feedback control of security risks in the output content of large models. This technical solution solves the problems mentioned in the background section.

[0009] To achieve the above objectives, the technical solution adopted by the present invention is as follows:

[0010] A method for dynamic filtering and feedback control of security risks in the output content of a large model includes:

[0011] Perform the construction of a multi-dimensional risk feature library, defining a semantic violation feature vector set V = {v1, v2, ..., v n}, and configure the corresponding weight coefficient matrix W∈R n×n ;

[0012] Multimodal preprocessing is performed on the model output X to extract text feature vector T, image feature vector I, and speech feature vector A;

[0013] Real-time risk value is calculated using a dynamic risk assessment algorithm. Where ||X|| 2 For content module length;

[0014] When R ≥ preset threshold θ, the filtering operation is triggered, and the semantic masking algorithm based on Transformer is used to target and mask the illegal content.

[0015] Establish a feedback control mechanism to adjust the risk feature library and model parameters based on user feedback data F and system self-inspection data D.

[0016] Preferably, the multi-dimensional risk feature library construction operation specifically includes the following steps:

[0017] Collected samples containing 12 typical violations, including sensitive, violent, terrorist, and vulgar content, to form a basic training corpus D = {D1,...D} 12};

[0018] A BERT-BiLSTM hybrid model is used to extract semantic features from D, generating an initial feature vector space F = {f1,...f p};

[0019] Automatic pattern recognition of F is performed using an improved DBSCAN clustering algorithm, and the risk feature vector set V is dynamically updated.

[0020] Preferably, the improved DBSCAN clustering algorithm specifically includes:

[0021] The adaptive neighborhood radius calculation is performed using the following formula:

[0022]

[0023] Where μ∈[1.2, 1.5] is a scaling factor, which is dynamically adjusted based on the data distribution characteristics. The standard deviation of the data points in the feature space is calculated as follows:

[0024]

[0025] In the formula, τ x Let m be the data mean and m be the feature dimension.

[0026] The core point determination threshold is calculated using the following formula:

[0027]

[0028] In the formula, n is the number of samples in the current cluster. The calculated MinPts value is rounded and compared with the threshold. If it is greater than or equal to the threshold, the data point is determined to be a core point; otherwise, it is not a core point.

[0029] The noise point filtering mechanism is implemented, and the specific operations include:

[0030] The formula for calculating the global average density of the data is:

[0031]

[0032] In the formula, ntotal V represents the total number of samples, and V represents the volume of the global data space.

[0033] Remove density ρ < 0.7ρ avg Discrete points are selected, and data points with a density ≥ 30% of the global average density are retained.

[0034] Preferably, the multimodal preprocessing of the model output content X specifically includes the following steps:

[0035] Text processing uses a pre-trained Transformer encoder, with each layer containing a multi-head self-attention mechanism (number of heads = 8);

[0036] The maximum length of the input sequence is set to 512, and the output dimension is adjusted to 512 dimensions through a linear transformation.

[0037] The formula for calculating the feature vector T of text data is:

[0038] T=LayerNorm(Attention(Q,K,V)+FEN(H));

[0039] In the formula, Q, K, and V represent the query, key, and value vectors, respectively, all with a dimension of 64. FFN represents a feedforward neural network with a hidden layer dimension of 2048, and H represents the output of the previous layer.

[0040] Image processing uses the ResNet-50 network structure, removing the last fully connected layer, and the input image size is standardized to 224×224×3;

[0041] The feature vector I of the image data is extracted from the global average pooling layer, and the calculation formula is:

[0042]

[0043] In the formula, H and W represent the height and width of the feature map, respectively, and H = 7, W = 7; x c，i，j This represents the pixel value at position (i, j) in channel c; I ∈ R 2048 This is the final feature vector;

[0044] The speech processing uses a neural network model, with its 1D-CNN layer configured as follows: kernel size = 5, stride = 2, number of channels = 64, and GRU layer set as follows: bidirectional structure, number of hidden layer units = 128;

[0045] The feature vector A of the speech data is generated through attention pooling, and the calculation formula is as follows:

[0046]

[0047] In the formula, h tRepresents the hidden state of the GRU at time t, u∈R d , W∈R d×d Here are the learnable parameters, and d = 128 represents the hidden layer dimension.

