Large language model black box adversarial sample generation optimization method based on emoticon disturbance

Abstract

The invention belongs to an anti-attack technology in the field of natural language processing, and relates to an emoticon disturbance-based large language model black box adversarial sample generation optimization method. According to the method, a disturbance expression mode of emotion icon insertion is constructed, a mechanism of combining continuous coding and discrete insertion is adopted, and the insertion position and the insertion type of an emotion icon are modeled into a combined black box optimization problem which can be solved in a continuous space. An insertion instruction obtained through decoding acts on an original text, model input is constructed in combination with a pre-designed cue word template, and an antagonistic text with an interference effect on a target large language model is generated. On this basis, a particle swarm optimization algorithm is introduced as a global search strategy, a search process is guided in combination with an elite solution retention mechanism, and through fitness calculation and iterative optimization, an adversarial sample capable of inducing the model to generate misprediction is obtained. The method can be used for evaluating the robustness and safety of the large language model.

Description

Technical Field

[0001] This invention belongs to the field of adversarial attack technology in natural language processing, and relates to an optimization method for generating black-box adversarial samples for large language models based on emoji perturbation. Background Technology

[0002] In recent years, generative large language models based on the Transformer architecture, such as BERT, ChatGPT, Llama, and Qwen, have achieved significant breakthroughs in the field of natural language processing. These models, pre-trained on massive corpora and fine-tuned for downstream tasks, have consistently achieved leading performance in various application scenarios, including sentiment analysis, machine translation, logical reasoning, and open-domain dialogue. With technological advancements, many traditional natural language processing tasks have gradually been unified under a text generation paradigm, enabling large language models to surpass their predecessors in multiple tasks. Although large language models possess strong language understanding and generation capabilities, their reliability and robustness remain insufficient, especially in high-risk scenarios such as healthcare, finance, and industrial control, where sensitivity to input perturbations can lead to serious consequences. Therefore, researching adversarial attack methods against large language models and evaluating their defense capabilities is crucial for identifying model vulnerabilities and improving their security.

[0003] Adversarial attacks are a widespread and well-studied security threat in machine learning systems. Through carefully crafted input perturbations, attackers can induce models to produce incorrect or more attacker-intended outputs, often imperceptible or acceptable to humans. Adversarial attacks on natural language processing primarily fall into two categories: perturbation-based methods and cue-based attacks. Perturbation-based attacks can operate at different text levels. At the sentence level, attackers can rewrite or replace entire sentences to alter their semantics. At the word level, attack methods typically employ synonym substitution, keyword deletion, and other techniques to interfere with the model's judgment. At the character level, attackers can make minor edits to individual characters, thereby interfering with the word segmenter or the model's encoding process and causing recognition errors. In addition to the aforementioned text perturbation-based attacks, cue-based attacks bypass model security constraints by designing special inputs or induce the model to generate content that violates security policies during inference. This type of risk is particularly prominent in large language models that require strict adherence to instructions.

[0004] However, existing adversarial attack methods primarily focus on perturbation design at the standard text unit level, such as character, word, or sentence-level replacement and editing, with relatively insufficient attention paid to perturbations of non-standard symbolic forms. Emojis, as a special symbolic form widely used in modern digital communication, are typically used to express emotions or pragmatic information, and their representation lies between character-level noise and symbols with certain semantic meaning. However, existing natural language models have relatively limited ability to systematically model such symbols during the training phase, potentially leading to instability in predictive behavior when processing inputs containing emojis. Furthermore, emojis are usually encoded as specific Unicode symbols in model processing and participate in inference as regular input units, increasing the complexity of existing character- or vocabulary-based detection and filtering methods when handling such inputs. Simultaneously, emojis can appear in different positions without significantly affecting syntactic structure or text readability, making existing defense mechanisms face higher uncertainty when dealing with such non-standard symbol perturbations.

