Large model input and output safety protection method based on AI dynamic interception

Abstract

The invention discloses a large model input and output security protection method based on AI dynamic interception, which comprises the steps of obtaining large model input and output data and performing security detection, and further comprises the steps of extracting multi-class semantic features through cross-modal analysis, constructing a semantic association chain and collecting user behavior features and environment features. And generating a real-time risk value based on three types of feature dynamic risk assessment, and executing interception or release operation in combination with a dynamic interception decision threshold. According to the method, the problem of inaccurate protection caused by single-mode detection, static evaluation and a fixed threshold in the prior art is solved, multi-dimensional dynamic safety protection is realized, and the accuracy and adaptability of large-model input and output safety protection are improved.

Description

Technical Field

[0001] This invention relates to the field of security protection technology, specifically to a method for protecting the input and output security of large models based on AI dynamic interception. Background Technology

[0002] With the widespread application of large-scale models across various fields, the security protection of their input and output has become a key technical challenge. Existing large-scale model security protection methods mostly employ single-modal detection approaches, performing keyword matching or simple semantic analysis only on text-based input and output data. This fails to effectively handle the security risks posed by multimodal input data such as voice and images. Furthermore, existing risk assessments are mostly static, calculating risk values ​​based solely on preset risk rules or fixed weights, without fully considering the dynamic changes in user behavior and environmental characteristics that affect risk levels. This leads to discrepancies between risk assessment results and actual risk situations. In addition, the blocking decision thresholds of existing protection methods are mostly fixed values, unable to be dynamically adjusted according to real-time risk conditions, easily resulting in missed or false blocking, severely impacting the security and convenience of using large-scale models.

[0003] Based on the above problems, there is an urgent need for a large-scale input-output security protection method that can adapt to multimodal inputs, dynamically assess risks, and flexibly adjust interception strategies, in order to solve the problem of insufficient protection accuracy caused by the single protection dimension, static assessment, and fixed threshold of existing technologies. Summary of the Invention

[0004] The purpose of this invention is to address the shortcomings of existing technologies by proposing a large-model input / output security protection method based on AI dynamic interception. This method includes steps such as acquiring the input and output data of the large model, performing security checks on the input and output data, and further includes:

[0005] S1: Perform cross-modal parsing on the input data to extract text semantic features, speech-to-text semantic features, and image description semantic features;

[0006] S2: Construct a semantic association chain, which is generated based on the semantic association relationship between text semantic features, speech transcription semantic features and image description semantic features;

[0007] S3: Collect user behavior characteristics and environmental characteristics. The user behavior characteristics include interaction frequency, input duration and historical risk records. The environmental characteristics include network environment type, device security level and access time.

[0008] S4: Dynamic risk assessment is performed based on semantic association chains, user behavior characteristics, and environmental characteristics to generate real-time risk values;

[0009] S5: Based on real-time risk values ​​and dynamically calculated interception decision thresholds, perform interception or release operations on input or output data.

[0010] Preferably, cross-modal parsing in S1 includes: extracting text semantic features from text input data by word segmentation and part-of-speech tagging; extracting speech transcription semantic features from speech input data by converting it into text using a speech transcription model, and extracting image description semantic features from image input data by converting it into text description using an image description generation model, wherein the image description generation model adopts an encoder-decoder architecture.

[0011] Further preferably, the process of constructing the semantic association chain in S2 includes: calculating the first degree of association between text semantic features and speech-to-text semantic features; calculating the second degree of association between text semantic features and image description semantic features; calculating the third degree of association between speech-to-text semantic features and image description semantic features; and constructing a network semantic association chain based on the first degree of association, the second degree of association, and the third degree of association, wherein each semantic feature in the network semantic association chain is a node, and the degree of association is the connection weight between nodes.

[0012] Further preferably, the user behavior feature collection process in S3 includes: recording the timestamp of each user input through the large model interaction interface, calculating the time interval between two adjacent inputs to obtain the interaction frequency; recording the total time from the start of input to the completion of input to obtain the input duration; retrieving records marked as risky behaviors during historical interactions from the security database bound to the user identity to obtain historical risk records; the environmental feature collection process includes: determining the network environment type through network protocol analysis, obtaining the device security level through device security detection tools, and obtaining the access time period through timestamp parsing.

[0013] More preferably, the dynamic risk assessment process in S4 includes: firstly, calculating the cross-modal semantic risk value using the cross-modal semantic risk correlation formula, wherein the cross-modal semantic risk correlation formula is...

[0014] ;

[0015] in, This is a cross-modal semantic risk value, dimensionless, ranging from 0 to 1. These are text-to-speech semantic co-coefficients, dimensionless, ranging from 0 to 1. The text-image semantic co-coefficient is dimensionless and ranges from 0 to 1. These are the speech-image semantic co-coefficients, dimensionless, ranging from 0 to 1. This is a basic value for textual semantic risk, dimensionless, and ranging from 0 to 1. This is a baseline value for semantic risk in speech-to-text transcription, dimensionless, and ranging from 0 to 1. This is a basic value for semantic risk in image description, dimensionless, and ranging from 0 to 1. This is the semantic decay factor, with dimensions of 1 / second and a value range of 0.01 to 0.11 / second. The time difference between cross-modal data is expressed in seconds.

[0016] Furthermore, the dynamic risk assessment process further includes: calculating the real-time weights of each risk dimension using a dynamic risk weight iteration formula, wherein the dynamic risk weight iteration formula is:

[0017] ;

[0018] in, This is the real-time weight vector after the k-th iteration. It is dimensionless, and the values ​​of each dimension range from 0 to 1. This is the weight vector after the (k-1)th iteration. It is dimensionless, and the values ​​of each dimension range from 0 to 1. The step size for weight iteration is dimensionless and ranges from 0.001 to 0.01. This represents the gradient of the risk assessment loss function at the (k-1)th iteration, and its dimensionless value. This is a user behavior risk value, dimensionless, ranging from 0 to 1. This is the environmental risk value, which is dimensionless and ranges from 0 to 1. This is a cross-modal semantic risk value, which is dimensionless and ranges from 0 to 1.

[0019] Further preferably, the interception decision threshold in S5 is calculated using a cross-modal risk interception decision threshold formula, wherein the cross-modal risk interception decision threshold formula is:

[0020] ;

[0021] in, The threshold for real-time interception decisions is dimensionless and ranges from 0 to 1. The basic interception threshold is dimensionless and ranges from 0.5 to 0.8. This is a threshold adjustment coefficient, dimensionless, with a value ranging from 0.1 to 0.5. Let be the 2-norm of the real-time weight vector after the k-th iteration, with dimensionless dimensions. The maximum 2-norm of the weight vector, which is dimensionless. This is a real-time risk value, dimensionless, ranging from 0 to 1. This is the historical average risk value, which is dimensionless and ranges from 0 to 1.

