Method for joint evaluation of model security and availability based on dynamic multi-objective optimization

Abstract

The present application relates to the technical field of artificial intelligence security and natural language processing, and in particular provides a model security and usability joint evaluation method based on dynamic multi-objective optimization. The method comprises using an optimization signal provided by a local reference model to iteratively update a test suffix to generate an evaluation sample; and applying the evaluation sample optimized based on the reference model to the local environment of a target model to be tested for verification and evaluation. The method solves the problems of insufficient evaluation target coverage and weak sample naturalness and scene consistency.

Description

Technical Field

[0001] This invention relates to the fields of artificial intelligence security and natural language processing technology, and in particular to a model security availability joint evaluation method based on dynamic multi-objective optimization, which is used to comprehensively evaluate the content security policy response and service availability characteristics of a model under controlled evaluation conditions. Background Technology

[0002] With the widespread deployment of large language models, the need for systematic evaluation of their robustness, security consistency, and service availability is becoming increasingly urgent. However, existing evaluation methods have two typical limitations in terms of indicator coverage and coordination: First, existing security boundary detection techniques mainly focus on content compliance, often neglecting resource consumption during the inference process (such as computing power consumption and latency). Since the responses induced by such methods are usually short, it is difficult to effectively simulate service availability bottlenecks under high load or complex inference scenarios. Second, although existing service stress testing methods simulate high load by constructing long texts, the generated samples are often accompanied by semantic collapse (such as garbled characters or cyclic repetition). This results in a serious lack of semantic naturalness in the samples, making them highly susceptible to triggering defense rules based on perplexity level (PPL) or repetition rate, thus being directly intercepted by the preprocessing module and unable to truly reach the model kernel.

[0003] Therefore, existing technologies struggle to achieve a coordinated assessment of content security policy boundary behaviors and service availability pressure characteristics within a unified evaluation framework. Unifying these two evaluation objectives typically presents two key optimization challenges: first, indicators such as output length and resource consumption intensity are discrete and non-differentiable, making stable convergence difficult for gradient-based direct optimization; second, text naturalness, scene consistency, and load intensity often exhibit mutually constraining relationships in the objective space, leading to gradient conflicts and Pareto trade-offs in multi-objective optimization. Summary of the Invention

[0004] In view of this, the present invention provides a joint evaluation method for model security and availability based on dynamic multi-objective optimization, in order to solve the problems of insufficient coverage of evaluation objectives and weak sample naturalness and scenario consistency.

[0005] In a first aspect, the present invention provides a joint evaluation method for model security and availability based on dynamic multi-objective optimization, the method comprising:

[0006] Step 1: Use the optimization signal provided by the local reference model to iteratively update the test suffix and generate evaluation samples;

[0007] Step 2: Apply the locally optimized evaluation samples based on the reference model to the target model environment for verification and evaluation.

[0008] Optionally, the steps preceding step 1 include:

[0009] Step a, Initialization and Input Construction: Receive the instruction to be tested With the initial test suffix This serves as the input basis for subsequent iterative optimization; whereby Initialize via random sampling or a placeholder sequence, with the length set according to the preset number of tokens;

[0010] Step b, Model Adaptation and Reference Model Loading: Based on the identification information of the model under test, load a local reference model that matches the structural features according to the preset mapping rules to generate gradient-related optimization signals; if the structural features cannot be identified, load a general reference model and decode the token sequence into a printable text string, and complete the adaptation evaluation through an interface call.

[0011] Optionally, step 1 includes:

[0012] Step 11: Model response generation;

[0013] In the In the next iteration, the instruction to be tested will be... With the current test suffix Concatenate the sequences to construct the input sequence. ;Change the sequence The current local reference model is input for forward propagation, generating candidate response texts. Its expression is:

[0014] ;

[0015] in, The parameter is The conditional probability distribution of the local reference model under given input conditions; if the local reference model and the target model under test are consistent in structural features or training paradigm, then The response distribution of the target model to be tested The reference approximation is used to drive the subsequent indicator calculation and test suffix update process;

[0016] Step 12: Normalization calculation and dynamic aggregation of multidimensional utility indicators;

[0017] A normalization mapping mechanism is introduced to map each sub-indicator to the [0,1] interval, and dynamic aggregation is performed in conjunction with the course learning strategy;

[0018] A. Boundary Trigger Confidence Index Probabilistic computation;

[0019] The confidence index is used to quantify the geometric mean confidence of the model's generated positive prefix of the preset target; to map the results in the log probability domain to standardized probability values, an exponential transformation formula is used:

[0020] ;

[0021] in, Indicates the length of the token sequence with the predefined target affirmative prefix; Indicates the first definite prefix sequence of the target One Token; Indicates the instruction to be tested; Indicates the current number The test suffix for wheels; The parameter is The conditional probability distribution of the local reference model under given input conditions;

