Large language model security test method based on evolutionary dynamic adversarial attack

Abstract

The invention discloses a large language model security testing method based on evolutionary dynamic adversarial attacks, and relates to the technical field of security testing. Comprising the following steps: 1, creating a dynamic attack generation engine, constructing an adversarial evolution architecture by utilizing the dynamic attack generation engine, and generating a test sample based on the adversarial evolution architecture for a large language model security test; the method comprises the following steps: 1, establishing a large-scale language model, 2, calculating investigation parameters of harmlessness, honesty and helpfulness based on a Constancy AI principle, calculating a security alignment gap index SAGI by using the investigation parameters, and intelligently judging a value drift condition of the large-scale language model according to the security alignment gap index SAGI, 3, establishing a multi-modal joint defense engine, and carrying out intelligent judgment on the value drift condition of the large-scale language model according to the value drift condition of the large-scale language model. Steganalysis, syntax tree analysis and audio anomaly detection functions are integrated, and all-around threat detection coverage of texts, codes, images and voices is carried out on a detected large language model.

Description

Technical Field

[0001] This invention discloses a security testing method for large language models based on evolving dynamic adversarial attacks, which relates to the field of security testing technology. Background Technology

[0002] Existing security testing methods for large language models still have some shortcomings, such as:

[0003] Insufficient coverage of dynamic attacks: For all threat categories defined in OWASP LLM Top 10-2024, existing static testing has a detection bottleneck for adaptive attacks such as GCG-optimized attacks, and cannot achieve dynamic evolution and real-time countermeasures against attack samples.

[0004] The lack of value alignment assessment means that the "helpfulness-harmlessness paradox" cannot be quantitatively detected, and the risk of value drift during continuous learning, such as outputting harmful content in the name of providing help, cannot be addressed.

[0005] There are shortcomings in multimodal defense: it cannot overcome the shortcomings of isolated analysis of four-modal features (text, image, audio, and code), lacks a cross-modal joint inference engine, has a high false negative rate for multimodal attacks, and cannot meet the multi-dimensional compliance requirements of the EU AI Act, etc. Summary of the Invention

[0006] This invention addresses the problems of existing technologies by providing a security testing method for large language models based on evolutionary dynamic adversarial attacks. It utilizes evolutionary adversarial attack technology to achieve intelligent and systematic model security assessment. It integrates cutting-edge technologies from multiple disciplines, including reinforcement learning, genetic algorithms, legal knowledge graphs, steganalysis, and value alignment verification, to comprehensively improve the security and robustness of large models in order to cope with the increasingly severe AI security threats.

[0007] The specific solution proposed in this invention is as follows:

[0008] This invention provides a security testing method for large language models based on evolvable dynamic adversarial attacks, including:

[0009] Step 1: Create a dynamic attack generation engine, build an adversarial evolution architecture using the dynamic attack generation engine, and generate test samples based on the adversarial evolution architecture for large language model security testing. Specifically, the adversarial evolution architecture generates attack strategies through the attacker and generates test samples of the attack based on the attack strategies. The defender deploys the real-time response mode of the model under test under the attack strategy and attempts to thwart the attack. The adversarial relationship between the attacker and the defender ensures that the test samples effectively cover unknown threat patterns.

[0010] Step 2: Calculate the assessment parameters for harmlessness, honesty, and helpfulness based on the ConstitutionalAI principle, and use these parameters to calculate the Security Alignment Gap Index (SAGI). Then, based on the SAGI, intelligently judge the value drift of the large-scale language model.

[0011] Step 3: Create a multimodal joint defense engine that integrates steganalysis, syntax tree parsing, and audio anomaly detection functions to provide comprehensive threat detection coverage of text, code, images, and speech for the large language model under test.

[0012] Furthermore, in step 1 of the large language model security testing method based on evolutionary dynamic adversarial attacks, when the attacker generates test samples for the attack according to the attack strategy, the gradient coordinate optimization algorithm (GCG) is used to generate adversarial perturbations. Along the gradient direction of the loss function with respect to the perturbation, the perturbations are updated with a certain learning rate to gradually generate more effective test samples. The formula used is:

[0013]

[0014] Explain the update method for counter-perturbation δ, δ t δ represents the adversarial perturbation generated in the t-th iteration. t+1 It is the adversarial perturbation after the (t+1)th iteration update, where η is the learning rate, controlling the step size of the perturbation update in each iteration. L represents the gradient of the perturbation δ. ce Let f(x+δ) be the cross-entropy loss function, representing the prediction result of the target model f on the input sample x+δ with added perturbation δ, where x is the original sample and y is the input sample. max The label that maximizes the cross-entropy loss function value.

