Mongolian-based malicious prompt dataset augmentation method

Abstract

The present application relates to the technical field of data expansion, in particular to a Mongolian-based malicious prompt data set expansion method. The present application can construct targeted malicious prompt samples by extracting high-frequency roots and affixes in the Mongolian basic malicious prompt corpus and the general corpus and combining morphological analysis, enhance the diversity and authenticity of the Mongolian security evaluation data set, optimize the candidate malicious prompt samples by using a genetic algorithm, make the expanded samples more consistent with the grammar and semantic rules of Mongolian, ensure the effectiveness of the attack samples in the Mongolian scene, enhance the robustness and adversariality of the expanded data set by using an adversarial generation strategy, simulate possible attack behaviors in real scenarios, and thus provide an effective sample generation tool for security evaluation in the Mongolian scene, and improve the anti-attack ability of the Mongolian model.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of data expansion, in particular to a malicious prompt data set expansion method based on Mongolian. BACKGROUND

[0002] In recent years, China has made rapid progress in the field of large language models. With the widespread deployment of large language models in various applications, more and more security problems have become increasingly prominent, especially jailbreaking attacks. Jailbreaking attack refers to bypassing the built-in security measures of the model to make it output harmful, illegal or inappropriate content. Such attacks not only endanger the safety and privacy of users, but also may have more extensive negative impacts on society. In low-resource language environments, the harm of large model jailbreaking attacks is particularly prominent. These languages have fewer users worldwide, resulting in great challenges in data collection, corpus organization, and model training. The effectiveness and security of large models often rely on massive, diverse, and high-quality corpus data as support. Therefore, the lack of generalization ability due to data scarcity in low-resource languages makes the model prone to understanding bias, insufficient generation ability, and weak defense against attacks, thus providing opportunities for attackers.

[0003] Currently, there are many methods for constructing security evaluation data sets, which have achieved certain research results. However, most existing security evaluation data sets are based on high-resource languages such as English and Chinese. Common adversarial samples and prompt injection attack cases in high-resource languages are difficult to directly adapt to Mongolian scenarios. Moreover, there are almost no targeted attack samples designed based on the morphological characteristics of Mongolian agglutinative languages (such as complex suffixes and flexible word order). This makes it impossible to effectively verify the anti-attack ability of the model in real scenarios. SUMMARY

[0004] The main purpose of the present application is to provide a malicious prompt data set expansion method based on Mongolian, which aims to solve the technical problems in the prior art.

[0005] The present application proposes a malicious prompt data set expansion method based on Mongolian, which includes:

[0006] Obtain a Mongolian basic malicious prompt corpus and a Mongolian general corpus, and extract a high-frequency root set and a high-frequency affix set from the Mongolian general corpus;

[0007] Extract the core malicious semantic features of the Mongolian basic malicious prompt corpus, and perform morphological analysis on the core malicious semantic features using a Mongolian word segmentation model to obtain a malicious root subset and a malicious affix subset;

[0008] The malicious root subset is compared and screened with a high-frequency root set to obtain a replaceable root library, and the malicious affix subset is compared and screened with a high-frequency affix set to obtain a replaceable affix library;

[0009] A plurality of grammar compatibility coefficients are obtained according to the replaceable affix library and the replaceable root library, and an effective combination pair is screened from the replaceable affix library and the replaceable root library according to each grammar compatibility coefficient;

[0010] Each effective combination pair is subjected to semantic consistency verification, and a candidate malicious prompt sample that passes the verification is extracted, and the candidate malicious prompt sample is iteratively optimized through a genetic algorithm to generate an initial expansion sample set;

[0011] The initial expansion sample set is subjected to multi-dimensional filtering to obtain a preliminary optimization data set, and the preliminary optimization data set is enhanced by using an adversarial generation strategy to generate an adversarial expansion sample;

[0012] The adversarial expansion sample is combined with the preliminary optimization data set to obtain a final expansion data set.

[0013] Preferably, the step of morphologically analyzing the core malicious semantic feature by using a Mongolian word segmentation model to obtain a malicious root subset and a malicious affix subset comprises:

[0014] A plurality of Mongolian words are obtained according to the core malicious semantic feature, and each Mongolian word is input into a Mongolian segmentation model for morphological splitting to obtain a corresponding candidate root and a candidate affix;

[0015] The root appearance probability of each candidate root and the semantic correlation degree between each candidate root and the core malicious semantic feature are obtained, and the effectiveness score of the corresponding candidate root is obtained according to each root appearance probability and semantic correlation degree;

[0016] It is judged whether the effectiveness score of each candidate root is greater than a first preset score threshold;

[0017] If the effectiveness score is greater than the first preset score threshold, the candidate root is included in an initial malicious root set;

[0018] The semantic category of the core malicious semantic feature is obtained, and the initial malicious root set is subjected to semantic filtering and screening according to the semantic category to obtain a malicious root subset;

[0019] The vowel attribute matching degree and the grammar rule compliance degree of each candidate affix are obtained, and the compatibility score of the corresponding candidate affix is obtained according to each vowel attribute matching degree and grammar rule compliance degree;

[0020] determining whether the compatibility score of each of the candidate affixes is greater than a second preset score threshold value;

[0021] If the compatibility score of the candidate affix is greater than the second preset score threshold value, the candidate affix is included in the initial malicious affix set;

[0022] Obtaining the affix category of the core malicious semantic feature, and functionally filtering the initial malicious affix set according to the affix category to obtain a malicious affix subset.

[0023] Preferably, the step of comparing the malicious root subset with the high-frequency root set to obtain a replaceable root library comprises:

[0024] Respectively obtaining the malicious semantic vector, the malicious core syllable sequence and the malicious part-of-speech label of each malicious root in the malicious root subset, and the high-frequency semantic vector and the high-frequency part-of-speech label of each high-frequency root in the high-frequency root set;

[0025] Filtering the high-frequency roots corresponding to the high-frequency part-of-speech labels consistent with the malicious part-of-speech label from the plurality of high-frequency part-of-speech labels as the same part-of-speech candidate roots, and obtaining the same part-of-speech semantic vector and the same part-of-speech core syllable sequence of each of the same part-of-speech candidate roots;

[0026] According to each of the same part-of-speech core syllable sequence and the malicious core syllable sequence, the edit distance of the corresponding same part-of-speech candidate root and the malicious root is obtained, and according to each of the edit distance, the first morphological similarity is obtained;

[0027] According to each of the same part-of-speech semantic vector and the malicious semantic vector, the corresponding first cosine similarity is obtained, and according to each of the first cosine similarity and the first morphological similarity, the corresponding first comprehensive matching degree is obtained;

[0028] Determining whether each of the first comprehensive matching degrees is greater than a first preset matching degree;

[0029] If the first comprehensive matching degree is greater than the first preset matching degree, the same part-of-speech candidate root corresponding to the first comprehensive matching degree is included in the replaceable root library.

[0030] Preferably, the step of obtaining a plurality of grammatical compatibility coefficients according to the replaceable affix library and the replaceable root library, and filtering out an effective combination pair from the replaceable affix library and the replaceable root library according to each of the grammatical compatibility coefficients comprises:

[0031] obtaining the affix morphological attribute and the affix grammatical attribute of each same-function candidate affix in the replaceable affix library and the root morphological attribute and the root grammatical attribute of each same-part-of-speech candidate root in the replaceable root library, and obtaining a vowel harmony matching value according to the ending vowel type of each affix morphological attribute and the initial vowel type of the root morphological attribute;

[0032] obtaining a consonant-vowel connection fitness according to the initial connecting vowel of each affix morphological attribute and the ending consonant type of the root morphological attribute, and obtaining a corresponding morphological compatibility score according to each consonant-vowel connection fitness and vowel harmony matching value;

[0033] obtaining a function correlation degree according to the affix function of each affix grammatical attribute and the commonly-used collocation affix type of the root grammatical attribute, obtaining a part-of-speech matching degree according to the applicable part-of-speech range of each affix grammatical attribute and the part-of-speech of the root grammatical attribute, and obtaining a corresponding grammatical fitness score according to each part-of-speech matching degree and function correlation degree;

[0034] obtaining a first common occurrence probability and a second common occurrence probability of each same-function candidate affix and same-part-of-speech candidate root in the Mongolian basic malicious prompt corpus and the Mongolian general corpus respectively, and obtaining a malicious scene fitness according to each first common occurrence probability and second common occurrence probability;

[0035] obtaining a semantic correlation strength according to the semantic direction of each affix grammatical attribute and the semantic category of the root grammatical attribute, and obtaining a corresponding semantic compatibility score according to each semantic correlation strength and malicious scene fitness;

[0036] obtaining a grammatical compatibility coefficient of each same-function candidate affix and same-part-of-speech candidate root according to each semantic compatibility score, grammatical fitness score and morphological compatibility score, and judging whether each grammatical compatibility coefficient is greater than a preset threshold coefficient;

[0037] if the grammatical compatibility coefficient is greater than the preset threshold coefficient, determining that the same-function candidate affix and same-part-of-speech candidate root corresponding to the grammatical compatibility coefficient are an effective combination pair.

[0038] Preferably, the step of performing semantic consistency verification on each effective combination pair and extracting a candidate malicious prompt sample that passes the verification, comprises:

[0039] splicing the same-function candidate affix and same-part-of-speech candidate root in each effective combination pair to generate a combined vocabulary and obtaining a morphological variation feature of each combined vocabulary, and obtaining a corresponding initial semantic vector according to each morphological variation feature;

[0040] Obtaining original malicious prompt samples, and obtaining a benchmark semantic vector and an extended benchmark semantic vector of a malicious root word in a corresponding original malicious prompt sample according to a same word nature candidate root word in each of the valid combinations;

[0041] Obtaining a corresponding second cosine similarity according to each of the benchmark semantic vectors and the initial semantic vector, and judging whether each of the second cosine similarities is greater than a first semantic threshold;

[0042] If the second cosine similarity is greater than the first semantic threshold, a combination vocabulary corresponding to the second cosine similarity is included in a primary candidate vocabulary set;

[0043] Obtaining an extended semantic vector of each combination vocabulary in the primary candidate vocabulary set according to a context association feature of each of the combination vocabularies;

[0044] Obtaining a corresponding third cosine similarity according to each of the extended semantic vectors and the extended benchmark semantic vector, and judging whether each of the third cosine similarities is greater than a second semantic threshold;

[0045] If the third cosine similarity is greater than the second semantic threshold, a combination vocabulary corresponding to the third cosine similarity is included in a secondary candidate vocabulary set;

[0046] Replacing a corresponding root word and affix in the original malicious prompt sample with a combination vocabulary in the secondary candidate vocabulary set to obtain a corresponding initial malicious prompt sample, and obtaining a syntactic structure tree of each initial malicious prompt sample;

[0047] Obtaining a corresponding syntactic consistency score and a malicious probability value according to each of the syntactic structure trees, and obtaining a corresponding comprehensive semantic consistency score according to each of the syntactic consistency scores and the malicious probability values;

[0048] Judging whether each of the comprehensive semantic consistency scores is greater than a preset score threshold;

[0049] If the comprehensive semantic consistency score is greater than the preset score threshold, an initial malicious prompt sample corresponding to the comprehensive semantic consistency score is marked as a candidate malicious prompt sample that passes the test.

