Large model security defense method and device, storage medium and electronic equipment

Abstract

The embodiment of the invention discloses a security defense method for a large model, and the method comprises the steps: obtaining an original feature extracted from the prompt information by a feature extraction layer and a predetermined answer rejection feature vector corresponding to the feature extraction layer for each feature extraction layer in the LLM after the prompt information is inputted into the LLM; and reconstructing the original feature vector by adopting the answer rejection feature vector to obtain a first reconstructed feature, determining a projection feature of the original feature in the direction of the answer rejection feature vector, adjusting the direction of the projection feature according to the direction of the first reconstructed feature, reconstructing the original feature according to the adjusted projection feature to obtain a second reconstructed feature, and obtaining the answer rejection feature. And finally, generating response information according to the output feature of each feature extraction layer in the LLM. The method can ensure the smoothness of the LLM to generate the response information while effectively improving the resistance of the LLM to the jailbreak attack.

Description

Technical Field

[0001] This specification relates to the field of computer technology, and in particular to a large-scale security defense method, device, storage medium, and electronic device. Background Technology

[0002] With the development of artificial intelligence (AI) technology, the application of large language models (LLM) is becoming more and more widespread. However, its powerful content generation capabilities also bring serious security challenges.

[0003] Although LLMs learn during training to recognize malicious prompts and refuse to generate corresponding responses to them in order to avoid generating non-compliant content, attackers can still induce LLMs to generate various non-compliant and harmful content through carefully designed prompts. This type of attack is known as a jailbreak attack.

[0004] These issues not only pose legal compliance risks but also damage user experience and brand reputation. Therefore, how to provide security protection for LLM is an urgent problem to be solved. Summary of the Invention

[0005] This specification provides a large-scale security defense method, device, storage medium, and electronic device to partially solve the problems existing in the prior art.

[0006] The embodiments in this specification adopt the following technical solutions: This specification provides a security defense method for large-scale models, the method comprising: Get the prompt information; The prompt information is input into a pre-trained large language model (LLM); For each feature extraction layer in the LLM, the original features extracted by the feature extraction layer from the prompt information and the pre-determined rejection feature vector corresponding to the feature extraction layer are obtained; the rejection feature vector is used to characterize the semantics of the feature extraction layer refusing to generate response information for prompt information with aggressive behavior; The original features are reconstructed using the rejection feature vector to obtain a first reconstructed feature; and the projection feature of the original features onto the direction of the rejection feature vector is determined. The orientation of the projection feature is adjusted according to the orientation of the first reconstructed feature; The original features are reconstructed based on the projection features after the direction is adjusted to obtain the second reconstructed features, which are used as the output features of the feature extraction layer. Based on the output features of each feature extraction layer in the LLM, the response information corresponding to the prompt information is generated.

[0007] This specification provides a security defense device for a large-scale model, the device comprising: The first acquisition module is used to acquire prompt information; The input module is used to input the prompt information into a pre-trained large language model (LLM). The second acquisition module is used to acquire, for each feature extraction layer in the LLM, the original features extracted by that feature extraction layer from the prompt information and the pre-determined rejection feature vector corresponding to that feature extraction layer; the rejection feature vector is used to characterize the semantics of the feature extraction layer refusing to generate response information for prompt information with aggressive behavior; The first reconstruction module is used to reconstruct the original features using the rejection feature vector to obtain the first reconstructed features; and to determine the projection features of the original features on the direction of the rejection feature vector. An adjustment module is used to adjust the orientation of the projected feature according to the orientation of the first reconstructed feature; The second reconstruction module is used to reconstruct the original features based on the projection features after the direction is adjusted, so as to obtain the second reconstructed features, which are used as the output features of the feature extraction layer. The generation module is used to generate response information corresponding to the prompt information based on the output features of each feature extraction layer in the LLM.

[0008] This specification provides a computer-readable storage medium storing a computer program that, when executed by a processor, implements the aforementioned security defense method for the large model.

