A method and system for fourth-order linkage-based large model adaptive security detection

Abstract

The application discloses a kind of big model self-adapting safety detection method and system based on four-stage linkage, and the safety detection of big model output content is realized by four-stage cooperation linkage: context consistency reasoning stage is calculated to generate text and the semantic consistency score of multi-round dialogue history, user prompt word and external knowledge base, and mark potential risk;Causal chain risk detection stage models multi-round dialogue as causal graph, calculates risk path probability and matches attack mode library, and marks high risk;Dynamic game optimization stage constructs the game space of detector and attacker, solves optimal detection threshold and links to update each stage parameter;According to system performance and risk situation, switch between low-power monitoring state and dynamic updating state in cycle state switching stage, and output risk level is integrated four-stage result.The application solves the problems of low detection rate, high false alarm, risk non-traceability and resource waste in prior art, realizes self-adapting, low false alarm, traceability and high efficiency and energy saving.

Description

Technical Field

[0001] This invention belongs to the field of artificial intelligence security technology, specifically relating to a method and system for adaptive security detection of large models based on four-order linkage. Background Technology

[0002] With the widespread application of Large Language Models (LLMs) in customer service, content generation, and intelligent question answering, the security issues of their output are becoming increasingly prominent. Because LLM outputs are generated based on network predictions, they are vulnerable to cue word injection attacks, leading to risks such as toxic language, privacy leaks, and the illusion of a large model. Existing large model output security detection technologies have the following core flaws:

[0003] 1. Lack of context: Most mainstream detection methods use static classifiers, which only support risk assessment at the single-turn and single-sentence level and cannot analyze the risks that gradually escalate in multi-turn dialogues.

[0004] 2. Limitations of static detection: The detection threshold is fixed, and the defense strength cannot be dynamically adjusted according to the attacker's strategy or system performance, resulting in a high false negative rate when facing new types of attacks, or a high false positive rate for normal user conversations.

[0005] 3. High false positive rate and lack of source tracing capability: It lacks a deep understanding of semantic consistency and is prone to misjudging normal topic switching as risk; at the same time, it does not model risk paths and cannot locate the source of attacks.

[0006] 4. Inability to identify covert attacks: Lacks the ability to detect complex attack patterns such as step-by-step inducement and logical vulnerability exploitation.

[0007] To address the aforementioned issues, there is an urgent need for a comprehensive detection method that covers the entire process from "context awareness to causal chain tracing, dynamic game theory, and state optimization" to achieve adaptive, low-false-positive, traceable, and resource-efficient security detection for large models. Summary of the Invention

[0008] This invention aims to overcome the shortcomings of existing large model security detection technologies. It provides a method and system for adaptive security detection of large models based on four-stage linkage. Through four-stage linkage of "contextual consistency reasoning → causal chain risk detection → dynamic game optimization → cyclic state switching", combined with multi-dimensional risk factors and dynamic parameter adjustment, adaptive security detection of the output content of large models can be achieved.

[0009] Firstly, this invention proposes a method for adaptive security detection of a large model based on fourth-order linkage, which includes the following steps:

[0010] Contextual consistency reasoning: Calculate the semantic consistency score between the generated text and the multi-turn dialogue history, user prompts, and external knowledge base, and mark potential risks;

[0011] Causal chain risk detection: Model multi-turn dialogues as causal graphs, calculate the probability of risky paths and match them with an attack pattern library to mark high risks;

[0012] Dynamic game optimization: Construct a game space between the detector and the attacker, solve for the optimal detection threshold, and update the parameters at each stage in a coordinated manner;

[0013] Cyclic state switching: Switching between low-power monitoring state and dynamic update state based on system performance and risk profile; and

[0014] Based on the results of the above four stages, a risk level score and corresponding risk level are output.

[0015] Preferably, the context-consistent reasoning specifically includes:

[0016] Perform context-consistent reasoning to construct a semantic chain consisting of user prompt word P, generated text T, multi-turn dialogue history H, and external knowledge base K. Encode H, T, P, and K into vector representations using a large language model or sentence vector model: h i =Enocder(H i ),t=Encoder(T),p=Encoder(P),k j =Encoder(k j ), where h i Let k represent the content of the i-th round of dialogue in the history of a multi-turn dialogue. j This represents the j-th rule or piece of information in an external knowledge base;

[0017] Calculate the relationship between t and each h i Each k j The semantic consistency score C is obtained by weighting the cosine similarity of p, and by introducing a topic-aware threshold and a knowledge base matching confidence threshold δ to dynamically adjust the weight coefficients α and β, and setting a risk judgment threshold θ. c And the entropy of the generated text information H(T), the entropy threshold τ, if C < θ c And H(T)>τ, the marked text is a potential risk.

[0018] Preferably, the causal chain risk detection specifically includes:

[0019] Perform causal chain risk detection, modeling each round of dialogue in the multi-turn dialogue history H as nodes V = {v1, v2, ..., v...} n}, by concatenating semantic vectors [v i ;v j The input is a two-layer neural network MLP, and the causal dependency weights from round i to j are calculated using the sigmoid activation function. v i This represents the i-th round of dialogue;

[0020] Enumerate all dialogue paths and calculate the risk probability of each path by multiplying the transition probabilities. n represents the total number of rounds in the historical dialogue, and j represents the successor node of i;

[0021] P is calculated using EMD distance. risk The RiskScore is obtained by comparing the similarity to a predefined attack pattern library P. If P risk If the RiskScore is greater than 0.65 (risk threshold) or the path matching attack pattern RiskScore is greater than 0.75 (matching risk type threshold), then it is marked as high risk.

[0022] Preferably, the dynamic game optimization specifically includes:

[0023] Construct the detector policy space Θ = {0.50, 0.55, ..., 0.90} and the user policy space A = {direct attack, induced attack, evasion attack}, and define the utility function U. d =λ·DR(θ,a)-(1-λ)·FPR(θ), where θ is the threshold of the detector's decision variable, DR represents the attack detection rate, FPR represents the false alarm rate, and λ represents the security weight coefficient;

[0024] The optimal threshold is obtained by solving the Nash equilibrium using a maximum-minimum strategy. Based on the current threshold θ t Attacker's optimal strategy a * And the learning rate η dynamically updates the threshold Represents the detector utility function U d The gradient with respect to the threshold θ, that is, the change of θ with respect to U d The direction and rate of influence;

[0025] And update the context consistency threshold θ synchronously. c =θ * Historical weighting coefficient α, information entropy threshold τ, risk probability threshold P risk and the pattern matching threshold RiskScore.

