Location coding-based LLM input injection detection method and system
By employing a position-encoded LLM input injection detection method, this paper identifies and evaluates control statement fragments in input text, generates position-encoded sequences, and performs lightweight perturbation difference feature evaluation. This solves the adaptive avoidance problem of input injection attacks in existing technologies and achieves stronger robustness and upfront protection.
Patent Information
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- Filing Date
- 2026-01-20
- Publication Date
- 2026-04-07
AI Technical Summary
Existing input injection protection solutions lack the ability to adaptively avoid input injection attacks, and are prone to missed or false detections, especially when facing attackers' attack methods such as synonym rewriting, insertion of irrelevant content, and progressive injection across rounds of dialogue.
A positional encoding-based LLM input injection detection method is adopted. By dividing the text sequence into multiple text units with independent semantic features, controlling or imperative sentence fragments are identified and positionally encoded to generate positionally encoded sequences. Combined with light perturbation and difference features, the injection risk is assessed using the RXNet-Pos neural network.
It improves the ability to identify hidden injected instructions in cross-sentence, cross-paragraph, and cross-turn dialogues, reduces the dependence on specific words and explicit semantics, enhances the sensitivity and generalization ability of detection, and avoids high-risk inputs from entering the core reasoning process of large language models.
Smart Images
Figure CN121808767A_ABST
Abstract
Description
Technical Field
[0001] This invention relates to the field of artificial intelligence security technology, specifically to an LLM input injection detection method and system based on positional coding. Background Technology
[0002] With the widespread application of large language models in scenarios such as intelligent question answering, code generation, automated decision-making, and tool invocation, LLMs typically receive natural language input directly from external users, retrieval systems, or third-party data sources. Because the input sources are open and uncontrollable, attackers can construct specific texts to induce models to ignore established constraints, leak sensitive information, or perform unauthorized operations. This type of attack is commonly referred to as input injection attack (also known as hint injection or jailbreak attack).
[0003] Existing input injection protection solutions mostly employ techniques such as keyword matching, rule validation, and semantic-based classification models. However, these methods typically rely on specific vocabulary or explicit semantic features, and are prone to missed or false detections when faced with attackers' adaptive avoidance strategies (such as paraphrasing, inserting irrelevant content, splitting instructions into different locations, hiding instructions using references / code / data structures, and progressive injection through cross-turn dialogues). Summary of the Invention
[0004] The purpose of this invention is to propose a position-encoded LLM input injection detection method to solve the problems mentioned in the background art.
[0005] To achieve the above-mentioned objectives, the first technical solution adopted by this invention is: an LLM input injection detection method based on positional encoding, comprising the following steps: S1, Obtain the text sequence to be input into the large language model; S2, the text sequence is divided into multiple text units with independent semantic features according to different granularities; S3, based on the semantic attributes and contextual relationships of the text units, identify the control or instructional sentence fragments and descriptive sentence fragments in the text sequence that are related to the output behavior of the large language model; S4, perform position encoding processing on the position of the control or instruction statement fragment in the text sequence to generate a position encoding sequence; S5, perform a light perturbation on the control or instruction statement fragment, input the original input and the perturbation input to the target model respectively, extract the model output distribution or internal representation and calculate the difference features; S6, Based on the position encoding sequence and the difference feature, extract the structural position feature and construct the fusion feature vector; S7, input the fused feature vector into the injection discriminative neural network model to obtain the injection risk result of the text sequence; when the risk result exceeds a preset threshold, prevent the text sequence from entering the large language model inference process.
[0006] Furthermore, in step S2, the granularity of text unit division, from largest to smallest, includes: division by punctuation marks, division based on grammatical structure while maintaining the integrity of semantic units, and division by phrases.
[0007] Furthermore, in step S3, the control or instructional statement fragment includes at least one of rule overriding, role switching, priority declaration, format enforcement, prohibited or required statements, ignored or disregarded statements, tool call instructions, and conditional branch statements.