[0050] As preferred, the step of obtaining a preliminary optimization dataset by performing multi-dimensional filtering on the initial expansion sample set, and enhancing the preliminary optimization dataset by using an adversarial generation strategy to generate an adversarial expansion sample, includes:

[0051] Obtaining syntactic structure data of each sample in the initial expansion sample set, and obtaining a corresponding syntactic integrity index according to the syntactic structure data;

[0052] screening samples with complete syntax structure from the initial expanded sample set according to the syntax integrity index to obtain a syntax filtered subset, and obtaining semantic redundancy between samples according to the semantic feature vector of each sample in the syntax filtered subset;

[0053] removing duplicate samples in the syntax filtered subset according to the semantic redundancy to obtain a semantic deduplicated subset, and performing category balance verification according to the malicious category of each sample in the semantic deduplicated subset;

[0054] screening samples that pass the category balance verification from the semantic deduplicated subset to obtain a preliminary optimized dataset, and obtaining the root sequence, affix combination and word order structure of each sample in the preliminary optimized dataset;

[0055] obtaining root replacement adversarial samples according to the root sequence, and obtaining affix tampering adversarial samples according to the affix combination;

[0056] obtaining word order permutation adversarial samples according to the word order structure, and fusing the root replacement adversarial samples, the affix tampering adversarial samples and the word order permutation adversarial samples to generate adversarial expanded samples.

[0057] The application also provides a Mongolian-based malicious prompt dataset expansion system, comprising:

[0058] The extraction module is configured to obtain a Mongolian basic malicious prompt corpus and a Mongolian general corpus, and extract a high-frequency root set and a high-frequency affix set of the Mongolian general corpus;

[0059] The analysis module is configured to extract core malicious semantic features of the Mongolian basic malicious prompt corpus, and perform morphological analysis on the core malicious semantic features by using a Mongolian word segmentation model to obtain a malicious root subset and a malicious affix subset;

[0060] The comparison and screening module is configured to compare and screen the malicious root subset with the high-frequency root set to obtain a replaceable root library, and compare and screen the malicious affix subset with the high-frequency affix set to obtain a replaceable affix library;

[0061] The screening module is configured to obtain a plurality of syntax compatibility coefficients according to the replaceable affix library and the replaceable root library, and screen an effective combination pair from the replaceable affix library and the replaceable root library according to each syntax compatibility coefficient;

[0062] The verification and optimization module is configured to perform semantic consistency verification on each effective combination pair and extract a candidate malicious prompt sample that passes the verification, and perform iterative optimization on the candidate malicious prompt sample by using a genetic algorithm to generate an initial expanded sample set;

[0063] The filtering and enhancing module is configured to perform multi-dimensional filtering on the initial expanded sample set to obtain a preliminary optimized data set, and perform enhancement on the preliminary optimized data set by using an adversarial generation strategy to generate adversarial expanded samples.

[0064] The merging module is configured to merge the adversarial expanded samples with the preliminary optimized data set to obtain a final expanded data set.

[0065] Preferably, the filtering and enhancing module comprises an acquisition unit configured to acquire syntax structure data of each sample in the initial expanded sample set, and acquire a corresponding syntax integrity index according to the syntax structure data.

[0066] The first screening unit is configured to screen samples with complete syntax structure from the initial expanded sample set according to the syntax integrity index to obtain a syntax filtered subset, and acquire semantic redundancy between samples according to semantic feature vectors of each sample in the syntax filtered subset.

[0067] The removing unit is configured to remove redundant samples in the syntax filtered subset according to the semantic redundancy to obtain a semantic deduplicated subset, and perform category balance verification according to malicious categories of each sample in the semantic deduplicated subset.

[0068] The second screening unit is configured to screen samples that pass the category balance verification from the semantic deduplicated subset to obtain the preliminary optimized data set, and acquire a root sequence, a combination of affixes and a word order structure of each sample in the preliminary optimized data set.

[0069] The replacing unit is configured to acquire root replacement adversarial samples according to the root sequence, and acquire affix tampering adversarial samples according to the combination of affixes.

[0070] The fusion unit is configured to acquire word order permutation adversarial samples according to the word order structure, and fuse the root replacement adversarial samples, the affix tampering adversarial samples and the word order permutation adversarial samples to generate the adversarial expanded samples.

[0071] The application further provides a computer device comprising a memory and a processor, wherein the memory stores a computer program, and the processor implements the steps of the Mongolian-based malicious prompt data set expansion method when executing the computer program.

[0072] The application further provides a computer readable storage medium having a computer program stored thereon, wherein the computer program is executed by a processor to implement the steps of the Mongolian-based malicious prompt data set expansion method.

[0073] The Mongolian language is a language with a long history and a large number of users, and the security of the Mongolian language model is also an important research direction in the field of natural language processing. The Mongolian language model is a model that can understand and generate Mongolian language text, and it is widely used in many fields such as information retrieval, machine translation, and speech recognition. However, the Mongolian language model is vulnerable to attacks, and the security of the Mongolian language model is an important research direction in the field of natural language processing. The present application can construct a targeted malicious prompt sample by extracting high-frequency roots and affixes in the Mongolian basic malicious prompt corpus and the general corpus, and combining morphological analysis, which can enhance the diversity and authenticity of the Mongolian security evaluation dataset. By using genetic algorithm to optimize the candidate malicious prompt sample, the expanded sample is more consistent with the grammar and semantic rules of the Mongolian language, which ensures the effectiveness of the attack sample in the Mongolian language scene. By using the adversarial generation strategy to enhance the expanded dataset, the robustness and adversarialness of the dataset are improved, which can simulate the attack behavior that may occur in the real scene, thereby not only providing an effective sample generation tool for security evaluation in the Mongolian language scene, but also improving the anti-attack ability of the Mongolian language model, and providing a new idea and technical support for language-specific security dataset expansion, which is helpful to promote the security research and technical application in the field of Mongolian language. BRIEF DESCRIPTION OF DRAWINGS

[0074] Figure 1 The method flowchart of an embodiment of the present application.

[0075] Figure 2 The system structure diagram of an embodiment of the present application.

[0076] Figure 3 The internal structure diagram of the computer device of an embodiment of the present application.

[0077] Figure 4 The Mongolian language segmentation model structure diagram of an embodiment of the present application.

[0078] The implementation of the object of the present application, functional characteristics and advantages will be further described with reference to the drawings. DETAILED DESCRIPTION

[0079] It should be understood that the specific embodiments described herein are only used to explain the present application, and are not used to limit the present application.

[0080] As shown in the Figure 1 application provides a Mongolian-based malicious prompt dataset expansion method, which comprises:

[0081] S1, obtaining a Mongolian basic malicious prompt corpus and a Mongolian general corpus, and extracting a high-frequency root set and a high-frequency affix set of the Mongolian general corpus;

[0082] S2, extracting the core malicious semantic features of the Mongolian basic malicious prompt corpus, and using a Mongolian word segmentation model to perform morphological analysis on the core malicious semantic features to obtain a malicious root subset and a malicious affix subset;

[0083] S3, screening the malicious root subset and the high-frequency root set to obtain a replaceable root library, and screening the malicious affix subset and the high-frequency affix set to obtain a replaceable affix library;

[0084] S4, obtaining a plurality of syntax compatibility coefficients according to the replaceable affix library and the replaceable root library, and screening out effective combination pairs from the replaceable affix library and the replaceable root library according to each syntax compatibility coefficient;

[0085] S5, performing semantic consistency verification on each effective combination pair and extracting a candidate malicious prompt sample that passes the verification, and generating an initial expansion sample set by iteratively optimizing the candidate malicious prompt sample through a genetic algorithm;

[0086] S6, performing multi-dimensional filtering on the initial expansion sample set to obtain a preliminary optimization data set, and generating an adversarial expansion sample by enhancing the preliminary optimization data set using an adversarial generation strategy;

[0087] S7, combining the adversarial expansion sample with the preliminary optimization data set to obtain a final expansion data set.

[0088] As described in steps S1-S2 above, most of the existing malicious prompt corpora in the prior art are from languages such as English and Chinese, and the uniqueness of Mongolian (such as rich suffixes and flexible word order) makes the malicious prompts in the existing corpora cannot be directly used. By constructing a special corpus for Mongolian, the adaptability and effectiveness of the trained model to the Mongolian environment can be ensured. High-frequency roots and affixes are basic constituent elements in Mongolian. Mastering these roots and affixes can help to identify and generate malicious prompts. By extracting the high-frequency root and affix set from the general corpus, the computational complexity and irrelevant information can be effectively reduced, thereby improving the efficiency and accuracy of the system. The core semantic features of malicious prompts are often closely related to malicious intent and can reflect the intent and pattern of malicious attacks. By extracting these features from the Mongolian basic malicious prompt corpus, the core semantic features of malicious prompts can be effectively extracted, making the generated malicious samples more attackable and stealthy, and better simulating real attack behavior. Using a Mongolian word segmentation model to morphologically analyze the core malicious semantic features can accurately extract malicious roots and affixes, thereby accurately identifying transformed words in malicious prompts, and effectively avoiding misidentification due to the complexity of the language. Unlike traditional malicious prompt recognition methods based on fixed vocabulary, the present application uses a morphological analysis model that can accurately process the special grammatical structure of Mongolian, which enables the system to more accurately recognize and construct malicious prompt samples in the Mongolian environment, enhancing the adaptability and accuracy of the model.

[0089] As described in steps S3-S4 above, the existing malicious prompt generation often only relies on fixed malicious vocabulary and does not consider substitution, while the present application can filter out irrelevant or infrequently used vocabulary by comparing malicious roots and high-frequency roots and malicious affixes and high-frequency affixes, ensuring that the generated malicious prompts are more representative and aggressive, and the screened replaceable root library and replaceable affix library provide more extensive replacement options for subsequent malicious prompt generation, and by constructing a replacement library of roots and affixes, a variety of malicious prompts can be generated flexibly, which not only increases the concealment of the attack, but also effectively improves the diversity and robustness of the model; traditional malicious prompt generation methods often ignore grammar compatibility and semantic consistency, resulting in prompts that do not conform to language standards and may lose attack effectiveness. The grammar compatibility coefficient is a quantitative indicator of the grammatical compatibility of roots and affixes, and the grammar compatibility coefficient can help measure whether the combination of roots and affixes conforms to the grammar structure of Mongolian.

[0090] As described in step S5 above, the step of generating an initial expanded sample set by iteratively optimizing candidate malicious prompt samples using a genetic algorithm includes obtaining the semantic feature vector, grammar structure tree, and malicious intensity score of each sample in the candidate malicious prompt sample set, constructing an initial population fitness evaluation benchmark based on the semantic feature vector, calculating the initial fitness value of each sample based on the fitness evaluation benchmark, and selecting a parent sample set using roulette selection based on the initial fitness value, generating a child sample set by performing a crossover operation based on the grammar structure tree of the parent sample set, and performing a mutation operation based on the malicious intensity score of the child sample set, constructing a new generation population based on the child sample set after the mutation operation and the high fitness samples in the parent sample set, and calculating the average fitness value of the new generation population in real time, determining whether the average fitness value meets the preset convergence threshold, if so, stopping iteration and taking the current population as the initial expanded sample set; if not, repeating the selection, crossover, and mutation steps until the convergence condition is met; genetic algorithm is an optimization method that can simulate natural selection and evolution, and is suitable for handling optimization problems with high complexity. In the process of optimizing malicious prompt samples, iterative optimization using genetic algorithm can explore a number of malicious prompt samples with high attackability in a short time, thereby expanding the sample set. Unlike traditional manual generation or simple rule generation methods, genetic algorithm can find the optimal combination of malicious prompt samples through an adaptive evolution process, making the generated samples more diverse and aggressive, thereby enhancing the system's ability to detect malicious prompts. Semantic consistency verification ensures that the generated malicious prompts are semantically reasonable and aggressive, and by selecting combinations that meet the grammar and semantics, more effective and meaningful malicious prompt samples can be generated, thereby ensuring that the generated malicious prompts meet the grammar requirements and are aggressive, improving the effectiveness and reliability of the malicious prompts.