[0026] Preferably, the cyclic state switching specifically includes:

[0027] Define the state control flag L t When the utility gradient convergence condition is met simultaneously Threshold stability condition The detection performance meets the following conditions: FPR < 0.05 and DR > 0.95; system risk status conditions. When, where N high_risk N represents the number of high-risk dialogue samples. totalL represents the total number of samples tested. t When = 1, the system enters a low-power monitoring state and freezes all dynamic parameters;

[0028] When the attack strategy evolution ΔSim is detected EMD >ρ, deteriorating risk situation Or system performance degradation When ρ is the pattern difference threshold, when L t When = 0, restart the gradient calculation module and unfreeze and update the parameters.

[0029] Preferably, the output of the risk level score and corresponding risk level based on the combined results of the above four stages includes:

[0030] Calculate the comprehensive risk score R for detection: R = μ1·C + μ2·P risk +μ3(1-θ * ), where μ1, μ2, μ3 are weighting coefficients, and μ1 + μ2 + μ3 = 1, based on R and the preset risk level threshold R. low and R high Output the final risk level:

[0031] Preferably, the dynamic adjustment of the weighting coefficients α and β adopts a dual-threshold mechanism:

[0032]

[0033] Where α + β + γ = 1, γ is the weighting coefficient of p, and the default values ​​are α = 0.5, β = 0.2, γ = 1 - α - β. The default value of δ is 0.7, and θ c The default value is 0.6, and the default value of τ is 1.8.

[0034] Preferably, the transition probability N(i) is the set of successor nodes of i, and the EMD distance calculation formula is: And satisfy ∑ j f ij ≤P i , ∑ i f ij ≤Q j .

[0035] Preferably, the attacker's optimal strategy a * =argmax a U a (θ t ,a), where, U a (θ t ,a)=(1-DR(θ t ,a))-μ·Cost(a), Cost(a)=[wt ·T(a)+w c ·C(a)+w s ·S(a)], Cost(a) represents the total cost of the attack, T(a) is the time cost, C(a) is the computational resource cost, S(a) is the concealment cost, w t w c w s These are weighting coefficients, defaulting to w. t =0.4, w c =0.4, w s =0.2, η=0.01, μ represents the cost weight, with a default value of 0.3, and θ takes values ​​of [0.4,0.9], with a maximum update increment of 0.05 per hour.

[0036] Preferably, the determination criterion for the evolution of the attack strategy is as follows: Among them, P new P represents a new set of attack modes. base This represents the original attack pattern library, with ρ having a default value of 0.3, and N... high_risk N represents the number of high-risk dialogue samples. total This represents the total number of samples tested.

[0037] Preferably, the default value of μ1 is 0.4, the default value of μ2 is 0.4, the default value of μ3 is 0.2, and R low The default value is 0.3, R high The default value is 0.7.

[0038] Preferably, the steps further include:

[0039] Parameter definition: Define the input and output parameters. The input parameters include the user prompt word P, the text T generated by the large language model LLM, the multi-turn dialogue history H, and the external knowledge base K. The output parameter is the risk level score R.

[0040] Secondly, embodiments of the present invention provide a system for adaptive security detection of a large model based on four-order linkage, the system comprising:

[0041] The context consistency reasoning module is used to calculate the semantic consistency score between the generated text and the multi-turn dialogue history, user prompts, and external knowledge base, and to mark potential risks.

[0042] The causal chain risk detection module is used to model multi-turn dialogues as causal graphs, calculate the probability of risky paths and match them with an attack pattern library, and mark high risks.

[0043] The dynamic game optimization module is used to construct the game space between the detector and the attacker, solve for the optimal detection threshold, and update the parameters at each stage in a coordinated manner.

[0044] The cyclic state switching module is used to switch between low-power monitoring state and dynamic update state according to system performance and risk status.

[0045] The risk scoring module is used to comprehensively calculate and output the risk level score and corresponding risk level.

[0046] The modules work together in sequence to achieve adaptive security detection of the large model.

[0047] Thirdly, embodiments of the present invention provide an electronic device, including: one or more processors; and a storage device for storing one or more programs, wherein when the one or more programs are executed by the one or more processors, the one or more processors implement the method described in any implementation of the first aspect.

[0048] Fourthly, embodiments of the present invention provide a computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, implements the method as described in any of the implementations of the first aspect.

[0049] Compared with the prior art, the beneficial results of the present invention are as follows:

[0050] This invention proposes a four-stage integrated detection method encompassing contextual consistency reasoning, causal chain risk detection, dynamic game theory optimization, and security response. This method effectively addresses the shortcomings of existing technologies, such as the inability to identify multi-turn covert attacks, lack of dynamic adaptability, high false positive rates, and lack of traceability. Specific technical effects include: accurately identifying user-guided attack intentions through implicit logical chains in multi-turn dialogues, achieving covert attack detection; dynamically adjusting detection thresholds based on user behavior, minimizing interference with normal user experience while ensuring security; providing a complete risk factor chain and audit logs, meeting compliance, interpretability, and traceability requirements; and continuously evolving detection capabilities with updates to the risk pattern library, exhibiting adaptive and continuous optimization potential. This invention can be deployed independently or integrated with existing detection technologies to form a matrix defense system, significantly improving the overall security and controllability of content generated by large language models. Attached Figure Description

[0051] The accompanying drawings are included to provide a further understanding of the embodiments and are incorporated in and constitute a part of this specification. The drawings illustrate embodiments and, together with the description, serve to explain the principles of the invention. Other embodiments and many anticipated advantages of the embodiments will be readily recognized as they become better understood through reference to the following detailed description. Elements in the drawings are not necessarily to scale. The same reference numerals refer to corresponding similar parts.

[0052] Figure 1This is a flowchart illustrating the adaptive security detection method for large models based on fourth-order linkage, according to an embodiment of the present invention.

[0053] Figure 2 This is a flowchart of a specific embodiment of the present invention: a four-level linkage adaptive security detection process.

[0054] Figure 3 This is a flowchart of dynamic game parameter adjustment in a specific embodiment of the present invention;

[0055] Figure 4 This is a flowchart of a loop state switching in a specific embodiment of the present invention;

[0056] Figure 5 This is a schematic diagram of the system architecture for large-model adaptive security detection based on fourth-order linkage, according to an embodiment of the present invention.

[0057] Figure 6 This is a schematic diagram of the structure of a computer device suitable for implementing electronic devices according to embodiments of the present invention. Detailed Implementation

[0058] The present invention will now be described in further detail with reference to the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are merely illustrative of the invention and not intended to limit it. Furthermore, it should be noted that, for ease of description, only the parts relevant to the invention are shown in the accompanying drawings.

