Model reasoning method and device based on knowledge prohibition, equipment and storage medium

Abstract

The invention provides a model reasoning method, device and equipment based on knowledge prohibition and a storage medium, relates to the technical field of data processing, in particular to the fields of large language models, content security, compliance management and the like, and can be used for application scenes such as controllable text generation and the like. According to the specific scheme, in response to user input, one or more forbidding rules and forbidding strength corresponding to each forbidding rule are determined; calling at least one corresponding pluggable forbidding module from a preset module library according to the forbidding rule; according to the forbidding strength, the pluggable forbidding module is loaded to the trunk model, and a model instance used for the current reasoning task is formed; and reasoning by using the model instance to obtain a reasoning result corresponding to the user input. According to the scheme, a pluggable forbidding module and a forbidding strength and priority superposition rule are adopted, harmful knowledge and sensitive information in a large language model are efficiently and controllably cleared from the parameter level, and modularization, refinement and rapid switching according to scenes of security policies are achieved.

Description

Technical Field

[0001] This disclosure relates to the field of data processing technology, particularly to the fields of large language models, content security and compliance governance, and can be used in application scenarios such as controllable text generation. Specifically, it relates to model reasoning methods, devices, equipment and storage media based on knowledge prohibition. Background Technology

[0002] With the widespread use of large-scale language models in various applications, the content generated by these models may contain harmful information or outdated erroneous knowledge. Existing technologies primarily control this through four methods: First, external security mechanisms utilize sensitive word matching, rule systems, content moderation models, or reward models to detect and filter output results during the inference phase. Second, deleting or replacing training data containing harmful knowledge and then retraining the entire dataset or performing large-scale fine-tuning on cleaned data weakens or even covers the original sensitive information at the parameter level. Third, alignment techniques leverage preference data and reward signals to enhance the ranking weights for security, thereby prioritizing the output of compliant content in the generation distribution. Fourth, machine forgetting methods use parameter perturbation, adversarial training, or special optimization strategies to allow the model to forget specific knowledge as much as possible without full training. Summary of the Invention

[0003] This disclosure provides a method, apparatus, device, and storage medium for model reasoning based on knowledge prohibition.

[0004] According to a first aspect of this disclosure, a model reasoning method based on knowledge prohibition is provided, comprising: in response to user input, determining one or more prohibition rules and a prohibition strength corresponding to each prohibition rule; according to the prohibition rules, calling at least one corresponding pluggable prohibition module from a preset module library; the module library includes at least one pluggable prohibition module, the pluggable prohibition module being configured to forget the knowledge corresponding to the prohibition rule; according to the prohibition strength, loading the pluggable prohibition module into the backbone model to form a model instance for the current reasoning task; and using the model instance to perform reasoning to obtain a reasoning result corresponding to the user input.

[0005] According to a second aspect of this disclosure, a model reasoning apparatus based on knowledge prohibition is provided, comprising: an input parsing module, configured to determine one or more prohibition rules and a prohibition strength corresponding to each prohibition rule in response to user input; a forgetting invocation module, configured to invoke at least one corresponding pluggable prohibition module from a preset module library according to the prohibition rules; the module library includes at least one pluggable prohibition module, the pluggable prohibition module being configured to forget the knowledge corresponding to the prohibition rule; an instance construction module, configured to load the pluggable prohibition module into a backbone model according to the prohibition strength, forming a model instance for the current reasoning task; and a model reasoning module, configured to perform reasoning using the model instance to obtain a reasoning result corresponding to the user input.

[0006] According to a third aspect of this disclosure, an electronic device is provided, comprising: at least one processor; and a memory communicatively connected to the at least one processor; wherein the memory stores instructions executable by the at least one processor, the instructions being executed by the at least one processor to enable the at least one processor to perform any of the methods described in the embodiments of this disclosure.

[0007] According to a fourth aspect of this disclosure, a non-transitory computer-readable storage medium is provided storing computer instructions, wherein the computer instructions are used to cause the computer to perform any of the methods according to embodiments of this disclosure.

[0008] According to a fifth aspect of this disclosure, a computer program product is provided, including a computer program that, when executed by a processor, implements any of the methods according to embodiments of this disclosure.

[0009] The scheme disclosed herein employs pluggable prohibition modules and rules for superimposing prohibition strength and priority to efficiently and controllably remove harmful knowledge and sensitive information from large language models at the parameter level, thereby achieving modularization, refinement, and rapid switching of security policies according to scenarios.

[0010] It should be understood that the description in this section is not intended to identify key or essential features of the embodiments of this disclosure, nor is it intended to limit the scope of this disclosure. Other features of this disclosure will become readily apparent from the following description. Attached Figure Description

[0011] The accompanying drawings are provided to better understand this solution and do not constitute a limitation of this disclosure. Wherein: Figure 1 This is a flowchart illustrating the model reasoning method based on knowledge prohibition according to an embodiment of this disclosure; Figure 2 This is a schematic diagram of the structure of a model reasoning device based on knowledge prohibition according to an embodiment of this disclosure; Figure 3This is a schematic diagram of a scenario for a model reasoning method based on knowledge prohibition, according to an embodiment of this disclosure. Figure 4 This is a structural diagram of an electronic device used to implement the knowledge prohibition-based model reasoning method of the present disclosure embodiments. Detailed Implementation

[0012] The exemplary embodiments of this disclosure are described below with reference to the accompanying drawings, including various details of the embodiments to aid understanding, and should be considered merely exemplary. Therefore, those skilled in the art will recognize that various changes and modifications can be made to the embodiments described herein without departing from the scope of this disclosure. Similarly, for clarity and brevity, descriptions of well-known functions and structures are omitted in the following description.

[0013] Before introducing the technical solutions of the embodiments of this disclosure, let's further explain the technical terms that may be used in this disclosure: Knowledge prohibition refers to the portion of knowledge that, under specific times and scenarios, laws, regulations, regulatory policies, or business rules explicitly require should no longer be retained, accessed, or output within the model. Knowledge prohibition emphasizes the removal, sealing, or even forgetting of certain knowledge from the model's internal knowledge base, rather than merely controlling surface output. Harmful knowledge refers to content that, under current regulations and security requirements, is considered unsuitable for output or dissemination by the model, including but not limited to illegal or non-compliant content, privacy or sensitive personal information, detailed operating methods that could pose real risks, and knowledge that is incorrect, outdated, or potentially misleading to users due to policy or time changes.

[0014] In related technologies, mechanisms based on external filtering or security nets still retain sensitive knowledge within the model. If rules are bypassed or audits fail to detect this, harmful information may still be leaked. Furthermore, continuous manual maintenance of the rule base is required, making it difficult to cover complex and ever-changing attacks and topics. Mechanisms based on full retraining or large-scale fine-tuning are extremely costly in terms of computing power and time, making it difficult to keep up with frequent changes in policies and business rules. They are also prone to catastrophic forgetting, impairing model performance in other domains, and are difficult to roll back after training, lacking flexible and reversible modular management capabilities. Meanwhile, mechanisms based on alignment training do not truly eliminate harmful knowledge from the parameters; under high-temperature or random sampling, existing dangerous content may still be sampled, posing a probabilistic security risk of failure. Preliminary research on machine forgetting is mostly still in the experimental stage, easily damaging other model capabilities, lacking sophisticated retention mechanisms, and having low integration with pipelines. Overall, existing solutions still fall short of meeting practical requirements for security and rapid response in terms of cost, efficiency, forgetting accuracy, protection of general capabilities, and modular and traceable management of strategies.

[0015] In order to at least partially solve one or more of the above-mentioned problems and other potential problems, this disclosure proposes a model reasoning method based on knowledge prohibition. It adopts pluggable prohibition modules and rules for superimposing prohibition strength and priority to efficiently and controllably remove harmful knowledge and sensitive information from large language models at the parameter level, thereby realizing the modularization, refinement and rapid switching of security policies according to scenarios.

[0016] This disclosure provides a model reasoning method based on knowledge prohibition. Figure 1 This is a flowchart illustrating a knowledge-prohibition-based model inference method according to an embodiment of the present disclosure. This knowledge-prohibition-based model inference method can be applied to a knowledge-prohibition-based model inference device. The knowledge-prohibition-based model inference device is located in an electronic device. The electronic device includes, but is not limited to, fixed devices and / or mobile devices. For example, fixed devices include, but are not limited to, servers, which can be cloud servers or ordinary servers. Mobile devices include, but are not limited to, controllable text generation devices, which can be mobile phones, tablets, etc. In some possible implementations, the knowledge-prohibition-based model inference method can also be implemented by a processor calling computer-readable instructions stored in memory. Figure 1 As shown, this knowledge-forbidden model reasoning method includes: S101. In response to user input, determine one or more prohibition rules and the prohibition strength corresponding to each prohibition rule.

[0017] S102. According to the prohibition rules, call at least one corresponding pluggable prohibited module from the preset module library.

[0018] S103. Based on the prohibition strength, load the pluggable prohibition module into the backbone model to form a model instance for the current inference task.

[0019] S104. Use model instances to perform reasoning and obtain reasoning results corresponding to user input.

[0020] Here, user input refers to the original request content submitted to the large model by the end user or the upper-layer business system. In this embodiment of the disclosure, user input can be natural language questions, instructions, dialogue context, or structured data containing task intent and scenario information.

[0021] Here, prohibition rules refer to predefined compliance constraints for specific knowledge or content types within the model. They describe which knowledge points, topic categories, or time periods should be prohibited from being called or output in the current request scenario. For example, prohibition rules could be "prohibit the output of a certain type of drug formula" or "prohibit the output of a certain legal text content before a certain point in time." Prohibition strength refers to a quantitative parameter corresponding to each prohibition rule, which can be used to characterize the strictness and effectiveness of the rule in the current inference task. For example, prohibition strength can be different levels such as "complete prohibition," "strong suppression," and "weak suppression," with each level corresponding to a prohibition strength parameter. Alternatively, a prohibition strength parameter value can be directly set for each prohibition rule.

[0022] In this embodiment, after receiving user input, the input is first parsed and the scenario is identified. Combining contextual information such as user identifier, business type, location, and current effective time, one or more prohibition rules related to the request are automatically retrieved from a pre-configured set of compliance policies. During the retrieval process, corresponding entries can be matched based on features such as the topic, entity, and time range involved in the input. Subsequently, for each matched prohibition rule, a corresponding prohibition strength value can be assigned according to a preset policy, thereby determining the prohibition rule and its prohibition strength. For example, the preset policy may include regulatory level, violation risk level, explicit configuration on the business side, or parameters passed in from the upper-layer application.

[0023] Here, the module library refers to a pre-built and stored collection of modular model components, including at least one pluggable prohibition module. Each pluggable prohibition module is decoupled from the backbone model, and each module is typically designed and trained for a specific type of single prohibition rule or a specific knowledge scope. A pluggable prohibition module is a functional sub-module selected from the module library that can be loaded onto the backbone model on demand before or during inference. The parameters and / or structure of the pluggable prohibition module are specifically configured to mask or effectively forget the knowledge related to its corresponding prohibition rule.

[0024] In this embodiment, each prohibition rule is first matched against metadata in the module library. Based on a predefined mapping relationship or indexing mechanism, one or more pluggable prohibition modules corresponding to the rule are retrieved. For example, the retrieved pluggable prohibition modules can be pre-trained modules targeting a specific sensitive area, a specific time period, or a specific legal provision. Specifically, when multiple prohibition rules exist, corresponding prohibition modules can be selected for each rule to form a list of modules to be loaded. During this process, the module library provides not only module ontology parameters but also metadata such as module applicability, version information, and effective date. Finally, at least one pluggable prohibition module to be invoked can be determined based on the matching results.