[0048] Preferably, the dynamic risk assessment algorithm adopts a dual-channel assessment mechanism, specifically including:

[0049] The static evaluation channel is executed, and the initial risk value R0 is calculated based on the pre-trained RoBERTa model. The calculation formula is as follows:

[0050] R0=σ(W0×f RoBERTa +b0);

[0051] In the formula, f RoBERTa ∈R 1024 W0 ∈ R represents the text feature vector output by the RoBERTa model. 1×1024 σ represents the static evaluation weight matrix, b0 represents the bias term, and σ(.) represents the Sigmoid activation function.

[0052] The dynamic evaluation channel is implemented, and the content context-related risk R1 is learned through the LSTM network. The calculation formula is as follows:

[0053] R1=σ(W1×h t +b1);

[0054] In the formula, h t ∈R 256 W1 represents the hidden state of the LSTM at time t, where W1∈R 1×256 b1 represents the dynamic evaluation weight matrix, b1 represents the bias term, and σ(.) represents the Sigmoid activation function.

[0055] By integrating the results of the dual-channel assessment, the final risk value is calculated:

[0056] R = αR0 + (1-α)R1;

[0057] In the formula, α∈[0,1] is the dynamic adjustment coefficient, the optimal value is determined by grid search, and R∈[0,1] is the final risk value, which is used to trigger the filtering operation.

[0058] Preferably, the filtering operation includes a three-level processing strategy, specifically including:

[0059] Perform Level 1 filtering; when the real-time risk value R ≥ 0.9, perform a complete blocking operation on clearly illegal content.

[0060] Perform secondary filtering; when 0.6 ≤ R < 0.9, add a warning label to suspected content and restrict its spread.

[0061] A three-level filtering process is implemented. When R < 0.6, a manual review process is initiated for edge content, with the review time t satisfying t ≤ t. max = 300 seconds.

[0062] Preferably, the specific operation of the feedback control mechanism includes:

[0063] Perform user feedback processing, collect user ratings S∈[1,5] for the filtering results, and construct the feedback matrix F;

[0064] Perform system self-checks, generate a test case set T = {C1, C0} daily, and calculate the model accuracy P and false positive rate FPR.

[0065] Perform parameter adjustment processing, and update the weight matrix W using the gradient descent method. The update formula is as follows:

[0066]

[0067] In the formula, γ = 0.01, which represents the initial learning rate; The gradient representing the user feedback loss has a dimension of n×n; The gradient represents the system's self-checking loss, with a dimension of n×n; δ=0.1 represents the regularization coefficient, which prevents overfitting.

[0068] Preferably, the user rating S is calculated using the following formula:

[0069] S = w1S1 + w2S2 + w3S3;

[0070] In the formula, S1 represents the filtering accuracy score, S2 represents the processing timeliness score (0≤S2≤1, actual processing time / expected time), S3 represents the user experience satisfaction (0≤S3≤1, obtained through NPS survey), and w1+w2+w3=1, and w1≥0.5, to ensure that accuracy is given priority.

[0071] Preferably, in the multimodal preprocessing, the features of each modality are fused through a cross-modal attention mechanism to generate a unified feature representation. Specific operations include:

[0072] The text-image attention matrix is ​​calculated as follows:

[0073]

[0074] The image-speech attention matrix is ​​calculated as follows:

[0075]

[0076] The speech-text attention matrix is ​​calculated as follows:

[0077]

[0078] The final fusion feature is:

[0079] F fusion =A ti ×V t +A iv ×V i +A vt ×V v ;

[0080] In the formula, Q t / Q i / Q v K represents the query vector (from text / image / speech modalities respectively). i / K v / K t Represents the key vectors (from image / speech / text modalities respectively), V t / V i / V v The representative value vectors (from text / image / speech modalities respectively) are d=128, which represents the feature dimension, ensuring that the computational cost is controllable.

[0081] Preferably, the specific operations for storing the filtering results include:

[0082] Record the original content hash value H(X) = SHA3-256(X);

[0083] Record filtering operation logs L = {op1, op2, ..., op...} k};

[0084] Record user feedback (F);

[0085] Record system self-test report D;

[0086] All data is encrypted and stored using the national cryptographic algorithm SM4, with a key length of 256 bits, CBC encryption mode, and an initialization vector IV that is randomly generated.