[0005] While emojis provide a highly concealed and naturally integrated medium for constructing adversarial perturbations, searching for effective emoji insertion schemes within a large and discrete insertion space remains challenging. Evolutionary Computation (EC) can perform global optimization in such difficult-to-solve non-discontinuous and non-differentiable spaces, offering greater applicability compared to gradient-based optimization methods. By maintaining multiple candidate solutions at the swarm level and iteratively updating them using a stochastic search strategy, EC methods can effectively discover emoji perturbations that significantly impact the model and are difficult for defense mechanisms to detect. In particular, Particle Swarm Optimization (PSO) achieves a good balance between global exploration and local search through information sharing among particles, enabling efficient searching and generation of adversarial samples that can induce model prediction errors with a limited number of queries. Summary of the Invention

[0006] This invention proposes a method for generating adversarial examples for emojis based on particle swarm optimization and an elite strategy. It aims to address the shortcomings of existing large language models, such as insufficient robustness to non-standard symbol perturbations and inefficient and uncontrollable adversarial example generation methods. This invention models the insertion position and type of emojis as a combinatorial black-box optimization task, constructs an encoding-decoding mechanism for emoji perturbations, and employs a particle swarm optimization algorithm to perform global search and iterative optimization of the perturbation space, thereby automatically generating adversarial examples that can effectively mislead the model. This method can successfully induce large language models to produce erroneous outputs while maintaining the semantic readability of the text, achieving an effective attack.

[0007] The present invention adopts the following technical solution:

[0008] An optimization method for generating black-box adversarial examples for large language models based on emoji perturbation includes the following steps:

[0009] Step (1): Use the large language model to be attacked to perform initial inference on the input statement, obtain its original predicted category label, and confirm that the prediction result is correct, so as to ensure that the statement can be used as an effective attack target.

[0010] Step (2): Based on the preset emoji set and text length, construct a continuous encoding vector to describe the insertion position and insertion type of the emoji; and design corresponding decoding rules to map the continuous vector into an executable "emoji-position" insertion combination.

[0011] Step (3): Based on the “emoji-insertion position” instruction combination obtained in step (2), insert the corresponding emoji into the specified position of the original text to construct the candidate adversarial text; then input the candidate adversarial sample into the large language model to be attacked, obtain the predicted category and corresponding confidence after the attack, and use it to evaluate the effectiveness of the perturbation.

[0012] Step (4): Use the particle swarm optimization algorithm to update and iteratively search the perturbation coding vector. By continuously adjusting the insertion position and type of emojis, find adversarial samples that can induce the large language model to make incorrect predictions about the input text, thereby achieving an effective attack on the target model.

[0013] Further, step (1) includes the following steps:

[0014] (1.1) Based on the task format requirements of the target large language model, design prompt word templates for sentiment classification or logical reasoning tasks.

[0015] (1.2) The original input statement is denoted as The text is embedded into the prompt word template to generate the model's final input text, and its corresponding true label is denoted as... The final text is input into the large language model to be attacked, and the model outputs a set of candidate category label sequences. and the corresponding category probability distribution This indicates that the model is in The predicted probabilities on each output. The outputs are sorted from highest to lowest probability value; therefore, the label with the highest probability is: , which serves as the model's final predicted label.

[0016] (1.3) The model predicts the label and the true label if and only if the predicted label matches the true label, i.e., the following condition is met: Then the input statement A sentence is considered a target sentence that can be used to construct adversarial examples and enters the subsequent adversarial example generation process. If the above conditions are not met, the sentence is discarded and a new input sample is selected.

[0017] Furthermore, step (2) includes the following steps:

[0018] (2.1) Determine the length of the solution vector: The length of the solution vector to be encoded is obtained based on the length of the statement and the predefined proportion of inserted emoticons. The formula is as follows:

[0019]

[0020] in, This indicates the number of tokens in the input statement. This indicates the proportion of emojis inserted relative to the length of the statement. This indicates that the length of the solution vector is rounded up.

[0021] (2.2) Constructing the solution vector and dividing the encoding subspace: The length of the solution vector obtained from the formula Construct continuous solution vectors The vector consists of two sub-vectors of equal length: the first part is the position-coded component. : Used to encode the insertion position of emojis; Second part: emoji encoding components : The type used to encode emojis.

[0022] The division relationship is as follows:

[0023]

[0024] (2.3) Decode the continuous vector into a discrete set of "insertion instructions": each emoji insertion operation is represented by a pair of elements in the vector. A common description, in which, Represents the position-encoded subvector in the solution vector The One portion, Represents the position-encoded subvector in the solution vector The Each component; calculate the actual insertion position and corresponding emoji according to the following formula.

