A large model security evaluation method based on multi-dimensional adversarial attack

Abstract

The application discloses a kind of big model safety evaluation methods based on multi-dimension confrontation attack, by constructing multi-dimension attack scene description, in combination with the characteristics of data availability destruction and system integrity violation, generate confrontation sample sequence, and optimize sample parameters in black box attack mode, accurately locate model weak link.Meanwhile, based on risk quantification value sequence and security image mechanism, extract reinforcement requirement data and reverse optimization to generate protection path, finally realize that model protection ability significantly improves.The application generates through scene, sample optimization and the closed-loop mechanism of risk assessment, effectively deal with complex attack environment, guarantee system safety stability.

Description

Technical Field

[0001] This invention relates to the field of large model security evaluation technology, and in particular discloses a large model security evaluation method based on multi-dimensional adversarial attacks. Background Technology

[0002] With large-scale models widely used in critical scenarios such as financial risk control, medical diagnosis, autonomous driving, and intelligent customer service, their security and reliability have become one of the core factors determining whether a system can be truly commercialized. If a large-scale model encounters a carefully designed adversarial attack in a real-world environment, it could lead to flawed decision-making, system loss of control, or even large-scale leakage of user privacy. Therefore, developing security assessment methods that can comprehensively reveal the vulnerabilities of large-scale models has become an urgent issue that the current artificial intelligence industry must address.

[0003] Most current security assessment solutions tend to repeatedly verify models against a specific attack method or only test them during the model inference phase. While this approach may uncover issues in certain single scenarios, it fails to reflect the true performance of a large model under complex attacks throughout its entire lifecycle. Because attackers can exploit every stage of the model's development, from pre-training to fine-tuning to final deployment, using entirely different knowledge conditions and data formats to launch attacks, existing assessment methods often only see the tip of the iceberg and struggle to pinpoint the model's true weaknesses under the combined influence of multiple attack dimensions.

[0004] The core technical challenge lies in the fact that the four dimensions—the attack target, the attacker's level of knowledge, the modality of the input data, and the model's learning stage during the attack—are not independent but rather exhibit strong interactions and coupling effects. For example, when an attacker simultaneously targets the model's privacy, operates under black-box conditions with only limited knowledge of the output, uses multimodal inputs combining images and text, and chooses to launch the attack during the fine-tuning phase, the model's vulnerability is often far greater than the result of combining any single dimension. This complex interaction resulting from multidimensional coupling makes traditional independent testing methods for each dimension unable to accurately recreate real-world attack scenarios or determine which specific combination represents the model's most dangerous weak point.

[0005] Therefore, how to systematically characterize and simulate the real adversarial process of mutual influence and reinforcement among multi-dimensional factors, and accurately identify the specific combination of conditions that make the model most vulnerable to attack in the actual business operation environment, has become a key issue in building a large model security protection capability evaluation system. Summary of the Invention

[0006] This invention provides a large-scale security evaluation method based on multi-dimensional adversarial attacks, aiming to address at least one deficiency in the aforementioned prior art.

[0007] This invention relates to a large-scale model security evaluation method based on multi-dimensional adversarial attacks, comprising the following steps:

[0008] S100. By referencing the preset security assessment framework, initial parameters are obtained from the attack target type and attack knowledge base dimensions to generate a multi-dimensional network attack scenario description, resulting in a set of attack scenarios that include data availability disruption and system integrity violation.

[0009] S200. Based on the set of attack scenarios, a sample generation algorithm is used to adapt the input data modality and the model learning stage to obtain a multimodal adversarial sample sequence.

[0010] S300. If the multimodal adversarial sample sequence triggers abnormal model response under black-box attack mode, the sample parameters are adjusted through optimization algorithm to determine the optimized adversarial sample set.

[0011] S400. Obtain test response data from the optimized adversarial sample set, use the risk quantification algorithm to calculate the attack success rate index, and obtain the risk quantification value sequence.

[0012] S500. If the risk quantification value sequence exceeds the preset threshold, the model safety profile generation mechanism will be integrated to obtain the model weakness location result.

[0013] S600: Extract reinforcement requirement data from the model's weak point location results, process the reinforcement requirement data through the reverse application of optimization algorithms, and generate a path to improve protection capabilities.

[0014] Further, step S100 includes:

[0015] S110. Obtain the attack target type and attack knowledge base information, and parse the attack target type and attack knowledge base information to obtain the initial parameter set;

[0016] S120. Input the initial parameter set into the security assessment framework and determine the multidimensional feature mapping based on the initial parameter set;

[0017] S130. Generate an attack vector sequence containing data availability anomalies and system integrity failures based on the multidimensional feature mapping;

[0018] S140. Identify and evolve the key nodes of the attack vector sequence to obtain a set of attack scenarios that include data availability disruption and system integrity violation.

[0019] Further, step S200 includes:

[0020] S210. Analyze the multi-source heterogeneous data streams contained in the attack scenario set to determine the input data modality and model learning stage;

[0021] S220. Construct a multi-dimensional feature space based on the input data modality and model learning stage, and locate the vulnerable feature regions of the decision boundary within the multi-dimensional feature space;

[0022] S230. Calculate the backpropagation gradient for vulnerable feature regions and generate an adaptive perturbation factor matrix;

[0023] S240. The adaptive perturbation factor matrix is ​​fused with the original input data and time-series arranged according to the attack path logic to obtain a multimodal adversarial sample sequence.

[0024] Further, step S300 includes:

[0025] S310. If a multimodal adversarial sample sequence triggers an abnormal model response under black-box attack mode, the response confidence distribution data is analyzed to filter out a subset of abnormal response samples.

[0026] S320. Initialize the evolutionary strategy population for the subset of abnormal response samples, and calculate the fitness function value of each entity in the evolutionary strategy population.

[0027] S330. Generate a new generation of candidate sample set based on the fitness function value, and map the new generation of candidate sample set to the target black box model to obtain feedback information;

[0028] S340. Update the gradient estimation vector based on feedback information to correct the perturbation direction, and extract convergent individuals that meet the convergence state judgment index to determine the optimized adversarial sample set.

[0029] Further, step S400 includes:

[0030] S410. Obtain the test response confidence vector set from the optimized adversarial sample set. The test response confidence vector set is captured by inference traversal after inputting the optimized adversarial sample set into the target black box model.

[0031] S420. Generate a list of misjudged samples indexes based on the test response confidence vector set. The list of misjudged samples indexes is obtained by extracting the predicted categories and comparing the predicted categories with the true labels.

[0032] S430. Calculate the attack success rate index value based on the list of misjudged samples. The attack success rate index value is obtained by weighting and normalizing the associated confidence value by calling the risk quantification matrix.

[0033] S440. Construct a risk quantification value sequence based on the attack success rate index.

[0034] Further, step S500 includes:

[0035] S510. Extract high-risk adversarial sample data. The high-risk adversarial sample data is retrieved based on the risk quantification value sequence index that exceeds the preset security threshold.

[0036] S520. Construct a neuron activation state matrix, which consists of the response values ​​captured by inputting high-risk adversarial sample data into the target black-box model.

[0037] S530. Construct a model security profile, which is obtained by fusing a feature sensitivity map generated based on the neuron activation state matrix.

[0038] S540. Obtain the model's weak link location results. The model's weak link location results are determined by identifying the network layer with the highest sensitivity variance based on the hierarchical vulnerability mapping table generated by the analytical model security profile.

[0039] Further, step S600 includes:

[0040] S610. Analyze the weak link location results of the analytical model, extract the network layer index of sensitivity variance anomalies, and generate structured reinforcement requirement data;

[0041] S620. Map the reinforcement requirement data to a constrained optimization objective function, calculate the inverse gradient direction of the constrained optimization objective function, and establish the inverse optimization solution space.

[0042] S630. Calculate the weight correction tensor in the inverse optimization solution space to obtain the numerical adjustment amount;

[0043] S640: Aggregate the weight update vector sequence generated based on the numerical adjustment amount, and generate the final protection capability enhancement path based on the weight update vector sequence.

[0044] The beneficial effects achieved by this invention are as follows:

[0045] This invention provides a large-scale model security evaluation method based on multi-dimensional adversarial attacks, offering an integrated solution to the business problem of the intertwined complexity of attack scenarios and model vulnerabilities in the cybersecurity field. This problem manifests as insufficient scenario descriptions due to the diversity of attack targets and the dynamic nature of the knowledge base, as well as the challenge of adaptability between adversarial sample generation and abnormal model responses. This invention generates adversarial sample sequences by constructing multi-dimensional attack scenario descriptions, combining the characteristics of data availability disruption and system integrity violations, and optimizes sample parameters under black-box attack mode to accurately locate model weaknesses. Simultaneously, based on risk quantification value sequences and security profiling mechanisms, it extracts hardening requirement data and reverse-optimizes the generation of protection paths, ultimately achieving a significant improvement in model protection capabilities. This invention effectively addresses complex attack environments and ensures system security and stability through a closed-loop mechanism of scenario generation, sample optimization, and risk assessment. Attached Figure Description

[0046] Figure 1 This is a flowchart illustrating an embodiment of the large-model security evaluation method based on multi-dimensional adversarial attacks of the present invention. Detailed Implementation

[0047] To better understand the above technical solutions, the following will provide a detailed explanation of the technical solutions in conjunction with the accompanying drawings and specific implementation methods.

[0048] like Figure 1 As shown, the first embodiment of the present invention proposes a large-scale model security evaluation method based on multi-dimensional adversarial attacks, including the following steps:

[0049] Step S100: By referencing the preset security assessment framework, initial parameters are obtained from the attack target type and attack knowledge base dimensions to generate a multi-dimensional network attack scenario description, resulting in a set of attack scenarios that include data availability disruption and system integrity violation.

