A method for detecting rerouting attacks in LLM routing systems

Abstract

This invention discloses a rerouting attack detection method for LLM routing systems. The method trains a rerouting attack detector by modeling normal queries and rerouting queries, and then identifies rerouting attacks on new queries during the detection phase. Without relying on large-scale language models for defense inference, it effectively identifies highly covert rerouting attacks, significantly improving the robustness of LLM routing systems in terms of cost control, response quality, and security, and exhibiting good engineering deployability. This invention introduces a diversified rerouting sample generation mechanism to simulate different attacker capabilities and attack scenarios, automatically generating diverse rerouting queries covering multiple possible attack forms. This provides a more representative and comprehensive sample base for subsequent detection model training, thereby improving the detection model's adaptability and generalization performance against different types of rerouting attacks.

Description

Technical Field

[0001] This invention relates to the field of text classification based on artificial intelligence (AI), and specifically to a method for detecting rerouting attacks in LLM routing systems. Background Technology

[0002] The rapid development of large language models (LLMs) has greatly enhanced the capabilities of artificial intelligence systems. However, different LLMs exhibit varying levels of performance and computational cost. Generally, more powerful models tend to provide higher quality responses but may incur significantly higher computational costs, while weaker models are less expensive but may produce lower quality responses. To address this issue, using LLM routing to select the most suitable model from multiple LLMs based on query features (such as complexity) to achieve a balance between response quality and computational cost has become a widely adopted strategy in contemporary AI applications (such as OpenAI's GPT-5 routing system). However, LLM routers, acting as classifiers, face new adversarial attacks (called rerouting attacks), where attackers manipulate the router's model selection through malicious input, wasting computational resources, reducing response quality, and even increasing the risk of jailbreak.

[0003] Currently, no researchers have proposed a detection method specifically for rerouting attacks. Furthermore, existing adversarial attack detection methods for general artificial intelligence systems exhibit significant limitations when applied to rerouting attacks. This is because:

[0004] (1) Rerouting attacks are designed to interfere with the router’s decision-making process rather than to directly manipulate the LLM output, so they cannot be defended against by detecting improper output content;

[0005] (2) The rerouting hint only adds an adversarial prefix before the normal query, which is highly similar to the normal query in the semantic space, resulting in a high false positive rate of existing adversarial attack detectors;

[0006] (3) The LLM routing system itself is lightweight, so inference-intensive defenses (such as using large models for defense) are inefficient and difficult to apply to the detection of rerouting attacks.

[0007] This invention systematically studies the rerouting attack threat in LLM routing systems, classifying it into three risk scenarios: cost increase, quality hijacking, and security bypass. The focus is on the effectiveness of existing rerouting attacks on different routers in these scenarios. The results show that LLM routers are highly vulnerable to rerouting attacks, especially in the cost increase risk scenario. Furthermore, to further explore the reasons for the high success rate of rerouting attacks, this invention uses interpretability tools to analyze rerouting queries. The study found that rerouting queries often exhibit characteristics similar to benign complex queries, manipulating the decision boundaries of LLM routers. Therefore, a rerouting attack detection method for LLM routing systems is urgently needed to improve the robustness of LLM routing systems. Summary of the Invention

[0008] This invention proposes for the first time a rerouting attack detection method for LLM routing systems. The method first constructs positive and negative sample pairs based on normal queries and rerouting queries to help the detection model capture the implicit differences between normal and rerouting queries, and then adaptively adjusts the training weights of the difficult sample pairs, thereby improving the detector's performance in detecting rerouting queries.

[0009] To achieve the above objectives, the technical solution adopted by the present invention is as follows:

[0010] This invention discloses a rerouting attack detection method for LLM routing systems, which trains a rerouting detector and applies it to rerouting attack detection, specifically as follows:

[0011] 1) Rerouting Sample Generation: Given a normal query Rerouting Sample Generator Generate a rerouting setting Apply it to normal queries Generate rerouting query ;

[0012] 2) Rerouting attack detector based on contrastive learning: based on normal queries Rerouting query with pairing Construct positive and negative sample pairs and feed them into the rerouting attack detector. Perform pairwise training, detector Evaluation of predicted labels for sample pairs and internal similarity score ;

[0013] 3) Weighting and Optimization of Hard Samples: Adaptive Sampling Network From the detector Collect samples for predicting labels and similarity score The output feedback is used to dynamically identify hard sample pairs based on this feedback. And increase its training weights Based on training weights Iterative update of rerouting sample generator and detector Model parameters;

[0014] 4) Rerouting attack detection: Rerouting attack detector After training is complete, given a new query Detector Several test pairs will be constructed and a majority voting strategy will be applied to generate classification results for rerouting attack detection.