[0025] Insertion position The calculation formula is as follows:

[0026]

[0027] Emoji types The calculation formula is as follows:

[0028]

[0029] in, This indicates rounding down, ultimately resulting in a set of insertion instructions: , This indicates the number of elements in the set of insertion instructions; where, A lookup table indexing emojis to specific emoji symbols. The length of the facial expression index table;

[0030] Furthermore, step (3) includes the following steps:

[0031] (3.1) Based on the set of insertion instructions obtained in step (2), insert each emoji Inject raw text sequence The corresponding insertion position Generate adversarial text This refers to the input statement after the disturbance.

[0032] (3.2) Based on the prompt word template constructed in step (1.1), the adversarial text obtained in step (3.1) is... Fill in the template to form a complete prompt word text that can be directly input into the target large language model.

[0033] (3.3) Input the prompt text into the large language model to be attacked, obtain its output result, and extract the predicted probability value of the model on the original label in the manner of step (1.2). Define the probability value as the fitness value of the current adversarial example, which is used to measure the degree of influence of the perturbation scheme on the model prediction result, and participate in the subsequent optimization calculation as the fitness function in the particle swarm optimization algorithm.

[0034] Furthermore, step (4) includes the following steps:

[0035] (4.1) Randomly initialize the population to construct an initial population consisting of multiple solution vectors: in, To determine the population size, each solution vector is generated using a random real number encoding method;

[0036] (4.2) Execute the particle swarm optimization algorithm to obtain the optimal solution of the particle swarm optimization algorithm;

[0037] Furthermore, the particle swarm optimization algorithm described in step (4.2) includes the following steps:

[0038] (4.2.1) Calculate the fitness value of each particle.

[0039] (4.2.1.1) First, according to steps (2) and (3), the solution vector corresponding to the particle is decoded into adversarial sentence samples;

[0040] (4.2.1.2) The adversarial text Input the data into the large language model to be attacked, and obtain the model's output results and corresponding probability values ​​for all categories. And combined with the real labels obtained in step (1) The model's probability of dealing with the true label in adversarial sentences is used as the fitness value of the current particle. Among them, fitness value The smaller the value, the more the adversarial text weakens the model's confidence in the original category, meaning the stronger the attack effect.

[0041] (4.2.2) Update the individual history best position of the particle ( ) and the population's global historical best position ( The specific update steps are as follows:

[0042] (4.2.2.1) If it is the first generation population, then each particle Initialize the position of the particles, population It is the current If the best value is not found, then go to (4.2.2.2) and (4.2.2.3).

[0043] (4.2.2.2) If the fitness of each particle Then update This is the current position; otherwise, do not update.

[0044] (4.2.2.3) If the fitness of each particle Then update This is the current position; otherwise, do not update.

[0045] (4.2.3) Sort all particles in the swarm according to the fitness function value calculated in step (4.2.1);

[0046] (4.2.4) If the fitness value of a particle is in the top 80%, then the position is updated according to formula (5):

[0047]

[0048] in, For the first During the nth iteration The particle in the first Values ​​in each dimension For the first The number of particles recorded during the historical iteration process The optimal position value in each dimension The global optimal solution recorded by the particle swarm during its historical iterations is the solution at the th... Position values ​​in each dimension; For random numbers ranging from 0 to 1, choose the probability. The value range is from 0 to 1. Indicated by As the mean, with The absolute value of the variance is a Gaussian distribution.

[0049] (4.2.5) If a particle's fitness value is not in the top 80%, then perform a structured position update operation guided by elite solutions for that particle. First, based on the particle fitness ranking results, select the top 80% from the current population. The best-fit particles form an elite solution set, and an elite particle is randomly selected from this set as the teacher solution. Subsequently, using "position-expression" paired encoding elements as the basic update unit, fragment-level cross-learning operations are performed on the particles to be updated.

[0050] Let the particle In the The solution vector is composed of position-encoded subvectors. With expression encoding subvector The composition, the solution vector corresponding to the teacher particle is Then its cross-update rule based on paired segments can be expressed as:

[0051]

[0052] in, The random number is uniformly distributed in the interval [0,1]. The crossover probability; This represents a randomly selected contiguous segment interval along the insertion point index dimension. For each selected segment interval, the "position-expression" pairs of the particle within that interval are simultaneously copied from the teacher particle to the particle. The corresponding solution vector is used to ensure the structural consistency between the insertion position sorting information and the corresponding expression type.