[0025] Here, the backbone model refers to the large language model ontology that serves as the basic carrier of reasoning capabilities in the reasoning system. It has undergone pre-training and necessary alignment training, but does not contain any additional prohibition modules related to specific prohibition rules. It is a relatively stable and general-purpose basic model. A model instance refers to a specific model configuration instance that is based on the backbone model and temporarily loaded and superimposed with corresponding pluggable prohibition modules according to the required prohibition rules and prohibition strength. It is used only for this reasoning task.

[0026] In this embodiment, the backbone model parameters matching the current task can be loaded first. Then, according to a pre-designed module insertion mechanism, the selected prohibited modules are injected into the corresponding positions of the backbone model in a pluggable manner. Specifically, during the injection process, the modules can be configured according to the prohibition strength corresponding to each prohibited module, thereby determining the degree of influence of each module on the inference computation. After the configuration is completed, a model instance that is only valid within the current inference session can be generated.

[0027] Here, the inference result refers to the final response content output after calculating the user input using a model instance loaded with the prohibition module. In this embodiment of the disclosure, the inference result can be natural language text, structured results, decision suggestions, or other forms of model output, and has been constrained by prohibition rules and prohibition strength during the inference process. That is, while ensuring the completion of the task, the presentation of harmful or prohibited knowledge corresponding to the prohibition rules is effectively avoided or suppressed.

[0028] In this embodiment, user input can first be used as the input sequence or feature vector of the model instance. Forward propagation and decoding are then performed according to the standard large-scale model inference process. In the computation of each layer, the backbone model parameters and the loaded prohibition module parameters jointly participate in representation transformation and feature extraction. The prohibition module, through its designed structure and configured prohibition strength, intervenes in, weakens, or reconstructs the internal representation involving prohibited knowledge. Finally, an output sequence is generated, forming a response to the user input. In particular, due to the dynamic control role of the prohibition module during the inference process, the model instance, while maintaining general understanding and generation capabilities, can significantly reduce or avoid falling into the knowledge scope covered by prohibition rules at the output level.

[0029] The technical solution of this disclosure, by dynamically parsing user input, determining prohibition rules and prohibition strength during the inference stage, and loading pluggable prohibition modules on demand based on a module library, combines these modules with the backbone model to generate model instances for specific tasks, and then uses these instances to complete the inference output. This decouples the knowledge prohibition strategy from the capabilities of the basic model, transforming the control of harmful or prohibited knowledge into the on-demand loading of manageable prohibition modules. This not only significantly reduces the training costs and response latency caused by frequent changes in regulations or business rules, but also achieves fine control over the degree of knowledge suppression in different scenarios through the adjustability of prohibition strength. At the same time, it avoids causing widespread damage to the overall capabilities of the backbone model, supports the modularization, rollback, and auditable management of security policies, and comprehensively improves the security, flexibility, and maintainability of large-scale language models in dynamic and highly compliant environments.

[0030] In some embodiments, in response to user input, determining one or more prohibition rules and the prohibition strength corresponding to each prohibition rule includes: obtaining a query term input by the user; parsing the query term and determining the prohibition rule triggered by the parsing result; performing intent recognition on the query term and determining the risk level corresponding to the query term; and determining the prohibition strength according to the risk level and a predefined mapping relationship between risk level and prohibition strength.

[0031] Here, query terms refer to the text content obtained from user input that drives this retrieval or generation task. It can be a whole natural language question directly entered by the user, or core keywords or standardized query expressions extracted based on the context of the dialogue.

[0032] In this embodiment, the system first receives natural language text, accompanying context, and possible structured parameters from the original input. Preprocessing is then performed, such as encoding conversion, removal of irrelevant control characters, language detection, and word segmentation. Combined with the dialogue context and session state, the core query content that truly needs to be fed into the model in the current round is determined and extracted as query terms. Specifically, in certain scenarios, the query terms can also be standardized, for example, converting colloquial expressions into standard questions or condensing multi-turn information into explicit query expressions.

[0033] In this embodiment, the query terms can first be comprehensively analyzed, including keyword extraction, entity recognition, topic classification, and time and location element recognition, to construct a structured representation of the query terms. Subsequently, the analyzed features can be matched against a pre-configured prohibition rule base. The prohibition rule base records triggering conditions such as topics, specific knowledge scopes, restricted time periods, or corresponding clauses. When the analysis result contains the triggering condition of a rule, it is determined that the rule has been triggered.

[0034] Here, intent recognition refers to the process of semantically understanding and classifying query terms to determine the user's true purpose or task type, such as distinguishing between "general knowledge inquiry," "academic discussion," and "high-risk operation request," and mapping query terms to several predefined intent categories through models or rules. Risk level refers to the result of a graded assessment of the potential security, compliance, or business risks posed by the query after intent recognition and related analysis.

[0035] In this embodiment, the query term and its parsed features can be input into an intent recognition model. This model can be a multi-classification model based on machine learning or deep learning, or a hybrid system combining rules and models. Subsequently, the model comprehensively considers semantic clues, sentence patterns, contextual relationships, user attributes, and historical behavior information in the query term to determine whether the user is seeking normal learning or general knowledge, or attempting to obtain high-risk operating methods or guidance for illegal purposes, thereby classifying the intent into a predefined intent category. Based on this, different intent categories can be mapped to corresponding risk levels according to a security strategy. For example, general science popularization queries are labeled as low risk, ambiguous queries that may have sensitive tendencies are labeled as medium risk, and queries that clearly involve illegal activities or serious harm are labeled as high risk or extremely high risk. Finally, a comprehensive risk level label is generated for the current query term.

[0036] Here, the predefined mapping relationship between risk level and prohibition intensity refers to the pre-configured rules or mapping table that maps different risk levels to different prohibition intensity values. The mapping relationship can be configured to specify that low risk corresponds to weak prohibition or prohibition intensity parameter 0.1, medium risk corresponds to medium prohibition intensity or prohibition intensity parameter 0.5, high risk or very high risk corresponds to strong prohibition or prohibition intensity parameter 1, etc., so that automatic and reproducible conversion can be performed when determining the prohibition intensity.

[0037] In this embodiment, a pre-configured table or function showing the mapping relationship between predefined risk levels and prohibition strengths can be consulted. This mapping relationship is pre-defined by the security policy maker based on regulatory requirements, business tolerance, and historical data. Specifically, when multiple prohibited rules or various risk signals exist, strategies such as taking the highest risk level, weighted fusion, or rule priority can be used to calculate the final applicable risk level. Then, the prohibition strength value of each prohibition rule is derived based on the mapping relationship, and these strengths are passed as parameters to subsequent module loading and inference processes, achieving automated and quantitative control of the prohibition intensity.

[0038] Thus, by combining parsing-triggered prohibition rules with risk levels based on intent recognition, and leveraging predefined mapping relationships, abstract security risk assessments are transformed into quantifiable prohibition strength parameters, achieving refined and dynamic control over knowledge prohibition. For the same type of prohibition rule, the prohibition strength can be automatically adjusted according to different user intents and contextual risk levels, avoiding one-size-fits-all over-blocking, thereby preserving the model's normal response capabilities and user experience to the greatest extent possible while ensuring security and compliance. By explicitly configuring security policies at the system level through predefined mapping relationships, the overall security, flexibility, and maintainability are improved when dealing with complex and changing requests.

[0039] In some embodiments, in response to user input, determining one or more prohibition rules and the prohibition strength corresponding to each prohibition rule further includes: obtaining request metadata; determining a corresponding general prohibition rule based on the request metadata; and adding the general prohibition rule to the prohibition rules.

[0040] Here, request metadata refers to structured information related to this user request, used to describe the external environment and attributes of the request. It includes at least the region and time of request initiation, and can also be expanded to include the user's industry, account type, business line, terminal type, etc., as needed, to reflect the scope of applicable laws and regulations, timeliness requirements and business context of the request.

[0041] In this embodiment of the disclosure, while receiving user input, metadata information related to the request can be collected from the communication session, authentication system, and business gateway. For example, at least the originating region and time of the request can be parsed from the metadata information. Specifically, extended metadata such as user type, affiliated organization, and business scenario identifier can also be additionally obtained, and this information can be uniformly encapsulated into a structured request metadata object for subsequent prohibition rule decisions.

[0042] Here, a general prohibition rule refers to a prohibition rule that should take effect based solely on the region, time, or other global attributes of the request, without relying on the semantics of the specific query terms. It may include a complete ban on the output of specific categories of content in a certain region, or a ban on the dissemination of certain knowledge points from a certain effective date under a certain law. It applies to all requests initiated under the corresponding conditions.

[0043] In this embodiment, the initiating region and initiation time can first be matched with a pre-configured general prohibition rule base. This general prohibition rule base records general compliance requirements that must be executed or prioritized for execution in various regions and time periods. Subsequently, all general prohibition rules applicable to the request initiating region can be filtered out, and rules that have been in effect and have not yet expired before that time can be filtered out based on the request initiation time. Specifically, for general rules configured with user type, business line, and other conditions, further conditional judgments can be made on other fields in the metadata, retaining only the general prohibition rules that should be in effect under the current request metadata conditions, thereby forming a set of general prohibition rules for this request.

[0044] In this embodiment, a set of general prohibition rules determined for this request can be obtained, and the two can be merged. Specifically, duplicate rules can be deduplicated based on rule identifiers, and the priority or prohibition strength configurations that the same rule may have under different sources can be uniformly coordinated. The merged result forms a complete list of prohibition rules, which includes both specific prohibition rules triggered by the semantics of the query content itself and general prohibition rules.

[0045] Thus, by further introducing request metadata and general prohibition rules, the determination of the scope of knowledge prohibition no longer relies solely on the user input content itself, but also comprehensively considers the external compliance environment, achieving dual-dimensional security control from content sensitivity to scenario compliance. This ensures that the corresponding general prohibition rules are automatically activated based on request metadata, thereby avoiding omissions. Simultaneously, abstracting the general prohibition rules separately and automatically overlaying them through metadata mapping helps decouple regional and time-sensitive compliance requirements from specific business logic. Only the general rule base needs to be maintained without modifying the model ontology and business code, ensuring compliance consistency and timely response of the large model across regions and time periods.

[0046] In some embodiments, the pluggable prohibition module is pre-built by: obtaining a set of prohibition rules; training the parameter fine-tuning module based on the backbone model, according to the prohibition rules and the sample set corresponding to the prohibition rules, to obtain the pluggable prohibition module corresponding to the prohibition rules; associating the pluggable prohibition module, the prohibition rules and the corresponding version information, and storing them in the module library.

[0047] Here, the prohibition rule set refers to a pre-compiled set containing multiple prohibition rules and their corresponding training resources, prepared before constructing the pluggable prohibition module. It includes at least one prohibition rule and a sample set corresponding to each prohibition rule. Each prohibition rule describes the scope of knowledge that the model needs to forget or suppress, and the corresponding sample set is a training dataset built around the knowledge covered by that rule. This dataset may include negative samples that the model should no longer provide, as well as contrast or preference samples, used to impose targeted constraints on the model's behavior during subsequent fine-tuning stages.