[0022] Further optimized real-time risk values The calculation method is as follows:

[0023] ;

[0024] in This is the transpose of the real-time weight vector after the k-th iteration. For cross-modal semantic risk values, User behavior risk value Environmental risk value, user behavior risk value The environmental risk value is obtained through normalization and weighted summation of user behavior characteristics. It is obtained through the classification, quantification, and weighted summation of environmental characteristics.

[0025] A further optimized risk assessment loss function in the dynamic risk weight iteration formula. The mean squared error loss function is used. The iteration termination condition is that the 2-norm of the difference between the weight vectors of two adjacent iterations is less than a preset convergence threshold, or the number of iterations reaches a preset maximum number of iterations. The preset convergence threshold and the preset maximum number of iterations are determined by the security protection response time requirements of the large model.

[0026] Further optimized, the basic value of text semantic risk in the cross-modal semantic risk correlation formula Basic value of semantic risk in speech-to-text transcription and the basic value of semantic risk in image description All results are calculated using a pre-trained risk semantic recognition model. This pre-trained risk semantic recognition model adopts a Transformer architecture and is generated through training on a labeled dataset containing malicious semantics, gray semantics, and normal semantics. A semantic decay factor is also included. The system is dynamically adjusted based on the transmission latency and semantic consistency of cross-modal data.

[0027] The technical effects achieved by the above embodiments include:

[0028] This invention extracts multiple semantic features through cross-modal parsing and constructs semantic association chains. It then combines user behavior features and environmental features for dynamic risk assessment, and uses three linked formulas to dynamically calculate risk values ​​and interception thresholds. The core innovative technologies lie in the multimodal feature fusion risk assessment mechanism, the dynamic weight iteration adjustment strategy, and the real-time interception threshold optimization method. These technologies address the insufficient accuracy issues caused by single-modal detection, static evaluation, and fixed thresholds in existing technologies. This achieves multi-dimensional coverage and dynamic adaptation of security protection for large model inputs and outputs, improving the accuracy and adaptability of protection. Attached Figure Description

[0029] Figure 1 This is a flowchart of the large model input / output security protection method based on AI dynamic interception in this application. Detailed Implementation

[0030] To make the objectives, technical solutions, and advantages of this invention clearer, the invention will be further described in detail below with reference to the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are merely illustrative and not intended to limit the invention.

[0031] Existing technologies suffer from limitations such as a single protection dimension, static risk assessment, and fixed interception thresholds. They only perform security detection on single-modal data, without considering the semantic relationships of multimodal data. Furthermore, risk assessments do not take into account the dynamic changes in user behavior and the environment, and the interception thresholds cannot adapt to the real-time risk situation, resulting in insufficient protection accuracy.

[0032] Based on this, this embodiment provides a large-scale model input / output security protection method based on AI dynamic interception, including the steps of acquiring input and output data of the large model, and performing security detection on the input and output data, and further including: S1 performing cross-modal parsing on the input data to extract text semantic features, speech-to-text semantic features, and image description semantic features; S2 constructing a semantic association chain, which is generated based on the semantic relationship between text semantic features, speech-to-text semantic features, and image description semantic features; S3 collecting user behavior features and environmental features, including interaction frequency, input duration, and historical risk records, and environmental features including network environment type, device security level, and access time period; S4 performing dynamic risk assessment based on semantic association chain, user behavior features, and environmental features to generate a real-time risk value; S5 performing interception or allowance operations on the input or output data based on the real-time risk value and dynamically calculated interception decision threshold.

[0033] The core of this technical solution lies in constructing a multi-dimensional collaborative dynamic protection system. Input and output data acquisition is achieved through the interaction interface of a large model. This interface supports real-time transmission of various data types, including text, voice, and images. Data transmission employs encryption protocols to ensure the security of the original data. Basic security detection steps include data integrity verification and format validity verification, eliminating invalid and maliciously tampered data to provide a reliable data source for subsequent processing. The cross-modal parsing in step S1 relies on a dedicated processing module. For text-type input data, word segmentation uses a dictionary-based forward maximum matching algorithm. The segmentation granularity can be adjusted according to the application scenario of the large model. Part-of-speech tagging uses a Hidden Markov Model, with tagging dimensions including 12 basic parts of speech such as nouns, verbs, adjectives, and adverbs. Semantic tendencies are identified through part-of-speech combination. For voice-type input data transcription, an automatic speech recognition model based on the Transformer architecture is used. The model includes an encoder and a decoder. The encoder employs a 6-layer multi-head self-attention mechanism, and the decoder uses a 3-layer bidirectional LSTM. During transcription, Mel-spectrum feature extraction and speech activity detection are used to remove background noise and invalid speech segments, ensuring the accuracy of the transcribed text. The image input data description generation adopts an encoder-decoder architecture. The encoder uses a ResNet50 network to extract high-level visual features of the image, and the decoder uses an LSTM network with an attention mechanism to convert the visual features into natural language descriptions. The description text includes key semantic information such as the main object, actions, and scenes in the image. All three types of semantic features are stored in vector form, with a uniform vector dimension of 512 for easy subsequent association calculations. In step S2, the semantic association chain construction first normalizes the three types of semantic feature vectors to eliminate dimensional differences. Then, a cosine similarity algorithm is used to calculate the pairwise association degree. The cosine similarity calculation is based on the ratio of the vector dot product to the product of the magnitudes, with a value between 0 and 1. An association degree greater than 0.7 is considered a strong association, 0.3 to 0.7 is a moderate association, and less than 0.3 is a weak association. The network semantic association chain is stored in the form of an adjacency matrix, where the matrix elements are the corresponding association degree values. The matrix dimension is 3×3, with rows and columns corresponding to text semantic features, speech-to-text semantic features, and image description semantic features, respectively. After the association chain is constructed, feature enhancement is performed through a graph neural network to highlight the risk contribution of strongly associated nodes. Feature acquisition in step S3 is achieved through a dedicated data acquisition module. The interaction frequency is calculated using the sliding window method, with the window size set to 5 minutes. The time interval between two adjacent inputs within the window is counted, and the average value is taken as the current interaction frequency. The input duration is calculated by recording the start and end timestamps of the input operation and calculating the difference between the two. The timestamp accuracy is at the millisecond level. Historical risk records are stored in a relational database uniquely bound to the user's identity. The records include information such as the time of occurrence of the risk behavior, risk type, risk level, and processing result. During acquisition, historical data from the past 3 months are retrieved using the user's identity identifier.The network environment type is determined by analyzing data transmission protocols and network link parameters. Protocol types include HTTP, HTTPS, FTP, etc., and link parameters include transmission latency, packet loss rate, bandwidth fluctuation, etc., which are comprehensively judged as a secure and trusted network, a public network, or a risky network. Device security level detection is achieved through a security agent program deployed on the terminal device. Detection dimensions include operating system version, security patch installation status, virus scanning status, firewall configuration, etc., and a weighted scoring method is used to determine the security level. Access time periods are parsed into specific time periods based on timestamps, divided into working hours, rest hours, and high-risk periods. Working hours are 9:00-18:00, rest hours are 18:00-24:00, and high-risk periods are 0:00-9:00. The dynamic risk assessment in step S4 adopts a layered calculation strategy. First, cross-modal semantic risk values, user behavior risk values, and environmental risk values ​​are calculated separately. Then, real-time risk values ​​are obtained through real-time weighted vector fusion. The main body for risk assessment is an AI inference engine deployed in the cloud. The engine uses a GPU cluster to accelerate the calculation, ensuring that the assessment latency does not exceed 100 milliseconds. The S5 step's interception decision is achieved by comparing the real-time risk value with the real-time interception decision threshold. When the real-time risk value is greater than or equal to the real-time interception decision threshold, an interception operation is performed. The interception operation includes refusing input data into the large model or preventing output data from being displayed to the user, and providing feedback to the user on the reason for the interception. When the real-time risk value is less than the real-time interception decision threshold, a release operation is performed, and the data flows normally. The execution of the interception and release operations is implemented through the interface permission control module of the large model, and the module supports real-time response to the decision results.

