Transaction risk detection method, device and equipment

Abstract

The embodiment of the invention provides a transaction risk detection method, device and equipment, and the method comprises the steps: receiving a transaction risk detection request for a target object, obtaining multi-modal business data related to the transaction behavior of the target object in response to the transaction risk detection request, and carrying out the detection of the transaction risk of the target object through a preset large language model, feature extraction processing is carried out on the multi-modal service data, credible features and suspicious features corresponding to the target object are obtained, and the credible features are used for representing that the probability that the target object has the transaction risk is smaller than a preset probability threshold value; the suspicious feature is used for representing that the probability that the target object has the transaction risk is greater than a preset probability threshold value, performing confrontation analysis on the credible feature and the suspicious feature, and determining whether the target object has the transaction risk according to a confrontation analysis result.

Description

Technical Field

[0001] This application relates to the field of computer technology, and in particular to a method, apparatus and equipment for detecting transaction risks. Background Technology

[0002] As financial services become increasingly digitalized, risky behaviors such as illegal transactions are becoming more covert, intelligent, and cross-platform. How to detect risks among trading users in order to protect user privacy and ensure transaction and data security has become a focus of attention for all industries.

[0003] Risk detection for trading users can be performed using models built on deep learning algorithms, such as Big Language. However, due to the inherent mechanism of Big Language models and the limitations of training data, model illusions such as factual errors may occur, leading to low accuracy in risk detection. Therefore, a more reliable risk detection solution for trading objects is needed. Summary of the Invention

[0004] The purpose of the embodiments in this specification is to provide a more reliable risk detection scheme for trading objects.

[0005] To achieve the above technical solution, the embodiments in this specification are implemented as follows: This specification provides a transaction risk detection method, comprising: receiving a transaction risk detection request for a target object; responding to the transaction risk detection request, acquiring multimodal business data related to the transaction behavior of the target object; using a preset large language model to perform feature extraction processing on the multimodal business data to obtain credible features and suspicious features corresponding to the target object, wherein the credible features are used to characterize that the probability of the target object having transaction risk is less than a preset probability threshold, and the suspicious features are used to characterize that the probability of the target object having transaction risk is greater than a preset probability threshold; performing adversarial analysis on the credible features and the suspicious features, and determining whether the target object has transaction risk based on the adversarial analysis results.

[0006] This specification provides a transaction risk detection device, comprising: a request receiving module for receiving a transaction risk detection request for a target object; a data acquisition module for acquiring multimodal business data related to the transaction behavior of the target object in response to the transaction risk detection request; a feature extraction module for performing feature extraction processing on the multimodal business data using a preset large language model to obtain credible features and suspicious features corresponding to the target object, wherein the credible features indicate that the probability of the target object having a transaction risk is less than a preset probability threshold, and the suspicious features indicate that the probability of the target object having a transaction risk is greater than a preset probability threshold; and a risk detection module for performing adversarial analysis on the credible features and the suspicious features, and determining whether the target object has a transaction risk based on the adversarial analysis results.

[0007] This specification provides an embodiment of a transaction risk detection device, comprising: a processor; and a memory configured to store computer-executable instructions, wherein the executable instructions, when executed, cause the processor to: receive a transaction risk detection request for a target object; in response to the transaction risk detection request, acquire multimodal business data related to the transaction behavior of the target object; perform feature extraction processing on the multimodal business data using a preset large language model to obtain credible features and suspicious features corresponding to the target object, wherein the credible features characterize that the probability of the target object having a transaction risk is less than a preset probability threshold, and the suspicious features characterize that the probability of the target object having a transaction risk is greater than a preset probability threshold; perform adversarial analysis on the credible features and the suspicious features, and determine whether the target object has a transaction risk based on the adversarial analysis results.

[0008] This specification also provides a storage medium for storing computer-executable instructions. When executed by a processor, the executable instructions implement the following process: receiving a transaction risk detection request for a target object; responding to the transaction risk detection request, acquiring multimodal business data related to the transaction behavior of the target object; using a preset large language model to perform feature extraction processing on the multimodal business data to obtain credible features and suspicious features corresponding to the target object, wherein the credible features are used to characterize that the probability of the target object having transaction risk is less than a preset probability threshold, and the suspicious features are used to characterize that the probability of the target object having transaction risk is greater than a preset probability threshold; performing adversarial analysis on the credible features and the suspicious features, and determining whether the target object has transaction risk based on the adversarial analysis results.

[0009] This specification also provides a computer program product, including a computer program that, when executed by a processor, implements the following process: receiving a transaction risk detection request for a target object; responding to the transaction risk detection request, acquiring multimodal business data related to the transaction behavior of the target object; using a preset large language model to perform feature extraction processing on the multimodal business data to obtain credible features and suspicious features corresponding to the target object, wherein the credible features are used to characterize that the probability of the target object having transaction risk is less than a preset probability threshold, and the suspicious features are used to characterize that the probability of the target object having transaction risk is greater than a preset probability threshold; performing adversarial analysis on the credible features and the suspicious features, and determining whether the target object has transaction risk based on the adversarial analysis results. Attached Figure Description

[0010] To more clearly illustrate the technical solutions in the embodiments or prior art of this specification, the drawings used in the description of the embodiments or prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments recorded in this specification. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort. Figure 1 This is a schematic diagram illustrating the implementation environment of one of the transaction risk detection methods described in this specification. Figure 2 This is a schematic diagram illustrating the processing procedure of one transaction risk detection method described in this specification; Figure 3 This is a schematic diagram of a feature extraction process described in this specification; Figure 4 This is a schematic diagram of a transaction risk detection system described in this specification; Figure 5 This is a schematic diagram of a transaction risk detection process described in this manual; Figure 6 This is a schematic diagram of an adversarial analysis process described in this specification; Figure 7 This is a schematic diagram of another adversarial analysis process described in this specification; Figure 8 This is a schematic diagram of another adversarial analysis process described in this specification; Figure 9 This is a schematic diagram illustrating the update process of a large language model as described in this specification. Figure 10 This is a schematic diagram of yet another transaction risk detection device described in this manual; Figure 11 This is a schematic diagram of a transaction risk detection device described in this manual. Detailed Implementation

[0011] This specification provides a method, apparatus, and device for detecting transaction risks.

[0012] To enable those skilled in the art to better understand the technical solutions in this specification, the technical solutions in the embodiments of this specification will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of this specification, and not all embodiments. Based on the embodiments in this specification, all other embodiments obtained by those skilled in the art without creative effort should fall within the scope of protection of this specification.

[0013] This specification provides a more reliable risk detection scheme for trading objects. On the one hand, it can comprehensively and accurately detect the risk of target objects by using multi-source heterogeneous data (i.e., multimodal business data) from different systems with different structures and semantics. On the other hand, by using adversarial analysis of credible and suspicious features extracted by a large language model, it can avoid the low accuracy problem caused by the large language model relying solely on single-dimensional features for risk detection. Furthermore, the adversarial analysis results can accurately detect whether the target object has transaction risks, thus improving the accuracy of risk detection. Specific processing details can be found in the following embodiments.

[0014] The transaction risk detection method described in one or more embodiments of this specification is applicable to the implementation environment of transaction risk detection, such as... Figure 1 As shown, the implementation environment includes at least: Client 100 and server 200. Furthermore, server 200 can be configured with various network models and algorithms, among which: Client 100 can run on terminal devices, which can be mobile phones, personal computers, tablets, e-book readers, wearable devices, devices that interact with information based on AR (Augmented Reality) and VR (Virtual Reality), and laptop computers, etc. Client 100 can be installed on terminal devices, and Client 100 can be an application, a browser, or a subroutine embedded in an application, etc.

[0015] Server 200 can run on a server, which can be one or more servers, a server cluster consisting of several servers, or a cloud server on a cloud computing platform. Server 200 can be installed on the server. Server 200 can be an application or a subroutine embedded in an application. Various network models and algorithms can be integrated into server 200, or server 200 can call one or more of various network models and algorithms to perform corresponding operations.

