Large model refusal response elimination method and device, storage medium and electronic equipment

Abstract

The invention provides a large model refusal response elimination method and device, a storage medium and electronic equipment, and relates to the field of large language models. The electronic equipment obtains a mistaken rejection sample set and a conventional sample set; obtaining a first activation vector set when the to-be-processed model processes the false rejection sample set and a second activation vector set when the to-be-processed model processes the conventional sample set; determining an answer rejection network layer from the to-be-processed model according to the difference between the first activation vector set and the second activation vector set; and performing intervention on the answer rejection network layer, so that the to-be-processed model can normally process the harmless problem which is mistakenly rejected before intervention. Thus, by comparing the internal activation modes of the model for harmless but rejected questions and normally answerable questions, the rejection network layers dominating rejection behaviors are identified, and directional intervention is performed for the rejection network layers, so that the excessive defense response of the model can be weakened on the premise of minimizing the influence on other functions.

Description

Technical Field

[0001] This application relates to the field of large language models, and more specifically, to a method, apparatus, storage medium, and electronic device for large model rejection response elimination. Background Technology

[0002] Large models refer to general artificial intelligence models trained on a large number of parameters and massive amounts of data. These models have powerful language understanding and generation capabilities and can handle a variety of complex tasks, including question answering, reasoning, and creation.

[0003] However, in practical use, large models often exhibit a tendency to refuse responses. That is, when receiving specialized requests from certain domains, even if the requests themselves are harmless and reasonable, the model may misjudge them as potentially involving sensitive or dangerous content and actively refuse to respond. This phenomenon typically manifests as outputting standardized rejection statements such as "I cannot provide this information" or "This is prohibited content," or avoiding the question by changing the subject. For example, in a medical context, terms describing anatomical structures or imaging diagnoses might be misidentified as pornographic content; in the cybersecurity field, technical discussions about vulnerability reproduction might be intercepted as malicious attack guidance.

[0004] Therefore, this refusal to respond can sometimes be significantly inconvenient, especially in professional environments that heavily rely on accurate responses. Frequent false rejections can significantly reduce the model's practical usability. Users cannot obtain the professional support they need, leading to decreased work efficiency and even affecting the formulation of critical decisions. Furthermore, because the model does not truly understand the user's intent but mechanically triggers security rules, its responses often lack contextual adaptability, further undermining the trust and effectiveness of human-computer interaction.

[0005] Research has found that the biggest problem with current intervention methods is that they overemphasize reducing the rejection rate by adopting full-layer or coarse-grained interventions, which, while eliminating false rejections, damage the model's linguistic fluency, reasoning consistency, and factual accuracy. Summary of the Invention

[0006] To overcome at least one deficiency in the prior art, this application provides a large model rejection response elimination method, apparatus, storage medium, and electronic device, comprising: In a first aspect, this application provides a method for eliminating rejection responses in a large model, the method comprising: Obtain a false rejection sample set and a regular sample set, wherein the false rejection sample set includes harmless questions that would be incorrectly rejected by the model to be processed, and the regular sample set includes questions that the model to be processed is willing to answer normally; Obtain the first activation vector set when the model to be processed processes the false rejection sample set, and the second activation vector set when processing the regular sample set; Based on the difference between the first activation vector set and the second activation vector set, the rejection network layer is determined from the model to be processed; Intervene the rejection network layer so that the model to be processed can properly handle harmless questions that would otherwise be incorrectly rejected before the intervention.

[0007] Secondly, this application provides a large-scale rejection response elimination device, the device comprising: The sample preparation module is used to obtain a false rejection sample set and a regular sample set. The false rejection sample set includes harmless questions that will be incorrectly rejected by the model to be processed, and the regular sample set includes questions that the model to be processed is willing to answer normally. The activation vector module is used to obtain the first activation vector set when the model to be processed processes the false rejection sample set and the second activation vector set when processing the regular sample set; The rejection identification module is used to determine the rejection network layer from the model to be processed based on the difference between the first activation vector set and the second activation vector set; The rejection intervention module is used to intervene in the rejection network layer so that the model to be processed can properly handle harmless questions that would otherwise be incorrectly rejected before the intervention.

[0008] Thirdly, this application provides a storage medium storing a computer program that, when executed by a processor, implements the large model rejection response elimination method.

[0009] Fourthly, this application provides an electronic device, which includes a processor and a memory, wherein the memory stores a computer program, and the computer program, when executed by the processor, implements the large model rejection elimination method.

[0010] Compared with the prior art, this application has the following beneficial effects: The large-scale model rejection elimination method, apparatus, storage medium, and electronic device provided in this application involve the electronic device acquiring a false rejection sample set and a regular sample set. The false rejection sample set includes harmless questions that would be incorrectly rejected by the model to be processed, while the regular sample set includes questions that the model to be processed is willing to answer normally. The device acquires a first activation vector set when processing the false rejection sample set and a second activation vector set when processing the regular sample set. Based on the difference between the first and second activation vector sets, a rejection network layer is identified from the model to be processed. Intervention is applied to the rejection network layer to enable the model to normally process harmless questions that would be incorrectly rejected before the intervention. Thus, by comparing the model's internal activation patterns for harmless but rejected questions and normally answerable questions, the rejection network layer that dominates the rejection behavior is identified, and targeted intervention is applied to these rejection network layers, which can reduce the model's overly defensive reaction while minimizing the impact on other functions. Attached Figure Description

[0011] To more clearly illustrate the technical solutions of the embodiments of this application, the accompanying drawings used in the embodiments will be briefly introduced below. It should be understood that the following drawings only show some embodiments of this application and should not be regarded as a limitation of the scope. For those skilled in the art, other related drawings can be obtained based on these drawings without creative effort.

[0012] Figure 1 A flowchart illustrating the large model rejection response elimination method provided in this application embodiment; Figure 2 A schematic diagram illustrating the process details of step S3 provided in an embodiment of this application; Figure 3 A schematic diagram illustrating the process details of step S3-3 provided in the embodiments of this application; Figure 4 A schematic diagram of the structure of the large model rejection response elimination device provided in the embodiments of this application; Figure 5 This is a schematic diagram of the structure of an electronic device provided in an embodiment of this application. Detailed Implementation

[0013] To make the objectives, technical solutions, and advantages of the embodiments of this application (hereinafter referred to as "the embodiments") clearer, the technical solutions of the embodiments of this application will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of this application, and not all embodiments. The components of the embodiments of this application described and shown in the accompanying drawings can generally be arranged and designed in various different configurations.