[0059] It should be noted that, unless otherwise specified, the embodiments and features described in the present invention can be combined with each other. The present invention will now be described in detail with reference to the accompanying drawings and embodiments.

[0060] To address the shortcomings of existing technologies, the improvements in this invention mainly include: 1) Proposing context-aware detection, pioneering a dialogue history embedding mechanism to solve the blind spot of multi-turn attacks, and combining historical dialogues and external knowledge bases to calculate semantic consistency scores and identify abnormal logical jumps; 2) Constructing a causal chain risk detection model. Multi-turn dialogues are modeled as causal graphs, and a risk propagation graph model is established to identify step-by-step induced attacks; 3) Introducing dynamic game optimization. Security detection is modeled as an attack-defense game, and thresholds are adjusted in real time to balance security and user experience.

[0061] In a first aspect, embodiments of the present invention disclose a method for adaptive security detection of a large model based on fourth-order linkage, such as... Figure 1 As shown, the method includes the following steps:

[0062] S1. Contextual Consistency Reasoning: Calculate the semantic consistency score between the generated text and the multi-turn dialogue history, user prompts, and external knowledge base, and mark potential risks;

[0063] This step specifically includes:

[0064] S11. Perform context-consistent reasoning to construct a semantic chain of user prompt word P, generated text T, multi-turn dialogue history H, and external knowledge base K. Encode H, T, P, and K into vector representations using a large language model or sentence vector model: h i =Encoder(H i ),t=Encoder(T),p=Encoder(P),k j =Encoder(K j ), where h i Let k represent the content of the i-th round of dialogue in the history of a multi-turn dialogue. j This represents the j-th rule or piece of information in an external knowledge base;

[0065] S12, Calculate the relationship between t and each h. i Each k j The semantic consistency score C is obtained by weighting the cosine similarity of p, and by introducing a topic-aware threshold and a knowledge base matching confidence threshold δ to dynamically adjust the weight coefficients α and β, and setting a risk judgment threshold θ. c And the entropy of the generated text information H(T), the entropy threshold τ, if C < θ c And H(T)>τ, the marked text is a potential risk.

[0066] Specifically, the dynamic adjustment of the weighting coefficients α and β adopts a dual-threshold mechanism:

[0067]

[0068] Where α + β + γ = 1, γ is the weighting coefficient of p, and the default values ​​are α = 0.5, β = 0.2, γ = 1 - α - β. The default value of δ is 0.7, and θ c The default value is 0.6, and the default value of τ is 1.8.

[0069] S2, Causal Chain Risk Detection: Models multi-turn dialogues as causal graphs, calculates the probability of risky paths and matches them with an attack pattern library, and marks high-risk paths.

[0070] In this embodiment, causal chain risk detection specifically includes:

[0071] S21. Perform causal chain risk detection, and model each round of dialogue in the multi-round dialogue history H as a node V = {v1, v2, ..., v...} n}, by concatenating semantic vectors [v i ;v j The input is a two-layer neural network MLP, and the causal dependency weights from round i to j are calculated using the sigmoid activation function. v iThis represents the i-th round of dialogue;

[0072] S22. Enumerate all dialogue paths and calculate the risk probability of each path by multiplying the transition probabilities. n represents the total number of rounds in the historical dialogue, and j represents the successor node of i;

[0073] S23. Calculate P using EMD distance. risk The RiskScore is obtained by comparing the similarity to a predefined attack pattern library P. If P risk If the RiskScore is >0.65 (risk threshold) or the path matching attack pattern RiskScore is >0.75 (matching risk type threshold), then it is marked as high risk.

[0074] Specifically, transition probability N(i) is the set of successor nodes of i, and the EMD distance calculation formula is: And satisfy ∑ j f ij ≤P i , ∑ i f ij ≤Q j .

[0075] S3. Dynamic Game Optimization: Construct a game space between the detector and the attacker, solve for the optimal detection threshold, and update the parameters at each stage in a coordinated manner.

[0076] In this embodiment, dynamic game optimization specifically includes:

[0077] S31. Construct the detector policy space Θ = {0.50, 0.55, ..., 0.90} and the user policy space A = {direct attack, induced attack, evasive attack], and define the utility function U. d =λ·DR(θ,a)-(1-λ)·FPR(θ), where θ is the threshold of the detector's decision variable, DR represents the attack detection rate, FPR represents the false alarm rate, and λ represents the security weight coefficient;

[0078] S32. Obtain the optimal threshold by solving the Nash equilibrium using the maximum-minimum strategy. Based on the current threshold θ t Attacker's optimal strategy a * And the learning rate η dynamically updates the threshold Represents the detector utility function U d The gradient with respect to the threshold θ, that is, the change of θ with respect to U d The direction and rate of influence;

[0079] S33, and synchronously update the context consistency threshold θ c =θ *Historical weighting coefficient α, information entropy threshold τ, risk probability threshold P risk and the pattern matching threshold RiskScore.

[0080] Specifically, the attacker's optimal strategy a * =argmax a U a (θ t ,a), where, U a (θ t ,a)=(1-DR(θ t ,a))-μ·Cost(a), Cost(a)=[w t ·T(a)+w c ·C(a)+w s ·S(a)], Cost(a) represents the total cost of the attack, T(a) is the time cost, C(a) is the computational resource cost, S(a) is the concealment cost, w t w c w s These are weighting coefficients, defaulting to w. t =0.4, w c =0.4, w s =0.2, η=0.01, μ represents the cost weight, with a default value of 0.3, and θ takes values ​​of [0.4,0.9], with a maximum update increment of 0.05 per hour.

[0081] S4. Cyclic State Switching: Switches between low-power monitoring state and dynamic update state based on system performance and risk status; and

[0082] In this step, the cyclic state switching specifically includes:

[0083] S41. Define the status control flag L t When the utility gradient convergence condition is met simultaneously Threshold stability condition The detection performance meets the following conditions: FPR < 0.05 and DR > 0.95; system risk status conditions. When, where N high_risk N represents the number of high-risk dialogue samples. total L represents the total number of samples tested. t When = 1, the system enters a low-power monitoring state and freezes all dynamic parameters;

[0084] S42, When attack strategy evolution ΔSim is detected EMD >ρ, deteriorating risk situation Or system performance degradation When ρ is the pattern difference threshold, when L tWhen = 0, restart the gradient calculation module and unfreeze and update the parameters.

[0085] Specifically, the default value for μ1 is 0.4, the default value for μ2 is 0.4, the default value for μ3 is 0.2, and R... low The default value is 0.3, R high The default value is 0.7.

[0086] S5. Output the risk level score and corresponding risk level based on the results of the above four stages.

