Large language model integrity verification method and system based on output feature distribution statistical test

Abstract

The invention discloses a large language model integrity verification method and system based on output feature distribution statistical test, and belongs to the field of artificial intelligence safety. In order to solve the problem of unreliable verification caused by output randomness of a large language model, the method comprises the following steps of: obtaining model finger with expected output and actual output of a to-be-verified model; performing multi-level feature extraction on expected and actual outputs to obtain two groups of feature vector sets; and performing double-sample statistical test on the two groups of feature vector sets to judge whether the feature distribution has significant difference or not. Preferably, the check is a maximum mean difference (MMD) check in conjunction with a permutation check to obtain reliable p values in small samples. And finally, judging the integrity of the model according to a comparison result of the p value and a preset significance level. According to the method, random interference can be overcome, model tampering can be detected with high sensitivity by using a small amount of API calling, and the robustness and reliability of verification are remarkably improved.

Description

A method and system for verifying the integrity of large language models based on statistical tests of output feature distributions Technical Field

[0001] This invention belongs to the field of artificial intelligence security and trusted computing, specifically relating to a method and system for verifying the integrity of large language models (LMs), and in particular a verification method capable of handling the randomness of model output. Background Technology

[0002] When using model fingerprints to verify the integrity of large language models deployed in the cloud, the basic process involves querying the cloud model using a set of preset sensitive prompts and comparing the returned actual output with the expected output stored in the fingerprint. However, large language models are inherently generative models, and their decoding process typically includes random sampling steps (e.g., controlled by parameters such as temperature, top-p, or top-k). This results in even the same model and the same input potentially producing slightly different output texts under multiple queries.

[0003] This inherent randomness in output presents a fundamental challenge to integrity verification. Traditional methods that rely on precise string matching or simple similarity comparison based on output results are almost entirely ineffective in this scenario. Even the original, completely unmodified model may produce outputs that differ from the expected output in the fingerprint due to randomness, leading to a large number of false positives (identifying a normal model as tampered). Conversely, relaxing the comparison threshold to tolerate this randomness may result in false negatives, failing to detect subtle output changes caused by minor parameter modifications.

[0004] Therefore, designing a verification method that can effectively distinguish between "inherent random fluctuations in the model" and "systematic output differences caused by model tampering" has become a key technical challenge that urgently needs to be solved in this field. Summary of the Invention

[0005] (I) Technical problem to be solved The present invention aims to solve the problem that existing large language model integrity verification methods are difficult to handle the randomness of model output, resulting in unreliable verification results, and provides an integrity verification method and system based on statistical principles that can make high-confidence judgments under random interference.

[0006] (II) Technical Solution To solve the above technical problems, this embodiment of the invention provides a method for verifying the integrity of a large language model based on statistical testing of output feature distribution. The method includes the following steps: S100: Obtaining a model fingerprint of a large language model to be verified, and an actual output set generated by the large language model to be verified for sensitive prompt words in the model fingerprint; the model fingerprint includes a set of sensitive prompt words and a corresponding expected output set; S200: Extracting feature vectors from each output text in the expected output set and the actual output set, respectively, to obtain an expected feature vector set and an actual feature vector set; S300: Performing a two-sample statistical test on the expected feature vector set and the actual feature vector set to determine whether there is a statistically significant difference in the feature distribution represented by the two sets, and obtaining a test result; S400: Determining the integrity status of the large language model to be verified based on the test result.

[0007] Furthermore, in step S200, the method for extracting feature vectors is multi-level feature extraction, and the extracted features include at least: surface text features, semantic representation features, and / or task-specific features.

[0008] Furthermore, in step S300, the two-sample statistical test is a non-parametric kernel method test, specifically the Maximum Mean Discrepancy (MMD) test.

[0009] Furthermore, in step S300, to improve the reliability of the test under small sample conditions, the statistical test also incorporates the permutation test technique to calculate the p-value of the test result.

[0010] Further, in step S400, the method for determining the integrity status of the large language model to be verified includes: comparing the p-value with a preset significance level. Compare; if the p-value is less than If the condition is met, it is determined that the integrity of the large language model to be verified has been compromised; otherwise, it is determined that its integrity has been preserved.

[0011] Another embodiment of the present invention provides a large language model integrity verification system based on statistical testing of output feature distribution. The system includes: a data and fingerprint acquisition module for acquiring a model fingerprint of a large language model to be verified and its actual output set; a feature extraction module for extracting feature vectors from the expected output and the actual output in the fingerprint, respectively, to obtain an expected feature vector set and an actual feature vector set; a statistical testing module for performing a two-sample statistical test on the expected feature vector set and the actual feature vector set to determine whether there is a significant difference in the feature distributions represented by the two, and outputting a test result; and an integrity decision module for determining the integrity status of the large language model to be verified based on the test result.

