Adaptive large model prompt attack and security evaluation method based on feedback learning

Abstract

The application provides a self-adaptive large model prompt attack and security evaluation method based on feedback learning, and belongs to the technical field of artificial intelligence security. The method comprises the following steps: constructing an attack library containing multiple text transformation attack strategies, and obtaining performance data of the attack strategies on a target model; then, the success rate, average score, R value and Q value of the attack strategies are calculated, and the optimal attack strategy is selected in descending order of the Q value; the strategy is applied to generate an adversarial input from an original malicious prompt, and the attack is judged to be successful or not by a pre-training evaluation model score after the adversarial input is submitted to the target model; if the attack is not successful, the strategy is reselected; if the attack is successful, the statistical data are updated and the score is recalculated; the strategy is iteratively tried according to the Q value until a preset condition is met; finally, the test process is recorded and a report is generated. The method realizes the security evaluation of the large model, improves the success rate and efficiency of the attack test, provides empirical evidence for the design of the large model defense mechanism, and guarantees the application safety of the large model.

Description

An Adaptive Large Model Hint Attack and Security Assessment Method Based on Feedback Learning Technical Field

[0001] This invention belongs to the field of artificial intelligence security technology, specifically relating to an adaptive large model hint attack and security assessment method based on feedback learning. Background Technology

[0002] With the rapid development of artificial intelligence (AI) technology, especially the application of large-scale pre-trained models (such as GPT and BERT), AI is performing increasingly well in many fields, particularly achieving significant breakthroughs in Natural Language Processing (NLP). While providing efficient solutions for various tasks, large models also face challenges in areas such as security and privacy protection. To ensure that large models are not attacked during application and to prevent them from being maliciously exploited, evaluating the security of large models has become an important research direction. Large Language Models (LLMs) have made groundbreaking progress in fields such as natural language processing, content generation, and intelligent interaction. With the widespread application of LLMs, the security issues of these models are becoming increasingly prominent. How to systematically evaluate the robustness of large language models against security threats such as hint injection, jailbreak attacks, privacy leaks, and backdoor implantation, and to establish effective protection and verification mechanisms, has become one of the core issues in current AI security research.

[0003] Current large language models, due to their non-independent and identically distributed nature, are prone to data drift, making them significantly vulnerable to attacks. Furthermore, their distributed architecture provides opportunities for malicious attacks, allowing attackers to modify model parameters and disrupt the training process. Meanwhile, existing defense methods are mostly designed for specific attack methods, lacking comprehensive protection against multiple attacks. Traditional model security assessment methods lack adaptability, making it difficult to match the security response characteristics of different models, limiting testing efficiency and attack success rates, and also resulting in excessive resource consumption and an inability to systematically detect potential model security vulnerabilities.

[0004] Therefore, there is an urgent need to develop an efficient and adaptive method for large model hint attacks and security assessment, to achieve systematic testing of the security boundaries of large language models, to provide empirical evidence for the design of defense mechanisms and the enhancement of model robustness, and to improve the overall security level of artificial intelligence systems. Summary of the Invention

[0005] In view of this, this invention provides an adaptive large-model prompting attack and security assessment method based on feedback learning. By integrating multiple text transformation attack strategies and combining them with historical attack effect data, it achieves intelligent selection and adaptive execution of attack methods, thereby improving the concealment, success rate, and systematic nature of adversarial testing. This provides an efficient and reliable automated testing tool for the security assessment of large language models. Through continuous attack effect tracking and data analysis, a quantitative assessment system for model security weaknesses is constructed, providing empirical evidence and optimization directions for the design of defense mechanisms and robustness enhancement of large language models. Ultimately, this helps improve the overall security and adversarial robustness of artificial intelligence systems.

[0006] The method includes:

[0007] S1. Construct an attack library containing various text transformation attack strategies and obtain performance data of the attack strategies on the target model;

[0008] S2. Calculate the success rate and average score using performance data, calculate the R value of each attack strategy using weighted scoring, and calculate the Q value of each attack strategy based on the R value.

[0009] S3. Sort all attack strategies in descending order of their corresponding Q values ​​and obtain the attack strategy with the highest Q value;

[0010] S4. Apply the attack strategy to the original malicious prompt to generate adversarial input, submit the adversarial input to the target model, obtain the target model's response, and automatically score the target model through a pre-trained evaluation model to determine whether the attack is successful. If yes, proceed to step S5; otherwise, return to step S3.