[0050] 1. Security assessment framework reference mechanism: Introduce internationally recognized AI security assessment frameworks (such as the NIST AI Risk Management Framework and ISO / IEC 24089), optimize the framework dimensions by combining the characteristics of large models, and clarify the three-dimensional assessment system of "attack target - attack method - attack impact" to provide a standardized basis for attack scenario construction.

[0051] 2. Initial Parameter Acquisition: Initial parameters are extracted from two core dimensions: ① Attack target type parameters, including data availability destruction (e.g., inducing large model output garbled text, refusing to respond), system integrity violation (e.g., tampering with large model output results, injecting malicious instructions), privacy leakage (e.g., inducing large model to leak training data), etc.; ② Attack knowledge base parameters, extracting attack methods (e.g., FGSM, PGD (Projected Gradient Descent), CW (Carlini & Wagner) attacks), attack strength, applicable modalities, etc. from public adversarial attack knowledge bases (e.g., Adversarial Robustness Toolbox, FGSM (Fast Gradient Sign Method) attack case library).

[0052] 3. Generation of multi-dimensional attack scenario descriptions: Based on the initial parameters, multi-dimensional attack scenario descriptions are generated using a scenario modeling language (such as UML (Unified Modeling Language)). Each scenario must clearly define elements such as the attack target, attack method, input modality, attack intensity, and expected impact. For example, "Image modality attack scenario based on PGD algorithm, the attack target is to destroy data availability, the attack intensity is the perturbation amplitude ε=0.03, and the expected outcome is to induce misclassification in the large visual model."

[0053] 4. Attack Scenario Set Construction: Integrate all multi-dimensional attack scenario descriptions to form an attack scenario set that includes multiple types of targets such as data availability destruction, system integrity violation, and privacy leakage, ensuring coverage of different input types such as text, image, voice, and multimodal, as well as different model stages such as training and inference.

[0054] Step S200: Based on the attack scenario set, a sample generation algorithm is used to adapt the input data modality and model learning stage to obtain a multimodal adversarial sample sequence.

[0055] 1. Sample generation algorithm selection: Adapt differentiated sample generation algorithms to different attack scenarios: TextFooler, BERT-Attack, etc. are selected for text modal attacks; FGSM, PGD, CW, etc. are selected for image modal attacks; WaveAdv, AudioAdversarialExamples, etc. are selected for speech modal attacks; and CMGAN (Conformer-based Metric Generative Adversarial Network) algorithm is selected for multimodal attacks.

[0056] 2. Input Data Modality Adaptation Processing: Based on the input modality specified in the attack scenario, the original samples are preprocessed in a targeted manner: text samples are segmented and word vectors are mapped; image samples are normalized and pixel values ​​are adjusted; speech samples are subjected to Mel-spectrum conversion; ensuring that the generated adversarial samples meet the input format requirements of the large model.

[0057] 3. Model learning phase adaptation processing: For training scenarios, adversarial examples adapted to the training data distribution are generated and mixed into the training set to test the training robustness of the large model; for inference scenarios, adversarial examples that conform to the characteristics of real-time input are generated to simulate attacks in the real inference process; for example, training samples need to match the batch size and data augmentation strategy of the large model training data, and inference samples need to meet the latency requirements of real-time input.

[0058] 4. Generation of multimodal adversarial sample sequences: Arrange the generated adaptive adversarial samples in order according to the priority of the attack scenarios (high-risk scenarios first) to form a multimodal adversarial sample sequence; each sample needs to be bound to the corresponding attack scenario identifier to facilitate the traceability of subsequent attack results.

[0059] Step S300: If the multimodal adversarial sample sequence triggers an abnormal model response under black-box attack mode, the sample parameters are adjusted through an optimization algorithm to determine the optimized adversarial sample set.

[0060] 1. Black-box attack mode verification: Using a black-box attack mode (without obtaining the internal parameters and structure of the large model), the multimodal adversarial sample sequence is generated one by one and input into the large model to be evaluated. The model's output results, response time, error type and other response data are recorded. If the model outputs an incorrect result, the response times out or refuses to respond, it is determined that the model response is abnormal.

[0061] 2. Optimize trigger condition judgment: Set optimization trigger threshold. If the attack success rate (number of times an abnormal response is triggered / number of tests) of a certain adversarial sample is ≥50%, it is determined to be a sample that needs optimization; if the attack success rate is <50%, the sample is directly removed to avoid invalid samples occupying evaluation resources.

[0062] 3. Sample parameter optimization: Adaptive optimization algorithms (such as Adam optimizer and genetic algorithm) are used to adjust the key parameters of adversarial samples: for text samples, the perturbation word replacement ratio and attack step size are adjusted; for image samples, the perturbation amplitude and iteration number are adjusted; for speech samples, the spectral perturbation intensity is adjusted. The optimization goal is to improve the attack success rate to ≥80% while controlling the sample perturbation amplitude (e.g., ε≤0.05 for image samples) to ensure that the samples have concealment.

[0063] 4. Generation of optimized adversarial sample set: Integrate all optimized adversarial samples, remove samples that fail to meet the optimization trigger conditions, and form an optimized adversarial sample set; each sample needs to record information such as parameters before and after optimization, changes in attack success rate, etc.

[0064] Step S400: Obtain test response data from the optimized adversarial sample set, calculate the attack success rate index using the risk quantification algorithm, and obtain the risk quantification value sequence.

[0065] 1. Test response data extraction: Extract core response data from the black-box attack tests corresponding to the optimized adversarial sample set, including attack success rate, model performance degradation (such as accuracy decrease, response latency increase), attack impact range (such as single task failure or full task paralysis), attack duration, etc.

[0066] 2. Risk Quantification Algorithm Design: A weighted summation algorithm is used to construct a risk quantification model. The risk quantification value = α × attack success rate + β × performance degradation + γ × impact range weight + δ × duration weight; where α, β, γ, and δ are weight coefficients (α + β + γ + δ = 1, based on expert scoring, such as α = 0.4, β = 0.3, γ = 0.2, δ = 0.1); the attack success rate ranges from [0, 1], the performance degradation ranges from [0, 1], the impact range weight is (single task failure = 0.3, multi-task failure = 0.7, full task paralysis = 1.0), and the duration weight is (<1min = 0.2, 1-5min = 0.6, >5min = 1.0).

[0067] 3. Risk Quantification Value Sequence Generation: Calculate the risk quantification value corresponding to each optimized adversarial sample according to the order of the multimodal adversarial sample sequence, and arrange them in order to form a risk quantification value sequence; this sequence intuitively reflects the security risk level of the large model under different attack scenarios.

[0068] Step S500: If the risk quantification value sequence exceeds the preset threshold, the model safety profile generation mechanism is integrated to obtain the model weakness location result.

[0069] 1. Risk Threshold Determination: A preset risk quantification threshold is set (based on industry large-scale model security standards and historical evaluation data, such as threshold = 0.6); the risk quantification value sequence is traversed. If a certain risk quantification value is greater than the threshold, it is determined to be a high-risk attack scenario, triggering the vulnerability location process; if all values ​​are less than or equal to the threshold, it is determined that the large-scale model security status meets the standards, and no further location is required.

[0070] 2. Model Safety Profile Generation: Construct a model safety profile generation mechanism. The profile dimensions include the large model architecture (such as the number of Transformer layers and the number of attention heads), parameter size, training data distribution, input modality processing modules, output decision logic, etc. By parsing the large model's configuration files, training logs, and test response data, information in each dimension is filled in to generate an accurate model safety profile.

[0071] 3. Vulnerability Locator Identification: Correlate the attack characteristics (such as attack modalities, attack methods, and triggered error types) of high-risk attack scenarios with the model's security profile. For example, if "image modal PGD attacks trigger misclassification, and the correlation profile reveals that the visual feature extraction module (such as CNN convolutional layer) has poor robustness," then the vulnerability is identified as "the image feature extraction module is vulnerable to attacks." Integrate all identification results to form the model vulnerability identification results, clarifying the weak module, the cause of the vulnerability, and the associated attack scenarios.

[0072] Step S600: Extract reinforcement requirement data from the model's weak point location results, process the reinforcement requirement data through the reverse application of optimization algorithms, and generate a path to improve protection capabilities.

[0073] 1. Hardening requirement data extraction: Extract core hardening requirements from the weak link location results, including the protection objectives of the weak module (such as improving adversarial robustness and enhancing input verification capabilities), the appropriate protection method type (such as adversarial training, input sanitization, and model distillation), and protection performance requirements (such as reducing the attack success rate to <10%).

[0074] 2. Reverse application of optimization algorithms: The optimization algorithms in step S300 are reversed and applied to the hardening requirements: For example, for the requirement that "the image feature extraction module is vulnerable to perturbations", the PGD optimization algorithm is reversed to design an adversarial training strategy - using the adversarial samples generated by PGD as training data to optimize the parameters of the feature extraction module and improve its robustness to perturbations; for the weak links in the text modality, the TextFooler algorithm is reversed to design an input purification module to filter malicious text containing perturbations.

[0075] 3. Protection Capability Enhancement Path Generation: Integrate the results of reinforcement requirement processing to generate phased protection capability enhancement paths, including short-term protection measures (such as deploying input purification modules), medium-term protection measures (such as conducting adversarial training to optimize model parameters), and long-term protection measures (such as reconstructing the architecture of vulnerable modules). Each measure must clearly define the implementation steps, technical parameters, expected effects, and acceptance criteria. Finally, output a complete protection capability enhancement path to achieve closed-loop management of "assessment-location-reinforcement".

[0076] Furthermore, the large-scale model security evaluation method based on multi-dimensional adversarial attacks provided in this embodiment includes step S100 as follows:

[0077] Step S110: Obtain the attack target type and attack knowledge base information, and parse the attack target type and attack knowledge base information to obtain the initial parameter set.