[0014] Therefore, the following detailed description of the embodiments of this application provided in the accompanying drawings is not intended to limit the scope of the claimed application, but merely to illustrate selected embodiments of the application. All other embodiments obtained by those skilled in the art based on the embodiments of this application without inventive effort are within the scope of protection of this application.

[0015] It should be noted that similar labels and letters in the following figures indicate similar items. Therefore, once an item is defined in one figure, it does not need to be further defined and explained in subsequent figures.

[0016] In the description of this application, it should be noted that the terms "first," "second," "third," etc., are used only for distinguishing descriptions and should not be construed as indicating or implying relative importance. Furthermore, the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such a process, method, article, or apparatus. Without further limitations, an element defined by the phrase "comprising one..." does not exclude the presence of other identical elements in the process, method, article, or apparatus that includes said element.

[0017] Based on the above statement, as introduced in the background section, the biggest problem with current intervention methods is that they excessively pursue a reduction in the rejection rate by adopting full-layer or coarse-grained interventions, which, while eliminating false rejections, damages the model's linguistic fluency, reasoning consistency, and factual accuracy.

[0018] For example, when a medical professional asks a large model, "How can I identify ground-glass nodules in the lungs using CT images?", it is a harmless and clinically significant professional question. However, because terms such as "nodule" and "image recognition" may be associated with sensitive or lesion descriptions in the training data, the model develops rejection directions across multiple network layers, causing it to misjudge the content as high-risk and refuse to answer.

[0019] To eliminate false rejections, existing intervention methods typically perform projection elimination of activation vectors uniformly across dozens of network layers from the intermediate to the output layer, forcibly erasing the average difference direction associated with rejection in each layer. This approach requires coarse-grained intervention across all layers. While it can reduce the overall rejection rate to some extent, its broad scope fails to distinguish which layers truly dominate rejection behavior and which primarily support linguistic logic and factual expression. Consequently, while suppressing false rejections, it also disrupts the neural pathways responsible for maintaining semantic coherence and the accuracy of medical knowledge. Ultimately, this can lead to issues such as incoherent sentences, broken reasoning chains, and even erroneous denial of common disease features when the model answers other routine questions, severely damaging the model's usability and credibility in real-world medical scenarios.

[0020] It should be noted that the defects in the solutions in the prior art are the result of practice and careful research. Therefore, the discovery process of the above problems and the solutions proposed by the embodiments of this application in the following text should be regarded as contributions to this application in the process of invention and creation, and should not be understood as technical content known to those skilled in the art.

[0021] Based on the discovery of the above-mentioned technical problems, this embodiment provides a method for eliminating large model rejection responses. For example... Figure 1 As shown, the method includes: S1, obtain the false rejection sample set and the regular sample set.

[0022] The false rejection sample set includes harmless questions that the model to be processed would incorrectly reject, while the regular sample set includes questions that the model to be processed is willing to answer normally.

[0023] S2, obtain the first activation vector set when the model to be processed processes the false rejection sample set, and the second activation vector set when processing the regular sample set.

[0024] S3. Based on the difference between the first activation vector set and the second activation vector set, determine the rejection network layer from the model to be processed.

[0025] S4 intervenes in the rejection network layer so that the model under treatment can properly handle harmless questions that would otherwise be incorrectly rejected before the intervention.

[0026] Thus, by comparing the model's internal activation patterns for harmless but rejected questions with normal answerable questions, the rejection network layers that dominate the rejection behavior can be identified. Targeted interventions on these rejection network layers can reduce the model's over-defensive response while minimizing the impact on other functions.

[0027] It should be understood that the electronic device implementing this large-model rejection-response elimination method can be a computing device with data processing and model inference capabilities. Specifically, such electronic devices include, but are not limited to, servers, cloud computing platforms, high-performance computing clusters, or workstations equipped with graphics processing units (GPUs), capable of loading and running large models to perform forward inference on the false rejection sample set and the regular sample set to collect activation vectors. During this process, the electronic device needs to have sufficient memory and computing power to support the reading and storage of activation states of multi-layer neural networks.

[0028] Taking a server as an example, the server can be a single server or a group of servers. The server group can be centralized or distributed (e.g., the servers can be a distributed system). In some embodiments, the server can be local or remote relative to the user terminal. In some embodiments, the server can be implemented on a cloud platform; by way of example only, a cloud platform can include private cloud, public cloud, hybrid cloud, community cloud, distributed cloud, inter-cloud, multi-cloud, etc., or any combination thereof. In some embodiments, the server can be implemented on an electronic device having one or more components.

[0029] To make the solution provided in this embodiment clearer, the server is used as an electronic device for implementing the large model rejection elimination method, and in conjunction with... Figure 1 Each step of the method is described in detail. However, it should be understood that the operations in the flowchart may not be implemented in sequence, and steps without logical contextual relationships may be reversed in order or performed simultaneously. Furthermore, those skilled in the art, guided by the content of this application, may add one or more other operations to the flowchart, or remove one or more operations from the flowchart. See also... Figure 1 The method includes: S1, obtain the false rejection sample set and the regular sample set.

[0030] The false rejection sample set includes harmless questions that the model to be processed would incorrectly reject, while the regular sample set includes questions that the model to be processed is willing to answer normally.

[0031] In practical applications, the false rejection sample set refers to the dataset containing harmless questions that the model might mistakenly reject. These questions are semantically legitimate professional requests, such as descriptions of anatomical structures in the medical field or technical discussions about vulnerability reproduction experiments in the cybersecurity field. However, they are rejected because the model misjudges them as harmful content due to the sensitivity of the terminology. The normal sample set, on the other hand, refers to the dataset containing questions that the model is willing to answer normally, used to characterize the model's normal response patterns in non-sensitive contexts.