[0048] In this embodiment, the security policy maker, compliance team, or business entity can first define the knowledge points that need to be prohibited or suppressed at the model level based on current laws, regulations, industry standards, and internal policies. These requirements are then organized into structured prohibition rule entries, with each rule clearly defining its scope and degree of prohibition. Subsequently, for each prohibition rule, a corresponding sample set can be constructed and labeled. These samples can come from segments marked as to be forgotten in the original training data, artificially synthesized question-answer pairs, risky answers selected from dialogue logs, etc., and are labeled according to the rule requirements. Finally, each prohibition rule and its sample set can be collected uniformly to form a prohibition rule set, providing a unified data entry point for subsequent training processes.

[0049] Here, the parameter fine-tuning module refers to the parameter sub-module introduced on the basis of the backbone model, which can be trained and loaded independently. It can be a lightweight fine-tuning structure such as Low-Rank Adaptation (LoRA). By adding or redirecting some parameters, it can adjust the output distribution of the model on specific knowledge, thereby realizing the ability to locally forget a certain prohibition rule.

[0050] In this embodiment, after selecting a specific prohibition rule and its sample set, the backbone model parameters are loaded, and a parameter fine-tuning module is initialized for the rule. For example, LoRA or adapter structures are inserted into several Transformer layers, and only these newly added parameters are made trainable, while the backbone model parameters are frozen or remain essentially unchanged. Subsequently, the parameter fine-tuning module is optimized according to a preset training objective using the sample set corresponding to the rule as training data. Furthermore, during training, only the parameters in the fine-tuning module can be updated, thereby achieving suppression or forgetting of target knowledge when used in combination.

[0051] Here, version information refers to the identifier and metadata associated with both the prohibition rule and the pluggable prohibition module. In this embodiment, version information can be used to record information such as the version number, creation or training time, effective or invalidation time, applicable region, training data source, and algorithm configuration of the prohibition rule or pluggable prohibition module, facilitating subsequent upgrades, rollbacks, and traceability. In particular, the same prohibition rule can generate multiple versions after iterative optimization, corresponding to multiple fine-tuning modules and version records.

[0052] In this embodiment, after completing the training of a fine-tuning module for a specific prohibition rule, a version information record can be assigned or updated for the rule and module. This record includes metadata such as rule number, module number, version number, effective or expiration time, applicable region, and business scope. Then, an index entry can be created or updated for the prohibition rule, associating and storing the rule's logical description, version information, and corresponding pluggable prohibition module parameter files and structural definitions. Specifically, for multiple iterations of training the same prohibition rule, version information can be used to distinguish different versions of the prohibition module, and configuration of the current default version and historical version retention strategies is supported.

[0053] Thus, by combining the set of prohibition rules with the sample set, abstract requirements are transformed into trainable data constraints. Leveraging the lightweight structure of the parameter fine-tuning module, a pluggable prohibition module is trained for each prohibition rule without altering the parameters of the main model. This enables the forgetting or suppression of specific knowledge, avoiding the high cost and catastrophic forgetting risk of full retraining, while preserving the general capabilities of the main model. Furthermore, by linking prohibition rules and prohibition modules with version information, a rollback-capable and iteratively optimizeable knowledge prohibition management system is constructed. This ensures that each policy update and module training has a clear version record and effective scope, facilitating rapid switching or upgrading of corresponding modules when regulations and business rules change.

[0054] In some embodiments, obtaining a set of prohibited rules includes: obtaining rule text; parsing the rule clauses in the rule text and generating at least one prohibited rule according to a preset rule template; and constructing a sample set based on the rule text and the prohibited rules.

[0055] Here, rule text refers to natural language or structured text materials used to constrain or guide the output behavior of the model. It can be directly derived from user-input prohibitions, or it can be derived from documents such as laws and regulations, regulatory policies, industry standards, internal rules and regulations of enterprises, and business operation specifications stored in certain databases. It is the original basis and source for constructing prohibition rules.

[0056] In this embodiment of the disclosure, raw text data related to content security and compliance can be collected from multiple channels. For example, it can receive rule descriptions directly input by users or administrators through an interface or uploaded files, or it can automatically retrieve or periodically synchronize the latest provisions, notices, and documents from pre-connected data sources such as regulatory databases, policy document libraries, and enterprise rule libraries. Furthermore, during the acquisition process, these raw texts can undergo basic preprocessing and be categorized and labeled according to information such as document type, source, and effective date to form a set of rule texts.

[0057] Here, a rule clause refers to a specific entry or phrase in the rule text that can be independently identified and has a relatively complete normative meaning. In this embodiment of the disclosure, a rule clause may include a legal provision, a policy regulation, or a corporate system containing explicit prohibitions or restrictions. Each rule clause typically corresponds to a specific type of prohibited obligation or scope of constraint. The preset rule template refers to a set of templates pre-designed to structure natural language rule clauses into a machine-processable prohibition rule format. In this embodiment of the disclosure, each rule template defines the key fields and structure that the rule should include, such as the prohibited content type, applicable field, time range, applicable region, target scope, and degree of prohibition, so that rule clauses from different sources and with different expressions can be abstracted into a unified format of prohibition rules, facilitating subsequent automated processing and training.

[0058] In this embodiment, natural language processing technology can first be used to segment and structurally identify the text. Based on information such as document numbering, headings, and clause markers, the text is broken down into appropriately granular rule clause units. Subsequently, semantic analysis can be performed on each rule clause to identify prohibited or restrictive expressions and extract key elements, including the restricted content type or behavior, applicable subject, applicable scenario, geographical scope, effective and expiration time, and degree of prohibition. Based on this, a preset rule template that best matches the semantics of the clause can be selected, and the extracted elements can be filled into the fields defined in the template to generate a structured prohibition rule object. In particular, a complex rule clause may be broken down into multiple prohibition rules covering different details.

[0059] In this embodiment, a training sample set can be constructed using each prohibition rule as the core, combined with its corresponding rule text content and business background. Specifically, based on the prohibition scope specified in the rule, questions and answers directly related to or highly similar to the prohibited content can be extracted from historical dialogue data, open corpora, and relevant domain documents. Outputs that violate the rule are marked as negative samples that should be suppressed or forgotten. At the same time, alternative safe answers that meet the rule requirements are designed or collected and marked as positive samples. In particular, for scenarios requiring preference training, violating and compliant answers under the same query can be paired into preference samples, and it can be marked which one should be prioritized by the model. Furthermore, synthetic question-and-answer sets covering boundary scenarios and approximate expressions can be automatically generated based on the key expressions in the rule text. Finally, these samples can be organized into corresponding sample sets and associated with prohibition rules to form the basic data for training the pluggable prohibition module.

[0060] In this way, legal provisions and policy regulations are transformed into structured prohibition rules and their corresponding training data. This allows various heterogeneous texts to be parsed and executed within a unified framework, significantly reducing the cost of writing and maintaining prohibition rules and enabling rapid response to changes in regulations and policies. By constructing targeted sample sets from the rule texts, training data that precisely aligns with the semantics of the rules is provided, making the trained pluggable prohibition modules more closely aligned with real-world compliance requirements in terms of behavior.

[0061] In some embodiments, constructing a sample set based on rule text and prohibition rules includes: extracting sample examples from the rule text; generating positive samples based on the data to be retained in the sample examples; generating negative samples based on the data to be prohibited in the sample examples; and constructing a sample set using the positive and negative samples.

[0062] Here, sample examples refer to specific statements, fragments, or scenario descriptions directly extracted from the rule text that can be used to illustrate what content should be allowed and what content should be prohibited. In this embodiment of the disclosure, sample examples may include typical case descriptions in regulations, descriptions of correct / incorrect practices listed in compliance documents, etc., and are training sample prototypes extracted from the original rule text.

[0063] In this embodiment, exemplary statements and paragraphs in the text can be identified first. Then, natural language processing techniques can be used to filter and segment these candidate statements, extracting those segments that clearly describe specific behavioral scenarios and provide typical examples as sample examples. Specifically, the association information between the sample examples and their respective rule clauses and rule numbers can be preserved to enable accurate judgment in conjunction with the corresponding prohibition rules, thereby ensuring consistency between the sample examples and the rule semantics.

[0064] Here, the data to be retained refers to the information or content in the sample examples that, after being judged according to the parsed prohibition rules, is deemed not to be within the prohibited scope and should continue to be allowed for the model to possess and output. This can include legal usages given in the rule examples, knowledge points that are allowed to be disclosed, etc. Positive samples refer to training samples constructed based on the data to be retained. They embody the compliant responses or behaviors that the model should give when encountering such inputs, and can be used to guide the model to continue to retain and strengthen these permitted output knowledge and patterns in relevant scenarios.

[0065] In this embodiment, each sample example can first be finely annotated using pre-structured prohibition rules to identify information fragments that do not fall within the scope of the prohibition rules but are explicitly affirmed or listed as correct or permitted by the document. These fragments are then marked as data to be retained. Training samples can then be constructed based on this retained data. For example, the scenario descriptions in the examples can be transformed into queries that users might ask, and the encouraged or permitted practices in the examples can be organized into standard answers, thereby forming positive training samples. Specifically, the data to be retained can be paraphrased or expanded according to the semantics of the rule text to generate more positive samples covering different expressions. Finally, these positive samples are then uniformly labeled as compliant output.

[0066] Here, the data that needs to be prohibited refers to the information and content in the sample examples that falls within the constraints of the prohibition rules and should be forgotten or suppressed by the model. This can include recipes, algorithm details, sensitive fields, etc., that are explicitly listed as not to be disclosed. Negative samples refer to training samples constructed based on the data that needs to be prohibited. They represent answers or behaviors that should not be given under similar inputs, and can penalize this part of the knowledge during training, thereby effectively suppressing prohibited content.

[0067] In this embodiment, each sample example can be analyzed based on prohibition rules to identify content that directly corresponds to the prohibited clause, is explicitly listed as an incorrect example, or falls within the prohibited scope. This content is then identified as items that need to be prohibited. Subsequently, training samples can be constructed using these prohibited data as the core. For example, the problem or scenario description in the example can be used as input, and the prohibited answers or practices shown in the example can be used as output, forming input-output pairs. These outputs are then marked as answers that should be suppressed or rejected. Specifically, a contrasting compliant answer can be constructed for the same input, making the answer containing prohibited content a less preferred option, thus being penalized as a negative sample within the preference learning framework.

[0068] In this embodiment, positive and negative samples can be uniformly organized and quality-controlled, including deduplication, cleaning of abnormal samples, balancing the proportion of samples of different types and difficulties, and maintaining the association between each sample and its source rule clauses, sample examples, and prohibition rules. Subsequently, positive and negative samples can be merged into a complete sample set according to a predetermined data format, where each sample has a clear label and possible weight information to support various subsequent training paradigms. Specifically, a corresponding sample subset can be organized for each prohibition rule, so that the corresponding sample set can be loaded at the rule granularity when training the pluggable prohibition module, ultimately forming a well-structured and fully labeled sample resource library for use by the subsequent fine-tuning module.

[0069] Thus, by automatically extracting sample examples from the rule text, distinguishing between data to be retained and data to be prohibited, and then generating positive and negative samples respectively, a refined transformation from abstract rules to executable training signals is achieved. The parallel construction of positive and negative samples creates clear contrast constraints during training, significantly improving the prohibition module's ability to discriminate boundary scenarios. This strengthens the suppression of prohibited content while avoiding excessive involvement and false positives of legal and harmless content. By constructing samples based on native examples in the rule text, the training data can be ensured to be highly semantically aligned with actual regulations and policy requirements, reducing the cost and bias of manually designing samples, thereby improving the accuracy, robustness, and maintainability of the entire knowledge prohibition mechanism.