[0078] The initial parameter set is obtained using the following formula:

[0079] (1)

[0080] In formula (1), Represents the initial parameter set. Represents an analytic function. Indicates the type of attack target. This represents the attack knowledge base information. The control logic of formula (1) takes the attack target type, attack knowledge base information and corresponding parsing function as input. The attack target type and attack knowledge base information are passed to the parsing function. Through the parsing operation of the target type features and knowledge base content, the function extracts and integrates the initial parameters that are suitable for the current scenario, and finally forms the initial parameter set. The core is to use the parsing function to extract the initial parameters required for the subsequent process from the two types of attack-related information.

[0081] In the field of cybersecurity, the first step is to obtain information on attack target types and attack knowledge bases. Attack target types typically refer to specific targets such as web servers, database systems, or IoT devices, while the attack knowledge base is a collection of databases storing historical vulnerabilities, attack patterns, and defense strategies. By parsing this information, an initial set of parameters is obtained. These parameters include the target's operating system version, known vulnerability numbers such as CVE-2023-1234, and potential attack entry points such as unencrypted APIs (Application Programming Interfaces). Specifically, the parsing process involves data extraction and classification: querying the knowledge base for entries matching the target type, analyzing the descriptive text using natural language processing techniques, and converting it into structured parameters, such as mapping "SQL injection vulnerability" to the parameters "injection risk level: high" and "impact scope: data leakage." This parsing helps to form a comprehensive initial set of parameters, providing foundational data for subsequent assessments. Assuming the target is an enterprise-level web server, the knowledge base information shows that it runs Apache software and has a heartbeat vulnerability. After parsing, the initial parameter set includes "target type: web application", "vulnerability type: buffer overflow", and "parameter value: port 80 is open", thus quantifying the attack probability.

[0082] Step S120: Input the initial parameter set into the security assessment framework and determine the multidimensional feature mapping based on the initial parameter set.

[0083] The following formula is used to determine the multidimensional feature map by applying an activation function after inputting the initial set of parameters into the security assessment framework:

[0084] (2)

[0085] In formula (2), This represents a multidimensional feature mapping based on an initial set of parameters. This indicates a security assessment framework. Let represent the Sigmoid activation function. The control logic of formula (2) takes the initial parameter set, the security assessment framework, and the Sigmoid activation function as inputs. First, the initial parameter set is passed into the security assessment framework, which analyzes the parameters and extracts relevant features. Then, the Sigmoid activation function is applied to the feature results output by the framework to perform nonlinear transformation, and finally, the feature mapping result integrating the multidimensional attributes of the initial parameters is obtained. The core is to use the feature extraction capability of the security assessment framework and the nonlinear processing of the activation function to transform the initial parameters into a structured multidimensional feature mapping.

[0086] Next, the initial parameter set is input into the security assessment framework, an integrated software system used to simulate and evaluate security risks. This framework typically processes the input data based on machine learning models such as decision trees or neural networks. Specifically, the process of determining the multidimensional feature mapping based on the initial parameter set involves converting the parameters into vector representations, for example, mapping "vulnerability type" to a risk dimension and "port open" to an access dimension. The framework's feature extraction module then calculates the multidimensional vectors, such as a three-dimensional mapping: (risk value 0.8, accessibility 0.9, impact depth 0.7). For the aforementioned web server example, the framework analyzes the parameter set, generates a mapping graph, and identifies high-risk areas such as anomalies in the data availability dimension, which helps visualize potential threats.

[0087] Step S130: Generate an attack vector sequence containing data availability anomalies and system integrity failures based on the multidimensional feature mapping.

[0088] The attack vector sequence is derived using the following formula:

[0089] (3)

[0090] In formula (3), Represents the attack vector sequence. This represents a data availability anomaly attack vector. The system integrity failure attack vector is represented by the control logic of formula (3). The data availability anomaly attack vector, the system integrity failure attack vector, and the corresponding coefficients determined based on multidimensional feature mapping are used as inputs. First, the two types of attack vectors are multiplied by the corresponding coefficients respectively (reflecting the weight ratio of different attack dimensions). Then, the two weighted attack vector results are integrated to generate an attack vector sequence that simultaneously contains the dimensions of data availability anomaly and system integrity failure. The core is to combine the coefficients determined by multidimensional feature mapping to perform weighted combination of the two types of attack vectors to form a structured attack vector sequence.

[0091] The data availability anomaly attack vector is derived using the following formula:

[0092] (4)

[0093] In formula (4), This represents the result of multidimensional feature mapping. Indicates abnormal injection strength. The data availability noise distribution is represented. The control logic of formula (4) takes the multidimensional feature mapping result, the anomaly injection strength, and the data availability noise distribution as inputs. First, the data availability noise distribution is scaled by the anomaly injection strength (controlling the anomaly strength of the attack). Then, the scaled noise is added to the multidimensional feature mapping result, integrating the basic attribute of the feature and the availability anomaly noise, and finally generating the data availability anomaly attack vector. The core is to combine the basic attribute of the feature mapping with the availability noise with strength to construct an availability anomaly attack vector that is adapted to the attack strength.

[0094] The system integrity failure attack vector is derived using the following formula:

[0095] (5)

[0096] In formula (5), This represents the result of multidimensional feature mapping. This represents element-wise multiplication. The integrity failure mask is represented. The control logic of formula (5) takes the multidimensional feature mapping result and the integrity failure mask as inputs. Through element-wise multiplication, the features of the integrity failure mask are multiplied one by one with the corresponding elements of the multidimensional feature mapping result, so that the feature mapping result carries the attribute features of integrity failure, and finally generates the system integrity failure attack vector. The core is to use element-wise multiplication to apply the integrity failure mask features to the multidimensional feature mapping result and construct an attack vector that is adapted to the system integrity failure scenario.

[0097] The attack vector sequence, which includes data availability anomalies and system integrity failures, is generated based on multidimensional feature mapping. Here, the attack vector sequence refers to a series of ordered attack steps, such as scanning ports first and then injecting malicious code. The generation process involves path planning algorithms to derive the sequence from the mapping. For example, starting from the high-risk dimension, vectors such as "Step 1: Port scanning leads to availability anomalies" and "Step 2: Code injection causes integrity failure" are constructed.

[0098] Step S140: Identify and evolve the key nodes of the attack vector sequence to obtain a set of attack scenarios that include data availability disruption and system integrity violation.

[0099] The set of attack scenarios is derived using the following formula:

[0100] (6)

[0101] In formula (6), This represents the final set of attack scenarios. Indicates the first One attack scenario This indicates that it exists. This indicates the key nodes in the scene. This represents the attack effect function. Indicates the degree of data availability disruption. Indicates the degree of system integrity violation. and These are the judgment thresholds for the two dimensions of damage. The control logic of formula (6) takes each attack scenario, corresponding key node, attack effect function, and judgment threshold of data availability / integrity damage as input, traverses each attack scenario and associated key node, calculates the degree of data availability damage and system integrity violation under the scenario through the attack effect function, and then determines whether these two degrees of damage exceed the corresponding thresholds. Attack scenarios that simultaneously meet the dual threshold conditions are screened and integrated to form a set of attack scenarios that include data availability damage and system integrity violation. The core is to screen out effective attack scenarios that simultaneously meet the requirements of availability and integrity damage by judging the dual-dimensional thresholds of the attack effect.

[0102] The method identifies and evolves key nodes in the attack vector sequence. Key nodes are turning points in the sequence, such as successful injection nodes. Evolution is achieved by expanding the sequence into multiple variants using mutation algorithms, resulting in a set of attack scenarios that include data availability disruption and system integrity violations. For web servers, the key node is the "injection point." The evolved scenarios include "Scenario 1: DDoS (Distributed Denial of Service) attack disrupts data availability, leading to service interruption" and "Scenario 2: Database tampering violates integrity, causing data forgery." This method can simulate real threats and improve the effectiveness of defense strategies.

[0103] Preferably, the large-scale model security evaluation method based on multi-dimensional adversarial attacks provided in this embodiment includes step S200 as follows:

[0104] Step S210: Analyze the multi-source heterogeneous data streams contained in the attack scenario set to determine the input data modality and model learning stage.

[0105] The following formula is used to determine the input data modality of the attack scenario data stream by aggregating multi-source data through cosine similarity:

[0106] (7)

[0107] In formula (7), Indicates the input data mode. Indicates candidate modes, Indicates the number of multiple sources. Indicates the first Source heterogeneous data stream, Representing candidate modes The embedded representation of the candidate modality. The control logic of formula (7) takes the candidate modality set, the multi-source heterogeneous data stream, and the embedded representation of each candidate modality as input. It measures the matching degree between the single-source data stream and the candidate modality by using cosine similarity. Then, it sums the matching degrees of the multi-source data streams and selects the candidate modality with the largest total matching degree. It determines the input data modality of the attack scenario data stream. The core is to select the input modality that best matches the multi-source heterogeneous data stream by aggregating the cosine similarity between the multi-source data and the candidate modality.

[0108] The following formula is used to determine the learning stage of the model in the attack scenario through the log-likelihood average of the gradient sequence:

[0109] (8)

[0110] In formula (8), This indicates the model learning phase. Indicates the candidate learning stage. Indicates the number of time steps. Indicates the first Step loss gradient, Indicates input data, The logarithmic probability is represented. The control logic of formula (8) takes the candidate learning stage set, time step, loss gradient of each step, input data and log probability function as input, and selects the candidate learning stage with the largest average value by calculating the log likelihood of the loss gradient sequence under the candidate learning stage, and determines it as the actual learning stage of the model in the attack scenario. The core is to match the current learning stage state of the model by using the log likelihood aggregation of the loss gradient sequence.