[0008] Furthermore, in step S4, the location encoding adopts a structured encoding method based on normalized location and distribution statistics, specifically including: Calculate the relative start and end coordinates of the control segment within the text sequence; Global distribution statistics of generated control content, including control segment coverage, number of segments, average length, and maximum length; Divide the text sequence into K equal-length logical intervals, count the token proportion of the control segment in each interval, and generate a K-dimensional bucket density histogram. Extract the structural carrier features of the control segment, including whether it is located in at least one of the following: code block, quotation block, inside parentheses / quotes, JSON / YAML key-value area, list / title area.
[0009] Furthermore, the relative start and end coordinates are calculated as follows: using the total length L of the text sequence as the denominator, the ratio of the start index start to the end index end of the control segment is calculated, namely start / L and end / L.
[0010] Furthermore, in step S5, the measurement method of the difference feature includes at least one of the following: logits difference (measuring the impact of perturbation on the model's final decision), embedding difference (measuring the impact of perturbation on the semantic representation within the model), similarity change (measuring the impact of perturbation on the final output content), and cross-layer difference spectrum (how the impact of perturbation propagates and evolves layer by layer within the model).
[0011] Furthermore, in step S7, the injection discrimination neural network model is RXNet-Pos, which includes a one-dimensional convolutional layer, an attention mechanism layer, and a fully connected layer, and outputs the injection risk probability value through the Sigmoid activation function.
[0012] To achieve the above-mentioned objectives, the second technical solution adopted by the present invention is: a position-encoded LLM input injection detection system, applied in a position-encoded LLM input injection detection method, comprising: The input receiving module is used to acquire the text sequence to be input into the large language model; A text unit segmentation module is used to divide the text sequence into multiple text units with independent semantic features; A control statement recognition module is used to identify control or instructional statement fragments and descriptive statement fragments in the text sequence; A position encoding module is used to encode the position of the control or instruction statement fragment to generate a position encoding sequence; The perturbation difference feature generation module is used to perform a light perturbation on the control statement and calculate the difference features between the original input and the model output or representation corresponding to the perturbation input. The structural feature extraction and fusion module is used to construct a fused feature vector based on positional encoding sequences and difference features; The injection discriminant network module is used to input the fused feature vector into the RXNet-Pos neural network and output the injection risk result.
[0013] Furthermore, the risk results output by the injection discrimination network module include risk scores or high-risk and low-risk classification labels; when the risk result is high-risk, the triggered security handling strategies include at least one of input interception, content purification, and manual review.
[0014] Due to the application of the above technical solution, the present invention has the following advantages compared with the prior art: Structured modeling: By using positional encoding and structural carrier features, the injection behavior is abstracted in a structured way, reducing the dependence on specific words and explicit semantics.
[0015] Strong anti-circumvention capability: It can identify hidden injection commands in cross-sentence, cross-paragraph, and cross-turn dialogues, and has stronger robustness against synonym rewriting, split injection, tail injection, and carrier spoofing.
[0016] Difference Enhancement Discrimination: By introducing difference responses through positional encoding perturbations and control statement disturbances, the abnormal impact of jailbreak commands on model behavior is amplified, thereby improving detection sensitivity and generalization ability.
[0017] Pre-emptive protection: Injection detection is performed before the large language model is executed to prevent high-risk inputs from entering the core reasoning process and reduce the risk of sensitive information leakage and unauthorized execution.
[0018] Universality and scalability: Applicable to various large language model architectures and multilingual inputs, and can be extended to include structural carrier recognition and risk strategies according to application requirements. Attached Figure Description
[0019] Figure 1 The flowchart of the LLM input injection detection method based on position encoding provided in the embodiment of the present invention is shown; Figure 2 The diagram shows a block diagram of the perturbation difference feature generation module of the LLM input injection detection system based on position encoding provided in an embodiment of the present invention. Figure 3 This shows a block diagram of the structural feature extraction module of the LLM input injection detection system based on position coding provided in an embodiment of the present invention; Figure 4 The diagram shows the injection discrimination network module block of the LLM input injection detection system based on position encoding provided in an embodiment of the present invention. Detailed Implementation
[0020] To enable those skilled in the art to better understand the present application, the technical solutions in the embodiments of the present application will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present application, and not all embodiments. Based on the embodiments in the present application, all other embodiments obtained by those of ordinary skill in the art without creative effort should fall within the scope of protection of the present application.