[0053] (4.2.6) If the termination condition is met, output the optimal solution of the particle swarm optimization algorithm. The termination conditions include: reaching the maximum number of iterations, or finding adversarial text that can change the target model's predicted label (i.e., a successful attack). If the termination conditions are not met, steps (4.2.1) to (4.2.5) are repeated.

[0054] The beneficial effects of this invention are as follows: This invention aims to generate adversarial text that can effectively mislead large language models for evaluating the robustness and security of the models. By constructing a discrete perturbation representation based on emoji insertion and utilizing particle swarm optimization (PSO) to optimize in a continuous search space, this invention can efficiently locate adversarial samples with significant attack effects within a large-scale perturbation space. Compared to traditional random insertion or exhaustive search methods, this invention has significant advantages in terms of efficiency, stability, and search quality in adversarial sample generation. Furthermore, this invention maintains the semantic coherence and readability of the original text during perturbation construction, making the generated adversarial text more natural and covert, thus making it easier to circumvent model defense mechanisms. Attached Figure Description

[0055] Figure 1 This is a detailed flowchart of the present invention;

[0056] Figure 2 This is a flowchart of the emoji adversarial sample generation module of the present invention;

[0057] Figure 3 This is a schematic diagram of the solution vector encoding and decoding of the present invention, as well as the specific process of constructing adversarial examples;

[0058] Figure 4 This is a schematic diagram illustrating how the model output is obtained according to the present invention;

[0059] Figure 5 Examples of input text, prompt word templates, and adversarial text in specific embodiments of the present invention. Detailed Implementation

[0060] The present invention will now be described in detail with reference to the accompanying drawings and specific embodiments. These embodiments are based on the technical solution of the present invention and provide detailed implementation methods and specific operating procedures. However, the scope of protection of the present invention is not limited to the following embodiments.

[0061] This invention proposes a method for generating adversarial examples for emojis based on particle swarm optimization. By constructing a perturbation representation that combines continuous encoding with discrete emoji insertion operations, the insertion position and type of emojis are uniformly modeled as a black-box optimization problem solvable in a continuous space. This method uses an encoder-decoder mechanism to map potential solution vectors to specific emoji insertion instructions and employs a particle swarm optimization algorithm to perform global search and iterative updates within the perturbation space to automatically generate adversarial text that most effectively interferes with the target model. While maintaining the semantics and readability of the original sentences, this invention can effectively reduce the model's confidence in the correct label or induce it to output the wrong category, thereby achieving efficient adversarial attacks on large language models. It can be used to evaluate the robustness and security of large language models and provides a reference for the design of model protection strategies.

[0062] The method of the present invention can be used to carry out adversarial attacks on target models in natural language processing tasks, and its overall process is shown in Figure 1.

[0063] This invention specifically uses the text sentiment classification task of the large language model Qwen2-7B-Instruct as an example to verify its prediction results through adversarial attacks. The implementation methods are described in detail (e.g., Figure 1 As shown), the specific steps include:

[0064] Step (1): Use Qwen2-7B-Instruct to obtain the input text. The steps for predicting category labels include:

[0065] (1.1) Based on the instructional input format of Qwen2-7B-Instruct, construct a prompt word template suitable for sentiment classification tasks, the structure of which is as follows: Figure 5 As shown;

[0066] (1.2) Transfer the original input text Embedded into the prompt word template constructed in step (1.1), a complete prompt word text that can be directly input into Qwen2-7B-Instruct is generated, thus forming the final input content of the model. The model outputs a set of candidate category label sequences. and the corresponding category probability distribution In this specific implementation, the predicted category of the original text is "positive".

[0067] Step (2): Construct the solution vector and decode it into the corresponding emoji insertion scheme, which includes the following implementation steps:

[0068] (2.1) Based on the original input text of Quantity is recorded as and preset emoji insertion ratio Calculate the length of the solution vector ;

[0069] (2.2) The length of the solution vector obtained from the formula , construct as Figure 3 The continuous solution vector shown The vector consists of two sub-vectors of equal length: the first part... V p ∈ [0,1] N*r : Used to encode the insertion position of emojis; Part Two V e ∈ [0,100] N*r : The type used to encode emojis.

[0070] (2.3) Each emoji insertion operation consists of a pair of elements in the vector. According to the corresponding decoding formula, the pair of components can be mapped to the actual insertion position and the emoji to be inserted, respectively, thus generating an emoji like... Figure 3 The combination of decoded and inserted instructions is shown.