[0016] In addition, it may include a database 300, which may be located in the server on which the server 200 runs or outside the server on which the server 200 runs. The database 300 may store multimodal business data related to the transaction phase of each target object to be detected.

[0017] In this implementation environment, server 200 can receive a transaction risk detection request sent by client 100 for a target object. In response to the transaction risk detection request, server 200 can obtain multimodal business data related to the transaction behavior of the target object, and use a preset large language model to perform feature extraction processing on the multimodal business data to obtain credible features and suspicious features corresponding to the target object. The credible features can be used to indicate that the probability of the target object having transaction risk is less than a preset probability threshold, and the suspicious features can be used to indicate that the probability of the target object having transaction risk is greater than a preset probability threshold. Adversarial analysis is performed on the credible features and suspicious features, and based on the adversarial analysis results, it is determined whether the target object has transaction risk. Then, server 200 can return the transaction risk detection result to client 100.

[0018] like Figure 2 As shown in the embodiments of this specification, a transaction risk detection method is provided. The execution subject of this method can be a server, which can be a single independent server or a server cluster composed of multiple servers. The server can be a backend server for businesses such as financial services or online shopping, or a backend server for an application. The method specifically includes the following steps: In step S202, a transaction risk detection request for the target object is received.

[0019] The target object can be any user, account, or other object that can engage in transaction activities.

[0020] In practice, the server can identify users who generate transaction behavior within a preset detection period as target objects. Alternatively, the server can identify a user as a target object and trigger a transaction risk detection request for that target object when it detects that the user has triggered a transaction such as resource transfer.

[0021] In step S204, in response to the transaction risk detection request, multimodal business data related to the transaction behavior of the target object is obtained.

[0022] Multimodal business data can be multi-source heterogeneous data that is related to transaction behavior and has different data structures, obtained through multiple different collection channels. For example, multimodal business data can include one or more of the following: text data, structured data, time-series behavioral data, and graph structure data. Text data can include unstructured natural language data such as message data, interaction data, and transaction notes of the target object. Structured data can include tabular data containing object information of the target object (such as account balance, registration information, etc.). Time-series behavioral data can include transaction data and login logs of the target object, which are sequence data ordered by time. Graph structure data can include graph data constructed by nodes and edges, such as resource flow graph structure data and object association graph structure data.

[0023] In practice, in response to transaction risk detection requests, the server can collect data related to the target object and transaction behavior as multimodal business data by using multiple different collection channels, based on the object identifier of the target object and the behavior identifier of the target object's transaction behavior.

[0024] In step S206, a preset large language model is used to perform feature extraction processing on multimodal business data to obtain credible features and suspicious features corresponding to the target object.

[0025] Among them, the trustworthy feature can be used to characterize that the probability of the target object having transaction risk is less than a preset probability threshold, while the suspicious feature can be used to characterize that the probability of the target object having transaction risk is greater than a preset probability threshold.

[0026] In implementation, the server can use a pre-defined Large Language Model (LLM) to extract features from multimodal business data that have a probability of less than a pre-defined probability threshold that can be used to characterize the existence of transaction risks of the target object, based on the semantics of the multimodal business data and the data source (i.e., collection channel), as credible features. At the same time, it can extract features from multimodal business data that have a probability of greater than a pre-defined probability threshold that can be used to characterize the existence of transaction risks of the target object as suspicious features.

[0027] For example, a server can use a pre-defined large language model (such as a multimodal large language model) to perform feature extraction on multimodal business data and determine the correlation between the extracted features and each risk type (such as no risk, low risk, high risk, etc.). Then, the server can filter out trustworthy features and suspicious features corresponding to the target object based on the correlation between the features and each risk type. For example, the server can identify features with a correlation greater than a pre-defined correlation threshold with no risk as trustworthy features corresponding to the target object, and identify features with a correlation greater than a pre-defined correlation threshold with high risk as suspicious features corresponding to the target object.

[0028] Alternatively, the server can determine the credibility of each feature based on its data source. It can also determine the credibility of features from different data sources based on the credibility of the data source. The credibility of the data source can be determined based on the type of data source (such as computer-generated data types (i.e., log files, system records, and other data types automatically generated by computer programs), manually collected data types, etc.), the nature of the data source (such as official, self-media, public media, etc.), and historical posting information.

[0029] For example, taking the credibility of the data source as the basis for determining the type of data source, the credibility of the data source for computer-generated data types can be higher than that for manually collected data types. That is, the credibility of the features of the data source for computer-generated data types can be higher, while the credibility of the features contained in the data source for manually collected data types can be lower.

[0030] In this way, the server can determine the trustworthy and suspicious features of the target object based on the trustworthiness of each feature and the correlation between each feature and each risk type.

[0031] Furthermore, the aforementioned method for determining credible and suspicious features is an optional and implementable method. In practical application scenarios, there can be a variety of different methods. Different methods can be selected according to different practical application scenarios. This specification does not specifically limit the embodiments in this regard.

[0032] In step S208, adversarial analysis is performed on credible and suspicious features, and based on the results of the adversarial analysis, it is determined whether the target object has transaction risks.

[0033] Among them, the adversarial analysis results can be used to characterize the adversarial reasoning results between credible features and suspicious features.

[0034] In implementation, the server can use a pre-set large language model to obtain the credibility of credible features and the credibility of suspicious features. Based on the credibility, the number of credible features, and the number of suspicious features, the server can perform adversarial analysis on the credible features and suspicious features to obtain the adversarial analysis results.

[0035] For example, the server can obtain target trusted features with a trustworthiness greater than a preset trustworthiness threshold from trusted features, and target suspicious features with a trustworthiness greater than a preset trustworthiness threshold from suspicious features. Then, based on the number of target trusted features and the number of target suspicious features, the adversarial analysis result can be determined. Specifically, if the number of target trusted features is greater than the number of target suspicious features, the adversarial analysis result can be determined that the target object does not pose a transaction risk; conversely, if the number of target trusted features is not greater than the number of target suspicious features, the adversarial analysis result can be determined that the target object poses a transaction risk.

[0036] Alternatively, the server can determine a first risk value (e.g., the difference between the numbers) based on the number of credible features and the number of suspicious features. Then, it can determine a second risk value (e.g., the difference between the means) based on the mean (or maximum, minimum, etc.) of the credibility of credible features and the mean (or maximum, minimum, etc.) of the credibility of suspicious features. Finally, the adversarial analysis result can be determined based on the first and second risk values.

[0037] Furthermore, the process of determining the results of the above-mentioned adversarial analysis is an optional and feasible process. In practical application scenarios, there can be a variety of different determination methods. Different determination methods can be selected according to different practical application scenarios. This specification does not specifically limit this in the embodiments.

[0038] This specification provides a transaction risk detection method. It receives a transaction risk detection request for a target object, and in response, acquires multimodal business data related to the target object's transaction behavior. Using a preset large language model, it performs feature extraction processing on the multimodal business data to obtain credible and suspicious features corresponding to the target object. Credible features indicate that the probability of the target object having transaction risk is less than a preset probability threshold, while suspicious features indicate that the probability of the target object having transaction risk is greater than a preset probability threshold. Adversarial analysis is performed on the credible and suspicious features, and based on the adversarial analysis results, it is determined whether the target object has transaction risk. On the one hand, multi-source heterogeneous data (i.e., multimodal business data) from different systems with different structures and semantics can comprehensively and accurately detect risk in target objects. On the other hand, adversarial analysis using credible and suspicious features extracted by the large language model avoids the low accuracy problem caused by the large language model relying solely on single-dimensional features for risk detection. Furthermore, the adversarial analysis results can accurately detect whether the target object has transaction risk, improving the accuracy of transaction risk detection.

[0039] In practical applications, the specific processing methods for obtaining credible and suspicious features corresponding to the target object by using a preset large language model in step S206 above can be varied. The following provides one optional method for determining these features: Figure 3 As shown, the specific process may include the following steps S2062 to S2064.

[0040] In step S2062, modal alignment processing is performed on the multimodal service data to obtain aligned service data.