[0015] As a further improvement, the present invention provides a given normal query Rerouting Sample Generator Generate a rerouting setting Specifically:

[0016] Rerouting Sample Generator Four attack configurations—white-box, black-box, gray-box, and no-box—are employed to simulate an attacker constructing a rerouting query after hijacking a normal query. The rerouting settings are then used to... Define attack methods Target router Trigger length Perplexity constraint The value of , convolutional neural network Used for predictive rerouting settings middle , Choice and , The range of values ​​for:

[0017] .

[0018] As a further improvement, the rerouting sample generator described in this invention Generate a rerouting setting Apply it to normal queries Generate rerouting query Specifically:

[0019] ;

[0020] ;

[0021] in, This indicates a trigger constructed by a rerouting query. Indicates in the router Using attack methods Perform trigger optimization. and These represent calculation triggers. Length and confusion This represents the string concatenation operation.

[0022] As a further improvement, the present invention describes a method based on normal queries. Rerouting query with pairing Construct positive and negative sample pairs and feed them into the rerouting attack detector. Pair training is conducted, specifically as follows:

[0023] Normal query dataset obtained from rerouting sample generation Adversarial query dataset Positive and negative sample pairs are constructed, where positive sample pairs consist of normal-normal query pairs and adversarial-adversarial query pairs, while negative pairs consist of normal-adversarial query pairs. Positive sample pairs share the same semantic distribution, enabling the rerouting attack detector F to learn to identify queries from the same category, while negative pairs combine normal queries and adversarial queries, enabling the rerouting attack detector F to learn to distinguish between normal queries and rerouting queries.

[0024] As a further improvement, the detector described in this invention Evaluation of predicted labels for sample pairs Specifically:

[0025] During training, given a sample pair The rerouting detector utilizes an encoder Extracting text embeddings and Then the projection head Mapping text embeddings to a normalized embedding space, classifier Classify the sample pairs to obtain their predicted labels. This label will be used for classification loss. This allows the rerouting attack detector to detect... Learn to distinguish between positive and negative sample pairs:

[0026] ;

[0027] in, Indicates the number of sample pairs. Indicates the first The true label of each sample Indicates the first The predicted probability of a sample.

[0028] As a further improvement, the detector described in this invention Assess the internal similarity score of sample pairs Specifically:

[0029] Based on the embedding of sample pairs, the classifier Output sample pair internal similarity score This score was used to supervise the contrast loss. This allows the rerouting attack detector to detect... It is learned that in the embedding space, positive samples are closer to their internal samples, while negative samples are farther away from their internal samples.

[0030]

[0031] in, This indicates the number of positive and negative sample pairs. Indicates the similarity between sample pairs. It is a temperature hyperparameter that controls the similarity scale. It is the set of positive samples for anchoring samples. Indicates the denominator mask. This represents the weights of these sample pairs.

[0032] As a further improvement, the adaptive sampling network described in this invention... From the detector Collect samples for predicting labels and similarity score The output feedback is used to dynamically identify hard sample pairs based on this feedback. And increase its training weights Specifically:

[0033] To measure the rerouting attack detector Performance on training samples, rerouting attack detection method calculates true labels and prediction labels absolute difference between As performance feedback, the similarity score within the sample pair is also utilized. As a feedback on sample similarity, it is based on the feedback of model performance. And sample pair similarity feedback Adaptive sampling network The weights in the supervised contrast loss are calculated for this sample pair. This allows samples that are more difficult to classify to receive higher weights in the denominator.

[0034] As a further improvement, the present invention describes a method based on training weights. Iterative update of rerouting sample generator and detector The model parameters are as follows:

[0035] Based on the aforementioned training sample weights, the rerouting sample generator... Rerouting attack detector The training loss function is as follows:

[0036] ;

[0037] ;

[0038] in, This represents the weights of the training sample pairs. These are the non-negative hyperparameters of the balancing loss function;

[0039] Adaptive sampling network A local optimum strategy is used to predict the weights of each sample pair during the current training iteration; this is achieved through an adaptive sampling network. The optimization function is as follows:

[0040] ;

[0041] in, It is a hyperparameter that balances performance feedback and similarity feedback.