[0070] In some implementations, a user-defined set of prohibition rules {R} can be received first. This set of rules is used to constrain the content that the model must not output in actual business scenarios, such as various prohibited violations, sensitive or erroneous information. Specifically, for each rule in the set, the user provides a small number of examples through the interface or configuration file. Since each rule only requires a small number of positive and negative samples to complete the configuration, the user can complete the personalized rule and example definition at a low cost.

[0071] After collecting the rules and examples, the user-inputted unretrievable rules and their corresponding examples can be parsed and structured to automatically construct the forgetting dataset D. forget and retain dataset D retain Forgotten dataset D forget The dataset is composed of negative examples corresponding to each rule. These samples are not treated as knowledge to be learned in subsequent training phases, but are designed as adversarial targets. For example, during training, a forgetting loss is used for this dataset. Through backward optimization, the model gradually deviates from the original answer distribution in the output space corresponding to these samples, thereby weakening or even eliminating the model's memory of relevant violations, sensitive, or erroneous information. The dataset D is retained. retainIt consists of positive examples corresponding to all rules and a portion of general high-quality corpus. For example, during training, a conventional learning loss can be applied to the retained dataset, while an adversarial loss for the forgotten dataset can be optimized in parallel, thereby simultaneously moving away from negative examples and moving closer to positive examples, thus avoiding catastrophic forgetting.

[0072] Thus, by leveraging user-defined rules against recall and a limited number of positive and negative examples, the content to be forgotten and the content to be retained are precisely defined before training begins, providing clear and fine-grained data guidance for subsequent adversarial training. Furthermore, by simultaneously constructing forgettable and retaintable datasets and employing differentiated loss designs during training, the model can maintain or even enhance its mastery of normal knowledge and abilities while moving away from prohibited knowledge. This effectively reduces the negative impact on the overall model performance while improving security and compliance.

[0073] In some embodiments, a sample set is constructed using positive and negative samples, including: when the number of positive or negative samples is lower than a preset threshold, generating supplementary samples corresponding to the prohibition rules using a preset sample generation model; and constructing a sample set using positive, negative, and supplementary samples.

[0074] Here, the preset quantity threshold refers to the minimum number of samples pre-set before constructing the sample set to determine whether the current number of positive and negative samples is sufficient, thus triggering an automatic sample expansion mechanism. The preset quantity threshold can be divided into a positive sample quantity threshold and a negative sample quantity threshold. The positive sample quantity threshold refers to the minimum number of samples that must be retained for each prohibition rule. When the actual number of positive samples obtained under a rule is less than this value, it is considered that the retention-side supervision of that rule is insufficient, and additional positive training data needs to be generated. The negative sample quantity threshold refers to the minimum number of prohibited samples required for each prohibition rule. When the number of negative samples under a rule is less than this threshold, it is considered that the constraint signal on the prohibited content is insufficient, and expansion is required.

[0075] Here, the sample generation model refers to a pre-configured generative model specifically designed to automatically generate more training samples based on prohibition rules and a small number of existing examples. It understands the semantics of the rules and the existing distribution of positive and negative samples, generating new samples with similar styles and semantics in batches without deviating from the rule constraints. Supplementary samples refer to the new set of samples automatically generated and added by the sample generation model when the number of positive or negative samples under a certain prohibition rule falls below a corresponding preset threshold. These can include supplementary positive samples and supplementary negative samples. Specifically, supplementary positive samples are additional compliant examples generated by the sample generation model around the content permitted by the rule when there are insufficient positive samples for that rule, used to enhance the model's learning of normal answer patterns. Supplementary negative samples are more illegal or sensitive examples generated by the sample generation model around the content prohibited by the rule when there are insufficient negative samples for that rule, used to strengthen the model's ability to identify and suppress prohibited content.

[0076] In this embodiment, the currently collected positive and negative samples under each prohibition rule can be counted first, and the numbers can be compared with preset thresholds for the number of positive and negative samples, respectively. If the number of positive samples under a certain rule is less than the threshold for the number of positive samples, or the number of negative samples is less than the threshold for the number of negative samples, then the training data corresponding to that rule is deemed insufficient. In particular, the comparison process can be performed at the rule level, either immediately after the rule is initially configured or automatically during rule updates or periodic data maintenance. Furthermore, the structured description of the rule, the existing small number of positive and negative samples, and necessary contextual information can be provided as input prompts to the sample generation model, so that the sample generation model can automatically generate new samples based on understanding the rule semantics and example style. At the same time, the generated results can be quality and security verified to ensure the effectiveness and reliability of the supplementary samples.

[0077] In this embodiment, samples can be classified and labeled according to their sample labels, grouping original positive samples and supplementary positive samples into one class, and original negative samples and supplementary negative samples into another class. Next, necessary cleaning and deduplication operations can be performed on the overall sample set to balance the distribution of positive and negative sample ratios, different representation forms, and different difficulty levels, thus avoiding excessive bias towards any one subclass during training. Finally, the sorted positive samples, negative samples, and corresponding supplementary samples can be packaged into a dataset object and associated with the corresponding prohibition rules.

[0078] Thus, by setting thresholds for the number of positive and negative samples and combining this with an automatic sample generation model to supplement samples, a training dataset of moderate size, broader coverage, and balanced positive and negative samples can be automatically expanded even when the user provides only a few examples or none. This avoids underfitting of the model or unstable prohibition effects caused by scarce samples. Furthermore, managing supplementary positive and negative samples separately helps to simultaneously strengthen the ability to retain compliant content and suppress non-compliant content during training, forming a clear contrastive learning signal and improving the model's discrimination accuracy in boundary scenarios.

[0079] In some embodiments, based on the backbone model, the parameter fine-tuning module is trained according to any prohibition rule and the sample set corresponding to the prohibition rule to obtain a pluggable prohibition module corresponding to the prohibition rule, including: generating a model to be trained according to the backbone model and the parameter fine-tuning module; and training the model to be trained using the sample set to obtain the pluggable prohibition module.

[0080] Here, the model to be trained refers to the overall model structure entity formed on the basis of the backbone model after introducing the parameter fine-tuning module, which is used for this round of training. In this embodiment of the disclosure, the model to be trained consists of two parts: a backbone model part with basically fixed parameters and a parameter fine-tuning module with trainable parameters. During forward inference, the two work together to process the input, and during backpropagation and parameter updates, optimization is mainly performed on the parameter fine-tuning module.

[0081] In this embodiment, the currently used backbone model can be loaded or selected first, and a parameter fine-tuning module can be instantiated for the target prohibition rule. This fine-tuning module can then be inserted into or attached to a specific position in the backbone model. During the generation process, the parameters of the backbone model can be marked as frozen, while the parameters of the parameter fine-tuning module can be marked as trainable parameters. Finally, the backbone model and the parameter fine-tuning module can be combined and configured to form a model to be trained.

[0082] In this embodiment, after generating the model to be trained, a sample set corresponding to the target prohibition rule can be loaded. This sample set includes the aforementioned positive and negative samples constructed based on the rule, as well as supplementary samples obtained by expanding the model through a sample generation model when necessary. During training, in each training batch, samples from the sample set can be input into the model to be trained, and the loss function between the model output and the desired label can be calculated. An inhibition or forgetting-oriented loss is applied to negative samples, and a loss to reinforce compliant output is applied to positive samples. Different weighted or multi-task loss designs can be adopted depending on the specific implementation. Subsequently, backpropagation can be performed based on the loss value, updating only the trainable parameters in the parameter fine-tuning module while keeping the backbone model parameters essentially unchanged. This allows the fine-tuning module to gradually learn to adjust the internal representation and output distribution of the overall model when encountering inputs related to the prohibition rule. After several training rounds and confirming the effect meets the standard through a validation set or online evaluation, the trained parameter fine-tuning module is extracted from the model to be trained and saved independently, thus obtaining the pluggable prohibition module corresponding to the prohibition rule.

[0083] Thus, by first combining the backbone model and the parameter fine-tuning module into a trainable model, and then using a sample set constructed for specific prohibition rules for targeted training, a pluggable prohibition module can be trained for each prohibition rule without compromising the original general capabilities of the backbone model. The structural decoupling of the backbone model and the fine-tuning module allows prohibition capabilities to exist in a modular manner, facilitating loading, unloading, upgrading, and rollback along the rule dimension. This avoids the high cost and high risk of requiring large-scale retraining of the entire model for each rule update. Simultaneously, by updating only the parameters of the fine-tuning module, training overhead is significantly reduced, and the impact of catastrophic forgetting is minimized. This enables rapid adaptation to constantly changing requirements, achieving refined and controllable management of the model's output behavior.

[0084] In some embodiments, generating a model to be trained based on the backbone model and the parameter fine-tuning module includes: initializing the adapter parameters of the parameter fine-tuning module; freezing the backbone parameters of the backbone model; and injecting the parameter fine-tuning module into the linear layer of the backbone model to generate the model to be trained.

[0085] Here, adapter parameters refer to a set of trainable parameters within the parameter fine-tuning module used to adjust the behavior of the backbone model without significantly modifying its structure and parameters.

[0086] In this embodiment of the disclosure, a corresponding adapter substructure can first be constructed for each linear layer that needs to insert an adapter, based on the selected fine-tuning architecture, and a set of adapter parameters to be trained can be assigned to these structures. Subsequently, these adapter parameters can be assigned initial values ​​according to a preset initialization strategy (e.g., random small value initialization, zero initialization, or initialization based on a specific distribution) to ensure that the perturbation of the backbone model output is controllable and stable at the start of training.

[0087] Here, the backbone parameters refer to all the original parameters that the backbone model itself has learned and fixed during the large-scale pre-training or supervised fine-tuning phase. In this embodiment, the backbone parameters may include the weights and biases in various Transformer layers, attention layers, feedforward network layers, embedding layers, etc., and are a set of fundamental parameters that support the model's general understanding and generation capabilities.

[0088] In this embodiment of the disclosure, after loading the backbone model, all original parameters can be uniformly marked, the gradient calculation or update switch of these parameters can be turned off, or their learning rate can be set to zero in the optimizer, so that the weight update operation is no longer performed on the backbone parameters during training.

[0089] Here, a linear layer refers to a neural network layer in the backbone model that exists in the form of a linear transformation. It can be composed of a weight matrix and a bias term to achieve an affine transformation of the input vector.

[0090] In this embodiment, the main model structure can be traversed first to locate all linear layers that are pre-defined as having pluggable adapters. Then, fine-tuning modules can be embedded around each target linear layer according to a selected adaptation scheme. For example, a parallel or series adapter branch can be added to the input or output path of the original linear layer, and the output of that linear layer can be subjected to additional linear or nonlinear transformations using pre-initialized adapter parameters, before being superimposed or combined with the original output.

[0091] Thus, by first properly initializing the adapter parameters, then fully freezing the backbone parameters, and embedding the fine-tuning module into the backbone model by injecting it into a linear layer, structural decoupling of backbone capabilities and prohibition capabilities is achieved. Freezing the backbone parameters ensures the stability of the model's original general capabilities and avoids the degradation of overall performance caused by local training for a specific rule. Injecting the adapter only into the linear layer and making it the only trainable part results in a small parameter size, low training cost, and different prohibition rules can have their own independent adapter parameter sets, facilitating on-demand loading, unloading, or updating.