[0071] Insertion position calculation:

[0072]

[0073] Emoji type calculation:

[0074]

[0075] Furthermore, step (3) includes the following steps:

[0076] (3.1) Based on the set of insertion instructions obtained in step (2), insert each emoji Inject raw text sequence The corresponding insertion position , generate as Figure 3 The adversarial text shown This refers to the input statement after the disturbance.

[0077] (3.2) Based on the prompt word template constructed in step (1.1), the adversarial text obtained in step (3.1) is... Fill in the template to form a shape like Figure 5 The text shown is the complete prompt word text that can be directly input into the target large language model.

[0078] (3.3) Input the prompt text into the large language model to be attacked, obtain its output, and extract the predicted probability value of the model on the original label in the same way as in step (1.1). Define the probability value as the fitness value of the current adversarial example for subsequent fitness calculation and attack effect evaluation.

[0079] Step (4): Search for adversarial examples based on the particle swarm optimization algorithm combined with an elite strategy. The process for generating adversarial examples for emoticons is as follows: Figure 2 As shown, the specific steps include:

[0080] (4.1) Particle swarm initialization: Initialize a set of particle solution vectors according to step (2.2). Particle swarm size Maximum number of iterations It is 100;

[0081] (4.2) Calculate the fitness of the particles. The overall process of calculating the fitness value of the designed particle swarm optimization algorithm is as follows: Figure 4 As shown, the steps include:

[0082] (4.2.1) Particle decoding into a set of insertion instructions: based on the corresponding "position encoding component" in the particle solution vector. "and "emoji encoding components" "Perform paired parsing according to step (2.3), such as..." Figure 3 The diagram shows that each pair of components is mapped to a specific "insertion position – emoji" instruction pair;

[0083] (4.2.2) Combine the inserted instruction pair with the original statement to generate candidate adversarial text, and combine it with the designed prompt word template to construct a complete prompt word;

[0084] (4.2.3) Input the complete prompt word into the target large language model Qwen2-7B-Instruct to obtain the prediction results of the model in each category and the corresponding prediction probability, and define the probability value as the fitness value of the current adversarial example.

[0085] (4.3) Sort all particles in the swarm according to their fitness, and then update the individual and global best positions of the swarm.

[0086] (4.3.1) The formula for the solution vector of particles whose fitness ranks in the top 80% is as follows:

[0087]

[0088] in, The number of iterations is At that time, the first The particle in the first The value of dimension, For the number of iterations The best position in the overall historical context at that time. The number of iterations is Time The best position in the individual history of each particle For random numbers ranging from 0 to 1, in this example, a probability is selected. The value is 0.7. Indicated by As the mean, with The absolute value of the variance is a Gaussian distribution, and the particles are updated by perturbation through this distribution;

[0089] (4.3.2) If a particle's fitness value is not in the top 80%, a structured position update operation guided by elite solutions is performed on that particle. Based on the particle fitness ranking results, the top 15 particles with the best fitness in the current population are selected to form an elite solution set, and an elite particle is randomly selected from this elite solution set as the teacher solution. Subsequently, using the "position-expression" paired encoding elements as the basic update unit, a fragment-level cross-learning operation is performed on the particle to be updated.

[0090] Let the particle In the The solution vector is composed of position-encoded subvectors. With expression encoding subvector Composition, the code corresponding to the teacher particle is Then its cross-update rule based on paired segments can be expressed as:

[0091]

[0092] in, The random number is uniformly distributed in the interval [0,1]. The crossover probability is set to 0.7 in this example. A continuous segment is randomly selected from all insertion points, and the corresponding position encoding subvector and expression encoding subvector within the segment are copied from the teacher particle to the current particle in pairs to update the position of the particle.

[0093] During the aforementioned crossover process, all updated encoded values ​​are initially restricted to their corresponding legal value ranges through boundary constraints to ensure that the solution vector always satisfies the definition of the encoding space.

[0094] (4.4) Repeat steps (4.2) to (4.3) until the iteration termination condition is met; stop iterating when the maximum number of iterations is reached or an adversarial example that can change the target model's predicted label has been found. If the termination condition is not met, the number of iterations is increased. ++, and continue to the next iteration.