[0022] B. Response Length Index truncation calculation;

[0023] Set a target length threshold L_target, and use the truncation normalization formula:

[0024] ;

[0025] in, This represents the total number of tokens in the actual response text generated by the model; This indicates a preset high load length threshold; This represents the truncation function;

[0026] C. Naturalness and Scene Consistency Indicators Composite calculation;

[0027] Constructing a multi-dimensional The indicator is calculated using the following formula:

[0028] ;

[0029] Among them, the fluency item is calculated based on the perplexity level (PPL) and is used to constrain suffixes to conform to the basic grammatical rules of natural language; the style similarity item includes... Representational style corpus, The cosine similarity between the generated suffix and the style corpus in the embedding space is used to guide the suffix to maintain the stylistic and semantic features of the target scene; This is a balancing coefficient used to adjust the weight between the two.

[0030] D. Aggregation of comprehensive utility based on course learning;

[0031] Based on the above normalized index, calculate the overall utility of the current iteration. :

[0032] ;

[0033] in, They represent the first The dynamic weight coefficients of each indicator during round iteration, satisfying the normalization constraint: ;

[0034] E. Dynamic weight adjustment strategy;

[0035] Design a phased dynamic weight scheduling mechanism based on course learning, with each iteration round... The increase in weighting coefficient Evolving according to the following strategy:

[0036] Phase 1: Boundary-triggered search period; when and At that time, polarization weights are used to prioritize increasing the boundary trigger confidence index. The goal of Phase 1 is to make... The test suffix is ​​raised to the threshold neighborhood to obtain the test suffix that meets the triggering condition.

[0037] Phase 2: Load Enhancement and Sample Quality Maintenance Period;

[0038] A phase switch is triggered when any of the following conditions are met:

[0039] (1) (2) ;

[0040] Upon entering Phase 2, the weights will be switched to a balanced distribution, while maintaining... Greater than or equal to Under these conditions, improve the response length index Naturalness and Scene Consistency Indicators ,in The tolerance zone is 0.02–0.10.

[0041] If detected during stage 2 Then temporarily increase Alternatively, it can revert to stage 1 to ensure that the evaluation samples continue to meet the boundary triggering conditions;

[0042] Step 13: Policy update based on gradient estimation;

[0043] I. Dominance Value Estimation :

[0044] To reduce variance, calculate the odds value for the current iteration:

[0045] ;

[0046] in, The moving average baseline for historical utility;

[0047] II. Calculation of the original gradient :

[0048] Using the gradient information provided by the local reference model, the gradient of the log probability of the target prefix sequence TargetPrefix used for boundary determination is estimated under the current input conditions, and this gradient is used as the update direction signal of the test suffix in the embedding space.

[0049] ;

[0050] Wherein, Target Prefix is ​​the reply text. The former A Token subsequence;

[0051] III. Gradient Scaling:

[0052] Using the dominance value scalar Weighted scaling of the original gradient vector:

[0053] ;

[0054] The minus sign "-" indicates that the update is performed in the direction of minimizing loss and maximizing utility.

[0055] IV. Mask Filtering Operations ⊙ Scaled_Grad:

[0056] Construct a binary vocabulary mask matrix (Mask) and impose constraints on the update direction: perform word frequency statistics based on a general or domain-specific corpus and set a frequency truncation threshold. Simultaneously, filtering is performed based on the target language character set, setting the corresponding position of tokens that do not meet the word frequency or character rules to 0, and the rest to 1; then, mask filtering is performed. By suppressing gradient components pointing to unwanted words through element-wise multiplication, the test suffix update conforms to the preset text quality and style constraints.

[0057] Step 14: Suffix mutation and candidate generation;

[0058] Based on the final gradient after masking filtering, the current test suffix... Update: Calculate the expected gradient return for replacing each token position with other candidate words in the vocabulary; select the top-k candidate words with the highest returns for sampling and replacement, and generate the test suffix for the next time step. The updated test suffix The data is sent back to the input to begin the next iteration.

[0059] Step 15: Iterative determination;

[0060] Check if the termination condition is met: if not, continue the above steps; if met, output the final optimized test suffix. .

[0061] Optionally, step 2 includes:

[0062] Step 21, Transfer Test Implementation: Input the instruction to be tested and the final optimized test suffix as the final instruction into the target model to be tested;

[0063] Homologous feature mapping: When the reference model and the target model under test are consistent in structural features or training paradigm, the final optimized test suffix shows good applicability on similar model types, thus evaluating and verifying the policy boundary response and usability pressure characteristics without obtaining the gradient of the target model under test.

[0064] Dual-mode execution: The execution path is adaptively selected based on the deployment environment. For the target model to be tested deployed locally, the inference engine is directly instantiated and called. For the target model to be tested in the form of a remote service, interactive calls are made through a standardized API interface. Both modes are evaluated and judged based on input and output to objectively verify the applicability and evaluation performance of the generated test suffix under different deployment forms.