[0009] This specification provides an electronic device including a memory, a processor, and a computer program stored in the memory and executable on the processor. When the processor executes the program, it implements the security defense method of the aforementioned large model.

[0010] This specification provides a computer program product, which includes a computer program that, when executed by a processor, implements the aforementioned large-scale security defense method.

[0011] The above-described at least one technical solution adopted in the embodiments of this specification can achieve the following beneficial effects: This specification discloses a security defense method for large-scale model (LLM). After inputting a prompt message into the LLM, this method, for each feature extraction layer in the LLM, obtains the original features extracted from the prompt message by that feature extraction layer and a pre-determined rejection feature vector corresponding to that feature extraction layer. The rejection feature vector characterizes the semantics of the feature extraction layer's refusal to generate response information. The original feature vector is reconstructed using the rejection feature vector to obtain a first reconstructed feature. The projection feature of the original feature onto the direction of the rejection feature vector is then determined. Based on the direction of the first reconstructed feature, the direction of the projection feature is adjusted. The original feature is then reconstructed based on the adjusted projection feature to obtain a second reconstructed feature, which serves as the output feature of that feature extraction layer. Finally, response information is generated based on the output features of each feature extraction layer in the LLM. This method can effectively improve the LLM's resistance to jailbreak attacks while ensuring the smoothness of the LLM's response information generation. Attached Figure Description

[0012] The accompanying drawings, which are included to provide a further understanding of this specification and form part of this specification, illustrate exemplary embodiments and are used to explain this specification, but do not constitute an undue limitation thereof. In the drawings: Figure 1 A flowchart illustrating the security defense method for large models provided in the embodiments of this specification; Figure 2 A schematic diagram of a large-scale security defense device provided in the embodiments of this specification; Figure 3 This is a schematic diagram of the structure of the electronic device provided in the embodiments of this specification. Detailed Implementation

[0013] To make the objectives, technical solutions, and advantages of this specification clearer, the technical solutions of this specification will be clearly and completely described below in conjunction with specific embodiments and corresponding drawings. Obviously, the described embodiments are only a part of the embodiments of this specification, and not all of them. Based on the embodiments in this specification, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of this specification.

[0014] The technical solutions provided in the various embodiments of this specification are described in detail below with reference to the accompanying drawings.

[0015] Figure 1 The flowchart of the security defense method for large models provided in the embodiments of this specification specifically includes the following steps: S100: Get the prompt information.

[0016] In the embodiments of this specification, the following are used: Figure 1The method illustrated uses LLM for inference to generate response information. The device used can be any device deployed with LLM, including but not limited to personal computers, mobile phones, tablets, servers, and server clusters consisting of multiple servers. The following explanation uses a server as an example only; those skilled in the art should understand that the choice of device for execution is crucial. Figure 1 The methods shown do not constitute a limitation on the solutions provided in this specification.

[0017] The server can first obtain the prompt information. This prompt information may include user prompts for the LLM, such as questions that require the LLM to answer, like "What kind of clothes are suitable for today's weather?", and may also include system prompts pre-set for the LLM, such as "The training samples used during training cannot be disclosed" and "Response information containing illegal content cannot be generated."

[0018] System prompts are invisible to users. Generally, after receiving a user's prompt, the server can merge the user's prompt with the pre-stored system prompts into a single prompt, which will then be used as the received prompt.

[0019] In addition, this manual does not restrict the modality of the prompt information; the prompt information can be in text modality, or in image, video, or audio modality.

[0020] S101: Input the prompt information into the pre-trained large language model LLM.

[0021] After the server obtains the prompt information through the above step S100, it can input the prompt information into the pre-trained LLM to generate the corresponding response information through the LLM.

[0022] The LLM is pre-trained, specifically using sample prompts with various attack behaviors. When the trained LLM identifies that the input prompt has at least one of the aforementioned attack behaviors, it will refuse to generate the corresponding response information. In other words, the pre-trained LLM in this embodiment already has a certain defensive capability against attack behaviors.