[0032] It is important to note that constructing these two types of sample sets requires designing representative questions based on the core terminology of the target vertical domain and introducing diverse contextual variations to cover different expressions and usage scenarios. In this process, it is crucial to ensure sufficient diversity in semantic expression, sentence structure, and input format among the samples to avoid analytical bias due to a single sample type.

[0033] Based on the above embodiments' description of the false rejection sample set and the regular sample set, please refer to [link to previous document]. Figure 1 Next, for Figure 1 Step S2 will be explained below: S2, obtain the first activation vector set when the model to be processed processes the false rejection sample set, and the second activation vector set when processing the regular sample set.

[0034] In this embodiment, the model to be processed includes multiple predetermined candidate network layers; the first activation vector set and the second activation vector set are output by the multiple candidate network layers.

[0035] It should be understood that obtaining the first and second activation vector sets of the model under test when processing the false rejection sample set and the regular sample set is intended to capture the differences in the model's response to different types of problems.

[0036] Specifically, the model to be processed refers to a large language model that requires optimization of rejection behavior. This model includes multiple pre-determined candidate network layers, which are key network layers selected for analysis and intervention. These layers are typically located in the residual pathways or feedforward network outputs after the outputs of mid-to-high-level self-attention mechanisms. During this process, the server loads the model to be processed in evaluation mode and disables randomization mechanisms such as dropout to ensure the stability and reproducibility of the inference process. Subsequently, activation capture hooks are registered at the selected candidate layers to capture the hidden state outputs generated by each layer when receiving input prompts. In practice, the false rejection sample set and the regular sample set are input into the model in batches. During forward propagation, the hidden activation tensors corresponding to each candidate network layer are recorded, thus forming the first activation vector set and the second activation vector set, respectively.

[0037] Thus, this step obtains the performance of the model under test when processing two different sample sets by collecting neural activation data of key layers.

[0038] Based on the descriptions of the first activation vector set and the second activation vector set in the above embodiments, please refer to... Figure 1 Next, for Figure 1 Step S3 will be explained below: S3. Based on the difference between the first activation vector set and the second activation vector set, determine the rejection network layer from the model to be processed.

[0039] Research has found that traditional methods typically use the mean activation difference across all or most layers as the rejection direction, and then perform extensive projection elimination or bias injection based on this. However, this approach fails to differentiate the actual contribution of each network layer to the rejection behavior, treating all layers equally, thus failing to identify the key neural pathways that truly dominate false rejections. Since activation differences may exist in multiple layers but only a few layers have a causal effect, coarse-grained methods are prone to interfering with too many irrelevant layers, thereby impairing language fluency and reasoning consistency. Therefore, as... Figure 2 As shown, this embodiment provides the following optional implementation methods for step S3: S3-1, multiple candidate network layers are treated as network layers to be processed.

[0040] S3-2, obtain the first activation vector subset and the second activation vector subset output by the network layer to be processed from the first activation vector set and the second activation vector set, respectively.

[0041] In this embodiment, the server needs to analyze multiple candidate network layers independently, treating each as a layer to be processed. During this process, for each layer to be processed, a first subset of activation vectors and a second subset of activation vectors output by that layer are extracted from the first set of activation vectors and the second set of activation vectors, respectively. The former corresponds to the set of hidden states of that layer when the model incorrectly rejects a harmless question, while the latter represents the activation response of that layer when the model normally answers a regular question.

[0042] Based on the above explanation of the first and second activation vector subsets in step S3-2, please refer to [link to previous text]. Figure 2 Step S3 also includes: S3-3, based on the difference between the first activation vector subset and the second activation vector subset, obtain the rejection direction vector of the network layer to be processed.

[0043] Among them, the rejection direction vector represents the vector that causes the network layer to reject the response.

[0044] Research has found that simply calculating the difference between the first and second activation vector subsets to obtain the rejection direction vector is insufficient. This results in a rejection direction vector that is sensitive to anomalous samples and exhibits poor stability due to the lack of sufficient integration of discriminative signals. Consequently, the direction estimation is coarse and lacks interpretability. Therefore, it fails to effectively distinguish between genuine rejection-related directions and noise interference, leading to over-ablation or intervention failure, and ultimately making it difficult to accurately suppress false rejections while preserving language proficiency. Therefore, if... Figure 3 As shown, this embodiment provides the following optional implementation methods for step S3-3: S3-3-1, subtract the fusion vector of the first activation vector subset from the fusion vector of the second activation vector subset to obtain the initial rejection vector.

[0045] This embodiment can be understood as subtracting the fusion vector of the first activation vector subset from the fusion vector of the second activation vector subset to obtain the initial rejection vector. The purpose is to identify the directional differences related to rejection behavior in a specific network layer to be processed.

[0046] Specifically, the fused vector of the first activation vector subset refers to the center vector calculated by the server using a robust mean method on the first activation vector subset output by the falsely rejected samples at this layer. This robust mean includes statistical estimation methods that are insensitive to outliers, such as truncated means or Huber means, to reduce the impact of individual outliers on the overall mean. Similarly, the fused vector of the second activation vector subset refers to the center vector obtained by the server using the same method to calculate the second activation vector subset output by the regular samples at this layer.

[0047] In this process, by subtracting the two fused vectors, a difference vector representing the systematic shift in the two response modes is obtained, i.e., the initial rejection vector. This process can be expressed as:

[0048] In the formula, Indicates the first The initial rejection vector of the layer, This represents the fusion vector of the first subset of activation vectors (corresponding to falsely rejected samples), which is the robust mean of the activations of harmful class samples at this layer. This represents the fusion vector of the second activation vector subset (corresponding to regular samples), which is the robust mean of the activation of harmless samples in this layer.

[0049] This demonstrates that by utilizing robust statistical methods, the robustness of direction estimation is improved, effectively mitigating the problem of inaccurate direction caused by noise or extreme activation interference in the traditional mean difference method.

[0050] Based on the above explanation of the initial rejection vector in step S3-3-1, please refer to [link / reference]. Figure 3 Step S3-3 also includes: S3-3-2, the rejection direction of the initial rejection vector is processed using a pre-trained augmentation model to obtain the augmented rejection vector.

[0051] This embodiment can be understood as follows: by introducing a supervised learning mechanism, the initial rejection vector is directionally enhanced using a pre-trained augmentation model, thereby improving the discriminative ability and semantic accuracy of the vector in identifying and suppressing false rejection behavior.

