Content security protection method and device based on semantic consistency

Abstract

The invention belongs to the technical field of computer information security, particularly discloses a content security protection method and device based on semantic consistency, and aims to solve the problem that high-level cue word injection attacks are difficult to effectively recognize in the prior art. Carrying out real-time interception on dominant illegal texts through a content filtering module; quantizing generation rationality differences of prompt words between attack and normal language models by using a word vector confusion degree calculation module; evaluating the logic coherence of the sentence structure of the prompt word through a statement semantic consistency judgment module; integrating the multi-dimensional feature data and carrying out risk classification by adopting a machine learning algorithm; and routing the suspected attack request to a value fine tuning model for processing according to a judgment result. According to the technical scheme, high-precision recognition and response to complex cue word injection attacks are achieved, and the content safety protection capacity and compliance guarantee level of a large model in an interaction scene are remarkably improved.

Description

Technical Field

[0001] This invention belongs to the field of computer information security technology, and specifically discloses a content security protection method and device based on semantic consistency. Background Technology

[0002] With the rapid development of Large Language Models (LLMs) technology and its deep penetration into various industry applications, their core position as a new generation of artificial intelligence infrastructure has become increasingly prominent. Leveraging their superior natural language understanding, generation, and reasoning capabilities, LLMs are profoundly transforming multiple fields, including knowledge-based question answering, content creation, code generation, and even enterprise-level intelligent decision-making, becoming a crucial engine for driving industrial digital and intelligent transformation. However, while this powerful content generation capability unleashes enormous productivity value, it also brings severe and complex content security risks. Ensuring that the model's output content is legal, compliant, and conforms to social norms and public order has become a key bottleneck restricting the healthy and sustainable development of this technology.

[0003] Current technologies generally lack the ability to conduct security assessments based on the inherent characteristics of language models themselves. A large language model is essentially a probability distribution model trained on massive amounts of text data; the generation of any text follows its inherent probabilistic logic. Normal, benign user interactions typically exhibit coherent language patterns and semantic flow that conform to the general rules learned by the model. However, injection attacks, in order to achieve their manipulative intent, often introduce probabilistically inconsistent instruction fragments into the text, or construct sentence structures rarely seen in normal contexts. This "abnormality" or "inconsistency" presented in the language model's probability space is precisely the key signal for identifying such attacks, but existing security filtering mechanisms have not established an effective framework for measuring and analyzing these deep features. Therefore, how to design a method that transcends traditional surface content detection, delves into the inherent probability distribution and semantic structure of the language model, and identifies potential logical manipulation attempts by quantitatively evaluating the rationality and semantic consistency of the generated input text has become a key challenge and an urgent technical problem for those skilled in the art. Summary of the Invention

[0004] The purpose of this invention is to overcome the technical shortcomings of existing content security protection systems, which lack sufficient identification capabilities due to reliance on surface content review when dealing with advanced and covert attacks such as prompt word injection and jailbreak attacks. Addressing the fundamental misalignment between existing defense logic and novel attack mechanisms, this invention proposes a content security protection method and device based on semantic consistency. This method goes beyond static matching and classification of explicit text content, delving into the intrinsic probability distribution and semantic structure of language models. By constructing a multi-dimensional, multi-layered deep semantic analysis and behavior judgment framework, it quantitatively assesses the anomalies of user input in the language model's probability space and the inconsistencies in its semantic structure. Combined with the dynamic evolution characteristics of conversation history, it achieves accurate identification and adaptive response to malicious manipulation attempts, thereby fundamentally improving the security, compliance, and credibility of large language model applications.

