Large model resource protection method based on static feature evaluation and dynamic decoding control

Abstract

The invention relates to a large model resource protection method based on static feature evaluation and dynamic decoding control, which comprises the following steps of: receiving a text input by a user, and carrying out preprocessing and static feature analysis on the text to obtain a risk score; based on the risk score, a decoding tendency mode is set, large model reasoning is started, and a dynamic control module is initialized; the dynamic control module dynamically calculates reasoning characteristics and executes real-time decoding intervention in the reasoning process according to the reasoning characteristics; according to a decoding intervention result, if reasoning is terminated in advance, an interrupt signal is sent to a reasoning rear end of the large model, Token generation is forcibly stopped, reasoning fallback is carried out, and a reasoning fallback result is fed back to the user; according to a decoding intervention result, if decoding is inferred to be normal and a termination Token is generated, a complete response is output and fed back to the user. Compared with the prior art, the resource depletion attack can be efficiently recognized before a large number of computing resources are occupied, and deep defense before reasoning and in reasoning is achieved.

Description

TECHNICAL FIELD

[0001] The present application relates to the field of large model resource protection, in particular to a large model resource protection method based on static feature evaluation and dynamic decoding control. BACKGROUND

[0002] The existing large model service system generally uses an open interface or an interactive application as a service delivery form. In this service mode, the server is at risk of resource exhaustion attacks: an attacker can induce a large model to produce lengthy reasoning, cyclic calculation or repetitive thinking paths in the reasoning process by constructing redundant task instructions or malicious suffix information. Such abnormal behavior will consume a large amount of computing resources and reduce system throughput, and in severe cases, it can cause task backlog, increased latency, and even model denial of service. In view of the above risks, the market has clear technical needs for resource security protection of large model AI reasoning services: 1. Abnormal request real-time identification: the need to identify and interrupt abnormal requests in real time during reasoning to avoid redundant reasoning and excessive resource occupation.

[0003] 2. System stability guarantee: the need to implement fine-grained control on single reasoning in an open environment to prevent malicious requests from affecting overall performance.

[0004] 3. Lightweight defense mechanism: the need for a lightweight defense mechanism that can be embedded in the model running layer without additional complex processes to complete risk identification and reasoning control.

[0005] Chinese patent CN119721235A discloses a method and system for accelerating large model reasoning using dynamic tree structure speculation decoding, which generates predicted characters using a small model to generate a tree structure, and inputs the input text and the predicted characters generated by the small model into a large model to determine whether to receive the predicted characters generated by the small model through the large model reasoning process, thereby dynamically adjusting the prediction tree structure. This method can generate more tokens while increasing the prediction length through the dynamic tree structure speculation decoding method, fully utilizes the parallel processing capability of general-purpose graphics processors, and realizes the acceleration of large model reasoning. However, this method cannot identify and interrupt abnormal requests in real time during reasoning, and the adjustment process is complex.

[0006] Therefore, there is a need for a lightweight defense method that can be embedded in the model running layer, which can identify and interrupt abnormal requests in real time during reasoning, implement fine-grained control on single reasoning, and prevent malicious requests from affecting overall performance. SUMMARY

[0007] The purpose of the present application is to overcome the defects of the prior art and provide a large model resource protection method based on static feature evaluation and dynamic decoding control, which completes context length allocation and decoding process control based on static risk evaluation and dynamic inference features, and realizes early identification and real-time inhibition of excessive inference behavior.

[0008] The purpose of the present application can be achieved by the following technical solutions: According to the first aspect of the present application, a large model resource protection method based on static feature evaluation and dynamic decoding control is provided, which comprises the following steps: Step 1: receiving user input text, pre-processing and static feature analysis of the text, and obtaining a risk score; Step 2: based on the risk score, setting a decoding tendency mode, starting large model inference, and initializing a dynamic control module; Step 3: the dynamic control module dynamically calculates the inference features, and performs real-time decoding intervention of the inference process according to the inference features; Step 4: according to the decoding intervention result, if the inference is terminated in advance, an interrupt signal is sent to the inference backend of the large model, the Token generation is forcibly stopped, and the inference is rolled back, and the inference rollback result is fed back to the user; Step 5: according to the decoding intervention result, if the inference decoding normally generates a terminated Token, the complete response is output to the user.

[0009] As a preferred technical solution, in step 1, if the pre-processed text contains embedded redundant tasks, step 1 comprises the following steps: Step 101: receiving user original input text and pre-processing; Step 102: performing fast feature extraction on the pre-processed text to extract statistical features and language pattern vector features; Step 103: performing task difficulty matching detection to evaluate the expected difficulty of the main task and the embedded redundant task in the pre-processed text, and calculating a difficulty matching score; Step 104: calculating the risk score according to a weighted score function based on the statistical features, language pattern vector features and difficulty matching score.