[0087] Also includes:

[0088] S0. Parameter Definition: Define the input and output parameters. The input parameters include the user prompt word P, the text T generated by the large language model LLM, the multi-turn dialogue history H, and the external knowledge base K. The output parameter is the risk level score R.

[0089] Compared with the prior art, the present invention has the following significant advantages:

[0090] Full-link risk coverage: The four-level linkage mechanism achieves full-process detection of "context-causal chain-dynamic defense-resource optimization" for the first time, improving the detection rate of multi-round step-by-step inducing attacks by 30% compared with static detection;

[0091] Dynamically balancing security and user experience: Based on the game theory of attack and defense, the threshold is dynamically adjusted to increase the defense strength when attacks occur frequently and reduce false alarms during normal conversations. Experiments show that the false alarm rate is less than 5%, which is 60% lower than the fixed threshold method.

[0092] Risk traceability and compliance: Cause-effect graph modeling can locate attack paths (such as "round 3 inducement → round 5 output of sensitive content"), provide complete audit logs, and meet the compliance requirements of finance and government affairs;

[0093] Efficient resource utilization: In low-risk scenarios, the system enters a low-power monitoring state, reducing server CPU utilization by 40% and significantly saving hardware resources.

[0094] Strong scalability: Supports dynamic updates of the knowledge base and attack pattern library, and can be adapted to different fields such as e-commerce, finance, and government affairs, with a wide range of applications.

[0095] In one specific embodiment, this invention proposes a security detection method for large language model-generated text based on contextual consistency reasoning, multi-round causal chain detection, and dynamic game optimization. Through a three-stage detection process, it effectively identifies hidden risks in LLM-generated text and achieves a dynamic balance between security and user experience. Figure 2 As shown, the detailed steps of the solution are as follows:

[0096] Step 1: First, define the input: user prompt words P, LLM-generated text T, multi-turn dialogue history H, external knowledge base K, and output risk level score R.

[0097] Step Two:

[0098] Phase 1 – Context-Consistent Reasoning. This phase detects the semantic consistency between the generated text and historical dialogues, user prompts, and external knowledge, identifying logical contradictions and risky outputs.

[0099] 1. Establish semantic chains for user prompts, LLM outputs, and historical dialogues;

[0100] Multi-source feature embedding: For user history H, currently generated content T, prompt word P, and external knowledge base K, vector representations are obtained by encoding using a large language model or sentence vector model.

[0101] h i =Encoder(H i ),t=Encoder(T),p=Encoder(P),k j =Encoder(K j )

[0102] Then, a consistency score is calculated between each step of the generation and the history and external knowledge.

[0103] 2. Semantic Consistency Calculation: Detect the semantic consistency between T and historical data H, hints P, and the knowledge base K, identifying logical jumps and potential attacks. Calculate t and each h... i Each k j And the cosine similarity of p, and the weighted highest similarity of each module. The max operation is introduced mainly to solve the long-range dependency problem in multi-turn dialogues:

[0104] C = α·max i (cos(t,h i ))+β·max j (cos(t,k j ))+γ·cos(t,p)

[0105] Where α + β + γ = 1, with default values ​​of α = 0.5, β = 0.2, and γ = 1 - α - β. Considering both normal topic switching and the lack of knowledge base coverage, a topic awareness and knowledge base matching confidence threshold δ (default value 0.7) is introduced to dynamically adjust the values ​​of α and β. The topic detector labels each round of dialogue with a topic tag. If a "topic switch" is detected, the system switches to a more lenient threshold or ignores historical consistency; a dual threshold mechanism is adopted.

[0106]

[0107] Knowledge base matching threshold setting: Check the matching degree of T in K. If the matching degree is lower than the given confidence threshold, it is determined to be a "knowledge base not covered area". A dual threshold mechanism is also used.

[0108]

[0109] Detect abnormal jumps and implicit attacks (such as logical contradictions with history or leading questions).

[0110] 3. Risk Assessment: Set a risk assessment threshold θ c (Default 0.6), the information entropy H(T) of the generated text,

[0111] The entropy threshold τ = 1.8, if C < θ c If H(T) > τ, the text is considered inconsistent with the context and marked as a potential risk; otherwise, it is considered consistent.

[0112]

[0113] Here, w represents the word segmentation of T.

[0114] Step 3:

[0115] Phase 2 – Causal Chain Risk Detection.

[0116] In multi-turn dialogues, the system detects how users gradually guide LLM to generate harmful content (i.e., implicit attack paths). The complete dialogue is modeled as a causal graph, and the path between user intent and output is analyzed through causal reasoning. If a path satisfies an attack pattern (e.g., gradually guiding bypass rules → outputting sensitive content), an alert is triggered.

[0117] 1. Cause-effect graph modeling: Each round of dialogue is constructed as a node, and causal dependencies between nodes are established.

[0118] V = {v1, v2, ..., v} n}

[0119]

[0120] Among them, v i Indicates the i-th round of dialogue, [v i ;v j [] represents the concatenated semantic vector, and MLP represents a two-layer neural network that extracts v from the concatenated features. i With v j Interactive information (such as semantic associations and logical dependencies); σ represents the sigmoid activation function, which maps the output of the neural network to the [0,1] interval, making w i,j This aligns with the physical meaning of "weight" (0 represents no dependency, 1 represents extremely strong dependency); w i,jThis represents the causal dependency strength or association weight from round i to j.

[0121] 2. High-risk path detection: Enumerate all possible paths, calculate the product of transition probabilities for each path, and take the path with the highest risk as the risk path probability of the currently generated text content. Define the probability of a risk path:

[0122]

[0123] in,

[0124]

[0125] n represents the total number of rounds in the historical dialogue, j represents the successor node of i, and through reasoning, we find combinations on the path that satisfy the attack pattern (such as inducement + covert coding attack + output of sensitive words). P risk Essentially, it quantifies the "risk level of inconsistency in dialogue logic" through probability product. The larger the value, the higher the risk; the smaller the value, the lower the risk and the more coherent the dialogue.

[0126] 3. Attack Pattern Matching: Match causal chains based on known attack patterns defined in the risk pattern library (such as prompt word injection patterns, instruction sequences for gradually circumventing security strategies, etc.), i.e., the risk probability P. risk By associating risk with specific known risk patterns and “finding the most similar known pattern”, risk interpretability is made possible. The final output RiskScore can both quantify the degree of risk and indicate the type of risk (which known pattern it is closest to), providing a clear basis for subsequent risk handling (such as interception and warning).

[0127]

[0128] Where P represents a predefined attack pattern library, and EMD refers to calculating the EMD distance between the path feature vector and the pattern vector in the attack pattern library P. It is used to measure the similarity of probability distributions. The smaller the value, the more similar the distributions are; the larger the value, the greater the difference in distributions.