[0034] Existing technologies suffer from inconsistent feature extraction methods and significant loss of semantic information when parsing cross-modal data, making it impossible to effectively fuse multimodal features for security detection.

[0035] Based on this, cross-modal parsing in S1 includes: extracting text semantic features by word segmentation and part-of-speech tagging for text input data; extracting speech transcription semantic features for speech input data after it has been converted to text by a speech transcription model, using the same method as for text input data; and extracting image description semantic features for image input data after it has been converted to text description by an image description generation model, the image description generation model using an encoder-decoder architecture.

[0036] For text-type input data, word segmentation is performed using the precise mode of the jieba word segmentation tool. This mode can accurately split words in the text, avoiding ambiguous word segmentation. For professional terms and domain-specific vocabulary, a custom dictionary is pre-built, containing commonly used professional terms from multiple fields such as government affairs, finance, and medicine, ensuring the accuracy of word segmentation. After word segmentation, each word is tagged with its part of speech using the Peking University Chinese Part-of-Speech Tagging Set, covering 26 parts of speech including nouns, verbs, adjectives, adverbs, and prepositions. The tagging process is implemented using a Hidden Markov Model, which has been trained on a corpus containing 1 million tagged texts, achieving an accuracy rate of over 98%. Semantic feature extraction is based on the tagged word sequence. The Word2Vec model is used to convert each word into a low-dimensional dense vector with a vector dimension of 512. Then, mean pooling is used to combine the word vectors into a text semantic feature vector. The transcription model for speech input data employs an end-to-end speech recognition model based on Transformer. The input is a single-channel speech signal with a 16kHz sampling rate. First, speech features are extracted through preprocessing steps such as pre-emphasis, framing, and windowing. Pre-emphasis uses a first-order high-pass filter, framing uses a 20ms frame length and a 10ms frame shift, and windowing uses a Hanning window. Then, Mel-frequency cepstral coefficients are extracted as speech features, with a coefficient dimension of 40. The encoder of the model consists of a 6-layer multi-head self-attention mechanism and a feedforward neural network. The multi-head self-attention mechanism has 8 heads, and the feedforward neural network has 2048 hidden layer nodes. The decoder consists of a 3-layer bidirectional LSTM and a fully connected layer. The bidirectional LSTM has 1024 hidden layer nodes, and the fully connected layer outputs a character probability distribution. The model is trained on a corpus containing 5000 hours of multi-domain speech data, achieving a transcription accuracy of over 95%. The transcribed text undergoes the same word segmentation and part-of-speech tagging process as the original text input data, extracting semantic feature vectors with a 512-dimensional vector dimension. For image-type input data, the description generation model employs an encoder-decoder architecture. The encoder uses a ResNet50 network with 50 convolutional and pooling layers. The input is a 224×224 pixel RGB image. First, the image is normalized, mapping pixel values ​​to 0 to 1. Then, the ResNet50 network extracts visual features, resulting in a 7×7×2048 feature map. The decoder uses an LSTM network with Bahdanau attention mechanism. The LSTM has 1024 hidden nodes. The attention mechanism dynamically focuses on key regions in the image, improving description accuracy. The model is trained on the COCO dataset containing 80,000 images and corresponding text descriptions, achieving a BLEU-4 value of over 0.65. The generated text descriptions also undergo word segmentation and part-of-speech tagging, extracting semantic feature vectors with a 512-dimensional vector dimension.The extraction process for the three types of semantic feature vectors remains consistent to ensure a unified feature format, laying the foundation for subsequent semantic association chain construction and risk assessment.

[0037] Existing technologies, when processing multimodal features, do not consider the correlation between semantic features of different modalities, and only conduct risk assessments on each modal feature individually. This results in the inability to capture risk information transmitted collaboratively by multimodal data, affecting the accuracy of protection.

[0038] Based on this, the construction process of the semantic association chain in S2 includes: calculating the first degree of association between text semantic features and speech-to-text semantic features; calculating the second degree of association between text semantic features and image description semantic features; calculating the third degree of association between speech-to-text semantic features and image description semantic features; and constructing a network semantic association chain based on the first degree of association, the second degree of association, and the third degree of association, where each semantic feature in the network semantic association chain is a node, and the degree of association is the connection weight between nodes.

[0039] The first correlation score is calculated using the text semantic feature vector and the speech-to-text semantic feature vector, employing a cosine similarity algorithm. The formula is: the first correlation score equals the dot product of the text semantic feature vector and the speech-to-text semantic feature vector, divided by the product of the magnitudes of the text semantic feature vector and the speech-to-text semantic feature vector. The cosine similarity value ranges from 0 to 1; the closer the value is to 1, the higher the semantic similarity between the two types of semantic features, and the stronger the correlation. The second correlation score is calculated using the text semantic feature vector and the image description semantic feature vector, and the third correlation score is calculated using the speech-to-text semantic feature vector and the image description semantic feature vector. The calculation method is completely consistent with the first correlation score, ensuring consistency in correlation score calculation. After calculation, the three correlation scores are normalized using a min-max normalization method, mapping the correlation score values ​​to between 0 and 1 to eliminate the influence of differences between feature vectors of different modalities. The network semantic association chain is constructed using three types of semantic features as nodes, distinguished by unique identifiers. These nodes correspond to text semantic feature nodes, speech-to-text semantic feature nodes, and image description semantic feature nodes, respectively. The weights of the edges connecting nodes represent the corresponding normalized association scores. The association chain is stored using a graph data structure with a 3×3 adjacency matrix. Matrix element a_ij represents the connection weight between the i-th and j-th nodes, where i and j take values ​​of 1, 2, and 3, corresponding to the text semantic feature nodes, speech-to-text semantic feature nodes, and image description semantic feature nodes, respectively. To enhance the risk representation capability of the association chain, feature enhancement processing is applied to the graph data structure. A graph convolutional neural network is used to train the association chain. The graph convolutional neural network consists of two graph convolutional layers and one fully connected layer. The output dimension of the first graph convolutional layer is 256, the output dimension of the second graph convolutional layer is 128, and the output dimension of the fully connected layer is 3, corresponding to the enhanced features of the three nodes. The training process uses the risk semantic recognition results as a supervision signal to optimize the connection weights of the association chains, enabling the association chains to better capture the collaborative risk information of multimodal semantics. The enhanced network semantic association chains can intuitively present the association strength between the three types of semantic features, providing more comprehensive semantic feature support for subsequent dynamic risk assessment.