[0021] It should be noted that the terms "first," "second," etc., in the specification, claims, and accompanying drawings of this application are used to distinguish similar objects and are not necessarily used to describe a specific order or sequence. It should be understood that such data can be interchanged where appropriate for the embodiments of this application described herein. Furthermore, the terms "comprising" and "having," and any variations thereof, are intended to cover non-exclusive inclusion; for example, a process, method, system, product, or system that comprises a series of steps or units is not necessarily limited to those steps or units explicitly listed, but may include other steps or units not explicitly listed or inherent to such processes, methods, products, or systems.
[0022] It should be noted that, unless otherwise specified, the embodiments and features described in this application can be combined with each other. This application will now be described in detail with reference to the accompanying drawings and embodiments.
[0023] like Figure 1 As shown, this embodiment of the invention provides an LLM input injection detection method based on positional encoding, comprising the following steps: S1, Obtain the text sequence to be input into the large language model; The text sequence includes inputs that are either single-turn inputs or inputs concatenated from multiple-turn dialogues; S2 divides the text sequence into multiple text units with independent semantic features according to different granularities; S3, based on the semantic attributes and contextual relationships of text units, identifies control or instructional sentence fragments and descriptive sentence fragments in the text sequence that are related to the output behavior of the large language model; Specifically, semantic attributes and contextual relationships are obtained by using pre-trained language models (such as Word2Vec models) to obtain text embedding representations, and then using machine learning (such as using random forests) to identify control sentence fragments and descriptive sentence fragments.
[0024] S4, perform position encoding on the position of the control or instructional statement fragment in the text sequence to generate a position encoding sequence; S5, apply a light perturbation to the control or instruction statement fragment, input the original input and the perturbation input to the target model respectively, extract the model output distribution or internal representation and calculate the difference features; Specifically, the control statement perturbation and difference feature generation steps are as follows: Lightly perturb the control or instruction statement fragments to generate at least one set of perturbed control statement versions (while maintaining the overall semantic theme, the control structure is equivalently rewritten or weakened). Input the original input and perturbed input into the target model, extract the model output distribution or internal representation, and calculate the difference features. The difference features are used to characterize the abnormal sensitivity of the control structure to model behavior.
[0025] S6. Based on the positional coding sequence and difference features, extract structural positional features and construct a fused feature vector; Specifically, by encoding the position of control statements and lightly perturbing the position encoding signal and the form of control statements, stable features highly correlated with jailbreak injection can be extracted from the "difference response," thereby reducing dependence on specific words while improving the generalization ability of new attack templates.
[0026] S7 inputs the fused feature vector into the injection discriminative neural network model to obtain the injection risk result of the text sequence; when the risk result exceeds the preset threshold, the text sequence is prevented from entering the large language model inference process.
[0027] This invention detects and assesses the risks of control / instructional injection statements without relying on specific keywords and is robust to expression rewriting and position splitting, thus preventing high-risk inputs from entering the core reasoning process.
[0028] Specifically, this application implements the following functions: Separation of control and descriptive statements: The input text is divided into multiple semantic text units, and control / instructional statement fragments and descriptive statement fragments related to the model's output behavior are identified.
[0029] Structural position feature abstraction: The position of the control statement in the input sequence is encoded in a normalized position and distribution statistical manner, and structural position features are extracted to form an abstract representation of structural patterns such as "head injection / tail injection / sandwich injection / span injection / carrier camouflage".
[0030] Perturbation Difference Augmentation: Lightly perturbs the positional encoding or control statements, compares the differences (difference features) between the model's internal representation or output distribution before and after the perturbation, amplifies the abnormal impact of jailbreak injection on model behavior, and is used for risk assessment during the training / inference phase.
[0031] Unified discriminant network: The structural location features and difference features are fused and injected into the discriminant neural network RXNet-Pos, and the output is injected risk score or classification result.