[0129] 4. Judgment: If P risk If the RiskScore is >0.65 (risk threshold) or the path matching attack pattern RiskScore is >0.75 (matching risk type threshold), then it is marked as high risk.

[0130] Step Four:

[0131] Phase 3 – Dynamic Game Theory Optimization. Users and detectors are viewed as two sides in a game. The detector dynamically adjusts its detection threshold based on user history and current behavior to ensure a balance between defense and user experience. The detection threshold is determined by minimizing attacker utility and maximizing defense utility.

[0132] 1. Establish the game matrix: The detector's policy space Θ = {0.50, 0.55, ..., 0.90}, and the detector's decision variable is the threshold θ (such as the score threshold for judging "whether it is an attack"; the higher θ is, the stricter the detector is); the user's policy space A = {direct attack, induced attack, attack avoidance}, and the user's (attacker's) decision variable is "attack method a" (different attack methods). Establish the utility function U(θ,a) between the two, defined as the weighted sum of security and user experience.

[0133] U d =λ·DR(θ,a)-(1-λ)·FPR(θ)

[0134]

[0135] Wherein, DR represents the attack detection rate, the probability that the detector successfully identifies the attack at threshold θ when an attacker uses method a (a higher rate indicates better security); FPR represents the false positive rate, the probability that the detector misclassifies normal behavior as an attack at threshold θ (a higher rate indicates a worse user experience because normal operation is interfered with); λ represents the security weight coefficient (default 0.7), which can be optimized experimentally to represent the degree of importance attached to security (a higher weight has a greater impact on the detection rate); (1-λ) is the user experience weight (default 0.3), and a higher false positive rate has a greater negative impact on utility. In summary, U d The larger the value of (θ,a), the better the "security-user experience balance" of the detector under that θ and a.

[0136] 2. Nash Equilibrium Solution: The game equilibrium is solved using the "max-min strategy." The core objective is to ensure that the detector maintains an optimal balance between security and user experience even when facing the worst-case scenario. The final determined θ... * It is the optimal threshold when both sides' strategies are stable.

[0137]

[0138] 3. Dynamic Threshold Update: The core of this feature is to adjust the threshold θ in real time based on the attacker's strategy and system performance (such as false positive rate, number of risky samples, historical interaction records, etc.). The goal is to ensure that the detector remains optimal when "attacker's strategy changes" or "system performance fluctuates." If there is an increase in high-risk samples (attacks) recently, θ needs to be increased (the detector becomes more stringent, reducing false negatives); if there is an increase in false positives recently (normal behavior is misjudged), θ needs to be decreased (the detector becomes more lenient, improving user experience).

[0139]

[0140] a * =argmaxa U a (θ t ,a),η=0.01

[0141] U a (θ t ,a)=(1-DR(θ t ,a))-μ·Cost(a)

[0142] Cost(a) = [w t ·T(a)+w c ·C(a)+w s ·S(a)]

[0143] Where η represents the learning rate, which controls the magnitude of each update (to avoid excessive adjustment that could cause system oscillation); Represents the detector utility function U d The gradient with respect to the threshold θ (representing "the change of θ with respect to U") d (the direction and rate of influence), if the gradient is positive: increasing θ will increase U. d (At this point, the threshold should be increased). If the gradient is negative: decreasing θ will increase U. d (At this point, the threshold should be lowered);

[0144] a * Is the attacker at the current threshold θ t The "optimal attack method" is the one that the attacker chooses to maximize their own utility U. a Attack methods (such as in θ) t In stricter cases, "evasion attack" may be chosen to bypass detection; ∈ represents a small perturbation (default value 0.001), which is a small adjustment to θ; μ represents the cost weight (default value 0.3), Cost(a) represents the total cost of the attack, T(a) is the time cost, C(a) is the computational resource cost, and S(a) is the concealment cost. t w c w s It is the weighting coefficient (default w) t =0.4, w c =0.4, w s =0.2).

[0145] Constraints: θ takes values ​​between [0.4, 0.9] (to ensure system stability); updates are limited to 0.05 per hour (to prevent oscillations), preventing drastic fluctuations in the threshold within a short period of time, avoiding system oscillations (such as a sudden large number of false alarms or missed alarms), and ensuring the smoothness of adjustments.

[0146] like Figure 3 The diagram shown is a flowchart of the dynamic game parameter adjustment process in an embodiment of the present invention.

[0147] Based on the optimal threshold θ * Real-time synchronization to Phase 1 and Phase 2 forms a three-level linkage of parameters, model, and strategy, and achieves dynamic balance through closed-loop feedback. However, there is a condition restriction: when the parameter p=0, all dynamic parameters will be updated. When p=1, no parameters are updated, all parameters remain unchanged, and the second and third steps mentioned above will be skipped.

[0148]

[0149] All relevant dynamic parameters have been updated as follows:

[0150] 1) Context consistency threshold: The optimal threshold is directly used as the criterion for determining context consistency, θ * A higher θ indicates a stricter consistency requirement, therefore, θ c =θ * .

[0151] 2) Historical weighting coefficient: when θ * When α > 0.5, increase the weight of historical data (maximum α = 1); θ * Reduce the weight of historical data when the value is ≤0.5 (minimum α=0.375).

[0152]

[0153] 3) Information entropy threshold: θ * For every increase of 0.1, τ decreases by 0.06, when θ * When θ = 0.5, τ = 1.8 (baseline value), the threshold τ and θ * A negative correlation indicates that more stable information is required when strengthening defenses.

[0154] τ=1.8-0.6×(θ * -0.5)

[0155] 4) Risk probability threshold: θ * When P = 0.5, the baseline threshold P risk =0.65,θ * For every ±0.1, P risk ±0.025.

[0156] P risk =0.65 + 0.25 × (θ) * -0.5)

[0157] 5) Pattern matching threshold: θ * When P = 0.5, the baseline threshold P risk =0.75,θ * For every ±0.1, the RiskScore is ±0.025.

[0158] RiskScore = 0.75 + 0.25 × (θ) * -0.5)

[0159] 6) Comprehensive Risk Score R: This index is a comprehensive index calculated by summarizing and integrating the outputs of each stage of the entire closed-loop process.

[0160] R = μ1·C + μ2·P risk +μ3(1-θ * )

[0161] Where μ1, μ2, and μ3 are weighting coefficients, and μ1 + μ2 + μ3 = 1. The default values ​​are μ1 = 0.4, μ2 = 0.4, and μ3 = 1 - μ1 - μ2, which can be freely set according to experimental or business objectives. * This represents the "stress level" of the detector, because θ * The higher the value, the more stringent the system, and the higher the likelihood of an attack.