[0091] As described in steps S6-S7 above, the traditional malicious prompt data set generally lacks adversarial samples and cannot comprehensively evaluate the performance of the model in the face of real attacks, which may cause the model to fail to identify more complex adversarial attack samples. The present application can remove redundant and low-quality samples through multi-dimensional filtering, only retaining high-quality samples that meet the attack pattern under multiple indicators, thereby improving the quality of the training data set and enabling the model to focus more on samples with high attackability. The multi-dimensional filtering can effectively improve the quality of the data set and further optimize the malicious prompt samples, thereby improving the recognition and defense capabilities of the model. The adversarial generation strategy generates samples that can confuse the model by simulating the behavior of attackers. This strategy can effectively enhance the attackability of the generated samples, enabling the system to maintain strong defense capabilities in the face of complex adversarial attacks. By introducing the adversarial generation strategy, more covert and efficient attack samples can be generated, improving the anti-attack ability of the system. By merging the adversarial expansion samples and the preliminary optimized data set, it can ensure that the generated data set contains not only real attack samples but also optimized adversarial samples, thereby providing more comprehensive and accurate training data and enabling the model to be trained closer to the real attack scenario, improving its effectiveness and robustness in practical applications.

[0092] In one embodiment, the step S2 of performing morphological analysis on the core malicious semantic feature using a Mongolian word segmentation model to obtain a malicious root subset and a malicious affix subset comprises:

[0093] S21, obtaining a plurality of Mongolian words according to the core malicious semantic feature, and inputting each Mongolian word into a Mongolian segmentation model for morphological splitting to obtain corresponding candidate roots and candidate affixes;

[0094] S22, obtaining a root appearance probability of each candidate root and a semantic correlation degree between each candidate root and the core malicious semantic feature, and calculating an effectiveness score of the corresponding candidate root by weighted summation according to the root appearance probability and the semantic correlation degree;

[0095] S23, determining whether the effectiveness score of each candidate root is greater than a first preset score threshold;

[0096] If the effectiveness score is greater than the first preset score threshold, the candidate root is included in the initial malicious root set;

[0097] S24, obtaining a semantic category of the core malicious semantic feature, and performing semantic filtering and screening on the initial malicious root set according to the semantic category to obtain a malicious root subset;

[0098] S25, obtain the vowel attribute matching degree and the grammar rule compliance degree of each candidate affix, and obtain the compatibility score of the corresponding candidate affix by weighted summation according to each of the vowel attribute matching degree and the grammar rule compliance degree;

[0099] S26, judge whether the compatibility score of each of the candidate affixes is greater than a second preset score threshold;

[0100] If the compatibility score of the candidate affix is greater than the second preset score threshold, the candidate affix is included in the initial malicious affix set;

[0101] S27, obtain the affix category of the core malicious semantic feature, and perform functional filtering and screening on the initial malicious affix set according to the affix category to obtain a malicious affix subset.

[0102] As described in steps S21-S22, as shown in the figure, Figure 4 As described in steps S21-S22, as shown in the figure,

[0103] The root appearance probability is the ratio of the number of occurrences of the root in the Mongolian general corpus to the total number of roots, the semantic correlation degree is the first cosine similarity of the root and the core malicious semantic feature, the first cosine similarity can be calculated through the pre-trained Mongolian word vector, and the vowel harmony degree is the matching degree of the vowel attributes of the affix and the root (1 point is matched for positive vowel, 1 point is matched for negative vowel, and 0 points are matched for no matching); Since Mongolian is a typical agglutinative language, its word form is complex, and the suffix changes a lot, direct lexical analysis will face great challenges, and the application can dynamically generate a Mongolian word set without relying on a fixed vocabulary, thereby better coping with the rich vocabulary and expression of Mongolian, and avoiding the loopholes caused by the fixed vocabulary or rules in the traditional method. The vocabulary of Mongolian is diverse, and the core malicious semantic feature can accurately describe the semantic level behind the vocabulary, so it can more effectively capture potential malicious behavior, by inputting each Mongolian word into a Mongolian segmentation model for morphological splitting, the root and affix can be accurately extracted, and the special Mongolian segmentation model ensures the accurate disassembly of the vocabulary at the morphological level, thereby providing higher accuracy and reliability for subsequent analysis; Simply relying on the frequency of the root or simple dictionary matching in the selection process of the malicious root may lead to a large number of irrelevant or misjudgment results, the application obtains the root appearance probability of each candidate root, and calculates the semantic correlation degree in combination with the core malicious semantic feature, which can effectively improve the relevance of the candidate root, by comprehensively considering the frequency of the root and its relevance to the malicious semantic, irrelevant roots are filtered out, the misjudgment rate is effectively reduced, and the accuracy of malicious behavior detection is improved. Compared with the common frequency-based or fixed rule-based method in the prior art, the innovation of this step is to make a comprehensive judgment in combination with the semantic level, which can better adapt to the complexity and diversity of Mongolian, by weighting and summing the appearance probability and semantic correlation degree of the candidate root, a more accurate effectiveness score can be obtained, the probability information of the root appearance and the relevance of the semantic level are fully utilized, so that the root with truly malicious nature can be more accurately screened out, thereby greatly improving the accuracy of malicious root identification.

[0104] As described in steps S23-S25 above, the degree of compliance of the grammatical rule is the matching degree of the affix attachment position and the corresponding root part of speech, which is the core index for determining whether the candidate affix and the corresponding root are matched. Mongolian is a typical agglutinative language, and roots of different parts of speech need to be matched with functionally corresponding affixes. For example, nouns are matched with case affixes to show the grammatical role of the noun in the sentence, and verbs are matched with tense affixes to show the time state of the action. The core function of the case affix is to attach to the noun to clearly show the grammatical role of the noun in the sentence, and the case affix can only be attached to the noun. The core function of the tense affix is to attach to the verb to clearly show the time state of the action, and the tense affix can only be matched with the verb (or the root after verbalization), and cannot be matched with non-verb parts of speech such as nouns and adjectives. Therefore, when a noun is followed by a case affix, the degree of compliance of the grammatical rule is 1 point, and when a verb is followed by a tense affix, the degree of compliance of the grammatical rule is 1 point. Conversely, if they do not match, they get 0 points. The compatibility score of the candidate affix is the compatibility of the candidate affix and the corresponding candidate root. The semantic category refers to the semantic category or field to which the root belongs, which is a macroscopic classification of the semantics of the root. The semantic filtering of the malicious root subset includes calculating the average cosine similarity of the semantic vector of each root in the initial malicious root set and the semantic vector library constructed by the core malicious semantic features, and retaining the roots with an average cosine similarity greater than a predetermined similarity to obtain the malicious root subset. The function filtering of the malicious affix subset includes establishing a malicious intensifier affix dictionary containing affixes that can enhance negative, attack, insult, and other semantics, and calculating the functional similarity (i.e., the ratio of the number of affixes with the same grammatical function to the total number of functional affixes) of each affix in the initial malicious affix set and the affixes in the malicious intensifier affix dictionary. Retain the affixes with a functional similarity greater than a predetermined functional similarity to obtain the malicious affix subset.

[0105] In the prior art, many methods only rely on surface features such as word frequency or vocabulary matching, lacking deep semantic consideration, and the present application can effectively filter out those roots with lower scores and weaker association with malicious semantics by setting a first preset score threshold. The semantic category of the core malicious semantic feature can help filter out roots unrelated to malicious behavior in the malicious root set. By matching the malicious root with the semantic category of the core malicious semantic feature, more accurate roots directly related to malicious behavior can be screened out, thereby effectively improving the robustness of the model, avoiding noise interference, and more in line with the diversity of malicious semantics in actual scenarios. By obtaining the vowel attribute matching degree and grammar rule compliance degree of the candidate affix, it can be accurately judged whether the affix conforms to the language characteristics of Mongolian, and further screened out affixes with malicious potential. By introducing the matching degree evaluation of vowel attributes and grammar rules, the rationality and legality of each affix can be ensured, thereby improving the recognition ability of malicious affixes. By weighting and summing the vowel attribute matching degree and grammar rule compliance degree, a more accurate compatibility score can be obtained, thereby not only improving the accuracy of affix screening, but also ensuring that the complexity and grammar characteristics of Mongolian are fully considered.

[0106] As described in steps S26-S27 above, the affix category refers to the classification of affixes according to their function or grammatical role, reflecting the grammatical characteristics of Mongolian agglutinative language. By setting a second preset score threshold, the present application can effectively screen out affixes with higher compatibility scores and malicious potential. By introducing compatibility scores and threshold control, the screening of malicious affixes is more precise and in line with actual needs, ensuring the flexibility and accuracy of the system, thereby more effectively identifying malicious affixes and improving the protection capabilities of the entire malicious language model. Function filtering of affixes can further improve the model's ability to recognize malicious language. By combining the affix category of core malicious semantic features, the initial malicious affix set can be effectively filtered semantically, ensuring that only affixes related to malicious semantics are retained, thereby better adapting to the unique grammatical characteristics of Mongolian, and accurately improving the recognition ability of malicious affixes through function filtering, thereby enhancing the model's attack detection and protection capabilities.

[0107] In one embodiment, the step S3 of comparing the subset of malicious roots with the high-frequency root set to obtain a replaceable root library includes:

[0108] S31, respectively, obtain the malicious semantic vector, malicious core syllable sequence and malicious part-of-speech label of each malicious root in the subset of malicious roots, and the high-frequency semantic vector and high-frequency part-of-speech label of each high-frequency root in the high-frequency root set;

[0109] S32, filter out the high-frequency word root corresponding to the high-frequency word nature label consistent with the malicious word nature label from the plurality of high-frequency word nature labels as a same-word nature candidate root, and obtain a same-word nature semantic vector and a same-word nature core syllable sequence of each same-word nature candidate root;

[0110] S33, obtain the edit distance of the corresponding same-word nature candidate root and the malicious word root according to each same-word nature core syllable sequence and the malicious core syllable sequence, and obtain the first morphological similarity according to each edit distance;

[0111] S34, obtain the first cosine similarity according to each same-word nature semantic vector and the malicious semantic vector, and obtain the first comprehensive matching degree by weighted summation calculation according to each first cosine similarity and first morphological similarity;

[0112] S35, judge whether each first comprehensive matching degree is greater than a first preset matching degree;

[0113] If the first comprehensive matching degree is greater than the first preset matching degree, the same-word nature candidate root corresponding to the first comprehensive matching degree is included in the replaceable root library.