[0032] According to an embodiment of the present invention, in step S2, the granularity of text unit division from large to small includes: division by punctuation marks, division based on grammatical structure while maintaining the integrity of semantic units, and division by phrases.
[0033] According to an embodiment of the present invention, in step S3, the control or imperative statement fragment includes at least one of rule overriding, role switching, priority declaration, format enforcement, prohibited or required statements, ignored or disregarded statements, tool call instructions, and conditional branch statements.
[0034] According to an embodiment of the present invention, in step S4, the location encoding adopts a structured encoding method based on normalized location and distribution statistics, specifically including: Calculate the relative start and end coordinates of the control segment within the text sequence; Global distribution statistics of generated control content, including control segment coverage, number of segments, average length, and maximum length; Divide the text sequence into K equal-length logical intervals, count the token proportion of the control segment in each interval, and generate a K-dimensional bucket density histogram. Extract the structural carrier features of the control segment, including whether it is located in at least one of the following: code block, quotation block, inside parentheses / quotes, JSON / YAML key-value area, list / title area.
[0035] According to an embodiment of the present invention, the relative start and end coordinates are calculated as follows: with the total length L of the text sequence as the denominator, the ratio of the start index start to the end index end of the control segment is calculated, namely start / L and end / L.
[0036] According to an embodiment of the present invention, in step S5, the measurement method of the difference feature includes at least one of logits difference, embedding difference, similarity change, and cross-layer difference spectrum.
[0037] According to an embodiment of the present invention, in step S7, the injection discriminative neural network model is RXNet-Pos, which includes a one-dimensional convolutional layer, an attention mechanism layer, and a fully connected layer, and outputs the injection risk probability value through the Sigmoid activation function.
[0038] In one specific embodiment, injection detection is based on single-round input, where the input text is a single-round user input. The system first segments the text into words or sub-words, and completes text unit segmentation and control statement recognition. Subsequently, the system generates structured positional encoding features (including normalized position, binning distribution, carrier structure features, etc.) for the control statement fragments, and performs a light perturbation on the positional encoding and control statements (equivalently rewriting or weakening the control structure while maintaining the overall semantic theme) to form difference features. RXNet-Pos outputs an injection risk score based on the fused features. When the risk score exceeds a preset threshold, the input is prevented from entering the large language model.
[0039] In one specific embodiment, injection detection based on multi-turn dialogue incorporates historical dialogue context. Positional encoding across turns provides coarser-grained features. The system performs consistency identification and positional distribution statistics on cross-turn control statements, and combines this with cross-turn perturbation difference features input into RXNet-Pos, thereby identifying progressive, cross-turn splitting injection behaviors.
[0040] like Figures 2-4 As shown, to achieve the above-mentioned objective, the second technical solution adopted by the present invention is: a position-encoded LLM input injection detection system, applied in a position-encoded LLM input injection detection method, comprising: The input receiving module is used to acquire the text sequence to be input into the large language model; The text unit segmentation module is used to divide a text sequence into multiple text units with independent semantic features; The control statement recognition module is used to identify control or directive statement fragments and descriptive statement fragments in a text sequence; The position encoding module is used to encode the position of control or instructional statement fragments and generate position encoding sequences; The perturbation difference feature generation module is used to perform a light perturbation on the control statement and calculate the difference features between the original input and the model output or representation corresponding to the perturbation input. Specifically, the perturbation difference feature generation module is used to perform a light perturbation on the control statement, and input the original input and the perturbation input into the alternative model or the target model, extract the output / representation and calculate the difference features.
[0041] The structural feature extraction and fusion module is used to construct a fused feature vector based on positional encoding sequences and difference features; Specifically, the structural feature extraction and fusion module is used to extract structural position features and perform feature fusion based on position-coded sequences, position-coded perturbation sequences, and difference features.
[0042] The injection discriminant network module is used to input the fused feature vector into the RXNet-Pos neural network and output the injection risk result.