[0042] As a further improvement, the rerouting attack detector described in this invention After training is complete, given a new query Detector Several test pairs will be constructed and a majority voting strategy will be applied to generate classification results for rerouting attack detection, specifically:

[0043] Given a new user query Detector Random sampling will be performed from the training dataset A normal query , with user query composition a sample pair Then the detector Will be on this Each sample predicts the classification result, and a majority voting strategy is applied to output the final detection, i.e., the user query. Is it a normal query or a rerouting query?

[0044]

[0045] in, Indicates the category of the prediction. Indicates a positive sample pair. Indicates negative sample pairs, This is an indicator function; it takes the value 1 when the condition within the parentheses is true, and 0 otherwise.

[0046] The beneficial effects of this invention are as follows:

[0047] 1) This invention addresses the lack of effective defenses against rerouting attacks in existing LLM routing systems by proposing a novel rerouting attack detection method for LLM routing systems. This method trains a rerouting attack detector by modeling normal queries and rerouting queries, and then identifies rerouting attacks in new queries during the detection phase. Without relying on large-scale language models for defense inference, it effectively identifies highly covert rerouting attacks, significantly improving the robustness of LLM routing systems in terms of cost control, response quality, and security. It also demonstrates good engineering deployability and practical value.

[0048] 2) Addressing the shortcomings of existing technologies, such as the lack of rerouting attack data and the difficulty in systematically modeling rerouting attack behavior, this invention introduces a diversified rerouting sample generation mechanism by "giving a normal query, generating rerouting settings, and applying them to the normal query to generate a rerouting query." This mechanism automatically generates diverse rerouting queries by simulating different attacker capabilities and attack scenarios. This not only solves the problem of insufficient training data for rerouting attacks but also covers multiple possible attack forms, providing a more representative and comprehensive sample foundation for subsequent detection model training. This enhances the detection model's adaptability and generalization performance against different types of rerouting attacks.

[0049] 3) To address the issue that rerouting attacks merely add adversarial prefixes to normal queries, resulting in high false positive rates in existing detection methods due to their semantic similarity to normal queries, this invention proposes a dual-feedback mechanism based on contrastive learning. This mechanism involves constructing positive and negative sample pairs based on normal queries and paired rerouting queries, and then feeding these sample pairs into a rerouting attack detector for pairwise training. During training, the predicted labels of the sample pairs and the similarity scores within the sample pairs are simultaneously evaluated. By modeling positive and negative sample pairs in pairs and jointly learning the classification results and internal similarity information of the sample pairs, this effectively characterizes the fine-grained differences between normal queries and rerouting queries. This allows the detector to accurately distinguish between queries with high semantic similarity, significantly reducing the false positive rate.

[0050] 4) Addressing the challenge of rerouting attacks being highly concealed and difficult to identify through conventional training, this invention proposes a hard sample weighting mechanism. This mechanism involves "collecting predicted labels and internal similarity scores of sample pairs from the detector as output feedback, and dynamically identifying hard sample pairs and increasing their training weights based on this feedback." By assigning higher weights to rerouting query samples that are highly similar to normal queries during model training, the detection model can focus on hard samples, thereby enhancing the robustness and stability of the detector in complex attack scenarios and avoiding performance bias caused by the model's over-reliance on easily classified samples.

[0051] 5) Since the rerouting attack detection method of the present invention can complete the attack identification in the detection stage by “constructing several test pairs and applying the majority voting strategy to generate the classification result of rerouting attack detection”, and the overall reasoning process only relies on a lightweight model and does not need to call a large-scale language model for defense decision, it can significantly reduce the additional computational overhead while ensuring detection accuracy. It is particularly suitable for LLM routing systems that are sensitive to reasoning efficiency and cost, and is conducive to deployment and application in actual online service environments. Attached Figure Description

[0052] Figure 1 This is a schematic diagram of the rerouting attack detection method for LLM routing systems in this invention. Detailed Implementation

[0053] To facilitate understanding and implementation of the present invention by those skilled in the art, the present invention will be further described in detail below with reference to the accompanying drawings and specific embodiments. It should be understood that the embodiments described herein are for illustration and explanation only and are not intended to limit the present invention.