[0052] It should be understood that the initial rejection vector is a direction vector derived from the difference in the mean activation values ​​of the network layers being processed between falsely rejected samples and regular samples. However, it only reflects statistical offset and lacks modeling of the causal relationship between whether a rejection was actually triggered. Therefore, in practical applications, the server uses a pre-trained small-scale linear discriminator as an augmentation model, employing "rejection labels" or "rejection trigger features" as supervisory signals to learn weights that can effectively distinguish between rejection and non-rejection responses. Based on this, the weight direction is integrated into the initial rejection vector to form a new, more discriminative direction. The corresponding expression is:

[0053] in, This is the enhanced rejection vector. Let be the initial rejection vector, where This is an adjustable scaling factor used to control the degree of contribution in the supervision direction. This indicates a normalization operation, ensuring that the resulting vector has a unit length, which facilitates the numerical stability of subsequent projection interventions.

[0054] In this way, not only is the information of the original activation differences preserved, but also the discriminative prior from the labeled data is injected, so that the final enhanced rejection vector can more accurately point to the neural pathways that actually cause the rejection behavior, thereby improving the effectiveness and safety of the intervention.

[0055] Based on the enhanced rejection vector in step S3-3-2 of the above implementation, see below. Figure 3 Step S3 also includes: S3-3-3, perform principal component analysis on the enhanced rejection vector to obtain the rejection direction vector of the network layer to be processed.

[0056] This can be understood as follows: in this embodiment, the enhanced rejection vector is structurally optimized by using dimensionality reduction and subspace filtering to extract the most stable and representative directional components, thereby improving the robustness and manipulation of the rejection direction vector.

[0057] Specifically, performing principal component analysis (PCA) on the enhanced rejection vectors involves performing PCA on the intra-class covariance matrix of the activation space containing that direction to identify the low-dimensional subspace where data variation is most significant. In this process, the server first calculates the intra-class covariance matrix for each category based on the activation distribution of false rejection samples and regular samples in the network layer to be processed. Then, by performing eigenvalue decomposition on the covariance matrix, a set of principal component directions sorted by variance contribution is obtained. Subsequently, only the first... The stable principal component subspace spanned by the principal components corresponding to the largest eigenvalues ​​is obtained. The enhanced rejection vector is projected into this subspace, and redundant or unstable components in the noise direction are removed to finally obtain the rejection direction vector. The corresponding expression is:

[0058] In the formula, Indicates from the front Orthogonal projection operation on a subspace composed of principal components This is the rejection vector after discrimination enhancement.

[0059] It is evident that by introducing a principal component denoising mechanism, the directional fluctuations caused by sample perturbation or model randomness are effectively suppressed, ensuring that the final rejection direction vector is concentrated on semantically relevant and statistically stable neural pathways, thereby enhancing the accuracy and safety of subsequent interventions.

[0060] Based on the above embodiment's explanation of the rejection direction vector in step S3-3, continue to refer to... Figure 2 Step S3 also includes: S3-4, intervene based on the rejection direction vector of the network layer to be processed, and evaluate the intervention effect score of the network layer to be processed.

[0061] It should be understood that relying solely on a single indicator, such as changes in the rejection rate, when evaluating the intervention effect on large-scale model rejection behavior lacks a systematic consideration of multidimensional impacts. Therefore, this embodiment also provides the following optional implementation methods for steps S3-4: S3-4-1, obtain the rejection benefit, general capability loss, security risk interception rate, and intervention stability of the network layer to be processed after intervention.

[0062] Among them, the rejection benefit represents the effectiveness of the intervention direction in reducing the false rejection rate of the model for professional and harmless requests; the degree of loss of general ability represents the negative impact of the intervention direction on the model's ability to understand and generate general language; the security risk interception rate represents the effect of the intervention direction on the model's interception of real and harmful requests; and the intervention stability represents the consistency of the intervention direction's behavior under different input variants. S3-4-2 weightedly integrates the rejection benefit, the degree of loss of general capabilities, the security risk interception rate, and the intervention stability to obtain the intervention effect score of the network layer to be processed.

[0063] This embodiment can be understood as providing a more comprehensive evaluation mechanism by introducing multiple dimensions of indicators and performing weighted fusion, which is used to evaluate the intervention effect score of candidate network layers, thereby realizing a comprehensive evaluation and priority ranking of the intervention results of different candidate network layers.

[0064] In practical applications, the server acquires key performance indicators of the network layer to be processed after intervention in the rejection direction, including the benefit of rejection removal, the degree of loss of general capabilities, the security risk interception rate, and the stability of the intervention. The following is an explanation of each of these evaluation indicators: The de-rejection benefit refers to whether the intervention can effectively reduce the model's false rejection rate for professional and harmless requests. In practice, a validation set containing typical false rejection questions (e.g., how to properly destroy expired fireworks?) is used. First, the original rejection rate of the model for this type of question in the uninterrupted state (e.g., 90%) is recorded. Then, after applying the current direction intervention, the model is retested to obtain a new rejection rate (e.g., reduced to 10%). The difference between the two is the de-rejection benefit. A lightweight scoring model can also be introduced to determine whether the output constitutes a valid answer in order to improve the evaluation accuracy.

[0065] The general ability loss measure whether the intervention impairs the model’s basic language understanding and reasoning abilities. It is determined by using a general task dataset (e.g., GSM8K math problems or MMLU common sense questions) as input and quantifying the impact by comparing the change in perplexity of the model’s generated answers or the decrease in task accuracy before and after the intervention. If the accuracy drops from 80% to 75%, it is recorded as a 5 percentage point ability loss.

[0066] The security risk interception rate reflects whether the model's ability to defend against real harmful content (e.g., manufacturing dangerous goods, committing fraud, etc.) is weakened after intervention. The process involves running the intervened model on a set of red-line questions and using an external security classifier (e.g., Llama-Guard) or rule engine to detect whether there are any violations in the output. The proportion of "defense failures" is counted as the score, which should ideally be close to zero; otherwise, this direction will be rejected.