[0162] Based on R and the preset risk level threshold R low (Default value 0.3) and R high (Default value 0.7), output the final risk level:

[0163]

[0164] Step 5:

[0165] Phase 4 – Loop State Switching. The optimal detection strategy output from Phase 3 (including thresholds, weight coefficients, and game matrix parameters) is synchronously input into Phase 2 (causal chain risk detection) and Phase 1 (contextual consistency reasoning) in real time, forming a dynamic closed loop. The system continuously adjusts the detection strategy based on the latest user behavior, attack patterns, and historical data. Intelligent detection mechanisms are implemented by setting termination conditions, freezing mechanisms, and wake-up mechanisms, ensuring that the system maintains its dynamic optimization capabilities while avoiding resource waste caused by infinite loops.

[0166] 1. Loop Termination. The system enters low-power listening state if and only if all four of the following conditions are met simultaneously:

[0167] 1) Utility gradient convergence condition: Detector utility function U d The absolute value of the gradient with respect to the threshold θ is less than 0.001.

[0168]

[0169] 2) Threshold stability condition: Current threshold θ t Compared with the threshold θ 24 hours ago t-24 The relative volatility does not exceed 0.5%.

[0170]

[0171] 3) Detection performance standards: Simultaneously meet the requirements of low false alarm rate and high detection rate.

[0172] (FPR<0.05)∧(DR>0.95)

[0173] 4) Systemic risk situation conditions: The proportion of high-risk samples does not exceed 5%.

[0174]

[0175] Where, N high_risk N represents the number of high-risk dialogue samples. total This represents the total number of samples tested. The marker value L t Defined as a composite determination formula:

[0176]

[0177] When L t When θ = 1, the system enters a listening state, shuts down the real-time gradient calculation module, and freezes all dynamic parameters θ. c ,α,τ,P risk RiskScore, i.e.:

[0178]

[0179] 2. Loop state activated. The paused update loop will immediately restart when any of the following conditions are triggered:

[0180] 1) Attack strategy evolution. A new attack pattern is detected, i.e., the risk pattern library is updated. When at least one pattern in the new pattern library differs significantly from all baseline patterns (i.e., the minimum distance is large, greater than the threshold ρ (default value 0.3), it is determined that the attack strategy has evolved.

[0181]

[0182] Among them, P new P represents a new set of attack modes. base This represents the original attack pattern library.

[0183] 2) The risk situation has worsened. The proportion of high-risk samples has exceeded 15% for three consecutive hours.

[0184]

[0185] 3) System performance degradation. That is, the false alarm rate is greater than 10% for five consecutive detection windows.

[0186]

[0187] The state transition control decision formula is defined as follows:

[0188]

[0189] When L t When θ = 0, * The loop detection update is awakened, the gradient calculation module is restarted, all parameters are unfrozen and updated.

[0190]

[0191] 3. System Termination. The entire detection system will only completely stop in two situations: 1) when the administrator sends a shutdown command, and 2) when there are no dialogue requests for 24 consecutive hours (automatic hibernation), but it will automatically restart when a new dialogue request arrives.

[0192] like Figure 4 The diagram shown is a flowchart of the loop state switching in an embodiment of the present invention.

[0193] This invention has broad application prospects: it can be deployed in large language model API gateways to achieve real-time risk detection, security interception, filtering, and response; it can be applied in content review platforms to achieve automated detection and interception of illegal multi-turn dialogues; it can be embedded in enterprise-level chatbots to prevent the leakage of sensitive information and the generation of harmful content; and combined with national cybersecurity standards, it can meet the needs of security assessment, compliance audit, and risk report generation.

[0194] The following uses "security testing of a large-scale e-commerce customer service model" as an example to explain in detail the implementation process of this invention:

[0195] The application scenario is as follows: the e-commerce customer service big model needs to handle dialogues such as "product consultation, order inquiry, and after-sales refund", and defend against attacks such as "inducing the disclosure of user addresses and bypassing refund review". This invention is deployed on the big model API gateway to detect the risks of user input and model output in real time.

[0196] The implementation steps include: parameter initialization: input parameters are P = "How to bypass refund review and directly issue a refund", H = {H1 = "The product has quality problems", H_2 = "Refund review is too slow"}, (K = "E-commerce refund rules: Quality certificates must be provided for review"); initial thresholds θ_c = 0.6, τ = 1.8;

[0197] Phase 1: Context-consistent reasoning:

[0198] Feature embedding: Sentence-BERT encoding yields h1, h2, t (model response: "can be forged to bypass verification"), p, and k1;

[0199] Semantic consistency calculation: max_i(cos(t,hi))=0.4, max_j(\cos(t,k_j))=0.3<0.7, therefore C=0.5×0.4+0×0.3+0.3×0.9=0.37<0.6;

[0200] Risk labeling: H(T) = 1.9 > 1.8, is labeled as potential risk.

[0201] Phase 2: Causal Chain Risk Detection

[0202] Cause-effect graph construction: w_1,2 = 0.8, w_2,3 = 0.9 (v_3 = p);

[0203] Risk path probability: P_risk = 0.8 × 0.9 × 0.95 = 0.684 > 0.65;

[0204] Attack pattern matching: RiskScore = 0.8 > 0.75, marked as high risk.

[0205] Phase 3: Dynamic Game Optimization

[0206] Game theory solution: When the attacker's strategy a = "inducing attack", U_d(0.7,a) = 0.7 × 0.92 - 0.3 × 0.04 = 0.632 (maximum utility), so θ^* = 0.7;

[0207] Parameter linkage: θ_c = 0.7, α = 0.6, τ = 1.68;

[0208] Phase 4: Cyclic state switching: The current proportion of high-risk samples is 12% > 5%, L_t = 0, and dynamic updates are maintained;

[0209] Risk level output: R = 0.4 × 0.37 + 0.4 × 0.684 + 0.2 × (1 - 0.7) = 0.481, which is judged as medium risk, and the output is "Warning: The request involves illegal operation and guidance cannot be provided".

[0210] Further reference Figure 5 As an implementation of the methods shown in the above figures, this application provides an embodiment of a system for adaptive security detection based on a large model with fourth-order linkage. This system embodiment is similar to... Figure 1 and Figure 2 Corresponding to the method embodiments shown, the system can be specifically applied to various electronic devices.

[0211] Secondly, embodiments of the present invention also disclose a system for adaptive security detection of a large model based on four-order linkage, such as... Figure 5As shown, the system 500 includes: a context-consistent reasoning module 51, a causal chain risk detection module 52, a dynamic game optimization module 53, a loop state switching module 54, and a risk scoring module 55.