[0087] Compared with existing technologies, this invention provides a method for dynamic filtering and feedback control of security risks in the output content of large models, which has the following beneficial effects:

[0088] This invention employs a BERT-BiLSTM hybrid model to extract semantic features, combined with an improved DBSCAN algorithm to achieve automatic risk pattern discovery, improving feature library update efficiency by 40%. It constructs 12 basic risk vectors with a dynamic expansion mechanism, covering 98% of known violation types. A trimodal heterogeneous network design (text / image / speech) and cross-modal attention mechanism achieve feature complementarity, resulting in a 92.3% accuracy rate for detecting complex violations. A static channel ensures adherence to basic rules, while a dynamic channel captures contextual risks. A three-level filtering strategy is used: explicitly violating content is completely blocked within 0.3 seconds, suspected content is labeled with a visual warning, and marginal content is manually reviewed within ≤5 minutes. This ensures that the model output not only guarantees content safety but also maximizes the application value of the large model. Attached Figure Description

[0089] Figure 1 This is a schematic diagram of the method flow for S101-S105 in this invention;

[0090] Figure 2 This is a schematic diagram of the method flow for S201-S203 in this invention;

[0091] Figure 3 This is a schematic diagram of the method flow for S301-S307 in this invention;

[0092] Figure 4 This is a schematic diagram of the method flow for S401-S403 in this invention;

[0093] Figure 5 This is a schematic diagram of the method flow for S501-S504 in this invention. Detailed Implementation

[0094] The following description is intended to disclose the invention and enable those skilled in the art to implement it. The preferred embodiments described below are merely examples, and other obvious variations will occur to those skilled in the art.

[0095] Example 1

[0096] Please refer to Figure 1 As shown, a method for dynamic filtering and feedback control of security risks in the output content of a large model includes:

[0097] S101. Perform the multi-dimensional risk feature library construction operation, and define the semantic violation feature vector set V = {v1, v2, ..., v n}, and configure the corresponding weight coefficient matrix W∈R n×n ;

[0098] S102. Perform multimodal preprocessing on the model output content X to extract text feature vector T, image feature vector I, and speech feature vector A;

[0099] S103. Calculate the real-time risk value using a dynamic risk assessment algorithm. Where ||X|| 2 For content module length;

[0100] S104. When R ≥ preset threshold θ, a filtering operation is triggered, and a semantic masking algorithm based on Transformer is used to target and mask the illegal content.

[0101] S105. Establish a feedback control mechanism to adjust the risk feature library and model parameters based on user feedback data F and system self-inspection data D.

[0102] As will be understood by those skilled in the art, this invention extracts semantic features using a BERT-BiLSTM hybrid model, combines it with an improved DBSCAN algorithm to achieve automatic risk pattern discovery, thereby improving the feature library update efficiency by 40%. It constructs 12 basic risk vectors plus a dynamic expansion mechanism, covering 98% of known violation types. A trimodal heterogeneous network design (text / image / speech) is used, and feature complementarity is achieved through a cross-modal attention mechanism, resulting in a 92.3% accuracy rate for detecting complex violations. A static channel (RoBERTa) ensures adherence to basic rules, while a dynamic channel (LSTM) captures contextual risks. A three-level filtering strategy is employed: explicitly violating content is completely blocked within 0.3 seconds, suspected content is labeled with a visual warning, and marginal content is manually reviewed within ≤5 minutes. Thus, this invention not only ensures content security during model output but also maximizes the application value of the large model.

[0103] Please refer to Figure 2 As shown, the specific steps involved in constructing a multi-dimensional risk feature library are as follows:

[0104] S201. Collect typical violation samples including sensitive, violent, terrorist, and vulgar content to form a basic training corpus D = {D1,...D2}. 12};

[0105] S202. Use the BERT-BiLSTM hybrid model to extract semantic features from D, generating an initial feature vector space F = {f1,...f2}. p};

[0106] S203. Automatic pattern recognition is performed on F using the improved DBSCAN clustering algorithm, and the risk feature vector set V is dynamically updated.

[0107] The improved DBSCAN clustering algorithm specifically includes:

[0108] The adaptive neighborhood radius calculation is performed using the following formula:

[0109]

[0110] Where μ∈[1.2, 1.5] is a scaling factor, which is dynamically adjusted based on the data distribution characteristics. The standard deviation of the data points in the feature space is calculated as follows:

[0111]

[0112] In the formula, τ x Let m be the data mean and m be the feature dimension.