[0005] According to a first aspect of the present invention, the present invention claims protection for a content security protection method based on semantic consistency, comprising: S1: The input and output content is directly filtered and intercepted through the content filtering module. The content filtering module uses a pre-trained language model combined with a keyword matching mechanism to identify and block explicit illegal text. S2: Using the word vector perplexity calculation module, the perplexity difference of the input prompt word to be detected is calculated between different language models. The word vector perplexity calculation module trains the prompt word generation model and the normal corpus generation model by constructing an attack corpus and a normal corpus, respectively, and quantifies the rationality of the generated prompt word based on the probability distribution characteristics. S3: Using the sentence semantic consistency determination module, calculate the degree of semantic coherence of the input prompt word before and after. The sentence semantic consistency determination module evaluates the logical consistency of the sentence structure by comparing and analyzing the perplexity at the sentence level and the perplexity at the word level. S4: Through the comprehensive judgment module, multi-dimensional feature data is integrated to identify user input risks. The comprehensive judgment module integrates word vector perplexity difference value, sentence semantic consistency difference value, sentence number statistics value, character number statistics value, frequency of occurrence of sensitive words, and frequency of use of special symbols. Machine learning algorithms are used to make the final classification judgment to obtain the comprehensive judgment result. S5: Perform suspected injection attack judgment and response routing. Based on the comprehensive judgment result, user requests identified as suspected injection attacks are routed to the value fine-tuning model for processing, while normal requests continue to be served by the general inference model.

[0006] Furthermore, the method also includes: The content filtering module uses a pre-trained language model that combines BERT pre-training with keyword methods to detect illegal text content.

[0007] Furthermore, the method also includes: The attack corpus contains labeled prompt word injection attack samples, and the normal corpus contains normal user interaction samples. Both corpora have undergone data cleaning and standardization. Both the prompt word generation model and the normal corpus generation model adopt a transformer architecture based on a self-attention mechanism.

[0008] Furthermore, the specific execution process of the word vector perplexity calculation module includes: S21, For the prompt word to be detected, input it into the prompt word generation model and the normal corpus generation model respectively; S22, obtain the vocabulary probability distribution matrix at the output layer of the prompt word generation model and the normal corpus generation model, wherein the dimension of the vocabulary probability distribution matrix corresponds to the product of the prompt word length and the vocabulary size; S23, calculate the conditional probability of each word based on the word probability distribution matrix, and obtain the overall perplexity value through geometric mean operation; S24, calculate the relative difference ratio of the perplexity values ​​of the prompt word generation model and the normal corpus generation model.

[0009] Furthermore, the method also includes: The semantic consistency determination module adopts a perplexity calculation strategy for sentence segmentation path and word segmentation path; The sentence segmentation path divides the target prompt word into multiple clauses based on punctuation marks, calculates the perplexity of each clause, and then obtains the overall value through geometric mean. The word segmentation path directly calculates the overall perplexity of the prompt word to be detected based on the word sequence, and finally evaluates semantic consistency by comparing the relative differences between the calculation results of the two paths.

[0010] Furthermore, the feature dimensions integrated by the comprehensive determination module of this method include: The word vector perplexity difference value is calculated by the ratio of the absolute difference in perplexity between the two models to the larger value. The statement semantic consistency difference value is calculated by the ratio of the absolute difference in perplexity between the two calculation paths to the larger value. The sentence count is obtained by counting punctuation marks; the character count is obtained by counting the number of words after word segmentation. The frequency of sensitive words is calculated based on the ratio of the number of sensitive words identified by the Naive Bayes algorithm to the total number of words. The frequency of special symbols is calculated based on the ratio of the number of matching preset symbol patterns to the total number of words.

[0011] Furthermore, the method also includes: The value fine-tuning model is obtained by supervised fine-tuning of the basic language model. The training data includes question and answer samples that conform to social norms and customs. Low-rank adaptation technique is used in the fine-tuning process. The method further includes: The system features a real-time monitoring and feedback mechanism that continuously collects user interaction data and updates the feature library. Monitoring metrics include attack detection accuracy, false alarm rate, and response latency. When any metric deviates from the preset threshold, an alert is triggered. The system supports incremental training of the judgment model based on newly collected data, with a model update cycle of no more than 24 hours.

[0012] Furthermore, the method also includes: The formula for calculating perplexity is as follows:

[0013] Where W represents a corpus, and N represents the number of tokens contained in that corpus. , which represents the probability that the model generates the sentence.

[0014] Based on the analysis of the lexical probability distribution matrix, the perplexity of the detected prompt word is calculated in both the prompt word generation model and the normal corpus generation model. Then, the difference between the two is calculated using the following formula; .