[0067] Intervention stability characterizes the consistency of the intervention direction's behavior under different data distributions and prompt templates. In practice, the data is divided into multiple slices (e.g., group A and group B) or different prompt word formats are used (e.g., "Please answer..." and "You can tell me..."). The rejection direction vector for each group is calculated, and then cosine similarity is used to assess its directional consistency. The closer the similarity is to 1, the more stable the "rejection direction" of the corresponding layer is, regardless of data changes, indicating that the direction is more stable and reliable.

[0068] Based on this, the server linearly integrates the above four indicators according to preset weights to obtain the final intervention effect score. This is used to rank and optimize all candidate layers. Therefore, the relationship between rejection gain, general capability loss, security risk interception rate, and intervention stability and effectiveness score is as follows:

[0069] In the formula, Indicates the first Intervention effect score of the layer In order to refuse benefits, As for the degree of loss of general capabilities, To improve the security risk interception rate, To intervene in stability, These are the adjustment weights for the corresponding items, used to adjust the balance between the objectives according to different application scenarios.

[0070] In this way, the effects of intervention on multiple candidate network layers can be quantitatively evaluated and ranked based on the evaluation results, making it easier to scientifically select the optimal intervention location from multiple candidate network layers.

[0071] Based on the above embodiments, the intervention effect scores of each candidate network layer in steps S3-4 are further reviewed. Figure 2 Step S3 also includes: S3-5, Based on the intervention effect score of each candidate network layer, determine the non-responding network layer from multiple candidate network layers.

[0072] In this embodiment, based on the intervention effect score of each candidate network layer, the key network layer that contributes the most to eliminating false rejection behavior and has the least disturbance to the model's general ability is identified from multiple candidate network layers, thereby achieving precise and low-loss model behavior regulation.

[0073] Specifically, after obtaining the intervention effect scores of each candidate network layer, the server will sort all candidate network layers according to these scores, initially retaining a few layers with higher scores (e.g., the top 20 layers) as a set of candidate layers for further screening. Furthermore, this embodiment provides a comprehensive screening strategy to further optimize the selection results, including four criteria: contribution, robustness, redundancy, and position preference. Contribution requires that the selected layer significantly improves the rejection benefit after intervention; robustness emphasizes that the intervention of the selected layer should minimize the negative impact on the model's general capabilities; redundancy is used to control functional duplication between layers; when adjacent or similar layers have a highly consistent rejection direction, only a representative layer is retained to avoid superimposed perturbations caused by multiple interventions; position preference is based on experience, prioritizing network layers located in the middle to high-level range of the model structure (e.g., 30% to 60% of the total number of layers), as they are usually closer to the semantic abstraction and decision-making stages and are more suitable for undertaking the execution role of rejection logic.

[0074] In order to filter the candidate layer set from the above multiple criteria, this embodiment transforms it into a single candidate layer set. Find the optimal subset The optimization problem. In specific implementation, a state mask vector is initialized. ,in This represents the total number of layers in the model. Indicates the first The layer is currently optional; otherwise, it has been excluded.

[0075] First, the mask is initialized according to the position preference criterion, retaining only the layers in the middle and high-level ranges, and masking the bottom and top layers. The expression is:

[0076] Based on the above mask, the server iterates through the following selection strategy until the selected layer is found. Reaching the preset threshold Each iteration consists of three steps: First, calculate the current effective score, i.e., the original intervention effect score vector. With the current mask The element-wise product is obtained. This ensures that only valid scores that have not yet been shielded are retained. Second, use a greedy strategy to select the layer with the highest current effective score. And add this layer to the final main layer set. ; Third, perform redundancy suppression updates, not only for the selected layers... The corresponding mask is set to zero, and its neighborhood (e.g., before and after) is also set to zero. All layers of the layer are also set to unselectable, that is:

[0077] In this way, it can effectively prevent the repeated selection of overlapping functions at similar levels and realize cross-level redundancy control.

[0078] In summary, by using a multi-objective scoring and structured screening process to evaluate the intervention effect, the key layer that truly dominates the false rejection behavior can be accurately identified from multiple candidate network layers, which will then be the network layer that requires final intervention.

[0079] Based on the rejection network layer determined in the above embodiments, see further... Figure 1 Next, we will continue with... Figure 1 Step S4 will be explained below: S4 intervenes in the rejection network layer so that the model under treatment can properly handle harmless questions that would otherwise be incorrectly rejected before the intervention.

[0080] It should be understood that existing methods, by directly modifying all network layers of the model or coarsely intervening in key layers, are prone to side effects such as logical breaks, decreased factuality, or failure of safety boundaries. Therefore, an intervention mechanism is needed that can both target and regulate the core neural representations that lead to false rejections and maintain the overall stability of the model's behavior. In view of this, this embodiment provides the following optional implementation methods for step S4: S4-1, intervene in the output or weights of the rejection network layer according to the rejection direction vector of the rejection network layer.

[0081] In this embodiment, the effective suppression of false rejection is achieved through two orthogonal paths: dynamically adjusting the hidden state during inference to avoid rejection response, and allowing long-term stable false rejection capability to be solidified by slightly updating model parameters, thus balancing flexibility and durability.

[0082] Specifically, in practical applications, based on the above example, the rejection network layer that truly dominates the false rejection behavior is selected from multiple candidate network layers, and the rejection direction vector corresponding to that layer is obtained. This vector represents the first... The layer represents the semantic direction in the representation space that is highly relevant to the triggering model's rejection response. At this point, different intervention paths can be selected based on specific deployment requirements.

[0083] (1) Real-time correction of the output of the non-responding network layer during the inference phase: This refers to "intervening in the output of the non-responding network layer." This process occurs during the model's forward inference and does not alter the original model weights, making it a lossless and reversible runtime control mechanism. In practice, the input data is processed layer by layer through the model up to the current non-responding network layer, obtaining the hidden state of the original output of that layer. The server uses the determined rejection direction vector Perform joint projection elimination and adaptive rotation operations on the hidden state to generate a corrected hidden state. The transformation process is described by the following formula:

[0084] In the formula, the first term In Indicates to and Perform inner product This yields linear projection cancellation along the rejection direction, which is used to weaken the component strength of the activation vector in that sensitive direction. This is the dynamic intervention intensity coefficient, whose value is based on the currently input risk scoring function. The result is obtained by weighted calculation using the Sigmoid function, i.e. This enables adaptive control that allows for stronger intervention under high-risk scenarios (i.e., strong intervention for questions with a high risk of refusal) and lighter intervention under low-risk scenarios (i.e., slight intervention for questions with a low risk of refusal).