[0054] The purpose of this invention is to address the serious security threats posed by existing rerouting attack methods to LLM routing systems, the lack of corresponding defense measures, and the poor migrating effectiveness of defense methods from other fields. This invention proposes a rerouting attack detection method for LLM routing systems. Figure 1 This is the data flow diagram of the present invention:

[0055] The specific implementation method of the present invention is as follows:

[0056] 1) Rerouting Sample Generation: Given a normal query Rerouting Sample Generator Generate a rerouting setting Apply it to normal queries Generate rerouting query .

[0057] Rerouting generator Four attack scenarios—white-box, black-box, gray-box, and no-box—are employed to simulate the rerouting query construction performed by an attacker after hijacking normal queries. In a white-box attack, the attacker utilizes the gradient information of the LLM router to optimize the rerouting trigger. In a black-box attack, the attacker uses the decision result output by the LLM router (i.e., which model to route to) to optimize the rerouting trigger. In a gray-box attack, the attacker uses the win rate information output by the LLM router (i.e., the winning ratio of one model compared to another) to optimize the rerouting trigger. In a no-box attack, the attacker does not rely on a specific LLM router for trigger optimization; instead, they use an auxiliary LLM to extract query features from a set of normal queries and construct the rerouting trigger. A rerouting generator is also included. Define rerouting settings based on the attack target and method. Including attack methods Target router Trigger length Perplexity constraint The value of . Rerouting generator basic network Used for predictive rerouting settings middle , Choice and , The range of values ​​for:

[0058]

[0059] Based on convolutional neural network Predicted rerouting settings Rerouting generator Normal queries will be processed. Perform a rerouting attack to generate rerouting queries. :

[0060]

[0061]

[0062] in, This indicates a trigger constructed by a rerouting query. Indicates in the router Using attack methods Perform trigger optimization. and These represent calculation triggers. Length and confusion This represents the string concatenation operation.

[0063] 2) Rerouting attack detector based on contrastive learning: based on normal queries Rerouting query with pairing Construct positive and negative sample pairs and feed them into the rerouting attack detector. Perform pairwise training, detector Evaluation of predicted labels for sample pairs and internal similarity score .

[0064] Rerouting attack detector First, the normal query dataset obtained based on "rerouting sample generation" Adversarial Query (Rerouting Query) Dataset Construct positive and negative sample pairs. Positive sample pairs consist of normal-normal query pairs or adversarial-adversarial query pairs, meaning that samples within a positive sample pair share the same semantic distribution, thus enabling the rerouting attack detector to detect this. Learn to identify queries from the same category. Negative pairs consist of normal-adversarial query pairs, with the goal of disabling the rerouting attack detector. Learn to distinguish between normal queries and rerouting queries. This invention implements a complex sampling strategy that balances two types of negative pairs: cross-indexed negative pairs, pairing normal queries with adversarial variants of different queries, and self-indexed negative pairs, pairing normal queries with their own adversarial variants. The ratio of the two types of negative pairs is determined by the negative sample pair cross-ratio. control, This indicates the proportion of negative cross-index pairs to the total number of negative pairs, thus ensuring that the model learns to recognize adversarial patterns between and within queries.

[0065] During training, given a sample pair The rerouting detector utilizes an encoder Extracting text embeddings and Then the projection head The text embeddings are mapped to a normalized embedding space. After regularization of the embeddings, and It will be fed into the embedded classifier The rerouting attack detection branch and the sample pair similarity evaluation branch are used to obtain the predicted labels of the sample pairs. Similarity score between samples .

[0066] Predicted labels for sample pairs This reflects the detector For classifying sample pairs, 0 represents a positive sample pair, and 1 represents a negative sample pair. This label will be used in the classification loss. The goal is to make the rerouting attack detector Learn to distinguish between positive and negative sample pairs:

[0067] ;

[0068] in, Indicates the number of sample pairs. Indicates the first The true label of each sample Indicates the first The predicted probability of a sample.

[0069] Similarity score within a sample pair This reflects the semantic similarity within a sample pair; the closer to 1, the more similar the two samples within the pair. For negative sample pairs, a higher similarity score indicates that the constructed rerouting suggestion is closer to the features of the normal suggestion, making it more difficult for the classifier to distinguish them. Similarity Score Used for supervised contrast loss This allows the rerouting attack detector to detect... It is learned that in the embedding space, positive samples are closer to their internal samples, while negative samples are farther away from their internal samples.