[0015] Furthermore, the method also includes: The perplexity of the detected prompt words is calculated in two ways: word and sentence. For the prompt word to be detected, it is divided into sentences according to punctuation, and the prompt word to be detected contains m short sentences. The perplexity level is calculated for each short sentence separately. , ,... The overall level of confusion is given by the following formula: ; For the prompt word to be detected, it is segmented into words according to characters. The prompt word to be detected includes n words. The perplexity is calculated using the following formula: ; Finally, the difference between the two is calculated as follows: .

[0016] According to a second aspect of the present invention, the present invention claims protection for a content security protection device based on semantic consistency, comprising: The content filtering module directly filters and intercepts input and output content, using a pre-trained language model combined with a keyword matching mechanism to identify and block explicit violations. The word vector perplexity calculation module calculates the perplexity difference of the input prompt word to be detected between different language models. By constructing an attack corpus and a normal corpus, the prompt word generation model and the normal corpus generation model are trained respectively, and the rationality of the generated prompt word is quantified based on the probability distribution characteristics. The sentence semantic consistency determination module calculates the degree of semantic coherence of the input prompt words before and after them, and evaluates the logical consistency of the sentence structure by comparing and analyzing the perplexity at the sentence level and the perplexity at the word level. The comprehensive judgment module integrates multi-dimensional feature data to identify user input risks. The comprehensive judgment module integrates features such as word vector perplexity difference value, sentence semantic consistency difference value, sentence number statistics value, character number statistics value, frequency of occurrence of sensitive words, and frequency of use of special symbols, and uses machine learning algorithms to make the final classification judgment to obtain the comprehensive judgment result. The value fine-tuning model receives and executes suspected injection attack judgment and response routing. Based on the comprehensive judgment result, user requests identified as suspected injection attacks are routed to the destination, while normal requests continue to be served by the general inference model. The semantically consistent content security protection device is used to execute the semantically consistent content security protection method.

[0017] Compared with the prior art, the present invention has the following beneficial effects: By constructing a multi-level semantic analysis framework, the semantic features of prompt words are deeply analyzed from two dimensions: word vector probability distribution characteristics and sentence structure consistency. Combined with multi-dimensional behavioral feature fusion and machine learning classification mechanism, high-precision identification and blocking of advanced prompt word injection attacks are achieved, effectively improving the content security protection capability and compliance assurance level of large language models in complex interaction scenarios. Attached Figure Description

[0018] Figure 1 A flowchart illustrating the workflow of a content security protection method based on semantic consistency, for which protection is sought in an embodiment of the present invention. Figure 2 This is a second flowchart of a content security protection method based on semantic consistency that is claimed in an embodiment of the present invention; Figure 3This is a structural block diagram of a content security protection device based on semantic consistency, which is claimed in an embodiment of the present invention. Detailed Implementation

[0019] The technical solutions of the embodiments of this application will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only a part of the embodiments of this application, and not all of the embodiments. Based on the embodiments of this application, all other embodiments obtained by those of ordinary skill in the art without creative effort are within the scope of protection of this application.

[0020] In this document, the term "embodiment" means that a particular feature, structure, or characteristic described in connection with an embodiment may be included in at least one embodiment of this application. The appearance of this phrase in various places throughout the specification does not necessarily refer to the same embodiment, nor is it a mutually exclusive, independent, or alternative embodiment. It will be explicitly and implicitly understood by those skilled in the art that the embodiments described herein can be combined with other embodiments.

[0021] A relatively mature content security protection system for large models has been established in existing technologies. This system is typically built around two dimensions: intrinsic model security and external filtering and review. At the intrinsic model security level, it mainly relies on injecting aligned values ​​during the model pre-training and fine-tuning stages. This is achieved through techniques such as Reinforcement Learning From Human Feedback (RLHF), which guides the model to learn response patterns that conform to human social ethical norms. At the external filtering and review level, security gateways are generally deployed at the model's input and output ends. The core technology typically combines efficient keyword matching algorithms with lightweight text classification models. Specifically, the keyword matching mechanism maintains a dynamically updated lexicon covering sensitive areas such as politics, terrorism, pornography, and violence, enabling high-speed scanning and immediate interception of incoming text data. The lightweight classification model, trained through supervised learning on labeled corpora, can perform coarse-grained risk assessment of text, identifying semantically explicit violations. At a specific stage of technological development, this protection strategy, which combines internal and external approaches and focuses on identifying explicit content, has played a crucial role in intercepting direct and explicit malicious instructions and harmful information, thus building the first line of defense for content security.