[0011] S5. Based on the attack results, update the statistical data of the attack strategy on the target model, recalculate the R value and Q value of the attack strategy, and try the attack strategies in order of Q value until the preset conditions are met.

[0012] S6. Record the complete testing process and generate a test report.

[0013] Further, in step S1, the attack library is:

[0014] S = { , , ..., };

[0015] Where m is the total number of strategies;

[0016] The attack strategy includes:

[0017] Word order reversal (FWO) is used to completely reverse the order of words in an input sentence.

[0018] Intraword Flip (FCW) is used to reverse the order of characters within each word.

[0019] Sentence-level character reversal (FCS) is used to reverse the character order of an entire sentence.

[0020] Model deception mode (FMM) is used to combine character flipping with specific instruction guidance;

[0021] Hexadecimal encoding (HEX) is used to convert text into a hexadecimal representation.

[0022] ROT13 encoding is used for encoding using the ROT13 cryptography.

[0023] Leetspeak encoding LEET is used to replace letters with numbers and special characters.

[0024] Further, in step S1, the performance data includes:

[0025] Number of attempts Number of successes Total GPT assessment score .

[0026] Furthermore, the specific steps of step S2 include:

[0027] S21. Record attack strategy In the target model Based on the performance data, the success rate of the attack strategy on the current model is calculated. and average rating ;

[0028] when When the value is greater than 0, the success rate can be calculated using the following formula. and average rating :

[0029] = , = ;

[0030] S22. The R-value of each attack strategy is calculated using a weighted scoring method. The calculation formula is as follows:

[0031] = · ·10+ · ;

[0032] in, and Let be the weighting coefficient, satisfying =1.

[0033] S23. Calculate the Q value using the R value. The formula for calculating the Q value is as follows:

[0034] = + ;

[0035] in, For the new Q value, This is the old Q value.

[0036] Furthermore, the specific steps of step S3 include:

[0037] S31. Target Model During the testing process, all attack strategies were sorted in descending order according to their corresponding Q values, and the attack strategy with the highest Q value was selected for testing. The formula for descending sorting is:

[0038] =sort(S,by= ,order=desending);

[0039] Where sort() is the sorting function, and by= Based on The sorting criteria, order=desending specifies the sorting order;

[0040] S32. Use an α-greedy strategy, where each time an attack method is chosen, there is an α probability of trying another method.

[0041] Furthermore, the specific steps of step S4 include:

[0042] S41. Regarding the chosen attack strategy It is applied to the original malicious prompt p to generate adversarial input. = (p) Submits the adversarial input to the target model. Obtain the model response r;

[0043] S42. Use the pre-trained evaluation model E to automatically score the model response:

[0044] Score=E(p, ,r);

[0045] Simultaneously, a rule-based keyword matching method is used to assist in the judgment:

[0046] =any(k∈r for k∈ );

[0047] in, `a` is a Boolean variable indicating whether the target model's response triggered the preset rejection mechanism; `any()` is a logical function used to determine whether at least one element in the set satisfies the subsequent conditions; `k` is the iteration variable. This is a pre-defined set of rejection keywords;

[0048] The final conditions for a successful attack are:

[0049] success=(score ≥ θ)∧(notis rejected );

[0050] Where θ is the preset success threshold.

[0051] Furthermore, in step S5, the statistical data of the updated attack strategy on the target model is obtained through the following formula:

[0052] ← +1;

[0053] If successful: ← +1, ← +Score.

[0054] Furthermore, in step S5, the preset condition must satisfy any one of the following:

[0055] Current attack strategy: attack successful (score ≥ θ) ∧ (notis rejected );

[0056] All strategies have been tried;

[0057] Reach the preset maximum number of attempts;

[0058] If the current strategy fails, the system will wait for a preset delay time d before trying the next strategy:

[0059] if not success: wait(d);i←i+1.

[0060] Furthermore, the specific details of recording the complete test process in step S6 include:

[0061] Original hints and all adversarial variants;

[0062] Target model response and evaluation score;

[0063] The attack strategy sequence used;

[0064] The final result of the attack was either success or failure;

[0065] Historical performance statistics for each attack strategy.