[0041] In practice, risk information may be scattered across multiple modalities of data. For example, text data may contain information about the user's subjective intent, structured data can be used to characterize the user's basic identity features, time-series behavioral data can reflect the user's dynamic operating patterns, and graph structure data can be used to characterize implicit group relationships. Therefore, if business data of different modalities is modeled and processed separately or vector concatenation is performed, there will be a lack of preservation of the feature semantics of the original business data and cross-modal logical alignment. As a result, when using models built based on deep learning algorithms, such as large language models, to detect transaction risks, the output content may be out of touch with the facts, or even produce "illusions," due to the inability to accurately reference the specific features in the original input (such as "an average of 5 transfers per day"), leading to low credibility of the conclusions.

[0042] Therefore, as Figure 4As shown, a transaction risk detection system can be built based on a multi-source heterogeneous data unified alignment module, an LLM-driven adversarial structured reasoning module, and an interpretable reinforcement learning feedback module.

[0043] The server can utilize the alignment units (such as text alignment units, structured alignment units, sequence alignment units, and graph data alignment units) corresponding to each modality in the multi-source heterogeneous data unified alignment module to perform cross-modal contextual alignment on multimodal business data. This allows for the semantic extraction of different modal data and mapping them to a unified risk analysis logic framework to obtain aligned business data. The aligned business data can include features and feature values.

[0044] In this way, risk-related data from different sources and formats can be unified into a form that can be understood by a pre-defined large language model through a multi-source heterogeneous data unification alignment module, while retaining the original feature names for subsequent inference.

[0045] For example, for text data in multimodal business data, the server can use text alignment units to clean and summarize the text data, use structured alignment units to perform linguistic assembly processing on structured data, use sequence alignment units to perform model analysis and linguistic assembly processing on time-series behavioral data, and use graph data alignment units to perform graph relation extraction, structured network input, and linguistic assembly processing on graph structured data, so as to obtain the features and feature values ​​contained in business data of different modalities.

[0046] The server can assign unique symbolic identifiers (such as f1, f2, etc.) to the extracted features and feature values, and build a mapping table based on the extracted features and feature values.

[0047] For example, the server can align time-series data such as "50 transfers in the last 30 days" into feature f1, with the feature value being high-frequency transactions, and align graph data such as "payee A is involved in fraud" into feature f2, with the feature value being related party involved in fraud. The results obtained from the alignment process can share the same set of risk semantic space, such as "abnormal behavior" and "identity credibility".

[0048] In this way, to avoid the problem that the model cannot uniformly understand multi-source heterogeneous data (i.e. multimodal business data) and the problem that the output is not traceable due to the loss of original features in inference, the above alignment process can realize the end-to-end preservation of the original feature semantics of multimodal input representation, providing a foundation for subsequent factual verification and regulatory audit.

[0049] In step S2064, a preset large language model is used to extract features from the aligned business data based on preset prompt information to obtain the credible features and suspicious features corresponding to the target object.

[0050] The preset prompts can be used to constrain the output of the large language model to conform to the preset format specifications. For example, the preset prompts may include "the format of the output credible features and / or suspicious features is "feature-feature value"". The server can use CFG (Context-Free Grammar), regular expression constraints or word list masking to ensure that the output of the large language model conforms to the preset format specifications.

[0051] In implementation, the server can use preset prompts to determine whether the credible and / or suspicious features output by the large language model can reference the original features (i.e., the aligned multimodal business data), thus avoiding the "illusion" problem of the large language model and ensuring the credibility of the conclusions of the large language model.

[0052] For example, such as Figure 4 As shown, the LLM-driven adversarial structured reasoning module in the transaction risk detection system can be used. This module can guide the LLM to adhere to a preset structured template (i.e., preset format specifications) during the generation process, explicitly separating credible and suspicious features, and completing the adversarial judgment. This module can include a constrained decoder, which dynamically limits the output space during the adversarial analysis result generation stage. For example, when generating "credible features," only the format {fX-value, fY-value} is allowed to be output, where fX and fY are features, and value is the feature value; when generating detection conclusions, the generated results only include "risky" or "no risk."

[0053] In practical applications, the specific handling methods for determining whether the target object has transaction risks based on the adversarial analysis results in step S208 above can vary. The following provides one optional method for determination, such as... Figure 5 As shown, the specific process may include the following steps S2082 to S2084.

[0054] In step S2082, the adversarial analysis results are evaluated for quality based on the format, preset format specifications, credible features, and suspicious features, and the quality evaluation results are obtained.

[0055] In implementation, the server can use a pre-trained evaluation model to evaluate the quality of the adversarial analysis results based on the format, preset format specifications, credible features, and suspicious features of the adversarial analysis results, and obtain the quality evaluation results. The evaluation model can be a model built based on a preset machine learning algorithm.

[0056] In practical applications, the quality assessment of the adversarial analysis results in step S2082 based on the format, preset format specifications, credible features, and suspicious features can be performed in various ways to obtain the quality assessment results. The following provides an optional determination method, which may include the following steps A1 to A3.

[0057] In step A1, reliable and suspicious features are determined to exist in the aligned business data, and the first evaluation result is obtained.

[0058] In implementation, different scores can be configured for different situations, and the sum of these scores is determined as the first evaluation result. For example, if a feature (both credible and suspicious features) exists in the aligned business data, the score for that feature can be 1; if a feature does not exist in the aligned business data, the score for that feature can be -1. Finally, the scores for each feature can be aggregated to obtain the first evaluation result. In this way, the first evaluation result can be used to assess whether the features extracted by the large language model have a clear source of evidence.

[0059] In step A2, it is determined whether the format of the adversarial analysis result matches the preset format specification, and the second evaluation result is obtained.

[0060] In implementation, for example, the preset format specification may include specifications for format constraints, such as limiting the output of the large language model to JSON Schema format. Then, the server can determine whether the adversarial analysis result is in JSON Schema format and obtain the second evaluation result.

[0061] Furthermore, the server can also obtain a second evaluation result based on whether the fields included in the adversarial analysis results are missing or misaligned. For example, assuming that according to the preset format specifications, the output of the large language model should include the detection conclusion, risk type, credible features, suspicious features, and the adversarial analysis process, the server can check whether the adversarial analysis results contain the above fields and whether each field corresponds to a feature. Based on the detection results, a second evaluation result can be obtained. In this way, the output of the large language model can be used to ensure that it complies with the disclosure requirements for the "criteria for risk judgment" in the preset specifications, that is, to ensure that the adversarial analysis results output by the large language model meet compliance requirements.

[0062] In step A3, the quality assessment result is determined based on the first assessment result and / or the second assessment result.

[0063] The results of the adversarial analysis today include detection conclusions and risk types. Detection conclusions can include two categories: the existence of risk and the absence of risk. Risk types can be used to characterize the specific type of transaction risk of the target object, such as illegal financial activities, fraud, illegal business operations, etc.

[0064] In practice, the server can perform a weighted summation of the first and second evaluation results to determine the quality evaluation result for the adversarial analysis results based on the summation result.

[0065] Alternatively, the server can perform consistency checks between features and conclusions based on the number of trustworthy features, the number of suspicious features, and the detection conclusions, to obtain a third evaluation result.

[0066] For example, if the number of suspicious features is zero and the number of credible features is not zero, but the detection conclusion is that there is a risk, then the score of the corresponding third evaluation result is low because the consistency between the features and the conclusion is low. Similarly, if the number of credible features is zero and the number of suspicious features is not zero, but the detection result is that there is no risk, then the score of the corresponding third evaluation result is low because the consistency between the features and the conclusion is low.

[0067] Furthermore, the server can utilize a pre-trained consistency detection model to perform consistency detection between features and conclusions based on the number and type of credible features, the number and type of suspicious features, and the detection conclusions. Based on the consistency detection results, a third evaluation result is determined. The consistency detection model can be a model built using a pre-defined machine learning algorithm.

[0068] Then, the server can also perform semantic consistency checks on the detection conclusions and risk types to obtain the fourth evaluation result.