[0111] The process of parsing the multi-source heterogeneous data streams contained in an attack scenario set first involves identifying the data types from different sources, such as text data from network logs, image data captured by sensors, and structured data from database queries. These data streams often exhibit heterogeneous characteristics, such as inconsistent formats or timestamps. It's important to note that multi-source heterogeneous data streams refer to diverse data collected from multiple channels. For example, in a cybersecurity environment, this includes real-time traffic monitoring data and historical vulnerability reports, which may exist in JSON format or binary streams. Determining the input data modality involves classifying the data into text modality, image modality, or time-series modality using classification algorithms. For example, log files are classified as text modality. The model learning phase then evaluates whether the data is suitable for supervised or unsupervised learning, such as using labeled data for feature extraction during the initial training phase. In one implementation, assuming the attack scenario set originates from enterprise network intrusion simulations, where the data stream includes firewall logs and user behavior records, parsing determines the input data modality to be a mixed modality, including text and numerical types. Simultaneously, the model learning phase is positioned at the reinforcement learning stage because iterative optimization of adversarial strategies is required. This parsing helps in subsequent feature space construction and ensures data consistency.

[0112] Step S220: Construct a multidimensional feature space based on the input data modality and model learning stage, and locate the vulnerable feature regions of the decision boundary within the multidimensional feature space.

[0113] The multidimensional feature space is derived using the following formula:

[0114] (9)

[0115] In formula (9), Represents a multidimensional feature space. The construction function is represented by formula (9). The control logic of formula (9) takes the input data modality, model learning stage and corresponding construction function as input. The determined input data modality and model learning stage are passed into the construction function. Based on the characteristics of these two key information (modal attributes of input data and learning stage state of model), the function constructs a feature dimension framework that is adapted to the current attack scenario and finally generates the corresponding multi-dimensional feature space. The core is to combine the key information of input data and model stage to build the feature space foundation for subsequent location of vulnerable feature regions.

[0116] The vulnerable feature region is derived using the following formula:

[0117] (10)

[0118] In formula (10), Indicates vulnerable feature regions. Represents a point in the feature space. Represents the gradient of the decision function. The vulnerability threshold is represented by the control logic of formula (10). The control logic takes the multidimensional feature space, decision function and vulnerability threshold as input. First, it traverses each feature point in the multidimensional feature space and calculates the norm of the gradient of the decision function corresponding to each point. Then, it determines whether the norm is less than the vulnerability threshold and filters and integrates the feature points that meet the conditions to finally form the vulnerable feature region. The core is to locate the relatively vulnerable region of the decision boundary in the feature space by comparing the norm of the gradient of the decision function with the threshold.

[0119] The process of constructing a multidimensional feature space based on the input data modality and the model learning stage involves mapping modal data to a high-dimensional vector space, such as using embedding techniques to convert text modality into a vector representation. Locating vulnerable feature regions at the decision boundary within the multidimensional feature space involves analyzing the model's decision boundary to identify areas susceptible to perturbations. For example, in a support vector machine model, the decision boundary is the hyperplane separating different classes, and vulnerable feature regions are highly sensitive points near the boundary. Specifically, a multidimensional feature space is an abstract mathematical representation where each dimension corresponds to a data feature, such as packet size or time interval in network traffic. Principal component analysis can be used for dimensionality reduction to highlight key dimensions during construction. In one implementation, for the aforementioned enterprise network example, where the input data modality is a mixture of text and time series, and the model learning stage is supervised learning, the log text is embedded as a 100-dimensional vector during feature space construction. Gradient descent is then used to locate vulnerable regions near the decision boundary within the space, such as identifying subspaces with high abnormal traffic feature values. This localization can reveal potential attack weaknesses.

[0120] Step S230: Calculate the backpropagation gradient for the vulnerable feature region and generate the adaptive perturbation factor matrix.

[0121] The backpropagation gradient is obtained using the following formula:

[0122] (11)

[0123] In formula (11), Indicates targeting vulnerable feature regions The backpropagation gradient, Represents the gradient operator. Represents the loss function. Indicates model parameters, Indicates the input sample. This indicates element-wise multiplication. The binary mask matrix represents the vulnerable feature region. The control logic of formula (11) takes the loss function, model parameters, input samples and the binary mask matrix of the vulnerable feature region as input. First, it calculates the basic backpropagation gradient of the loss function with respect to the model parameters. Then, through element-wise multiplication, it uses the binary mask matrix to filter out the gradient components that correspond only to the vulnerable feature region. Finally, it obtains the backpropagation gradient focused on the vulnerable region. The core is to use the binary mask matrix to limit the backpropagation gradient to the vulnerable feature region, so as to achieve the regional targeting of the gradient.

[0124] The adaptive perturbation factor matrix is ​​generated using the following formula:

[0125] (12)

[0126] In formula (12), This represents the adaptive perturbation factor matrix. This represents the scaling factor for the disturbance amplitude. Indicates a vulnerable area mask. The Euclidean norm is used for normalization. Represents a small, numerically stable constant. The function limits the perturbation to Within the range. The control logic of formula (12) takes the gradient of the vulnerable region, mask, scaling factor, etc. as input, and generates an adaptive perturbation factor matrix that focuses on the vulnerable feature region and has controllable amplitude through the process of "locking the vulnerable region → stabilizing the gradient magnitude → adjusting the perturbation intensity → constraining the perturbation range". The core is to combine mask screening and numerical processing to make the perturbation accurately adapt to the vulnerable region and maintain stability.

[0127] The process of calculating backpropagation gradients for vulnerable feature regions refers to propagating errors from the output layer to the input layer in a neural network model to calculate the gradient value of each feature. For example, in deep learning frameworks like TensorFlow, backpropagation uses the chain rule to calculate derivatives and generate gradient vectors. Generating an adaptive perturbation factor matrix involves dynamically adjusting perturbation parameters based on these gradients, forming a matrix where each element represents the perturbation strength for a specific feature. Specifically, the adaptive perturbation factor matrix is ​​a two-dimensional array used to represent perturbation weights for different modalities; for example, matrix rows correspond to feature dimensions, and columns correspond to perturbation levels. In one implementation, continuing with enterprise network scenarios, for traffic features in vulnerable regions, the calculation of backpropagation gradients starts from the model's loss function, obtaining partial derivatives to generate a gradient map, and then adaptively adjusting factors, such as setting the perturbation factor for high-gradient features to 0.5 times the original value, forming a 3×3 matrix for subsequent fusion.

[0128] Step S240: Fuse the adaptive perturbation factor matrix with the original input data and perform time-series arrangement according to the attack path logic to obtain a multimodal adversarial sample sequence.

[0129] Multimodal adversarial example sequences are derived using the following formula:

[0130] (13)

[0131] In formula (13), This represents a multimodal adversarial sample sequence. Indicates time Adversarial examples, The sequence length is represented by the control logic of formula (13). The control logic takes the adversarial samples and sequence length at each time as input, follows the temporal logic of the attack path, and arranges and integrates the adversarial samples at different times in chronological order to form an ordered multimodal adversarial sample sequence. The core is to use temporal arrangement to associate the scattered single-time adversarial samples into a continuous sample sequence that conforms to the attack path logic.

[0132] time The adversarial examples are derived using the following formula:

[0133] (14)

[0134] In formula (14), Indicates data fusion. Indicates time The attack path logic, This represents the timing arrangement function. The control logic of formula (14) is based on time... The system takes the fused data, attack path logic, and timing orchestration function as input. The timing orchestration function binds the fused data with the attack path logic at the current moment to generate an adversarial sample that is adapted to the attack logic at that moment. The core is to make the adversarial sample match the attack path requirements at the corresponding moment to ensure the consistency of the timing attack logic.

[0135] The fused data is obtained through the following formula:

[0136] (15)

[0137] In formula (15), This represents the original input data. The control logic of formula (15) takes the original input data and the adaptive perturbation factor matrix as inputs, and embeds the characteristics of the perturbation factor into the original input data through the element-wise multiplication fusion operation, and integrates the fused data with perturbation attributes. The core is to bind the original data with the perturbation factor by means of element-wise combination, so as to provide basic data for subsequent generation of adversarial examples.

[0138] The process of fusing the adaptive perturbation factor matrix with the original input data involves matrix multiplication or addition operations to apply perturbations to the data, such as element-wise multiplication to introduce noise. Temporal orchestration based on attack path logic arranges the perturbed data according to a predefined attack sequence, such as reconnaissance-intrusion-maintenance, resulting in a multimodal adversarial sample sequence. This sequence serves as a temporalized adversarial example used to test model robustness. Specifically, the attack path logic is a knowledge graph-based structure describing the steps of an attack from initial scanning to final destruction. Temporal orchestration ensures the perturbations are applied sequentially over time. In one implementation, the aforementioned adaptive perturbation factor matrix is ​​added to the original log data during fusion to generate perturbed traffic records. These records are then orchestrated into a sequence according to the path logic. For example, the first step perturbs the scan data, leading to false positive alerts; the second step perturbs the intrusion data, simulating integrity breaches. This ultimately forms an adversarial sample sequence containing text and image modalities, enabling the simulation of complex attacks.

[0139] Furthermore, the large-scale model security evaluation method based on multi-dimensional adversarial attacks provided in this embodiment includes step S300 as follows:

[0140] Step S310: If the multimodal adversarial sample sequence triggers an abnormal model response under black-box attack mode, then analyze the response confidence distribution data to filter out a subset of abnormal response samples.

[0141] The selected subset of abnormal response samples is obtained using the following formula:

[0142] (16)

[0143] In formula (16), This represents a subset of abnormal response samples. This refers to a single sample in a multimodal adversarial sample sequence. This represents a multimodal adversarial sample sequence. This represents the outlier score based on the response confidence distribution data. The threshold is indicated. The control logic of formula (16) takes the multimodal adversarial sample sequence, the anomaly score function, and the screening threshold as inputs. Through the process of "traversing samples → calculating anomaly scores → threshold comparison and screening", it extracts the sample subset that triggers the abnormal response of the model from the sequence. The core is the anomaly score based on the response confidence, which accurately locates the sample in the sequence that causes the model to be abnormal.