[0022] As offensive and defensive confrontations escalate and attackers gain a deeper understanding of the working principles of large models, the aforementioned protection paradigm based on static rules and surface semantic analysis is increasingly revealing its inherent limitations when facing new advanced attacks such as prompt injection and jailbreak attacks. The reason for this is that the core strategy of these advanced attacks is no longer simply using prohibited words, but rather manipulating the model's behavioral logic by constructing complex and concealed linguistic environments. Attackers often use role-playing commands, academic research disguises, logical nesting deception, or special encoded symbols to cleverly encapsulate malicious intent within a seemingly grammatically correct and semantically coherent text. For traditional keyword matching systems, since the attack text may not contain any pre-set sensitive words, the system will be completely ineffective. Furthermore, lightweight classification models that rely on surface semantic features often rely on features extracted by bag-of-words models or shallow neural networks. These features cannot penetrate the attacker's carefully designed semantic disguises and are unable to capture the deep logical contradictions and intention distortions within the text. Therefore, the fundamental contradiction facing existing technological systems lies in the fact that their defense mechanisms are based on the censorship of text "content," while new attacks target the inducement and manipulation of model "behavior." This fundamental misalignment between defense logic and attack mechanisms results in a significant deficiency in the ability of protection systems to identify malicious commands that have undergone semantic reconstruction or multi-turn dialogue, thus creating serious security vulnerabilities.

[0023] According to the first embodiment of the present invention, referring to Figure 1 This invention claims protection for a content security protection method based on semantic consistency, comprising: S1: The input and output content is directly filtered and intercepted through the content filtering module. The content filtering module uses a pre-trained language model combined with a keyword matching mechanism to identify and block explicit illegal text. S2: Using the word vector perplexity calculation module, the perplexity difference of the input prompt word to be detected is calculated between different language models. The word vector perplexity calculation module trains the prompt word generation model and the normal corpus generation model by constructing an attack corpus and a normal corpus, respectively, and quantifies the rationality of the generated prompt word based on the probability distribution characteristics. S3: Using the sentence semantic consistency determination module, calculate the degree of semantic coherence of the input prompt word before and after. The sentence semantic consistency determination module evaluates the logical consistency of the sentence structure by comparing and analyzing the perplexity at the sentence level and the perplexity at the word level. S4: Through the comprehensive judgment module, multi-dimensional feature data is integrated to identify user input risks. The comprehensive judgment module integrates word vector perplexity difference value, sentence semantic consistency difference value, sentence number statistics value, character number statistics value, frequency of occurrence of sensitive words, and frequency of use of special symbols. Machine learning algorithms are used to make the final classification judgment to obtain the comprehensive judgment result. S5: Perform suspected injection attack judgment and response routing. Based on the comprehensive judgment result, user requests identified as suspected injection attacks are routed to the value fine-tuning model for processing, while normal requests continue to be served by the general inference model.

[0024] Furthermore, the method also includes: The content filtering module uses a pre-trained language model that combines BERT pre-training with keyword methods to detect illegal text content.

[0025] In this embodiment, BERT, short for Bidirectional Encoder Representation of Transformer, is based on the encoder part of the Transformer, abandoning the decoder and capturing contextual information by stacking multiple encoders (e.g., BERT-base has 12 layers, BERT-large has 24 layers). Furthermore, by utilizing the Self-Attention mechanism, each position can simultaneously focus on the entire input sequence, overcoming the limitations of traditional unidirectional models.

[0026] Specifically, the model includes an input and embedding layer. Token embeddings map words to vectors, segment embeddings distinguish different sentences within a sentence pair (e.g., using [SEP] as a separator), and position embeddings represent the positional information of words using learnable vectors. The encoder model, through a multi-head self-attention mechanism, enhances the model's ability to capture information from different subspaces. The output layer, combining the output characteristics of BERT with the requirements of the classification task, extracts effective features from the contextual representation and maps them to the classification label space.