[0069] For example, if the test result is that there is no risk, but the risk type is illegal operation, the corresponding score of the fourth assessment result will also be low because the semantic consistency between the test result and the risk type is low.

[0070] Finally, the server determines the quality assessment result based on one or more of the following evaluation results: a first evaluation result, a second evaluation result, a third evaluation result, and a fourth evaluation result. For example, the server can perform a weighted summation of the first, second, third, and fourth evaluation results to determine the quality assessment result for the adversarial analysis results based on the summation result.

[0071] In step S2084, based on the quality assessment results, it is determined whether the adversarial analysis results meet the transaction risk detection requirements of the target object. If it is determined that the adversarial analysis results meet the transaction risk detection requirements of the target object, it is determined that the target object has transaction risks based on the adversarial analysis results.

[0072] In practice, taking the quality assessment result including a quality assessment score as an example, if the quality assessment score is not less than the preset score threshold, it can be determined that the adversarial analysis result meets the transaction risk detection requirements of the target object. If the quality assessment score is less than the preset score threshold, it can be determined that the adversarial analysis result does not meet the transaction risk detection requirements of the target object.

[0073] If the adversarial analysis results meet the corresponding transaction risk detection requirements of the target object, the target object is identified as having transaction risks based on the adversarial analysis results. If the adversarial analysis results do not meet the corresponding transaction risk detection requirements of the target object, the multimodal business data, suspicious features, trustworthy features, adversarial analysis results, and quality assessment results can be sent to a pre-set reviewer for review, so as to determine whether the target object has transaction risks based on the review results.

[0074] In practical applications, the specific processing methods for adversarial analysis of credible and suspicious features in step S208 above can vary. The following provides one optional determination method, such as... Figure 6 As shown, the specific process may include the following steps S2086 to S2088.

[0075] In step S2086, the credibility of credible features and the credibility of suspicious features are determined using a pre-trained judgment model based on multimodal business data.

[0076] The decision model can be a model built based on a preset deep learning algorithm.

[0077] In step S2088, a pre-defined large language model is used to perform adversarial analysis on credible features and credibility, as well as suspicious features and credibility.

[0078] In implementation, the server can utilize a pre-defined large language model to perform adversarial analysis on credible and suspicious features based on pre-defined prompts, credible features and their credibility levels. This improves the accuracy of the large language model's output by basing the credibility levels on the features.

[0079] In practical applications, the specific processing methods for adversarial analysis of credible and suspicious features in step S208 above can vary. The following provides one optional determination method, such as... Figure 7As shown, the specific process may include the following steps S20810 to S20814.

[0080] In step S20810, the first feature weight corresponding to the credible feature and the second feature weight corresponding to the suspicious feature are obtained.

[0081] In practice, the server can obtain the first feature weight corresponding to the credible feature and the second feature weight corresponding to the suspicious feature based on the preset correspondence between features and weights.

[0082] Among them, the preset correspondence can be a correspondence set by experts in the field of transaction risk based on knowledge and experience, or the preset correspondence can be extracted based on historical transaction data using a pre-trained extraction model. In addition, there are many other methods for determining the preset correspondence, which can vary depending on the actual application scenario. This specification does not specifically limit this method in the embodiments.

[0083] In step S20812, a first weighted feature is determined based on the first feature weight and the credible feature, and a second weighted feature is determined based on the second feature weight and the suspicious feature.

[0084] In practice, the server can determine the feature score corresponding to each feature (i.e., credible feature and suspicious feature) according to the preset correspondence between features and feature scores, and then perform weighted processing on the feature scores according to the feature weights corresponding to the features to obtain the first weighted feature and the second weighted feature respectively.

[0085] In step S20814, adversarial analysis is performed on credible features and suspicious features based on the first weighted features and the second weighted features.

[0086] In practice, the server can determine the weight relationship between credible features and suspicious features based on the relationship between the scores corresponding to the first weighted feature and the scores corresponding to the second weighted feature. For example, if the score corresponding to the first weighted feature is greater than the score corresponding to the second weighted feature, the weight of the credible feature can be considered greater than that of the suspicious feature. Conversely, if the score corresponding to the first weighted feature is less than the score corresponding to the second weighted feature, the weight of the credible feature can be considered less than that of the suspicious feature.

[0087] For example, in such Figure 4The LLM-driven adversarial structured reasoning module shown can also include an adversarial reasoning engine. For example, two evidence pools can be maintained on the server: a trusted data pool for storing credible features and a suspicious data pool for storing suspicious features, to perform adversarial analysis based on the features stored in these two evidence pools. This allows the LLM output to describe the weight comparison of credible and suspicious features and the final decision logic (e.g., "suspicious evidence significantly outweighs credible evidence"). Introducing a human expert-style adversarial reasoning mechanism into LLM risk control can reduce the false positive rate and improve the robustness of conclusions.

[0088] Credible features can include feature f3, while suspicious features can include features f1 and f2. Feature f1 can be an abnormal transfer feature, and the corresponding feature value of the target object can be "5 cross-border transfers within the last 7 days". Feature f2 can be a crime-related feature, and the corresponding feature value of the target object can be fraud-related. Feature f3 can be an occupation, and the corresponding feature value of the target object can be a sole proprietorship. The adversarial analysis result obtained based on the credible and suspicious features can be: "Although the customer's occupation is a sole proprietorship (f3), there have been 5 cross-border transfers within the last 7 days (f1), and the recipient is involved in fraud (f2). Suspicious evidence has a higher weight than credible evidence, so it is determined that there is a risk, and the risk type is illegal financial activity risk."

[0089] If the scores corresponding to the first weighted feature and the second weighted feature are equal, then adversarial analysis can be further performed based on the credibility of the credible feature and the credibility of the suspicious feature. For example, the credible feature with the largest product of feature score and feature weight among the credible features can be obtained, and the suspicious feature with the largest product of feature score and feature weight among the suspicious features can be obtained. Then, the adversarial analysis result can be determined based on the credibility of the obtained credible feature and the suspicious feature.

[0090] In practical applications, the specific processing methods for adversarial analysis of credible and suspicious features in step S208 above can vary. The following provides one optional determination method, such as... Figure 8 As shown, the specific process may include the following steps, S20816.

[0091] In step S20816, a pre-defined large language model is used to perform adversarial analysis on credible and suspicious features.

[0092] In practice, the server can input trusted features, suspicious features, and preset prompts into a preset large language model to perform adversarial analysis on trusted features and suspicious features, and obtain the adversarial analysis results.

[0093] In practical applications, large language models can also be updated. The specific methods for updating can vary; one optional method is provided below. Figure 9 As shown, the specific process may include the following steps, S902.

[0094] In step S902, based on the quality assessment results, the reward value corresponding to the adversarial analysis results is determined, and based on the reward value corresponding to the adversarial analysis results, the preset large language model is updated using a reinforcement learning algorithm to obtain the updated large language model.

[0095] In implementation, the server's reasons are as follows: Figure 4 The interpretable reinforcement learning feedback module in the transaction risk detection system shown can continuously optimize the LLM inference strategy through multi-dimensional reward signals, improving its factual accuracy, logical consistency, and format standardization. For example, the server can determine the reward value corresponding to the adversarial analysis result based on the multi-dimensional reward function in Table 1 below.

[0096] Table 1

[0097] That is, the server can determine the reward value corresponding to the factual reward (R-fact) based on the first evaluation result, the reward value corresponding to the format compliance reward (R-format) based on the second evaluation result, the reward value corresponding to the reasoning coherence reward (R-logic) based on the third evaluation result, and the reward value corresponding to the answer consistency reward (R-consist) based on the fourth evaluation result. Finally, based on the weights corresponding to different reward types, the server determines the reward value corresponding to the adversarial analysis result.

[0098] After determining the reward value corresponding to the adversarial analysis result, the server can update the preset large language model through reinforcement learning algorithm to obtain the updated large language model.