[0043] It should be noted that, based on the generated multi-dimensional fused positional encoding features, the RXNet-Pos receptive neural network is used to assess and classify the injection risk of the input text. This network is specifically designed to receive and process the aforementioned structured positional encoding sequences. It is a hybrid neural network that integrates convolutional attention mechanisms and multilayer perceptrons. Its core task is to map positional distribution patterns to injection risk probabilities. The model network abstracts risk patterns from the original features level by level through the following hierarchical structure: All the features obtained above are shaped into tensor formats suitable for deep network processing.
[0044] For location-based bucket histogram features and serialized location encoding, a one-dimensional convolutional kernel is used to perform a sliding scan along the location dimension to capture the local clustering patterns of control content in the text space.
[0045] By incorporating attention mechanisms, the network learns to assign different weights to features in different location intervals.
[0046] The features obtained through local perception, along with other global statistical features (coverage, number of segments, etc.), structural features, and behavioral difference features, are input into multiple fully connected layers.
[0047] The final fully connected layer maps the high-level features to a scalar and outputs the final injection risk probability value Prisk through a sigmoid activation function.
[0048] According to an embodiment of the present invention, the risk result output by the injection discrimination network module includes a risk score or a classification label of high risk or low risk; when the risk result is high risk, the triggered security handling strategy includes at least one of input interception, content purification, and manual review.
[0049] In summary, the present invention has the following advantages compared with the prior art: Structured modeling: By using positional encoding and structural carrier features, the injection behavior is abstracted in a structured way, reducing the dependence on specific words and explicit semantics.
[0050] Strong anti-circumvention capability: It can identify hidden injection commands in cross-sentence, cross-paragraph, and cross-turn dialogues, and has stronger robustness against synonym rewriting, split injection, tail injection, and carrier spoofing.
[0051] Difference Enhancement Discrimination: By introducing difference responses through positional encoding perturbations and control statement disturbances, the abnormal impact of jailbreak commands on model behavior is amplified, thereby improving detection sensitivity and generalization ability.
[0052] Pre-emptive protection: Injection detection is performed before the large language model is executed to prevent high-risk inputs from entering the core reasoning process and reduce the risk of sensitive information leakage and unauthorized execution.
[0053] Universality and scalability: Applicable to various large language model architectures and multilingual inputs, and can be extended to include structural carrier recognition and risk strategies according to application requirements.
[0054] Those skilled in the art will understand that, for ease of explanation, the example is provided with one memory and one processor. In actual terminals or servers, multiple processors and memories may exist. Memory can also be referred to as storage medium or storage device, etc., and the embodiments of this application do not limit this.
[0055] It should be understood that in the embodiments of this application, the processor may be a Central Processing Unit (CPU), or it may be other general-purpose processors, digital signal processors (DSPs), application-specific integrated circuits (ASICs), field-programmable gate arrays (FPGAs), or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, etc. The processor may also be a general-purpose microprocessor, graphics processing unit (GPU), or one or more integrated circuits to execute relevant programs to achieve the functions required by the embodiments of this application.
[0056] The processor can also be an integrated circuit chip with signal processing capabilities. In implementation, each step of this application can be completed through integrated logic circuits in the processor hardware or instructions in software form. The aforementioned processor can implement or execute the methods, steps, and logic block diagrams disclosed in the embodiments of this application. The steps of the methods disclosed in the embodiments of this application can be directly manifested as execution by a hardware decoding processor, or execution by a combination of hardware and software modules in the decoding processor. The software modules can reside in random access memory, flash memory, read-only memory, programmable read-only memory, electrically erasable programmable memory, registers, or other mature storage media in the art. This storage medium is located in memory; the processor reads information from the memory and, in conjunction with its hardware, completes the functions required by the units included in the methods, systems, and storage media of the embodiments of this application.
[0057] It should also be understood that the memory mentioned in the embodiments of this application can be volatile memory or non-volatile memory, or may include both volatile and non-volatile memory. Non-volatile memory can be read-only memory (ROM), programmable read-only memory (PROM), erasable programmable read-only memory (EPROM), electrically erasable programmable read-only memory (EEPROM), or flash memory. Volatile memory can be random access memory (RAM), which is used as an external cache.