[0144] The response confidence distribution data is obtained by parsing using the following formula:

[0145] (17)

[0146] In formula (17), This represents the mean confidence level. Indicates the standard deviation of the confidence level. The confidence entropy is represented by the original response confidence distribution. The control logic of formula (17) takes the original response confidence distribution as input, extracts its three key statistical features: mean, standard deviation, and entropy, and integrates them to obtain structured response confidence distribution data. The core is to transform the original confidence distribution into a quantitative indicator that can be used for anomaly detection through statistical feature analysis.

[0147] When adversarial sample sequences are applied to black-box attack patterns, if these sequences cause the model to output an abnormal response—for example, in a network security system, the model should identify normal traffic but misidentifies it as an intrusion—it is necessary to analyze the response confidence distribution data. Specifically, response confidence distribution data refers to the model's predicted probability distribution for each sample. For instance, an image recognition model outputs a category probability vector, where abnormal responses are characterized by low confidence or uneven distribution. The analysis process involves statistically analyzing these probability values, such as calculating the average confidence for each category and filtering out samples with confidence levels below a threshold, such as 0.5, forming a subset of abnormal response samples. In network intrusion detection operations, this filtering helps identify subsets of models sensitive to specific perturbations, thus providing foundational data for subsequent optimization.

[0148] Step S320: Initialize the evolutionary strategy population for the subset of abnormal response samples, and calculate the fitness function value of each entity in the evolutionary strategy population.

[0149] The fitness function value calculated for the subset of anomalous response samples is obtained using the following formula:

[0150] (18)

[0151] In formula (18), This represents the fitness function value. Indicates the size of the subset of abnormal samples. Indicates the first The weights of each outlier sample, Indicates the first Feature vectors of anomalous samples Indicates the first The scale parameter corresponding to each sample. The control logic of formula (18) takes the parameters (size, weight, feature vector, scale parameter) of the abnormal response sample subset and the evolutionary population entity features as inputs, and quantifies the matching degree between the population entity and the abnormal sample subset by summing the weighted Gaussian kernel function to obtain the fitness function value. The core is to use the Gaussian kernel to measure feature similarity, and combine the weight and scale parameter to adjust the influence weight of the sample to comprehensively evaluate the fitness of the entity.

[0152] An evolutionary strategy population is initialized for the selected subset of anomalous response samples. This population is a genetic algorithm-based set where each entity represents a potential perturbation variant. For example, the population might contain 100 individuals, each a variant version of the sample. The fitness function is calculated by defining a function to evaluate the effectiveness of each entity. For instance, the fitness function could be the reciprocal of the model's misclassification rate. During calculation, each entity is input into a black-box model; the higher the degree of anomaly in the response, the lower the fitness value. In one implementation, assuming the business scenario is adversarial testing of an autonomous driving system, and the anomalous subset includes perturbed road sign images, perturbation parameters such as noise intensity are randomly generated during population initialization, and fitness is calculated to ensure population diversity for exploring better perturbations.

[0153] Step S330: Generate a new generation of candidate sample set based on the fitness function value, and map the new generation of candidate sample set to the target black box model to obtain feedback information.

[0154] The next-generation candidate sample set is obtained through the following formula:

[0155] (19)

[0156] In formula (19), This represents a new generation of candidate samples. This represents the current fitness function value. The set of candidate samples is represented by . The control logic of formula (19) takes the current generation of candidate sample set and the fitness function value of each sample as input, and generates a new generation of candidate sample set by "screening the best sample of the current generation" - the core is the fitness-based optimization iteration, and retains the sample with the highest fitness in the current generation to enter the next generation.

[0157] Based on these fitness function values, a new generation of candidate samples is generated, a process similar to genetic crossover and mutation. For example, high-fitness individuals are selected for crossover to produce offspring, forming a new set. This new generation of candidate samples is then mapped to the target black-box model to obtain feedback. Specifically, mapping involves inputting candidate samples into the target black-box model and collecting the output, such as classification labels or confidence scores, as feedback. This feedback can reveal model weaknesses in business applications. For example, in financial fraud detection, feedback may show that certain perturbation samples have successfully bypassed detection, thus guiding strategy adjustments.

[0158] Step S340: Update the gradient estimation vector based on the feedback information to correct the perturbation direction, and extract convergent individuals that meet the convergence state judgment index to determine the optimized adversarial sample set.

[0159] The updated gradient estimate vector is obtained using the following formula:

[0160] (20)

[0161] In formula (20), This represents the updated gradient estimation vector. This represents the current gradient estimation vector. Indicates the update step size. The feedback information is represented. The control logic of formula (20) takes the current gradient estimation vector, update step size and feedback information as input, and realizes the iterative update of the gradient estimation vector through the process of "calculating feedback increment → superimposing correction gradient" - the core is to correct the gradient direction with the help of feedback information, and the step size controls the update magnitude, so that the gradient is more suitable for the optimization requirements of the current attack.

[0162] The optimized adversarial sample set is obtained using the following formula:

[0163] (twenty one)

[0164] In formula (21), This represents the optimized set of adversarial examples. Indicates the first One adversarial example, Indicates the convergence state determination index. Indicates the convergence threshold. The total number of individuals is represented. The control logic of formula (21) takes adversarial samples, perturbation, convergence judgment index and threshold as input, and obtains the optimized adversarial sample set that meets the convergence requirements through the process of "generating candidate samples → judging convergence status → screening samples that meet the conditions" - the core is the threshold screening based on convergence judgment index to ensure that all individuals in the final sample set reach the convergence state.

[0165] The gradient estimation vector is updated based on the acquired feedback information to correct the perturbation direction. This gradient estimation vector is an approximate gradient used to simulate white-box gradient calculations in black-box scenarios. For example, the impact of the perturbation on the response can be estimated using the finite difference method. The vector direction is adjusted during the update to enhance the attack effect. Subsequently, convergent individuals that meet the convergence criteria are extracted; for example, convergence is determined when the fitness change is less than 0.01. These individuals are selected to determine the optimized adversarial sample set. In one implementation, in black-box attacks in medical image diagnosis, this update and extraction process can generate a more robust sample set, helping to improve the model's resistance to noise and ultimately reducing the risk of misdiagnosis in actual deployment.

[0166] Preferably, the large-model security evaluation method based on multi-dimensional adversarial attacks provided in this embodiment includes step S400 as follows:

[0167] Step S410: Obtain the test response confidence vector set from the optimized adversarial sample set. The test response confidence vector set is captured after inference traversal of the target black box model by inputting the optimized adversarial sample set into it.

[0168] The test response confidence vector set is derived using the following formula:

[0169] (twenty two)

[0170] In formula (22), This represents the set of test response confidence vectors. Indicates the first Each test response confidence vector Indicates a capture operation. This represents the inference function of the target black-box model. This represents the optimized adversarial example. This represents the optimized adversarial sample set. The control logic of formula (22) takes the optimized adversarial sample set, the target black-box model inference function, and the confidence vector capture operation as inputs. Through the process of "traversing samples → model inference → capturing confidence vectors → integrating the set", it generates a test response confidence vector set. The core is to process the optimized adversarial samples one by one, extract the confidence vectors corresponding to the model inference, and summarize them.

[0171] The process of obtaining a set of test response confidence vectors from an optimized set of adversarial examples is explored in intrusion detection systems within the cybersecurity field. Specifically, these optimized adversarial example sets are first input into a target black-box model for inference traversal. For instance, when processing network traffic data, the target black-box model analyzes the characteristics of each sample, such as packet size and transmission protocol, and then captures the output confidence vector for each sample. Here, the confidence vector refers to the probability distribution of the model's classification of the sample; for example, a vector might represent a normal traffic probability of 0.8 and an abnormal probability of 0.2. Through this traversal method, a set of all vectors is collected to evaluate the model's performance in an adversarial environment.

[0172] Step S420: Generate a list of misjudged samples based on the test response confidence vector set. The list of misjudged samples is obtained by extracting the predicted categories and comparing the predicted categories with the true labels.

[0173] The list of misjudged samples is derived using the following formula:

[0174] (twenty three)

[0175] In formula (23), This represents a list of indexes of misjudged samples. Indicates the first False positive indicator for each sample This represents the total number of samples in the test response confidence vector set. The control logic of formula (23) takes the misjudgment indicator of the sample and the total number of samples as inputs, and generates an index list of misjudged samples through the process of "traversing the index → ​​determining the misjudgment status → filtering the misjudgment number" - the core is to accurately extract the number of all misjudged samples based on the filtering of the misjudgment indicator.

[0176] No. The false positive indicator for each sample is derived using the following formula:

[0177] (twenty four)

[0178] In formula (24), Indicates the first The predicted category for each sample, Indicates the true label, The indicator function is 1 when the predicted category is not equal to the true label and 0 otherwise. The control logic of formula (24) takes the predicted category, true label and indicator function of the sample as input, and generates the misjudgment indicator of the sample through the process of "comparing the prediction with the true category → triggering the output of the indicator function" - the core is to use the indicator function to quantify the matching status between the predicted category and the true label, and directly identify whether the sample is misjudged.

[0179] No. The predicted category for each sample is obtained using the following formula:

[0180] (25)

[0181] In formula (25), Indicates the first Test samples in category Confidence level on This indicates the category index corresponding to the maximum value. The control logic of formula (25) takes the confidence scores of each category of the test sample as input and determines the predicted category of the sample through the process of "locating the maximum confidence score → extracting the corresponding category index" - the core is to select the category based on the maximum confidence score, which directly corresponds to the prediction result of the model.

[0182] When generating a list of misclassified sample indices based on the test response confidence vector set, it is necessary to extract the predicted category of each vector and compare it with the true label. For example, in financial fraud detection, if the confidence vector shows that the model predicts a transaction as fraudulent with a probability of 0.7, but the true label is a normal transaction, then it is marked as a misclassification, and its index is recorded as sample number 5. By comparing all vectors, a list is generated listing all the misclassified indices. This step ensures the accurate location of problematic samples.