[0023] S102: For each feature extraction layer in the LLM, obtain the original features extracted by the feature extraction layer from the prompt information and the pre-determined rejection feature vector corresponding to the feature extraction layer.

[0024] In the embodiments described in this specification, the LLM includes an encoding layer, several feature extraction layers, and a generative network. The encoding layer encodes the input prompt information into an embedding vector. The feature extraction layers extract the original features of the prompt information from the embedding vector. The generative network generates response information corresponding to the prompt information based on the original features extracted by at least one feature extraction layer.

[0025] Specifically, for the input prompt information, the prompt information can be decomposed into several tokens, and then each token can be input into the encoding layer to obtain the embedding vector of each token, which is the embedding vector of the prompt information.

[0026] When the feature extraction layer is implemented using a self-attention mechanism-based module (such as a transformer), since the embedding vector of each token is input to the feature extraction layer one by one, and based on the self-attention mechanism, when the embedding vector of the last token in the prompt is input to the feature extraction layer, the features extracted by the feature extraction layer from the embedding vector of the last token will contain the features of all tokens in the prompt. Therefore, under the action of the self-attention mechanism, the features extracted by the feature extraction layer from the embedding vector of the last token are essentially the complete features extracted from the prompt. Thus, for any feature extraction layer, the complete features extracted from the prompt by the feature extraction layer are referred to in this specification as the original features extracted by the feature extraction layer.

[0027] In addition, the coding layer in LLM can also be regarded as a feature extraction layer and the operations of steps S102 to S105 are performed in the same way.

[0028] In the embodiments of this specification, a rejection feature vector corresponding to each feature extraction layer in the LLM can be pre-determined. Since the LLM is pre-trained, it already possesses a certain degree of defense against attack behavior. Therefore, the rejection feature vector determined in the embodiments of this specification is used to characterize the semantics of the feature extraction layer refusing to generate response information for prompts with attack behavior.

[0029] This can be understood as follows: the original features extracted by the feature extraction layer from the prompt information contain at least two parts. The first part is the semantics of generating response information based solely on the semantics of the prompt information, regardless of whether the prompt information contains attack behavior. The second part is the semantics of refusing to generate response information if the prompt information contains attack behavior.

[0030] The semantics of the first part mentioned above affect whether the LLM can smoothly generate response information according to the semantics of the prompt information, which affects the smoothness of the LLM's generation. The semantics of the second part affect whether the LLM can refuse to generate response information when attacked, which affects the LLM's defense performance against attacks.

[0031] In this specification, a rejection feature vector can be pre-determined for a feature extraction layer to represent the feature space in which the second part of the semantics extracted by the feature extraction layer is located. In other words, the semantics that fall into the feature space among the original features extracted by the feature extraction layer are the second part of the semantics extracted by the feature extraction layer.

[0032] Therefore, after inputting the prompt information into the LLM, for each feature extraction layer in the LLM, on the one hand, the original features extracted by the feature extraction layer from the prompt information can be obtained, and on the other hand, the rejection feature vector corresponding to the feature extraction layer, which has been determined in advance for that feature extraction layer, can be obtained.

[0033] S103: The original features are reconstructed using the rejection feature vector to obtain the first reconstructed features; and the projection features of the original features on the direction of the rejection feature vector are determined.

[0034] In the embodiments of this specification, for each feature extraction layer in the LLM, after the server obtains the original features extracted from the prompt information by the feature extraction layer and the pre-determined rejection feature vector corresponding to the feature extraction layer through the above step S102, it can reconstruct the original features using the rejection feature vector to reconstruct a first reconstructed feature vector that can take into account both the smoothness of generation and the defense performance. On the other hand, it can simultaneously determine the projection features of the original features on the direction of the rejection feature vector.

[0035] Specifically, when reconstructing the original features using the rejection feature vector, a weight vector for fitting the original features using the rejection feature vector can be determined, and then this weight vector and the rejection feature vector are used to reconstruct the original features. Ridge regression or other algorithms can be used to determine the weight vector w for fitting the original features using the rejection feature vector.