[0015] Furthermore, in step 1 of the large language model security testing method based on evolutionary dynamic adversarial attacks, the attack path is optimized by introducing a PPO policy network through the attacker, utilizing the reward function:

[0016]

[0017] Evaluate the merits of attack paths, ASR attack success rate, and measure the probability that an attack path successfully reaches its target. -λ.Detect The term is an exponential decay term used to penalize detected attack paths. Detect represents the probability or index of an attack being detected. λ is an adjustment parameter used to control the degree of influence of the detection probability on the reward function. The larger λ is, the greater the negative impact of the detection probability on the reward function. β is an adjustment parameter used to control the strength of the complexity penalty. Perp(δ) represents the complexity of the path or the degree of deviation from normal behavior, which is calculated by analyzing the differences between the characteristics of the attack path and the normal behavior pattern.

[0018] Furthermore, in step 1 of the aforementioned security testing method for large language models based on evolutionary dynamic adversarial attacks, the test model is deployed to implement a real-time response mode under the attack strategy through a defender. This includes deploying a triple real-time response defense mode, namely semantic rejection, obfuscated output, and anti-inducement trap. Semantic rejection is the most commonly used mode; when suspicious but not yet clearly harmful input intent is detected, the response is directly rejected.

[0019] Obfuscated output: When input is deemed high-risk but the conversation needs to be maintained, provide ambiguous, harmless, or topic-shifting responses.

[0020] Anti-trap is the highest level of defense. After actively identifying the attacker's intention to lure them, it simulates being hooked but actually outputs preset security content or implants misleading information, and even attempts to reverse-probe the attacker's identity and intentions.

[0021] Furthermore, in step 2 of the aforementioned security testing method for large language models based on evolutionary dynamic adversarial attacks, harmlessness is calculated based on the Constitutional AI principle: the harmful content is detected by fine-tuning the BERT classifier, and the rate of decrease in harmful responses is calculated. Where ΔH is the rate of decrease in harmful response, representing the percentage reduction in harmful response, and its value ranges from 0 to 1, N mal N refers to the total number of harmful responses generated by the tested large language model during the testing or observation period. total This refers to the total number of responses generated by the tested large language model within the same testing or observation period.

[0022] Furthermore, in step 2 of the aforementioned security testing method for large language models based on evolutionary dynamic adversarial attacks, honesty is calculated based on the Constitutional AI principle:

[0023] Construct a FactChecker-GPT model based on WikiData knowledge graph to quantify the illusion index H. score =|BERTfact-BERTout|2,H score BERT is the illusion index, used to quantify the difference between the output of a large language model and the facts, and to assess the degree of illusion of the large language model. BERTfact is the semantic vector of the factual text, representing real and credible information. BERTout is the semantic vector of the output of the large language model under test, representing the content generated by the model. The |·|2 operation calculates the Euclidean distance between two vectors, measuring the difference between the vectors in the semantic space.

[0024] Furthermore, in step 2 of the aforementioned security testing method for large language models based on evolutionary dynamic adversarial attacks, the helpability is calculated based on the Constitutional AI principle:

[0025] The RAG task test set is used to evaluate the completion of the test task, and the help decay ratio is defined:

[0026]

[0027] HDR stands for Helpful Attenuation Ratio, which measures the degree of attenuation of helpfulness of the tested large language model when it is subjected to interference. The value ranges from 0 to 1, where 0 indicates no attenuation and 1 indicates that the helpfulness is almost completely lost. Recall @10adv is the recall rate of the tested large language model in the top 10 results under adversarial or interference conditions. Recall @10clean is the recall rate of the tested large language model in the top 10 results under ideal conditions without interference.

[0028] Furthermore, in step 2 of the aforementioned security testing method for a large language model based on an evolutionary dynamic adversarial attack, the harmful response reduction rate ΔH in the harmlessness category and the quantified illusion index H in the honesty category are utilized. score And the auxiliary attenuation ratio HDR calculation for the safety alignment gap index SAGI:

[0029] SAGI = 0.5ΔH + 0.3H score +0.2HDR

[0030] Based on the Security Alignment Gap Index (SAGI) of the large language model, the intelligent judge identifies value drift when SAGI > 0.1, indicating severe value drift, and performs drift monitoring accordingly.