[0065] Step 22: Evaluation and Judgment Results: Classify and judge the target model based on its response content and performance.

[0066] Content security compliance boundary trigger determination: If the response content contains a preset set of target prefixes, the current instruction under test is determined to meet the content security policy boundary trigger condition;

[0067] Long text generation: If the length of the generated response content exceeds the preset threshold, or the response latency reaches the set threshold, then the current input is determined to meet the usability stress assessment conditions.

[0068] In a second aspect, embodiments of the present invention provide a computer-readable storage medium comprising a stored program, wherein, when the program is executed, it controls the device where the computer-readable storage medium is located to perform a joint evaluation method for model security and availability based on dynamic multi-objective optimization, as described in the first aspect or any possible implementation thereof.

[0069] Thirdly, embodiments of the present invention provide an electronic device, including: one or more processors; a memory; and one or more computer programs, wherein the one or more computer programs are stored in the memory, and the one or more computer programs include instructions that, when executed by the device, cause the device to perform the model security availability joint evaluation method based on dynamic multi-objective optimization in the first aspect or any possible implementation of the first aspect.

[0070] The technical solution provided by this invention includes using the optimization signal provided by the local reference model to iteratively update the test suffix and generate evaluation samples; applying the locally optimized evaluation samples based on the reference model to the target model environment for verification and evaluation. This method solves the problems of insufficient coverage of evaluation targets and weak sample naturalness and scene consistency. Attached Figure Description

[0071] To more clearly illustrate the technical solutions of the embodiments of the present invention, the drawings used in the embodiments will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0072] Figure 1 A flowchart illustrating the joint evaluation method for model security and availability based on dynamic multi-objective optimization provided in this embodiment of the invention;

[0073] Figure 2 A schematic diagram illustrating the principle of test suffix generation based on multi-dimensional evaluation indicators and style consistency constraints, provided in an embodiment of the present invention.

[0074] Figure 3 A comparison chart of average triggering metrics at the content security policy boundary provided in the embodiments of the present invention;

[0075] Figure 4 A comparison chart of the average output length of different methods provided in the embodiments of the present invention;

[0076] Figure 5 A comparison chart of the average perplexity PPL index of different methods provided in the embodiments of the present invention;

[0077] Figure 6 This is a schematic diagram of an electronic device provided in an embodiment of the present invention. Detailed Implementation

[0078] To make the objectives, technical solutions, and advantages of the embodiments of the present invention clearer, the technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0079] It should be understood that the described embodiments are merely some, not all, of the embodiments of the present invention. All other embodiments obtained by those skilled in the art based on the embodiments of the present invention without inventive effort are within the scope of protection of the present invention.

[0080] The terminology used in the embodiments of this invention is for the purpose of describing particular embodiments only and is not intended to limit the invention. The singular forms “a,” “the,” and “the” used in the embodiments of this invention are also intended to include the plural forms unless the context clearly indicates otherwise.

[0081] It should be understood that the term "and / or" used in this article is merely a description of the relationship between related objects, indicating that three relationships can exist. For example, A and / or B can represent: A existing alone, A and B existing simultaneously, or B existing alone. Additionally, the character " / " in this article generally indicates that the preceding and following related objects have an "or" relationship.

[0082] Depending on the context, the word "if" as used here can be interpreted as "when," "when," "in response to determination," or "in response to detection." Similarly, depending on the context, the phrase "if determination" or "if detection (of the stated condition or event)" can be interpreted as "when determination," "in response to determination," "when detection (of the stated condition or event)," or "in response to detection (of the stated condition or event)."

[0083] Figure 1 A flowchart of the joint evaluation method for model security and availability based on dynamic multi-objective optimization provided in this embodiment of the invention is shown below. Figure 1 As shown, the method includes:

[0084] In embodiments of the present invention, such as Figure 1 As shown, the overall process can be divided into:

[0085] Phase 1: Evaluation sample generation phase driven by local reference model. In Phase 1, the system uses the optimization signals provided by the local reference model to iteratively update the test suffix in order to generate evaluation samples that have both high boundary trigger confidence and high text naturalness.

[0086] Phase Two: Model Call and Migration Evaluation Phase. In Phase Two, the system applies the locally optimized test samples based on the reference model to the environment of the target model under test for verification and evaluation.

[0087] Phase 1, which generates test suffixes that meet the multi-dimensional evaluation objectives, is a crucial step in generating evaluation samples; its iterative update process combines... Figure 2 The multi-objective optimization mechanism and the gradient update mechanism under style mask constraints are shown.