[0114] As described in steps S31-S32 above, wherein the core syllable sequence refers to the combination of syllables in the Mongolian root or affix that carries the core pronunciation and morphological features, is the basic phonetic unit that constitutes the vocabulary, the part-of-speech label refers to the classification label of the root or vocabulary according to the grammatical function, reflects the grammatical role of the vocabulary in the sentence, the malicious semantic vector, the malicious core syllable sequence and the malicious part-of-speech label of the malicious root can comprehensively capture the semantics, syllable structure and grammatical role of the malicious root, the malicious semantic vector of the malicious root can reflect its potential malicious nature, providing a basis for subsequent judgment of whether the root can generate an adversarial sample, the malicious core syllable sequence can help identify the pronunciation and form features of the root, and can enhance the language adaptability of the model, especially when facing complex language structures, obtaining the high-frequency semantic vector and high-frequency part-of-speech label of the high-frequency root set is through analyzing the usage frequency and grammatical role of high-frequency roots, capturing their commonality and grammatical rules in language, which provides a grammatical basis for subsequent screening of candidate roots with the same part-of-speech, ensuring that truly potential replacement roots are selected from the high-frequency root set; by selecting high-frequency roots corresponding to high-frequency part-of-speech labels consistent with the malicious part-of-speech label, ensuring that the candidate roots have the same grammatical role (such as noun, verb, etc.), thus ensuring that the generated adversarial sample is consistent with the malicious sample in grammatical structure, thus helping to control the grammatical consistency of the generated adversarial sample, preventing grammatical errors from causing unnatural samples, ensuring that the generated adversarial sample maintains maliciousness while not being invalidated due to grammatical mismatch, improving the model's adaptability to grammatical changes, especially for complex languages such as Mongolian. Through comprehensive semantic vector and syllable sequence analysis, not only the matching degree of the candidate root in the grammatical layer is ensured, but also its consistency in pronunciation and semantics is ensured, which makes the generation of adversarial samples not only reasonable in grammar, but also more threatening in semantics, making it more challenging for defense systems.

[0115] As described in steps S33-S35 above, the first cosine similarity is obtained by the ratio between the dot product of the malicious semantic vector and the homonymic semantic vector and the product of the modulus of the malicious semantic vector and the modulus of the homonymic semantic vector, the edit distance refers to the minimum number of editing operations (inserting, deleting, replacing characters) required to convert one character sequence into another character sequence, which is used to quantify the morphological difference between the two sequences, the edit distance is calculated by adding the number of inserted characters, the number of deleted characters and the number of replaced characters, the number of inserted characters refers to the number of characters required to be inserted to convert the malicious core syllable sequence into the homonymic core syllable sequence, the number of deleted characters refers to the number of characters required to be deleted, and the number of replaced characters refers to the number of characters required to be replaced, the morphological similarity refers to the similarity of the morphological structure (such as syllable sequence, character composition) of the root or affix in Mongolian, the first morphological similarity is calculated by subtracting the ratio of the edit distance and the length of the longest core syllable sequence from 1 after selecting the longest core syllable sequence from the malicious core syllable sequence and the homonymic core syllable sequence, after determining that the first comprehensive matching degree is greater than the first preset matching degree, the corresponding multiple homonymic candidate roots need to be included in the replaceable candidate root set first, and then the Mongolian grammar rule adaptability detection is performed on each homonymic candidate root in the replaceable candidate root set to determine whether it can form a grammatically correct combined word with a preset number of affixes in the malicious affix sub-set, if it can form a grammatically correct combined word with a preset number of affixes in the malicious affix sub-set, the root is retained in the replaceable candidate root set, otherwise it is excluded from the replaceable candidate root set, finally, the multiple homonymic candidate roots in the replaceable candidate root set are sorted in descending order according to the corresponding first comprehensive matching degree to obtain the replaceable root library.

[0116] The edit distance calculates the morphological difference between the same word candidate root and the malicious root, measures the spelling difference between the two, can help accurately evaluate the syllable similarity between the malicious root and the candidate root, and thus provides a quantitative index for subsequent morphological similarity calculation. The introduction of edit distance makes the calculation of morphological similarity more accurate. Edit distance provides a quantitative measurement method for the model, which can accurately analyze the morphological similarity between the roots, and improves the generation quality and diversity of the adversarial samples. The cosine similarity calculates the semantic similarity between the same word candidate root and the malicious root, which can quantify the similarity between the two in the semantic space and reflect the closeness of the candidate root and the malicious root in meaning, providing a basis for determining whether the malicious root can successfully generate an adversarial sample. Cosine similarity can avoid errors caused by morphological changes in the root, making the semantic similarity calculation more accurate. Weighted summation combines the morphological similarity and semantic similarity information, which can comprehensively evaluate the overall matching degree of the candidate root and the malicious root, making the adversarial sample generation more robust. Through threshold judgment, only candidate roots that meet the conditions can enter the replacement library, thereby avoiding inappropriate roots from interfering with the normal operation of the system, effectively controlling the quality of the replacement root library, and ensuring that the system only introduces candidate roots with high matching degree. By using comprehensive matching degree for screening, the candidate root is more suitable for the requirements of malicious sample generation, improving the accuracy of defense and the effectiveness of attack sample generation.

[0117] In one embodiment, the step S3 of comparing the subset of malicious affixes with the high-frequency affix set to obtain a replaceable affix library includes:

[0118] S36, respectively acquiring the malicious function label and the malicious form feature of each malicious affix in the subset of malicious affixes, and the high-frequency function label and the high-frequency form feature of each high-frequency affix in the high-frequency affix set;

[0119] S37, selecting the high-frequency affix corresponding to the high-frequency function label consistent with the malicious function label from the plurality of high-frequency function labels as a same-function candidate affix;

[0120] S38, analyzing the malicious use context of each malicious affix in the Mongolian basic malicious prompt corpus, and acquiring the corresponding malicious root part of speech type according to the malicious use context;

[0121] S39, analyzing the same-function use context of each same-function candidate affix in the Mongolian general corpus, and acquiring the corresponding same-function root part of speech type according to the same-function use context;

[0122] S310, obtain the number of common collocation root morphological types according to the plurality of malicious root morphological types and the functionally equivalent root morphological types, and obtain the number of all collocation root morphological types of each malicious root morphological type in the Mongolian basic malicious prompt corpus;

[0123] S311, obtain the morphological coincidence degree according to the ratio of the number of common collocation root morphological types to the number of all collocation root morphological types;

[0124] S312, respectively obtain the malicious vowel harmony rule, the malicious phoneme number, the malicious vowel attribute and the malicious consonant ending of each malicious affix, and the functionally equivalent vowel harmony rule, the functionally equivalent phoneme number, the functionally equivalent vowel attribute and the functionally equivalent consonant ending of the functionally equivalent candidate affix, and obtain the phoneme number difference rate according to the difference between the malicious phoneme number and the functionally equivalent phoneme number and the ratio of the malicious phoneme number;

[0125] S313, obtain the vowel attribute matching degree according to the malicious vowel attribute and the functionally equivalent vowel attribute, and obtain the consonant ending matching degree according to the malicious consonant ending and the functionally equivalent consonant ending;

[0126] S314, obtain the second morphological similarity by weighted sum calculation according to the difference between 1 minus the phoneme number difference rate and the weighted sum of the consonant ending matching degree and the vowel attribute matching degree;

[0127] S315, obtain the vowel harmony matching degree according to the malicious vowel harmony rule and the functionally equivalent vowel harmony rule, and obtain the second comprehensive matching degree by weighted sum according to the vowel harmony matching degree, the second morphological similarity and the morphological coincidence degree;

[0128] S316, judge whether each second comprehensive matching degree is greater than a second preset matching degree;

[0129] If the second comprehensive matching degree is greater than the second preset matching degree, the functionally equivalent candidate affix corresponding to the second comprehensive matching degree is included in the replaceable affix library.

[0130] As described in steps S36-S39, wherein the function label refers to the classification label of the affix according to the grammatical function, which reflects the role of the affix in lexical derivation or grammatical expression, the morphological label refers to the classification label of the morphological according to the grammatical function, which reflects the role of the morphological in lexical derivation or grammatical expression, the high-frequency morphological feature refers to the morphological feature of the root or affix with high frequency in the Mongolian general corpus, the malicious use context refers to the language environment such as the root type and sentence structure collocated with the malicious affix in the Mongolian malicious prompt corpus, and the malicious vowel harmony rule refers to the vowel attribute matching rule followed by the combination of the malicious affix and the root, which is one of the core morphological features of the Mongolian agglutinative language.

[0131] The prior art usually relies on single vocabulary matching or identification based on relatively simple text classification algorithms, which is difficult to handle the complex morphological changes and suffix structure in Mongolian, and the present application comprehensively identifies malicious function tags and morphological features, which helps to understand the multi-dimensional understanding of malicious affixes, improves the adaptability to complex scenarios, effectively improves the ability to capture the deep grammatical and semantic features of malicious affixes, and through the analysis of the function tags and morphological features of high-frequency affixes, common high-frequency affixes can be extracted from a large number of samples, by screening the affixes consistent with the function tags of malicious affixes from the high-frequency affixes, irrelevant or inefficient candidate affixes are avoided, by ensuring the consistency of the candidate affixes and the malicious function tags, the accuracy of the malicious affix replacement is improved, so as to more effectively resist attacks against specific functions, ensure that the replaced affix has the same attack effect, by analyzing the usage context of malicious affixes, their behavior patterns in actual language use can be deeply understood, and the context analysis of malicious affixes helps to capture their potential attack targets and usage rules, so as to accurately construct the corresponding malicious usage scenarios, by obtaining the part of speech type of the malicious root, the specific grammatical properties of the root can be determined, the grammatical and semantic consistency of the malicious affix replacement is improved, by adding context analysis to enhance the understanding of malicious usage, more accurate guidance can be provided for subsequent malicious affix replacement, by analyzing the usage context of the same function candidate affix, its usage in ordinary corpus can be identified, which not only helps to verify whether the candidate affix can normally adapt to the general usage of Mongolian, but also ensures that it has the same function as the malicious affix from the grammatical and semantic aspects.

[0132] If the malicious vowel attribute and the same-function vowel attribute are the same, the vowel attribute matching degree is 1, otherwise, the vowel attribute matching degree is 0; if the malicious consonant ending and the same-function consonant ending are the same, the consonant ending matching degree is 1; if the malicious consonant ending and the same-function consonant ending belong to the same pronunciation position, the consonant ending matching degree is 0.5; if the malicious consonant ending and the same-function consonant ending are all different, the consonant ending matching degree is 0. After judging that the second comprehensive matching degree is greater than the second preset matching degree, the corresponding multiple same-function candidate affixes are first included in the replaceable candidate affix set, and then the semantic influence degree of each same-part-of-speech candidate affix in the replaceable candidate affix set is tested. The test method is to generate a test vocabulary by combining the same-part-of-speech candidate affix with any root in the malicious root subset, to calculate the semantic deviation degree of the test vocabulary and the original malicious root combination vocabulary, and to judge whether the semantic deviation degree is greater than the preset deviation. If the semantic deviation degree is not greater than the preset deviation, the same-part-of-speech candidate affix is retained in the replaceable candidate affix set, otherwise, it is excluded from the replaceable candidate affix set. Finally, the same-part-of-speech candidate affixes in the replaceable candidate affix set are sorted in descending order of the second comprehensive matching degree to obtain the replaceable affix library. The semantic deviation degree is calculated by subtracting the dot product of the vector of the test vocabulary and the vector of the original malicious root combination vocabulary from the product of the modulus of the vector of the test vocabulary and the modulus of the vector of the original malicious root combination vocabulary.