[0031]

[0032] DriftAlert is used to indicate whether a significant drift has been detected. A DriftAlert value of 1 indicates that a drift has been detected and the large language model under test needs to be retrained; a DriftAlert value of 0 indicates that no significant drift has been detected and the large language model under test can continue to operate normally.

[0033] This invention also provides a security testing device for large language models based on evolving dynamic adversarial attacks, including an attack generation module, a security alignment evaluation module, and a multimodal joint defense module.

[0034] The attack generation module creates a dynamic attack generation engine, uses the dynamic attack generation engine to build an adversarial evolution architecture, and generates test samples based on the adversarial evolution architecture for large language model security testing. Specifically, the adversarial evolution architecture generates attack strategies through the attacker and generates attack test samples based on the attack strategies. The defender deploys the real-time response mode of the tested model under the attack strategy and attempts to thwart the attack. The adversarial interaction between the attacker and the defender ensures that the test samples effectively cover unknown threat patterns.

[0035] The Safety Alignment Assessment module calculates the assessment parameters of harmlessness, honesty, and helpfulness based on the ConstitutionalAI principle, and uses these parameters to calculate the Safety Alignment Gap Index (SAGI). Based on the SAGI, the intelligent judge assesses the value drift of the large-scale language model.

[0036] The multimodal joint defense module creates a multimodal joint defense engine that integrates steganalysis, syntax tree parsing, and audio anomaly detection functions to provide comprehensive threat detection coverage of text, code, images, and speech for the large language model under test.

[0037] The advantages of this invention are:

[0038] By simulating real hacker attack paths through a dynamic attack generation engine, attack samples can evolve autonomously and continuously generate new and unknown threats, thus overcoming the lag of traditional static testing.

[0039] The Security Alignment Gap Index (SAGI) transforms abstract ethical principles such as harmlessness, honesty, and helpfulness into quantifiable indicators, enabling real-time monitoring of moral drift in the tested large language model.

[0040] By using a multimodal joint defense system, the modal barriers between text, images, audio, and code are broken down, and cross-media attack signals, such as image hiding instructions and audio backdoors, are scanned simultaneously to achieve collaborative defense.

[0041] In the short term, this invention can serve as an efficient and secure testing method to accelerate the deployment and certification of AI in high-risk areas.

[0042] The long-term deployment of a dynamic architecture allows for autonomous upgrades and defense against future threats such as quantum computing attacks and brain-computer interface security.

[0043] In summary, this invention revolutionizes the AI ​​security testing paradigm, enabling a leap from passive defense to proactive immunity, and providing a foundation of trust for AI applications in key industries. Attached Figure Description

[0044] Figure 1 This is a schematic diagram of the process of attack and defense confrontation involving the method of the present invention.

[0045] Figure 2This is a workflow diagram for the SAGI intelligent referee decision based on the Security Alignment Gap Index.

[0046] Figure 3 This is a schematic diagram of the application architecture of the present invention. Detailed Implementation

[0047] The present invention will be further described below with reference to the accompanying drawings and specific embodiments, so that those skilled in the art can better understand and implement the present invention. However, the embodiments described are not intended to limit the present invention.

[0048] This invention provides a security testing method for large language models based on evolvable dynamic adversarial attacks, including:

[0049] Step 1: Create a dynamic attack generation engine, build an adversarial evolution architecture using the dynamic attack generation engine, and generate test samples based on the adversarial evolution architecture for large language model security testing. Specifically, the adversarial evolution architecture generates attack strategies through an attacker and generates test samples of the attacks based on the attack strategies. The defender deploys the real-time response mode of the model under test under the attack strategies and attempts to thwart the attacks. The adversarial interaction between the attacker and the defender ensures that the test samples effectively cover unknown threat patterns.