[0212] In one specific embodiment, the context consistency reasoning module 51 is used to calculate the semantic consistency score between the generated text and the multi-turn dialogue history, user prompts and external knowledge base, and mark potential risks; the causal chain risk detection module 52 is used to model the multi-turn dialogue as a causal graph, calculate the probability of risk paths and match them with the attack pattern library, and mark high risks.

[0213] The dynamic game optimization module 53 is used to construct the game space between the detector and the attacker, solve the optimal detection threshold, and update the parameters at each stage in a coordinated manner; the loop state switching module 54 is used to switch between low-power monitoring state and dynamic update state according to system performance and risk situation; the risk scoring module 55 is used to comprehensively calculate and output the risk level score and corresponding risk level.

[0214] The modules work together in sequence to achieve adaptive security detection of the large model.

[0215] The functions and methods of the above modules correspond to each other, and will not be repeated here.

[0216] The following is for reference. Figure 6 It shows a schematic diagram of the structure of a computer device 600 suitable for implementing an electronic device according to embodiments of the present invention. Figure 6 The electronic device shown is merely an example and should not be construed as limiting the functionality and scope of the embodiments of the present invention.

[0217] like Figure 6 As shown, the computer device 600 includes a central processing unit (CPU) 601 and a graphics processing unit (GPU) 602, which can perform various appropriate actions and processes according to programs stored in read-only memory (ROM) 603 or programs loaded from storage section 609 into random access memory (RAM) 604. The RAM 604 also stores various programs and data required for the operation of the device 600. The CPU 601, GPU 602, ROM 603, and RAM 604 are interconnected via a bus 605. An input / output (I / O) interface 606 is also connected to the bus 605.

[0218] The following components are connected to I / O interface 606: an input section 607 including a keyboard, mouse, etc.; an output section 608 including an LCD, speakers, etc.; a storage section 609 including a hard disk, etc.; and a communication section 610 including a network interface card, such as a LAN card or modem. The communication section 610 performs communication processing via a network such as the Internet. A drive 611 may also be connected to I / O interface 606 as needed. A removable medium 612, such as a hard disk, optical disk, magneto-optical disk, semiconductor memory, etc., is installed on drive 611 as needed so that computer programs read from it can be installed into storage section 609 as needed.

[0219] In particular, according to embodiments disclosed in this invention, the processes described above with reference to the flowcharts can be implemented as computer software programs. For example, embodiments disclosed in this invention include a computer program product comprising a computer program carried on a computer-readable medium, the computer program containing program code for performing the methods shown in the flowcharts. In such embodiments, the computer program can be downloaded and installed from a network via communication section 610, and / or installed from removable medium 612. When the computer program is executed by central processing unit (CPU) 601 and graphics processing unit (GPU) 602, the functions defined in the methods of this invention are performed.

[0220] It should be noted that the computer-readable medium described in this invention can be a computer-readable signal medium, a computer-readable medium, or any combination thereof. A computer-readable medium can be, for example,—but not limited to—an electrical, magnetic, optical, electromagnetic, infrared, or semiconductor device, apparatus, or any combination thereof. More specific examples of a computer-readable medium may include, but are not limited to: an electrical connection having one or more wires, a portable computer disk, a hard disk, random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM or flash memory), optical fiber, portable compact disk read-only memory (CD-ROM), optical storage device, magnetic storage device, or any suitable combination thereof. In this invention, a computer-readable medium can be any tangible medium containing or storing a program that can be used by or in conjunction with an instruction execution apparatus, device, or device. In this invention, a computer-readable signal medium can include a data signal propagated in baseband or as part of a carrier wave, carrying computer-readable program code. Such propagated data signals can take various forms, including but not limited to electromagnetic signals, optical signals, or any suitable combination thereof. Computer-readable signal media can also be any computer-readable medium other than a computer-readable medium, which can send, propagate, or transmit a program for use by or in connection with an instruction execution device, apparatus, or apparatus. The program code contained on the computer-readable medium can be transmitted using any suitable medium, including but not limited to: wireless, wire, optical fiber, RF, etc., or any suitable combination thereof.

[0221] Computer program code for performing the operations of this invention can be written in one or more programming languages ​​or a combination thereof, including object-oriented programming languages ​​such as Java, Smalltalk, and C++, as well as conventional procedural programming languages ​​such as "C" or similar programming languages. The program code can be executed entirely on the user's computer, partially on the user's computer, as a standalone software package, partially on the user's computer and partially on a remote computer, or entirely on a remote computer or server. In cases involving remote computers, the remote computer can be connected to the user's computer via any type of network—including a local area network (LAN) or a wide area network (WAN)—or can be connected to an external computer (e.g., via the Internet using an Internet service provider).

[0222] The flowcharts and block diagrams in the accompanying drawings illustrate the architecture, functionality, and operation of possible implementations of apparatus, methods, and computer program products according to various embodiments of the present invention. In this regard, each block in a flowchart or block diagram may represent a module, segment, or portion of code containing one or more executable instructions for implementing a specified logical function. It should also be noted that in some alternative implementations, the functions indicated in the blocks may occur in a different order than those indicated in the drawings. For example, two consecutively indicated blocks may actually be executed substantially in parallel, and they may sometimes be executed in reverse order, depending on the functions involved. It should also be noted that each block in the block diagrams and / or flowcharts, and combinations of blocks in the block diagrams and / or flowcharts, may be implemented using dedicated hardware-based devices that perform the specified functions or operations, or using a combination of dedicated hardware and computer instructions.

[0223] The modules described in the embodiments of the present invention can be implemented in software or hardware. The described modules can also be located in a processor.

[0224] In another aspect, the present invention also provides a computer-readable medium, which may be included in the electronic device described in the above embodiments; or it may exist independently and not assembled into the electronic device. The computer-readable medium carries one or more programs that, when executed by the electronic device, cause the electronic device to perform the methods and steps described in the first aspect of the embodiments of the present invention.

[0225] The above description is merely a preferred embodiment of the present invention and an explanation of the technical principles employed. Those skilled in the art should understand that the scope of the invention is not limited to the specific combination of the above-described technical features, but also includes other technical solutions formed by arbitrary combinations of the above-described technical features or their equivalents without departing from the inventive concept. For example, technical solutions formed by substituting the above-described features with (but not limited to) technical features with similar functions disclosed in this invention.