[0133] The prior art generally ignores the phonological features of language, and direct replacement of affixes may result in unnatural pronunciation or detection by the detection system. The present application further strengthens the similarity of malicious affixes and same-function affixes in the grammatical structure by calculating the number of commonly combined root part-of-speech types and obtaining the part-of-speech coincidence degree, which helps to ensure the consistency of the replaced affix and the original malicious affix in the grammatical structure, thereby improving the effectiveness and linguistic rationality of the replaced malicious affix. By calculating the number of syllable difference rates, vowel attribute matching degrees, and consonant ending matching degrees, the similarity between two affixes in phonology can be quantified, thereby ensuring that the replaced affix not only matches in grammar but also does not deviate from the original attack sample in pronunciation, thereby ensuring its concealment and effectiveness. By calculating the second comprehensive matching degree through weighted summation, the syllable difference, vowel attribute, and consonant ending are considered comprehensively, further improving the overall matching degree of malicious affix replacement, and more accurately evaluating the adaptability between candidate affixes and malicious affixes, ensuring that the replaced affix meets the attack requirements and avoids grammatical or phonological anomalies. By judging whether the second comprehensive matching degree exceeds the preset matching degree, the best candidate affix is further selected as the final replaceable affix, thereby ensuring that only the most suitable replacement affix is retained, avoiding the interference of invalid affixes, and improving the attack effect and concealment of the entire attack sample.

[0134] In one embodiment, the step S4 of obtaining a plurality of grammar compatibility coefficients according to the replaceable affix library and the replaceable root library, and screening out valid combination pairs from the replaceable affix library and the replaceable root library according to each of the grammar compatibility coefficients comprises:

[0135] S41, obtaining the affix morphological attribute and the affix grammar attribute of each same-function candidate affix in the replaceable affix library and the root morphological attribute and the root grammar attribute of each same-part-of-speech candidate root in the replaceable root library, and obtaining a vowel harmony matching value according to the ending vowel type of each of the affix morphological attributes and the initial vowel type of the root morphological attribute;

[0136] S42, obtaining a consonant-vowel connection fitness according to the initial connecting vowel of each of the affix morphological attributes and the ending consonant type of the root morphological attribute, and obtaining a corresponding morphological compatibility score by weighted summation calculation according to each of the consonant-vowel connection fitness and the vowel harmony matching value;

[0137] S43, obtaining a function correlation degree according to the affix function of each of the affix grammar attributes and the commonly used collocation affix type of the root grammar attribute, obtaining a part-of-speech matching degree according to the applicable part of speech range of each of the affix grammar attributes and the part of speech of the root grammar attribute, and obtaining a corresponding grammar fitness score by weighted summation calculation according to each of the part-of-speech matching degree and the function correlation degree;

[0138] S44, obtaining a first common occurrence probability and a second common occurrence probability of each of the same-function candidate affix and the same-part-of-speech candidate root in the Mongolian basic malicious prompt corpus and the Mongolian general corpus respectively, and calculating a malicious scene fitness according to each of the first common occurrence probability and the second common occurrence probability, wherein the calculation formula is: E(SP) = [1 + G(TX1)] / [1 + G(TX2)] ; wherein E(SP) represents the malicious scene fitness, G(TX1) represents the first common occurrence probability, and G(TX2) represents the second common occurrence probability;

[0139] S45, obtaining semantic association strength according to semantic direction of each of the affix grammar attribute and semantic category of the root grammar attribute, and performing weighted summation calculation according to each of the semantic association strength and malicious scene adaptation degree to obtain corresponding semantic compatibility score;

[0140] S46, performing weighted summation calculation according to each of the semantic compatibility score, grammar adaptation degree score and morphological compatibility score to obtain grammar compatibility coefficient of the same function candidate affix and the same part of speech candidate root, and judging whether each of the grammar compatibility coefficient is greater than a preset threshold coefficient;

[0141] If the grammar compatibility coefficient is greater than the preset threshold coefficient, it is determined that the same function candidate affix and the same part of speech candidate root corresponding to the grammar compatibility coefficient are an effective combination pair.

[0142] As described in steps S41-S42, wherein the vowel harmony matching value is obtained by judging whether the ending vowel type of the affix morphological attribute and the initial vowel type of the root morphological attribute conform to the Mongolian vowel harmony rule, if both are positive vowels or both are negative vowels, the vowel harmony matching value is 1, if one is a neutral vowel and the other is a positive / negative vowel, the vowel harmony matching value is 0.5, otherwise, it is 0; the vowel-consonant connection adaptation degree is obtained by judging whether the ending consonant type of the root morphological attribute and the initial connecting vowel of the affix morphological attribute exist regular connecting phenomenon (follow the general, no special morphological change pronunciation rule, without changing the basic form of the consonant or vowel), if so, the adaptation degree is 1, if there is special connecting change (occurrence of consonant morphological change), the adaptation degree is 0.8, otherwise, it is 0.3; the vowel harmony matching value is a quantitative index for measuring whether the initial vowel type of the replaceable root and the ending vowel type of the replaceable affix conform to the vowel harmony rule in Mongolian, the vowel-consonant connection adaptation degree is an index describing the adaptation degree between the ending consonant type of the replaceable root and the initial connecting vowel of the replaceable affix in pronunciation and connecting rule, and the morphological compatibility score is an evaluation value of the replaceable root and the affix in morphological (pronunciation, spelling connection) compatibility, which is obtained by comprehensively evaluating the vowel harmony matching value and the vowel-consonant connection adaptation degree.

[0143] The application can fine match the compatibility of affixes and roots by obtaining the morphological attributes and syntactic attributes of each candidate affix and root in the replaceable affix library and root library, and through in-depth analysis of the morphological attributes of affixes and roots, ensure the coordination in morphology, Mongolian is an agglutinative language, with complex suffix changes and flexible word order, through detailed analysis of morphological attributes, it is helpful to capture and adapt these unique characteristics, thereby improving the language adaptability of the model, the combination rules of vowels and consonants in Mongolian are unique, the vowel harmony and consonant connection adaptation degree calculation is adopted, which can accurately simulate this language phenomenon, and then improve the morphological compatibility of affixes and roots, the existing technology usually ignores the phoneme matching problem in language, and the application effectively fills this gap, which is helpful to improve the accuracy of the model in the Mongolian language scene, the connection adaptation degree of vowels and consonants considers the phonological rules of language, so that the model can better understand and generate word combinations that conform to the characteristics of Mongolian, thereby improving the recognition and processing ability of the system to malicious input, the weighted scoring method can evaluate the actual adaptation of each candidate combination according to the morphological adaptation degree, so as to more accurately judge whether an effective word structure can be generated, through comprehensive evaluation of multiple phonological attributes, it can better adapt to the language characteristics of Mongolian, thereby improving the compatibility of the system in complex language scenarios, through morphological compatibility scoring, it is helpful to improve the anti-attack ability of the system when facing language interference, for example, it provides a strong judgment mechanism for non-standard combination of affixes or roots, reduces the possibility of model attack.

[0144] As described in the above steps S43-S46, wherein the first co-occurrence probability refers to the probability that a certain group of candidate affixes of the same function and candidate roots of the same part-of-speech co-occur in the Mongolian basic malicious prompt corpus, the second co-occurrence probability refers to the probability that a certain group of candidate affixes of the same function and candidate roots of the same part-of-speech co-occur in the Mongolian general corpus, the part-of-speech matching degree is determined by the applicable part-of-speech range of the affix grammatical attribute and the root grammatical attribute to determine whether the candidate affix of the same function can be collocated with the candidate root of the same part-of-speech, if it is a complete match, the part-of-speech matching value is 1, if it is a partial match, the part-of-speech matching value is 0.6, otherwise it is 0; the function correlation degree is calculated by the ratio of the co-occurrence frequency of the candidate root of the same part-of-speech with the same function affix in the Mongolian general corpus to the total occurrence frequency of the candidate root of the same part-of-speech in the Mongolian general corpus; the semantic association strength is obtained by the Mongolian semantic association dictionary, if the affix semantic direction is completely consistent with the root semantic category, the semantic association strength is 1, if it is partially associated, the semantic association strength is 0.5, otherwise it is 0; the function correlation degree is an index that measures the close degree of association between the commonly used collocation affix type of the replaceable root and the function of the replaceable affix, the part-of-speech matching degree is an index that measures the matching degree between the applicable part-of-speech range of the replaceable affix and the part-of-speech of the replaceable root, the grammatical adaptability score is an evaluation value of the compatibility of the replaceable root and the affix in the grammatical rules (part-of-speech collocation, function adaptation) by comprehensively considering the part-of-speech matching degree and the function correlation degree, the malicious scene adaptation degree is a bias index that measures the co-occurrence of the replaceable root and the affix in the malicious prompt corpus relative to the co-occurrence in the general corpus, the semantic association strength is an index that measures the degree of association between the semantic category of the replaceable root and the semantic direction of the replaceable affix based on the Mongolian semantic association dictionary, and the semantic compatibility score is an evaluation value of the compatibility of the replaceable root and the affix in the semantic level (semantic matching, scene adaptation) by comprehensively considering the semantic association strength and the malicious scene adaptation degree.

[0145] The prior art is generally based on a corpus of English or other high-resource languages, and it is difficult to effectively adapt to the unique challenges of Mongolian, and the prior art generally ignores the fine matching of functional association, but the present application can better simulate the grammatical structure in the language by explicitly considering the matching degree between the function and the part of speech of affixes and roots, especially in complex languages such as Mongolian, by introducing the functional association degree and the part of speech matching degree, the flexibility of Mongolian in grammar can be effectively dealt with, and the applicability of the system in dynamic scenarios is improved, and the weighted calculation of the functional association degree and the part of speech matching degree can simplify the matching process of complex grammar, so that the model can efficiently process different types of word combinations, especially in potential attacks to provide more efficient protection; The present application can more effectively detect security threats in a specific language environment by specifically constructing a malicious corpus of Mongolian, and by introducing the malicious corpus of Mongolian for adaptation degree calculation, more targeted data support can be provided for attack detection, thereby improving the malicious detection capability of the system in the Mongolian environment, and making up for the language limitations when evaluating security based on high-resource language models, providing an effective solution for attack evaluation of low-resource languages such as Mongolian; Unlike traditional methods that rely solely on grammatical rules, the present application takes into account the semantic level of vocabulary, so that the model not only evaluates grammatically, but also can adapt in depth at the semantic level, by comprehensively considering semantic association and malicious scenario adaptation degree, the recognition ability of the system to semantic misdirection and semantic deviation in malicious attacks can be effectively improved, and the protection capability of the system is enhanced, the semantic compatibility score helps the system better understand the semantic relationship between affixes and roots, and the recognition and processing capability of the model for potential malicious attacks is enhanced, especially in the complex Mongolian language environment, by comprehensively considering multiple score dimensions, the compatibility of affixes and roots can be evaluated from multiple angles, avoiding the misjudgment problem caused by single-dimensional evaluation, so that those combinations that truly conform to the grammatical, morphological and semantic rules in the Mongolian environment can be effectively screened out, thereby improving the processing accuracy of the model, and by comprehensively evaluating the grammatical compatibility coefficient, the effectiveness of affixes and roots can be better judged to ensure that the generated word combinations cannot be exploited by malicious attackers, and the security of the system is improved.