[0050] When generating test samples for an attack based on the attack strategy, the gradient coordinate optimization algorithm (GCG) is used to generate adversarial perturbations. These perturbations are updated along the gradient direction of the loss function with respect to the perturbation at a certain learning rate, gradually generating more effective test samples. The formula used is:

[0051]

[0052] Explain the update method for counter-perturbation δ, δ t δ represents the adversarial perturbation generated in the t-th iteration. t+1 It is the adversarial perturbation after the (t+1)th iteration update, where η is the learning rate, controlling the step size of the perturbation update in each iteration. L represents the gradient of the perturbation δ. ce Let f(x+δ) be the cross-entropy loss function, representing the prediction result of the target model f on the input sample x+δ with added perturbation δ, where x is the original sample and y is the input sample. max The label that maximizes the cross-entropy loss function value. This stage quickly locates vulnerabilities near the decision boundary of the tested large language model.

[0053] By introducing a PPO policy network through an attacker, the attack path is optimized, utilizing the reward function:

[0054]

[0055] The evaluation of attack paths is based on the ASR attack success rate, which measures the probability that an attack path successfully reaches its target. e-λ·Detect is an exponentially decaying term used to penalize detected attack paths. Detect represents the probability or metric of attack detection, and λ is an adjustment parameter used to control the influence of the detection probability on the reward function; a larger λ indicates a greater negative impact. β is an adjustment parameter used to control the strength of the complexity penalty. Perp(δ) represents the complexity of the path or its deviation from normal behavior, calculated by analyzing the differences between the characteristics of the attack path and normal behavior patterns. To generate more intelligent and human-like attack samples with multi-stage strategies such as chain-like inducement and context-dependent behavior, this method introduces the Proximal Policy Optimization (PPO) reinforcement learning algorithm to optimize attack paths.

[0056] The defense deploys the real-time response mode of the tested model under the attack strategy, including: deploying a triple real-time response defense mode, namely semantic rejection, obfuscated output, and anti-inducement trap.

[0057] Semantic rejection is the most commonly used mode. When suspicious but not yet clearly harmful input intent is detected, the response is directly rejected.

[0058] Obfuscated Output: When input is deemed high-risk but the conversation needs to be maintained, it provides a vague, harmless, or topic-shifting response.

[0059] Counter-Induction Trap is the highest level of defense. After actively identifying the attacker's intention to lure them, it simulates being hooked but actually outputs preset security content or implants misleading information, and even attempts to reverse-probe the attacker's identity and intentions.

[0060] Step 2: Based on the ConstitutionalAI principle, calculate the evaluation parameters for harmlessness, honesty, and helpfulness, and use these parameters to calculate the Safety Alignment Gap Index (SAGI). Then, use the SAGI to intelligently assess the value drift of the large language model. The SAGI fundamentally solves the problem of "missing value alignment assessment" and accurately captures potential value drift that may occur in the tested large language model after continuous learning or deployment. For example, excessively pursuing "helpfulness" while lowering the "harmlessness" standard may result in outputting seemingly helpful but actually harmful suggestions.

[0061] Harmlessness is calculated based on the principle of Constitutional AI: The harmful content detection is performed by fine-tuning the BERT classifier, and the rate of decrease in harmful responses is calculated. Where ΔH is the rate of decrease in harmful response, representing the percentage reduction in harmful response, and its value ranges from 0 to 1, N mal N refers to the total number of harmful responses generated by the tested large language model during the testing or observation period. total This refers to the total number of responses generated by the tested large language model within the same testing or observation period.

[0062] Honesty calculation based on Constitutional AI principles:

[0063] Construct a FactChecker-GPT model based on WikiData knowledge graph to quantify the illusion index H. score =|BERTfact-BERTout|2,H score BERT is the illusion index, used to quantify the difference between the output of a large language model and the facts, and to assess the degree of illusion of the large language model. BERTfact is the semantic vector of the factual text, representing real and credible information. BERTout is the semantic vector of the output of the large language model under test, representing the content generated by the model. The |·|2 operation calculates the Euclidean distance between two vectors, measuring the difference between the vectors in the semantic space.

[0064] Computational aids based on Constitutional AI principles:

[0065] The RAG task test set is used to evaluate the completion of the test task, and the help decay ratio is defined:

[0066]

[0067] HDR stands for Helpful Attenuation Ratio, which measures the degree of attenuation of helpfulness of the tested large language model when it is subjected to interference. The value ranges from 0 to 1, where 0 indicates no attenuation and 1 indicates that the helpfulness is almost completely lost. Recall @10adv is the recall rate of the tested large language model in the top 10 results under adversarial or interference conditions. Recall @10clean is the recall rate of the tested large language model in the top 10 results under ideal conditions without interference.