[0040] Existing technologies lack precise methods for collecting user behavior and environmental factors in risk assessment, resulting in inaccurate and incomplete relevant feature data, which cannot provide reliable support for dynamic risk assessment.

[0041] Based on this, the user behavior feature collection process in S3 includes: recording the timestamp of each user input through the large model interaction interface, calculating the time interval between two adjacent inputs to obtain the interaction frequency; recording the total time from the start of input to completion to obtain the input duration; retrieving records marked as risky behaviors during historical interactions from the security database bound to the user's identity to obtain historical risk records; the environmental feature collection process includes: determining the network environment type through network protocol analysis; obtaining the device security level through device security detection tools; and obtaining the access time period through timestamp parsing.

[0042] User behavior feature collection is achieved through a collaborative approach between the large-scale model's interaction interface and a secure database. The large-scale model's interaction interface supports the HTTP RESTful protocol, enabling real-time capture of user input. Each input operation triggers the interface to record a timestamp in UTC format with millisecond precision. Interaction frequency is calculated using a sliding window method, with a window size of 5 minutes (300 seconds). For each user, the system maintains a queue containing all input timestamps from the last 5 minutes. When a new input operation occurs, the difference between the current and previous timestamps is calculated to obtain the time interval between two adjacent inputs. The average of all time intervals in the queue is then calculated as the current interaction frequency, measured in times per second. Input duration is collected by recording the start and end timestamps of the user's input operation. The start timestamp is the time when the user first enters a character in the input box, and the end timestamp is the time when the user clicks the submit button or the system automatically submits. The input duration is the difference between the end and start timestamps, measured in seconds. Historical risk records are collected based on user identity identifiers. Each user has a unique identity identifier in the system. The security database uses a MySQL database to store records of risk behaviors during users' past interactions. The database table structure includes fields such as user identity identifier, timestamp of risk behavior occurrence, risk type, risk level, and processing result. Risk types include malicious input, sensitive information output, and unauthorized operations. Risk levels are divided into three levels: high, medium, and low. During collection, historical risk records for the past 3 months are queried using the user identity identifier to count the number of risk behaviors and the highest risk level, which serve as characteristics of historical risk records. Environmental characteristics are collected through a network protocol analysis module, device security detection tools, and a time analysis module. The network protocol analysis module, deployed on a cloud gateway, can parse the data transmission protocols between users and the large model, supporting the identification of common protocols such as HTTP, HTTPS, FTP, and SSH. It also collects network link parameters, including transmission latency, packet loss rate, and bandwidth fluctuation. Transmission latency is calculated by the round-trip time of data packets; packet loss rate is calculated by the ratio of the difference between sent and received data packets; and bandwidth fluctuation is obtained by monitoring the change in transmission rate per unit time. Based on the combined protocol type and link parameters, network environment types are categorized into secure and trusted networks, public networks, and risky networks. Secure and trusted networks refer to closed networks such as enterprise intranets and government intranets, with transmission latency less than 50 milliseconds, packet loss rate less than 0.1%, and bandwidth fluctuation less than 10%. Public networks refer to open networks such as WiFi networks and 4G / 5G networks, with transmission latency between 50 and 200 milliseconds, packet loss rate between 0.1% and 1%, and bandwidth fluctuation between 10% and 30%. Risky networks refer to networks with transmission latency greater than 200 milliseconds, packet loss rate greater than 1%, and bandwidth fluctuation greater than 30%.The device security detection tool is a lightweight agent program deployed on user terminals, supporting multiple operating systems including Windows, Linux, macOS, Android, and iOS. The agent program periodically scans the security status of terminal devices, including operating system version, security patch installation status, virus scan status, firewall configuration, and sensitive permission authorization status. Each scan dimension has a corresponding scoring standard, with a total score of 100 points. Based on the total score, the device security level is divided into high security, medium security, and low security levels. A score of 80 or above is considered high security, 60 to 80 points is medium security, and below 60 points is low security. Access time periods are obtained by parsing the timestamps of the input data. After converting the timestamps to local time, the time periods are divided as follows: 9:00-18:00 is the working period, 18:00-24:00 is the rest period, and 0:00-9:00 is the high-risk period. The time parsing module ensures the accuracy of the time conversion, taking into account factors such as time zones and daylight saving time.

[0043] Existing technologies lack risk calculation methods that can integrate the correlation between multimodal semantic features and consider the time decay effect, resulting in inaccurate cross-modal semantic risk assessment.

[0044] Based on this, the dynamic risk assessment process in S4 includes: firstly, calculating the cross-modal semantic risk value using the cross-modal semantic risk correlation formula, which is as follows:

[0045]

[0046] in, This is a cross-modal semantic risk value, which is dimensionless and ranges from 0 to 1. The text-speech semantic co-coefficient is dimensionless and ranges from 0 to 1. The text-image semantic co-coefficient is dimensionless and ranges from 0 to 1. The speech-image semantic co-coefficient is dimensionless and ranges from 0 to 1. This is the basic value for text semantic risk, which is dimensionless and ranges from 0 to 1. This is the basic value for semantic risk in speech-to-text transcription. It is dimensionless and ranges from 0 to 1. This is the basic value for semantic risk in image description, with a dimensionless dimension and a value range of 0 to 1. This is the semantic decay factor, with dimensions of 1 / second and a value range of 0.01 to 0.11 / second. The time difference between cross-modal data is expressed in seconds.