[0066] As can be seen from the above technical solutions, the present invention has the following advantages:

[0067] The adaptive large model hint attack and security assessment method based on feedback learning described in this invention specifically solves the technical problems of poor model characteristic adaptability, low testing efficiency, single attack methods and high resource consumption in the security assessment of large language models. At the same time, it makes up for the lack of comprehensive testing basis in the existing protection system and achieves multiple technical effects in large model security assessment and defense mechanism optimization.

[0068] By constructing a multi-type text transformation attack library, this invention overcomes the limitations of traditional assessments that only target specific attacks, enabling comprehensive testing of various security threats. It can fully uncover vulnerabilities in models under scenarios such as tooltip injection and jailbreak attacks, providing a complete basis for the design of comprehensive protection systems. Based on Q-value quantitative evaluation and dynamic attack selection using an α-greedy strategy, it can adapt to the security response characteristics of different models, solving the problems of data drift caused by non-independent and identically distributed models and strategy selection bias caused by the lack of transparency in security features. Relying on a real-time feedback data analysis and strategy update mechanism, it optimizes attack sequences, shortens the testing cycle, and improves testing efficiency by not consuming GPU resources. This invention's complete testing process recording and quantitative evaluation system can accurately locate model security weaknesses, providing concrete empirical evidence for correcting model parameter vulnerabilities in distributed architectures, enhancing model robustness, and ensuring the application security of large models. Attached Figure Description

[0069] To more clearly illustrate the technical solution of the present invention, the accompanying drawings used in the description will be briefly introduced below. Obviously, the accompanying drawings described below are only some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0070] Figure 1 is a flowchart illustrating the adaptive large model hint attack and security assessment method based on feedback learning of the present invention.

[0071] Figure 2 is a comparative diagram of different attack methods against ASR-GPT for each model;

[0072] Figure 3 is a comparative diagram of different attack methods of the present invention against ASR-DICT. Detailed Implementation

[0073] The various embodiments of the invention will be described more fully in the detailed steps of the adaptive large model cueing attack and security assessment method based on feedback learning described below. The invention may have various embodiments, and adjustments and changes may be made therein. However, it should be understood that there is no intention to limit the various embodiments of the invention to the specific embodiments disclosed herein, but rather the invention should be understood to cover all adjustments, equivalents, and / or alternatives falling within the spirit and scope of the various embodiments of the invention.

[0074] It should be understood that, when used in this specification, the term "comprising" indicates the presence of the described features, integrals, steps, operations, elements, and / or components, but does not exclude the presence or addition of one or more other features, integrals, steps, operations, elements, components, and / or collections thereof. The terms "comprising," "including," "having," and variations thereof all mean "including but not limited to," unless otherwise specifically emphasized.

[0075] The terms "one embodiment" or "some embodiments" used in this invention mean that one or more embodiments of the invention include the specific features, structures, or characteristics described in that embodiment. Therefore, the terms "in one embodiment," "in some embodiments," "in other embodiments," "in still other embodiments," etc., appearing in different parts of the invention do not necessarily refer to the same embodiment, but rather mean "one or more, but not all, embodiments," unless otherwise specifically emphasized.

[0076] To make the objectives, features, and advantages of this invention more apparent and understandable, specific embodiments and accompanying drawings will be used to clearly and completely describe the technical solutions protected by this invention. Obviously, the embodiments described below are only some embodiments of this invention, and not all embodiments. Based on the embodiments of this invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of this invention.

[0077] Please refer to Figure 1, which illustrates an adaptive large model cueing attack and security assessment method based on feedback learning. The method includes:

[0078] S1. Construct an attack library containing various text transformation attack strategies and obtain performance data of the attack strategies on the target model;

[0079] S2. Calculate the success rate and average score using performance data, calculate the R value of each attack strategy using weighted scoring, and calculate the Q value of each attack strategy based on the R value.

[0080] S3. Sort all attack strategies in descending order of their corresponding Q values ​​and obtain the attack strategy with the highest Q value;

[0081] S4. Apply the attack strategy to the original malicious prompt to generate adversarial input, submit the adversarial input to the target model, obtain the target model's response, and automatically score the target model through a pre-trained evaluation model to determine whether the attack is successful. If yes, proceed to step S5; otherwise, return to step S3.