[0088] Step 1: Use the optimization signal provided by the local reference model to iteratively update the test suffix and generate evaluation samples;

[0089] In this embodiment of the invention, step 1 includes:

[0090] Step 11: Model response generation (forward propagation);

[0091] In the In the next iteration, the instruction to be tested will be... With the current test suffix Concatenate the sequences to construct the input sequence. ;Change the sequence The current local reference model is input for forward propagation, generating candidate response texts. Its expression is:

[0092] ;

[0093] in, The parameter is The conditional probability distribution of the local reference model under given input conditions; if the local reference model and the target model under test are consistent in structural features or training paradigm, then The response distribution of the target model to be tested The reference approximation is used to drive the subsequent indicator calculation and test suffix update process;

[0094] Step 12: Normalization calculation and dynamic aggregation of multidimensional utility indicators;

[0095] In embodiments of the present invention, such as Figure 1 and Figure 2 As shown, in order to solve the problem of inconsistent dimensions of indicators of different dimensions, a normalization mapping mechanism is introduced to map each sub-indicator to the [0,1] interval, and dynamically aggregate them in combination with the course learning strategy.

[0096] A. Boundary Trigger Confidence Index Probabilistic computation;

[0097] The confidence index is used to quantify the geometric mean confidence of the model's generated positive prefix of the preset target; to map the results in the log probability domain to standardized probability values, an exponential transformation formula is used:

[0098] ;

[0099] in, Indicates the length of the token sequence with the predefined target affirmative prefix; Indicates the first definite prefix sequence of the target One Token; Indicates the instruction to be tested; Indicates the current number The test suffix for wheels; The parameter is The conditional probability distribution of the local reference model under given input conditions;

[0100] This invention uses a geometric mean probability calculation method, which makes the index more sensitive to low-probability positions in the sequence; compared with the arithmetic mean, it can better reflect the bottleneck effect under the constraint of overall sequence consistency.

[0101] B. Response Length Index truncation calculation;

[0102] To characterize the intensity of resource consumption related to availability pressure and to prevent the length term from becoming overly dominant during optimization, a target length threshold L_target is set, and a truncation normalization formula is used:

[0103] ;

[0104] in, This represents the total number of tokens in the actual response text generated by the model; This indicates a preset high load length threshold; This represents the truncation function; this function has saturation characteristics. Once the generated length reaches a threshold, the metric remains at 1.0 to prevent the optimization process from becoming overly biased towards the length objective and weakening the collaborative optimization of other metrics.

[0105] C. Naturalness and Scene Consistency Indicators Composite calculation;

[0106] To improve the consistency of test suffixes in natural language morphology and target scene style, and to reduce the probability of them being filtered by rule-based or statistical feature-based automated filtering, a composite-dimensional [suffix] is constructed. The indicator, which comprehensively measures the naturalness and scene matching of the test suffix text from two dimensions: grammatical fluency and consistency with the target style, is calculated as follows:

[0107] ;

[0108] Among them, the fluency item is calculated based on the perplexity level (PPL) and is used to constrain suffixes to conform to the basic grammatical rules of natural language, reducing unnatural features such as low-quality characters and meaningless repetitions; the style similarity item... Representational style corpora (such as domain-specific text collections like code comments and system logs), such as Figure 2 As shown, The cosine similarity between the generated suffix and the style corpus in the embedding space is used to guide the suffix to maintain the stylistic and semantic features of the target scene; This is a balancing coefficient used to adjust the weight between the two.

[0109] The naturalness and scene consistency index constructed in this invention By introducing a dual constraint mechanism of semantic style and grammatical fluency, the scenario adaptability and stability of the test samples are improved.

[0110] D. Aggregation of comprehensive utility based on course learning;

[0111] Based on the above normalized index, calculate the overall utility of the current iteration. :

[0112] ;

[0113] in, They represent the first The dynamic weight coefficients of each indicator during round iteration, satisfying the normalization constraint: ;

[0114] E. Dynamic weight adjustment strategy;

[0115] To alleviate gradient conflicts and convergence stagnation caused by differences in the optimization directions of various objectives in multi-objective optimization, a phased dynamic weight scheduling mechanism based on course learning is designed, which adjusts the weights according to the iteration rounds. The increase in weighting coefficient Evolving according to the following strategy:

[0116] Phase 1: Boundary-triggered search period; when (like )and At that time, polarization weights are used to prioritize increasing the boundary trigger confidence index, such as setting... , , The goal of Phase 1 is to make The test suffix is ​​raised to the threshold neighborhood to obtain the test suffix that meets the triggering condition.

[0117] Phase 2: Load Enhancement and Sample Quality Maintenance Period;

[0118] A phase switch is triggered when any of the following conditions are met:

[0119] (1) (2) (Avoid staying in stage 1 for too long);

[0120] After entering Phase 2, the weights will be switched to a balanced distribution (e.g., ), while maintaining Greater than or equal to Under these conditions, improve the response length index Naturalness and Scene Consistency Indicators ,in The tolerance zone is 0.02–0.10.