[0012] Furthermore, the statistical testing module is configured to perform the maximum mean difference (MMD) test and combine it with a permutation test to calculate the p-value.

[0013] (III) Beneficial Effects Compared with the prior art, the present invention has the following beneficial effects: 1. Strong robustness: The present invention does not directly compare the original text with strong randomness, but extracts stable feature vectors and compares their distribution, which can effectively filter out the interference of random noise and significantly improve the stability and robustness of the verification results.

[0014] 2. High sensitivity: By using advanced distribution testing methods such as maximum mean difference (MMD), this invention can capture subtle changes in the output feature distribution caused by model parameter modifications, and has high sensitivity for detecting modifications that are difficult to detect, such as minor quantification and parameter fine-tuning.

[0015] 3. High efficiency with small sample size: This invention combines permutation test technology, which enables it to provide reliable statistical judgments even with small sample size (i.e., fewer API calls and smaller fingerprint size), making it very suitable for practical application scenarios where API call costs are limited.

[0016] 4. Method universality: The multi-level feature extraction and statistical testing framework of this invention has good universality, does not depend on specific model architecture or task type, and can be widely used for integrity verification of various large language models. Attached Figure Description

[0017] Figure 1 is a flowchart of a method for verifying the integrity of a large language model based on statistical tests of output feature distribution according to an embodiment of the present invention.

[0018] Figure 2 is a structural block diagram of an integrity verification system according to an embodiment of the present invention.

[0019] Figure 3 is a more detailed flowchart of the statistical test process in step S300 of Figure 1, showing the implementation details of combining MMD and permutation test. Detailed Implementation

[0020] To make the objectives, technical solutions, and advantages of the present invention clearer, the present invention will be further described in detail below with reference to the accompanying drawings and specific embodiments.

[0021] Please refer to Figure 1, which illustrates the flow of an integrity verification method according to an embodiment of the present invention.

[0022] Step S100: Obtain the model fingerprint and actual output.

[0023] This step marks the beginning of the verification process. The user or device performing the verification must first possess the fingerprint of the target's original model. ,in It is a set of sensitive prompt words. This corresponds to the expected output. Meanwhile, users can access the API interface... Query the cloud model to be verified to obtain the actual output set. .

[0024] Step S200: Extract feature vectors.

[0025] This is a crucial step in dealing with randomness. We do not directly compare texts. and Instead of mapping them to a more stable and easily comparable feature space, this embodiment employs a multi-level feature extraction strategy for each output text (whether expected or not). Or practical Extract a comprehensive feature vector z from each.

[0026] Surface text features: These calculate text length, average word length, lexical richness (number of distinct lemmas / total lemmas), frequency of specific keywords, etc. These features are fast to calculate and can reflect macroscopic changes in output style.

[0027] Semantic representation features: Using a separate, pre-trained encoder model (such as BERT, RoBERTa, etc.), the output text is encoded into a fixed-dimensional vector (e.g., 768-dimensional). This vector captures the deep semantic information of the text. Even if two sentences have different wording, if their meanings are similar, their semantic vectors should also be similar.

[0028] Task-specific features: If the sensitive prompts are designed for a specific task (such as a math problem or a knowledge-based question), we can extract task-related features from the output. For example, for a math problem, we can extract the final numerical answer; for a knowledge-based question, we can determine whether the answer is correct (yes / no).

[0029] These three types of features are concatenated or combined using a weighted method to form the final feature vector z. After this step, we obtain two sets of feature vectors: the expected feature vector set. and the actual set of feature vectors .

[0030] Step S300: Perform a two-sample statistical test.

[0031] Now, the verification problem is transformed into a classic statistical problem: determining the set. and Whether they come from the same probability distribution. Since k (number of API calls) is usually small (e.g., 8-15 times), we need a test method that is robust to small samples. This embodiment uses the maximum mean difference (MMD) test.

[0032] The core idea of ​​MMD is that if two distributions are identical, then samples taken from these two distributions should have very similar means in some reproducing kernel Hilbert space (RKHS). The value of MMD is the distance between these two means. Its empirical estimator can be calculated by the following formula:

[0033] in It is a kernel function, usually a Gaussian kernel. If two sets come from the same distribution, The value should be close to 0.

[0034] In order to determine the observed To determine whether the value is "large enough" to conclude that the distributions are different, we combine the permutation test to calculate the p-value, as shown in Figure 3: 1. Calculate the observation statistic: First, based on the original two groups of samples... and The observed MMD value was calculated and denoted as . .