[0058] By way of example, but not limitation, many forms of RAM are available, such as Static Random Access Memory (SRAM), Dynamic Random Access Memory (DRAM), Synchronous DRAM (SDRAM), Double Data Rate SDRAM (DDR SDRAM), Enhanced Synchronous DRAM (ESDRAM), Synchlink DRAM (SLDRAM), and Direct Rambus RAM (DR RAM).
[0059] The memory can also be a Compact Disc Read-Only Memory (CD-ROM) or other optical disc storage, optical disk storage (including compressed optical discs, laser discs, optical discs, digital universal optical discs, Blu-ray discs, etc.), magnetic disk storage media, or other magnetic storage devices, or any other medium capable of carrying or storing desired program code in the form of instructions or data structures that can be accessed by a computer, but is not limited thereto. The memory can exist independently and be connected to the processor via a bus. The memory can also be integrated with the processor. The memory can store programs, and when the program stored in the memory is executed by the processor, the processor performs the various steps of the method determined in the above embodiments of this application.
[0060] It should be noted that when the processor is a general-purpose processor, DSP, ASIC, FPGA, or other programmable logic device, discrete gate or transistor logic device, or discrete hardware component, the memory (storage module) is integrated into the processor. It should be noted that the memory described herein is intended to include, but is not limited to, these and any other suitable types of memory.
[0061] It should be understood that the term "and / or" in this article is merely a description of the relationship between related objects, indicating that three relationships can exist. For example, A and / or B can represent: A existing alone, A and B existing simultaneously, or B existing alone. Additionally, the character " / " in this article generally indicates that the preceding and following related objects have an "or" relationship.
[0062] In implementation, each step of the above method can be completed by integrated logic circuits in the processor's hardware or by instructions in software. The steps of the method disclosed in the embodiments of this application can be directly implemented by a hardware processor, or by a combination of hardware and software modules within the processor. The software modules can reside in mature storage media in the art, such as random access memory, flash memory, read-only memory, programmable read-only memory, electrically erasable programmable memory, or registers. Since this storage medium is located in memory, the processor reads information from the memory and, in conjunction with its hardware, completes the steps of the above method; to avoid repetition, these will not be described in detail here.
[0063] Those skilled in the art will recognize that the various illustrative logical blocks (ILBs) and steps described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, or a combination of computer software and electronic hardware. Whether these functions are implemented in hardware or software depends on the specific application and design constraints of the technical solution. Those skilled in the art can use different methods to implement the described functions for each specific application, but such implementations should not be considered beyond the scope of this application.
[0064] In the above embodiments, implementation can be achieved, in whole or in part, through software, hardware, firmware, or any combination thereof. When implemented in software, it can be implemented, in whole or in part, as a computer-programmed program product. A computer program product includes one or more computer instructions. When the computer program instructions are loaded and executed on a processor, all or part of the flow or function according to the embodiments of this application is generated. The computer can be a general-purpose computer, a computer network, or other programmable device.
[0065] This embodiment also provides a computer-readable storage medium storing a computer program that causes a computer to execute in order to implement the above-described position-encoded LLM input injection detection method.
[0066] It should be noted that computer instructions can be stored in a computer-readable storage medium or transmitted from one computer-readable storage medium to another. For example, computer instructions can be transmitted from one website, computer, server, or data center to another via wired (e.g., coaxial cable, fiber optic) or wireless (e.g., infrared, wireless, microwave, etc.) means, or from one website, computer, server, or data center to a mobile phone processor via a wired means. A computer-readable storage medium can be any usable medium that a computer can access, or a data storage system such as a server or data center that integrates one or more usable media. Usable media can be magnetic media (e.g., floppy disks, hard disks), optical media (e.g., DVDs), or semiconductor media (e.g., solid-state drives), etc.
[0067] Finally, it should be noted that the above are merely preferred embodiments of the present invention and are not intended to limit the present invention. Although the present invention has been described in detail with reference to the foregoing embodiments, those skilled in the art can still modify the technical solutions described in the foregoing embodiments or make equivalent substitutions for some of the technical features. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of the present invention should be included within the protection scope of the present invention.