[0121] If detected during stage 2 Then temporarily increase Alternatively, it can revert to stage 1 to maintain the evaluation samples continuously meeting the boundary triggering conditions and improve the stability of the iteration process;

[0122] Step 13: Policy update based on gradient estimation ( );

[0123] This invention is based on Figure 2 The mechanism shown is the core of the test suffix iterative update. The system does not directly update the model parameters, but rather updates the input test suffix. The specific process is as follows:

[0124] I. Dominance Value Estimation :

[0125] To reduce variance, calculate the odds value for the current iteration:

[0126] ;

[0127] in, The historical utility moving average baseline; if This indicates that the current suffix is ​​relatively better in terms of overall utility, and can enhance the update signal in this direction.

[0128] II. Calculation of the original gradient :

[0129] Using the gradient information provided by the local reference model, the gradient of the log probability of the target prefix sequence TargetPrefix used for boundary determination is estimated under the current input conditions, and this gradient is used as the update direction signal of the test suffix in the embedding space.

[0130] ;

[0131] Wherein, Target Prefix is ​​the reply text. The former A sequence of token subsequences, thus enabling gradient estimation and... The computational objects remain consistent, and noise from tokens irrelevant to the decision is reduced. If the local reference model and the target model under test have consistent structural features, this gradient signal can be used to improve the stability of subsequent suffix updates;

[0132] III. Gradient Scaling:

[0133] Using the dominance value scalar Weighted scaling of the original gradient vector:

[0134] ;

[0135] The minus sign "-" indicates that the update is performed in the direction of minimizing loss and maximizing utility.

[0136] IV. Mask Filtering Operations ⊙ Scaled_Grad:

[0137] To reduce the probability of generating low-quality characters, low-frequency terms, or unnatural fragments during gradient updates, a binary vocabulary mask matrix is ​​constructed, and the update direction is constrained by filtering: word frequency statistics are performed based on a general or domain-specific corpus, and a frequency truncation threshold is set. (e.g., retaining Top-K high-frequency words); simultaneously, filter using the target language character set, setting the position of tokens that do not meet the word frequency or character rules to 0, and the rest to 1; then perform mask filtering. By suppressing gradient components pointing to unwanted words through element-wise multiplication, the test suffix update conforms to the preset text quality and style constraints.

[0138] Step 14: Suffix mutation and candidate generation;

[0139] Based on the final gradient after masking filtering, the current test suffix... Update: Calculate the expected gradient return for replacing each token position with other candidate words in the vocabulary; select the top-k candidate words with the highest returns for sampling and replacement, and generate the test suffix for the next time step. ;like Figure 2 The dotted line indicates the updated test suffix. The data is sent back to the input to begin the next iteration.

[0140] Step 15: Iterative determination;

[0141] Check if the termination condition is met (e.g., reaching the maximum number of iterations). or combined utility (If the threshold is exceeded): If not met, continue the above steps; if met, output the final optimized test suffix. .

[0142] Step 2: Apply the locally optimized evaluation samples based on the reference model to the target model environment for verification and evaluation.

[0143] In this embodiment of the invention, step 2 includes:

[0144] Step 21, Transfer testing implementation (mapping based on common features): Input the instruction to be tested and the final optimized test suffix as the final instruction into the target model to be tested;

[0145] Homologous feature mapping: When the reference model and the target model under test are consistent in structural features or training paradigm, the final optimized test suffix shows good applicability on similar model types, thus evaluating and verifying the policy boundary response and usability pressure characteristics without obtaining the gradient of the target model under test.

[0146] Dual-mode execution: The execution path is adaptively selected based on the deployment environment. For the target model to be tested deployed locally, the inference engine is directly instantiated and called. For the target model to be tested in the form of a remote service, interactive calls are made through a standardized API interface. Both modes are evaluated and judged based on input and output to objectively verify the applicability and evaluation performance of the generated test suffix under different deployment forms.

[0147] Step 22: Evaluation and Judgment Results: Classify and judge the target model based on its response content and performance.

[0148] Content security compliance boundary trigger (response anomaly) determination: If the response content contains a preset target prefix set, the current instruction under test is determined to meet the content security policy boundary trigger condition;

[0149] Ultra-long text generation (high computational load): If the length of the generated response content exceeds the preset threshold, or the response latency reaches the set threshold, the current input is determined to meet the usability stress evaluation conditions.

[0150] This invention generates and filters test samples with good applicability and text naturalness using a local reference model without needing to obtain the internal parameters and gradient information of the target model under test. This enables a collaborative and automated evaluation of the boundary behavior of content security policies and the performance of service availability under pressure in large language models.