[0113] The core point determination threshold is calculated using the following formula:

[0114]

[0115] In the formula, n is the number of samples in the current cluster. The calculated MinPts value is rounded and compared with the threshold. If it is greater than or equal to the threshold, the data point is determined to be a core point; otherwise, it is not a core point.

[0116] The noise point filtering mechanism is implemented, and the specific operations include:

[0117] The formula for calculating the global average density of the data is:

[0118]

[0119] In the formula, n total V represents the total number of samples, and V represents the volume of the global data space.

[0120] Remove density ρ < 0.7ρ avg Discrete points are selected, and data points with a density ≥ 30% of the global average density are retained.

[0121] Those skilled in the art will understand that by collecting 12 types of violation samples (sensitive / violent / vulgar, etc.), a multi-dimensional corpus is constructed to ensure that the risk feature database covers key areas such as policy compliance, social ethics, and legal boundaries. The BERT layer captures static word vectors and contextual semantics, while the BiLSTM layer models temporal dependencies. Experimental data shows that the hybrid model improves the F1-score by 18.7% compared to the single model (based on the CCF2023 content security evaluation set). A composite feature vector space is constructed by combining textual semantic features and user behavior features (such as posting frequency and device fingerprints), and an adaptive ε-parameter adjustment mechanism is introduced to dynamically adjust the clustering radius according to data density, solving the performance fluctuation problem of traditional DBSCAN in sparse / dense data distributions.

[0122] Please refer to Figure 3 As shown, the multimodal preprocessing of the model output X includes the following steps:

[0123] S301. Text processing uses a pre-trained Transformer encoder, with each layer containing a multi-head self-attention mechanism (number of heads = 8).

[0124] S302. The maximum length of the input sequence is set to 512, and the output dimension is adjusted to 512 dimensions through a linear transformation.

[0125] S303, The formula for calculating the feature vector T of text data is:

[0126] T=LayerNorm(Attention(Q,K,V)+FEN(H));

[0127] In the formula, Q, K, and V represent the query, key, and value vectors, respectively, all with a dimension of 64. FFN represents a feedforward neural network with a hidden layer dimension of 2048, and H represents the output of the previous layer.

[0128] S304. Image processing uses the ResNet-50 network structure, removes the last fully connected layer, and normalizes the input image size to 224×224×3.

[0129] S305. The feature vector I of the image data is extracted from the global average pooling layer, and the calculation formula is:

[0130]

[0131] In the formula, H and W represent the height and width of the feature map, respectively, and H = 7, W = 7; x c，i，j This represents the pixel value at position (i, j) in channel c; I ∈ R 2048 This is the final feature vector;

[0132] S306. The speech processing adopts a neural network model. Its 1D-CNN layer is configured with a kernel size of 5, a stride of 2, and 64 channels. The GRU layer is set as a bidirectional structure with 128 hidden units.

[0133] S307. The feature vector A of the speech data is generated through attention pooling, and the calculation formula is as follows:

[0134]

[0135] In the formula, h t Represents the hidden state of the GRU at time t, u∈R d , W∈R d×d Here are the learnable parameters, and d = 128 represents the hidden layer dimension.

[0136] The dynamic risk assessment algorithm employs a dual-channel assessment mechanism, the specific operations of which include:

[0137] The static evaluation channel is executed, and the initial risk value R0 is calculated based on the pre-trained RoBERTa model. The calculation formula is as follows:

[0138] R0=σ(W0×f RoBERTa +b0);

[0139] In the formula, f RoBERTa ∈R 1024 W0 ∈ R represents the text feature vector output by the RoBERTa model. 1×1024 σ represents the static evaluation weight matrix, b0 represents the bias term, and σ(.) represents the Sigmoid activation function.

[0140] The dynamic evaluation channel is implemented, and the content context-related risk R1 is learned through the LSTM network. The calculation formula is as follows:

[0141] R1=σ(W1×h t +b1);

[0142] In the formula, h t ∈R 256 W1 represents the hidden state of the LSTM at time t, where W1∈R 1×256 b1 represents the dynamic evaluation weight matrix, b1 represents the bias term, and σ(.) represents the Sigmoid activation function.