[0092] In some embodiments, training a model to be trained using a sample set to obtain a pluggable prohibition module includes: determining a forgetting loss using negative samples in the sample set; the forgetting loss includes a multinomial sub-loss weighted by category; determining a retention loss using positive samples in the sample set; determining a resilient consolidation loss based on Fisher information of the adapter parameters; and training the model to be trained based on the forgetting loss, retention loss, and resilient consolidation loss to obtain a pluggable prohibition module.

[0093] Here, forgetting loss refers to a type of loss function built based on negative samples, used to guide the model to deteriorate on these samples and move away from the original harmful outputs. Forgetting loss, through backpropagation, makes the model tend to refuse to answer, avoid, or provide safe alternative answers when encountering such inputs, thereby weakening the model's memory of harmful knowledge or violation patterns. In particular, since different negative samples can be divided according to violation categories, forgetting loss is usually composed of multiple sub-losses, with different weights applied to the sub-losses of different categories, forming a category-weighted multi-sub-loss.

[0094] In this embodiment, training data labeled as negative samples can be selected from the sample set in each training round, and these negative samples are classified according to pre-defined violation category labels. Subsequently, these negative samples can be input into the model to be trained, and the model's output results for the negative samples under the current parameters can be obtained. Corresponding sub-loss functions are designed according to different categories. For example, there is a rejection output loss for a rejection scenario, and a loss for deviating from the original harmful answer for a secure rewriting scenario. For each type of negative sample, the sub-loss for that category can be calculated separately, and then the sub-losses are linearly weighted and summed according to preset category weights to obtain the overall forgetting loss. In particular, the preset category weights can be flexibly set according to risk level and compliance requirements.

[0095] Here, the retention loss refers to the loss function built based on positive samples, which is used to maintain or enhance the model's original capabilities in general tasks and safe outputs.

[0096] In this embodiment of the disclosure, data labeled as positive samples can be extracted from the sample set during training. These data represent the normal, safe, and general capabilities that the user wants the model to maintain or enhance. Subsequently, the positive samples can be input into the model to be trained to obtain the model output, which is then compared with the target answer in the positive samples to calculate the retention loss.

[0097] Here, Fisher information refers to a quantity introduced from statistics and information theory to measure the importance of a parameter under a given data distribution. It characterizes the contribution of each parameter in the adapter parameters to past tasks or the original capability. For example, the larger the Fisher information, the more critical the parameter is to maintaining the existing capability. Elastic consolidation loss is a regularization loss built based on Fisher information to achieve Elastic Weight Consolidation (EWC). It can impose stronger constraints on important parameters with large Fisher information by restricting the adapter parameters in the current training from deviating too far from the previous optimal parameters.

[0098] In this embodiment, forward and backward computations are first performed on a dedicated reserved dataset or historical task data using the adapter parameters from before training. The expected value of the squared gradient of each adapter parameter on this data is calculated to approximate the Fisher information of the corresponding parameter. Subsequently, after the computation is complete, a Fisher weight can be assigned to each adapter parameter to represent its importance to the original capability. During actual training, the adapter parameters in the current training can be compared one by one with the previous baseline parameters. If the difference is too large, a corresponding penalty term is generated according to the corresponding Fisher weight. Finally, the penalty terms can be summarized to form the overall elastic consolidation loss.

[0099] In this embodiment, the forgetting loss obtained from negative samples can be used to drive the model away from harmful content; the retention loss obtained from positive samples can be used to maintain and enhance the model's performance on normal tasks; simultaneously, the elastic consolidation loss constructed based on Fisher information can be used to flexibly constrain the adapter parameters, avoiding excessive modification of key capability parameters. The total loss function is formed by weighting and summing the three types of losses according to preset weight coefficients, followed by backpropagation and gradient update, updating only the trainable parameters in the adapter while keeping the core parameters frozen. After multiple rounds of iterative training, when the verification results show that the model meets the expected standards in terms of prohibited content suppression and normal capability preservation, the trained adapter parameters are extracted from the overall model and solidified, forming a pluggable prohibition module corresponding to the prohibition rule.

[0100] Thus, by finely dividing the training objective into three parts—forgetting loss, retention loss, and resilient consolidation loss—and uniformly weighting and jointly training them, a more precise balance can be achieved between actively forgetting harmful content and stably retaining existing capabilities. The three components work together, combined with an adapter-based efficient parameter fine-tuning mechanism, allowing the prohibition capability to be encapsulated in a pluggable module. This provides both security control and avoids compromising overall performance, improving controllability and maintainability in real-world business environments.

[0101] In some implementations, the forgetting loss is used to proactively push away the model's memory and representation of harmful knowledge on negative sample data. Specifically, this can be done on the forgetting dataset D. forget The standard language model loss is calculated and used as the forgetting loss in parameter updates. For example, the forgetting loss can be expressed by the following formula: ,in, L forget Indicates loss due to forgetting. L LM Represents the language model loss. θ Indicates the main parameters, φ This indicates the adapter parameters.

[0102] In some implementations, retention loss is used to maintain the model's original capabilities in general tasks and normal scenarios while performing forgetting training. Specifically, during training, positive samples can be input into the model to be trained with the adapter, the standard language model loss can be calculated, and the adapter parameters can be updated with the goal of minimizing this loss. For example, retention loss can be expressed by the following formula: ,in, L retain This indicates that the loss is retained.

[0103] In some implementations, to avoid compromising the model's generality while performing forgetting training, an EWC regularization term can be introduced into the loss function to penalize excessive modifications to important parameters. Specifically, before forgetting training begins, the current adapter parameters can be fixed as initial reference values, which can be zero or a pre-training checkpoint. Subsequently, Fisher information can be calculated for each adapter parameter, used as a measure of parameter importance; a higher Fisher information value indicates that the parameter is more critical to maintaining the model's original generality. Further, during training, each adapter parameter can be penalized for deviations from its initial reference value, with the penalty strength weighted by its Fisher information and controlled by a hyperparameter. For example, the elastic consolidation loss can be expressed by the following formula: ,in, L EWC Indicates elastic consolidation loss, λ Indicates hyperparameters, F i This indicates Fisher's information. φ i Indicates the first i One adapter parameter, φ 0,i This represents the initial reference value.

[0104] In some implementations, when introducing the EWC mechanism, Fisher information can be used to assign importance weights to each parameter to measure its contribution to the old task or the model's general capabilities. A reference dataset D can be selected to anchor the old capabilities. ref This dataset can be a subset of the data used during pre-training, a specially constructed capability reserve set, or a validation set from older tasks. The model is then fixed at the optimal parameter points based on the older tasks or the original capabilities. In D ref The log-likelihood is calculated forward on a sample-by-sample basis, and for each model parameter... Calculate the corresponding gradients, and then take the expectation or average of the squares of these gradients to obtain each parameter. Fisher information .

[0105] In some embodiments, training the model to be trained includes: constructing a total loss based on forgetting loss, retention loss, and resilient consolidation loss; configuring the total loss to optimize the forgetting loss in the gradient ascent direction and the retention loss and resilient consolidation loss in the gradient descent direction; and training the model to be trained using the total loss to obtain a pluggable prohibited module.

[0106] Here, the total loss refers to a unified objective function obtained by combining the forgetting loss (driving forgetting), the retention loss (maintaining capability), and the elastic consolidation loss (protecting important parameters) according to certain weights and signs during training. This objective function is configured to optimize the forgetting loss along the gradient ascent direction and the retention and elastic consolidation losses along the gradient descent direction. Specifically, the gradient ascent direction refers to optimizing along the positive direction of the loss function's gradient during parameter updates, increasing the value of the loss; the gradient descent direction refers to optimizing along the negative gradient direction of the loss function during parameter updates, decreasing the value of the loss.

[0107] In this embodiment, the forgetting loss, retention loss, and elastic consolidation loss can be calculated based on the current batch of data in each training iteration. Then, these three items can be combined according to preset weight coefficients and signs to construct the total loss function. Furthermore, when designing the total loss, a negative sign can be introduced into the forgetting loss to transform the default gradient descent optimizer into a gradient ascent effect for that part of the loss. Simultaneously, the retention loss and elastic consolidation loss are added to the total loss with positive values, and the optimizer will naturally update its parameters along their negative gradient direction, effectively reducing these two losses and achieving gradient descent optimization. For example, the total loss function can be expressed by the following formula: ,in, α , β and γIt is an adjustable non-negative hyperparameter used to balance the relative effects of the three types of losses.

[0108] In this embodiment, after constructing the total loss, it can be used as the sole optimization objective to drive the iterative update of the adapter parameters in the model to be trained. Specifically, in each training cycle, data batches containing both negative and positive samples can be sampled from the sample set and input into the overall model structure with frozen backbone parameters and only open adapter parameters for training. This completes one forward computation, yielding the forgetting loss, retention loss, and elastic consolidation loss, respectively. Then, the total loss L is calculated based on pre-set weights and sign combinations. total Then, multiple iterations are performed. When the validation results show that the model's output on harmful content is significantly suppressed or forgotten, while its performance on general tasks and safe outputs remains at the expected level and there is no obvious catastrophic forgetting, the trained adapter parameters can be solidified and abstracted into a set of independent pluggable prohibition modules.

[0109] Thus, by employing gradient ascent in the forgetting loss within the total loss, the training process actively pushes model parameters away from regions capable of efficiently representing and generating harmful content, achieving the erasure of harmful knowledge at the parameter level, rather than merely superficial behavioral avoidance. By optimizing the retention loss and resilient consolidation loss using gradient descent, the model's performance on general, security tasks is continuously maintained and corrected. The stability of key parameters is finely protected by the EWC mechanism, effectively preventing catastrophic forgetting and overall performance collapse. Combined with the pluggable prohibition module obtained through synchronous training, this further realizes the modularity, configurability, and rollbackable deployment of security capabilities, greatly improving the security controllability and maintenance efficiency of large models in real-world business environments.

[0110] In some embodiments, training the model to be trained includes: constructing a gradient ascent stage loss based on the forgetting loss using the gradient ascent algorithm; constructing a gradient descent stage loss based on the retention loss and the elastic consolidation loss using the gradient descent algorithm; and performing alternating optimization training on the model to be trained according to the gradient ascent stage loss and the gradient descent stage loss to obtain a pluggable prohibited module.

[0111] Here, gradient ascent refers to an optimization method that updates parameters along the positive direction of the gradient of the loss function during parameter updates, thereby increasing the value of the objective function. The goal is to maximize a certain metric. The gradient ascent stage loss refers to the portion of the loss function that needs to be maximized when executing the gradient ascent algorithm. It can be directly composed of forgetting loss or a weighted sum of forgetting losses, and is specifically used to drive the model's performance to deteriorate on harmful samples, achieving proactive forgetting.

[0112] In this embodiment, the forgetting loss or its weighted form can first be defined as the gradient ascent stage loss, and a gradient ascent-type optimization strategy can be selected. This involves explicitly adjusting the pluggable module parameters along the positive gradient direction of the loss function during parameter updates, causing the forgetting loss to gradually increase, thereby actively weakening the internal representation of harmful knowledge. For example, the gradient ascent stage loss can be expressed by the following formula: ,in, L Ga This represents the loss during the gradient ascent phase.