[0027] Furthermore, the method also includes: The attack corpus contains labeled prompt word injection attack samples, and the normal corpus contains normal user interaction samples. Both corpora have undergone data cleaning and standardization. Both the prompt word generation model and the normal corpus generation model adopt a transformer architecture based on a self-attention mechanism.

[0028] Furthermore, referring to Figure 2The specific execution process of the word vector perplexity calculation module includes: S21, For the prompt word to be detected, input it into the prompt word generation model and the normal corpus generation model respectively; S22, obtain the vocabulary probability distribution matrix at the output layer of the prompt word generation model and the normal corpus generation model, wherein the dimension of the vocabulary probability distribution matrix corresponds to the product of the prompt word length and the vocabulary size; S23, calculate the conditional probability of each word based on the word probability distribution matrix, and obtain the overall perplexity value through geometric mean operation; S24, calculate the relative difference ratio of the perplexity values ​​of the prompt word generation model and the normal corpus generation model.

[0029] Furthermore, the method also includes: The semantic consistency determination module adopts a perplexity calculation strategy for sentence segmentation path and word segmentation path; The sentence segmentation path divides the target prompt word into multiple clauses based on punctuation marks, calculates the perplexity of each clause, and then obtains the overall value through geometric mean. The word segmentation path directly calculates the overall perplexity of the prompt word to be detected based on the word sequence, and finally evaluates semantic consistency by comparing the relative differences between the calculation results of the two paths.

[0030] Furthermore, the feature dimensions integrated by the comprehensive determination module of this method include: The word vector perplexity difference value is calculated by the ratio of the absolute difference in perplexity between the two models to the larger value. The statement semantic consistency difference value is calculated by the ratio of the absolute difference in perplexity between the two calculation paths to the larger value. The sentence count is obtained by counting punctuation marks; the character count is obtained by counting the number of words after word segmentation. The frequency of sensitive words is calculated based on the ratio of the number of sensitive words identified by the Naive Bayes algorithm to the total number of words. The frequency of special symbols is calculated based on the ratio of the number of matching preset symbol patterns to the total number of words.

[0031] In this embodiment, the sensitive words in the injection attack scenario can be calculated using the Naive Bayes algorithm to determine which words are considered sensitive. Commonly used sensitive words include ignore, forget, play, switch, and administrator.

[0032] Similarly, common symbols used in injection attacks include special symbols such as "<<" and "--", which can also be statistically analyzed using the Naive Bayes algorithm.

[0033] Based on the above feature data, selection algorithms are used for training and comprehensive judgment. XGBoost has advantages such as high accuracy and prevention of overfitting, so it is adopted for classification and judgment. The optimal solution / approximate optimal solution is obtained using the following formula: ; in The loss function; ; Where T is the number of leaf nodes, and is the magnitude of the leaf node vector. Indicates the difficulty of node splitting. Then it represents the L2 regularization coefficient.

[0034] When making decisions about the construction, it is represented as follows: ; w represents a one-dimensional vector of length T, which represents the weights of each leaf node in tree q.

[0035] q represents the result of a tree, and its function is to... Mapping to a certain leaf node, assuming the tree has T leaf nodes.

[0036] The following result is obtained through formula derivation: ; The first-order partial derivative of the samples contained in leaf node j is a constant; The second-order partial derivative of the samples contained in leaf node j is a constant. The final method is to find all By finding the value of , we can obtain the distribution of the decision tree.

[0037] Furthermore, the method also includes: The value fine-tuning model is obtained by supervised fine-tuning of the basic language model. The training data includes question and answer samples that conform to social norms and customs. Low-rank adaptation technique is used in the fine-tuning process. The method further includes: The system features a real-time monitoring and feedback mechanism that continuously collects user interaction data and updates the feature library. Monitoring metrics include attack detection accuracy, false alarm rate, and response latency. When any metric deviates from the preset threshold, an alert is triggered. The system supports incremental training of the judgment model based on newly collected data, with a model update cycle of no more than 24 hours.