[0010] As a preferred technical solution, in step 1, if the pre-processed text does not contain embedded redundant tasks, step 1 comprises the following steps: Step 111: receiving user original input text and pre-processing; Step 112: performing fast feature extraction on the pre-processed text to extract statistical features and language pattern vector features; Step 113: Calculate the risk score according to a weighted scoring function based on statistical features and language pattern vector features.

[0011] As a preferred technical solution, the preprocessing includes useless character denoising and Unicode encoding normalization.

[0012] As a preferred technical solution, the statistical features include length, suffix repetition rate, and rare token proportion.

[0013] As a preferred technical solution, the language pattern vector features include adversarial suffix features, explicit reasoning incentive phrase features, and embedded redundant task instruction features.

[0014] As a preferred technical solution, step 2 includes the following steps: determining a length threshold according to resource usage to limit the maximum generation length of the large model under the length threshold to minimize resource consumption of malicious request execution over-reasoning; otherwise, configure the decoding tendency mode as normal and assign a default maximum generation length. Start the decoding process of large model inference and initialize the dynamic control module.

[0015] As a preferred technical solution, step 3 includes the following steps: The dynamic control module calculates the inference features of the current generated Token in real time, including reasoning trigger word density and termination Token delay. determine whether the reasoning trigger word density or termination Token delay exceeds the corresponding preset threshold, If so, further determine the degree of exceeding the threshold, if the threshold is seriously exceeded, terminate the inference in advance, otherwise, according to the frequency of reasoning trigger words in the current branch, down-regulate the sampling weight or implement pruning on the branches exceeding the threshold to suppress branch expansion, and apply a positive reward to the Logit score of the termination Token to prompt the model to terminate output; If not, no decoding intervention is applied.

[0016] As a preferred technical solution, the inference rollback specifically extracts the answer from the current generated partial inference, and uses the generated partial inference or the extracted answer as the inference rollback result.

[0017] As a preferred technical solution, the method further includes: recording the input text of this request, the risk score, the decoding trajectory length, and the triggered decoding intervention action for continuous optimization.

[0018] According to a second aspect of the present application, there is provided an electronic device comprising a memory and a processor, the memory having stored thereon a computer program, the processor implementing the method when executing the program.

[0019] According to a third aspect of the present application, there is provided a computer readable storage medium having stored thereon a computer program, the program implementing the method when executed by a processor.

[0020] Compared with the prior art, the present application has the following beneficial effects: (1) Two-stage mixed defense architecture: the present application proposes a two-stage mixed defense architecture, combining static analysis based on multi-scale feature evaluation and dynamic control based on model decoding behavior monitoring, which can efficiently identify resource exhaustion attacks before a large amount of computing resources are occupied, and achieve in-depth defense before and during reasoning.

[0021] (2) Decoding tendency control based on static task difficulty: the present application innovatively introduces a decoding tendency allocation strategy based on task difficulty matching, which accurately identifies low-value and high-consumption malicious requests by comparing the expected difficulty of the main task with the computational overhead of the embedded redundant task, and strictly limits the maximum generation length of reasoning to a lower threshold, thereby achieving a source blocking and cost-optimized defense strategy for attacks.

[0022] (3) Real-time decoding intervention in the decoding stage: the present application proposes fine-grained intervention in the decoding stage, and the real-time decoding control module acts on the Logits output stage of the model, directly offsets the delayed termination effect induced by attacks by applying positive rewards to specific termination tokens, and can also suppress the expansion of redundant reasoning paths, thereby achieving active and accurate control of the model reasoning process, and reducing the reasoning length and energy consumption of malicious requests to a safe range. BRIEF DESCRIPTION OF DRAWINGS

[0023] Figure 1 The method flowchart of the present application. DETAILED DESCRIPTION

[0024] The technical solutions in the embodiments of the present application will be clearly and completely described below with reference to the drawings in the embodiments of the present application. Obviously, the described embodiments are part of the embodiments of the present application, rather than all the embodiments. Based on the embodiments in the present application, all other embodiments obtained by those of ordinary skill in the art without creative labor should fall within the scope of protection of the present application.