[0113] Here, gradient descent refers to a standard optimization method that updates parameters along the negative gradient of the loss function during parameter updates, thereby reducing the value of the objective function. The goal is to minimize the error or penalty term. The gradient descent stage loss refers to the portion of the loss function that needs to be minimized during the gradient descent algorithm. It is composed of the retention loss and the elasticity consolidation loss, weighted according to certain criteria. It is used to ensure the model maintains good performance on positive samples and to constrain excessive deviations from important parameters.

[0114] In this embodiment, the retention loss and elastic consolidation loss can be combined into a gradient descent stage loss according to a preset weighting coefficient. This allows the parameters to be updated along the negative gradient direction of the gradient descent stage loss, thereby jointly reducing the retention loss and elastic consolidation loss. For example, the gradient descent stage loss can be expressed by the following formula: in, L Gd This represents the loss during the gradient descent phase.

[0115] Here, alternating optimization training refers to dividing the optimization process into two stages within the same training process. One stage is dedicated to performing gradient ascent updates for the gradient ascent stage loss, while the other stage performs gradient descent updates for the gradient descent stage loss. The two stages are performed alternately at a certain frequency or in a certain order, thereby balancing the two objectives of forgetting harmful content and retaining general capabilities in the time dimension.

[0116] In this embodiment, two complementary optimization phases can be explicitly divided in the training process and executed alternately at a preset frequency or strategy. For example, the alternating execution process can be a series of ascent phases followed by a series of descent phases, or several ascent steps followed by several descent steps. Specifically, within a training cycle, several gradient ascent phases can be executed first. Each time the gradient ascent phase loss is calculated based on negative samples, the pluggable module parameters can be updated using gradient ascent, thereby continuously weakening the model's fitting ability on harmful content. Subsequently, the process can switch to the gradient descent phase, calculating the gradient descent phase loss based on positive samples and reference data, and updating the same batch of pluggable module parameters. This allows the model's performance on general tasks to be restored and consolidated, while simultaneously using EWC regularization to limit excessive modification of key parameters.

[0117] In this way, by splitting the forgetting of harmful knowledge and the retention of general capabilities into gradient ascent and gradient descent phases and adopting an alternating optimization training method, the model can rhythmically destroy the representations related to harmful content in the time dimension first, and then immediately repair and strengthen the representations related to general capabilities. This effectively avoids the risk of biased updates and catastrophic forgetting caused by single-objective training.

[0118] In some embodiments, the knowledge prohibition-based model reasoning method further includes: when more than one pluggable prohibition module is selected, assigning a priority to each pluggable prohibition module according to a preset superposition rule; and after handling the conflicts between pluggable prohibition modules according to the priority, combining each pluggable prohibition module.

[0119] Here, the preset overlay rules refer to a set of combination strategies predefined during the deployment or configuration phase. These strategies specify how the effects of multiple pluggable disallowed modules should be overlaid and coordinated when they are active simultaneously. The preset overlay rules may include: how to determine the priority order of each module, what decision-making strategy to adopt when multiple modules provide different processing opinions on the same output, and whether to adjust the overlay method under different business scenarios, user types, or security levels. Priority refers to the relative importance level or execution order identifier assigned to each pluggable disallowed module. It is used to determine which module's decision should be adopted first or override the decisions of other modules when multiple modules are active simultaneously. Priority can be represented in the form of numerical values, levels, or ordered lists, and is usually determined based on the regulatory compliance requirements, business criticality, or manual configuration by the administrator.

[0120] In this embodiment, when it is detected that the number of pluggable prohibited modules selected for a certain inference task is greater than one, predefined overlay rules can first be read from the configuration center or policy library. These rules include category information of various prohibited modules, default priority order, and priority adjustment strategies under different security levels or business scenarios. Subsequently, based on these overlay rules and actual scenario parameters, a clear priority value or level can be calculated and assigned to each selected pluggable prohibited module. For example, a unified convention of lower values ​​indicating higher priority or higher values ​​indicating higher priority can be adopted, and administrators can manually adjust the priority of specific modules through configuration files or the console, thereby forming an ordered list of module priorities.

[0121] Here, conflict between pluggable disabling modules refers to a situation where different pluggable disabling modules give inconsistent processing conclusions when judging the same input request or the same output content. In this embodiment of the disclosure, conflict between pluggable disabling modules may include one module judging that the output content should be strictly prohibited and replaced, while another module judging that it can be allowed or only slightly modified; or multiple modules giving different blocking ranges and strategies for the same type of content.

[0122] In this embodiment, potential conflicts between modules can be considered uniformly during the inference execution chain construction phase, and processed and combined according to priority. Specifically, when a user requests to enter the inference process, each prohibition module can be called sequentially according to the sorted priority list, allowing them to identify and process risks in the model's intermediate outputs or candidate responses. For example, if a high-priority module determines that a certain type of content must be prohibited and provides a replacement or blocking solution, and a subsequent low-priority module gives a different opinion on this content, the processing result of the high-priority module can be directly adopted according to a preset superposition rule. Furthermore, for cases where multiple modules require prohibition but have different processing methods, the most stringent or most policy-compliant solution can be selected as the final output according to priority. After completing the adjudication of all potential conflicts, the remaining conflict-free or conflict-resolved modules can be combined to form a prohibition module combination chain, which is uniformly called during the model inference process, thereby ensuring the consistency and interpretability of the overall prohibition strategy.

[0123] Thus, by introducing preset overlay rules, explicitly assigning priorities, and uniformly handling conflicts between pluggable prohibited modules in multi-module coexistence scenarios, unpredictable behavior caused by differing opinions among multiple prohibited modules is avoided. This ensures that the model always responds according to a defined and traceable security logic when facing sensitive content. The priority-based conflict resolution mechanism allows modules related to laws and regulations, mandatory compliance, or core security objectives to take precedence in all circumstances, while modules related to business personalization or experience optimization play a supporting role without violating high-priority security policies, thereby balancing security and flexibility.

[0124] In some embodiments, a pluggable prohibition module is loaded into the backbone model to form a model instance for the current inference task, based on the prohibition strength. This includes: determining the forward propagation increment based on the parameters of the pluggable prohibition module and the prohibition strength; adding the forward propagation increment to the initial forward propagation function of the backbone model to obtain an optimized forward propagation function; and forming a model instance for the current inference task based on the optimized forward propagation function.

[0125] Here, the forward propagation increment refers to the additional output correction or supplementary value generated by the pluggable disable module during the forward calculation process, which numerically reflects the intervention effect of the disable module.

[0126] In this embodiment, the stored parameter set and prohibition strength of each selected prohibition module can be read first. Then, when constructing the forward computation graph, several pre-specified insertable layers or operators (such as self-attention layers, feedforward layers, etc.) in the backbone model can be used to calculate the corrected output of the prohibition module at these positions based on its parameters. Next, the corrected output can be scaled or weighted proportionally according to the corresponding prohibition strength to obtain the forward propagation increment of the module at that position. Specifically, in cases where multiple prohibition modules act simultaneously at the same position, the increments of each module can be weighted and summed or combined in other ways according to superposition rules and priority strategies to ultimately obtain a unified forward propagation increment at that position used for subsequent superposition onto the backbone computation results.

[0127] Here, the initial forward pass function refers to the original forward computation logic of the backbone model before any pluggable disabled modules are loaded, i.e., the default mapping relationship from input to output. In this embodiment, the initial forward pass function is determined by the network structure and parameters already determined during the pre-training or basic fine-tuning phase, and remains frozen during training.

[0128] In this embodiment, the original computations of the backbone model at each target layer or operator can first be defined as the initial forward transfer function. Subsequently, the incremental parts generated by the prohibition module can be combined with the initial forward transfer function to form an optimized forward transfer function that includes the influence of the prohibition policy.

[0129] In this embodiment, the overall network structure including the optimized forward transfer function can be considered as a new model instance. This instance inherits all the basic capabilities of the backbone model and adds behavioral corrections from the prohibition module at designated locations. Subsequently, inference parameters adapted to the current inference task can be configured for this instance, and it can be registered as a task-specific instance. When a user request arrives, this model instance is directly invoked for inference calculation. Because it has already loaded the incremental logic of the prohibition module, the corresponding prohibition strength and security policy effect will be automatically reflected when generating the answer. When the task ends or the configuration changes, the instance can be destroyed or different pluggable prohibition modules can be reloaded to quickly form a new model instance to adapt to subsequent tasks.

[0130] In this way, all security-related interventions are encapsulated within the increments generated by the pluggable disabling modules, keeping the main model clean and stable. This facilitates version management and reuse, while avoiding the risks and costs associated with frequent re-tuning of the main model. By explicitly applying the disabling strength to the increments, the disabling intensity can be flexibly adjusted according to scenarios and users, achieving continuous control from weak alerts to strong blocking.

[0131] In some implementations, a pre-trained backbone language model can be obtained first, and all the original weight parameters of this model are denoted as... θ This serves as the foundation for the input model. Simultaneously, an efficient parameter fine-tuning technique is employed. Taking LoRA as an example, several linear layers within the backbone model are modified without altering the backbone weights. θ Under this premise, a new set of low-rank trainable adapter parameters is injected into these linear layers to structurally build the independent parameter channels upon which subsequent forgetting training depends. Furthermore, the selected linear layers in the backbone model (such as the query, key-value projection layers in self-attention, and fully connected layers in the feedforward network) can be traversed, and for each linear layer's weight matrix... W Keep its original value unchanged and mark it as a frozen parameter, meaning it will not be updated in subsequent training. W , making W This always represents the original weight matrix in the pre-trained backbone model. Subsequently, a pair of low-rank matrices can be introduced into this linear layer. A and B And construct a low-rank increment through them. ΔW=BA , used to represent the original weights WLearnable corrections. After superimposing the prohibition strength as a weight, the forward propagation of the linear layer changes from the original... h=Wx , modified to h=Wx+μΔWx=Wx+μBAx ,in x The vector or hidden state input to this linear layer (e.g., query / key / value in self-attention or input to the feedforward layer). h This is the updated output of this layer. μ These are the weight parameters determined based on the prohibition strength. During the initialization phase, the matrix... A and B The LoRA adapter parameters are initialized to preset small values ​​(e.g., random values ​​close to zero) to ensure that at the start of training... ΔW right W The impact is minimal, thus ensuring that the behavior of models injected with the adapter but not yet trained remains largely consistent with the original backbone model. Simultaneously, the backbone parameters are frozen. θ , only A and B Marked as trainable parameters, only the LoRA adapter parameters (i.e., those on all linear layers) are used in subsequent training based on forgotten / retained samples and EWC constraints. A , B The trunk parameters will be updated. θ This remains unchanged. Through the above injection and initialization operations, the final output is a model with a trainable LoRA adapter. M , M A set of low-rank incremental parameters was superimposed on the outside of each objective linear layer of the original backbone model. A , B Furthermore, the forgetting-related learning process is entirely confined to these newly added LoRA parameters, and is completely independent of the original parameters of the backbone model. θ Decoupling.

[0132] In some embodiments, reasoning is performed using model instances to obtain reasoning results corresponding to user input, including: performing reasoning using model instances to obtain initial reasoning results; and calling filters to process the initial reasoning results according to preset filtering rules to obtain the final reasoning result.

[0133] Here, the initial inference result refers to the original output content generated by the model instance directly through its internal forward computation and decoding process after receiving user input.