[0085] Second item A nonlinear orientation rotation mechanism is introduced to appropriately redirect suppressed orientation information to the adjacent semantic space, thereby reducing semantic distortion caused by direct subtraction. Here; The rotation intensity is adaptively adjusted based on the output semantic fidelity feedback. For the parameterized Givens rotation operator, its optimal rotation angle Determined by minimizing semantic distortion:

[0086] In the formula, the first term The second item measures the magnitude of the change in activation, encouraging smaller perturbations; Then evaluate the semantic consistency before and after the modification, such as by calculating the cosine distance using a contrastive learning encoder or by assessing the task relevance score based on a few-shot classifier. Hyperparameters Used to balance the trade-offs between the two. The final choice It can minimize the damage to the original semantic content while avoiding rejection behavior to the greatest extent.

[0087] Therefore, this intervention method ensures that the original semantic content is preserved as much as possible while changing the activation direction, preventing logical breaks or irrelevant answers.

[0088] (2) During the training or fine-tuning phase, the weight matrix of this layer is persistently modified in low-rank form. This involves intervening in the weights of the rejection network layer. This process is a persistent modification at the parameter level and is suitable for scenarios requiring long-term deployment and prioritizing inference efficiency. Specifically, it involves adjusting the weight matrix of the selected rejection network layer. A low-rank update strategy is used to apply small increments to generate the updated weight matrix. This ensures that changes are concentrated in the subspace associated with the direction of rejection, avoiding resource consumption and catastrophic forgetting problems caused by global retraining.

[0089] This weight update can be achieved through adaptive rank-one patching and enhanced LoRA (Low-Rank Adaptation) update methods.

[0090] The adaptive rank-one patch (Rank-OnePatch) is expressed as follows:

[0091] In the formula, the direction vector Explicitly bind to the identified rejection direction vector to ensure that the update operates on the target semantic axis; the other side vector This can be obtained by solving the following optimization problem:

[0092] The objective function requires the updated model to perform well on the general capability test set. Minimizes behavioral changes, thus constraining The direction of the parameter value allows parameter updates to both mitigate the tendency to refuse responses and maintain basic language functionality. It is a preset scaling factor that can be normalized and adjusted according to different layers or different model structures to adapt to the differences in activation levels of each layer and improve the generalization and consistency of updates.

[0093] The enhanced LoRA (Low-Rank Adaptation) update method is expressed as follows:

[0094] In the formula, the matrix The row space is constrained to approximately tensor The one-dimensional subspace in which it resides, i.e. This restricts updates to the space dominated by the direction of rejection; while the matrix The optimization is then performed using gradient descent, and its loss function consists of a weighted sum of two terms:

[0095] In the formula, This represents capability preservation loss, used to maintain the model's performance stability on standard benchmark tasks. For example, it can be applied to a test set covering non-sensitive domains such as commonsense reasoning, language understanding, and mathematical computation. The difference between the output of the original model and the modified model is evaluated by constructing this loss term using metrics such as perplexity, accuracy reduction, or semantic similarity. The smaller the value, the better the model retains its core language capabilities.

[0096] This refers to the loss from rejection, used to reduce the rejection rate of harmless requests in specialized fields. This loss is typically based on a sample set of false rejections consisting of typical issues from fields such as medicine, cybersecurity, and law. Calculations show that the degree of improvement can be quantified by the proportion of the model shifting from "refusing to answer" to "generating normally" before and after statistical intervention. The smaller the value, the stronger the model's willingness and ability to respond to questions that should have been answered.

[0097] The two loss terms are multiplied by preset weighting coefficients respectively. and And by linearly weighting and combining them, the final overall objective function is formed. These two hyperparameters can be flexibly adjusted according to specific application scenarios: for example, in medical diagnostic scenarios, where safety and reliability are emphasized, they can be appropriately increased. The proportion of [something] can be increased; however, in high-availability scenarios such as red team testing or vulnerability analysis, the proportion can be increased. Prioritize reducing the false rejection rate.

[0098] In addition, orthogonality constraints are introduced to enforce The column vectors are mutually orthogonal to improve numerical stability and prevent parameter redundancy.

[0099] To further mitigate the risk of abrupt changes from permanent modifications, a gradual weight update strategy can be employed. In this process, the weights are not changed drastically all at once, but rather the differences are gradually added in stages. Each stage of the update follows the recursive relationship below:

[0100] in, To progress over time The gradually increasing learning rate factor allows for small initial attempts and steady convergence in the later stages; The weighted difference term is calculated based on the aforementioned low-rank method. After each stage of update is completed, the model's overall performance on the validation set is automatically evaluated, including indicators such as false rejection rate, general capability score, and security interception rate. Only when it is confirmed that there is no significant degradation will the next stage of update continue, thereby achieving safe and controllable gradual evolution.

[0101] This demonstrates that by implementing real-time intervention and persistent updates to the output or weights of the rejection network layer, a flexible range of options is provided for security, availability, and maintainability in different business scenarios.

[0102] In summary, this embodiment identifies the rejection network layers that dominate the rejection behavior by comparing the model's internal activation patterns for harmless but rejected questions with normal answerable questions, and then targets these rejection network layers with targeted interventions. This approach can reduce the model's overly defensive response while minimizing the impact on other functions.

[0103] Based on the same inventive concept as the large model rejection cancellation method provided in this embodiment, this embodiment also provides a large model rejection cancellation device. This device includes at least one software functional module that can be stored in a memory or embedded in an electronic device. The processor in the electronic device executes the executable module stored in the memory. For example, the software functional module and computer program included in this device. Please refer to... Figure 4 Functionally, the device may include: The sample preparation module 11 is used to obtain a false rejection sample set and a regular sample set. The false rejection sample set includes harmless questions that will be incorrectly rejected by the model to be processed, and the regular sample set includes questions that the model to be processed is willing to answer normally. Activation vector module 12 is used to obtain the first activation vector set when the model to be processed processes the false rejection sample set and the second activation vector set when processing the regular sample set. The rejection identification module 13 is used to determine the rejection network layer from the model to be processed based on the difference between the first activation vector set and the second activation vector set. The rejection intervention module 14 is used to intervene in the rejection network layer so that the model under treatment can properly handle harmless questions that would otherwise be incorrectly rejected before the intervention.