[0047] The theoretical basis of this formula is the synergistic risk effect and time decay effect of multimodal semantic features. The logical derivation process is as follows: Multimodal semantic risk is not a simple superposition of individual modal risks, but rather the result of interaction and synergistic contribution between different modalities. Therefore, it is necessary to consider the synergistic effect of two types of modal semantic risks. The synergistic effect is represented by the product of the basic values ​​of pairwise modal risks. The larger the product value, the higher the synergistic risk of the two types of semantics. The text-speech semantic synergistic coefficient, text-image semantic synergistic coefficient, and speech-image semantic synergistic coefficient are used to quantify the synergistic importance of different modal combinations. The coefficient values ​​are determined by the gradient descent optimization algorithm. The optimization objective is to minimize the mean square error between the cross-modal semantic risk value and the actual risk label. The optimization process uses a dataset containing 100,000 multimodal risk samples, covering different domains and different risk types. The final synergistic coefficients satisfy the following conditions: To ensure the reasonableness of the coefficients, the numerator of the formula is the weighted sum of the collaborative risks of the three modal combinations, comprehensively covering the collaborative contributions of all modal combinations. The denominator uses the Euclidean norm of the collaborative coefficients to normalize the numerator, preventing cross-modal semantic risk values ​​from exceeding the reasonable range of 0 to 1 due to differences in the values ​​of the collaborative coefficients. The Euclidean norm is calculated as the square root of the sum of squares of the collaborative coefficients, ensuring the effectiveness of the normalization. During the acquisition of cross-modal data, there is a time difference between the generation and transmission of data from different modalities. As the time interval increases, the correlation between different modal semantics gradually weakens, and the risk contribution also decreases. Therefore, an exponential decay term is introduced. Characterizing the time decay effect, the exponential decay term ranges from 0 to 1. When the time difference is 0, the decay term is 1, and the time decay effect is 0; as the time difference increases, the decay term decreases, and the time decay effect strengthens. Semantic decay factor The attenuation rate is controlled by fitting a large amount of experimental data. The experiment selected multimodal data samples with different time differences, calculated the deviation between the actual risk value and the theoretical risk value, and adjusted accordingly. To minimize the deviation, the final value range was determined to be between 0.01 and 0.11 / second. Time difference This is the difference in timestamps between the latest and earliest acquired modal data, expressed in seconds, to ensure the accuracy of the time difference calculation. For example, if the timestamp for text data acquisition is t1, the timestamp for voice data acquisition is t2, and the timestamp for image data acquisition is t3, assuming t3 > t2 > t1, then the time difference is... The calculation process of this formula is executed in parallel on a GPU cluster to ensure computational efficiency. The value of each parameter has a clear theoretical basis and experimental support, which can accurately quantify the collaborative risk of multimodal semantics. At the same time, the time decay effect is considered to make the calculation of cross-modal semantic risk value more in line with the actual scenario.

[0048] Existing technologies use a fixed weighting method in risk assessment, which cannot dynamically adjust the importance of each risk dimension according to the real-time risk situation, resulting in a large deviation between the risk assessment results and the actual risk situation.

[0049] Based on this, the dynamic risk assessment process also includes: calculating the real-time weights of each risk dimension using a dynamic risk weight iteration formula, which is:

[0050]

[0051] in, is the real-time weight vector after the kth iteration, with dimensionless dimensions and values ​​ranging from 0 to 1 for each dimension; is the weight vector after the (k-1)th iteration. It is dimensionless and the values ​​of each dimension range from 0 to 1. The step size for weight iteration is dimensionless and ranges from 0.001 to 0.01. This is the gradient of the risk assessment loss function at the (k-1)th iteration, and its dimensionless value. This is the user behavior risk value, which is dimensionless and ranges from 0 to 1. This is the environmental risk value, which is dimensionless and ranges from 0 to 1. This is a cross-modal semantic risk value, which is dimensionless and ranges from 0 to 1.

[0052] The theoretical basis of this formula is the gradient descent optimization principle and the dynamic allocation mechanism of risk dimension contribution. The logical derivation process is as follows: The core objective of weight iteration is to minimize the risk assessment loss function, so that the predicted real-time risk value is highly consistent with the actual risk situation. The risk assessment loss function adopts the mean squared error loss function, specifically in the form of... ,in The actual risk value for the i-th sample is determined by manual annotation; The predicted risk value for the i-th sample is obtained by the weighted sum of the risk dimension values ​​and their corresponding weights; n is the number of samples. The gradient of the loss function. To reflect the direction and extent of the impact of changes in the weight vector on the loss function, gradient calculation uses the backpropagation algorithm. Starting from the loss function, the gradient value of each weight is obtained by taking the derivative layer by layer, and the gradient at the (k-1)th iteration is calculated. This is a three-dimensional vector, representing the gradients of cross-modal semantic risk weights, user behavior risk weights, and environmental risk weights, respectively. The weight iteration process adjusts the weight vector along the gradient descent direction, gradually reducing the loss function and achieving weight optimization. To adapt the weight adjustment to the real-time risk situation, a risk dimension contribution factor is introduced. This factor quantifies the proportion of cross-modal semantic risk in the current total risk. When the proportion of cross-modal semantic risk is high, the factor value is larger, and weight adjustments will tend to optimize the weight of the cross-modal semantic risk dimension, allowing this dimension to play a greater role in the overall risk assessment. When the proportion of user behavior risk or environmental risk is high, the factor value is smaller, and weight adjustments will tend to optimize the weight of the corresponding risk dimension, achieving dynamic weight adaptation. Weight iteration step size. The step size is used to control the magnitude of each weight adjustment. Too large a step size can cause oscillations during the iteration process, preventing convergence to the optimal solution; too small a step size will result in slow convergence, affecting real-time performance. Therefore, through extensive experiments, its value was determined to be between 0.001 and 0.01. Different step size values ​​were selected for iterative testing to observe convergence speed and accuracy, ultimately determining the optimal step size range. Initial values ​​of the weight vector. The initial weights are set to [0.5, 0.3, 0.2], corresponding to cross-modal semantic risk weights, user behavior risk weights, and environmental risk weights, respectively. These initial values ​​are determined based on statistical analysis of historical risk data. Cross-modal semantic risk accounts for the highest proportion of historical risk events, hence its largest initial weight. During iteration, the values ​​of each dimension of the weight vector remain between 0 and 1. When the adjusted weight value exceeds this range, it is automatically truncated to 0 or 1 to ensure the rationality of the weights. The iterative calculation of this formula is executed in real time in the AI ​​inference engine, with a calculation delay of no more than 10 milliseconds for each iteration, ensuring that the weight adjustments can respond to changes in the risk situation in real time.

[0053] Existing technologies use fixed interception decision thresholds, which cannot be dynamically adjusted according to real-time risk situations and weight changes, leading to frequent missed or false interceptions. Therefore, in S5, the interception decision threshold is calculated using a cross-modal risk interception decision threshold formula, which is as follows:

[0054] ;

[0055] in, The threshold for real-time interception decisions is dimensionless and ranges from 0 to 1. The basic interception threshold is dimensionless and ranges from 0.5 to 0.8. This is a threshold adjustment coefficient, dimensionless, with a value ranging from 0.1 to 0.5. Let be the 2-norm of the real-time weight vector after the k-th iteration, with dimensionless dimensions. The maximum 2-norm of the weight vector, which is dimensionless. This is a real-time risk value, dimensionless, ranging from 0 to 1. This is the historical average risk value, which is dimensionless and ranges from 0 to 1.