[0025] Unless otherwise defined, technical terms and scientific terms used in the present application shall have the same meaning as commonly understood by one of ordinary skill in the art to which this application pertains. The terms "a", "an", "one", "this", and similar referents in the context of describing the application are to be construed to be inclusive, not exclusive. For example, the use of the term "a" or "one" or "the" to refer to an item shall not (except where otherwise expressly so limited) be construed to exclude the presence of two or more such items. The use of the term "or" in the context of describing the application shall not be construed to be exclusive, that is, the use of "or" in such contexts will mean that the word is used in the "inclusive" sense. The terms "comprising", "including", "containing", and "having" are intended to be inclusive and mean that there can be additional elements other than the listed elements. The use of the term "connected" to describe a relationship between or among two or more objects shall not be construed as excluding the presence of one or more intervening objects between the related objects. The term "plurality" means two or more. The term "and / or" means "and" or "or". The term "first", "second", "third", etc. are used to distinguish between similar objects, and do not necessarily indicate a specific order or sequence.

[0026] To further describe the technical solutions of the present application, some professional terms mentioned in the embodiments are explained as follows: 1. Large Reasoning Model (LRM): a generative large language model with complex logical reasoning and slow thinking capabilities.

[0027] 2. Adversarial Suffix: a small piece of text appended at the end of normal user input, used to trigger specific malicious behavior of the large model.

[0028] 3. Explicit reasoning instruction: an explicit requirement in user input for the large model to perform redundant reasoning or analyze reasoning branches, such as "solve the problem in 3 ways", "analyze each step of reasoning in detail from multiple angles".

[0029] 4. Redundant task embedding: in addition to the main task of normal user input, additional redundant tasks are added to increase the length of reasoning, such as using base64 encoding for the main task description and requiring the large model to complete the task after decoding.

[0030] The present embodiment provides a large model resource protection method based on static feature evaluation and dynamic decoding control, as shown in Figure 1 The method comprises the following steps: Step 1: Receive user input text, pre-process the text and perform static feature analysis, and obtain risk score.

[0031] Step 1 includes the following steps: Step 101: Receive the user's original input text (T) and use the pre-processing module to perform useless character denoising and Unicode encoding normalization. Step 102: The feature extraction module performs fast feature extraction on the pre-processed text T' to extract statistical features (length, suffix repetition rate, and rare token proportion, etc.) and language pattern vector features (adversarial suffix features, explicit reasoning incentive phrase features, and embedded redundant task instruction features, etc.). In one embodiment, the language pattern vector feature extraction method of the feature extraction module is not limited to fixed rules or statistical methods. A Named Entity Recognition (NER) model or a text structure labeling model can be used to label the structural components of the text segments in the input prompt T' to generate language feature vectors. Or use a large language model to directly extract high-level semantic features or implicit reasoning pattern features, and then input the extraction results into a vectorization model (such as Sentence-BERT or Qwen3-embedding, etc.) to generate a vector representation for risk assessment. The above models can be used jointly to generate composite language features through multi-layer fusion to improve feature discrimination accuracy and risk score robustness.

[0032] Step 103: Perform task difficulty matching detection to assess the expected difficulty of the main task and possible embedded redundant tasks in the pre-processed text T', and calculate the difficulty matching score. If there is no redundant task, this step is not performed.

[0033] In this step, if the difficulty of the "low difficulty main task" and the "high computational embedded task" does not match, it may be a high-risk request, which will cause the risk score calculated in step 104 to be high.

[0034] Step 104: Calculate the risk score based on the weighted scoring function R(T') based on statistical features, language pattern vector features, and possible difficulty matching scores.

[0035] Step 2: The static control module sets the decoding tendency mode based on the risk score, starts the large model reasoning, and initializes the dynamic control module.

[0036] Step 2 includes the following steps: Step 201: Determine whether the risk score R(T') is greater than or equal to the high-risk threshold R Thres, if yes, configure the decoding tendency mode as conservative (CONSERVATIVE), in the conservative decoding tendency mode, a length threshold is determined according to the resource usage, and the maximum generation length max_token of the large model is limited to the length threshold, so as to minimize the resource consumption of malicious request execution over-inference; otherwise, the decoding tendency mode is configured as normal (NORMAL), and a default maximum generation length max_token is assigned; Step 202: Start the decoding process of the large model inference, and initialize the dynamic control module.

[0037] Step 3: The dynamic control module dynamically calculates the inference feature, and performs real-time decoding intervention of the inference process according to the inference feature.