[0146] In one embodiment, the step S5 of performing semantic consistency verification on each of the valid combination pairs and extracting candidate malicious prompt samples that pass the verification includes:

[0147] S51, according to the morphological variation characteristics of each combination word and the Mongolian semantic mapping rule, an initial semantic vector corresponding to each combination word is obtained.

[0148] S52, obtain the original malicious prompt sample, and obtain the benchmark semantic vector and the extended benchmark semantic vector of the malicious root word in the corresponding original malicious prompt sample according to the same word nature candidate root word in each of the valid combinations;

[0149] S53, obtain the corresponding second cosine similarity according to each of the benchmark semantic vectors and the initial semantic vector, and determine whether each of the second cosine similarities is greater than a first semantic threshold;

[0150] If the second cosine similarity is greater than the first semantic threshold, the combined vocabulary corresponding to the second cosine similarity is included in the primary candidate vocabulary set;

[0151] S54, obtain the context association feature of each combined vocabulary in the primary candidate vocabulary set, and obtain the extended semantic vector of the corresponding combined vocabulary according to each of the context association features;

[0152] S55, obtain the corresponding third cosine similarity according to each of the extended semantic vectors and the extended benchmark semantic vector, and determine whether each of the third cosine similarities is greater than a second semantic threshold;

[0153] If the third cosine similarity is greater than the second semantic threshold, the combined vocabulary corresponding to the third cosine similarity is included in the secondary candidate vocabulary set;

[0154] S56, replace the corresponding root word and affix in the original malicious prompt sample with the combined vocabulary in the secondary candidate vocabulary set to obtain the corresponding initial malicious prompt sample, and obtain the syntactic structure tree of each initial malicious prompt sample;

[0155] S57, obtain the corresponding syntactic consistency score and malicious probability value according to each of the syntactic structure trees, and obtain the corresponding comprehensive semantic consistency score according to each of the syntactic consistency score and the malicious probability value;

[0156] S58, determine whether each of the comprehensive semantic consistency scores is greater than a preset score threshold;

[0157] If the comprehensive semantic consistency score is greater than the preset score threshold, the initial malicious prompt sample corresponding to the comprehensive semantic consistency score is marked as a candidate malicious prompt sample that passes the test.

[0158] As described in steps S51-S53, wherein the Mongolian word formation rule is a grammatical specification of the combination of roots and affixes in Mongolian to form words, including the connection order of affixes, vowel harmony rules, consonant change rules, etc., to ensure that the word formed after the concatenation of roots and affixes meets the morphological requirements of Mongolian, the combined word is formed by checking the vowel attributes of the same word class candidate root and the vowel attributes of the same function candidate affix, judging whether they can be matched according to the vowel harmony rule, if they can be matched, then the same function candidate affix is connected to the same word class candidate root according to the Mongolian affix connection order rule to form a combined word; the Mongolian semantic mapping rule refers to the corresponding relationship criterion between the morphological features and the semantics in Mongolian, which is used to infer the semantics expressed by the word according to the morphological structure of the word, this rule covers the association between different affixes and semantic changes, the semantic shift rule after the combination of roots and affixes, etc., the initial semantic vector is mapped from the morphological change characteristics to the corresponding semantic characteristics by the Mongolian semantic mapping rule, and the initial semantic vector of the combined word is generated based on the semantic characteristics obtained by mapping through a pre-trained Mongolian word vector model (such as a fastText model, with a word vector dimension of 100, a minimum word frequency of 5, a window size of 3, and a training iteration number of 50).

[0159] The present application can generate combined words that meet the grammatical features of Mongolian by concatenating candidate affixes of the same function with candidate roots of the same word class, can fully utilize the characteristics of the agglutinative language of Mongolian, can ensure that the generated words have rationality and diversity in morphology, and thus can better adapt to the Mongolian environment, can ensure that the semantic representation of the words is more in line with the semantic system of Mongolian by obtaining the initial semantic vector according to the morphological change characteristics of each combined word and the Mongolian semantic mapping rule, can provide more accurate references for subsequent similarity calculation by extracting the benchmark semantic vector of the malicious root and the extended benchmark semantic vector from the original malicious prompt sample, can effectively filter out candidate words with similar semantics to the malicious root by calculating the cosine similarity between the benchmark semantic vector and the initial semantic vector and setting a semantic threshold for screening, so as to reduce the interference of noise words and improve the quality of the primary candidate word set, thereby providing a more targeted word set for subsequent steps, and by obtaining the context association features of each candidate word and generating an extended semantic vector accordingly, the semantic changes of the words in actual use can be better captured, thereby the semantic differences of the words in different contexts can be more accurately reflected, the polysemy of the words can be better understood, and the detection accuracy of the malicious prompt sample can be improved.

[0160] As described in steps S51-S56, the application can further refine the quality of the candidate words by calculating the cosine similarity between the extended semantic vector and the extended reference semantic vector, and screening the secondary candidate word set by the semantic threshold. It can ensure that the finally selected words are highly consistent with the semantic features of the malicious sample, reduce the false positives and false negatives, and compared with the traditional method of not performing multi-level similarity screening in the prior art, this hierarchical screening method can more carefully grasp the semantic matching degree, improve the overall detection effect, by replacing the secondary candidate words into the original malicious prompt sample, and obtaining the syntactic structure tree, it can ensure that the replaced sample still maintains consistency at the syntactic level, so as to ensure the rationality of the syntactic structure while ensuring the semantic consistency, thereby improving the credibility and effectiveness of the detection result. Compared with the simple word replacement in the prior art, this method takes into account the syntactic structure, which can more comprehensively verify the changes of the malicious sample and improve the comprehensiveness and accuracy of the detection.

[0161] As described in steps S57-S58, the malicious probability value is obtained by converting the candidate malicious prompt sample into an input format recognizable by the model through preprocessing, inputting the preprocessed sample into a Mongolian malicious semantic recognition model (such as a pre-training model based on BERT-base-mongolian, the input of which is the token sequence of the sample), and the model outputs a value in the interval [0, 1] by extracting and analyzing the malicious features in the sample, which is the malicious probability value of the sample, where 1 represents high maliciousness and 0 represents no maliciousness; the syntactic consistency score is obtained by analyzing the grammatical relationship of the core components (subject, predicate, object) in the syntactic structure tree to determine whether the combination of word replacement causes the core grammatical relationship to change, if not, the syntactic consistency score is 1, if partially changed but does not affect the semantic expression, it is 0.6, otherwise it is 0, the malicious probability value is obtained by inputting the candidate malicious prompt sample into the Mongolian malicious semantic recognition model; the calculation method of the second cosine similarity and the third cosine similarity is the same as the calculation formula of the first cosine similarity, which is the ratio between the corresponding vector dot product and the corresponding vector modulus product.

[0162] The application can more comprehensively evaluate the malicious nature and semantic consistency of the candidate samples by comprehensively considering the syntactic consistency score and malicious probability value. This multi-dimensional evaluation method can avoid the deviation caused by a single indicator, ensure that the final detection result is more accurate and reliable, and better balance the semantic and syntactic factors to improve the overall detection effect compared with the traditional method relying on a single indicator. By judging whether the comprehensive semantic consistency score is greater than the preset threshold, only samples that meet high standards in terms of semantics and syntax can be marked as qualified malicious prompt samples, thereby greatly improving the accuracy and reliability of the detection and reducing false positives and false negatives. Compared with the single threshold judgment method in the traditional method, this multi-level and comprehensive judgment method can more comprehensively reflect the true characteristics of the samples and improve the overall detection capability.

[0163] In one embodiment, the step S6 of generating adversarial augmented samples by performing multi-dimensional filtering on the initial augmented sample set to obtain a preliminary optimized data set and using an adversarial generation strategy to enhance the preliminary optimized data set comprises:

[0164] S61, acquiring the syntactic structure data of each sample in the initial augmented sample set, and acquiring the corresponding syntactic integrity index according to the syntactic structure data;

[0165] S62, filtering out samples with complete syntactic structure from the initial augmented sample set according to the syntactic integrity index to obtain a syntactic filtering subset, and acquiring the semantic redundancy between samples according to the semantic feature vectors of each sample in the syntactic filtering subset;

[0166] S63, removing duplicate samples in the syntactic filtering subset according to the semantic redundancy to obtain a semantic deduplication subset, and performing category balance verification according to the malicious categories of each sample in the semantic deduplication subset;

[0167] S64, filtering out samples that pass the category balance verification from the semantic deduplication subset to obtain a preliminary optimized data set, and acquiring the root sequence, affix combination and word order structure of each sample in the preliminary optimized data set;

[0168] S65, acquiring root replacement adversarial samples according to the root sequence, and acquiring affix tampering adversarial samples according to the affix combination;

[0169] S66, acquiring word order permutation adversarial samples according to the word order structure, and fusing the root replacement adversarial samples, affix tampering adversarial samples and word order permutation adversarial samples to generate adversarial augmented samples.

[0170] As described in steps S61-S62, wherein the syntax integrity index is calculated by extracting the presence rate of subject-predicate-object core components, the completeness of dependency relationship chain, and the correctness rate of empty word collocation from the syntax structure data, and performing weighted summation calculation, the presence rate of core components is recorded as 1 when subject-predicate-object are all present, 0.6 when one is missing, and 0 when two or more are missing, the completeness of dependency relationship chain is recorded as 1 when all nodes in the syntax tree have clear dependency relationship, and is proportionally deducted when there are isolated nodes, the correctness rate of empty word collocation is the proportion of empty word and real word collocation that conforms to the grammar rules, and the semantic redundancy is obtained by extracting the semantic feature vector of each sample using a Mongolian pre-training sentence vector model (such as UlaanBERT) and calculating the cosine similarity of any two sample vectors; in most existing data set construction, syntax structure is usually not fully considered, especially in non-high resource languages, the accuracy and richness of syntax analysis is low, and the present application can deeply understand the grammar rules of the sample by obtaining the syntax structure data of each sample, providing more targeted basis for subsequent optimization and deduplication, the syntax structure data can help accurately capture the regularity and irregularity of language, especially for highly cohesive languages such as Mongolian, by analyzing its unique grammar structure, more detailed data support can be provided for subsequent optimization, effectively avoiding language bias, and the syntax integrity index is used to screen samples with complete syntax structure, in order to ensure that the samples in the data set have high-quality representation in grammar, and the syntax integrity directly affects the training effect of the language model, by defining the syntax integrity index, samples that conform to the language rules can be accurately screened, avoiding training interference caused by syntax errors, thereby ensuring the quality of the training set, by filtering incomplete syntax samples, the noise in the data set can be reduced, and the model's learning ability for grammar integrity and accuracy can be enhanced, by strictly screening the syntax integrity, the model can focus on the correct language structure, thereby improving its performance and stability in actual application, especially in Mongolian, which has high flexibility, by calculating the semantic redundancy, samples with high similarity can be effectively identified and removed, ensuring the diversity of the data set in semantics, removing semantic duplicate samples when constructing the data set can avoid model overfitting, and enhance its adaptability to different language variants and expression methods, which is particularly important in diversified Mongolian expressions.