[0143] By integrating the results of the dual-channel assessment, the final risk value is calculated:

[0144] R = αR0 + (1-α)R1;

[0145] In the formula, α∈[0,1] is the dynamic adjustment coefficient, the optimal value is determined by grid search, and R∈[0,1] is the final risk value, which is used to trigger the filtering operation.

[0146] Please refer to Figure 4 As shown, the filtering operation includes a three-level processing strategy, and the specific operations include:

[0147] S401. Perform Level 1 filtering. When the real-time risk value R ≥ 0.9, perform a complete blocking operation on clearly illegal content.

[0148] S402. Perform secondary filtering. When 0.6 ≤ R < 0.9, add a warning label to suspected content and restrict its transmission.

[0149] Broadcast range;

[0150] S403. Perform three-level filtering. When R < 0.6, initiate a manual review process for edge content. The review time t satisfies t ≤ t max = 300 seconds.

[0151] Please refer to Figure 5 As shown, the specific operations of the feedback control mechanism include:

[0152] S501. Perform user feedback processing, collect user ratings for the filtering results S∈[1,5], and construct the feedback matrix F;

[0153] S502. Perform system self-check, generate a test case set T = {C1, C0} daily, and calculate the model accuracy P and false positive rate FPR.

[0154] S503. Perform parameter adjustment processing, and update the weight matrix W using the gradient descent method. The update formula is as follows:

[0155]

[0156] In the formula, γ = 0.01, which represents the initial learning rate; The gradient representing the user feedback loss has a dimension of n×n; The gradient represents the system's self-checking loss, with a dimension of n×n; δ=0.1 represents the regularization coefficient, which prevents overfitting.

[0157] S504, User rating S is calculated using the following formula:

[0158] S = w1S1 + w2S2 + w3S3;

[0159] In the formula, S1 represents the filtering accuracy score, S2 represents the processing timeliness score (0≤S2≤1, actual processing time / expected time), S3 represents the user experience satisfaction (0≤S3≤1, obtained through NPS survey), and w1+w2+w3=1, and w1≥0.5, to ensure that accuracy is given priority.

[0160] In multimodal preprocessing, features from different modalities are fused through a cross-modal attention mechanism to generate a unified feature representation. Specific operations include:

[0161] The text-image attention matrix is ​​calculated as follows:

[0162]

[0163] The image-speech attention matrix is ​​calculated as follows:

[0164]

[0165] The speech-text attention matrix is ​​calculated as follows:

[0166]

[0167] The final fusion feature is:

[0168] F fusion =A ti ×V t +A iv ×V i +A vt ×V v ;

[0169] In the formula, Q t / Q i / Q v K represents the query vector (from text / image / speech modalities respectively). i / K v / K t Represents the key vectors (from image / speech / text modalities respectively), V t / V i / V v The representative value vectors (from text / image / speech modalities respectively) are d=128, which represents the feature dimension, ensuring that the computational cost is controllable.

[0170] The specific operations for storing the results of the filtering operation include:

[0171] Record the original content hash value H(X) = SHA3-256(X);

[0172] Record filtering operation logs L = {op1, op2, ..., op...} k};

[0173] Record user feedback (F);

[0174] Record system self-test report D;

[0175] All data is encrypted and stored using the national cryptographic algorithm SM4, with a key length of 256 bits, CBC encryption mode, and an initialization vector IV that is randomly generated.

[0176] In summary, this invention employs a BERT-BiLSTM hybrid model to extract semantic features, combined with an improved DBSCAN algorithm to achieve automatic risk pattern discovery, improving feature library update efficiency by 40%. It constructs 12 basic risk vectors with a dynamic expansion mechanism, covering 98% of known violation types. A trimodal heterogeneous network design (text / image / speech) and cross-modal attention mechanism achieve feature complementarity, resulting in a 92.3% accuracy rate for detecting complex violations. A static channel (RoBERTa) ensures adherence to basic rules, while a dynamic channel (LSTM) captures contextual risks. A three-level filtering strategy completely blocks explicitly violating content within 0.3 seconds, adds visual warning labels to suspected content, and manually reviews edge content within ≤5 minutes. Therefore, this invention not only ensures content safety during model output but also maximizes the application value of the large model.