[0038] Step 3 includes the following steps: Step 301: The dynamic control module calculates the inference feature of the current generated Token in real time, including the inference trigger word density RTD and the termination Token delay N e ; Step 302: Determine whether the inference trigger word density RTD or the termination Token delay N e is beyond the corresponding preset threshold, Step 303: If yes, further determine the degree of exceeding the threshold, if the threshold is seriously exceeded (for example, exceeding the threshold by a preset proportion), the real-time decoding intervention module terminates the inference in advance, otherwise, the real-time decoding intervention module down-regulates the sampling weight or implements trajectory pruning on the branch exceeding the threshold according to the frequency of the inference trigger word in the current branch, so as to suppress the branch expansion, and applies a positive reward to the Logit score of the termination Token, so as to promote the model to terminate the output; Step 304: If no, no decoding intervention is applied.

[0039] In an embodiment, the real-time decoding intervention module can be implemented by specifying a custom Logits processor in the inference framework. It can also be replaced by a custom sampling controller or other methods that adjust the weight or suppress the sampling probability in the inference sampling stage to control the inference length and branch expansion.

[0040] Step 4: According to the decoding intervention result, if the inference is terminated in advance, a stop signal is sent to the inference backend of the large model to force the Token generation to stop, and the inference rollback is performed, and the inference rollback result is fed back to the user.

[0041] In this embodiment, the inference rollback is specifically: extracting the answer R'' from the current generated part of the inference R', for example, calling a small answer extractor or performing semantic compression / summary, taking the generated part of the inference R' or the extracted answer R'' as the inference rollback result.

[0042] Step 5: According to the decoding intervention result, if the decoding is normally generated to terminate the Token, output the complete response feedback to the user.

[0043] Step 6: Record the input text of this request, risk score, decoding track length and triggered decoding intervention action for continuous optimization.

[0044] The electronic device includes a central processing unit (CPU) that can perform various appropriate actions and processes according to computer program instructions stored in a read-only memory (ROM) or loaded from a storage unit into a random access memory (RAM). In the RAM, various programs and data required for device operation can also be stored. The CPU, ROM, and RAM are connected to each other through a bus. An input / output (I / O) interface is also connected to the bus.

[0045] A plurality of components in the device are connected to the I / O interface, including: an input unit such as a keyboard, a mouse, etc.; an output unit such as various types of displays, a speaker, etc.; a storage unit such as a magnetic disk, an optical disk, etc.; and a communication unit such as a network card, a modem, a wireless communication transceiver, etc. The communication unit allows the device to exchange information / data with other devices through a computer network such as the Internet and / or various telecommunication networks.

[0046] The processing unit performs the various methods and processes described above, such as method steps 1-6. For example, in some embodiments, the method steps 1-6 can be implemented as a computer software program that is tangibly embodied in a machine-readable medium, such as the storage unit. In some embodiments, part or all of the computer program can be loaded and / or installed on the device via the ROM and / or the communication unit. When the computer program is loaded into the RAM and executed by the CPU, one or more of the method steps 1-6 described above can be performed. Alternatively, in other embodiments, the CPU can be configured, by any appropriate means (e.g., by means of firmware), to perform the method steps 1-6.

[0047] The functions described above in this detailed description can be performed at least in part by one or more hardware logic components. For example, and without limitation, illustrative types of hardware logic components that can be used include field-programmable gate arrays (FPGAs), application-specific integrated circuits (ASICs), application-specific standard products (ASSPs), system-on-a-chip systems (SOCs), complex programmable logic devices (CPLDs), etc.

[0048] Program code for carrying out methods of the present application can be written in any combination of one or more programming languages. This program code can be provided to a processor or controller of a general purpose computer, special purpose computer, or other programmable data processing apparatus to produce a machine, such that the program code, when executed by the processor or controller, produces a means for implementing the functions / operations specified in the flowchart diagrams and / or block diagrams. The program code can be executed entirely on a machine, partially on a machine, partially on a machine as a stand-alone software package, or entirely on a remote machine or server.

[0049] In the context of the present application, a machine-readable medium can be a tangible medium that can contain or store program for use by or in connection with an instruction execution system, apparatus, or device. The machine-readable medium can be a machine-readable signal medium or a machine-readable storage medium. Machine-readable storage medium can include, without limitation, electronic, magnetic, optical, electromagnetic, infrared, or semiconductor system, apparatus, or device, or any suitable combination of the foregoing. More specific examples of the machine-readable storage medium will include one or more lines of electrical connections, portable computer disks, hard disk, random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM or Flash memory), optical fibers, portable compact disc read-only memory (CD-ROM), optical storage device, magnetic storage device, or any suitable combination of the foregoing.