[0099] In this way, by optimizing the multi-dimensional reward function through reinforcement learning, the reasoning process of the large language model can be guaranteed to satisfy: 1. Enhanced interpretability: Regulatory agencies can clearly trace the source of evidence for each conclusion; 2. Reduce false alarm rate: Adversarial mechanisms avoid misjudgment based on a single feature; 3. Supports continuous optimization: Reinforcement learning loop makes the system more accurate with use; 4. Meets compliance requirements: The output format complies with the disclosure requirements for "basis for risk assessment" in regulations such as the "Supervision and Management Measures for Financial Institutions".

[0100] The updated large language model can assess whether the facts are accurate, the logic is sound, and the format is compliant, ensuring that the risk assessment process is interpretable, traceable, and logically consistent. This transforms LLM (Local Risk Manager) from a "free-flowing narrative" to a "structured risk analyst," outputting analytical results that are machine-analyzable, human-verifiable, and regulatory-verifiable.

[0101] This specification provides a transaction risk detection method. It receives a transaction risk detection request for a target object, and in response, acquires multimodal business data related to the target object's transaction behavior. Using a preset large language model, it performs feature extraction processing on the multimodal business data to obtain credible and suspicious features corresponding to the target object. Credible features indicate that the probability of the target object having transaction risk is less than a preset probability threshold, while suspicious features indicate that the probability of the target object having transaction risk is greater than a preset probability threshold. Adversarial analysis is performed on the credible and suspicious features, and based on the adversarial analysis results, it is determined whether the target object has transaction risk. On the one hand, multi-source heterogeneous data (i.e., multimodal business data) from different systems with different structures and semantics can comprehensively and accurately detect risk in target objects. On the other hand, adversarial analysis using credible and suspicious features extracted by the large language model avoids the low accuracy problem caused by the large language model relying solely on single-dimensional features for risk detection. Furthermore, the adversarial analysis results can accurately detect whether the target object has transaction risk, improving the accuracy of transaction risk detection. The above are the transaction risk detection methods provided in the embodiments of this specification. Based on the same idea, the embodiments of this specification also provide a transaction risk detection device, such as... Figure 10 As shown.

[0102] The transaction risk detection device includes: a request receiving module 1001, a data acquisition core module 1002, a feature extraction module 1003, and a risk detection module 1004, wherein: The request receiving module 1001 is used to receive transaction risk detection requests for the target object; Data acquisition module 1002 is used to acquire multimodal business data related to the transaction behavior of the target object in response to the transaction risk detection request; The feature extraction module 1003 is used to perform feature extraction processing on the multimodal business data using a preset large language model to obtain credible features and suspicious features corresponding to the target object. The credible features are used to characterize that the probability of the target object having transaction risk is less than a preset probability threshold, and the suspicious features are used to characterize that the probability of the target object having transaction risk is greater than a preset probability threshold. The risk detection module 1004 is used to perform adversarial analysis on the credible features and the suspicious features, and determine whether the target object has transaction risks based on the adversarial analysis results.

[0103] In this embodiment of the specification, the feature extraction module 1003 is used for: The multimodal service data is subjected to modal alignment processing to obtain aligned service data; Using the preset large language model and based on preset prompt information, feature extraction processing is performed on the aligned business data to obtain credible features and suspicious features corresponding to the target object. The preset prompt information is used to constrain the preset large language model to generate analysis results that conform to preset format specifications.

[0104] In this embodiment of the specification, the risk detection module 1004 is used for: Based on the format of the adversarial analysis results, the preset format specification, the credible features, and the suspicious features, a quality assessment is performed on the adversarial analysis results to obtain a quality assessment result. Based on the quality assessment results, it is determined whether the adversarial analysis results meet the transaction risk detection requirements corresponding to the target object. If it is determined that the adversarial analysis results meet the transaction risk detection requirements corresponding to the target object, it is determined that the target object has transaction risks based on the adversarial analysis results.

[0105] In this embodiment of the specification, the risk detection module 1004 is used for: Determine whether the credible features and the suspicious features exist in the aligned business data to obtain a first evaluation result; Determine whether the format of the adversarial analysis result matches the preset format specification to obtain a second evaluation result; The quality assessment result is determined based on the first assessment result and / or the second assessment result.

[0106] In this embodiment of the specification, the risk detection module 1004 is used for: Based on the number of credible features, the number of suspicious features, and the detection conclusion, a consistency detection of features and conclusions is performed to obtain a third evaluation result; Semantic consistency detection is performed on the detection conclusions and the risk types to obtain the fourth evaluation result; The quality assessment result is determined based on one or more of the following assessment results: the first assessment result, the second assessment result, the third assessment result, and the fourth assessment result.

[0107] In this embodiment of the specification, the risk detection module 1004 is used for: Using a pre-trained judgment model, based on the multimodal business data, determine the credibility of the credible features and the credibility of the suspicious features; Using the preset large language model, adversarial analysis is performed on the credible features and the suspicious features based on the credible features and the credibility, as well as the suspicious features and the credibility.

[0108] In this embodiment of the specification, the risk detection module 1004 is used for: Obtain the first feature weight corresponding to the credible feature and the second feature weight corresponding to the suspicious feature; Based on the first feature weight and the credible feature, a first weighted feature is determined, and based on the second feature weight and the suspicious feature, a second weighted feature is determined. Based on the first weighted feature and the second weighted feature, adversarial analysis is performed on the credible feature and the suspicious feature.

[0109] In this embodiment of the specification, the risk detection module 1004 is used for: Using the pre-defined large language model, adversarial analysis is performed on the credible features and the suspicious features; The device further includes: The model update module is used to determine the reward value corresponding to the adversarial analysis result based on the quality assessment result, and update the preset large language model through a reinforcement learning algorithm based on the reward value corresponding to the adversarial analysis result to obtain the updated large language model.

[0110] This specification provides a transaction risk detection device that receives a transaction risk detection request for a target object, and in response to the request, acquires multimodal business data related to the target object's transaction behavior. Using a preset large language model, it performs feature extraction processing on the multimodal business data to obtain credible and suspicious features corresponding to the target object. Credible features indicate that the probability of the target object having transaction risk is less than a preset probability threshold, while suspicious features indicate that the probability of the target object having transaction risk is greater than a preset probability threshold. Adversarial analysis is performed on the credible and suspicious features, and based on the results of the adversarial analysis, it is determined whether the target object has transaction risk. On the one hand, multi-source heterogeneous data (i.e., multimodal business data) from different systems with different structures and semantics can comprehensively and accurately detect risk in target objects. On the other hand, adversarial analysis using credible and suspicious features extracted by the large language model avoids the low accuracy problem caused by the large language model relying solely on single-dimensional features for risk detection. Furthermore, the adversarial analysis results can accurately detect whether the target object has transaction risk, improving the accuracy of transaction risk detection. The above are the transaction risk detection devices provided in the embodiments of this specification. Based on the same idea, the embodiments of this specification also provide a transaction risk detection device, such as... Figure 11 As shown.

[0111] The transaction risk detection device can provide terminal equipment or servers, etc., for the above embodiments.

[0112] like Figure 11 As shown, device 1100 mainly consists of a communication interface 1102, a user interface 1104, a processor 1106, and a data storage 1108. These components are interconnected and communicate with each other via a system bus, network, or other connection mechanism 1110. The communication interface 1102 enables device 1100 to communicate with other devices, access networks, and transmission networks via analog or digital modulation. For example, the communication interface 1102 may include a chipset and antenna for wireless communication with a radio access network or access point. Furthermore, the communication interface 1102 can be a wired interface such as Ethernet, Token Ring, or a USB port, or a wireless interface such as Wi-Fi, Bluetooth, Global Positioning System (GPS), or a wide-area wireless interface (e.g., WiMAX or LTE). Of course, the communication interface 1102 can also support other forms of physical layer interfaces and standard or proprietary communication protocols. The communication interface 1102 may also include multiple physical communication interfaces, such as Wi-Fi, Bluetooth, and wide-area wireless interfaces.