[0177] The foregoing has shown and described the basic principles, main features, and advantages of the present invention. Those skilled in the art should understand that the present invention is not limited to the above embodiments. The embodiments and descriptions in the specification are merely principles of the invention. Various changes and modifications can be made to the invention without departing from its spirit and scope, and all such changes and modifications fall within the scope of the claimed invention. The scope of protection claimed by the appended claims and their equivalents is defined.

Claims

1. A method for dynamic filtering and feedback control of security risks in the output content of a large model, characterized in that, include: Perform the construction of a multi-dimensional risk feature library, defining a semantic violation feature vector set V = {v1, v2, ..., v n }, and configure the corresponding weight coefficient matrix W∈R n×n ; Multimodal preprocessing is performed on the model output X to extract text feature vector T, image feature vector I, and speech feature vector A; Real-time risk value is calculated using a dynamic risk assessment algorithm. Where ||X|| 2 For content module length; When R ≥ preset threshold θ, the filtering operation is triggered, and the semantic masking algorithm based on Transformer is used to target and mask the illegal content. Establish a feedback control mechanism to adjust the risk feature library and model parameters based on user feedback data F and system self-inspection data D.

2. The method for dynamic filtering and feedback control of security risks in the output content of a large model according to claim 1, characterized in that, The process of constructing the multi-dimensional risk feature library specifically includes the following steps: Collected samples containing 12 typical violations, including sensitive, violent, terrorist, and vulgar content, to form a basic training corpus D = {D1,...D} 12 }; A BERT-BiLSTM hybrid model is used to extract semantic features from D, generating an initial feature vector space F = {f1,...f p }; Automatic pattern recognition of F is performed using an improved DBSCAN clustering algorithm, and the risk feature vector set V is dynamically updated.

3. The method for dynamic filtering and feedback control of security risks in the output content of a large model according to claim 2, characterized in that, The improved DBSCAN clustering algorithm specifically includes: The adaptive neighborhood radius calculation is performed using the following formula: Where μ∈[1.2, 1.5] is a scaling factor, which is dynamically adjusted based on the data distribution characteristics. The standard deviation of the data points in the feature space is calculated as follows: In the formula, τ x Let m be the data mean and m be the feature dimension. The core point determination threshold is calculated using the following formula: In the formula, n is the number of samples in the current cluster. The calculated MinPts value is rounded and compared with the threshold. If it is greater than or equal to the threshold, the data point is determined to be a core point; otherwise, it is not a core point. The noise point filtering mechanism is implemented, and the specific operations include: The formula for calculating the global average density of the data is: In the formula, n total V represents the total number of samples, and V represents the volume of the global data space. Remove density ρ < 0.7ρ avg Discrete points are selected, and data points with a density ≥ 30% of the global average density are retained.

4. The method for dynamic filtering and feedback control of security risks in the output content of a large model according to claim 3, characterized in that, The multimodal preprocessing of the model output content X specifically includes the following steps: Text processing uses a pre-trained Transformer encoder, with each layer containing a multi-head self-attention mechanism (number of heads = 8); The maximum length of the input sequence is set to 512, and the output dimension is adjusted to 512 dimensions through a linear transformation. The formula for calculating the feature vector T of text data is: T=LayerNorm(Attention(Q,K,V)+FEN(H)); In the formula, Q, K, and V represent the query, key, and value vectors, respectively, all with a dimension of 64. FFN represents a feedforward neural network with a hidden layer dimension of 2048, and H represents the output of the previous layer. Image processing uses the ResNet-50 network structure, removing the last fully connected layer, and the input image size is standardized to 224×224×3; The feature vector I of the image data is extracted from the global average pooling layer, and the calculation formula is: In the formula, H and W represent the height and width of the feature map, respectively, and H = 7, W = 7; x c，i，j This represents the pixel value at position (i, j) in channel c; I ∈ R 2048 This is the final feature vector; The speech processing uses a neural network model, with its 1D-CNN layer configured as follows: kernel size = 5, stride = 2, number of channels = 64, and GRU layer set as follows: bidirectional structure, number of hidden layer units = 128; The feature vector A of the speech data is generated through attention pooling, and the calculation formula is as follows: In the formula, h t Represents the hidden state of the GRU at time t, u∈R d , W∈R d×d Here are the learnable parameters, and d = 128 represents the hidden layer dimension.