[0070]

[0071] in, This represents the sum of the number of positive and negative sample pairs, while This indicates the total number of samples in the sample pair. This indicates the similarity between sample pairs (cosine similarity is used by default). Representing samples respectively and Embedded, It is a temperature hyperparameter that controls the similarity scale. It is the set of positive samples that anchor the sample, that is, the set of samples that are positive samples. A set of samples with consistent labels:

[0072]

[0073] This represents the denominator mask, which specifies which sample pairs are considered when calculating the denominator of the loss function. Specifically, Including anchored samples The set of positive samples, and Each sample pair contains samples The sample set, Operations represent validation sample combinations ( Does it belong to One of the sample pairs.

[0074]

[0075] This represents the weights of these sample pairs.

[0076] 3) Weighting and Optimization of Hard Samples: Adaptive Sampling Network From the detector Collect samples for predicting labels and similarity score The output feedback is used to dynamically identify hard sample pairs based on this feedback. And increase its training weights Based on training weights Iterative update of rerouting sample generator and detector Model parameters.

[0077] To measure the rerouting attack detector Performance on training samples, rerouting attack detection method calculates true labels and prediction labels absolute difference between As performance feedback, this metric provides the model prediction error for each sample pair; a smaller error indicates higher confidence. It also utilizes the similarity score within each sample pair. As a feedback on sample similarity The similarity score ranges from 0 to 1, with scores closer to 1 indicating greater similarity between the two samples within a sample pair. For negative sample pairs, a higher similarity score indicates that the constructed rerouting suggestion closely resembles the features of the normal suggestion, making it more difficult for the classifier to distinguish between them. This is based on model performance feedback. And sample pair similarity feedback Adaptive sampling network The weights in the supervised contrast loss are calculated for this sample pair. This allows harder-to-classify samples (such as self-indexed negative pairs) to receive higher weights in the denominator, thus improving the detector's performance. The ability to distinguish between normal prompts and rerouting prompts.

[0078] Based on the aforementioned training sample weights, the rerouting sample generator... Rerouting attack detector The training loss function is as follows:

[0079]

[0080]

[0081] in, This represents the weights of the training sample pairs. It is the non-negative hyperparameter of the balancing loss function.

[0082] Adaptive sampling network A local optimum strategy is used to predict the weights of each sample pair during the current training iteration; this is achieved through an adaptive sampling network. The optimization function is as follows:

[0083]

[0084] in, It is a hyperparameter that balances performance feedback and similarity feedback, and for positive sample pairs, Less than 0, for negative sample pairs. Greater than 0.

[0085] 4) Rerouting attack detection: Rerouting attack detector After training is complete, given a new query Detector Several test pairs will be constructed and a majority voting strategy will be applied to generate classification results for rerouting attack detection.

[0086] Given a new user query Detector Random sampling will be performed from the training dataset A normal query , with user query composition a sample pair Then the detector Will be on this Each sample predicts the classification result, and a majority voting strategy is applied to output the final detection, i.e., the user query. Is it a normal query or a rerouting query?

[0087]

[0088] in, Indicates the category of the prediction. Indicates a positive sample pair. Indicates negative sample pairs, This is an indicator function; it takes the value 1 when the condition within the parentheses is true, and 0 otherwise. When the majority vote of a sample pair is a positive sample pair, it indicates a new user query. The distribution is similar to that of normal queries, therefore user queries It's a normal query; otherwise, if If the majority vote for a sample pair is negative, it indicates a new user query. The distribution of user queries is different from that of normal queries, therefore user queries This is a rerouting query.

[0089] It should be understood that the above description of the implementation examples is quite detailed, but it should not be considered as a limitation on the scope of protection of this invention. Those skilled in the art, under the guidance of this invention, can make substitutions or modifications without departing from the scope of protection of the claims of this invention, and all such substitutions or modifications fall within the scope of protection of this invention. The scope of protection of this invention should be determined by the appended claims.