[0036] When fitting the original features using the rejection feature vector, let the rejection feature vector be Q and the original features be h. Then, a weight vector w needs to be determined so that the reconstructed first feature vector g = Qw is as close to h as possible. Since in practical applications, we can only find w that makes g as close to h as possible, but not w that makes g exactly equal to h, we can use the ridge regression algorithm to determine the weight vector w. The product g of the rejection feature vector Q and the weight vector w is then used as the first reconstructed feature vector.

[0037] When determining the projection feature of the original feature onto the direction of the rejection feature vector, the original feature can be decomposed into a vector decomposition. This decomposition results in a perpendicular feature component (perpendicular to the rejection feature vector) and a parallel feature component (parallel to the rejection feature vector). This parallel feature component is the projection feature of the original feature onto the direction of the rejection feature vector. That is, h = h 平行 +h 垂直 h 平行 For parallel eigencomponents, h 垂直 For the vertical feature component, h 平行 and h 垂直 The original feature h is obtained by adding the vectors together.

[0038] S104: Adjust the direction of the projection feature according to the direction of the first reconstructed feature.

[0039] After obtaining the first reconstructed feature and the projection feature of the original feature onto the direction of the rejection feature vector through the above step S103, the server can adjust the direction of the projection feature according to the direction of the first reconstructed feature.

[0040] Specifically, the server can deflect the direction of the projected feature toward the direction of the first reconstructed feature while keeping the magnitude of the projected feature unchanged. The magnitude of the deflection can be controlled by preset control parameters for the feature extraction layer.

[0041] Furthermore, the server can employ the Spherical Linear Interpolation (SLERP) algorithm to rotate the direction of the projected feature toward the direction of the first reconstructed feature, while maintaining the magnitude of the projected feature unchanged. The rotation magnitude is positively correlated with a pre-set control parameter for this feature extraction layer, denoted as β. β ranges from 0 to 1. When β=0, it means the direction of the projected feature does not rotate toward the direction of the first reconstructed feature at all; when β=1, it means the direction of the projected feature is rotated to be completely the same as the direction of the first reconstructed feature. The larger the β value, the larger the rotation magnitude, and vice versa. The control parameters for different feature extraction layers can be the same or different.

[0042] S105: Reconstruct the original features based on the projection features after the direction is adjusted to obtain the second reconstructed features, which are used as the output features of the feature extraction layer.

[0043] The projection feature h was adjusted. 平行 After adjusting the direction, the resulting projected feature is denoted as h'. 平行 The server can obtain the vertical feature component h based on the vector decomposition of the original feature h. 垂直 And the projection feature h' after adjusting the direction平行 The original features are reconstructed to obtain the second reconstructed feature, denoted as h'. Specifically, the vertical feature component h can be... 垂直 With the projected feature h' after adjusting the direction 平行 By performing vector addition, we get h' = h 垂直 +h' 平行 .

[0044] After obtaining the second reconstructed feature h', the second reconstructed feature h' is used as the output feature of the feature extraction layer.

[0045] S106: Generate response information corresponding to the prompt information based on the output features of each feature extraction layer in the LLM.

[0046] After obtaining the output features h' of each feature extraction layer in the LLM through the above steps S102~S105, the server can use the generative network in the LLM to generate the response information corresponding to the prompt information using the output features h' of each feature extraction layer in the LLM. This specification does not restrict the modality of the response information generated by the LLM; it can be text-based, or it can be image, video, or audio-based.

[0047] Using the above method, for each feature extraction layer in an LLM, the direction of the parallel feature components extracted by that layer is shifted in a direction that balances generation fluency and defense performance. The original features are then reconstructed based on these adjusted parallel feature components to obtain a second reconstructed feature, which serves as the output feature of that feature extraction layer. Therefore, this method can effectively improve the LLM's resistance to jailbreak attacks while ensuring the fluency of the generated response information. Furthermore, the adjustment magnitude can be controlled through the control parameters corresponding to each feature extraction layer, allowing for flexible balancing of LLM generation fluency and defense performance in different application scenarios.