[0038] Furthermore, the method also includes: The formula for calculating perplexity is as follows:

[0039] Where W represents a corpus, and N represents the number of tokens contained in that corpus. , which represents the probability that the model generates the sentence.

[0040] Based on the analysis of the lexical probability distribution matrix, the perplexity of the detected prompt word is calculated in both the prompt word generation model and the normal corpus generation model. Then, the difference between the two is calculated using the following formula; .

[0041] In this embodiment, the first formula for calculating the perplexity is as follows:

[0042] Here, W represents a corpus, and N represents the number of tokens contained in that corpus. , which represents the probability that the model generates the sentence.

[0043] This step requires the construction of two corpora. ,in It is a training corpus that includes all injection attacks. This is a corpus of words normally suggested by users. (Through...) The corpus was used to train LLM recognition models. , For prompt word generation models, Generate large models from normal corpora.

[0044] For a new prompt word Calculate the probability of perplexity in both models. Perplexity represents the probability of that model occurring. For an attack hint word, assume it will appear... Corpus-trained models The calculated probability will be greater. Corpus-trained models The calculated probability will be even smaller.

[0045] The probability calculation method is as follows: For the Transformer model, take The output matrix in the logits layer is ,in The dimension is l. In the corpus, the vocabulary size has a dimension of k.

[0046] Includes n words ,in In the matrix token in the first line The probability of the field. In the matrix The second line The probability of; and so on, In the matrix In the nth row The probability of.

[0047] Based on the matrix analysis above, using Formula 1, we can obtain the following results: exist Model, perplexity of the model Then, use Formula 2 to calculate the difference between the two.

[0048]

[0049] Furthermore, the method also includes: The perplexity of the detected prompt words is calculated in two ways: word and sentence. For the prompt word to be detected, it is divided into sentences according to punctuation, and the prompt word to be detected contains m short sentences. The perplexity level is calculated for each short sentence separately. , ,... The overall level of confusion is given by the following formula: ; For the prompt word to be detected, it is segmented into words according to characters. The prompt word to be detected includes n words. The perplexity is calculated using the following formula: ; Finally, the difference between the two is calculated as follows: .

[0050] In this embodiment, the model is continued to be used. Perform a consistency check on the statements. For prompt words... For statement f, the perplexity is calculated in two ways: word and sentence. Because there are obvious differences in context between different sentences, the perplexity of the two methods differs greatly. Method 1: For prompt words, divide sentences according to punctuation (commas, periods, semicolons, etc.). Contains m short sentences The perplexity level is calculated for each short sentence separately. , ,... The overall level of confusion is as shown in Formula 3.

[0051] Method two: For prompt words, segment them according to their characters. Includes n words The perplexity is calculated using Formula 4.

[0052] Finally, calculate the difference between the two, see Formula 5.

[0053] According to a second embodiment of the present invention, referring to Figure 3 This invention claims protection for a content security protection device based on semantic consistency, comprising: The content filtering module directly filters and intercepts input and output content, using a pre-trained language model combined with a keyword matching mechanism to identify and block explicit violations. The word vector perplexity calculation module calculates the perplexity difference of the input prompt word to be detected between different language models. By constructing an attack corpus and a normal corpus, the prompt word generation model and the normal corpus generation model are trained respectively, and the rationality of the generated prompt word is quantified based on the probability distribution characteristics. The sentence semantic consistency determination module calculates the degree of semantic coherence of the input prompt words before and after them, and evaluates the logical consistency of the sentence structure by comparing and analyzing the perplexity at the sentence level and the perplexity at the word level. The comprehensive judgment module integrates multi-dimensional feature data to identify user input risks. The comprehensive judgment module integrates features such as word vector perplexity difference value, sentence semantic consistency difference value, sentence number statistics value, character number statistics value, frequency of occurrence of sensitive words, and frequency of use of special symbols, and uses machine learning algorithms to make the final classification judgment to obtain the comprehensive judgment result. The value fine-tuning model receives and executes suspected injection attack judgment and response routing. Based on the comprehensive judgment result, user requests identified as suspected injection attacks are routed to the destination, while normal requests continue to be served by the general inference model. The semantically consistent content security protection device is used to execute the semantically consistent content security protection method.