[0035] 2. Merging and Replacing: [This section appears to be incomplete and requires further context.] and They are merged into a large set containing 2k samples.

[0036] 3. Generate permutation samples: Perform a large number of random permutation samplings (e.g., M=1000 times) from a large set. In each sampling, k samples are randomly selected without replacement as the new "expected group", and the remaining k samples are the new "actual group".

[0037] 4. Calculate the permutation statistic: For each permutation, calculate an MMD value for the two groups of samples generated, resulting in a zero distribution of MMD containing M values. This distribution represents what the MMD value would look like "when the null hypothesis (i.e., the two distributions are the same) holds".

[0038] 5. Calculate the p-value: Calculate what percentage of the values ​​in the null distribution are greater than or equal to the values ​​we actually observe.

[0039] in It is an indicator function.

[0040] Step S400: Determine completeness based on the inspection results.

[0041] The p-value represents the probability that "if the model is complete, we would observe such a large difference." We presuppose a significance level. (Usually 0.05 or 0.01).

[0042] if This indicates that the difference we observed is an event with extremely low probability. Therefore, we have sufficient reason to reject the null hypothesis and determine that the integrity of the model to be verified has been compromised.

[0043] if This indicates that we do not have sufficient evidence to reject the null hypothesis, and therefore the integrity of the model to be verified is maintained.

[0044] Please refer to Figure 2, which shows a structural block diagram of an integrity verification system according to an embodiment of the present invention. This system can be provided as a software service and includes: a data and fingerprint acquisition module 10: responsible for receiving model fingerprints uploaded by users or retrieved from a database, managing API interactions with cloud models, and obtaining actual output.

[0045] Feature extraction module 20: Internally implements the above-mentioned multi-level feature extraction algorithm, which processes the original text output into a structured feature vector.

[0046] Statistical testing module 30: This is the core computing engine of the system. It implements the MMD and permutation test algorithms and is responsible for calculating the two sets of feature vectors and outputting the final p-value.

[0047] Integrity Decision Module 40: Receives the p-value from the statistical test module 30 and determines the significance level accordingly. Make a final determination of whether it is "complete" or "modified" and present the result to the user.

[0048] This invention, through a series of systematic steps, successfully solves the verification problem caused by the randomness of large language model outputs, providing important technical support for the development of trustworthy AI.

Claims

1. A method for verifying the integrity of a large language model based on statistical tests of output feature distribution, characterized in that, include: Obtain a model fingerprint and an actual output set of a large language model to be validated, wherein the model fingerprint includes a set of sensitive prompt words and a corresponding set of expected outputs; extract feature vectors for each expected output in the expected output set and each actual output in the actual output set, thereby obtaining a set of expected feature vectors and a set of actual feature vectors; perform a two-sample statistical test on the set of expected feature vectors and the set of actual feature vectors to determine whether there is a statistically significant difference in the feature distributions represented by the two sets, and obtain a test result; based on the test result, determine the integrity status of the large language model to be validated.

2. The method according to claim 1, characterized in that, The method for extracting feature vectors is a multi-level feature extraction method, and the feature vectors contain features selected from at least one of the following categories: surface text features, semantic representation features, or task-specific features.

3. The method according to claim 1, characterized in that, The two-sample statistical test is the Maximum Mean Discrepancy (MMD) test.

4. The method according to claim 3, characterized in that, The test result is a p-value, which is calculated by combining the permutation test technique to improve the reliability of the test under small sample conditions.

5. The method according to claim 4, characterized in that, The steps for determining the integrity status of the large language model to be verified include: comparing the p-value with a preset significance level; if the p-value is less than the significance level, then determining that the integrity of the large language model to be verified has been compromised.

6. A system for verifying the integrity of a large language model based on statistical tests of output feature distribution, characterized in that, include: A data and fingerprint acquisition module is used to acquire a model fingerprint and the actual output set of a large language model to be verified; A feature extraction module is used to extract feature vectors from the expected output and the actual output in the model fingerprint, respectively, to obtain an expected feature vector set and an actual feature vector set; a statistical test module is used to perform a two-sample statistical test on the expected feature vector set and the actual feature vector set to determine whether there is a significant difference in the feature distribution represented by the two, and output a test result. An integrity decision module is used to determine the integrity status of the large language model to be verified based on the test results.

7. The system according to claim 6, characterized in that, The feature extraction module is configured to perform multi-level feature extraction to generate feature vectors that include surface text features, semantic representation features, or task-specific features.

8. The system according to claim 6, characterized in that, The statistical test module is configured to perform the maximum mean difference (MMD) test and combine it with a permutation test to calculate a p-value as the test result.

Images