Claims

1. A method for detecting rerouting attacks in LLM routing systems, characterized in that... Train a rerouting detector and apply it to rerouting attack detection, specifically as follows: 1) Rerouting Sample Generation: Given a normal query Rerouting Sample Generator Generate a rerouting setting Apply it to normal queries Generate rerouting query ; 2) Rerouting attack detector based on contrastive learning: based on normal queries Rerouting query with pairing Construct positive and negative sample pairs and feed them into the rerouting attack detector. Perform pairwise training, detector Evaluation of predicted labels for sample pairs and internal similarity score ; 3) Weighting and Optimization of Hard Samples: Adaptive Sampling Network From the detector Collect samples for predicting labels and similarity score The output feedback is used to dynamically identify hard sample pairs based on this feedback. And increase its training weights Based on training weights Iterative update of rerouting sample generator and detector Model parameters; 4) Rerouting attack detection: Rerouting attack detector After training, given a new query, the detector... Several test pairs will be constructed and a majority voting strategy will be applied to generate classification results for rerouting attack detection; The given normal query Rerouting Sample Generator Generate a rerouting setting Specifically: Rerouting Sample Generator Four attack configurations—white-box, black-box, gray-box, and no-box—are employed to simulate an attacker constructing a rerouting query after hijacking a normal query. The rerouting settings are then used to... Define attack methods Target router Trigger length Perplexity constraint The value of , convolutional neural network Used for predictive rerouting settings middle , Choice and , The range of values ​​for: ； The rerouting sample generator Generate a rerouting setting Apply it to normal queries Generate rerouting query Specifically: ； ； in, This indicates a trigger constructed by a rerouting query. Indicates in the router Using attack methods Perform trigger optimization. and These represent calculation triggers. Length and confusion This represents the string concatenation operation.

2. The rerouting attack detection method for LLM routing systems according to claim 1, characterized in that, The above is based on normal query Rerouting query with pairing Construct positive and negative sample pairs and feed them into the rerouting attack detector. Pair training is conducted, specifically as follows: Normal query dataset obtained from rerouting sample generation Adversarial query dataset Positive and negative sample pairs are constructed, where positive sample pairs consist of normal-normal query pairs and adversarial-adversarial query pairs, while negative sample pairs consist of normal-adversarial query pairs. Positive sample pairs share the same semantic distribution, enabling the rerouting attack detector F to learn to identify queries from the same category, while negative pairs combine normal queries and adversarial queries, enabling the rerouting attack detector F to learn to distinguish between normal queries and rerouting queries.

3. The rerouting attack detection method for LLM routing systems according to claim 2, characterized in that, The detector Evaluation of predicted labels for sample pairs Specifically: During training, given a sample pair The rerouting detector utilizes an encoder Extracting text embeddings and Then the projection head Mapping text embeddings to a normalized embedding space, classifier Classify the sample pairs to obtain their predicted labels. This label will be used for classification loss. This allows the rerouting attack detector to detect... Learn to distinguish between positive and negative sample pairs: ； in, Indicates the number of sample pairs. Indicates the first The true label of each sample Indicates the first The predicted probability of a sample.

4. The rerouting attack detection method for LLM routing systems according to claim 3, characterized in that, The detector Assess the internal similarity score of sample pairs Specifically: Based on the embedding of sample pairs, the classifier Output sample pair internal similarity score This score was used to supervise the contrast loss. This allows the rerouting attack detector to detect... It is learned that in the embedding space, positive samples are closer to their internal samples, while negative samples are farther away from their internal samples. ； in, This indicates the number of positive and negative sample pairs. Indicates the similarity between sample pairs. It is a temperature hyperparameter that controls the similarity scale. It is the set of positive samples for anchoring samples. Indicates the denominator mask. This represents the weights of these sample pairs.

5. The rerouting attack detection method for LLM routing systems according to claim 4, characterized in that, The adaptive sampling network From the detector Collect samples for predicting labels and similarity score The output feedback is used to dynamically identify hard sample pairs based on this feedback. And increase its training weights Specifically: To measure the rerouting attack detector Performance on training samples, rerouting attack detection method calculates true labels and prediction labels absolute difference between As performance feedback, the similarity score within the sample pair is also utilized. As a feedback on sample similarity, it is based on the feedback of model performance. And sample pair similarity feedback Adaptive sampling network The weights in the supervised contrast loss are calculated for this sample pair. This allows samples that are more difficult to classify to receive higher weights in the denominator.

6. The rerouting attack detection method for LLM routing systems according to claim 5, characterized in that, The training weight-based Iterative update of rerouting sample generator and detector The model parameters are as follows: Based on the aforementioned training sample weights, the rerouting sample generator... Rerouting attack detector The training loss function is as follows: ； ； in, This represents the weights of the training sample pairs. These are the non-negative hyperparameters of the balancing loss function; Adaptive sampling network A local optimum strategy is used to predict the weights of each sample pair during the current training iteration; this is achieved through an adaptive sampling network. The optimization function is as follows: ； in, It is a hyperparameter that balances performance feedback and similarity feedback.

Images