Claims
1. A position-encoded LLM input injection detection method, characterized in that, Includes the following steps: S1, Obtain the text sequence to be input into the large language model; S2, the text sequence is divided into multiple text units with independent semantic features according to different granularities; S3, based on the semantic attributes and contextual relationships of the text units, identify the control or instructional sentence fragments and descriptive sentence fragments in the text sequence that are related to the output behavior of the large language model; S4, perform position encoding processing on the position of the control or instruction statement fragment in the text sequence to generate a position encoding sequence; S5, perform a light perturbation on the control or instruction statement fragment, input the original input and the perturbation input to the target model respectively, extract the model output distribution or internal representation and calculate the difference features; S6, Based on the position encoding sequence and the difference feature, extract the structural position feature and construct the fusion feature vector; S7, input the fused feature vector into the injection discriminative neural network model to obtain the injection risk result of the text sequence; when the risk result exceeds a preset threshold, prevent the text sequence from entering the large language model inference process.
2. The LLM input injection detection method based on positional encoding as described in claim 1, characterized in that, In step S2, the granularity of text unit division, from largest to smallest, includes: division by punctuation marks, division based on grammatical structure while maintaining the integrity of semantic units, and division by phrases.
3. The LLM input injection detection method based on positional encoding as described in claim 2, characterized in that, In step S3, the control or instructional statement fragment includes at least one of rule overriding, role switching, priority declaration, format enforcement, prohibited or required statements, ignored or disregarded statements, tool call instructions, and conditional branch statements.
4. The LLM input injection detection method based on positional encoding as described in claim 1, characterized in that, In step S4, the location encoding adopts a structured encoding method based on normalized location and distribution statistics, specifically including: Calculate the relative start and end coordinates of the control segment within the text sequence; Global distribution statistics of generated control content, including control segment coverage, number of segments, average length, and maximum length; Divide the text sequence into K equal-length logical intervals, count the token proportion of the control segment in each interval, and generate a K-dimensional bucket density histogram. Extract the structural carrier features of the control segment, including whether it is located in at least one of the following: code block, quotation block, inside parentheses / quotes, JSON / YAML key-value area, list / title area.
5. The LLM input injection detection method based on positional encoding as described in claim 1, characterized in that, The relative start and end coordinates are calculated as follows: with the total length L of the text sequence as the denominator, the ratio of the start index start to the end index end of the control segment is calculated, namely start / L and end / L.
6. The LLM input injection detection method based on positional encoding as described in claim 4, characterized in that, In step S5, the measurement method of the difference feature includes at least one of logits difference, embedding difference, similarity change, and cross-layer difference spectrum.
7. The LLM input injection detection method based on positional encoding as described in claim 1, characterized in that, In step S7, the injection discrimination neural network model is RXNet-Pos, which includes a one-dimensional convolutional layer, an attention mechanism layer, and a fully connected layer. The injection risk probability value is output through the Sigmoid activation function.
8. A position-encoded LLM input injection detection system, applied to the position-encoded LLM input injection detection method according to any one of claims 1-7, characterized in that, include; The input receiving module is used to acquire the text sequence to be input into the large language model; A text unit segmentation module is used to divide the text sequence into multiple text units with independent semantic features; A control statement recognition module is used to identify control or instructional statement fragments and descriptive statement fragments in the text sequence; A position encoding module is used to encode the position of the control or instruction statement fragment to generate a position encoding sequence; The perturbation difference feature generation module is used to perform a light perturbation on the control statement and calculate the difference features between the original input and the model output or representation corresponding to the perturbation input. The structural feature extraction and fusion module is used to construct a fused feature vector based on positional encoding sequences and difference features; The injection discriminant network module is used to input the fused feature vector into the RXNet-Pos neural network and output the injection risk result.
9. The LLM input injection detection system based on position coding as described in claim 8, characterized in that, The risk results output by the injection discrimination network module include risk scores or high-risk and low-risk classification labels; when the risk result is high-risk, the triggered security handling strategies include at least one of input interception, content purification, and manual review.