[0113] User interface 1104 includes receiving user input and providing output to the user. Therefore, user interface 1104 may include input components such as a keypad, keyboard, touch-sensitive or presence-sensitive panel, computer mouse, trackball, joystick, microphone, still camera, and video camera, and output components such as a display screen (which may be combined with a touch-sensitive panel), CRT, LCD, LED, display using DLP technology, printer, and other similar devices known or developed in the future. User interface 1104 may also generate auditory output via speakers, speaker jacks, audio output ports, audio output devices, headphones, and other similar devices known or developed in the future. In some embodiments, user interface 1104 may include software, circuitry, or other forms of logic capable of transmitting and receiving data from external user input / output devices. Additionally or alternatively, device 1100 may support remote access from other devices via communication interface 1102 or another physical interface (not shown). User interface 1104 may be configured to receive user input, the position and movement of which may be indicated by indicators or cursors described herein. User interface 1104 can also be configured as a display device for rendering or displaying text fragments.

[0114] Processor 1106 may include one or more general-purpose processors and / or special-purpose processors.

[0115] Data storage 1108 may include one or more volatile storage components and may be integrated wholly or partially with processor 1106. Data storage 1108 may include removable and non-removable components.

[0116] Processor 1106 is capable of executing program instructions 1118 (e.g., compiled or uncompiled program logic and / or machine code) stored in data storage 1108 to perform the various functions described herein. Data storage 1108 may contain a non-transitory computer-readable medium on which program instructions are stored, which, when executed by device 1100, enable device 1100 to perform any methods, processes, or functions disclosed in this specification and / or the accompanying drawings. Execution of program instructions 1118 by processor 1106 may result in processor 1106 using data 1112.

[0117] For example, program instructions 1118 may include an operating system 1122 (e.g., an operating system kernel, device drivers, and / or other modules) installed on device 1100 and one or more applications 1120 (e.g., a browser, social application, or game application). Similarly, data 1112 may include operating system data 1116 and application data 1114. Operating system data 1116 is primarily accessible to the operating system 1122, while application data 1114 is primarily accessible to one or more applications 1120. Application data 1114 may reside in a file system visible or hidden from the user of device 1100.

[0118] Application 1120 can communicate with operating system 1112 through one or more application programming interfaces (APIs). These APIs help application 1120 read and / or write application data 1114, transmit or receive information via communication interface 1102, receive or display information on user interface 1104, etc.

[0119] In some terminology, application 1120 may be simply referred to as "app". Furthermore, application 1120 can be downloaded to device 1100 through one or more online app stores or app markets. However, applications can also be installed on device 1100 in other ways, such as through a web browser or a physical interface on device 1100 (e.g., a USB port).

[0120] Specifically, in this embodiment, the transaction risk detection device includes a memory and one or more programs, wherein one or more programs are stored in the memory, and one or more programs may include one or more modules, and each module may include a series of computer-executable instructions for the transaction risk detection device, and is configured to be executed by one or more processors. The one or more programs include computer-executable instructions for performing the following: Receive transaction risk detection requests for the target object; In response to the transaction risk detection request, acquire multimodal business data related to the transaction behavior of the target object; Using a pre-defined large language model, feature extraction processing is performed on the multimodal business data to obtain credible features and suspicious features corresponding to the target object. The credible features are used to characterize that the probability of the target object having transaction risk is less than a preset probability threshold, and the suspicious features are used to characterize that the probability of the target object having transaction risk is greater than a preset probability threshold. Adversarial analysis is performed on the credible features and the suspicious features, and based on the results of the adversarial analysis, it is determined whether the target object poses a transaction risk.

[0121] The various embodiments in this specification are described in a progressive manner. Similar or identical parts between embodiments can be referred to interchangeably. Each embodiment focuses on describing the differences from other embodiments. In particular, the embodiments for transaction risk detection devices are basically similar to the method embodiments, so the description is relatively simple; relevant parts can be referred to the descriptions in the method embodiments.

[0122] This specification provides a transaction risk detection device that receives a transaction risk detection request for a target object, and in response to the request, acquires multimodal business data related to the target object's transaction behavior. Using a preset large language model, it performs feature extraction processing on the multimodal business data to obtain credible and suspicious features corresponding to the target object. Credible features indicate that the probability of the target object having transaction risk is less than a preset probability threshold, while suspicious features indicate that the probability of the target object having transaction risk is greater than a preset probability threshold. Adversarial analysis is performed on the credible and suspicious features, and based on the results of the adversarial analysis, it is determined whether the target object has transaction risk. On the one hand, multi-source heterogeneous data (i.e., multimodal business data) from different systems with different structures and semantics can comprehensively and accurately detect risk in target objects. On the other hand, adversarial analysis using credible and suspicious features extracted by the large language model avoids the low accuracy problem caused by the large language model relying solely on single-dimensional features for risk detection. Furthermore, the adversarial analysis results can accurately detect whether the target object has transaction risk, improving the accuracy of transaction risk detection.

[0123] Furthermore, based on the above Figures 1 to 9 This specification also provides a storage medium for storing computer-executable instruction information in one or more embodiments. In one specific embodiment, the storage medium may be a USB flash drive, optical disc, hard disk, etc. When the computer-executable instruction information stored in the storage medium is executed by a processor, it can realize the following process: Receive transaction risk detection requests for the target object; In response to the transaction risk detection request, acquire multimodal business data related to the transaction behavior of the target object; Using a pre-defined large language model, feature extraction processing is performed on the multimodal business data to obtain credible features and suspicious features corresponding to the target object. The credible features are used to characterize that the probability of the target object having transaction risk is less than a preset probability threshold, and the suspicious features are used to characterize that the probability of the target object having transaction risk is greater than a preset probability threshold. Adversarial analysis is performed on the credible features and the suspicious features, and based on the results of the adversarial analysis, it is determined whether the target object poses a transaction risk.

[0124] The various embodiments in this specification are described in a progressive manner. Similar or identical parts between embodiments can be referred to mutually. Each embodiment focuses on describing the differences from other embodiments. In particular, the above-described storage medium embodiment is basically similar to the method embodiment, so the description is relatively simple; relevant parts can be referred to the description of the method embodiment.

[0125] This specification provides a storage medium that receives a transaction risk detection request for a target object, and in response to the request, acquires multimodal business data related to the target object's transaction behavior. Using a preset large language model, it performs feature extraction processing on the multimodal business data to obtain credible and suspicious features corresponding to the target object. Credible features indicate that the probability of the target object having transaction risk is less than a preset probability threshold, while suspicious features indicate that the probability of the target object having transaction risk is greater than a preset probability threshold. Adversarial analysis is performed on the credible and suspicious features, and based on the results of the adversarial analysis, it is determined whether the target object has transaction risk. On the one hand, multi-source heterogeneous data (i.e., multimodal business data) from different systems with different structures and semantics can comprehensively and accurately detect risk in target objects. On the other hand, adversarial analysis using credible and suspicious features extracted by the large language model avoids the low accuracy problem caused by the large language model relying solely on single-dimensional features for risk detection. Furthermore, the adversarial analysis results can accurately detect whether the target object has transaction risk, improving the accuracy of transaction risk detection.

[0126] Furthermore, based on the above Figures 1 to 9 This specification also provides one or more embodiments of a computer program product, including a computer program, which, when executed by a processor, can perform the following processes: Receive transaction risk detection requests for the target object; In response to the transaction risk detection request, acquire multimodal business data related to the transaction behavior of the target object; Using a pre-defined large language model, feature extraction processing is performed on the multimodal business data to obtain credible features and suspicious features corresponding to the target object. The credible features are used to characterize that the probability of the target object having transaction risk is less than a preset probability threshold, and the suspicious features are used to characterize that the probability of the target object having transaction risk is greater than a preset probability threshold. Adversarial analysis is performed on the credible features and the suspicious features, and based on the results of the adversarial analysis, it is determined whether the target object poses a transaction risk.

[0127] The various embodiments in this specification are described in a progressive manner. Similar or identical parts between embodiments can be referred to mutually. Each embodiment focuses on describing the differences from other embodiments. In particular, the above-described embodiment of a computer program product is relatively simple in description because it is fundamentally similar to the method embodiment; relevant parts can be referred to the description of the method embodiment.