[0095] Figure 5This document illustrates the input text, prompt word template, and generated adversarial text examples used in the specific implementation of this invention. The upper part of the example demonstrates the original prediction result obtained by embedding the original input sentence into the prompt word template and inputting it into a large language model. The lower part of the example shows the adversarial text obtained after injecting an emoji perturbation generated according to the encoder-decoder mechanism and particle swarm optimization strategy described in this invention into the original sentence, and the resulting change in the predicted label. As shown in the figure, although the adversarial text only inserts three emojis into the sentence without changing the original semantics and readability, this perturbation is sufficient to change the target large language model's original "Positive" judgment to "Negative," thus verifying the effectiveness of the adversarial sample generation method of this invention in misleading the model's output.

Claims

1. An optimization method for generating black-box adversarial examples for large language models based on emoji perturbation, characterized in that, Includes the following steps: Step (1): Use the large language model to be attacked to perform initial inference on the input statement, obtain its original predicted category label, and confirm that the prediction result is correct, so as to ensure that the statement can be used as an effective attack target; Step (2): Based on the preset emoji set and text length, construct a continuous encoding vector to describe the insertion position and insertion type of the emoji; and design corresponding decoding rules to map the continuous vector into an executable "emoji-position" insertion combination; Step (3): Based on the "emoji-insertion position" instruction combination obtained in step (2), insert the corresponding emoji into the specified position of the original text to construct candidate adversarial text; The candidate adversarial sample is then input into the large language model to be attacked to obtain the predicted category and corresponding confidence level after the attack, which is used to evaluate the effectiveness of the perturbation. Step (4): Use the particle swarm optimization algorithm to update and iteratively search the perturbation coding vector. By continuously adjusting the insertion position and type of emojis, find adversarial samples that can induce the large language model to make incorrect predictions about the input text, thereby achieving an effective attack on the target model.

2. The method for generating and optimizing black-box adversarial examples for a large language model based on emoji perturbation as described in claim 1, characterized in that, Step (1) includes the following steps: (1.1) Based on the task format requirements of the target large language model, design prompt word templates for sentiment classification or logical reasoning tasks; (1.2) Record the original input statement as The text is embedded into the prompt word template to generate the model's final input text, and its corresponding true label is denoted as... The final text is input into the large language model to be attacked, and the model outputs a set of candidate category label sequences. and the corresponding category probability distribution This indicates that the model is in The predicted probabilities of each output; the outputs are sorted from highest to lowest probability value, therefore the label with the highest probability is: , as the final predicted label of the model; (1.3) The model predicts the label and the true label if and only if the predicted label matches the true label, i.e., the following condition is met: Then the input statement If a sentence is deemed suitable for constructing adversarial samples, it is considered a target sentence and proceeds to the subsequent adversarial sample generation process. If the above conditions are not met, the sentence is discarded and a new input sample is selected.

3. The method for generating and optimizing black-box adversarial examples for a large language model based on emoji perturbation as described in claim 1, characterized in that, Step (2) includes the following steps: (2.1) Determine the length of the solution vector: The length of the solution vector to be encoded is obtained based on the length of the statement and the predefined proportion of inserted emoticons. The formula is as follows: ； in, This indicates the number of tokens in the input statement. This indicates the proportion of emojis inserted relative to the length of the statement. This indicates that the length of the solution vector is rounded up. (2.2) Constructing the solution vector and dividing the encoding subspace: The length of the solution vector obtained from the formula Construct continuous solution vectors The vector consists of two sub-vectors of equal length: the first part is the position-coded component. : Used to encode the insertion position of emojis; Second part: emoji encoding components : The type used to encode emojis; The division relationship is as follows: V =[ V p V e # 2 ； (2.3) Decode the continuous vector into a discrete set of "insertion instructions": each emoji insertion operation is represented by a pair of elements in the vector. A common description, in which, Represents the position-encoded subvector in the solution vector The One portion, Represents the position-encoded subvector in the solution vector The Each component; calculate the actual insertion position and corresponding emoji according to the following formula; Insertion position The calculation formula is as follows: ； Emoji types The calculation formula is as follows: e i =EmojiTable M ⋅ V i e 100 # 4 ； in, This indicates rounding down, ultimately resulting in a set of insertion instructions: , This indicates the number of elements in the set of insertion instructions; where, A lookup table indexing emojis to specific emoji symbols. This represents the length of the facial expression index table.