[0171] As described in steps S63-S66 above, the category balance check is obtained by the ratio of the number of malicious category samples to the total number of samples, and the ratio between the maximum category proportion and the minimum category proportion is selected as the sample that passes the category balance check if it is less than the preset threshold; the root replacement adversarial sample is obtained by replacing the root of the target sample in the preliminary optimization dataset with a replacement root that is similar in semantic meaning but has subtle differences; the affix tampering adversarial sample is obtained by tampering with the functional affix in the target sample; and the syntax permutation adversarial sample is obtained by permuting the subject and object in the target sample and adjusting the adverbial position (the sample only retains a reasonable and smooth syntax). Removing duplicate samples in the syntactic filter subset through semantic redundancy can not only improve the diversity of the dataset, but also optimize the training efficiency. Through semantic deduplication, each sample can have unique semantic features, so that the model can be exposed to more diverse semantic information during training, improving its ability to respond to different contexts. Especially in the context of complex languages such as Mongolian, the balance check of malicious categories can avoid the bias of categories in the training set, thereby improving the comprehensiveness and accuracy of the model. The balance check of malicious samples can enable the model to have more balanced detection capabilities when facing different types of attacks, ensuring its robustness in actual attack scenarios. In particular, the design of specific attack samples for Mongolian can better adapt to its language characteristics. Through category balance screening, a more balanced and diverse data foundation can be provided for subsequent adversarial sample generation. A balanced dataset can prevent the model from being biased towards certain categories, making it more resistant to interference in actual applications. By constructing a category-balanced dataset, the model will have better generalization capabilities and be able to adapt to more diverse languages and attack patterns. By analyzing the root sequence, affix combination, and syntax structure in depth, subtle changes in language can be revealed, especially in complex languages such as Mongolian. This provides a solid foundation for subsequent adversarial sample generation, enabling the model to maintain effective robustness under adversarial attacks. Through the meticulous design of adversarial sample generation methods, customized attacks can be made according to the characteristics of different languages, breaking through the limitations of existing attack methods. By generating adversarial samples from different angles, the model's ability to resist attacks can be fully tested, especially in languages with specific grammar structures such as Mongolian, which can more effectively detect the model's weaknesses when facing changes in language characteristics. By integrating different types of adversarial samples, the diversity of samples can be increased, and the model's response capabilities can be improved. By integrating multiple adversarial samples, the model's performance when facing different attack methods can be fully evaluated, ensuring its adaptability and resistance to interference in actual applications, especially in the context of languages with unique grammar characteristics such as Mongolian.

[0172] As Figure 2As shown, the application also provides a Mongolian-based malicious prompt dataset expansion system, comprising:

[0173] An extraction module is configured to obtain a Mongolian basic malicious prompt corpus and a Mongolian general corpus, and extract a high-frequency root set and a high-frequency affix set of the Mongolian general corpus;

[0174] An analysis module is configured to extract core malicious semantic features of the Mongolian basic malicious prompt corpus, and perform morphological analysis on the core malicious semantic features by using a Mongolian word segmentation model to obtain a malicious root subset and a malicious affix subset;

[0175] A comparison and screening module is configured to compare and screen the malicious root subset with the high-frequency root set to obtain a replaceable root library, and compare and screen the malicious affix subset with the high-frequency affix set to obtain a replaceable affix library;

[0176] A screening module is configured to obtain a plurality of grammar compatibility coefficients according to the replaceable affix library and the replaceable root library, and screen out valid combination pairs from the replaceable affix library and the replaceable root library according to each of the grammar compatibility coefficients;

[0177] An inspection and optimization module is configured to perform semantic consistency verification on each of the valid combination pairs and extract candidate malicious prompt samples that pass the verification, and perform iterative optimization on the candidate malicious prompt samples by using a genetic algorithm to generate an initial expansion sample set;

[0178] A filtering and enhancing module is configured to perform multi-dimensional filtering on the initial expansion sample set to obtain a preliminary optimization dataset, and enhance the preliminary optimization dataset by using an adversarial generation strategy to generate adversarial expansion samples;

[0179] A merging module is configured to merge the adversarial expansion samples and the preliminary optimization dataset to obtain a final expansion dataset.

[0180] In one embodiment, the filtering and enhancing module comprises:

[0181] An acquisition unit is configured to acquire syntactic structure data of each sample in the initial expansion sample set, and acquire a corresponding syntactic integrity index according to the syntactic structure data;

[0182] A first screening unit is configured to screen out samples with complete syntactic structures from the initial expansion sample set according to the syntactic integrity index to obtain a syntactic filtering subset, and acquire semantic redundancy between samples according to semantic feature vectors of each sample in the syntactic filtering subset;

[0183] The removing unit is configured to remove repeated samples in the syntax filtering subset according to the semantic repetition degree, to obtain a semantic deduplication subset, and to perform a category balance check on each sample in the semantic deduplication subset according to a malicious category of the sample;

[0184] The second screening unit is configured to screen samples that pass the category balance check from the semantic deduplication subset, to obtain a preliminary optimization dataset, and to obtain a root sequence, a prefix combination, and a word order structure of each sample in the preliminary optimization dataset;

[0185] The replacing unit is configured to obtain a root replacement adversarial sample according to the root sequence, and to obtain a prefix tampering adversarial sample according to the prefix combination.

[0186] The fusing unit is configured to obtain a word order permutation adversarial sample according to the word order structure, and to fuse the root replacement adversarial sample, the prefix tampering adversarial sample, and the word order permutation adversarial sample to generate an adversarial expansion sample.

[0187] It should be noted that each module and unit in the Mongolian-based malicious prompt dataset expansion system corresponds to a step in the Mongolian-based malicious prompt dataset expansion method.

[0188] As shown in Figure 3 The computer device can be a server, and the internal structure thereof can be as shown in Figure 3 The computer device includes a processor, a memory, a network interface, and a database connected through a system bus. The processor of the computer device is configured to provide computing and control capabilities. The memory of the computer device includes a non-volatile storage medium and an internal memory. The non-volatile storage medium stores an operating system, a computer program, and a database. The internal memory provides an environment for running the operating system and the computer program in the non-volatile storage medium. The database of the computer device is configured to store all data required in the process of the Mongolian-based malicious prompt dataset expansion method. The network interface of the computer device is configured to communicate with an external terminal through a network connection. The computer program is executed by the processor to implement the Mongolian-based malicious prompt dataset expansion method.

[0189] Those skilled in the art can understand that Figure 3 The structure shown in

[0190] An embodiment of the present application also provides a computer readable storage medium having a computer program stored thereon, and the computer program is executed by the processor to implement any one of the above Mongolian-based malicious prompt dataset expansion methods.

[0191] Those skilled in the art can understand that all or part of the processes in the above-mentioned embodiment methods can be completed by instructing the relevant hardware through a computer program. The computer program can be stored in a non-volatile computer readable storage medium, and when the computer program is executed, the processes of the above-mentioned embodiment methods can be included. Any reference to memory, storage, database or other medium provided by the present application and used in the embodiments can include non-volatile and / or volatile memory. Non-volatile memory can include read-only memory (ROM), programmable ROM (PROM), electrically programmable ROM (EPROM), electrically erasable programmable ROM (EEPROM) or flash memory. Volatile memory can include random access memory (RAM) or external cache memory. As an illustration but not limitation, RAM is available in various forms, such as static RAM (SRAM), dynamic RAM (DRAM), synchronous DRAM (SDRAM), double data rate SDRAM (SSRSDRAM), enhanced SDRAM (ESDRAM), synchronous link (Synchlink) DRAM (SLDRAM), memory bus (Rambus) direct RAM (RDRAM), direct memory bus dynamic RAM (DRDRAM), and memory bus dynamic RAM (RDRAM).

[0192] The above only describes the preferred embodiments of the present application, and does not limit the patent scope of the present application. Any equivalent structure or equivalent process transformation using the content of the present application specification and drawings, or direct or indirect application in other related technical fields, is also included in the patent protection scope of the present application.

Claims

1. A method for expanding a malicious suggestion dataset based on Mongolian, characterized in that, include: Obtain a basic Mongolian malicious prompt corpus and a general Mongolian corpus, and extract the high-frequency word root set and high-frequency word affix set from the general Mongolian corpus; The core malicious semantic features of the Mongolian basic malicious prompt corpus are extracted, and the core malicious semantic features are morphologically analyzed using a Mongolian word segmentation model to obtain a subset of malicious word roots and a subset of malicious word affixes. The malicious word root subset is compared and filtered with the high-frequency word root set to obtain a replaceable word root library; the malicious affix subset is compared and filtered with the high-frequency affix set to obtain a replaceable affix library. Obtain the affix morphological attributes and affix grammatical attributes of each candidate affix with the same function in the replaceable affix library, and the root morphological attributes and root grammatical attributes of each candidate root with the same part of speech in the replaceable root library, and obtain the vowel harmony matching value according to the ending vowel type of each affix morphological attribute and the first letter vowel type of the root morphological attribute. The vowel-consonant connection fit is obtained based on the first letter connecting vowel of each affix morphological attribute and the ending consonant type of the root morphological attribute, and the corresponding morphological compatibility score is obtained based on each vowel-consonant connection fit and vowel harmony matching value. The functional relevance is obtained based on the affix function of each affix grammatical attribute and the common collocation affix type of the root grammatical attribute; the part-of-speech matching degree is obtained based on the applicable part-of-speech range of each affix grammatical attribute and the part-of-speech of the root grammatical attribute; and the corresponding grammatical fit score is obtained based on each part-of-speech matching degree and functional relevance. Obtain the first co-occurrence probability and the second co-occurrence probability of each of the candidate affixes with the same function and the candidate roots with the same part of speech in the Mongolian basic malicious prompt corpus and the Mongolian general corpus, respectively, and obtain the malicious scenario adaptability based on each of the first co-occurrence probability and the second co-occurrence probability. The semantic association strength is obtained based on the semantic orientation of each affix grammatical attribute and the semantic category of the root grammatical attribute, and the corresponding semantic compatibility score is obtained based on each semantic association strength and the malicious scenario adaptability. Based on each of the semantic compatibility score, grammatical fit score, and morphological compatibility score, obtain the grammatical compatibility coefficients of the corresponding candidate affixes with the same function and candidate roots with the same part of speech, and determine whether each of the grammatical compatibility coefficients is greater than a preset threshold coefficient. If the grammatical compatibility coefficient is greater than the preset threshold coefficient, then the candidate affixes with the same function and the candidate roots with the same part of speech corresponding to the grammatical compatibility coefficient are determined to be valid combination pairs. For each of the effective combination pairs, semantic consistency is checked and qualified candidate malicious prompt samples are extracted. The candidate malicious prompt samples are then iteratively optimized using a genetic algorithm to generate an initial expanded sample set. The initial augmented sample set is filtered in multiple dimensions to obtain a preliminary optimized dataset, and an adversarial generation strategy is used to enhance the preliminary optimized dataset to generate adversarial augmented samples. The adversarial augmented samples are merged with the preliminary optimized dataset to obtain the final augmented dataset.