[0151] In this embodiment of the invention, the steps preceding step 1 include:

[0152] Step a, Initialization and Input Construction: Receive the instruction to be tested With the initial test suffix This serves as the input basis for subsequent iterative optimization; whereby Initialize via random sampling or a placeholder sequence, with the length set according to the preset number of tokens;

[0153] Step b, Model Adaptation and Reference Model Loading: Based on the identification information of the model under test (model name, interface metadata, or model type label), load a local reference model that matches the structural features according to the preset mapping rules to generate gradient-related optimization signals; if the structural features cannot be identified, load a general reference model and decode the token sequence into a printable text string, and complete the adaptation evaluation through interface calls.

[0154] Experimental testing of this invention:

[0155] This invention was conducted on an NVIDIA A100 accelerated computing environment and the HarmBench standard dataset. Fifty instruction samples requiring key verification were randomly selected from the dataset for testing. Comparative evaluations were performed on the LLaMA and Gemma family models, with GCG, AutoDAN, and Sponge methods selected as baseline solutions for comparison. To ensure the comparability and reliability of the comparative evaluations, GCG, AutoDAN, Sponge, and the method of this invention were all tested on the same batch of 50 randomly selected instruction samples, and each was independently run three times under the same experimental configuration (including the maximum generation length limit, etc.). The final result was the average of the three runs.

[0156] Embodiments of the present invention, such as Figures 3 to 5 As shown, the success rate of boundary triggering in the LLaMA family scenario and the Gemma family scenario of this invention is 93.5% and 89.0% respectively, which is higher than the baseline method, while Sponge is less than 12% in this metric; with the maximum generation length limit of 1024 tokens (experimental configuration limit), the average output length of this invention exceeds 980 tokens, while GCG and AutoDAN are less than 400 tokens; at the same time, the average perplexity of the samples generated by this invention is about 35, while the average perplexity of the corresponding methods is generally greater than 2000, which shows better text naturalness and consistency.

[0157] The method of this invention can run in a computing environment with accelerated computing resources and can be adapted to large language models deployed locally or remotely through a unified inference and communication interface to complete the generation of evaluation samples and the collection of model responses.

[0158] The method of this invention constructs a test sample that simultaneously includes boundary trigger confidence index, response length index, and naturalness and scenario consistency index. It uses a policy gradient optimization method to generate and update test suffixes in a discrete text space, thereby obtaining test samples that meet the multi-dimensional evaluation objectives. The method of this invention can generate test samples that simultaneously meet boundary trigger conditions and high load characteristics under controlled evaluation conditions, and realize the collaborative evaluation of the boundary behavior of model content security policy and service availability pressure performance.

[0159] This invention introduces style masking and vocabulary constraint mechanisms to limit the candidate variation space of test suffixes, thereby improving the stylistic consistency and text naturalness of the samples. During the gradient search phase, style masking applies controlled constraints to the selectable lexical set, ensuring consistency between the stylistic and semantic structures of the test suffixes. This improves sample naturalness and scene adaptability, meets input quality requirements, and reduces the probability of misjudgment by quality control rules. Simultaneously, this invention maps discrete, non-differentiable indices such as output length to reward signals, enabling optimization within a policy learning framework. Furthermore, by adjusting the termination tendency of the generation process, the evaluation samples generate longer outputs while meeting boundary triggering conditions, thus achieving a quantitative assessment of resource consumption intensity and service availability pressure levels.

[0160] Compared with the prior art, the present invention has the following advantages:

[0161] 1. Achieve collaborative evaluation of content security policy boundary behaviors and service availability pressure characteristics within a unified framework. The generated evaluation samples can exhibit long output and continuous generation characteristics, provided that boundary triggering conditions are met, thus providing reproducible multi-dimensional evaluation criteria for model security and availability.

[0162] 2. Introduce style consistency and vocabulary constraint mechanisms to improve the naturalness and stylistic consistency of evaluation samples. By limiting the candidate variation space, the generated samples are made closer to normal interactive text in terms of grammatical and semantic structure, reducing perplexity level (PPL) and low-quality features, thereby reducing the possibility of being misjudged by automated filtering rules and improving the coverage of policy boundaries and usability risk scenarios.

[0163] 3. Overcame the optimization challenge of discrete and non-differentiable long text generation targets in service stress evaluation. Addressing the technical bottleneck of directly optimizing gradients for output length and continuous generation behavior, this invention establishes a modeling method that transforms discrete indicators into learnable signals. By jointly optimizing the end-symbol suppression probability and resource consumption reward, the non-differentiable hard constraint is successfully transformed into a soft gradient understandable by the policy network, thereby improving the stability of automated extreme load testing.

[0164] The technical solution provided by this invention includes using the optimization signal provided by the local reference model to iteratively update the test suffix and generate evaluation samples; applying the locally optimized evaluation samples based on the reference model to the target model environment for verification and evaluation. This method solves the problems of insufficient coverage of evaluation targets and weak sample naturalness and scene consistency.

[0165] The various steps in the embodiments of the present invention can be performed by an electronic device. This electronic device includes, but is not limited to, tablet computers, portable PCs, and desktop computers.