[0104] In this embodiment, the sample preparation module 11 is used to implement Figure 1 In step S1, the activation vector module 12 is used to implement... Figure 1 In step S2, the rejection recognition module 13 is used to implement... Figure 1 In step S3, the refusal-to-answer intervention module 14 is used to implement... Figure 1 Step S4 in the above process. Therefore, for a detailed description of each of the above modules, please refer to the specific implementation of the corresponding step.

[0105] Optionally, the model to be processed includes multiple pre-determined candidate network layers; The first and second activation vector sets are output by multiple candidate network layers.

[0106] Optionally, the rejection detection module 13 is also specifically used for: Multiple candidate network layers are treated as network layers to be processed. Obtain the first activation vector subset and the second activation vector subset output by the network layer to be processed from the first activation vector set and the second activation vector set, respectively; Based on the difference between the first activation vector subset and the second activation vector subset, the rejection direction vector of the network layer to be processed is obtained, wherein the rejection direction vector represents the vector that causes the rejection line of the network layer to be processed; Intervention is performed based on the rejection direction vector of the network layer to be processed, and the intervention effect score of the network layer to be processed is evaluated. Based on the intervention effect score of each candidate network layer, the non-responding network layer is determined from multiple candidate network layers.

[0107] Optionally, the rejection detection module 13 is also specifically used for: Subtract the fusion vector of the first activation vector subset from the fusion vector of the second activation vector subset to obtain the initial rejection vector; The rejection direction of the initial rejection vector is processed using a pre-trained augmentation model to obtain the augmented rejection vector; Principal component analysis was performed on the enhanced rejection vector to obtain the rejection direction vector of the network layer to be processed.

[0108] Optionally, the rejection detection module 13 is also specifically used for: The study obtains the rejection benefit, general capability loss, security risk interception rate, and intervention stability of the network layer to be processed after intervention. Among them, rejection benefit represents the effectiveness of the intervention direction in reducing the false rejection rate of the model for professional and harmless requests; general capability loss represents the negative impact of the intervention direction on the model's ability to understand and generate general language; security risk interception rate represents the effect of the intervention direction on the model's interception of real and harmful requests; and intervention stability represents the consistency of the intervention direction's behavior under different input variants. The intervention effect score of the network layer to be processed is obtained by weighting and integrating the rejection benefit, the degree of loss of general capabilities, the security risk interception rate, and the intervention stability.

[0109] Optionally, the refusal-to-answer intervention module 14 is also specifically used for: The output or weights of the rejection network layer can be intervened based on the rejection direction vector of the rejection network layer.

[0110] In addition, the functional modules in the various embodiments of this application can be integrated together to form an independent part, or each module can exist independently, or two or more modules can be integrated to form an independent part.

[0111] It should also be understood that if the above embodiments are implemented as software functional modules and sold or used as independent products, they can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of this application, in essence, or the part that contributes to the prior art, or part of the technical solution, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes several instructions to cause a computer device (which may be a personal computer, a server, or a network device, etc.) to execute all or part of the steps of the methods described in the various embodiments of this application.

[0112] Therefore, this embodiment also provides a storage medium, which is a computer-readable storage medium. This storage medium stores a computer program, which, when executed by a processor, implements the large-scale denial-of-response elimination method provided in this embodiment. The storage medium can be any medium capable of storing program code, such as a USB flash drive, external hard drive, read-only memory (ROM), random access memory (RAM), magnetic disk, or optical disk.

[0113] Please refer to Figure 5 This embodiment provides an electronic device for implementing a large model rejection response elimination method. The electronic device may include a processor 22 and a memory 21. The memory 21 stores a computer program, and the processor implements the large model rejection response elimination method provided in this embodiment by reading and executing the computer program corresponding to the above-described embodiments in the memory 21.

[0114] See also Figure 5 The electronic device also includes a communication unit 23. The memory 21, processor 22 and communication unit 23 are electrically connected to each other directly or indirectly through system bus 24 to realize data transmission or interaction.

[0115] The memory 21 can be an information recording device based on any electronic, magnetic, optical, or other physical principles, used to record execution instructions, data, etc. In some embodiments, the memory 21 can be, but is not limited to, volatile memory, non-volatile memory, memory drive, etc.

[0116] In some embodiments, the volatile memory may be random access memory (RAM); in some embodiments, the non-volatile memory may be read-only memory (ROM), programmable read-only memory (PROM), erasable programmable read-only memory (EPROM), electrically erasable programmable read-only memory (EEPROM), flash memory, etc.; in some embodiments, the storage drive may be a disk drive, solid-state drive, any type of storage disk (such as optical disc, DVD, etc.), or similar storage media, or a combination thereof.

[0117] The communication unit 23 is used to send and receive data over a network. In some embodiments, the network may include a wired network, a wireless network, a fiber optic network, a telecommunications network, an intranet, the Internet, a local area network (LAN), a wide area network (WAN), a wireless local area network (WLAN), a metropolitan area network (MAN), a public switched telephone network (PSTN), a Bluetooth network, a ZigBee network, or a near field communication (NFC) network, or any combination thereof. In some embodiments, the network may include one or more network access points. For example, the network may include wired or wireless network access points, such as base stations and / or network switching nodes, through which one or more components of the service request processing system can connect to the network to exchange data and / or information.

[0118] The processor 22 may be an integrated circuit chip with signal processing capabilities, and may include one or more processing cores (e.g., a single-core processor or a multi-core processor). By way of example only, the processor described above may include a Central Processing Unit (CPU), an Application Specific Integrated Circuit (ASIC), an Application Specific Instruction-set Processor (ASIP), a Graphics Processing Unit (GPU), a Physics Processing Unit (PPU), a Digital Signal Processor (DSP), a Field Programmable Gate Array (FPGA), a Programmable Logic Device (PLD), a controller, a microcontroller unit, a Reduced Instruction Set Computing (RISC) computer, or a microprocessor, or any combination thereof.