[0056] The theoretical design of this formula is based on the risk situation adaptation principle and the weight influence quantification mechanism. The logical derivation process is as follows: Basic interception threshold This is the baseline value for interception decisions. Its value is determined based on historical security data and industry security standards. Historical security data includes risk event records from the past six months, statistically analyzing the missed interception rate and false interception rate under different thresholds. Industry security standards reference relevant national cybersecurity regulations and industry standards, ultimately determining a value range between 0.5 and 0.8. When the baseline interception threshold is 0.5, it tends to reduce missed interceptions; when it is 0.8, it tends to reduce false interceptions. This value can be flexibly set according to the application scenario of the large-scale model. Weighting Influence Factor The 2-norm of the weight vector is used to quantify the impact of the strength of the real-time weight vector on the threshold. The calculation is the square root of the sum of squares of the weights of each dimension, reflecting the overall strength of the weight vector. The stronger the weight vector, the higher the distinguishability of each risk dimension and the more reliable the risk assessment result. At this time, the threshold should be adjusted appropriately to adapt to the improvement of assessment accuracy. This is the maximum 2-norm of the weight vector during historical iterations, used to normalize the strength of the current weight vector, ensuring that the weight influence factor ranges between 0 and 1, and guaranteeing the reasonableness of the adjustment range. Risk Situation Factor Used to quantify the relative level of the current real-time risk value and the historical average risk value. This is the average real-time risk value of all risk assessment samples over the past three months. When the real-time risk value is higher than the historical average risk value, the risk situation factor is greater than 1, indicating a high current risk level, and the threshold should be appropriately increased to reduce false alarms. When the real-time risk value is lower than the historical average risk value, the risk situation factor is less than 1, indicating a low current risk level, and the threshold should be appropriately decreased to reduce missed alarms. Threshold adjustment coefficient. The threshold is used to control the overall adjustment range, and its value was determined experimentally. Different adjustment coefficients were selected in the experiment, and changes in the missed block rate and false block rate were observed. The final value range was determined to be between 0.1 and 0.5. The larger the adjustment coefficient, the more sensitive the threshold is to changes in weight and risk situation; the smaller the adjustment coefficient, the more stable the threshold. The appropriate coefficient can be flexibly selected based on the security requirements of the large model and the usage scenario. The calculation process of this formula is performed synchronously with the calculation of the real-time risk value, with a calculation delay of no more than 50 milliseconds, ensuring the real-time nature of the interception decision. Dynamic adjustment of the real-time interception decision threshold allows the interception strategy to better adapt to the real-time risk situation, effectively reducing the occurrence of missed blocks and false blocks.

[0057] Existing technologies lack a method to effectively integrate the values ​​of each risk dimension with real-time weights to calculate the total risk value, resulting in inaccurate calculation of real-time risk values ​​and an inability to provide a reliable basis for interception decisions.

[0058] Based on this, real-time risk value The calculation method is as follows: ,in This is the transpose of the real-time weight vector after the k-th iteration. For cross-modal semantic risk values, User behavior risk value Environmental risk value, user behavior risk value The environmental risk value is obtained through normalization and weighted summation of user behavior characteristics. It is obtained through the classification, quantification, and weighted summation of environmental characteristics.

[0059] The real-time risk value is calculated using a vector dot product, which enables precise integration of each risk dimension value with its corresponding real-time weight, ensuring that the total risk value objectively reflects the current overall risk level. The vector dot product calculation process involves performing a dot product operation between the transpose of the real-time weight vector and the risk value vector to obtain the real-time risk value. (Real-time weight vector) ,in For cross-modal semantic risk weights, Assigning risk weights to user behavior Environmental risk weights, after transposition The risk value vector is The result of the dot product operation is The calculation result ranges from 0 to 1; a higher value indicates a higher overall risk level. User behavior risk value. The calculation consists of two steps: normalization and weighted summation. The three features—interaction frequency, input duration, and historical risk records—are first normalized using a min-max normalization method. The normalization formula for interaction frequency is: ,in The original interaction frequency, This represents the lowest historical interaction frequency. The highest historical interaction frequency, after normalization The value ranges from 0 to 1, and the higher the interaction frequency, the better. The larger the input duration, the more normalized the formula is. ,in The original input duration. This is the lowest input time in history. This represents the historical maximum input duration, after normalization. The value ranges from 0 to 1; the shorter the input duration, the better. The larger the value; the normalization formula for historical risk records is: ,in This represents the number of risky behaviors of the current user over the past 3 months. The number of the highest risky behaviors in history, after normalization The value ranges from 0 to 1; the more historical risk records, the better. The larger the value, the greater the risk. After normalization, a weighted sum is used to obtain the user behavior risk value. The interaction frequency is weighted at 0.4, the input duration at 0.3, and the historical risk record at 0.3. This weighting is based on the degree of influence of each feature on user behavior risk and is determined through statistical analysis of historical risk events. Environmental risk value. The calculation consists of two steps: hierarchical quantification and weighted summation. Three characteristics—network environment type, device security level, and access time period—are used for hierarchical quantification. For network environment type, a risky network is quantified as 1, a public network as 0.5, and a secure and trusted network as 0.1. For device security level, a low security level is quantified as 1, a medium security level as 0.5, and a high security level as 0.1. For access time period, high-risk periods are quantified as 1, rest periods as 0.5, and work periods as 0.1. After hierarchical quantification, a weighted summation is used to obtain the environmental risk value. The network environment type has a weight of 0.4, the device security level has a weight of 0.3, and the access time period has a weight of 0.3. This weight allocation is based on the degree of impact of each feature on environmental risk and was determined through fitting experimental data. The calculation of each risk dimension value and real-time weight is completed in the cloud AI inference engine. The calculation process uses 64-bit floating-point precision to ensure calculation accuracy. The calculation latency of the real-time risk value does not exceed 100 milliseconds, meeting the real-time requirements of large model input and output security protection.

[0060] Existing technologies lack clear iteration termination conditions during weight iteration, which can lead to excessive iterations affecting the protection response speed, or insufficient iterations causing the weights to fail to converge to the optimal value.

[0061] Based on this, the risk assessment loss function in the dynamic risk weight iteration formula The mean squared error loss function is used. The iteration termination condition is that the 2-norm of the difference between the weight vectors of two adjacent iterations is less than the preset convergence threshold, or the number of iterations reaches the preset maximum number of iterations. The preset convergence threshold and the preset maximum number of iterations are determined by the safety protection response time requirements of the large model.