Claims

1. A method for adaptive security detection of a large model based on fourth-order linkage, characterized in that, The method includes the following steps: Parameter definition: Define input parameters and output parameters. The input parameters include user prompt word B, text T generated by large language model LLM, multi-turn dialogue history H, and external knowledge base K. The output parameter is risk level score R. Contextual consistency reasoning: Calculate the semantic consistency score C between the generated text and the multi-turn dialogue history, user prompts, and external knowledge base, and set a risk assessment threshold. and generating text information entropy Entropy threshold ,like The text is marked as a potential risk; Causal chain risk detection: Modeling multi-turn dialogues as causal graphs and calculating the probability of risky paths. Based on the causal graph, a feature vector of the current dialogue path is constructed. The similarity between this feature vector and the attack pattern vectors in the predefined attack pattern library P is calculated using EMD distance. The maximum similarity is taken to obtain the path matching attack pattern score, RiskScore. or If so, mark it as high risk; Dynamic game optimization: Construct a game space between the detector and the attacker, solve for the optimal detection threshold, and update the parameters at each stage in a coordinated manner; The dynamic game optimization specifically includes: constructing the detector policy space. and user strategy space Define utility function ,in, Let 'a' be the threshold for the detector's decision variables, 'a' be the attack method, 'a' be the decision variable in the user's policy space, 'DR' be the attack detection rate, 'FPR' be the false positive rate, and 'λ' be the security weight coefficient. The optimal threshold is obtained by solving the Nash equilibrium using the maximal-minimum policy. Based on the current threshold Attacker's optimal strategy and learning rate Dynamically update threshold , Represents the detector utility function For threshold The gradient, that is, the gradient of the gradient, represents Changes The direction and rate of impact; and synchronously update the context consistency threshold. ,according to Update dialogue history weight coefficients Information entropy threshold Risk probability threshold and pattern matching threshold; Cyclic state switching: Switching between low-power monitoring state and dynamic update state based on system performance and risk profile; and Based on the results of the above four stages, a risk level score and corresponding risk level are output.

2. The method for adaptive security detection of large models according to claim 1, characterized in that, The context-consistent reasoning specifically includes: Perform context-consistent reasoning to construct user prompts. B Generate text T History of multiple rounds of dialogue H External knowledge base K The semantic chain, through a large language model or sentence vector model, is analyzed. H, T, B, K The vector representations are obtained by encoding them separately: ,in, This indicates the first round of dialogue in history. i Round of dialogue content, Represents the first in the external knowledge base j Rules or information; Calculate the relationship between t and each Each as well as The semantic consistency score C is obtained by weighting the cosine similarity. ,in, .

3. The method for adaptive security detection of large models according to claim 1, characterized in that, The causal chain risk detection specifically includes: Performing causal chain risk detection will involve multiple rounds of dialogue history. H Each round of dialogue in the model is represented by a node. By concatenating semantic vectors Input a two-layer neural network MLP and perform a round of computation using the sigmoid activation function. i arrive j Causal dependency weights , Indicates the first Round of dialogue, express The successor node; Enumerate all dialogue paths and calculate the risk probability of each path by multiplying the transition probabilities. , This indicates the total number of rounds in the historical dialogue.

4. The method for adaptive security detection of large models according to claim 1, characterized in that, The cycle state switching specifically includes: Define status control flags When the utility gradient convergence condition is met simultaneously Threshold stability conditions Testing performance standards and System risk situation conditions At this time, the system enters a low-power monitoring state and freezes all dynamic parameters; among them, This indicates the number of high-risk dialogue samples. This indicates the total number of samples tested; The current threshold, The threshold is from 24 hours ago; When the following are detected: an attack strategy evolution (i.e., at least one pattern in the newly added pattern library has a minimum distance greater than the threshold ρ between it and all baseline patterns), a deterioration in risk situation (i.e., the proportion of high-risk samples is >15% for 3 consecutive hours), or system performance degradation (i.e., the false alarm rate is greater than 10% for 5 consecutive detection windows), the gradient calculation module is restarted and the parameters are unfrozen and updated; ρ is the pattern difference threshold.

5. The method for adaptive security detection of large models according to claim 1, characterized in that, The risk level score and corresponding risk level output based on the results of the above four stages include: according to and preset risk level thresholds and Output the final risk level: 。 6. The method for adaptive security detection of large models according to claim 2, characterized in that, Introducing topic awareness and knowledge base matching confidence threshold To dynamically adjust and The topic detector labels each round of dialogue with a specific value. If a "topic switch" is detected, the system switches to a more lenient threshold or ignores historical consistency. A dual-threshold mechanism is employed. Knowledge base matching threshold setting: Check the matching degree of T in K. If the matching degree is lower than the given confidence threshold, it is determined as a "knowledge base not covered area". A dual threshold mechanism is also used. in, , The weighting coefficient for b is the default value. The The default value is 0.

7. The default value is 0.

6. The default value is 1.

8.

7. The method for adaptive security detection of large models according to claim 3, characterized in that, The transition probability , N(i) for i The set of successor nodes, the EMD distance calculation formula is as follows: And satisfy , .

8. The method for adaptive security detection of large models according to claim 1, characterized in that, The attacker's optimal strategy ,in, , , Indicates the total cost of the attack. It's the cost of time. It calculates resource costs. It is a hidden cost. These are weighting coefficients, by default. , , This represents the weight of the cost, with a default value of 0.

3. The value ranges from [0.4, 0.9], with a maximum update increment of 0.05 per hour.

9. The method for adaptive security detection of large models according to claim 5, characterized in that, The The default value is 0.

3. ， The default value is 0.

7.

10. A system for adaptive security detection of large models based on fourth-order linkage, used to execute the method for adaptive security detection of large models based on fourth-order linkage as described in any one of claims 1-9, characterized in that, The system includes: The context consistency reasoning module is used to calculate the semantic consistency score between the generated text and the multi-turn dialogue history, user prompts, and external knowledge base, and to mark potential risks. The causal chain risk detection module is used to model multi-turn dialogues as causal graphs, calculate the probability of risky paths and match them with an attack pattern library, and mark high risks. The dynamic game optimization module is used to construct the game space between the detector and the attacker, solve for the optimal detection threshold, and update the parameters at each stage in a coordinated manner. The cyclic state switching module is used to switch between low-power monitoring state and dynamic update state according to system performance and risk status. The risk scoring module is used to comprehensively calculate and output the risk level score and corresponding risk level. The modules work together in sequence to achieve adaptive security detection for large models.

11. An electronic device, comprising: One or more processors; Storage device for storing one or more programs; When the one or more programs are executed by the one or more processors, the one or more processors implement the method for large model adaptive security detection as described in any one of claims 1 to 9.

12. A computer-readable storage medium having a computer program stored thereon, characterized in that, When executed by a processor, the program implements the method for adaptive security detection of large models as described in any one of claims 1 to 9.

Images