[0183] Step S430: Calculate the attack success rate index value based on the misjudged sample index list. The attack success rate index value is obtained by weighting and normalizing the associated confidence value using the risk quantification matrix.

[0184] The attack success rate metric is calculated using the following formula:

[0185] (26)

[0186] In formula (26), This represents a numerical value indicating the success rate of an attack. This indicates the length of the list of misjudged sample indices. Represents the risk quantification matrix For the The confidence score associated with each misjudged sample The weighted mapping value, This represents the maximum mapping value of the risk quantification matrix. The formula calculates the attack success rate index by performing a weighted mapping on each confidence level, dividing by the maximum value to achieve normalization, and then taking the average. The control logic of formula (26) takes the misjudged sample information and the risk quantification matrix as inputs, and obtains the quantified attack success rate index through the process of "weighted mapping confidence level → normalization processing → mean calculation". The core is to first perform risk weighted mapping on the confidence level of the misjudged sample, then normalize and take the average to comprehensively measure the success of the attack.

[0187] The process of calculating the attack success rate index based on the list of misjudged samples involves applying a risk quantification matrix to the associated confidence scores for weighted mapping and normalization. Specifically, the risk quantification matrix is ​​a predefined table used to assess the risk weights of different confidence levels. For example, in the risk quantification matrix, confidence scores below 0.5 correspond to a high-risk weight of 2.0, while those above 0.8 correspond to a low-risk weight of 0.5. Then, these weights are applied to the confidence scores of the misjudged samples for weighted summation, and finally normalized to the 0-1 range to obtain a success rate index such as 0.75.

[0188] Step S440: Construct a risk quantification value sequence based on the attack success rate index value.

[0189] The risk quantification value series is derived using the following formula:

[0190] (27)

[0191] In formula (27), Indicates the first Quantitative risk value, Indicates the first A numerical value representing the success rate of an attack. This indicates the current cumulative number of terms; the formula is passed through the previous... The average of each attack success rate indicator is used to construct a risk quantification value sequence, thereby achieving cumulative average risk quantification. The control logic of formula (27) takes the cumulative attack success rate indicator and the current cumulative number of items as inputs, and collects the previous data. The process of "indicators → calculating the sum of indicators → calculating the cumulative average" constructs a risk quantification value series—the core of which is to use the cumulative average method to summarize the previous indicators. The success rate of each attack is combined to form the current risk quantification value, enabling a gradual accumulation assessment of risk.

[0192] When constructing a risk quantification value sequence based on attack success rate indicators, multiple indicator values ​​are arranged into a sequence according to time or sample order. For example, in a network security system, continuous testing yields indicators of 0.6, 0.7, and 0.8, forming a risk quantification value sequence used to track attack trends. Specifically, this construction process ensures sequence continuity by connecting values ​​through linear interpolation or smoothing.

[0193] Furthermore, the large-scale model security evaluation method based on multi-dimensional adversarial attacks provided in this embodiment includes step S500 as follows:

[0194] Step S510: Extract high-risk adversarial sample data. The high-risk adversarial sample data is obtained by retrieving the risk quantification value sequence index that exceeds the preset security threshold.

[0195] High-risk adversarial sample data is obtained through the following formula:

[0196] (28)

[0197] In formula (28), This indicates high-risk adversarial sample data. Indicates the first One sample data, Indicates the first Quantitative risk value, The preset safety threshold is indicated. The control logic of formula (28) takes sample data, risk quantification value and preset safety threshold as input, and extracts adversarial sample data with excessive risk through the process of "binding sample with risk value → comparing risk level with threshold → screening samples exceeding the standard" - the core is the threshold judgment based on risk quantification value to accurately locate high-risk adversarial samples.

[0198] The process of extracting high-risk adversarial sample data first requires understanding the concept of a risk quantification value sequence. This is a numerical sequence calculated previously, where each value represents the risk level of the adversarial sample in the model. For example, in intrusion detection systems in the cybersecurity field, the risk quantification value sequence includes a series of values ​​from 0 to 1, such as 0.85, 0.92, etc., indicating the potential danger of the sample causing the model to misjudge. Specifically, a preset security threshold is set to 0.8. When some values ​​in the risk quantification value sequence exceed this threshold, the original adversarial sample set is retrieved by index. For example, index 3 corresponds to a noisy network traffic sample that simulates disguised malicious intrusion data, thereby extracting these high-risk samples and forming a subset for further analysis of the model's vulnerability. In one implementation, if applied to financial fraud detection, high-risk adversarial sample data includes tampered transaction records, such as fraudulent transfer data with slightly adjusted amounts. Retrieval is performed based on the risk quantification value sequence, such as 0.9 exceeding the threshold of 0.7. This helps identify those samples most likely to bypass model detection, ensuring that subsequent steps focus on the parts that truly threaten model security.

[0199] Step S520: Construct a neuron activation state matrix, which consists of the response values ​​captured by inputting high-risk adversarial sample data into the target black-box model.

[0200] The neuron activation state matrix is ​​derived using the following formula:

[0201] (29)

[0202] In formula (29), Represents the neuron activation state matrix. The target black box model is represented. The control logic of formula (29) takes high-risk adversarial sample data and target black box model as inputs, and constructs the neuron activation state matrix through the process of "sample input model → capture neuron response → structured matrix". The core is to use high-risk samples to trigger the neuron response of the model, organize these response values ​​into matrix form, and record the activation state of the model.

[0203] When constructing the neuron activation state matrix, high-risk adversarial sample data needs to be input into the target black-box model to capture the response value of each neuron. Here, the neuron activation state matrix is ​​a multi-dimensional array, where rows represent samples, columns represent neurons in the target black-box model, and values ​​are non-negative values ​​calculated by activation functions such as the ReLU function. Specifically, high-risk image samples are input into the target black-box model, and the convolutional layer neurons of the target black-box model will generate activation values ​​such as 2.5, 1.8, etc. These values ​​reflect the intensity of feature extraction. By collecting the activation values ​​of all samples to form a matrix, such as a 10×100 matrix, where 10 is the number of samples and 100 is the number of neurons in the selected layer, this matrix construction process is achieved through sample-by-sample inference, revealing the internal response pattern of the target black-box model to perturbed samples.

[0204] Step S530: Construct a model security profile, which is obtained by fusing a feature sensitivity map generated based on the neuron activation state matrix.

[0205] Step S530: Construct a model security profile, which is obtained by fusing a feature sensitivity map generated based on the neuron activation state matrix.

[0206] The model's security profile is derived using the following formula:

[0207] (30)

[0208] In formula (30), Represents the security profile of the model. Indicates the number of feature sensitivity maps. Indicates the first The fusion weights of the graphs Indicates the first The formula (30) integrates multiple feature sensitivity maps by weighted summation to construct a security profile. The control logic of formula (30) takes the feature sensitivity maps and corresponding fusion weights as inputs, and integrates multiple feature sensitivity maps to construct a model security profile through the process of "allocating map weights → calculating the weighted contribution of a single map → summarizing the weighted results". The core is to adjust the influence of different maps by using weights and integrate multi-dimensional security features by weighted summation.

[0209] No. The sensitivity map of each feature is obtained by the following formula:

[0210] (31)

[0211] In formula (31), Indicates the number of input samples. Indicates the first The formula (31) generates a feature sensitivity map by taking the absolute value of the activation state matrix of multiple samples and averaging them. The control logic of formula (31) takes the activation state matrix of multiple input samples and the number of samples as inputs, and generates a feature sensitivity map through the process of "taking the absolute value of the activation matrix → accumulating the activation intensity of multiple samples → calculating the average of the samples". The core is to quantify the activation intensity of the neurons corresponding to the feature by averaging the absolute values ​​of the activation matrices of multiple samples, and obtain a quantitative map of feature sensitivity.

[0212] Constructing a model security profile involves the concept of fusing feature sensitivity maps. A feature sensitivity map is a heatmap or visualization generated from the neuron activation state matrix, showing the degree of influence of each feature on activation, such as sensitivity calculated through gradients. Specifically, after generating the feature sensitivity map based on the neuron activation state matrix, the fusion process includes weighted averaging of the sensitivities of different layers to form a comprehensive profile, such as a multi-layered chart representing the overall robustness of the model. This profile visually shows where the model is vulnerable to adversarial attacks, thus providing a foundation for security assessment.

[0213] Step S540: Obtain the model's weak link location results. The model's weak link location results are determined by identifying the network layer with the highest sensitivity variance based on the hierarchical vulnerability mapping table generated by the analytical model security profile.

[0214] The results of locating the weak points in the model are obtained using the following formula:

[0215] (32)

[0216] In formula (32), This indicates the results of locating the weak points in the model. Represents a hierarchical vulnerability mapping table. This indicates the network layer with the highest sensitivity variance. This represents the function determined based on the mapping table and the highest variance level. The control logic of formula (32) takes the hierarchical vulnerability mapping table, the network level with the highest sensitivity variance, and the corresponding function as input. Through the process of "inputting key information → function parsing mapping table to identify weak links", the result of locating the weak links of the model is obtained. The core is to rely on the hierarchical vulnerability mapping table to lock the weak point corresponding to the level with the highest sensitivity variance.

[0217] The network layer with the highest sensitivity variance is obtained using the following formula:

[0218] (33)

[0219] In formula (33), Indicates hierarchy The sensitivity variance Indicates network hierarchy Perform the operation of taking the maximum value. The control logic of formula (33) takes the sensitivity variance of each network layer as input, and determines the network layer with the highest sensitivity variance through the process of "traversing the layer variance → locating the maximum variance value → extracting the corresponding layer index" - the core is to filter out the layer with the largest variance based on the sensitivity variance of each layer and lock the most vulnerable network layer.