[0128] This specification provides a computer program product that receives a transaction risk detection request for a target object, and in response to the request, acquires multimodal business data related to the target object's transaction behavior. Using a preset large language model, it performs feature extraction processing on the multimodal business data to obtain credible and suspicious features corresponding to the target object. Credible features indicate that the probability of the target object having transaction risk is less than a preset probability threshold, while suspicious features indicate that the probability of the target object having transaction risk is greater than a preset probability threshold. Adversarial analysis is performed on the credible and suspicious features, and based on the results of the adversarial analysis, it is determined whether the target object has transaction risk. On the one hand, multi-source heterogeneous data (i.e., multimodal business data) from different systems with different structures and semantics can comprehensively and accurately detect risk in target objects. On the other hand, adversarial analysis using credible and suspicious features extracted by the large language model avoids the low accuracy problem caused by the large language model relying solely on single-dimensional features for risk detection. Furthermore, the adversarial analysis results can accurately detect whether the target object has transaction risk, improving the accuracy of risk detection for transaction objects.

[0129] The foregoing has described specific embodiments of this specification. Other embodiments are within the scope of the appended claims. In some cases, the actions or steps recited in the claims may be performed in a different order than that shown in the embodiments and may still achieve the desired result. Furthermore, the processes depicted in the drawings do not necessarily require the specific or sequential order shown to achieve the desired result. In some embodiments, multitasking and parallel processing are possible or may be advantageous.

[0130] In the 1990s, improvements to a technology could be clearly distinguished as either hardware improvements (e.g., improvements to the circuit structure of diodes, transistors, switches, etc.) or software improvements (improvements to the methodology). However, with technological advancements, many methodological improvements today can be considered direct improvements to the hardware circuit structure. Designers almost always obtain the corresponding hardware circuit structure by programming the improved methodology into the hardware circuit. Therefore, it cannot be said that a methodological improvement cannot be implemented using hardware physical modules. For example, a Programmable Logic Device (PLD) (such as a Field Programmable Gate Array (FPGA)) is such an integrated circuit whose logic function is determined by the user programming the device. Designers can program and "integrate" a digital system onto a PLD themselves, without needing chip manufacturers to design and manufacture dedicated integrated circuit chips. Furthermore, nowadays, instead of manually manufacturing integrated circuit chips, this programming is mostly implemented using "logic compiler" software. Similar to the software compiler used in program development, the original code before compilation must also be written in a specific programming language, called a Hardware Description Language (HDL). There are many HDLs, such as ABEL (Advanced Boolean Expression Language), AHDL (Altera Hardware Description Language), Confluence, CUPL (Cornell University Programming Language), HDCal, JHDL (Java Hardware Description Language), Lava, Lola, MyHDL, PALASM, and RHDL (Ruby Hardware Description Language). Currently, the most commonly used are VHDL (Very-High-Speed ​​Integrated Circuit Hardware Description Language) and Verilog. Those skilled in the art should also understand that by simply performing some logic programming on the method flow using one of these hardware description languages ​​and programming it into an integrated circuit, the hardware circuit implementing the logical method flow can be easily obtained.

[0131] The controller can be implemented in any suitable manner. For example, it can take the form of a microprocessor or processor and a computer-readable medium storing computer-readable program code (e.g., software or firmware) executable by the (micro)processor, logic gates, switches, application-specific integrated circuits (ASICs), programmable logic controllers, and embedded microcontrollers. Examples of controllers include, but are not limited to, the following microcontrollers: ARC 625D, Atmel AT91SAM, Microchip PIC18F26K20, and Silicon Labs C8051F320. A memory controller can also be implemented as part of the control logic of the memory. Those skilled in the art will also recognize that, in addition to implementing the controller in purely computer-readable program code form, the same functionality can be achieved by logically programming the method steps to make the controller take the form of logic gates, switches, application-specific integrated circuits, programmable logic controllers, and embedded microcontrollers. Therefore, such a controller can be considered a hardware component, and the means included therein for implementing various functions can also be considered as structures within the hardware component. Alternatively, the means for implementing various functions can be considered as both software modules implementing the method and structures within the hardware component.

[0132] The systems, devices, modules, or units described in the above embodiments can be implemented by computer chips or entities, or by products with certain functions. A typical implementation device is a computer. Specifically, a computer can be, for example, a personal computer, laptop computer, cellular phone, camera phone, smartphone, personal digital assistant, media player, navigation device, email device, game console, tablet computer, wearable device, or any combination of these devices.

[0133] For ease of description, the above apparatus is described by dividing it into various functional units. Of course, when implementing one or more embodiments of this specification, the functions of each unit can be implemented in one or more software and / or hardware.

[0134] Those skilled in the art will understand that the embodiments of this specification can be provided as methods, systems, or computer program products. Therefore, one or more embodiments of this specification may take the form of a completely hardware embodiment, a completely software embodiment, or an embodiment combining software and hardware aspects. Furthermore, one or more embodiments of this specification may take the form of a computer program product implemented on one or more computer-usable storage media (including, but not limited to, disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0135] The embodiments described herein are illustrated with reference to flowchart illustrations and / or block diagrams of methods, apparatus (systems), and computer program products according to embodiments of this specification. It will be understood that each block of the flowchart illustrations and / or block diagrams, and combinations of blocks in the flowchart illustrations and / or block diagrams, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, special-purpose computer, embedded processor, or other programmable device to produce a machine, such that the instructions, which execute via the processor of the computer or other programmable device, generate instructions for implementing the flowchart illustrations and / or block diagrams. Figure 1 One or more processes and / or boxes Figure 1 A device that provides the functions specified in one or more boxes.

[0136] These computer program instructions may also be stored in a computer-readable storage medium that can direct a computer or other programmable device to function in a particular manner, such that the instructions stored in the computer-readable storage medium produce an article of manufacture including instruction means, which are implemented in a process Figure 1 One or more processes and / or boxes Figure 1 The function specified in one or more boxes.

[0137] These computer program instructions may also be loaded onto a computer or other programmable device to cause a series of operational steps to be performed on the computer or other programmable device to produce a computer-implemented process, thereby providing instructions that execute on the computer or other programmable device for implementing the process. Figure 1 One or more processes and / or boxes Figure 1 The steps of the function specified in one or more boxes.

[0138] In a typical configuration, a computing device includes one or more processors (CPU), input / output interfaces, network interfaces, and memory.

[0139] Memory may include non-persistent storage in computer-readable media, such as random access memory (RAM) and / or non-volatile memory, such as read-only memory (ROM) or flash RAM. Memory is an example of computer-readable media.

[0140] Computer-readable media includes both permanent and non-permanent, removable and non-removable media that can store information by any method or technology. Information can be computer-readable instructions, data structures, modules of programs, or other data. Examples of computer storage media include, but are not limited to, phase-change memory (PRAM), static random access memory (SRAM), dynamic random access memory (DRAM), other types of random access memory (RAM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), flash memory or other memory technologies, CD-ROM, digital versatile optical disc (DVD) or other optical storage, magnetic tape, magnetic disk storage or other magnetic storage devices, or any other non-transferable medium that can be used to store information accessible by a computing device. As defined herein, computer-readable media does not include transient computer-readable media, such as modulated data signals and carrier waves.

[0141] It should also be noted that the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such process, method, article, or apparatus. Without further limitations, the presence of additional identical elements in the process, method, article, or apparatus that includes said elements is not excluded.

[0142] It should also be noted that the terms "one," "an," and "the" do not specifically refer to the singular; they can also include the plural. Ordinal numbers such as "first," "second," etc., do not necessarily indicate order; often they are used to distinguish between objects. For example, "first server" and "second server" usually refer to two servers. To differentiate between these two servers, they are described as "first server" and "second server." Of course, sometimes these two servers may be the same server.