[0050] The above description is only specific embodiments of the present application, but the protection scope of the present application is not limited thereto, and any person skilled in the art can easily think of various equivalent modifications or replacements within the technical scope disclosed by the present application, and these modifications or replacements should be covered within the protection scope of the present application. Therefore, the protection scope of the present application should be subject to the protection scope of the claims.

Claims

1. A method for protecting large model resources based on static feature evaluation and dynamic decoding control, characterized in that, The method includes the following steps: Step 1: Receive user input text, preprocess the text and perform static feature analysis to obtain a risk score; Step 2: Based on the risk score, set the decoding tendency mode, start the large model inference, and initialize the dynamic control module; Step 3: The dynamic control module dynamically calculates the reasoning features and performs real-time decoding intervention in the reasoning process based on the reasoning features; Step 4: Based on the decoding intervention results, if the inference is terminated prematurely, an interrupt signal is sent to the inference backend of the large model to forcibly stop token generation and perform inference rollback, and the inference rollback result is fed back to the user. Step 5: Based on the decoding intervention results, if the inference decoding successfully generates a termination token, then output a complete response to the user.

2. The method for protecting large model resources based on static feature evaluation and dynamic decoding control according to claim 1, characterized in that, In step 1, if the preprocessed text contains embedded redundant tasks, then step 1 includes the following steps: Step 101: Receive the user's original input text and preprocess it; Step 102: Perform fast feature extraction on the preprocessed text to extract statistical features and language pattern vector features; Step 103: Perform task difficulty matching detection, evaluate the expected difficulty of the main task and the embedded redundant tasks in the preprocessed text, and calculate the difficulty matching score. Step 104: Calculate the risk score based on the weighted scoring function that is based on statistical features, language pattern vector features, and difficulty matching score.

3. The method for protecting large model resources based on static feature evaluation and dynamic decoding control according to claim 1, characterized in that, In step 1, if the preprocessed text does not contain any embedded redundant tasks, then step 1 includes the following steps: Step 111: Receive the user's original input text and preprocess it; Step 112: Perform fast feature extraction on the preprocessed text to extract statistical features and language pattern vector features; Step 113: Calculate the risk score based on the weighted scoring function based on statistical features and language pattern vector features.

4. The method for protecting large model resources based on static feature evaluation and dynamic decoding control according to claim 1, characterized in that, The preprocessing includes denoising of useless characters and Unicode encoding normalization.

5. A method for protecting large model resources based on static feature evaluation and dynamic decoding control according to claim 2 or 3, characterized in that, The statistical features include length, suffix repetition rate, and proportion of rare tokens.

6. A method for protecting large model resources based on static feature evaluation and dynamic decoding control according to claim 2 or 3, characterized in that, The language pattern vector features include adversarial suffix features, explicit reasoning-incentivized phrase features, and embedded redundant task instruction features.

7. The method for protecting large model resources based on static feature evaluation and dynamic decoding control according to claim 1, characterized in that, Step 2 includes the following steps: Determine whether the risk score is greater than or equal to the high-risk threshold. If so, configure the decoding tendency mode as conservative. In conservative decoding tendency mode, determine a length threshold based on resource usage and limit the maximum generation length of the large model to the length threshold to minimize the resource consumption of malicious requests performing excessive inference. Otherwise, configure the decoding tendency mode as normal and allocate the default maximum generation length. Initiate the decoding process for large model inference and initialize the dynamic control module.

8. The method for protecting large model resources based on static feature evaluation and dynamic decoding control according to claim 1, characterized in that, Step 3 includes the following steps: The dynamic control module calculates the inference features of the currently generated tokens in real time, including the density of inference trigger words and the delay of the termination token. Determine whether the inference trigger word density or termination token delay exceeds the corresponding preset threshold. If so, further determine the degree to which it exceeds the threshold. If it severely exceeds the threshold, terminate the inference early. Otherwise, based on the frequency of the inference trigger words in the current branch, reduce the sampling weight of the branch that exceeds the threshold or prune it to suppress branch expansion, and apply a positive reward to the Logit score of the termination token to prompt the model to terminate the output. If not, no decoding intervention will be applied.

9. A method for protecting large model resources based on static feature evaluation and dynamic decoding control according to claim 1, characterized in that, The aforementioned reasoning rollback specifically involves extracting the answer from the currently generated partial reasoning and using the generated partial reasoning or the extracted answer as the reasoning rollback result.

10. A method for protecting large model resources based on static feature evaluation and dynamic decoding control according to claim 1, characterized in that, The method further includes recording the input text, risk score, decoding trajectory length, and triggered decoding intervention actions of this request for continuous optimization.

Images