[0082] S5. Based on the attack results, update the statistical data of the attack strategy on the target model, recalculate the R value and Q value of the attack strategy, and try the attack strategies in order of Q value until the preset conditions are met.

[0083] S6. Record the complete testing process and generate a test report.

[0084] It should be noted that this embodiment uses a cumulative scoring mechanism to quantitatively evaluate the matching degree between various attack methods and the current target model, selecting the most likely successful attack method. By prioritizing the use of historically best-performing methods, it can be disguised as a normal probe of the model's security boundaries, thereby enhancing the attack's stealth and adaptability. Then, the attack method with the highest score is selected to maximize the current attack effect. Simultaneously, the attack strategy sequence is dynamically adjusted based on real-time feedback to optimize the attack path and shorten the testing cycle. Since different models have different security mechanisms, some attack strategies may be more effective against specific models. By establishing a data-driven decision-making process, the testing process can adapt to model characteristics, effectively discovering security vulnerabilities while ensuring the systematic nature and scalability of the test. Executing dynamically generated attack sequences within the security testing framework allows the evaluation system to comprehensively detect the model's performance under different adversarial methods, identify potential security risks, and achieve efficient and automated evaluation of the robustness of large language models.

[0085] As a refinement and extension of the specific implementation of the above embodiments, in order to fully illustrate the specific implementation process of this embodiment, another adaptive large model hint attack and security assessment method based on feedback learning is provided, which includes the following steps:

[0086] S1. Construct an attack library containing various text transformation attack strategies and obtain performance data of the attack strategies on the target model;

[0087] In step S1, the attack library is:

[0088] S = { , , ..., };

[0089] Where m is the total number of strategies;

[0090] The attack strategy includes:

[0091] Word order reversal (FWO) is used to completely reverse the order of words in an input sentence.

[0092] Intraword Flip (FCW) is used to reverse the order of characters within each word.

[0093] Sentence-level character reversal (FCS) is used to reverse the character order of an entire sentence.

[0094] Model deception mode (FMM) is used to combine character flipping with specific instruction guidance;

[0095] Hexadecimal encoding (HEX) is used to convert text into a hexadecimal representation.

[0096] ROT13 encoding is used for encoding using the ROT13 cryptography.

[0097] Leetspeak encoding LEET is used to replace letters with numbers and special characters.

[0098] In step S1, the performance data includes:

[0099] Number of attempts Number of successes Total GPT assessment score .

[0100] S2. Calculate the success rate and average score using performance data, calculate the R value of each attack strategy using weighted scoring, and calculate the Q value of each attack strategy based on the R value.

[0101] The specific steps of step S2 include:

[0102] S21. Record attack strategy In the target model Based on the performance data, the success rate of the attack strategy on the current model is calculated. and average rating ;

[0103] when When the value is greater than 0, the success rate can be calculated using the following formula. and average rating :

[0104] = , = ;

[0105] S22. The R-value of each attack strategy is calculated using a weighted scoring method. The calculation formula is as follows:

[0106] = · ·10+ · ;

[0107] in, and Let be the weighting coefficient, satisfying =1.

[0108] S23. Calculate the Q value using the R value. The formula for calculating the Q value is as follows:

[0109] = + ;

[0110] in, For the new Q value, This is the old Q value.

[0111] S3. Sort all attack strategies in descending order of their corresponding Q values ​​and obtain the attack strategy with the highest Q value;

[0112] The specific steps of step S3 include:

[0113] S31. Target Model During the testing process, all attack strategies were sorted in descending order according to their corresponding Q values, and the attack strategy with the highest Q value was selected for testing. The formula for descending sorting is:

[0114] =sort(S,by= ,order=desending);

[0115] Where sort() is the sorting function, and by= Based on The sorting criteria, order=desending specifies the sorting order;

[0116] S32. Use an α-greedy strategy, where each time an attack method is chosen, there is an α probability of trying another method.

[0117] S4. Apply the attack strategy to the original malicious prompt to generate adversarial input, submit the adversarial input to the target model, obtain the target model's response, and automatically score the target model through a pre-trained evaluation model to determine whether the attack is successful. If yes, proceed to step S5; otherwise, return to step S3.