[0068] Using the rate of decrease in harmful response ΔH in harmlessness and the quantification of hallucination index H in honesty score And the auxiliary attenuation ratio HDR calculation for the safety alignment gap index SAGI:

[0069] SAGI = 0.5ΔH + 0.3H score +0.2HDR

[0070] Based on the Security Alignment Gap Index (SAGI) of the large language model, the intelligent judge identifies value drift when SAGI > 0.1, indicating severe value drift, and performs drift monitoring accordingly.

[0071]

[0072] DriftAlert is used to indicate whether a significant drift has been detected. A DriftAlert value of 1 indicates that a drift has been detected and the large language model under test needs to be retrained; a DriftAlert value of 0 indicates that no significant drift has been detected and the large language model under test can continue to operate normally.

[0073] Step 3: Create a multimodal joint defense engine that integrates steganalysis, syntax tree parsing, and audio anomaly detection functions to provide comprehensive threat detection coverage of text, code, images, and speech for the large language model under test.

[0074] Image steganalysis is performed using a fine-tuned STEGANALYSIS ResNet-50 model on the BOSSBase dataset, fused with an OCR recognition method. The formula used is:

[0075] ImageScore=0.6×StegScore+0.4×OCR

[0076] ImageScore represents the overall score of an image, indicating the comprehensive risk score of the presence of steganographic information in the image. StegScore is the steganographic feature score, and OCR is the proportion of recognizable text steganography.

[0077] Audio backdoor detection: Extract Mel-frequency cepstral coefficients (MFCCs) and input them into an LSTM anomaly detection network; combine with ASR content analysis.

[0078] Perform code obfuscation and cracking tests: Perform taint propagation analysis through Abstract Syntax Tree (AST) parsing, and support CWETop 25 vulnerability pattern recognition, such as CWE-79: Cross-Site Scripting (XSS).

[0079] This invention employs intelligent referencing to rapidly and comprehensively evaluate the output of the tested large language model, and drives the model's self-hardening based on the evaluation results, achieving closed-loop optimization. This invention integrates the results of dynamic attack generation, Security Alignment Evaluation (SAGI), and multimodal joint defense, forming an automated "test-evaluation-hardening" cycle.

[0080] Example 2

[0081] This invention also provides a security testing device for large language models based on evolving dynamic adversarial attacks, including an attack generation module, a security alignment evaluation module, and a multimodal joint defense module.

[0082] The attack generation module creates a dynamic attack generation engine, uses the dynamic attack generation engine to build an adversarial evolution architecture, and generates test samples based on the adversarial evolution architecture for large language model security testing. Specifically, the adversarial evolution architecture generates attack strategies through the attacker and generates attack test samples based on the attack strategies. The defender deploys the real-time response mode of the tested model under the attack strategy and attempts to thwart the attack. The adversarial interaction between the attacker and the defender ensures that the test samples effectively cover unknown threat patterns.

[0083] The Safety Alignment Assessment module calculates the assessment parameters of harmlessness, honesty, and helpfulness based on the ConstitutionalAI principle, and uses these parameters to calculate the Safety Alignment Gap Index (SAGI). Based on the SAGI, the intelligent judge assesses the value drift of the large-scale language model.

[0084] The multimodal joint defense module creates a multimodal joint defense engine that integrates steganalysis, syntax tree parsing, and audio anomaly detection functions to provide comprehensive threat detection coverage of text, code, images, and speech for the large language model under test.

[0085] The information interaction and execution process between the modules in the above-mentioned device are based on the same concept as the method embodiment of the present invention, and the specific details can be found in the description in the method embodiment of the present invention, and will not be repeated here.

[0086] Similarly, the advantages of the device of the present invention are:

[0087] By simulating real hacker attack paths through a dynamic attack generation engine, attack samples can evolve autonomously and continuously generate new and unknown threats, thus overcoming the lag of traditional static testing.

[0088] The Security Alignment Gap Index (SAGI) transforms abstract ethical principles such as harmlessness, honesty, and helpfulness into quantifiable indicators, enabling real-time monitoring of moral drift in the tested large language model.

[0089] By using a multimodal joint defense system, the modal barriers between text, images, audio, and code are broken down, and cross-media attack signals, such as image hiding instructions and audio backdoors, are scanned simultaneously to achieve collaborative defense.