[0220] hierarchy The sensitivity variance is obtained using the following formula:

[0221] (34)

[0222] In formula (34), Indicates hierarchy The number of sensitivity samples in the sample. Indicates hierarchy The Middle A sensitivity value, Indicates hierarchy The mean of sensitivity. The control logic of formula (34) takes the sensitivity samples, sample size and sensitivity mean of the level as input, and obtains the sensitivity variance of the level through the process of “calculating the square of the deviation between the sample and the mean → summing the square of the deviation → calculating the sample average”. The core is to quantify the degree of discrete fluctuation of the sensitivity value within the level. The larger the variance, the worse the stability of the sensitivity of the level.

[0223] When obtaining the results of model vulnerability localization, it is necessary to analyze the model security profile to generate a layer vulnerability mapping table. This table lists the vulnerability indicators for each network layer, such as variance values. The layer with the highest sensitivity variance is identified; for example, the variance of convolutional layer 2 is 0.45, higher than the 0.2 of other layers, thus identifying it as a vulnerability. Specifically, the analysis process involves statistically analyzing the variability of sensitivity for each layer. The mapping table may show that the input layer has low variance while the output layer has high variance, thus identifying the output layer as a key area for improvement. This localization result helps to optimize the model architecture in a targeted manner, improving overall security.

[0224] Preferably, the large-scale model security evaluation method based on multi-dimensional adversarial attacks provided in this embodiment includes step S600 as follows:

[0225] Step S610: Analyze the weak link location results of the model, extract the network layer index of sensitivity variance anomalies, and generate structured reinforcement requirement data.

[0226] The structural reinforcement requirements data are derived using the following formula:

[0227] (35)

[0228] In formula (35), This indicates data on reinforcement demand. Indicates the exception layer index. Indicates reinforcement priority. Indicates reinforcement strength. The number of abnormal layers is indicated. The control logic of formula (35) takes the number of abnormal layers, the index of each abnormal layer, the reinforcement priority and strength as inputs, and generates reinforcement requirement data through the process of "associating multi-dimensional reinforcement elements of a single abnormal layer → integrating the structured information of all abnormal layers". The core is to bind the key reinforcement information of each abnormal layer to form structured data that can guide the reinforcement operation.

[0229] The network hierarchy index used to extract sensitivity variance anomalies is derived using the following formula:

[0230] (36)

[0231] In formula (36), Indicates the first Network layer anomaly index, For indicator functions, Indicates hierarchy The sensitivity variance The preset abnormal threshold is indicated. The control logic of formula (36) takes the sensitivity variance of the network layer, the preset abnormal threshold and the indicator function as input. Through the process of "traversing the network layer → determining whether the variance exceeds the threshold → extracting the abnormal layer index", the network layer index with abnormal sensitivity variance is obtained. The core is to use the indicator function to filter out the network layer with excessive variance and locate the corresponding abnormal layer index.

[0232] When analyzing the results of weak point localization in the analytical model, it is necessary to extract network layer indexes with abnormal sensitivity variances from complex network layer data. This process involves a detailed analysis of the sensitivity distribution of each layer within the model. Sensitivity variance refers to the degree of fluctuation in the response of a certain layer to different input data, usually calculated using statistical methods. Specifically, in intrusion detection systems in the field of network security, assuming the model contains multiple layers such as input layer, hidden layer, and output layer, the analysis process will check the sensitivity data layer by layer, identify a submodule in the hidden layer with an abnormally high variance value, and then index and record it as a key layer requiring attention, forming structured hardening requirement data for subsequent processing. For example, in financial fraud detection, extracting network layer indexes with abnormal sensitivity variances is specifically for the analysis of transaction data processing models. Suppose that when the model processes tampered transaction records, the response of a certain intermediate layer to minor adjustments of the amount fluctuates greatly. Through analysis, it is found that the sensitivity variance of this layer is much higher than that of other layers. The system will automatically generate hardening requirement data, recording the index and anomaly description of this layer, providing a basis for subsequent hardening.

[0233] Step S620: Map the reinforcement requirement data to a constrained optimization objective function, calculate the inverse gradient direction of the constrained optimization objective function, and establish the inverse optimization solution space.

[0234] The constrained optimization objective function is derived from the following formula:

[0235] (37)

[0236] In formula (37), This represents the constrained optimization objective function. Indicates the first The penalty weight for reinforcement requirements, Indicates the first A function to determine the degree of violation of a hardening constraint. This represents the vector of reinforcement parameters to be optimized. The regularization coefficient indicates that it is used to control the space complexity of the solution. This represents the total number of reinforcement requirements. The control logic of formula (37) takes the reinforcement requirement parameters, constraint functions, parameters to be optimized, and regularization coefficients as inputs. It forms a constraint optimization objective function through the process of "calculating constraint violation penalty terms → weighted constraint penalty → adding regularization terms → constructing a minimization objective function". The core is to constrain the reinforcement parameters to meet the requirements through penalty terms, and control the complexity of the solution through regularization terms. Finally, the function is minimized to obtain reasonable reinforcement parameters.

[0237] The inverse gradient direction of the constrained optimization objective function is derived using the following formula:

[0238] (38)

[0239] In formula (38), Indicates the direction of the inverse gradient. The objective function represents the hardening parameter vector to be optimized. gradient, Represents the currently active set of constraints. Indicates the first A constrained Lagrange multiplier, Indicates the first The gradient of each constraint function. The control logic of formula (38) takes the gradient of the objective function, the set of active constraints and the corresponding Lagrange multipliers, and the gradient of the constraint function as inputs. It determines the inverse gradient direction under constraint optimization through the process of "calculating the negative gradient of the objective function → integrating the gradient terms of the active constraints → fusing the two parts to obtain the inverse direction". The core is to combine the descent direction of the unconstrained objective function with the gradient limit of the active constraints to obtain the gradient direction that is both suitable for objective optimization and satisfies the constraints.

[0240] The solution space for inverse optimization is derived using the following formula:

[0241] (39)

[0242] In formula (39), This represents the solution space for inverse optimization. Represents the decision variables for backward optimization. express One reinforcement constraint condition, The intersection operation represents the set operation. Indicates the current point With center radius The credible search spherical region is used to limit the backward optimization step size and exploration range. The control logic of formula (39) takes the hardening constraints, the current point, the search radius and the decision variables as inputs, and constructs the solution space of backward optimization through the process of "determining the feasible region of constraints → delineating the credible search region → finding the intersection of the two". The core is to simultaneously constrain the decision variables to meet the hardening requirements and the step size / exploration range limit, so as to ensure that the optimization process both meets the constraints and explores within a reasonable range.

[0243] The process of mapping reinforcement requirement data to a constrained optimization objective function requires transforming the reinforcement requirements into a mathematical expression. A constrained optimization objective function typically refers to an optimization objective that meets specific conditions, such as minimizing the model's sensitivity to abnormal inputs. Next, the inverse optimization solution space is established by calculating the inverse gradient direction. This process involves deriving the gradient information of the objective function in reverse to find the reverse path of the optimization direction. For example, in the aforementioned financial fraud detection business, the construction of the inverse optimization solution space specifically manifests as the design of parameter optimization paths for the anomaly-sensitive levels. The system derives the parameter directions that need to be adjusted based on the objective function, forming a virtual optimization space that lays the foundation for subsequent calculations of the weight correction tensor.

[0244] Step S630: Calculate the weight correction tensor in the inverse optimization solution space to obtain the numerical adjustment amount.

[0245] The weighted adjustment tensor is derived using the following formula:

[0246] (40)

[0247] In formula (40), This represents the weight correction tensor. Indicates the numerical adjustment step size. This represents the gradient of the current loss with respect to the weights. This represents the mask within the reverse optimization space. This indicates element-wise multiplication or tensor product operation. The control logic of formula (40) takes the step size adjustment, loss weight gradient, and back optimization space mask tensor as inputs. It calculates the weight correction tensor through the process of "obtaining the correction direction gradient → projecting the gradient to the solution space → controlling the correction magnitude → fusing to obtain the correction tensor". The core is to combine the correction direction of the loss gradient, the range constraint of the back optimization space, and the magnitude control of the step size to obtain the weight adjustment amount that conforms to the solution space.

[0248] The numerical adjustment amount is derived using the following formula:

[0249] (41)

[0250] In formula (41), Indicates the numerical adjustment amount. This represents the overall adjustment coefficient. and These represent the back gradients at the current point and the reference point, respectively. This indicates that the temperature parameter controls the smoothness of the distribution. and This represents two sets of weights in the solution space. The control logic of formula (41) takes the back gradient, weights, adjustment coefficients and temperature parameters as inputs, and obtains the numerical adjustment amount through the process of "quantifying gradient difference → temperature adjustment difference scale → softmax allocation of weight influence → calculating the basic difference of weights → fusing adjustment amplitude". The core is to combine the distribution characteristics of gradient difference and weight difference, and obtain the weight adjustment amount that fits the solution space by controlling the smoothness and amplitude of adjustment through parameters.

[0251] Calculating the weight correction tensor and obtaining numerical adjustments within the inverse optimization solution space refers to fine-tuning the model parameters using mathematical methods to generate specific adjustment values. The weight correction tensor is a multi-dimensional data structure that contains the changes in the parameters that need to be adjusted in the model.

[0252] Step S640: Aggregate the weight update vector sequence generated based on the numerical adjustment amount, and generate the final protection capability enhancement path based on the weight update vector sequence.

[0253] The path to improve protection capabilities is derived using the following formula:

[0254] (42)

[0255] In formula (42), This indicates the final path for enhancing protection capabilities. This represents the total number of time steps or the sequence length of the weight update vector. Indicates the first The weight update vector is generated based on the numerical adjustment. Indicates the first The scaling function for the step numerical adjustment is used to adjust the first step. The contribution intensity of each step update. The control logic of formula (42) takes the weighted update vector sequence, the total number of steps and the scaling function of each step as input. Through the process of "associating single-step update and scaling adjustment → calculating the single-step weighted update amount → accumulating the contribution of all steps → calculating the average of the number of steps", the update sequence is aggregated to generate a path for improving protection capabilities. The core is to adjust the contribution intensity of each step update through the scaling function, and then average and integrate the entire update sequence to obtain the final path for improving protection capabilities by comprehensively optimizing each step.