[0118] The specific steps of step S4 include:

[0119] S41. Regarding the chosen attack strategy It is applied to the original malicious prompt p to generate adversarial input. = (p) Submits the adversarial input to the target model. Obtain the model response r;

[0120] S42. Use the pre-trained evaluation model E to automatically score the model response:

[0121] Score=E(p, ,r);

[0122] Simultaneously, a rule-based keyword matching method is used to assist in the judgment:

[0123] =any(k∈r for k∈ );

[0124] in, `a` is a Boolean variable indicating whether the target model's response triggered the preset rejection mechanism; `any()` is a logical function used to determine whether at least one element in the set satisfies the subsequent conditions; `k` is the iteration variable. This is a pre-defined set of rejection keywords;

[0125] The final conditions for a successful attack are:

[0126] success=(score ≥ θ)∧(notis rejected );

[0127] Where θ is the preset success threshold.

[0128] S5. Based on the attack results, update the statistical data of the attack strategy on the target model, recalculate the R value and Q value of the attack strategy, and try the attack strategies in order of Q value until the preset conditions are met.

[0129] In step S5, the statistical data of the update attack strategy on the target model is obtained through the following formula:

[0130] ← +1;

[0131] If successful: ← +1, ← +Score.

[0132] In step S5, the preset condition must satisfy any one of the following:

[0133] Current attack strategy: attack successful (score ≥ θ) ∧ (notis rejected );

[0134] All strategies have been tried;

[0135] Reach the preset maximum number of attempts;

[0136] If the current strategy fails, the system will wait for a preset delay time d before trying the next strategy:

[0137] if not success: wait(d);i←i+1.

[0138] S6. Record the complete testing process and generate a test report.

[0139] The specific details of recording the complete test process in step S6 include:

[0140] Original hints and all adversarial variants;

[0141] Target model response and evaluation score;

[0142] The attack strategy sequence used;

[0143] The final result of the attack was either success or failure;

[0144] Historical performance statistics for each attack strategy.

[0145] Figure 2 shows a comparison of the attack success rates (ASR-GPT) of different attack methods (such as GCG, AutoDAN, etc.) on multiple large language models (such as gpt-4o-mini, grok-3-mini). It can be seen that the success rate of the embodiments of the present invention on each model is almost above 95%, which is significantly higher than other methods.

[0146] Figure 3 shows a comparison of the attack success rates (ASR-DICT) of different attack methods (such as GCG, AutoDAN, etc.) on multiple large language models (such as gpt-4o-mini, grok-3-mini). It can be seen that the success rate of the embodiments of the present invention on each model is almost above 95%, which is significantly higher than other methods.

[0147] Table 1 compares the token consumption and GPU resource consumption of different attack methods: GCG and AutoDAN have fewer tokens but take more than 24 hours to consume GPU resources; while PAIR, FlipAttack, and the embodiment of this invention have 0 GPU time consumption, but consume relatively more tokens.

[0148] Table 1. Token consumption and GPU resource consumption for different attack methods

[0149]

[0150] In some embodiments, the method is implemented based on a testing system comprising a central test controller and multiple target large language models. Each target large language model has an independent security alignment mechanism and response characteristics. The central test controller completes the entire process control of attack library initialization, strategy selection, data statistics, and result evaluation. During the testing process, the strategy selection deviation is reduced through iterative loops, thereby achieving adaptive learning of the security characteristics of the target model.

[0151] It should be understood that the sequence number of each step in the above embodiments does not imply the order of execution. The execution order of each process should be determined by its function and internal logic, and should not constitute any limitation on the implementation process of the embodiments of the present invention.

[0152] The above description of the disclosed embodiments enables those skilled in the art to make or use the invention. Various modifications to these embodiments will be readily apparent to those skilled in the art, and the general principles defined herein may be implemented in other embodiments without departing from the spirit or scope of the invention. Therefore, the invention is not to be limited to the embodiments shown herein, but is to be accorded the widest scope consistent with the principles and novel features disclosed herein.