2. The method for expanding a malicious suggestion dataset based on Mongolian language according to claim 1, characterized in that, The step of using a Mongolian word segmentation model to perform morphological analysis on the core malicious semantic features to obtain a subset of malicious word roots and a subset of malicious word affixes includes: Based on the core malicious semantic features, multiple Mongolian words are obtained, and each Mongolian word is input into a Mongolian word segmentation model for morphological splitting to obtain corresponding candidate word roots and candidate affixes; Obtain the occurrence probability of each candidate word root and the semantic correlation between each candidate word root and the core malicious semantic features, and obtain the effectiveness score of the corresponding candidate word root based on the occurrence probability and semantic correlation of each word root. Determine whether the validity score of each candidate word root is greater than the first preset score threshold; If the validity score is greater than the first preset score threshold, then the candidate word root is included in the initial malicious word root set; Obtain the semantic category of the core malicious semantic features, and perform semantic filtering on the initial malicious word root set according to the semantic category to obtain a subset of malicious word roots; Obtain the vowel attribute matching degree and grammatical rule conformance degree for each candidate affix, and obtain the compatibility score of the corresponding candidate affix based on each vowel attribute matching degree and grammatical rule conformance degree; Determine whether the compatibility score of each candidate affix is ​​greater than a second preset score threshold; If the compatibility score of the candidate affix is ​​greater than the second preset score threshold, then the candidate affix is ​​included in the initial malicious affix set. Obtain the affix categories of the core malicious semantic features, and perform functional filtering on the initial malicious affix set according to the affix categories to obtain a malicious affix subset.

3. The method for expanding a malicious suggestion dataset based on Mongolian language according to claim 1, characterized in that, The step of comparing and filtering the malicious root word subset with the high-frequency root word set to obtain a replaceable root word library includes: Obtain the malicious semantic vector, malicious core syllable sequence, and malicious part-of-speech tag for each malicious word root in the malicious word root subset, as well as the high-frequency semantic vector and high-frequency part-of-speech tag for each high-frequency word root in the high-frequency word root set; From the multiple high-frequency part-of-speech tags, high-frequency word roots corresponding to high-frequency part-of-speech tags that are consistent with malicious part-of-speech tags are selected as candidate word roots with the same part-of-speech tag, and the semantic vector and core syllable sequence of each candidate word root with the same part-of-speech tag are obtained. The edit distance between the corresponding candidate word root and the malicious word root is obtained based on each core syllable sequence with the same part of speech and the malicious core syllable sequence, and the first morphological similarity is obtained based on each edit distance. The first cosine similarity is obtained for each of the same part-of-speech semantic vectors and malicious semantic vectors, and the first comprehensive matching degree is obtained for each of the first cosine similarity and the first morphological similarity. Determine whether each of the first comprehensive matching degrees is greater than the first preset matching degree; If the first comprehensive matching degree is greater than the first preset matching degree, then the candidate word root with the same part of speech corresponding to the first comprehensive matching degree is included in the replaceable word root library.

4. The method for expanding a malicious suggestion dataset based on Mongolian language according to claim 1, characterized in that, The step of performing semantic consistency verification on each of the valid combination pairs and extracting qualified candidate malicious prompt samples includes: Concatenate the candidate affixes with the same function and the candidate roots with the same part of speech in each effective combination pair to generate a combined vocabulary and obtain the morphological change features of each combined vocabulary. Obtain the corresponding initial semantic vector based on each morphological change feature. Obtain the original malicious prompt sample, and obtain the baseline semantic vector and extended baseline semantic vector of the malicious word root in the corresponding original malicious prompt sample based on the candidate word root with the same part of speech in each effective combination pair; The corresponding second cosine similarity is obtained based on each of the baseline semantic vectors and the initial semantic vectors, and it is determined whether each second cosine similarity is greater than the first semantic threshold. If the second cosine similarity is greater than the first semantic threshold, then the combined words corresponding to the second cosine similarity are included in the primary candidate word set. Obtain the contextual association features of each combined word in the primary candidate vocabulary set, and obtain the extended semantic vector of the corresponding combined word based on each contextual association feature; The corresponding third cosine similarity is obtained based on each extended semantic vector and the extended baseline semantic vector, and it is determined whether each third cosine similarity is greater than the second semantic threshold. If the third cosine similarity is greater than the second semantic threshold, then the combined words corresponding to the third cosine similarity are included in the secondary candidate word set. Replace the corresponding root words and affixes in the original malicious prompt samples with the combined words in the secondary candidate word set to obtain the corresponding initial malicious prompt samples, and obtain the syntactic structure tree of each initial malicious prompt sample. Obtain the corresponding syntactic consistency score and malicious probability value based on each of the syntactic structure trees, and obtain the corresponding comprehensive semantic consistency score based on each of the syntactic consistency score and malicious probability value; Determine whether each of the comprehensive semantic consistency scores is greater than a preset score threshold; If the overall semantic consistency score is greater than the preset score threshold, then the initial malicious prompt sample corresponding to the overall semantic consistency score is marked as a qualified candidate malicious prompt sample.

5. The method for expanding a malicious suggestion dataset based on Mongolian language according to claim 1, characterized in that, The steps of performing multi-dimensional filtering on the initial augmented sample set to obtain a preliminary optimized dataset, and then using an adversarial generation strategy to enhance the preliminary optimized dataset to generate adversarial augmented samples include: Obtain the syntactic structure data of each sample in the initial expanded sample set, and obtain the corresponding syntactic integrity index based on the syntactic structure data; Based on the syntactic integrity index, samples with complete syntactic structures are selected from the initial expanded sample set to obtain a syntactic filtering subset. The semantic repetition between samples is obtained based on the semantic feature vector of each sample in the syntactic filtering subset. Based on the semantic redundancy, duplicate samples in the syntactic filtering subset are removed to obtain a semantic deduplication subset, and class balance is verified based on the malicious category of each sample in the semantic deduplication subset. Samples that pass the category balance test are selected from the semantic deduplication subset to obtain the preliminary optimized dataset, and the root sequence, affix combination and word order structure of each sample in the preliminary optimized dataset are obtained. Based on the root sequence, obtain root substitution adversarial samples; based on the affix combination, obtain affix tampering adversarial samples. Based on the given word order structure, adversarial samples of word order substitution are obtained, and the adversarial samples of word root substitution, word affix alteration, and word order substitution are fused together to generate adversarial augmented samples.

6. A malicious prompt dataset expansion system based on Mongolian language, characterized in that, include: The extraction module is used to obtain the basic Mongolian malicious prompt corpus and the general Mongolian corpus, and to extract the high-frequency word root set and high-frequency word affix set of the general Mongolian corpus; The parsing module is used to extract the core malicious semantic features of the Mongolian basic malicious prompt corpus, and to perform morphological analysis on the core malicious semantic features using a Mongolian word segmentation model to obtain a subset of malicious word roots and a subset of malicious word affixes. The comparison and filtering module is used to compare and filter the malicious word root subset with the high-frequency word root set to obtain a replaceable word root library, and to compare and filter the malicious affix subset with the high-frequency affix set to obtain a replaceable affix library. The filtering module is used to obtain the affix morphological attributes and affix grammatical attributes of each candidate affix with the same function in the replaceable affix library, and the root morphological attributes and root grammatical attributes of each candidate root with the same part of speech in the replaceable root library, and to obtain the vowel harmony matching value according to the ending vowel type of each affix morphological attribute and the first letter vowel type of the root morphological attribute. The vowel-consonant connection fit is obtained based on the first letter connecting vowel of each affix morphological attribute and the ending consonant type of the root morphological attribute, and the corresponding morphological compatibility score is obtained based on each vowel-consonant connection fit and vowel harmony matching value. The functional relevance is obtained based on the affix function of each affix grammatical attribute and the common collocation affix type of the root grammatical attribute; the part-of-speech matching degree is obtained based on the applicable part-of-speech range of each affix grammatical attribute and the part-of-speech of the root grammatical attribute; and the corresponding grammatical fit score is obtained based on each part-of-speech matching degree and functional relevance. Obtain the first co-occurrence probability and the second co-occurrence probability of each of the candidate affixes with the same function and the candidate roots with the same part of speech in the Mongolian basic malicious prompt corpus and the Mongolian general corpus, respectively, and obtain the malicious scenario adaptability based on each of the first co-occurrence probability and the second co-occurrence probability. The semantic association strength is obtained based on the semantic orientation of each affix grammatical attribute and the semantic category of the root grammatical attribute, and the corresponding semantic compatibility score is obtained based on each semantic association strength and the malicious scenario adaptability. Based on each of the semantic compatibility score, grammatical fit score, and morphological compatibility score, obtain the grammatical compatibility coefficients of the corresponding candidate affixes with the same function and candidate roots with the same part of speech, and determine whether each of the grammatical compatibility coefficients is greater than a preset threshold coefficient. If the grammatical compatibility coefficient is greater than the preset threshold coefficient, then the candidate affixes with the same function and the candidate roots with the same part of speech corresponding to the grammatical compatibility coefficient are determined to be valid combination pairs. The verification and optimization module is used to perform semantic consistency verification on each of the effective combination pairs and extract the candidate malicious prompt samples that pass the verification, and to iteratively optimize the candidate malicious prompt samples through a genetic algorithm to generate an initial expanded sample set. The filtering and enhancement module is used to perform multi-dimensional filtering on the initial augmented sample set to obtain a preliminary optimized dataset, and to enhance the preliminary optimized dataset using an adversarial generation strategy to generate adversarial augmented samples. The merging module is used to merge the adversarial augmented samples with the preliminary optimized dataset to obtain the final augmented dataset.

7. The malicious prompt dataset expansion system based on Mongolian language according to claim 6, characterized in that, The filter enhancement module includes: The acquisition unit is used to acquire the syntactic structure data of each sample in the initial expanded sample set, and to acquire the corresponding syntactic integrity index based on the syntactic structure data. The first screening unit is used to screen samples with complete syntactic structures from the initial expanded sample set according to the syntactic integrity index, to obtain a syntactic filtering subset, and to obtain the semantic repetition between samples according to the semantic feature vector of each sample in the syntactic filtering subset. The removal unit is used to remove duplicate samples from the syntactic filtering subset according to the semantic redundancy, to obtain a semantic deduplication subset, and to perform class balance verification based on the malicious category of each sample in the semantic deduplication subset. The second filtering unit is used to filter out samples that pass the category balance check from the semantic deduplication subset to obtain the preliminary optimized dataset, and to obtain the root sequence, affix combination and word order structure of each sample in the preliminary optimized dataset. The replacement unit is used to obtain root replacement adversarial samples based on the root sequence and to obtain affix tampering adversarial samples based on the affix combination. The fusion unit is used to obtain adversarial samples of word order substitution based on the word order structure, and to fuse the adversarial samples of word root substitution, word affix modification, and word order substitution to generate adversarial augmented samples.

8. A computer device comprising a memory and a processor, wherein the memory stores a computer program, characterized in that, When the processor executes the computer program, it implements the steps of the method according to any one of claims 1 to 5.

9. A computer-readable storage medium having a computer program stored thereon, characterized in that, When the computer program is executed by a processor, it implements the steps of the method according to any one of claims 1 to 5.

Images