4. The method for generating and optimizing black-box adversarial examples for a large language model based on emoji perturbation as described in claim 1, characterized in that, Step (3) includes the following steps: (3.1) Based on the set of insertion instructions obtained in step (2), insert each emoji Inject raw text sequence The corresponding insertion position Generate adversarial text This refers to the input statement after the disturbance. (3.2) Based on the prompt word template constructed in step (1.1), the adversarial text obtained in step (3.1) is... Fill in the template to form a complete prompt word text that can be directly input into the target large language model; (3.3) Input the prompt text into the large language model to be attacked, obtain its output result, and extract the predicted probability value of the model on the original label in the manner of step (1.2). Define the probability value as the fitness value of the current adversarial example, which is used to measure the degree of influence of the perturbation scheme on the model prediction result, and participate in the subsequent optimization calculation as the fitness function in the particle swarm optimization algorithm.

5. The method for generating and optimizing black-box adversarial examples for a large language model based on emoji perturbation as described in claim 1, characterized in that, Step (4) includes the following steps: (4.1) Randomly initialize the population to construct an initial population consisting of multiple solution vectors: in, To determine the population size, each solution vector is generated using a random real number encoding method; (4.2) Execute the particle swarm optimization algorithm to obtain the optimal solution of the particle swarm optimization algorithm; (4.2.1) Calculate the fitness value of each particle; (4.2.1.1) First, according to steps (2) and (3), the solution vector corresponding to the particle is decoded into adversarial sentence samples; (4.2.1.2) The adversarial text Input the data into the large language model to be attacked, and obtain the model's output results and corresponding probability values ​​for all categories. And combined with the real labels obtained in step (1) The model's probability of dealing with the true label in adversarial sentences is used as the fitness value of the current particle. Among them, fitness value The smaller the value, the more the adversarial text weakens the model's confidence in the original category, meaning the stronger the attack effect. (4.2.2) Update the individual history best position of the particle ( ) and the population's global historical best position ( The specific update steps are as follows: (4.2.2.1) If it is the first generation population, then each particle Initialize the position of the particles, population It is the current If the best value is not found, then go to (4.2.2.2) and (4.2.2.3). (4.2.2.2) If the fitness of each particle Then update This is the current position; otherwise, do not update. (4.2.2.3) If the fitness of each particle Then update This is the current position; otherwise, do not update. (4.2.3) Sort all particles in the swarm according to the fitness function value calculated in step (4.2.1); (4.2.4) If the fitness value of a particle is in the top 80%, then the position is updated according to formula (5): ； in, For the first During the nth iteration The particle in the first Values ​​in each dimension For the first The number of particles recorded during the historical iteration process The optimal position value in each dimension The global optimal solution recorded by the particle swarm during its historical iterations is the solution at the th... Position values ​​in each dimension; For random numbers ranging from 0 to 1, choose the probability. The value range is from 0 to 1. Indicated by As the mean, with The absolute value of the variance is a Gaussian distribution; (4.2.5) If a particle's fitness value is not in the top 80%, then perform a structured position update operation based on elite solutions for that particle; first, select the top 80% from the current population according to the particle fitness ranking results. The best-fit particles form an elite solution set, and an elite particle is randomly selected from this set as the teacher solution. Then, using the "position-expression" paired encoding elements as the basic update unit, a fragment-level cross-learning operation is performed on the particle to be updated. Let the particle In the The solution vector is composed of position-encoded subvectors. With expression encoding subvector The composition, the solution vector corresponding to the teacher particle is Then its cross-update rule based on paired segments can be expressed as: ； in, The random number is uniformly distributed in the interval [0,1]. The crossover probability; This represents a randomly selected contiguous segment interval along the insertion point index dimension; for each selected segment interval, the "position-expression" pairs of the particle within that interval are simultaneously copied from the teacher particle to the particle. The corresponding solution vector is used to ensure the structural consistency between the insertion position sorting information and the corresponding expression type; (4.2.6) If the termination condition is met, output the optimal solution of the particle swarm optimization algorithm. The termination conditions include: reaching the maximum number of iterations, or finding adversarial text that can change the target model's predicted label, i.e., the attack is successful; if the termination conditions are not met, then (4.2.1) to (4.2.5) are repeated.

Images