[0048] Furthermore, in the embodiments of this specification, when determining the rejection feature vector corresponding to each feature extraction layer in the LLM in advance, after training the LLM (at which point the LLM has a certain defensive capability), sample prompt information with attack behavior can be obtained, and the text representation of the sample prompt information in each preset language can be determined, that is, the sample prompt information can be translated into text corresponding to each preset language. The preset language can include any kind of language, such as Chinese, English, French, Japanese, etc., and this specification does not limit this.

[0049] Each text representation is then input into a pre-trained LLM to obtain the original sample features extracted by the feature extraction layer from each text representation. Although the original sample features extracted by the feature extraction layer from the text representations of the same cue message in different languages ​​are different, they all contain strong semantics of refusing to generate a response, since all text representations are representations of the same cue message, and this cue message is one with aggressive behavior.

[0050] Therefore, the original features of these samples can be clustered to obtain clusters. Specifically, the original features of each sample can be clustered based on their similarity to obtain a predetermined number of clusters. This predetermined number can be a fixed value set in advance; for example, the K-means clustering algorithm can be used to cluster the original features of each sample based on their similarity to obtain K clusters, where K is the predetermined number.

[0051] Then, for each cluster, a representative feature is determined based on the original features of the samples contained in that cluster. The representative feature of a cluster is used to characterize the overall trend of the original features of all samples in that cluster. For example, the average feature of the original features of all samples in a cluster can be used as the representative feature of that cluster. In the embodiments of this specification, for each cluster, Principal Component Analysis (PCA) algorithm can be used to determine the principal component vectors of the original features of each sample contained in that cluster, which are then used as the representative feature of that cluster.

[0052] After determining the representative features of each cluster, the vector formed by the orthonormal basis corresponding to the representative features of each cluster can be determined as the rejection feature vector corresponding to that feature extraction layer. Specifically, for a feature extraction layer, the feature extraction layer extracts the original features of each sample from the text representation of a sample prompt in different preset languages, and clusters the original features of each sample to obtain K clusters. After determining the representative features of each cluster using the PCA algorithm, the representative features of each cluster can be concatenated into a column matrix, denoted as column matrix C. Then, QR decomposition is performed on column matrix C, i.e., C=QR, where Q is orthonormal, that is, the column vectors in Q are all pairwise orthogonal and have a length of 1. T =I, where I is the identity matrix, Q T Let Q be the transpose of Q. Therefore, each column vector in the Q matrix is ​​an orthonormal basis of each column vector in the column matrix C. The vector formed by these orthonormal bases (i.e., the Q matrix) is the rejection feature vector corresponding to this feature extraction layer.

[0053] Therefore, in Figure 1 In step S103 shown, when the original features are reconstructed using the rejection feature vector to obtain the first reconstructed features, after determining the weight vector w for fitting the original features h using the rejection feature vector Q, the product g of the rejection feature vector Q and the weight vector w can be directly determined as the first reconstructed feature vector.

[0054] Experimental tests showed that without using the above method, LLM's defense performance against jailbreak attacks scored 38.7 (higher scores indicate better defense) and its smoothness in generating response information scored 96.9 (higher scores indicate better smoothness). However, when using the above method, LLM's defense performance against jailbreak attacks scored 61.3 and its smoothness in generating response information scored 97.3. Therefore, the method provided in this manual can effectively improve LLM's resistance to jailbreak attacks while ensuring the smoothness of LLM's response information generation.

[0055] The above is a security defense method for a large model provided by the embodiments of this specification. Based on the same idea, this specification also provides corresponding devices, storage media and electronic devices.