[0090] In the short term, the device of this invention can be used as an efficient and safe testing tool to accelerate the deployment and certification of AI in high-risk fields.

[0091] The long-term deployment of a dynamic architecture allows for autonomous upgrades and defense against future threats such as quantum computing attacks and brain-computer interface security.

[0092] It should be noted that not all steps and modules in the above processes and device structures are mandatory; some steps or modules can be omitted as needed. The execution order of each step is not fixed and can be adjusted as required. The system structure described in the above embodiments can be a physical structure or a logical structure. That is, some modules may be implemented by the same physical entity, or some modules may be implemented by multiple physical entities, or they may be jointly implemented by certain components in multiple independent devices.

[0093] The above-described embodiments are merely preferred embodiments provided to fully illustrate the present invention, and the scope of protection of the present invention is not limited thereto. Equivalent substitutions or modifications made by those skilled in the art based on the present invention are all within the scope of protection of the present invention. The scope of protection of the present invention is defined by the claims.

Claims

1. A security testing method for large language models based on evolutionary dynamic adversarial attacks, characterized by: include: Step 1: Create a dynamic attack generation engine, build an adversarial evolution architecture using the dynamic attack generation engine, and generate test samples based on the adversarial evolution architecture for large language model security testing. Specifically, the adversarial evolution architecture generates attack strategies through the attacker and generates test samples of the attack based on the attack strategies. The defender deploys the real-time response mode of the model under test under the attack strategy and attempts to thwart the attack. The adversarial relationship between the attacker and the defender ensures that the test samples effectively cover unknown threat patterns. Step 2: Calculate the assessment parameters for harmlessness, honesty, and helpfulness based on the ConstitutionalAI principle, and use these parameters to calculate the Security Alignment Gap Index (SAGI). Then, based on the SAGI, intelligently judge the value drift of the large-scale language model. Step 3: Create a multimodal joint defense engine that integrates steganalysis, syntax tree parsing, and audio anomaly detection functions to provide comprehensive threat detection coverage of text, code, images, and speech for the large language model under test.

2. The method for security testing of large language models based on evolutionary dynamic adversarial attacks according to claim 1, characterized in that: In step 1, when generating test samples for the attack using the attacker according to the attack strategy, the gradient coordinate optimization algorithm (GCG) is used to generate adversarial perturbations. These perturbations are updated along the gradient direction of the loss function with respect to the perturbation at a certain learning rate, gradually generating more effective test samples. The formula used is: Explain the update method for counter-perturbation δ, δ t δ represents the adversarial perturbation generated in the t-th iteration. t+1 It is the adversarial perturbation after the (t+1)th iteration update, where η is the learning rate, controlling the step size of the perturbation update in each iteration. L represents the gradient of the perturbation δ. ce Let f(x+δ) be the cross-entropy loss function, representing the prediction result of the target model f on the input sample x+δ with added perturbation δ, where x is the original sample and y is the input sample. max The label that maximizes the cross-entropy loss function value.

3. A security testing method for large language models based on evolutionary dynamic adversarial attacks according to claim 1 or 2, characterized in that in step 1, the attack path is optimized by introducing a PPO policy network through an attacker, utilizing a reward function: Evaluate the merits of attack paths, ASR attack success rate, and measure the probability that an attack path successfully reaches its target. -λ·Detect The term is an exponential decay term used to penalize detected attack paths. Detect represents the probability or index of an attack being detected. λ is an adjustment parameter used to control the degree of influence of the detection probability on the reward function. The larger λ is, the greater the negative impact of the detection probability on the reward function. β is an adjustment parameter used to control the strength of the complexity penalty. Perp(δ) represents the complexity of the path or the degree of deviation from normal behavior, which is calculated by analyzing the differences between the characteristics of the attack path and the normal behavior pattern.

4. The security testing method for large language models based on evolutionary dynamic adversarial attacks according to claim 1, characterized in that: Step 1 involves deploying the test model's real-time response to the attack strategy using a defender. This includes deploying a triple real-time response defense mode: semantic rejection, obfuscated output, and anti-inducement traps. Semantic rejection is the most commonly used mode; when suspicious but not yet clearly harmful input intent is detected, the response is directly rejected. Obfuscated output: When input is deemed high-risk but the conversation needs to be maintained, provide ambiguous, harmless, or topic-shifting responses. Anti-trap is the highest level of defense. After actively identifying the attacker's intention to lure them, it simulates being hooked but actually outputs preset security content or implants misleading information, and even attempts to reverse-probe the attacker's identity and intentions.