[0134] In this embodiment, user input can be preprocessed as necessary before being fed into the model instance for forward inference computation, resulting in a series of intermediate representations and an output probability distribution. Subsequently, based on a set decoding strategy, text, code, or other structured results can be generated from the output probability distribution, and these results can be used as the initial inference results.

[0135] Here, the preset filtering rules refer to a set of judgment and processing criteria that are predefined and stored during the design and deployment phase. They are used to verify and correct the initial inference results of the model in terms of compliance, security and quality. They may include sensitive words, sensitive entity lists, matching rules, privacy and information leakage detection rules, etc., and different rule sets can be configured according to business scenarios and user types.

[0136] Here, a filter refers to a functional component or module specifically responsible for executing the aforementioned preset filtering rules during the post-inference processing stage. In this embodiment of the disclosure, the filter can receive the initial inference results generated by the model and check, judge, and rewrite the content as necessary, either line by line or as a whole. The filter can be a pure rule engine, a service that calls one or more security classification models, or a combination of both; its output is the final inference result after security and compliance processing.

[0137] In this embodiment, after obtaining the initial inference result, a corresponding set of filtering rules can be loaded or selected from the configuration center based on the current business scenario, user identifier, and security level, and then the set can be executed by the filter. For example, the filter first parses and segments the initial inference result, and then applies various checking mechanisms such as sensitive word matching, regular expression pattern matching, machine learning classification, or scoring model judgment to mark potentially risky segments. Once a rule is found to be hit or the risk assessment exceeds a threshold, the filter processes the relevant segments according to a pre-configured processing strategy. The output content after complete processing by the filter is returned to the user as the inference result, thereby ensuring that the final presented result meets the preset requirements.

[0138] Thus, after the model instance generates the initial inference result, it calls an independent filter for post-processing according to the preset filtering rules. The model instance has already suppressed harmful content in the generation stage through the pluggable prohibition module. The filter, as the second line of defense, can intercept residual risks, forming a double protection, thereby significantly reducing the probability of harmful or non-compliant content being leaked.

[0139] This disclosure provides a model reasoning device based on knowledge prohibition, such as... Figure 2As shown, the device may include: an input parsing module 201, used to determine one or more prohibition rules and the prohibition strength corresponding to each prohibition rule in response to user input; a forgetting recall module 202, used to recall at least one corresponding pluggable prohibition module from a preset module library according to the prohibition rules; the module library includes at least one pluggable prohibition module, which is configured to forget the knowledge corresponding to the prohibition rule; an instance construction module 203, used to load the pluggable prohibition module into the backbone model according to the prohibition strength to form a model instance for the current inference task; and a model inference module 204, used to perform inference using the model instance to obtain the inference result corresponding to the user input.

[0140] In some embodiments, the input parsing module 201 includes: an input acquisition submodule for acquiring query terms input by the user; an input parsing submodule for parsing the query terms and determining the prohibition rules triggered by the parsing results; an intent recognition submodule for performing intent recognition on the query terms and determining the risk level corresponding to the query terms; and an intensity mapping submodule for determining the prohibition intensity according to the risk level and a predefined mapping relationship between the risk level and the prohibition intensity.

[0141] In some embodiments, the input parsing module 201 further includes: a metadata acquisition submodule, used to acquire request metadata; the request metadata includes at least the request initiation region and the request initiation time; a general rule determination submodule, used to determine the corresponding general prohibition rule based on the request metadata; and a rule merging submodule, used to add the general prohibition rule to the prohibition rule.

[0142] In some embodiments, the pluggable prohibition module is pre-built by: obtaining a set of prohibition rules; the set of prohibition rules includes at least one prohibition rule and a sample set corresponding to the prohibition rule; based on the backbone model, the parameter fine-tuning module is trained according to any prohibition rule and the sample set corresponding to the prohibition rule to obtain the pluggable prohibition module corresponding to the prohibition rule; the pluggable prohibition module, the prohibition rule and the corresponding version information are associated and stored in the module library.

[0143] In some embodiments, obtaining a set of prohibited rules includes: obtaining rule text; parsing the rule clauses in the rule text and generating at least one prohibited rule according to a preset rule template; and constructing a sample set based on the rule text and the prohibited rules.

[0144] In some embodiments, constructing a sample set based on rule text and prohibition rules includes: extracting sample examples from the rule text; generating positive samples based on the data to be retained in the sample examples; generating negative samples based on the data to be prohibited in the sample examples; and constructing a sample set using the positive and negative samples.

[0145] In some embodiments, a sample set is constructed using positive and negative samples, including: when the number of positive or negative samples is lower than a preset threshold, generating supplementary samples corresponding to the prohibition rules using a preset sample generation model; and constructing a sample set using positive, negative, and supplementary samples.

[0146] In some embodiments, based on the backbone model, the parameter fine-tuning module is trained according to any prohibition rule and the sample set corresponding to the prohibition rule to obtain a pluggable prohibition module corresponding to the prohibition rule, including: generating a model to be trained according to the backbone model and the parameter fine-tuning module; and training the model to be trained using the sample set to obtain the pluggable prohibition module.

[0147] In some embodiments, generating a model to be trained based on the backbone model and the parameter fine-tuning module includes: initializing the adapter parameters of the parameter fine-tuning module; freezing the backbone parameters of the backbone model; and injecting the parameter fine-tuning module into the linear layer of the backbone model to generate the model to be trained.

[0148] In some embodiments, training a model to be trained using a sample set to obtain a pluggable prohibition module includes: determining a forgetting loss using negative samples in the sample set; the forgetting loss includes a multinomial sub-loss weighted by category; determining a retention loss using positive samples in the sample set; determining a resilient consolidation loss based on Fisher information of the adapter parameters; and training the model to be trained based on the forgetting loss, retention loss, and resilient consolidation loss to obtain a pluggable prohibition module.

[0149] In some embodiments, training the model to be trained includes: constructing a total loss based on forgetting loss, retention loss, and resilient consolidation loss; configuring the total loss to optimize the forgetting loss in the gradient ascent direction and the retention loss and resilient consolidation loss in the gradient descent direction; and training the model to be trained using the total loss to obtain a pluggable prohibited module.

[0150] In some embodiments, training the model to be trained includes: constructing a gradient ascent stage loss based on the forgetting loss using the gradient ascent algorithm; constructing a gradient descent stage loss based on the retention loss and the elastic consolidation loss using the gradient descent algorithm; and performing alternating optimization training on the model to be trained according to the gradient ascent stage loss and the gradient descent stage loss to obtain a pluggable prohibited module.

[0151] In some embodiments, the knowledge prohibition-based model reasoning apparatus further includes: a priority allocation module 205 ( Figure 2 (Not shown in the image), used to assign priority to each pluggable disabling module according to a preset stacking rule when more than one pluggable disabling module is selected; Conflict merging module 206 ( Figure 2(Not shown in the image) is used to process conflicts between pluggable disabled modules according to priority, and then combine each pluggable disabled module.

[0152] In some embodiments, the instance construction module 203 includes: an increment function determination submodule, used to determine the forward propagation increment based on the parameters and prohibition strength of the pluggable prohibition module; a function optimization submodule, used to add the forward propagation increment to the initial forward propagation function of the backbone model to obtain an optimized forward propagation function; and an instance construction submodule, used to form a model instance for the current inference task based on the optimized forward propagation function.

[0153] In some embodiments, the model reasoning module 204 includes: an instance reasoning submodule, used to perform reasoning using model instances to obtain an initial reasoning result; and a result filtering submodule, used to call a filter to process the initial reasoning result according to preset filtering rules to obtain a reasoning result.

[0154] The specific functions and examples of each module and submodule of the apparatus in this disclosure can be found in the relevant descriptions of the corresponding steps in the above method embodiments, and will not be repeated here.

[0155] The knowledge prohibition-based model inference device in this embodiment can dynamically parse user input, determine prohibition rules and prohibition strength during the inference stage, and load pluggable prohibition modules on demand based on a module library. These modules are then combined with the backbone model to generate model instances for specific tasks, and the inference output is completed by these instances. This decouples the knowledge prohibition strategy from the capabilities of the basic model, transforming the control of harmful or prohibited knowledge into the on-demand loading of manageable prohibition modules. This not only significantly reduces the training costs and response latency caused by frequent changes in regulations or business rules, but also achieves fine control over the degree of knowledge suppression in different scenarios through the adjustability of prohibition strength. At the same time, it avoids causing large-scale damage to the overall capabilities of the backbone model, supports modular, rollbackable, and auditable management of security policies, and comprehensively improves the security, flexibility, and maintainability of large-scale language models in dynamic and highly compliant environments.

[0156] This disclosure provides a scenario illustration of a model reasoning method based on knowledge prohibition, as shown in the embodiments below. Figure 3 As shown.

[0157] As previously described, the knowledge-forbidden model reasoning method provided in this disclosure is applied to electronic devices. These electronic devices are intended to represent various forms of digital computers, such as laptop computers, desktop computers, workstations, personal digital assistants, servers, blade servers, mainframe computers, and other suitable computers.

[0158] Specifically, the electronic device may perform the following operations: in response to user input, determine one or more prohibition rules and the prohibition strength corresponding to each prohibition rule; according to the prohibition rules, call at least one corresponding pluggable prohibition module from a preset module library; the module library includes at least one pluggable prohibition module, which is configured to forget the knowledge corresponding to the prohibition rule; according to the prohibition strength, load the pluggable prohibition module into the backbone model to form a model instance for the current inference task; and use the model instance to perform inference to obtain the inference result corresponding to the user input.

[0159] It should be understood that Figure 3 The scene diagrams shown are merely illustrative and not restrictive; those skilled in the art can interpret them based on... Figure 3 Even with various obvious changes and / or substitutions to the examples, the resulting technical solutions still fall within the scope of this disclosure.

[0160] The acquisition, storage, and application of user personal information involved in the technical solution disclosed herein comply with the provisions of relevant laws and regulations and do not violate public order and good morals.

[0161] According to embodiments of this disclosure, this disclosure also provides an electronic device, a readable storage medium, and a computer program product.

[0162] Figure 4 A schematic block diagram of an example electronic device 400 that can be used to implement embodiments of the present disclosure is shown. The electronic device is intended to represent various forms of digital computers, such as laptop computers, desktop computers, workstations, personal digital assistants, servers, blade servers, mainframe computers, and other suitable computers. The electronic device may also represent various forms of mobile devices, such as personal digital assistants, cellular phones, smartphones, wearable devices, and other similar computing devices. The components shown herein, their connections and relationships, and their functions are merely illustrative and are not intended to limit the implementation of the present disclosure described and / or claimed herein.

[0163] like Figure 4As shown, device 400 includes a computing unit 401, which can perform various appropriate actions and processes based on a computer program stored in read-only memory (ROM) 402 or a computer program loaded from storage unit 408 into random access memory (RAM) 403. RAM 403 may also store various programs and data required for the operation of device 400. The computing unit 401, ROM 402, and RAM 403 are interconnected via bus 404. Input / output (I / O) interface 405 is also connected to bus 404.

[0164] Multiple components in device 400 are connected to I / O interface 405, including: input unit 406, such as keyboard, mouse, etc.; output unit 407, such as various types of monitors, speakers, etc.; storage unit 408, such as disk, optical disk, etc.; and communication unit 409, such as network card, modem, wireless transceiver, etc. Communication unit 409 allows device 400 to exchange information / data with other devices through computer networks such as the Internet and / or various telecommunications networks.