[0119] Understandable. Figure 5The structure shown is for illustrative purposes only. Electronic devices may also have more advanced features. Figure 5 Showing more or fewer components, or having with Figure 5 The different configurations shown. Figure 5 The components shown can be implemented using hardware, software, or a combination thereof.

[0120] It should be understood that the apparatus and methods disclosed in the above embodiments can also be implemented in other ways. The apparatus embodiments described above are merely illustrative. For example, the flowcharts and block diagrams in the accompanying drawings show the architecture, functionality, and operation of possible implementations of apparatus, methods, and computer program products according to various embodiments of this application. In this regard, each block in a flowchart or block diagram may represent a module, segment, or portion of code containing one or more executable instructions for implementing a specified logical function. It should also be noted that in some alternative implementations, the functions marked in the blocks may occur in a different order than those marked in the drawings. For example, two consecutive blocks may actually be executed substantially in parallel, and they may sometimes be executed in reverse order, depending on the functions involved. It should also be noted that each block in a block diagram and / or flowchart, and combinations of blocks in block diagrams and / or flowcharts, can be implemented using a dedicated hardware-based system that performs the specified function or action, or using a combination of dedicated hardware and computer instructions.

[0121] The above descriptions are merely various embodiments of this application, but the scope of protection of this application is not limited thereto. Any variations or substitutions that can be easily conceived by those skilled in the art within the technical scope disclosed in this application should be included within the scope of protection of this application. Therefore, the scope of protection of this application should be determined by the scope of the claims.

Claims

1. A large model NACK elimination method, characterized in that, The method comprises: obtaining a false rejection sample set and a normal sample set, wherein the false rejection sample set comprises harmless questions that will be falsely rejected by a to-be-processed model, and the normal sample set comprises questions that the to-be-processed model is willing to answer normally; obtaining a first activation vector set when the to-be-processed model processes the false rejection sample set and a second activation vector set when the to-be-processed model processes the normal sample set; determining a rejection network layer from the to-be-processed model according to a difference between the first activation vector set and the second activation vector set; intervening in the rejection network layer to enable the to-be-processed model to normally process harmless questions that will be falsely rejected before the intervention.

2. The large model disambiguation method of claim 1, wherein, The to-be-processed model comprises a plurality of predetermined candidate network layers; The first activation vector set and the second activation vector set are output by the plurality of candidate network layers.

3. The large model disambiguation method of claim 2, wherein, Determining a rejection network layer from the to-be-processed model according to a difference between the first activation vector set and the second activation vector set comprises: respectively taking the plurality of candidate network layers as to-be-processed network layers; respectively obtaining a first activation vector subset and a second activation vector subset output by the to-be-processed network layers from the first activation vector set and the second activation vector set; obtaining a rejection direction vector of the to-be-processed network layer according to a difference between the first activation vector subset and the second activation vector subset, wherein the rejection direction vector represents a vector leading to a rejection row of the to-be-processed network layer; intervening according to the rejection direction vector of the to-be-processed network layer and evaluating an intervention effect score of the to-be-processed network layer; determining a rejection network layer from the plurality of candidate network layers according to the intervention effect score of each candidate network layer.

4. The large model disambiguation method of claim 3, wherein, Obtaining a rejection direction vector of the to-be-processed network layer according to a difference between the first activation vector subset and the second activation vector subset comprises: subtracting a fusion vector of the first activation vector subset from a fusion vector of the second activation vector subset to obtain an initial rejection vector; processing a rejection direction of the initial rejection vector by using a pre-trained enhancement model to obtain an enhanced rejection vector; performing principal component analysis on the enhanced rejection vector to obtain the rejection direction vector of the to-be-processed network layer.

5. The large model disambiguation method of claim 3, wherein, Evaluating an intervention effect score of the to-be-processed network layer comprises: obtaining a rejection removal benefit, a general ability loss degree, a security risk interception rate and an intervention stability of the to-be-processed network layer after the intervention, wherein the rejection removal benefit represents effectiveness of an intervention direction in reducing a false rejection rate of the model on professional harmless requests; the general ability loss degree represents a negative influence degree of the intervention direction on general language understanding and generation ability of the model; the security risk interception rate represents an interception effect of the intervention direction on real harmful requests of the model; and the intervention stability represents behavior consistency of the intervention direction under different input variants; weighting and fusing the rejection removal benefit, the general ability loss degree, the security risk interception rate and the intervention stability to obtain the intervention effect score of the to-be-processed network layer.

6. The large model disambiguation method of claim 5, wherein, The relationship between the rejection yield, the general ability loss degree, the security risk interception rate, the intervention stability and the intervention effect is: In the formula, represents the intervention effect, represents the rejection yield, represents the general ability loss degree, represents the security risk interception rate, represents the intervention stability, , , , respectively represent preset weights.

7. The large model echo cancellation method of claim 3, wherein, Intervening the rejection network layer, including: Intervening the output or weight of the rejection network layer according to the rejection direction vector of the rejection network layer.

8. A large model NAK elimination apparatus characterized by comprising: The device includes: A sample preparation module configured to obtain a mis-rejection sample set and a regular sample set, wherein the mis-rejection sample set includes harmless questions that will be mis-rejected by a to-be-processed model, and the regular sample set includes questions that the to-be-processed model is willing to answer normally; An activation vector module configured to obtain a first activation vector set when the to-be-processed model processes the mis-rejection sample set and a second activation vector set when the to-be-processed model processes the regular sample set; A rejection identification module configured to determine a rejection network layer from the to-be-processed model according to the difference between the first activation vector set and the second activation vector set; A rejection intervention module configured to intervene the rejection network layer so that the to-be-processed model can normally process harmless questions that will be mis-rejected before intervention.

9. A storage medium, characterized by The storage medium stores a computer program, and the computer program realizes the large model rejection answer elimination method of any one of claims 1-7 when executed by the processor.

10. An electronic device, comprising: The electronic device includes a processor and a memory, and the memory stores a computer program, and the computer program realizes the large model rejection answer elimination method of any one of claims 1-7 when executed by the processor.

Images