[0056] Figure 2 This is a schematic diagram of a large-scale security defense device provided in an embodiment of this specification. The device includes: The first acquisition module 201 is used to acquire prompt information; Input module 202 is used to input the prompt information into a pre-trained large language model LLM; The second acquisition module 203 is used to acquire, for each feature extraction layer in the LLM, the original features extracted by the feature extraction layer from the prompt information and the pre-determined rejection feature vector corresponding to the feature extraction layer; the rejection feature vector is used to characterize the semantics of the feature extraction layer refusing to generate response information for prompt information with aggressive behavior; The first reconstruction module 204 is used to reconstruct the original features using the rejection feature vector to obtain the first reconstructed features; and to determine the projection features of the original features on the direction of the rejection feature vector. The adjustment module 205 is used to adjust the direction of the projection feature according to the direction of the first reconstructed feature; The second reconstruction module 206 is used to reconstruct the original features based on the projection features after the direction is adjusted, so as to obtain the second reconstructed features, which are used as the output features of the feature extraction layer. The generation module 207 is used to generate response information corresponding to the prompt information based on the output features of each feature extraction layer in the LLM.

[0057] Optionally, the second acquisition module 203 is specifically used to acquire sample prompt information with attack behavior; determine the text representation of the sample prompt information in each preset language; input each text representation into a pre-trained LLM to obtain the original sample features extracted by the feature extraction layer in the LLM from each text representation; cluster the original sample features to obtain each cluster; determine the representative features of each cluster based on the original sample features contained in each cluster; and determine the vector composed of the orthogonal basis corresponding to the representative features of each cluster as the rejection feature vector corresponding to the feature extraction layer.

[0058] Optionally, the second acquisition module 203 is specifically used to cluster the original features of each sample based on the similarity between the original features of each sample.

[0059] Optionally, the second acquisition module 203 is specifically used to determine the principal component vectors of the original features of each sample contained in the cluster using the principal component analysis (PCA) algorithm for each cluster, and to use them as the representative features of the cluster.

[0060] Optionally, the first reconstruction module 204 is specifically used to determine a weight vector for fitting the original features using the rejection feature vector; and to reconstruct the original features using the weight vector and the rejection feature vector.

[0061] Optionally, the first reconstruction module 204 is specifically used to decompose the original feature into a vertical feature component perpendicular to the direction of the rejection feature vector and a parallel feature component parallel to the direction of the rejection feature vector; and to use the parallel feature component as the projection feature of the original feature on the direction of the rejection feature vector; Optionally, the second reconstruction module 206 is specifically used to reconstruct the original features based on the vertical feature components and the projected features after adjusting the direction.

[0062] Optionally, the adjustment module 205 is specifically used to use the spherical linear interpolation SLERP algorithm to rotate the direction of the projected feature toward the direction of the first reconstructed feature, and to control the rotation amplitude according to the control parameters preset for the feature extraction layer.

[0063] This specification also provides a computer-readable storage medium storing a computer program that, when executed by a processor, can be used to perform the security defense method for the large model described above.

[0064] This specification also provides a computer program product comprising a computer program that, when executed by a processor, implements the large-scale security defense method provided above.

[0065] based on Figure 1 The security defense method for the large model shown in this specification is further provided in the embodiments. Figure 3 The diagram shows the structure of the electronic device. Figure 3 At the hardware level, the electronic device includes a processor, internal bus, network interface, memory, and non-volatile memory, and may also include other hardware required for business operations. The processor reads the corresponding computer program from the non-volatile memory into memory and then runs it to implement the aforementioned large-scale security defense method.

[0066] The above description is merely an embodiment of this specification and is not intended to limit this specification. Various modifications and variations can be made to this specification by those skilled in the art. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of this specification should be included within the scope of the claims of this specification.