[0062] The risk assessment loss function uses the mean squared error loss function, which can effectively quantify the deviation between the predicted risk value and the actual risk value, providing a clear optimization objective for weight iteration. The specific form of the mean squared error loss function is as follows: ,in To determine the number of samples used to calculate the loss function, the most recent 100 risk assessment samples were selected to ensure the real-time nature of the samples. The actual risk value for the i-th sample is labeled by a manual labeling team based on the severity of the risk event, with the labeling range between 0 and 1. The predicted risk value for the i-th sample is obtained by weighted sum of the risk dimension values ​​and their corresponding weights. The loss function is calculated after each weight iteration to provide feedback for weight adjustment. There are two iteration termination conditions; iteration terminates when either one is met: the first termination condition is that the 2-norm of the difference between the weight vectors of two adjacent iterations is less than a preset convergence threshold, and the difference between the weight vectors of two adjacent iterations is less than a certain threshold. The 2-norm of the difference is calculated as follows: The norm reflects the magnitude of change in the weight vector. When the norm is less than the preset convergence threshold, it indicates that the weight vector has stabilized, and further iteration has little effect on weight optimization. Terminating the iteration at this point reduces computational resource consumption and improves the protection response speed. The preset convergence threshold is determined based on the accuracy requirements of the large model's security protection. The higher the accuracy requirement, the smaller the convergence threshold, typically ranging from 0.0001 to 0.001. The second termination condition is when the number of iterations reaches the preset maximum number of iterations. The preset maximum number of iterations is determined based on the security protection response time requirements of the large model. The stricter the response time requirements, the smaller the maximum number of iterations, typically ranging from 50 to 200, ensuring that the weight iteration process does not take up too much time and affect the overall protection delay. For example, if the security protection response time requirement of the large model is no more than 500 milliseconds, and the calculation delay of each weight iteration is 10 milliseconds, then the preset maximum number of iterations can be set to 50 to ensure that the iteration process is completed within 500 milliseconds. When the number of iterations reaches the preset maximum number of iterations, the iteration terminates regardless of whether the weight vector has converged. The weight vector obtained in the current iteration is then used for risk assessment to avoid exceeding the protection delay limit due to non-convergence of iterations. The preset convergence threshold and preset maximum number of iterations can be dynamically adjusted according to the application scenario and security requirements of the large model. For example, in scenarios with extremely high security requirements, such as government affairs and finance, the preset convergence threshold can be set to 0.0001 and the preset maximum number of iterations can be set to 200 to ensure the accuracy of weight optimization; in general public service scenarios, the preset convergence threshold can be set to 0.001 and the preset maximum number of iterations can be set to 50 to balance accuracy and speed.

[0063] Existing technologies suffer from unreasonable risk semantic recognition model architecture, incomplete training data, and fixed semantic decay factors, leading to inaccurate calculation of multimodal semantic risk baseline values ​​and affecting the accuracy of cross-modal semantic risk assessment.

[0064] Based on this, the basic value of text semantic risk in the cross-modal semantic risk correlation formula Basic value of semantic risk in speech-to-text transcription and the basic value of semantic risk in image description All results were calculated using a pre-trained risk semantic recognition model. This model employs a Transformer architecture and is trained on a labeled dataset containing malicious, gray, and normal semantics. A semantic decay factor was also included. The system is dynamically adjusted based on the transmission latency and semantic consistency of cross-modal data.

[0065] The risk semantic recognition model adopts the Transformer architecture, which effectively captures long-distance dependencies in text sequences through a self-attention mechanism. This architecture is more suitable for semantic feature extraction and risk recognition than traditional recurrent neural networks. The overall structure of the model includes an input layer, an embedding layer, an encoder, a decoder, and an output layer. The input layer receives the text sequence after word segmentation and part-of-speech tagging, with a maximum length of 128 bytes. The embedding layer converts each word in the text sequence into a 512-dimensional word embedding vector, initialized using a pre-trained Word2Vec model. The encoder contains six layers of multi-head self-attention mechanisms and a feedforward neural network. Each multi-head self-attention mechanism has eight heads, and the feedforward neural network has 2048 hidden nodes. The ReLU activation function is used, and the encoder output is a 512-dimensional semantic feature vector. The decoder contains three layers of multi-head self-attention mechanisms, a feedforward neural network, and layer normalization. The decoder output is a 3-dimensional vector, corresponding to the probabilities of malicious, gray, and normal semantics, respectively. The output layer uses a softmax activation function to convert the decoder output into a probability distribution. The model training process is divided into two stages: pre-training and fine-tuning. The pre-training stage uses a corpus containing 1 million general text data entries, with the training objective being a language model task. The fine-tuning stage uses a labeled dataset containing malicious, gray, and normal semantics. The labeled dataset has 500,000 entries, including 150,000 malicious semantic entries covering types such as violence, terrorism, pornography, vulgarity, and hate speech; 150,000 gray semantic entries covering types such as sensitive topics and controversial content; and 200,000 normal semantic entries covering types such as ordinary communication, work and study, and information retrieval. The fine-tuning stage uses the cross-entropy loss function, the Adam optimizer, a learning rate of 0.0001, 100 training epochs, and a batch size of 64. After training, the model achieves an accuracy of over 98%, a recall of over 97%, and a precision of over 96% on the validation set. The reasoning process of the risk semantic recognition model is as follows: After the input text sequence is processed by the embedding layer and encoder, a semantic feature vector is obtained. The decoder decodes the semantic feature vector and outputs the probability distribution of three types of semantics. The probability of malicious semantics is used as the corresponding semantic risk baseline value, i.e., the text semantic risk baseline value. The probability of malicious semantics output by the model after inputting a text sequence; the baseline value of semantic risk in speech-to-text transcription. The malicious semantic probability output by the speech-to-text input model, and the baseline value of semantic risk in image description. The probability of malicious semantics output after inputting text into an image description model. Semantic decay factor. The dynamic adjustment is based on the transmission delay and semantic consistency of cross-modal data, where the transmission delay is the time difference between cross-modal data. The degree of semantic consistency is obtained by calculating the cosine similarity of the semantic feature vectors of the two modalities, and the average of the three correlation degrees is taken as the overall degree of semantic consistency. Semantic decay factor The dynamic adjustment formula is as follows ,in The maximum allowable time difference is set to 10 seconds, when the transmission delay... Semantic consistency hour, The time decay effect is the weakest; when transmission delay Seconds, semantic consistency hour, The time decay effect is strongest. This dynamic adjustment formula can flexibly adjust the semantic decay factor according to the actual situation of cross-modal data, making the calculation of the time decay effect more in line with the actual scenario, improving the calculation accuracy of cross-modal semantic risk value. The adjustment process of the semantic decay factor is carried out simultaneously with the calculation of cross-modal semantic risk value to ensure the real-time nature of the adjustment.