5. A security testing method for large language models based on evolutionary dynamic adversarial attacks as described in claim 1, characterized in that: In step 2, harmlessness is calculated based on the ConstitutionalAI principle: the harmful content detection is performed by fine-tuning the BERT classifier, and the harmful response reduction rate is calculated. Where ΔH is the rate of decrease in harmful response, representing the percentage reduction in harmful response, and its value ranges from 0 to 1, N mal N refers to the total number of harmful responses generated by the tested large language model during the testing or observation period. total This refers to the total number of responses generated by the tested large language model within the same testing or observation period.

6. The method for security testing of large language models based on evolutionary dynamic adversarial attacks according to claim 1, characterized in that: In step 2, honesty is calculated based on the ConstitutionalAI principle: Construct a FactChecker-GPT model based on WikiData knowledge graph to quantify the illusion index H. score =|BERTfact-BERTout|2,H score BERT is the illusion index, used to quantify the difference between the output of a large language model and the facts, and to assess the degree of illusion of the large language model. BERTfact is the semantic vector of the factual text, representing real and credible information. BERTout is the semantic vector of the output of the large language model under test, representing the content generated by the model. The |·|2 operation calculates the Euclidean distance between two vectors, measuring the difference between the vectors in the semantic space.

7. A security testing method for large language models based on evolutionary dynamic adversarial attacks as described in claim 1, characterized in that: Step 2 calculates helpfulness based on the ConstitutionalAI principle: The RAG task test set is used to evaluate the completion of the test task, and the help decay ratio is defined: HDR stands for Helpful Attenuation Ratio, which measures the degree of attenuation of helpfulness of the tested large language model when it is subjected to interference. The value ranges from 0 to 1, where 0 indicates no attenuation and 1 indicates that the helpfulness is almost completely lost. Recall @10adv is the recall rate of the tested large language model in the top 10 results under adversarial or interference conditions. Recall @10clean is the recall rate of the tested large language model in the top 10 results under ideal conditions without interference.

8. A security testing method for large language models based on evolutionary dynamic adversarial attacks as described in claim 1, characterized in that... In step 2, the rate of decrease in harmful response ΔH in harmlessness and the quantification of hallucination index H in honesty are used. score And the auxiliary attenuation ratio HDR calculation for the safety alignment gap index SAGI: SAGI=0.5ΔH+0.3H score +0.2HDR Based on the Security Alignment Gap Index (SAGI) of the large language model, the intelligent judge identifies value drift when SAGI > 0.1, indicating severe value drift, and performs drift monitoring accordingly. DriftAlert is used to indicate whether a significant drift has been detected. A DriftAlert value of 1 indicates that a drift has been detected and the large language model under test needs to be retrained; a DriftAlert value of 0 indicates that no significant drift has been detected and the large language model under test can continue to operate normally.

9. A security testing device for large language models based on evolutionary dynamic adversarial attacks, characterized in that: Including attacks The module consists of a generation module, a security alignment assessment module, and a multimodal joint defense module. The attack generation module creates a dynamic attack generation engine, uses the dynamic attack generation engine to build an adversarial evolution architecture, and generates test samples based on the adversarial evolution architecture for large language model security testing. Specifically, the adversarial evolution architecture generates attack strategies through the attacker and generates attack test samples based on the attack strategies. The defender deploys the real-time response mode of the tested model under the attack strategy and attempts to thwart the attack. The adversarial interaction between the attacker and the defender ensures that the test samples effectively cover unknown threat patterns. The Safety Alignment Assessment module calculates the assessment parameters of harmlessness, honesty, and helpfulness based on the ConstitutionalAI principle, and uses these parameters to calculate the Safety Alignment Gap Index (SAGI). Based on the SAGI, the intelligent judge assesses the value drift of the large-scale language model. The multimodal joint defense module creates a multimodal joint defense engine that integrates steganalysis, syntax tree parsing, and audio anomaly detection functions to provide comprehensive threat detection coverage of text, code, images, and speech for the large language model under test.

Images