[0143] In this specification, unless explicitly stated otherwise, "receiving and sending data" does not necessarily mean direct receiving and sending; it can also mean indirect receiving and sending. For example, A receiving data sent by B can be understood as A directly receiving data sent by B, or it can be understood as A indirectly receiving data sent by B through other entities such as C. Similarly, B sending data to A can be understood as B sending data directly to A, or it can be understood as B indirectly sending data to A through other entities such as C. Here, C can be a single subject, or two or more subjects.

[0144] This specification uses specific terms to describe embodiments thereof. Terms such as "an embodiment," "one embodiment," and / or "some embodiments" refer to a particular feature, structure, or characteristic associated with at least one embodiment of this specification. Therefore, it should be emphasized and noted that references to "an embodiment," "one embodiment," or "an alternative embodiment" in different locations within this specification do not necessarily refer to the same embodiment. Furthermore, those skilled in the art can combine and integrate the different embodiments or examples described herein, as well as the features of those different embodiments or examples, without contradiction.

[0145] Although one or more embodiments of this specification provide method steps as described in the embodiments or flowcharts, it is understood that the order of steps listed in the embodiments or flowcharts is only one of many possible execution orders and does not represent the only execution order. Therefore, when the claims involve method steps, any changes or adjustments to the order of such steps, or the parallelism between steps, are also within the scope of protection of the claims.

[0146] It should be noted that the user data obtained in this manual is authorized by the user and does not involve user privacy.

[0147] Those skilled in the art will understand that the embodiments of this specification can be provided as methods, systems, or computer program products. Therefore, one or more embodiments of this specification may take the form of a completely hardware embodiment, a completely software embodiment, or an embodiment combining software and hardware aspects. Furthermore, one or more embodiments of this specification may take the form of a computer program product implemented on one or more computer-usable storage media (including, but not limited to, disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0148] One or more embodiments of this specification can be described in the general context of computer-executable instructions, such as program modules, that are executed by a computer. Generally, program modules include routines, programs, objects, components, data structures, etc., that perform a specific task or implement a specific abstract data type. One or more embodiments of this specification can also be practiced in distributed computing environments where tasks are performed by remote processing devices connected via a communication network. In distributed computing environments, program modules can reside in local and remote computer storage media, including storage devices.

[0149] The various embodiments in this specification are described in a progressive manner. Similar or identical parts between embodiments can be referred to interchangeably. Each embodiment focuses on describing the differences from other embodiments. In particular, the system embodiments are basically similar to the method embodiments, so the description is relatively simple; relevant parts can be referred to the descriptions in the method embodiments.

[0150] The above description is merely an embodiment of this specification and is not intended to limit this document. Various modifications and variations can be made to this specification by those skilled in the art. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of this specification should be included within the scope of the claims of this specification.

Claims

1. A transaction risk detection method, comprising: receiving a transaction risk detection request for a target object; in response to the transaction risk detection request, obtaining multi-modal business data related to a transaction behavior of the target object; using a preset large language model, performing feature extraction processing on the multi-modal business data to obtain trusted features and suspicious features corresponding to the target object, the trusted features being used to represent that a probability of the target object having a transaction risk is less than a preset probability threshold, and the suspicious features being used to represent that the probability of the target object having a transaction risk is greater than the preset probability threshold; performing adversarial analysis on the trusted features and the suspicious features, and determining whether the target object has a transaction risk according to an adversarial analysis result.

2. The method of claim 1, wherein the using a preset large language model to perform feature extraction processing on the multi-modal business data to obtain trusted features and suspicious features corresponding to the target object comprises: performing modal alignment processing on the multi-modal business data to obtain aligned business data; using the preset large language model, performing feature extraction processing on the aligned business data based on preset prompt information to obtain trusted features and suspicious features corresponding to the target object, the preset prompt information being used to constrain the preset large language model to generate an analysis result conforming to a preset format specification.

3. The method of claim 2, wherein the determining whether the target object has a transaction risk according to the adversarial analysis result comprises: based on a format of the adversarial analysis result, the preset format specification, the trusted features, and the suspicious features, performing quality evaluation on the adversarial analysis result to obtain a quality evaluation result; based on the quality evaluation result, determining whether the adversarial analysis result meets a transaction risk detection requirement corresponding to the target object, and in a case where it is determined that the adversarial analysis result meets the transaction risk detection requirement corresponding to the target object, determining that the target object has a transaction risk based on the adversarial analysis result.

4. The method of claim 3, wherein the based on a format of the adversarial analysis result, the preset format specification, the trusted features, and the suspicious features, performing quality evaluation on the adversarial analysis result to obtain a quality evaluation result comprises: judging whether the trusted features and the suspicious features exist in the aligned business data to obtain a first evaluation result; judging whether the format of the adversarial analysis result matches the preset format specification to obtain a second evaluation result; based on the first evaluation result and / or the second evaluation result, determining the quality evaluation result.

5. The method of claim 4, wherein the adversarial analysis result comprises a detection conclusion and a risk type, and the based on the first evaluation result and / or the second evaluation result, determining the quality evaluation result comprises: based on a number of the trusted features, a number of the suspicious features, and the detection conclusion, performing consistency detection of features and conclusions to obtain a third evaluation result; perform semantic consistency detection on the detection conclusion and the risk type to obtain a fourth evaluation result; determine the quality evaluation result based on one or more of the following evaluation results: the first evaluation result, the second evaluation result, the third evaluation result, and the fourth evaluation result.

6. The method of claim 1, wherein the performing the adversarial analysis on the trusted feature and the suspicious feature comprises: determining, by using a pre-trained judgment model, a trustworthiness of the trusted feature and a trustworthiness of the suspicious feature based on the multi-modal business data; performing the adversarial analysis on the trusted feature and the suspicious feature based on the trusted feature and the trustworthiness and the suspicious feature and the trustworthiness by using the pre-set large language model.

7. The method of claim 1, wherein the performing the adversarial analysis on the trusted feature and the suspicious feature comprises: obtaining a first feature weight corresponding to the trusted feature and a second feature weight corresponding to the suspicious feature; determining a first weighted feature based on the first feature weight and the trusted feature and determining a second weighted feature based on the second feature weight and the suspicious feature; performing the adversarial analysis on the trusted feature and the suspicious feature based on the first weighted feature and the second weighted feature.

8. The method of claim 3, wherein the performing the adversarial analysis on the trusted feature and the suspicious feature comprises: performing the adversarial analysis on the trusted feature and the suspicious feature by using the pre-set large language model; the method further comprises: determining a reward value corresponding to the adversarial analysis result based on the quality evaluation result, and updating the pre-set large language model by using a reinforcement learning algorithm based on the reward value corresponding to the adversarial analysis result to obtain an updated large language model.

9. A transaction risk detection apparatus, comprising: a request receiving module configured to receive a transaction risk detection request for a target object; a data obtaining module configured to obtain multi-modal business data related to a transaction behavior of the target object in response to the transaction risk detection request; a feature extraction module configured to perform feature extraction processing on the multi-modal business data by using a pre-set large language model to obtain a trusted feature and a suspicious feature corresponding to the target object, the trusted feature being used to represent that a probability of the target object having a transaction risk is less than a pre-set probability threshold, and the suspicious feature being used to represent that the probability of the target object having a transaction risk is greater than the pre-set probability threshold; a risk detection module configured to perform adversarial analysis on the trusted feature and the suspicious feature, and determine whether the target object has a transaction risk according to an adversarial analysis result.

10. A transaction risk detection device, the transaction risk detection device comprising: a processor; and a memory arranged to store computer-executable instructions that, when executed, cause the processor to: receive a transaction risk detection request for a target object; obtain multi-modal business data related to a transaction behavior of the target object in response to the transaction risk detection request; The preset large language model is used for feature extraction processing on the multi-modal business data to obtain trusted features and suspicious features corresponding to the target object. The trusted features are used to represent that the probability of the target object having a transaction risk is less than a preset probability threshold. The suspicious features are used to represent that the probability of the target object having a transaction risk is greater than the preset probability threshold. The trusted features and the suspicious features are subjected to adversarial analysis, and whether the target object has a transaction risk is determined according to the adversarial analysis result.

Images