[0066] The above are merely preferred embodiments of the present invention and are not intended to limit the present invention in any other way. Any person skilled in the art may make changes or modifications to the above-disclosed technical content to create equivalent embodiments that can be applied to other fields. However, any simple modifications, equivalent changes, and modifications made to the above embodiments based on the technical essence of the present invention without departing from the scope of the present invention shall still fall within the protection scope of the present invention.

Claims

1. A method for protecting the input and output security of a large model based on AI dynamic interception, comprising the steps of acquiring the input and output data of the large model, and performing security detection on the input and output data, characterized in that, Also includes: S1: Perform cross-modal parsing on the input data to extract text semantic features, speech-to-text semantic features, and image description semantic features; S2: Construct a semantic association chain, which is generated based on the semantic association relationship between text semantic features, speech transcription semantic features and image description semantic features; S3: Collect user behavior characteristics and environmental characteristics. The user behavior characteristics include interaction frequency, input duration and historical risk records. The environmental characteristics include network environment type, device security level and access time. S4: Dynamic risk assessment is performed based on semantic association chains, user behavior characteristics, and environmental characteristics to generate real-time risk values; S5: Based on real-time risk values ​​and dynamically calculated interception decision thresholds, perform interception or release operations on input or output data.

2. The large model input / output security protection method based on AI dynamic interception according to claim 1, characterized in that, S1 cross-modal parsing includes: extracting text semantic features from text input data through word segmentation and part-of-speech tagging; extracting speech transcription semantic features from speech input data after it has been converted to text using a speech transcription model, using the same method as for text input data; and extracting image description semantic features from image input data after it has been converted to text description using an image description generation model, wherein the image description generation model adopts an encoder-decoder architecture.

3. The large model input / output security protection method based on AI dynamic interception according to claim 1, characterized in that, The process of constructing the semantic association chain in S2 includes: calculating the first degree of association between text semantic features and speech-to-text semantic features; calculating the second degree of association between text semantic features and image description semantic features; calculating the third degree of association between speech-to-text semantic features and image description semantic features; and constructing a network semantic association chain based on the first degree of association, the second degree of association, and the third degree of association. In the network semantic association chain, each semantic feature is a node, and the degree of association is the connection weight between nodes.

4. The large model input / output security protection method based on AI dynamic interception according to claim 1, characterized in that, The user behavior feature collection process in S3 includes: recording the timestamp of each user input through the large model interaction interface, calculating the time interval between two adjacent inputs to obtain the interaction frequency; recording the total time from the start of input to completion to obtain the input duration; retrieving records marked as risky behaviors during historical interactions from the security database bound to the user identity to obtain historical risk records; the environmental feature collection process includes: determining the network environment type through network protocol analysis, obtaining the device security level through device security detection tools, and obtaining the access time period through timestamp parsing.

5. The large model input / output security protection method based on AI dynamic interception according to claim 1, characterized in that, The dynamic risk assessment process in S4 includes: firstly, calculating the cross-modal semantic risk value using the cross-modal semantic risk correlation formula, wherein the cross-modal semantic risk correlation formula is as follows: ； in, This is a cross-modal semantic risk value, dimensionless, ranging from 0 to 1. These are text-to-speech semantic co-coefficients, dimensionless, ranging from 0 to 1. The text-image semantic co-coefficient is dimensionless and ranges from 0 to 1. These are the speech-image semantic co-coefficients, dimensionless, ranging from 0 to 1. This is a basic value for textual semantic risk, dimensionless, and ranging from 0 to 1. This is a baseline value for semantic risk in speech-to-text transcription, dimensionless, and ranging from 0 to 1. This is a basic value for semantic risk in image description, dimensionless, and ranging from 0 to 1. This is the semantic decay factor, with dimensions of 1 / second and a value range of 0.01 to 0.11 / second. The time difference between cross-modal data is expressed in seconds.

6. The large model input / output security protection method based on AI dynamic interception according to claim 5, characterized in that, The dynamic risk assessment process also includes: calculating the real-time weights of each risk dimension using a dynamic risk weight iteration formula, wherein the dynamic risk weight iteration formula is as follows: ； in, This is the real-time weight vector after the k-th iteration. It is dimensionless, and the values ​​of each dimension range from 0 to 1. This is the weight vector after the (k-1)th iteration. It is dimensionless, and the values ​​of each dimension range from 0 to 1. The step size for weight iteration is dimensionless and ranges from 0.001 to 0.

01. This represents the gradient of the risk assessment loss function at the (k-1)th iteration, and its dimensionless value. This is a user behavior risk value, dimensionless, ranging from 0 to 1. This is the environmental risk value, which is dimensionless and ranges from 0 to 1. This is a cross-modal semantic risk value, which is dimensionless and ranges from 0 to 1.

7. The large model input / output security protection method based on AI dynamic interception according to claim 6, characterized in that, In S5, the interception decision threshold is calculated using the cross-modal risk interception decision threshold formula, which is as follows: ； in, The threshold for real-time interception decisions is dimensionless and ranges from 0 to 1. The basic interception threshold is dimensionless and ranges from 0.5 to 0.

8. This is a threshold adjustment coefficient, dimensionless, with a value ranging from 0.1 to 0.

5. Let be the 2-norm of the real-time weight vector after the k-th iteration, with dimensionless dimensions. The maximum 2-norm of the weight vector, which is dimensionless. This is a real-time risk value, dimensionless, ranging from 0 to 1. This is the historical average risk value, which is dimensionless and ranges from 0 to 1.

8. The large model input / output security protection method based on AI dynamic interception according to claim 7, characterized in that, Real-time risk value The calculation method is as follows: ； in This is the transpose of the real-time weight vector after the k-th iteration. For cross-modal semantic risk values, User behavior risk value Environmental risk value, user behavior risk value The environmental risk value is obtained through normalization and weighted summation of user behavior characteristics. It is obtained through the classification, quantification, and weighted summation of environmental characteristics.

9. The large model input / output security protection method based on AI dynamic interception according to claim 6, characterized in that, Risk assessment loss function in dynamic risk weight iterative formula The mean squared error loss function is used. The iteration termination condition is that the 2-norm of the difference between the weight vectors of two adjacent iterations is less than a preset convergence threshold, or the number of iterations reaches a preset maximum number of iterations. The preset convergence threshold and the preset maximum number of iterations are determined by the security protection response time requirements of the large model.

10. The large model input / output security protection method based on AI dynamic interception according to claim 5, characterized in that, The base value of text semantic risk in the cross-modal semantic risk correlation formula Basic values ​​of semantic risk in speech-to-text transcription and the basic value of semantic risk in image description All results are calculated using a pre-trained risk semantic recognition model. This pre-trained risk semantic recognition model adopts a Transformer architecture and is generated through training on a labeled dataset containing malicious semantics, gray semantics, and normal semantics. A semantic decay factor is also included. The system is dynamically adjusted based on the transmission latency and semantic consistency of cross-modal data.

Images