[0054] In the several embodiments provided in this application, it should be understood that the disclosed systems, apparatuses, and methods can be implemented in other ways. For example, the apparatus embodiments described above are merely illustrative; for instance, the division of units is only a logical functional division, and in actual implementation, there may be other division methods. For example, multiple units or components may be combined or integrated into another system, or some features may be ignored or not executed. Furthermore, the coupling or direct coupling or communication connection shown or discussed may be through some interfaces, or indirect coupling or communication connection between apparatuses or units, and may be electrical, mechanical, or other forms.

[0055] Furthermore, the functional units in the various embodiments of this application can be integrated into one processing unit, or each unit can exist physically separately, or two or more units can be integrated into one unit. The integrated units described above can be implemented in hardware or as software functional units. The above are merely embodiments of this application and do not limit the patent scope of this application. Any equivalent structural or procedural transformations made based on the description and drawings of this application, or direct or indirect applications in other related technical fields, are similarly included within the patent protection scope of this application.

[0056] The specific embodiments of the invention have been described in detail above, but they are only examples, and this application is not limited to the specific embodiments described above. For those skilled in the art, any equivalent modifications or substitutions to the invention are also within the scope of this application. Therefore, all equivalent changes, modifications, and improvements made without departing from the spirit and principles of this application should be covered within the scope of this application.

Claims

1. A content security protection method based on semantic consistency, characterized in that, include: S1: The input and output content is directly filtered and intercepted through the content filtering module. The content filtering module uses a pre-trained language model combined with a keyword matching mechanism to identify and block explicit illegal text. S2: Using the word vector perplexity calculation module, the perplexity difference of the input prompt word to be detected is calculated between different language models. The word vector perplexity calculation module trains the prompt word generation model and the normal corpus generation model by constructing an attack corpus and a normal corpus, respectively, and quantifies the rationality of the generated prompt word based on the probability distribution characteristics. S3: Using the sentence semantic consistency determination module, calculate the degree of semantic coherence of the input prompt word before and after. The sentence semantic consistency determination module evaluates the logical consistency of the sentence structure by comparing and analyzing the perplexity at the sentence level and the perplexity at the word level. S4: Through the comprehensive judgment module, multi-dimensional feature data is integrated to identify user input risks. The comprehensive judgment module integrates word vector perplexity difference value, sentence semantic consistency difference value, sentence number statistics value, character number statistics value, frequency of occurrence of sensitive words, and frequency of use of special symbols. Machine learning algorithms are used to make the final classification judgment to obtain the comprehensive judgment result. S5: Perform suspected injection attack judgment and response routing. Based on the comprehensive judgment result, user requests identified as suspected injection attacks are routed to the value fine-tuning model for processing, while normal requests continue to be served by the general inference model.

2. The content security protection method based on semantic consistency according to claim 1, characterized in that, Also includes: The content filtering module uses a pre-trained language model that combines BERT pre-training with keyword methods to detect illegal text content.

3. The content security protection method based on semantic consistency according to claim 1, characterized in that, Also includes: The attack corpus contains labeled prompt word injection attack samples, and the normal corpus contains normal user interaction samples. Both corpora have undergone data cleaning and standardization. Both the prompt word generation model and the normal corpus generation model adopt a transformer architecture based on a self-attention mechanism.

4. The content security protection method based on semantic consistency according to claim 1, characterized in that, The specific execution process of the word vector perplexity calculation module includes: S21, For the prompt word to be detected, input it into the prompt word generation model and the normal corpus generation model respectively; S22, obtain the vocabulary probability distribution matrix at the output layer of the prompt word generation model and the normal corpus generation model, wherein the dimension of the vocabulary probability distribution matrix corresponds to the product of the prompt word length and the vocabulary size; S23, calculate the conditional probability of each word based on the word probability distribution matrix, and obtain the overall perplexity value through geometric mean operation; S24, calculate the relative difference ratio of the perplexity values ​​of the prompt word generation model and the normal corpus generation model.