5. The method for dynamic filtering and feedback control of security risks in the output content of a large model according to claim 4, characterized in that, The dynamic risk assessment algorithm employs a dual-channel assessment mechanism, specifically including the following operations: The static evaluation channel is executed, and the initial risk value R0 is calculated based on the pre-trained RoBERTa model. The calculation formula is as follows: R0=σ(W0×f RoBERTa +b0); In the formula, f RoBERTa ∈R 1024 W0 ∈ R represents the text feature vector output by the RoBERTa model. 1×1024 σ represents the static evaluation weight matrix, b0 represents the bias term, and σ(.) represents the Sigmoid activation function. The dynamic evaluation channel is implemented, and the content context-related risk R1 is learned through the LSTM network. The calculation formula is as follows: R1=σ(W1×h t +b1); In the formula, h t ∈R 256 W1 represents the hidden state of the LSTM at time t, where W1∈R 1×256 b1 represents the dynamic evaluation weight matrix, b1 represents the bias term, and σ(.) represents the Sigmoid activation function. By integrating the results of the dual-channel assessment, the final risk value is calculated: R = αR0 + (1-α)R1; In the formula, α∈[0,1] is the dynamic adjustment coefficient, the optimal value is determined by grid search, and R∈[0,1] is the final risk value, which is used to trigger the filtering operation.

6. The method for dynamic filtering and feedback control of security risks in the output content of a large model according to claim 5, characterized in that, The filtering operation includes a three-level processing strategy, specifically including: Perform Level 1 filtering; when the real-time risk value R ≥ 0.9, perform a complete blocking operation on clearly illegal content. Perform secondary filtering; when 0.6 ≤ R < 0.9, add a warning label to suspected content and restrict its spread. A three-level filtering process is implemented. When R < 0.6, a manual review process is initiated for edge content, with the review time t satisfying t ≤ t. max = 300 seconds.

7. The method for dynamic filtering and feedback control of security risks in the output content of a large model according to claim 6, characterized in that, The specific operations of the feedback control mechanism include: Perform user feedback processing, collect user ratings S∈[1,5] for the filtering results, and construct the feedback matrix F; Perform system self-checks, generate a test case set T = {C1, C0} daily, and calculate the model accuracy P and false positive rate FPR. Perform parameter adjustment processing, and update the weight matrix W using the gradient descent method. The update formula is as follows: In the formula, γ = 0.01, which represents the initial learning rate; The gradient representing the user feedback loss has a dimension of n×n; The gradient represents the system's self-checking loss, with a dimension of n×n; δ=0.1 represents the regularization coefficient, which prevents overfitting.

8. The method for dynamic filtering and feedback control of security risks in the output content of a large model according to claim 7, characterized in that, The user rating S is calculated using the following formula: S = w1S1 + w2S2 + w3S3; In the formula, S1 represents the filtering accuracy score, S2 represents the processing timeliness score (0≤S2≤1, actual processing time / expected time), S3 represents the user experience satisfaction (0≤S3≤1, obtained through NPS survey), and w1+w2+w3=1, and w1≥0.5, to ensure that accuracy is given priority.

9. The method for dynamic filtering and feedback control of security risks in the output content of a large model according to claim 8, characterized in that, In the multimodal preprocessing, the features of each modality are fused through a cross-modal attention mechanism to generate a unified feature representation. Specific operations include: The text-image attention matrix is ​​calculated as follows: The image-speech attention matrix is ​​calculated as follows: The speech-text attention matrix is ​​calculated as follows: The final fusion feature is: F fusion =A ti ×V t +A iv ×V i +A vt ×V v ; In the formula, Q t / Q i / Q v K represents the query vector (from text / image / speech modalities respectively). i / K v / K t Represents the key vectors (from image / speech / text modalities respectively), V t / V i / V v The representative value vectors (from text / image / speech modalities respectively) are d=128, which represents the feature dimension, ensuring that the computational cost is controllable.

10. The method for dynamic filtering and feedback control of security risks in the output content of a large model according to claim 9, characterized in that, The specific operations for storing the filtering results include: Record the original content hash value H(X) = SHA3-256(X); Record filtering operation logs L = {op1, op2, ..., op...} k }; Record user feedback (F); Record system self-test report D; All data is encrypted and stored using the national cryptographic algorithm SM4, with a key length of 256 bits, CBC encryption mode, and an initialization vector IV that is randomly generated.

Images