Claims

1. An adaptive large model hint attack and security assessment method based on feedback learning, characterized in that, The method includes: S1. Constructing an attack library containing multiple text transformation attack strategies and obtaining performance data of the attack strategies on the target model; S2. Calculating the success rate and average score through the performance data, calculating the R value of each attack strategy using weighted scoring, and accumulating the Q value of each attack strategy based on the R value; S3. Sort all attack strategies in descending order according to their corresponding Q values ​​and obtain the attack strategy with the highest Q value; S4. Applying the attack strategy to the original malicious prompt to generate adversarial input, submitting the adversarial input to the target model, obtaining the target model's response, automatically scoring the target model using a pre-trained evaluation model, and determining whether the attack is successful. If successful, proceed to step S5; otherwise, return to step S3; S5. Based on the attack results, updating the statistical data of the attack strategy on the target model, recalculating the R value and Q value of the attack strategy, and trying attack strategies sequentially according to the Q value until the preset conditions are met; S6. Recording the complete test process and generating a test report; The specific steps of step S4 include: S41. For the selected attack strategy It is applied to the original malicious prompt p to generate adversarial input. = (p) Submits the adversarial input to the target model. S42. Obtain the model response r; S43. Call the pre-trained evaluation model E to automatically score the model response: Score=E(p, Simultaneously, a rule-based keyword matching method is used for auxiliary judgment: =any(k∈r for k∈ );in, `a` is a Boolean variable indicating whether the target model's response triggered the preset rejection mechanism; `any()` is a logical function used to determine whether at least one element in the set satisfies the subsequent conditions; `k` is the iteration variable. The set of preset rejection keywords is used; the final attack success condition is: success = (score ≥ θ) ∧ (notis rejected ); where θ is the preset success threshold.

2. The adaptive large model hint attack and security assessment method based on feedback learning according to claim 1, characterized in that, In step S1, the attack library is: S = { , , ..., }; where m is the total number of strategies; the attack strategies include: Word Order Flip (FWO), used to completely reverse the word order in the input sentence; Intra-word Character Flip (FCW), used to reverse the character order within each word; Sentence-level Character Flip (FCS), used to reverse the character order of the entire sentence; Model Spoofing Pattern (FMM), used to combine character flipping with instruction guidance; Hexadecimal Encoding (HEX), used to convert text into hexadecimal representation; ROT13 Encoding, used to encode using ROT13 cipher; and Leetspeak Encoding (LEET), used to replace letters with numbers and special characters.

3. The adaptive large model hint attack and security assessment method based on feedback learning according to claim 1, characterized in that, In step S1, the performance data includes: number of attempts. Number of successes Total GPT assessment score 。 4. The adaptive large model hint attack and security assessment method based on feedback learning according to claim 3, characterized in that, The specific steps of step S2 include: S21. Record the attack strategy. In the target model Based on the performance data, the success rate of the attack strategy on the current model is calculated. and average rating ;when When the value is greater than 0, the success rate can be calculated using the following formula. and average rating ： = ， = S22. The R-value of each attack strategy is calculated using a weighted scoring method. The calculation formula is as follows: = · ·10+ · ;in, and Let be the weighting coefficient, satisfying =1; S23. Calculate the Q value using the R value, wherein the formula for calculating the Q value is: = + ;in, For the new Q value, This is the old Q value.

5. The adaptive large model hint attack and security assessment method based on feedback learning according to claim 1, characterized in that, The specific steps of step S3 include: S31. For the target model During the testing process, all attack strategies were sorted in descending order according to their corresponding Q values, and the attack strategy with the highest Q value was selected for testing. The formula for descending sorting is: =sort(S,by= ,order=desending); where sort() is the sorting function, by= Based on The sorting criteria are as follows: order=desending is the sorting order; S32. Use an α-greedy strategy, each time when choosing an attack method, there is an α possibility of trying other methods.

6. The adaptive large model hint attack and security assessment method based on feedback learning according to claim 3, characterized in that, In step S5, the statistical data of the update attack strategy on the target model is obtained through the following formula: ← +1;if success: ← +1, ← +Score。 7. The adaptive large model hint attack and security assessment method based on feedback learning according to claim 1, characterized in that, In step S5, the preset condition must satisfy any one of the following: the current attack strategy succeeds (score ≥ θ) ∧ (notis rejected ); All strategies have been tried; The preset maximum number of attempts has been reached; If the current strategy fails, the system waits for a preset delay time d before trying the next strategy: if not success: wait(d); i←i+1.

8. The adaptive large model hint attack and security assessment method based on feedback learning according to claim 1, characterized in that, The specific details of recording the complete testing process in step S6 include: the original prompts and all adversarial variants; the target model's response and evaluation score; the sequence of attack strategies used; the final attack result (success or failure); and historical performance statistics for each attack strategy.

Images