[0256] Next, the weight update vector sequence generated based on the numerical adjustments is aggregated to produce the final protection capability improvement path. This path refers to the order and manner of a series of parameter adjustments, aiming to improve the overall robustness of the model. For example, in the field of cybersecurity, targeting the weak points of an intrusion detection model, the system calculates the adjustment amount for each parameter, forming a weight update vector sequence, and ultimately generating a complete path from initial adjustments to final optimization, providing guidance for improving the model's protection capabilities.

[0257] The large-model security evaluation method based on multi-dimensional adversarial attacks provided in this embodiment achieves the following beneficial effects compared with existing technologies:

[0258] 1. Comprehensive coverage of multi-dimensional attack scenarios: Construct a set of attack scenarios covering multiple attack targets, multiple input modalities, and multiple model stages, fully exposing the security vulnerabilities of large models in complex real-world environments, and solving the problem of single evaluation scenarios in existing systems.

[0259] 2. Strong adaptability of adversarial examples: adversarial examples are generated differently for different input modalities and model learning stages to improve the success rate of attacks and ensure that the evaluation results can truly reflect the security shortcomings of large models.

[0260] 3. Precise risk quantification: Establish a multi-indicator weighted risk quantification model to transform security risks into quantifiable values, accurately measure the security level of the large model, and provide data support for security decision-making.

[0261] 4. Clear identification of weak links: By integrating security profiles of the model, the attack results are accurately correlated with the characteristics of the large model, the weak modules and the reasons for the vulnerability are clearly identified, and the blind optimization of protection is avoided.

[0262] 5. Assessment and Protection Closed Loop: Based on the weak links, targeted protection improvement paths are generated to achieve closed-loop management of the entire process of "assessment-location-hardening", which effectively improves the safe operation capability of the large model.

[0263] 6. High versatility and adaptability to various types of large models: It can flexibly adapt to security assessments of various large models such as text, images, voice, and multimodal data, and has a wide range of applicable scenarios and strong engineering practicality.

[0264] Although preferred embodiments of the invention have been described, those skilled in the art, upon learning the basic inventive concept, can make other changes and modifications to these embodiments. Therefore, the appended claims are intended to be interpreted as including both the preferred embodiments and all changes and modifications falling within the scope of the invention. Clearly, those skilled in the art can make various alterations and modifications to the invention without departing from its spirit and scope. Thus, if these modifications and modifications of the invention fall within the scope of the claims and their equivalents, the invention is also intended to include these modifications and modifications.

Claims

1. A security evaluation method for large-scale models based on multi-dimensional adversarial attacks, characterized in that, Includes the following steps: S100. By referencing the preset security assessment framework, initial parameters are obtained from the attack target type and attack knowledge base dimensions to generate a multi-dimensional network attack scenario description, resulting in a set of attack scenarios that include data availability disruption and system integrity violation. S200. Based on the set of attack scenarios, a sample generation algorithm is used to adapt the input data modality and the model learning stage to obtain a multimodal adversarial sample sequence. S300. If the multimodal adversarial sample sequence triggers an abnormal model response under black-box attack mode, the sample parameters are adjusted through an optimization algorithm to determine the optimized adversarial sample set. S400. Obtain test response data from the optimized adversarial sample set, use the risk quantification algorithm to calculate the attack success rate index, and obtain the risk quantification value sequence. S500. If the risk quantification value sequence exceeds a preset threshold, the model security profile generation mechanism is integrated to obtain the model weakness location result. S600. Extract reinforcement requirement data from the weak link location results of the model, process the reinforcement requirement data through the reverse application of the optimization algorithm, and generate a path to improve protection capabilities. Step S200 includes: S210. Analyze the multi-source heterogeneous data streams contained in the attack scenario set to determine the input data modality and model learning stage; S220. Construct a multi-dimensional feature space based on the input data modality and model learning stage, and locate the vulnerable feature region of the decision boundary within the multi-dimensional feature space; S230. Calculate the backpropagation gradient for the vulnerable feature region and generate an adaptive perturbation factor matrix; S240. The adaptive perturbation factor matrix is ​​fused with the original input data and time-series arranged according to the attack path logic to obtain a multimodal adversarial sample sequence. Step S300 includes: S310. If a multimodal adversarial sample sequence triggers an abnormal model response under black-box attack mode, the response confidence distribution data is analyzed to filter out a subset of abnormal response samples. S320. Initialize the evolutionary strategy population for the subset of abnormal response samples, and calculate the fitness function value of each entity in the evolutionary strategy population; S330. Generate a new generation of candidate sample set based on the fitness function value, and map the new generation of candidate sample set to the target black box model to obtain feedback information; S340. Update the gradient estimation vector based on the feedback information to correct the perturbation direction, and extract convergent individuals that meet the convergence state judgment index to determine the optimized adversarial sample set. Step S400 includes: S410. Obtain a set of test response confidence vectors from the optimized adversarial sample set, wherein the set of test response confidence vectors is captured by inferring and traversing the optimized adversarial sample set into the target black-box model. S420. Generate a misjudged sample index list based on the test response confidence vector set. The misjudged sample index list is obtained by extracting the predicted category and comparing the predicted category with the true label. S430. Calculate the attack success rate index value based on the misjudged sample index list. The attack success rate index value is obtained by weighting and normalizing the associated confidence value by calling the risk quantification matrix. S440. Construct a risk quantification value sequence based on the attack success rate index value; Step S500 includes: S510. Extract high-risk adversarial sample data, which is obtained by retrieving risk quantification value sequence indexes that exceed preset security thresholds. S520. Construct a neuron activation state matrix, which is composed of the response values ​​captured by inputting the high-risk adversarial sample data into the target black-box model; S530. Construct a model security profile, which is obtained by fusing a feature sensitivity map generated based on the neuron activation state matrix; S540. Obtain the model's weak link location result. The model's weak link location result is determined by identifying the network layer with the highest sensitivity variance based on the hierarchical vulnerability mapping table generated by parsing the model's security profile. Step S600 includes: S610. Analyze the weak link location results of the analytical model, extract the network layer index of sensitivity variance anomalies, and generate structured reinforcement requirement data; The structural reinforcement requirements data are derived using the following formula: ； in, This indicates data on reinforcement demand. Indicates the exception layer index. Indicates reinforcement priority. Indicates reinforcement strength. Indicates the number of exception layers; The network hierarchy index used to extract sensitivity variance anomalies is derived using the following formula: ； in, Indicates the first Network layer anomaly index, For indicator functions, Indicates hierarchy The sensitivity variance Indicates the preset abnormal threshold; S620. Map the reinforcement requirement data to a constrained optimization objective function, calculate the inverse gradient direction of the constrained optimization objective function, and establish the inverse optimization solution space. S630. Calculate the weight correction tensor in the inverse optimization solution space to obtain the numerical adjustment amount; S640. Aggregate the weight update vector sequence generated based on the numerical adjustment amount, and generate the final protection capability enhancement path based on the weight update vector sequence.

2. The large-scale model security evaluation method based on multi-dimensional adversarial attacks according to claim 1, characterized in that, Step S100 includes: S110. Obtain the attack target type and attack knowledge base information, and parse the attack target type and attack knowledge base information to obtain an initial parameter set; S120. Input the initial parameter set into the security assessment framework to determine the multidimensional feature mapping based on the initial parameter set; S130. Generate an attack vector sequence containing data availability anomalies and system integrity failures based on the multidimensional feature mapping; S140. Identify and evolve the key nodes of the attack vector sequence to obtain a set of attack scenarios that include data availability disruption and system integrity violation.

3. The large-scale model security evaluation method based on multi-dimensional adversarial attacks according to claim 1, characterized in that, In step S620, the constrained optimization objective function is obtained through the following formula: ； in, This represents the constrained optimization objective function. Indicates the first The penalty weight for reinforcement requirements, Indicates the first A function to determine the degree of violation of a hardening constraint. This represents the vector of reinforcement parameters to be optimized. The regularization coefficient indicates that it is used to control the space complexity of the solution. This indicates the total quantity of reinforcement required; The inverse gradient direction of the constrained optimization objective function is derived using the following formula: ； in, Indicates the direction of the inverse gradient. The objective function represents the hardening parameter vector to be optimized. gradient, Represents the currently active set of constraints. Indicates the first A constrained Lagrange multiplier, Indicates the first The gradient of each constraint function; The solution space for inverse optimization is derived using the following formula: ； in, This represents the solution space for inverse optimization. Represents the decision variables for backward optimization. express One reinforcement constraint condition, The intersection operation represents the set operation. Indicates the current point With center radius A trusted search spherical region is used to limit the backward optimization step size and exploration range.

4. The large-scale model security evaluation method based on multi-dimensional adversarial attacks according to claim 3, characterized in that, In step S630, the weight correction tensor is obtained using the following formula: ； in, This represents the weight correction tensor. Indicates the numerical adjustment step size. This represents the gradient of the current loss with respect to the weights. This represents the mask within the reverse optimization space. This indicates element-wise multiplication or tensor product operations. The numerical adjustment amount is derived using the following formula: ； in, Indicates the numerical adjustment amount. This represents the overall adjustment coefficient. and These represent the back gradients at the current point and the reference point, respectively. This indicates that the temperature parameter controls the smoothness of the distribution. and This represents two sets of weights in the solution space.

5. The large-scale model security evaluation method based on multi-dimensional adversarial attacks according to claim 4, characterized in that, In step S640, the path to improve protection capability is derived using the following formula: ； in, This indicates the final path for enhancing protection capabilities. This represents the total number of time steps or the sequence length of the weight update vector. Indicates the first The weight update vector is generated based on the numerical adjustment. Indicates the first The scaling function for the step numerical adjustment is used to adjust the first step. The contribution intensity is updated step by step.

Images