5. A content security protection method based on semantic consistency according to claim 1, characterized in that, Also includes: The semantic consistency determination module adopts a perplexity calculation strategy for sentence segmentation path and word segmentation path; The sentence segmentation path divides the target prompt word into multiple clauses based on punctuation marks, calculates the perplexity of each clause, and then obtains the overall value through geometric mean. The word segmentation path directly calculates the overall perplexity of the prompt word to be detected based on the word sequence, and finally evaluates semantic consistency by comparing the relative differences between the calculation results of the two paths.

6. A content security protection method based on semantic consistency according to claim 1, characterized in that, The feature dimensions integrated by the comprehensive judgment module include: The word vector perplexity difference value is calculated by the ratio of the absolute difference in perplexity between the two models to the larger value. The statement semantic consistency difference value is calculated by the ratio of the absolute difference in perplexity between the two calculation paths to the larger value. The sentence count is obtained by counting punctuation marks; the character count is obtained by counting the number of words after word segmentation. The frequency of sensitive words is calculated based on the ratio of the number of sensitive words identified by the Naive Bayes algorithm to the total number of words. The frequency of special symbols is calculated based on the ratio of the number of matching preset symbol patterns to the total number of words.

7. A content security protection method based on semantic consistency according to claim 1, characterized in that, Also includes: The value-based fine-tuning model is obtained by supervised fine-tuning of the basic language model. The training data includes question-and-answer samples that conform to social norms and customs. Low-rank adaptation techniques are used in the fine-tuning process. The method further includes: The system features a real-time monitoring and feedback mechanism that continuously collects user interaction data and updates the feature library. Monitoring metrics include attack detection accuracy, false alarm rate, and response latency. When any metric deviates from the preset threshold, an alert is triggered. The system supports incremental training of the judgment model based on newly collected data, with a model update cycle of no more than 24 hours.

8. A content security protection method based on semantic consistency according to claim 4, characterized in that, Also includes: The formula for calculating perplexity is as follows: Where W represents a corpus, and N represents the number of tokens contained in that corpus. , representing the probability that the model generates this sentence; Based on the analysis of the lexical probability distribution matrix, the perplexity of the detected prompt word is calculated in both the prompt word generation model and the normal corpus generation model. Then, the difference between the two is calculated using the following formula; 。 9. A content security protection method based on semantic consistency according to claim 5, characterized in that, Also includes: The perplexity of the detected prompt words is calculated in two ways: word and sentence. For the prompt word to be detected, it is divided into sentences according to punctuation, and the prompt word to be detected contains m short sentences. The perplexity level is calculated for each short sentence separately. , ,... The overall level of confusion is given by the following formula: ； For the prompt word to be detected, it is segmented into words according to characters. The prompt word to be detected includes n words. The perplexity is calculated using the following formula: ； Finally, the difference between the two is calculated as follows: 。 10. A content security protection device based on semantic consistency, characterized in that, include: The content filtering module directly filters and intercepts input and output content, using a pre-trained language model combined with a keyword matching mechanism to identify and block explicit violations. The word vector perplexity calculation module calculates the perplexity difference of the input prompt word to be detected between different language models. By constructing an attack corpus and a normal corpus, the prompt word generation model and the normal corpus generation model are trained respectively, and the rationality of the generated prompt word is quantified based on the probability distribution characteristics. The sentence semantic consistency determination module calculates the degree of semantic coherence of the input prompt words before and after them, and evaluates the logical consistency of the sentence structure by comparing and analyzing the perplexity at the sentence level and the perplexity at the word level. The comprehensive judgment module integrates multi-dimensional feature data to identify user input risks. The comprehensive judgment module integrates features such as word vector perplexity difference value, sentence semantic consistency difference value, sentence number statistics value, character number statistics value, frequency of occurrence of sensitive words, and frequency of use of special symbols, and uses machine learning algorithms to make the final classification judgment to obtain the comprehensive judgment result. The value fine-tuning model receives and executes suspected injection attack judgment and response routing. Based on the comprehensive judgment result, user requests identified as suspected injection attacks are routed to the destination, while normal requests continue to be served by the general inference model. The semantically consistent content security protection device is used to execute the semantically consistent content security protection method as described in any one of claims 1-9.

Images