Claims

1. A security defense method for large-scale models, the method comprising: Get the prompt information; The prompt information is input into a pre-trained large language model (LLM); For each feature extraction layer in the LLM, the original features extracted by the feature extraction layer from the prompt information and the pre-determined rejection feature vector corresponding to the feature extraction layer are obtained; the rejection feature vector is used to characterize the semantics of the feature extraction layer refusing to generate response information for prompt information with aggressive behavior; The original features are reconstructed using the rejection feature vector to obtain a first reconstructed feature; and the projection feature of the original features onto the direction of the rejection feature vector is determined. The orientation of the projection feature is adjusted according to the orientation of the first reconstructed feature; The original features are reconstructed based on the projection features after the direction is adjusted to obtain the second reconstructed features, which are used as the output features of the feature extraction layer. Based on the output features of each feature extraction layer in the LLM, the response information corresponding to the prompt information is generated.

2. The method as described in claim 1, wherein the rejection feature vector corresponding to the feature extraction layer is predetermined, specifically including: Obtain sample prompts indicating aggressive behavior; Determine the text representation of the sample prompt information in each preset language; Each text representation is input into a pre-trained LLM to obtain the original features of the samples extracted from each text representation by the feature extraction layer in the LLM. Clustering is performed on the original features of each sample to obtain each cluster; Based on the original features of the samples contained in each cluster, determine the representative features of each cluster; The vector formed by the orthonormal basis corresponding to the representative features of each cluster is determined as the rejection feature vector corresponding to the feature extraction layer.

3. The method as described in claim 2, wherein clustering of the original features of each sample specifically includes: Clustering is performed on the original features of each sample based on the similarity between the original features of each sample.

4. The method of claim 2, wherein determining the representative features of each cluster specifically includes: For each cluster, the principal component analysis (PCA) algorithm is used to determine the principal component vectors of the original features of each sample contained in the cluster, which serve as the representative features of the cluster.

5. The method as described in claim 2, wherein the original features are reconstructed using the rejected feature vector, specifically including: Determine the weight vector for fitting the original features using the rejected feature vector; The original features are reconstructed using the weight vector and the rejection feature vector.

6. The method of claim 5, wherein determining the projection feature of the original feature onto the direction of the rejection feature vector, specifically includes: The original feature is decomposed into a vertical feature component perpendicular to the direction of the rejection feature vector and a parallel feature component parallel to the direction of the rejection feature vector. The parallel feature components are used as projections of the original features onto the direction of the rejection feature vector. The original features are reconstructed based on the projected features after the orientation adjustment, specifically including: The original features are reconstructed based on the vertical feature components and the projected features after orientation adjustment.

7. The method of claim 5, wherein adjusting the orientation of the projection feature according to the orientation of the first reconstructed feature specifically includes: The SLERP algorithm is used to rotate the direction of the projected feature toward the direction of the first reconstructed feature, and the rotation amplitude is controlled according to the control parameters preset for the feature extraction layer.

8. A large-scale security defense device, the device comprising: The first acquisition module is used to acquire prompt information; The input module is used to input the prompt information into a pre-trained large language model (LLM). The second acquisition module is used to acquire, for each feature extraction layer in the LLM, the original features extracted by that feature extraction layer from the prompt information and the pre-determined rejection feature vector corresponding to that feature extraction layer; the rejection feature vector is used to characterize the semantics of the feature extraction layer refusing to generate response information for prompt information with aggressive behavior; The first reconstruction module is used to reconstruct the original features using the rejection feature vector to obtain the first reconstructed features; and to determine the projection features of the original features on the direction of the rejection feature vector. An adjustment module is used to adjust the orientation of the projected feature according to the orientation of the first reconstructed feature; The second reconstruction module is used to reconstruct the original features based on the projection features after the direction is adjusted, so as to obtain the second reconstructed features, which are used as the output features of the feature extraction layer. The generation module is used to generate response information corresponding to the prompt information based on the output features of each feature extraction layer in the LLM.

9. A computer-readable storage medium storing a computer program that, when executed by a processor, implements the method described in any one of claims 1-7.

10. An electronic device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor executes the program to implement the method described in any one of claims 1-7.

11. A computer program product comprising a computer program that, when executed by a processor, implements the method described in any one of claims 1-7.

Images