[0166] This invention provides a computer-readable storage medium including a stored program, wherein, when the program is running, it controls the electronic device containing the computer-readable storage medium to execute the above-described embodiment of the model security and availability joint evaluation method based on dynamic multi-objective optimization.

[0167] Figure 6 A schematic diagram of an electronic device provided in an embodiment of the present invention, such as... Figure 6 As shown, the electronic device 21 includes a processor 211, a memory 212, and a computer program 213 stored in the memory 212 and executable on the processor 211. When the computer program 213 is executed by the processor 211, it implements the model security and availability joint evaluation method based on dynamic multi-objective optimization in the embodiment. To avoid repetition, it will not be described in detail here.

[0168] Electronic device 21 includes, but is not limited to, processor 211 and memory 212. Those skilled in the art will understand that... Figure 6 This is merely an example of electronic device 21 and does not constitute a limitation on electronic device 21. It may include more or fewer components than shown, or combine certain components, or different components. For example, electronic device may also include input / output devices, network access devices, buses, etc.

[0169] The processor 211 may be a Central Processing Unit (CPU), or other general-purpose processors, digital signal processors (DSPs), application-specific integrated circuits (ASICs), field-programmable gate arrays (FPGAs), or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, etc. A general-purpose processor may be a microprocessor or any conventional processor.

[0170] The memory 212 can be an internal storage unit of the electronic device 21, such as a hard disk or RAM of the electronic device 21. The memory 212 can also be an external storage device of the electronic device 21, such as a plug-in hard disk, Smart Media Card (SMC), Secure Digital (SD) card, or FlashCard equipped on the electronic device 21. Furthermore, the memory 212 can include both internal and external storage units of the electronic device 21. The memory 212 is used to store computer programs and other programs and data required by network devices. The memory 212 can also be used to temporarily store data that has been output or will be output.

[0171] Those skilled in the art will clearly understand that, for the sake of convenience and brevity, the specific working processes of the systems, devices, and units described above can be referred to the corresponding processes in the foregoing method embodiments, and will not be repeated here.

[0172] The above description is only a preferred embodiment of the present invention and is not intended to limit the present invention. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of the present invention should be included within the scope of protection of the present invention.

Claims

1. A joint evaluation method for model security and availability based on dynamic multi-objective optimization, characterized in that, The method includes: Step 1: Use the optimization signal provided by the local reference model to iteratively update the test suffix and generate evaluation samples; Step 2: Apply the locally optimized evaluation samples based on the reference model to the environment of the target model under test for verification and evaluation; Before step 1, the following is included: Step a, Initialization and Input Construction: Receive the instruction to be tested With the initial test suffix This serves as the input basis for subsequent iterative optimization; whereby Initialize via random sampling or a placeholder sequence, with the length set according to the preset number of tokens; Step b, Model Adaptation and Reference Model Loading: Based on the identification information of the model under test, load a local reference model that matches the structural features according to the preset mapping rules to generate gradient-related optimization signals; if the structural features cannot be identified, load a general reference model and decode the token sequence into a printable text string, and complete the adaptation evaluation through an interface call. Step 2 includes: Step 21, Transfer Test Implementation: Input the instruction to be tested and the final optimized test suffix as the final instruction into the target model to be tested; Homologous feature mapping: When the reference model and the target model under test are consistent in structural features or training paradigm, the final optimized test suffix shows good applicability on similar model types, thus evaluating and verifying the policy boundary response and usability pressure characteristics without obtaining the gradient of the target model under test. Dual-mode execution: The execution path is adaptively selected based on the deployment environment. For the target model to be tested deployed locally, the inference engine is directly instantiated and called. For the target model to be tested in the form of a remote service, interactive calls are made through a standardized API interface. Both modes are evaluated and judged based on input and output to objectively verify the applicability and evaluation performance of the generated test suffix under different deployment forms. Step 22: Evaluation and Judgment Results: Classify and judge the target model based on its response content and performance. Content security compliance boundary trigger determination: If the response content contains a preset set of target prefixes, the current instruction under test is determined to meet the content security policy boundary trigger condition; Long text generation: If the length of the generated response content is greater than the preset threshold, or the response latency reaches the set threshold, then the current input is determined to meet the usability stress assessment conditions. Step 1 includes: Step 11: Model response generation; In the In the next iteration, the instruction to be tested will be... With the current test suffix Concatenate the sequences to construct the input sequence. ;Change the sequence The current local reference model is input for forward propagation, generating candidate response texts. Its expression is: ； in, The parameter is The conditional probability distribution of the local reference model under given input conditions; if the local reference model and the target model under test are consistent in structural features or training paradigm, then The response distribution of the target model to be tested The reference approximation is used to drive the subsequent indicator calculation and test suffix update process; Step 12: Normalization calculation and dynamic aggregation of multidimensional utility indicators; A normalization mapping mechanism is introduced to map each sub-indicator to the [0,1] interval, and dynamic aggregation is performed in conjunction with the course learning strategy; A. Boundary Trigger Confidence Index Probabilistic computation; The confidence index is used to quantify the geometric mean confidence of the model's generated positive prefix of the preset target; to map the results in the log probability domain to standardized probability values, an exponential transformation formula is used: ； in, Indicates the length of the token sequence with the predefined target affirmative prefix; Indicates the first definite prefix sequence of the target One Token; Indicates the instruction to be tested; Indicates the current number The test suffix for wheels; The parameter is The conditional probability distribution of the local reference model under given input conditions; B. Response Length Index truncation calculation; Set a target length threshold L_target, and use the truncation normalization formula: ； in, This represents the total number of tokens in the actual response text generated by the model; This indicates a preset high load length threshold; This represents the truncation function; C. Naturalness and Scene Consistency Indicators Composite calculation; Constructing a multi-dimensional The indicator is calculated using the following formula: ； Among them, the fluency item is calculated based on the perplexity level (PPL) and is used to constrain suffixes to conform to the basic grammatical rules of natural language; the style similarity item includes... Representational style corpus, The cosine similarity between the generated suffix and the style corpus in the embedding space is used to guide the suffix to maintain the stylistic and semantic features of the target scene; This is a balancing coefficient used to adjust the weight between the two. D. Aggregation of comprehensive utility based on course learning; Calculate the overall utility of the current iteration based on the normalized index. : ； in, They represent the first The dynamic weight coefficients of each indicator during round iteration, satisfying the normalization constraint: ; E. Dynamic weight adjustment strategy; Design a phased dynamic weight scheduling mechanism based on course learning, with each iteration round... The increase in weighting coefficient Evolving according to the following strategy: Phase 1: Boundary-triggered search period; when and At that time, polarization weights are used to prioritize increasing the boundary trigger confidence index. The goal of Phase 1 is to make... The test suffix is ​​raised to the threshold neighborhood to obtain the test suffix that meets the triggering condition. Phase 2: Load Enhancement and Sample Quality Maintenance Period; A phase switch is triggered when any of the following conditions are met: (1) ；(2) ； Upon entering Phase 2, the weights will be switched to a balanced distribution, while maintaining... Greater than or equal to Under these conditions, improve the response length index Naturalness and Scene Consistency Indicators ,in The tolerance zone is 0.02–0.