[0165] The computing unit 401 can be a variety of general-purpose and / or special-purpose processing components with processing and computing capabilities. Some examples of the computing unit 401 include, but are not limited to, a central processing unit (CPU), a graphics processing unit (GPU), various special-purpose artificial intelligence (AI) computing chips, various computing units running machine learning model algorithms, digital signal processors (DSPs), and any suitable processor, controller, microcontroller, etc. The computing unit 401 performs the various methods and processes described above, such as the knowledge-based prohibition model inference method. For example, in some embodiments, the knowledge-based prohibition model inference method can be implemented as a computer software program tangibly contained in a machine-readable medium, such as storage unit 408. In some embodiments, part or all of the computer program can be loaded and / or installed on device 400 via ROM 402 and / or communication unit 409. When the computer program is loaded into RAM 403 and executed by the computing unit 401, one or more steps of the knowledge-based prohibition model inference method described above can be performed. Alternatively, in other embodiments, computing unit 401 may be configured to perform a knowledge-prohibited model reasoning method by any other suitable means (e.g., by means of firmware).

[0166] Various embodiments of the systems and techniques described above herein can be implemented in digital electronic circuit systems, integrated circuit systems, field-programmable gate arrays (FPGAs), application-specific integrated circuits (ASICs), application-specific standard products (ASSPs), systems-on-chip (SoCs), complex programmable logic devices (CPLDs), computer hardware, firmware, software, and / or combinations thereof. These various embodiments may include implementations in one or more computer programs that can be executed and / or interpreted on a programmable system including at least one programmable processor, which may be a dedicated or general-purpose programmable processor, capable of receiving data and instructions from a storage system, at least one input device, and at least one output device, and transmitting data and instructions to the storage system, the at least one input device, and the at least one output device.

[0167] The program code used to implement the methods of this disclosure may be written in any combination of one or more programming languages. This program code may be provided to a processor or controller of a general-purpose computer, special-purpose computer, or other programmable data processing apparatus, such that when executed by the processor or controller, the program code causes the functions / operations specified in the flowcharts and / or block diagrams to be implemented. The program code may be executed entirely on a machine, partially on a machine, as a standalone software package partially on a machine and partially on a remote machine, or entirely on a remote machine or server.

[0168] In the context of this disclosure, a machine-readable medium can be a tangible medium that may contain or store a program for use by or in conjunction with an instruction execution system, apparatus, or device. A machine-readable medium can be a machine-readable signal medium or a machine-readable storage medium. A machine-readable medium can be, but is not limited to, electronic, magnetic, optical, electromagnetic, infrared, or semiconductor systems, apparatus, or devices, or any suitable combination of the foregoing. More specific examples of machine-readable storage media include electrical connections based on one or more wires, portable computer disks, hard disks, random access memory, read-only memory, erasable programmable read-only memory (EPROM), flash memory, optical fiber, compact disk read-only memory (CD-ROM), optical storage devices, magnetic storage devices, or any suitable combination of the foregoing.

[0169] To provide interaction with a user, the systems and techniques described herein can be implemented on a computer having: a display device for displaying information to the user (e.g., a cathode ray tube (CRT) or liquid crystal display (LCD) monitor); and a keyboard and pointing device (e.g., a mouse or trackball) through which the user provides input to the computer. Other types of devices can also be used to provide interaction with the user; for example, feedback provided to the user can be any form of sensory feedback (e.g., visual feedback, auditory feedback, or tactile feedback); and input from the user can be received in any form (including sound input, voice input, or tactile input).

[0170] The systems and technologies described herein can be implemented in computing systems that include backend components (e.g., as a data server), or computing systems that include middleware components (e.g., an application server), or computing systems that include frontend components (e.g., a user computer with a graphical user interface or web browser through which a user can interact with implementations of the systems and technologies described herein), or any combination of such backend, middleware, or frontend components. The components of the system can be interconnected via digital data communication of any form or medium (e.g., a communication network). Examples of communication networks include local area networks (LANs), wide area networks (WANs), and the Internet.

[0171] Computer systems can include clients and servers. Clients and servers are generally located far apart and typically interact via communication networks. Client-server relationships are created by computer programs running on the respective computers and having a client-server relationship with each other. Servers can be cloud servers, servers in distributed systems, or servers incorporating blockchain technology.

[0172] The specific embodiments described above do not constitute a limitation on the scope of protection of this disclosure. Those skilled in the art should understand that various modifications, combinations, sub-combinations, and substitutions can be made according to design requirements and other factors. Any modifications, equivalent substitutions, and improvements made within the principles of this disclosure should be included within the scope of protection of this disclosure.

Claims

1. A model reasoning method based on knowledge prohibition, comprising: In response to user input, determine one or more prohibition rules and the prohibition strength corresponding to each prohibition rule; According to the prohibition rules, at least one corresponding pluggable prohibition module is called from the preset module library; The module library includes at least one of the pluggable prohibition modules, which are configured to forget the knowledge corresponding to the prohibition rules; Based on the prohibition strength, the pluggable prohibition module is loaded into the backbone model to form a model instance for the current inference task; Using the model instance, inference is performed to obtain the inference result corresponding to the user input.

2. The method according to claim 1, wherein, The step of responding to user input by determining one or more prohibition rules and the prohibition strength corresponding to each prohibition rule includes: Get the query terms entered by the user; The query terms are parsed to determine the prohibition rules triggered by the parsing results; The query terms are subjected to intent recognition to determine the risk level corresponding to the query terms; Based on the risk level, the prohibition intensity is determined according to the predefined mapping relationship between risk level and prohibition intensity.

3. The method according to claim 2, wherein, The step of responding to user input and determining one or more prohibition rules and the prohibition strength corresponding to each prohibition rule further includes: Obtain request metadata; the request metadata includes at least the request initiation region and the request initiation time; Based on the request metadata, determine the corresponding general prohibition rule; Add the general prohibition rule to the prohibition rule triggered by the parsing result.

4. The method according to claim 1, wherein, The pluggable disable module is pre-built in the following manner: Obtain a set of prohibited rules; the set of prohibited rules includes at least one prohibited rule and a sample set corresponding to the prohibited rule; Based on the backbone model, the parameter fine-tuning module is trained according to any prohibition rule and the sample set corresponding to the prohibition rule to obtain a pluggable prohibition module corresponding to the prohibition rule. The pluggable disabling module, the disabling rule, and the corresponding version information are associated and stored in the module library.

5. The method according to claim 4, wherein, The set of prohibited rules includes: Get the rule text; Parse the rule clauses in the rule text and generate at least one prohibition rule according to a preset rule template; The sample set is constructed based on the rule text and the prohibition rule.

6. The method according to claim 5, wherein, The step of constructing the sample set based on the rule text and the prohibition rule includes: Extract sample examples from the rule text; Generate positive samples based on the data that needs to be retained in the sample examples; Based on the data that needs to be prohibited in the sample examples, generate negative samples; The sample set is constructed using the positive and negative samples.

7. The method according to claim 6, wherein, The step of constructing the sample set using the positive samples and the negative samples includes: When the number of positive or negative samples is lower than a preset threshold, a supplementary sample corresponding to the prohibition rule is generated using a preset sample generation model. The sample set is constructed using the positive samples, the negative samples, and the supplementary samples.

8. The method according to claim 4, wherein, The step of training the parameter fine-tuning module based on the backbone model, according to any prohibition rule and the sample set corresponding to the prohibition rule, to obtain a pluggable prohibition module corresponding to the prohibition rule includes: Based on the backbone model and the parameter fine-tuning module, a model to be trained is generated; The model to be trained is trained using the sample set to obtain the pluggable prohibition module.

9. The method according to claim 8, wherein, The step of generating a model to be trained based on the backbone model and the parameter fine-tuning module includes: Initialize the adapter parameters of the parameter fine-tuning module; Freeze the backbone parameters of the backbone model; The parameter fine-tuning module is injected into the linear layer of the backbone model to generate the model to be trained.

10. The method according to claim 9, wherein, The step of training the model to be trained using the sample set to obtain the pluggable prohibition module includes: The forgetting loss is determined using negative samples from the sample set; the forgetting loss includes multiple sub-losses weighted by category. Determine the retention loss using the positive samples in the sample set; Based on the Fisher information of the adapter parameters, determine the elastic consolidation loss; The model to be trained is trained based on the forgetting loss, the retention loss, and the elastic consolidation loss to obtain the pluggable prohibition module.

11. The method according to claim 10, wherein, The training of the model to be trained includes: A total loss is constructed based on the forgetting loss, the retention loss, and the resilient consolidation loss; the total loss is configured to optimize the forgetting loss in the gradient ascent direction and the retention loss and the resilient consolidation loss in the gradient descent direction. The total loss is used to train the model to be trained, and the pluggable prohibition module is obtained.

12. The method according to claim 10, wherein, The training of the model to be trained includes: Based on the aforementioned forgetting loss, a gradient ascent stage loss is constructed using the gradient ascent algorithm. Based on the retention loss and the elastic consolidation loss, a gradient descent stage loss is constructed using the gradient descent algorithm; Based on the gradient ascent phase loss and the gradient descent phase loss, the model to be trained is alternately optimized and trained to obtain the pluggable prohibition module.

13. The method according to claim 4, wherein, The method further includes: When more than one pluggable disabling module is selected, priority is assigned to each pluggable disabling module according to a preset stacking rule; Based on the stated priority, after handling the conflicts between the pluggable disabling modules, each of the pluggable disabling modules is combined.

14. The method according to claim 1, wherein, The step of loading the pluggable prohibition module into the backbone model according to the prohibition strength to form a model instance for the current inference task includes: The forward propagation increment is determined based on the parameters of the pluggable prohibition module and the prohibition strength; The forward propagation increment is added to the initial forward propagation function of the backbone model to obtain the optimized forward propagation function; Based on the optimized forward pass function, a model instance is formed for the current inference task.

15. The method according to claim 1, wherein, The step of using the model instance to perform reasoning to obtain a reasoning result corresponding to the user input includes: Using the model instance, inference is performed to obtain initial inference results; According to the preset filtering rules, the filter is invoked to process the initial inference result, and the inference result is obtained.

16. A model reasoning device based on knowledge prohibition, comprising: The input parsing module is used to determine one or more prohibition rules and the prohibition strength corresponding to each prohibition rule in response to user input; The forgetting call module is used to call at least one corresponding pluggable prohibition module from a preset module library according to the prohibition rule; the module library includes at least one of the pluggable prohibition modules, and the pluggable prohibition module is configured to forget the knowledge corresponding to the prohibition rule; An instance building module is used to load the pluggable prohibition module into the backbone model according to the prohibition strength, forming a model instance for the current inference task; The model reasoning module is used to perform reasoning using the model instance to obtain a reasoning result corresponding to the user input.

17. An electronic device comprising: At least one processor; as well as A memory that is communicatively connected to at least one processor; wherein, The memory stores instructions that can be executed by at least one processor to enable the at least one processor to perform the method of any one of claims 1-15.

18. A non-transitory computer-readable storage medium storing computer instructions, wherein, Computer instructions are used to cause a computer to perform the method according to any one of claims 1-15.

19. A computer program product comprising a computer program stored on a storage medium, wherein the computer program, when executed by a processor, implements the method according to any one of claims 1-15.

Images