10. If detected during stage 2 Then temporarily increase Alternatively, it can revert to stage 1 to ensure that the evaluation samples continue to meet the boundary triggering conditions; Step 13: Policy update based on gradient estimation; I. Dominance Value Estimation : To reduce variance, calculate the odds value for the current iteration: ； in, The moving average baseline for historical utility; II. Calculation of the original gradient : Using the gradient information provided by the local reference model, the gradient of the log probability of the target prefix sequence used for boundary determination is estimated under the current input conditions, and this gradient is used as the update direction signal of the test suffix in the embedding space. ； Wherein, Target Prefix is ​​the reply text. The former A Token subsequence; III. Gradient Scaling: Using the dominance value scalar Weighted scaling of the original gradient vector: ； The minus sign "-" indicates that the update is performed in the direction of minimizing loss and maximizing utility. IV. Mask Filtering Operations ⊙ Scaled_Grad: Construct a binary vocabulary mask matrix (Mask) and impose constraints on the update direction: perform word frequency statistics based on a general or domain-specific corpus and set a frequency truncation threshold. Simultaneously, filtering is performed based on the target language character set, setting the corresponding position of tokens that do not meet the word frequency or character rules to 0, and the rest to 1; then, mask filtering is performed. By suppressing gradient components pointing to unwanted words through element-wise multiplication, the test suffix update conforms to the preset text quality and style constraints. Step 14: Suffix mutation and candidate generation; Based on the final gradient after masking, the current test suffix Update: Calculate the expected gradient return for replacing each token position with other candidate words in the vocabulary; select the top-k candidate words with the highest returns for sampling and replacement, and generate the test suffix for the next time step. The updated test suffix The data is sent back to the input to begin the next iteration. Step 15: Iterative determination; Check if the termination condition is met: if not, continue the above steps; if met, output the final optimized test suffix. .

2. A computer-readable storage medium, characterized in that, The computer-readable storage medium includes a stored program, wherein, when the program is executed, it controls the device where the computer-readable storage medium is located to perform the model security and availability joint evaluation method based on dynamic multi-objective optimization as described in claim 1.

3. An electronic device, characterized in that, include: One or more processors; Memory; And one or more computer programs, wherein the one or more computer programs are stored in the memory, and the one or more computer programs include instructions that, when executed by the device, cause the device to perform the model security availability joint evaluation method based on dynamic multi-objective optimization as described in claim 1.

Images